@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/lib/website-enrichment.mjs

@@ -0,0 +1,404 @@
+// Bounded website and network enrichment, independent of registration authority.
+import { capturedWebCollectionQuality } from "../packages/evidence/collection-quality.mjs";
+import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
+import { recordOrEmpty as errorRecord } from "./json-record.mjs";
+import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
+import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
+import { collectDnsIntelligence, skippedDnsIntelligence } from "./dns-intelligence.mjs";
+import { fetchFaviconHash } from "./favicon.mjs";
+import { extractHtmlSignals } from "./html-signals.mjs";
+import { analyzeStaticHtml } from "./static-html-analysis.mjs";
+import { featureDecision, networkFeaturePolicy } from "./feature-policy.mjs";
+import { withoutHttpDeliveryMetadata, buildHttpObservation, failedHttpObservation, skippedHttpObservation } from "./http-intelligence.mjs";
+import { collectTlsIntelligence, skippedTlsObservation } from "./tls-intelligence.mjs";
+import { analyzeWebsiteSecurityPosture } from "./website-security-posture.mjs";
+import { analyzeWebsiteTechnology, captureTechnologyResponseHeaders, } from "./website-technology.mjs";
+import { analyzeResponsePolicyHeaders, qualifyResponsePolicyWithCspMeta, } from "./response-policy.mjs";
+import { nonEmptyErrorMessage } from "./error-detail.mjs";
+import { prepareSelectedLookupUrl } from "../packages/evidence/lookup-target.mjs";
+import { HOMEPAGE_FETCH_TIMEOUT_MS, MAX_HOMEPAGE_BYTES, } from "./outbound-request-bounds.mjs";
+// No marketplace (Afternic/Sedo/Dan.com/GoDaddy Auctions/etc.) offers a
+// free, no-auth API to check "is this specific domain listed for sale" -
+// what's checkable without credentials is the parking/landing-page
+// nameservers and homepage copy these services actually use, which is
+// broader coverage of the same signal, not a live cross-marketplace lookup.
+const PARKING_NS_DOMAINS = [
+    'sedoparking.com',
+    'sedo.com',
+    'above.com',
+    'bodis.com',
+    'parkingcrew.net',
+    'dan.com',
+    'hugedomains.com',
+    // https://www.atom.com/help/article/how-to-verify-your-standard-premium-domains
+    'squadhelp.com',
+    // https://blog.afternic.com/lander-selection-redefining-your-use-of-afternic-landing-pages/
+    'afternic.com',
+    'voodoo.com',
+    'fabulous.com',
+    'smartname.com',
+    'domainsponsor.com',
+    'undeveloped.com',
+    'trafficz.com',
+    'dsredirection.com',
+];
+function isParkingNameserver(value) {
+    const hostname = value.trim().replace(/\.$/u, '');
+    // Validate before case folding: non-ASCII letters can lowercase to ASCII.
+    if (!isValidAsciiHostname(hostname))
+        return false;
+    const normalised = hostname.toLowerCase();
+    return PARKING_NS_DOMAINS.some(domain => normalised === domain || normalised.endsWith(`.${domain}`));
+}
+const FOR_SALE_PATH_RE = /\/(?:premium-)?domains?-for-sale(?:\/|$)/i;
+function forSaleRedirectSignal(httpObservation) {
+    if (!httpObservation || typeof httpObservation !== 'object')
+        return null;
+    const observation = httpObservation;
+    const urls = [
+        observation.finalUrl,
+        ...(Array.isArray(observation.redirects)
+            ? observation.redirects.map((redirect) => redirect && typeof redirect === 'object' ? redirect.to : null)
+            : []),
+    ];
+    for (const value of urls) {
+        if (typeof value !== 'string' || value.length > 2048)
+            continue;
+        try {
+            const url = new URL(value);
+            if (['http:', 'https:'].includes(url.protocol) && FOR_SALE_PATH_RE.test(url.pathname)) {
+                return `for-sale landing-page redirect (${url.origin}${url.pathname})`;
+            }
+        }
+        catch {
+            // Malformed retained provenance cannot establish a sale signal.
+        }
+    }
+    return null;
+}
+// Fetches enough of the homepage for the lightweight HTML signals below and
+// preserves why the probe failed. A failed request is not evidence that a
+// domain has "no site": transient DNS/TLS/network failures, a slow origin, or
+// an HTTP error can all produce the same null body. Keeping that distinction
+// avoids turning an inconclusive probe into a false inactivity claim.
+async function fetchHomepage(domain, { fetcher = safeFetchDetailed, timeoutMs = HOMEPAGE_FETCH_TIMEOUT_MS, selectedUrl, signal } = {}) {
+    const selected = selectedUrl === undefined ? null : prepareSelectedLookupUrl(selectedUrl, domain);
+    const requestTimeoutMs = Number.isInteger(timeoutMs) && timeoutMs >= 10 && timeoutMs <= HOMEPAGE_FETCH_TIMEOUT_MS
+        ? timeoutMs
+        : HOMEPAGE_FETCH_TIMEOUT_MS;
+    const headers = whoisleuthRequestHeaders();
+    const failures = [];
+    const probeStartedAt = Date.now();
+    for (const requestUrl of selected ? [selected] : [`https://${domain}`, `http://${domain}`]) {
+        signal?.throwIfAborted();
+        const scheme = new URL(requestUrl).protocol.slice(0, -1);
+        const attemptStartedAt = Date.now();
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), requestTimeoutMs);
+        try {
+            const fetched = await fetcher(requestUrl, { signal: signal ? AbortSignal.any([signal, controller.signal]) : controller.signal, headers });
+            const fetchedResponse = fetched instanceof Response ? fetched : fetched.response;
+            const detail = fetched && typeof fetched === 'object' && 'response' in fetched
+                ? fetched
+                : {
+                    response: fetchedResponse,
+                    requestedUrl: requestUrl,
+                    finalUrl: requestUrl,
+                    redirectCount: 0,
+                    redirectLimitReached: false,
+                    hops: [{ url: requestUrl, status: fetchedResponse.status, location: null, durationMs: Date.now() - attemptStartedAt }],
+                    durationMs: Date.now() - attemptStartedAt,
+                };
+            const res = detail.response;
+            const analysisBase = new URL(detail.finalUrl);
+            analysisBase.search = '';
+            analysisBase.hash = '';
+            // Retain an explicitly partial prefix when the body exceeds its bound;
+            // downstream analyses must not treat it as a complete page. The
+            // timeout stays armed through this read (cleared in `finally` below,
+            // not here) - a malicious site could otherwise send headers
+            // immediately and then trickle or stall the body forever, hanging
+            // this worker with no deadline once the timer above is disarmed.
+            if (res.ok) {
+                const body = await readTextCapped(res, MAX_HOMEPAGE_BYTES, { includeSha256: true });
+                return {
+                    text: body.text,
+                    status: 'fetched',
+                    detail: `${selected ? 'Selected URL' : 'Homepage'} responded over ${scheme.toUpperCase()} (HTTP ${res.status}).`,
+                    responsePolicy: analyzeResponsePolicyHeaders(res.headers),
+                    technologyHeaders: captureTechnologyResponseHeaders(res.headers),
+                    ...(selected ? { analysisBaseUrl: analysisBase.toString() } : {}),
+                    http: buildHttpObservation({ ...detail, durationMs: Date.now() - attemptStartedAt }, {
+                        previousAttempts: failures,
+                        capturedBodyBytes: body.bytesRead,
+                        bodyInspected: true,
+                        bodyTruncated: body.truncated,
+                        bodySha256: body.sha256,
+                    }),
+                };
+            }
+            // A non-2xx HTTP response still conclusively proves that a web service
+            // answered on this domain. It may block this probe (403), require auth
+            // (401), have a broken homepage route (404), or be unhealthy (5xx), but
+            // none of those are equivalent to "no website". We cannot inspect its
+            // HTML signals, so preserve a separate responded status and release the
+            // unused body.
+            await res.body?.cancel().catch(() => { });
+            return {
+                text: null,
+                status: 'responded',
+                detail: `Web server responded over ${scheme.toUpperCase()} (HTTP ${res.status}); ${selected ? 'selected page' : 'homepage'} content was not available for inspection.`,
+                responsePolicy: analyzeResponsePolicyHeaders(res.headers),
+                technologyHeaders: captureTechnologyResponseHeaders(res.headers),
+                http: buildHttpObservation({ ...detail, durationMs: Date.now() - attemptStartedAt }, {
+                    previousAttempts: failures,
+                    capturedBodyBytes: 0,
+                    bodyInspected: false,
+                }),
+            };
+        }
+        catch (err) {
+            signal?.throwIfAborted();
+            const error = errorRecord(err);
+            const reason = error.name === 'AbortError'
+                ? `timed out after ${requestTimeoutMs} milliseconds`
+                : selected ? 'request failed; the selected URL was not retried at another path or scheme'
+                    : nonEmptyErrorMessage(err, 'request failed')
+                        .replace(/[\u0000-\u001f\u007f]+/g, ' ')
+                        .slice(0, 180);
+            failures.push({ url: requestUrl, error: `${scheme.toUpperCase()} ${reason}` });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    return {
+        text: null,
+        status: 'inconclusive',
+        detail: failures.length
+            ? `Could not confirm ${selected ? 'selected URL' : 'homepage'} activity: ${failures.map((attempt) => attempt.error).join('; ')}.`
+            : 'Could not confirm homepage activity.',
+        http: failedHttpObservation(failures, { durationMs: Date.now() - probeStartedAt }),
+    };
+}
+function deriveWebsiteActivity(homepageStatus, hasFavicon, alreadyParked = false) {
+    if (alreadyParked)
+        return 'parked';
+    if (homepageStatus === 'fetched' || homepageStatus === 'responded' || hasFavicon)
+        return 'active';
+    return 'unreachable';
+}
+async function enrichWebsite(context, options, featurePolicy) {
+    options.signal?.throwIfAborted();
+    const { domain, observationHostname, selectedUrl, registration, registryDnsEvidence, nameservers, dnssec } = context;
+    const websiteProbeEnabled = featureDecision('website_probe', featurePolicy).enabled;
+    const collectDns = options.collectDnsIntelligence || collectDnsIntelligence;
+    const collectTls = options.collectTlsIntelligence || collectTlsIntelligence;
+    const fetchHomepageForDomain = options.fetchHomepage || fetchHomepage;
+    const fetchFaviconForDomain = options.fetchFaviconHash || fetchFaviconHash;
+    const dnsIntelligenceEnabled = featureDecision('dns_intelligence', featurePolicy).enabled;
+    const tlsIntelligenceEnabled = featureDecision('tls_intelligence', featurePolicy).enabled;
+    const deepScanComplete = ['rdap', 'whois', 'dns_intelligence', 'website_probe', 'tls_intelligence']
+        .every((feature) => featureDecision(feature, featurePolicy).enabled);
+    // Registered - look for for-sale/parked/website signals (homepage fetch,
+    // deep mode only), and check for a configured mail exchanger as a
+    // phishing-risk signal (a lookalike domain that can receive/send mail is
+    // capable of running credential-harvesting or BEC campaigns).
+    const nsSignal = registration.state === 'registered' ? nameservers.find(isParkingNameserver) : undefined;
+    let forSaleSignal = nsSignal ? `parking nameserver (${nsSignal})` : null;
+    let activityStatus = nsSignal && observationHostname === domain ? 'parked' : 'unknown';
+    // Homepage + bounded DNS evidence resolve in parallel; the favicon fetch is sequenced after
+    // the homepage so it can use any <link rel="icon"> the page declares (many
+    // sites serve no /favicon.ico and only point to a CDN PNG this way). One
+    // extra round-trip on the already-slow deep path, in exchange for finding
+    // favicons the bare /favicon.ico probe would miss.
+    const pending = [
+        websiteProbeEnabled ? fetchHomepageForDomain(observationHostname, {
+            ...(selectedUrl ? { selectedUrl } : {}), ...(options.signal ? { signal: options.signal } : {}),
+        }).catch((err) => ({
+            text: null,
+            status: 'inconclusive',
+            detail: selectedUrl ? 'Could not confirm selected URL activity.'
+                : `Could not confirm homepage activity: ${String(err && err.message ? err.message : 'request failed').slice(0, 180)}.`,
+            http: failedHttpObservation([
+                { url: selectedUrl ?? `https://${observationHostname}`, error: selectedUrl ? 'request failed' : String(err && err.message ? err.message : 'request failed') },
+            ]),
+        })) : Promise.resolve({
+            text: null,
+            status: 'skipped',
+            detail: 'Website probing is disabled by deployment policy.',
+            http: skippedHttpObservation(),
+        }),
+        dnsIntelligenceEnabled
+            ? collectDns(observationHostname, {
+                ...(options.signal ? { signal: options.signal } : {}),
+                ...(options.dnsResolvers ? { resolvers: options.dnsResolvers } : {}),
+                includeExtendedContext: options.includeExtendedDnsContext === true,
+                includeInheritedCaa: options.includeInheritedCaa === true,
+                registryEvidence: registryDnsEvidence,
+                ...(observationHostname !== domain ? { registrationDomain: domain } : {}),
+            })
+            : Promise.resolve(skippedDnsIntelligence('DNS intelligence is disabled by deployment policy.', {
+                includeExtendedContext: options.includeExtendedDnsContext === true,
+                includeInheritedCaa: options.includeInheritedCaa === true,
+            })),
+        tlsIntelligenceEnabled
+            ? collectTls(observationHostname, { ...(options.signal ? { signal: options.signal } : {}) })
+            : Promise.resolve(skippedTlsObservation()),
+    ];
+    const [homepage, dnsIntelligence, tlsIntelligence] = await Promise.all(pending)
+        .finally(() => Promise.allSettled(pending));
+    options.signal?.throwIfAborted();
+    const page = homepage.text;
+    const pageBaseUrl = homepage.analysisBaseUrl ?? (typeof homepage.http?.finalUrl === 'string' ? homepage.http.finalUrl : `https://${observationHostname}/`);
+    let pageAnalysis = page ? analyzeStaticHtml(page, { baseUrl: pageBaseUrl, includeVisibleText: true }) : undefined;
+    let htmlSignals = {
+        domainSaleSignal: null,
+        pageTitle: null,
+        hasPasswordField: false,
+        hasExternalPasswordForm: null,
+        phishingLanguageMatch: null,
+        hasExternalFormAction: null,
+        externalAssetHosts: [],
+        cspMetaPolicy: null,
+        pageIdentity: null,
+        credentialSurfaceProfile: null,
+        structuredDataIdentity: null,
+        technologyProfile: null,
+        pageRoleProfile: null,
+        clientBehaviorProfile: null,
+    };
+    if (homepage.status === 'fetched') {
+        if (page) {
+            const responseContentType = homepage.http?.response?.contentType;
+            const pageIdentityEligible = typeof responseContentType !== 'string'
+                || responseContentType.trim() === ''
+                || /^(?:text\/html|application\/xhtml\+xml)(?:\s*;|$)/i.test(responseContentType.trim());
+            htmlSignals = await extractHtmlSignals(page, observationHostname, {
+                ...(options.signal ? { signal: options.signal } : {}),
+                ...(pageAnalysis ? { htmlAnalysis: pageAnalysis } : {}),
+                baseUrl: pageBaseUrl,
+                ...(typeof homepage.http?.observedAt === 'string' ? { observedAt: homepage.http.observedAt } : {}),
+                sourceTruncated: homepage.http?.response?.bodyTruncated === true,
+                exactBodyHash: homepage.http?.response?.bodyHash,
+                httpServer: homepage.http?.response?.server,
+                responseHeaders: homepage.technologyHeaders,
+                activityStatus,
+                includePageIdentity: pageIdentityEligible,
+                includePublicationMetadata: options.includePublicationMetadata !== false,
+                ...(options.includeCredentialSurfaceProfile !== undefined
+                    ? { includeCredentialSurfaceProfile: options.includeCredentialSurfaceProfile }
+                    : {}),
+                ...(options.includeStructuredDataIdentity !== undefined
+                    ? { includeStructuredDataIdentity: options.includeStructuredDataIdentity }
+                    : {}),
+                ...(options.includeTechnologyProfile !== undefined
+                    ? { includeTechnologyProfile: options.includeTechnologyProfile }
+                    : {}),
+            });
+            if (pageIdentityEligible && htmlSignals.domainSaleSignal) {
+                if (!selectedUrl && observationHostname === domain)
+                    forSaleSignal = forSaleSignal || htmlSignals.domainSaleSignal;
+                activityStatus = 'parked';
+            }
+        }
+    }
+    if (options.includeTechnologyProfile !== false && htmlSignals.technologyProfile === null
+        && ['fetched', 'responded'].includes(homepage.status)) {
+        htmlSignals.technologyProfile = await analyzeWebsiteTechnology({
+            ...(options.signal ? { signal: options.signal } : {}),
+            htmlAvailable: false,
+            httpServer: homepage.http?.response?.server,
+            responseHeaders: homepage.technologyHeaders,
+            observedAt: homepage.http?.observedAt,
+        });
+    }
+    // Complete document consumers before an optional network wait. Only the
+    // small icon projection, not every parsed element/token, crosses that wait.
+    const faviconEvidence = pageAnalysis ? {
+        iconLinks: pageAnalysis.iconLinks, effectiveBaseUrl: pageAnalysis.effectiveBaseUrl,
+    } : undefined;
+    const pageCollectionComplete = homepage.status === 'fetched' && homepage.http?.complete === true
+        && homepage.http.response?.bodyTruncated !== true && Boolean(pageAnalysis)
+        && !pageAnalysis?.inputLimitReached && !pageAnalysis?.tagLimitReached
+        && !pageAnalysis?.visibleTextLimitReached && !pageAnalysis?.forms.truncated;
+    pageAnalysis = undefined;
+    const favicon = websiteProbeEnabled
+        ? await fetchFaviconForDomain(observationHostname, {
+            baseUrl: pageBaseUrl, ...(faviconEvidence ? { htmlAnalysis: faviconEvidence } : {}),
+            ...(options.signal ? { signal: options.signal } : {}),
+        }).catch(() => null)
+        : null;
+    options.signal?.throwIfAborted();
+    const faviconHash = favicon ? favicon.hash : null;
+    const faviconPHash = favicon ? favicon.phash : null;
+    const responsePolicy = qualifyResponsePolicyWithCspMeta(homepage.responsePolicy, htmlSignals.cspMetaPolicy);
+    const retainedHttp = options.includeDeliveryMetadata === false
+        ? withoutHttpDeliveryMetadata(homepage.http)
+        : homepage.http;
+    const { cspMetaPolicy: _cspMetaPolicy, domainSaleSignal: _domainSaleSignal, ...retainedHtmlSignals } = htmlSignals;
+    const securityPosture = options.includeSecurityPosture === false ? null : analyzeWebsiteSecurityPosture({
+        http: homepage.http,
+        responsePolicy,
+        pageIdentity: htmlSignals.pageIdentity,
+        tls: tlsIntelligence,
+        dns: dnsIntelligence,
+        dnssec,
+        observedAt: homepage.http?.observedAt,
+    });
+    const redirectSaleSignal = forSaleRedirectSignal(homepage.http);
+    if (!selectedUrl && observationHostname === domain && !forSaleSignal && redirectSaleSignal) {
+        forSaleSignal = redirectSaleSignal;
+        activityStatus = 'parked';
+    }
+    const faviconProvedActive = !selectedUrl && homepage.status === 'inconclusive' && Boolean(favicon);
+    const websiteProbeStatus = faviconProvedActive ? 'responded' : homepage.status;
+    const websiteProbeDetail = faviconProvedActive
+        ? `${homepage.detail} A favicon responded successfully, confirming an active web service.`
+        : homepage.detail;
+    if (websiteProbeEnabled) {
+        activityStatus = deriveWebsiteActivity(homepage.status, !selectedUrl && Boolean(favicon), activityStatus === 'parked');
+    }
+    const registrationResult = registration.state !== 'registered' ? registration
+        : !forSaleSignal ? {
+            ...registration,
+            detail: 'source' in registration && registration.source === 'dns'
+                ? 'Authoritative DNS delegation confirms the domain is registered, but RDAP/WHOIS registration details were unavailable.'
+                : selectedUrl ? 'The domain is registered. Website observations concern the explicitly selected URL.'
+                    : observationHostname === domain ? 'Domain is registered and shows no for-sale signals.'
+                        : 'The domain is registered. Website observations concern the separately identified hostname.',
+        } : {
+            ...registration,
+            state: 'for_sale',
+            confidence: 'medium',
+            detail: `Detected a for-sale listing (${forSaleSignal}).`,
+        };
+    return {
+        ...registrationResult,
+        activityStatus,
+        websiteProbeStatus,
+        websiteProbeDetail,
+        http: retainedHttp,
+        ...(options.observationHostname !== undefined || selectedUrl ? { observationHostname } : {}),
+        ...(selectedUrl ? { webObservationMode: 'selected_url' } : {}),
+        deepScanComplete,
+        webCollectionQuality: capturedWebCollectionQuality(!websiteProbeEnabled ? 'not_collected' : pageCollectionComplete ? 'complete'
+            : homepage.status === 'fetched' ? 'partial' : 'unavailable', 
+        // The bounded favicon collector returns no result for both failed and
+        // non-image candidates. A miss therefore cannot prove an icon was removed.
+        !websiteProbeEnabled ? 'not_collected' : favicon ? 'complete' : 'unknown'),
+        faviconHash,
+        faviconPHash,
+        ...retainedHtmlSignals,
+        securityPosture,
+        nameservers: nameservers.length || observationHostname !== domain ? nameservers : dnsIntelligence.records.ns,
+        dns: dnsIntelligence,
+        tls: tlsIntelligence,
+        hasMx: dnsIntelligence.hasMx,
+        hasNullMx: dnsIntelligence.hasNullMx,
+        mxHosts: dnsIntelligence.mxHosts,
+        hasSpf: dnsIntelligence.hasSpf,
+        hasDmarc: dnsIntelligence.hasDmarc,
+    };
+}
+export { enrichWebsite, fetchHomepage, deriveWebsiteActivity, forSaleRedirectSignal };

package/lib/whois-authority.mjs

@@ -2,6 +2,8 @@
 // registry response referred by IANA can decide existence; later registrar
 // output is diagnostic and cannot replace an inconclusive registry result.
 import { normalizeWhoisChain } from "./whois-normalization.mjs";
+import { domainToASCII } from 'node:url';
+import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { parseIndentedWhoisValue, whoisFieldLimit, } from "./whois-values.mjs";
 const LINE_NOT_FOUND_PATTERNS = Object.freeze([
     /^[ \t]*(?:%{1,2}[ \t]*)?(?:error(?::\d+)?[ \t:.-]*)?no match(?:[ \t]+for(?:[ \t]+domain)?(?:[ \t]+["']?[a-z0-9.-]{1,253}["']?)?)?[.!]?[ \t]*$/im,
@@ -50,7 +52,41 @@ export function hasNicKgRegistrationEvidence(text) {
         && /^[ \t]*Record created[ \t]*:[ \t]*\S/im.test(text)
         && /^[ \t]*Name servers in the listed order[ \t]*:[ \t]*$/im.test(text);
 }
-function classifyHopEvidence(hop, index) {
+function canonicalObjectName(value) {
+    const name = domainToASCII(value.trim().replace(/^["']|["'.]+$/gu, '')).toLowerCase();
+    return isValidAsciiHostname(name) ? name : null;
+}
+/** An echoed object may qualify this response, never a different query. */
+export function whoisResponseMatchesDomain(text, requestedDomain) {
+    const expected = canonicalObjectName(requestedDomain);
+    if (!expected)
+        return false;
+    const identityPatterns = [
+        /^[ \t*]*(?:domain(?:[ \t]+name)?|domain_name|domainname)[ \t.]*:[ \t]*(\S[^\r\n]*)$/gimu,
+        /^[ \t]*\[Domain Name\][ \t]*(\S[^\r\n]*)$/gimu,
+        /^[ \t]*Domain[ \t]+([^\s()]+)[ \t]+\([A-Z][A-Z0-9_-]*\)[ \t]*$/gmu,
+        /^[ \t]*Domain(?: name)?[ \t]*:[ \t]*\r?\n(?:[ \t]*\r?\n)*[ \t]+(?:name:[ \t]*)?(\S[^\r\n]*)$/gimu,
+    ];
+    for (const pattern of identityPatterns) {
+        for (const match of text.matchAll(pattern)) {
+            // A few registries publish Unicode plus its parenthesised ASCII form.
+            const names = (match[1] ?? '').split(/[ \t()]+/u).filter(Boolean);
+            if (!names.length || names.some(name => canonicalObjectName(name) !== expected))
+                return false;
+        }
+    }
+    for (const pattern of LINE_NOT_FOUND_PATTERNS) {
+        for (const match of text.matchAll(new RegExp(pattern.source, `${pattern.flags}g`))) {
+            const names = match[0].match(/[a-z0-9-]+(?:\.[a-z0-9-]+)+\.?/giu) ?? [];
+            if (names.some(name => canonicalObjectName(name) !== expected))
+                return false;
+        }
+    }
+    // Known complete negative line formats without an echoed name retain their
+    // existing meaning only within the exact IANA-referred registry response.
+    return true;
+}
+function classifyHopEvidence(hop, index, requestedDomain) {
     if (hop.error)
         return 'error';
     const text = hop.response || '';
@@ -60,6 +96,8 @@ function classifyHopEvidence(hop, index) {
         return 'rate_limited';
     if (NZ_TEMPORARY_FAILURE_RE.test(text))
         return 'rate_limited';
+    if (index > 0 && requestedDomain !== undefined && !whoisResponseMatchesDomain(text, requestedDomain))
+        return 'inconclusive';
     if (NZ_NOT_FOUND_RE.test(text))
         return 'negative';
     if (LINE_NOT_FOUND_PATTERNS.some((pattern) => pattern.test(text))) {
@@ -95,12 +133,12 @@ function ianaRegistryReferral(hop) {
     }
     return null;
 }
-export function analyzeWhoisChainAuthority(chain) {
+export function analyzeWhoisChainAuthority(chain, requestedDomain) {
     const source = normalizeWhoisChain(chain);
     const evidence = source.map((hop, index) => ({
         server: hop.server,
         index,
-        kind: classifyHopEvidence(hop, index),
+        kind: classifyHopEvidence(hop, index, requestedDomain),
     }));
     const failed = evidence.filter((item) => item.kind === 'error' || item.kind === 'rate_limited');
     const registryReferral = ianaRegistryReferral(source[0]);
@@ -135,11 +173,11 @@ export function analyzeWhoisChainAuthority(chain) {
     };
 }
 /** Collection status shared by final and incremental Lookup presentation. */
-export function whoisCollectionStatus(chain) {
+export function whoisCollectionStatus(chain, requestedDomain) {
     const source = normalizeWhoisChain(chain);
     if (!source.length || source[0]?.error)
         return 'error';
     if (source.length === 1)
         return 'unsupported';
-    return analyzeWhoisChainAuthority(source).chainStatus;
+    return analyzeWhoisChainAuthority(source, requestedDomain).chainStatus;
 }

package/lib/whois-chain.mjs

@@ -146,7 +146,16 @@ export async function buildWhoisChainUncached(query, options = {}) {
     return chain;
 }
 export async function buildWhoisChain(query, options = {}) {
-    if (options.signal)
-        return buildWhoisChainUncached(query, options);
-    return cached(`whois:${query.toLowerCase()}`, () => buildWhoisChainUncached(query));
+    let ownedCollection;
+    try {
+        return await cached(`whois:${query.toLowerCase()}`, () => {
+            ownedCollection = buildWhoisChainUncached(query, options);
+            return ownedCollection;
+        }, options.signal);
+    }
+    finally {
+        // Cache cancellation rejects promptly, but a started transport still belongs
+        // to this lookup lease. Drain it before its caller can release that lease.
+        await ownedCollection?.catch(() => { });
+    }
 }

package/lib/whois-common-formats.mjs

@@ -245,7 +245,9 @@ function applyWhoisCommonFormats(text, isRootHop, dialects, context) {
     // sometimes just a hostname, sometimes "hostname  ip.addr" - rather
     // than a per-line "Name Server:" label. Only meaningful on non-root hops.
     if (!isRootHop && nameservers.size === 0) {
-        const headerMatch = text.match(/^[ \t*]*(?:Name ?[Ss]ervers|Domain Servers|DNS servers)[ \t.]*:?[ \t]*$/mi);
+        // Whitespace after a colon belongs to that colon: two independent runs
+        // around an optional colon allow quadratic backtracking on invalid lines.
+        const headerMatch = text.match(/^[ \t*]*(?:Name ?[Ss]ervers|Domain Servers|DNS servers)[ \t.]*(?::[ \t]*)?$/mi);
         if (headerMatch) {
             let found = 0;
             for (const line of text.slice((headerMatch.index ?? 0) + headerMatch[0].length).split('\n')) {

package/lib/whois-contacts.mjs

@@ -30,7 +30,9 @@ export function resolveIsnicRole(text, handle) {
     if (!handle)
         return null;
     const escaped = handle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    const headerMatch = text.match(new RegExp(`^[ \\t]*role:[ \\t]*(.+)\\r?\\n[ \\t]*nic-hdl:[ \\t]*${escaped}[ \\t]*$`, 'im'));
+    // Capture the whole role value, including leading whitespace. A separate
+    // whitespace run overlaps this capture and backtracks when the handle fails.
+    const headerMatch = text.match(new RegExp(`^[ \\t]*role:(.+)\\r?\\n[ \\t]*nic-hdl:[ \\t]*${escaped}[ \\t]*$`, 'im'));
     if (!headerMatch)
         return null;
     const lines = text
@@ -143,7 +145,7 @@ export function parseIndentedContactBlock(text, headerRe) {
     if (lines.length === 0)
         return null;
     const remaining = [...lines];
-    const emailIndex = remaining.findIndex((line) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(line));
+    const emailIndex = remaining.findIndex(isIndentedContactEmail);
     const email = emailIndex !== -1
         ? remaining.splice(emailIndex, 1)[0]
         : null;
@@ -161,3 +163,12 @@ export function parseIndentedContactBlock(text, headerRe) {
         truncated: allLines.length > lines.length,
     };
 }
+// Preserve the legacy contact classifier (not a mailbox validator), without
+// repeatedly trying a different separator in a long, dot-heavy failed match.
+function isIndentedContactEmail(line) {
+    const at = line.indexOf('@');
+    if (at <= 0 || line.indexOf('@', at + 1) !== -1 || /\s/.test(line))
+        return false;
+    const dot = line.indexOf('.', at + 2);
+    return dot !== -1 && dot < line.length - 1;
+}

package/lib/whois-normalization.mjs

@@ -21,7 +21,9 @@ export function normalizeWhoisChain(value) {
             ...(typeof hop.queriedAt === 'string' ? { queriedAt: hop.queriedAt.slice(0, 64) } : {}),
             ...(typeof hop.queryProfile === 'string' ? { queryProfile: hop.queryProfile.slice(0, 80) } : {}),
             ...(typeof hop.responseEncoding === 'string' ? { responseEncoding: hop.responseEncoding.slice(0, 40) } : {}),
-            ...(typeof hop.response === 'string' ? { response: hop.response.slice(0, MAX_WHOIS_BYTES) } : {}),
+            // Parser and authority analysis share protocol line endings, while the
+            // original hop retains its wire text. Lone and embedded controls remain.
+            ...(typeof hop.response === 'string' ? { response: hop.response.slice(0, MAX_WHOIS_BYTES).replace(/\r\n/g, '\n') } : {}),
             ...(typeof hop.error === 'string' ? { error: hop.error.slice(0, 1000) } : {}),
         });
     }

package/lib/whois-parser.mjs

@@ -1,13 +1,13 @@
 // WHOIS response parsing. Transport, referral-chain and stable public exports
 // remain owned by the facade in whois.mts.
 import { registryDateIso } from "./registry-dates.mjs";
-import { analyzeWhoisChainAuthority } from "./whois-authority.mjs";
+import { analyzeWhoisChainAuthority, whoisResponseMatchesDomain } from "./whois-authority.mjs";
 import { normalizeWhoisChain } from "./whois-normalization.mjs";
 import { applyWhoisCommonFormats } from "./whois-common-formats.mjs";
 import { applyWhoisDialects } from "./whois-dialects.mjs";
 import { WHOIS_FIELD_PATTERNS, normalizedWhoisContact, } from "./whois-parser-support.mjs";
 import { boundedWhoisValue, whoisFieldLimit, } from "./whois-values.mjs";
-function parseWhoisChain(chain) {
+function parseWhoisChain(chain, requestedDomain) {
     const source = normalizeWhoisChain(chain);
     const fields = {};
     const truncatedFields = new Set();
@@ -18,6 +18,8 @@ function parseWhoisChain(chain) {
         const text = hop.response;
         if (!text)
             return;
+        if (hopIndex > 0 && requestedDomain !== undefined && !whoisResponseMatchesDomain(text, requestedDomain))
+            return;
         // hopIndex 0 is always whois.iana.org, whose "domain:"/"created:"/
         // "changed:" fields describe the TLD's own root delegation record, not
         // the queried domain - e.g. "created: 1992-08-14" for .gt is Guatemala's
@@ -118,7 +120,7 @@ function parseWhoisChain(chain) {
     // Existence is decided authority-aware, not by a global "any hop said no
     // match" flag: positive registry evidence is never overridden by a later
     // registrar hop that failed, rate-limited, or returned "no match".
-    const authority = analyzeWhoisChainAuthority(source);
+    const authority = analyzeWhoisChainAuthority(source, requestedDomain);
     return {
         ...fields,
         nameservers: [...nameservers],

package/package.json

@@ -33,38 +33,39 @@
   "bugs": {
     "url": "https://github.com/slicedearth/whoisleuth/issues"
   },
-  "version": "2.4.0",
+  "version": "2.6.0",
   "dependencies": {
-    "@peculiar/x509": "2.0.0",
+    "@nuintun/qrcode": "5.0.3",
+    "@peculiar/x509": "2.1.0",
+    "fast-png": "8.0.0",
     "fflate": "0.8.3",
     "maxmind": "5.0.7",
     "parse5": "8.0.1",
+    "pdfjs-dist": "6.4.299",
+    "postal-mime": "4.0.4",
     "reflect-metadata": "0.2.2",
-    "tldts": "7.4.11",
-    "undici": "8.10.1"
+    "saxes": "6.0.0",
+    "tldts": "7.4.16",
+    "undici": "8.11.2"
   },
   "files": [
     "bin/**/*.mjs",
     "cli/**/*.mjs",
     "lib/**/*.mjs",
     "frontend/src/lib/**/*.js",
-    "packages/cases/**/*.mjs",
-    "packages/comparison/**/*.mjs",
-    "packages/contracts/**/*.mjs",
-    "packages/evidence/**/*.mjs",
-    "packages/interchange/**/*.mjs",
-    "packages/investigation/**/*.mjs",
-    "packages/monitoring/**/*.mjs",
-    "packages/workspace/**/*.mjs",
+    "packages/**/*.mjs",
+    "README.md",
     "docs/cli.md",
     "docs/cli-reference.md",
+    "docs/contextual-reviews.md",
+    "docs/offline-intake-context.md",
+    "docs/infrastructure-observations.md",
     "DISCLOSURE",
     "LICENSE",
-    "LICENSES/*.txt",
     "NOTICE",
-    "README.md",
     "SECURITY.md",
     "TRADEMARKS.md",
+    "LICENSES/Retire.js-Apache-2.0.txt",
     "third-party-notices.txt"
   ],
   "publishConfig": {