@slicedearth/whoisleuth-cli 2.5.1 → 2.6.0

package/lib/domain-posture-analysis.mjs

@@ -4,6 +4,48 @@
 import { parse as parseDomain } from 'tldts';
 import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { parseDmarcRecords, parseDmarcReportingAuthorization, parseReportingDestination, parseSpfRecords } from "./domain-posture-parsers.mjs";
+const SPF_PERMISSIVE_PATH_ISSUE = 'Observed permissive +all evidence on a potentially reachable positive SPF include or redirect path; review sender authorisation.';
+// This is a conservative universal-result check for unconditional all/include
+// chains, not a sender evaluator. Conditional mechanisms remain unknown.
+function spfStaticResult(policy) {
+    const parsed = policy.parsed;
+    if (!parsed?.valid)
+        return { everySender: null, permissive: false };
+    let uncertain = false, permissive = false;
+    const finish = (result) => ({
+        everySender: !uncertain ? result : null,
+        permissive,
+    });
+    for (const mechanism of parsed.mechanisms) {
+        if (mechanism.kind === 'all') {
+            if (mechanism.qualifier === '+')
+                permissive = true;
+            return finish(mechanism.qualifier);
+        }
+        if (mechanism.kind === 'include') {
+            const child = policy.children.get(mechanism.includeIndex);
+            const result = child ? spfStaticResult(child) : { everySender: null, permissive: false };
+            if (mechanism.qualifier === '+' && result.permissive)
+                permissive = true;
+            if (result.everySender === '+')
+                return finish(mechanism.qualifier);
+            if (result.everySender !== null)
+                continue; // Only child pass matches include.
+            uncertain = true;
+        }
+        else {
+            // Without sender evaluation, even a literal mechanism remains conditional.
+            uncertain = true;
+        }
+    }
+    if (parsed.redirect) {
+        const child = policy.children.get(parsed.includes.length);
+        const result = child ? spfStaticResult(child) : { everySender: null, permissive: false };
+        permissive ||= result.permissive;
+        return result.everySender === null ? { everySender: null, permissive } : finish(result.everySender);
+    }
+    return { everySender: null, permissive };
+}
 const SPF_LOOKUP_LIMIT = 10;
 const SPF_VOID_LOOKUP_LIMIT = 2;
 const SPF_MAX_DEPTH = 5;
@@ -41,6 +83,7 @@ function branchFor(item, state, terminalPolicy, dnsLookupTerms, issues) {
     };
 }
 async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
+    const rootPolicy = { parsed: null, children: new Map() };
     const queue = [{
             domain: rootDomain,
             parent: null,
@@ -49,6 +92,7 @@ async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
             path: [rootDomain],
             records: rootQuery.records,
             error: rootQuery.error,
+            policy: rootPolicy,
         }];
     const branches = [];
     const issues = [];
@@ -100,6 +144,7 @@ async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
         branches.push(branchFor(item, parsed.valid ? 'success' : 'invalid', parsed.terminalPolicy, parsed.dnsLookupTerms, parsed.issues));
         if (!parsed.valid)
             continue;
+        item.policy.parsed = parsed;
         if (dnsLookupTerms > SPF_LOOKUP_LIMIT) {
             boundReached = true;
             issues.push(`The expanded policy declares more than ${SPF_LOOKUP_LIMIT} DNS-querying terms.`);
@@ -111,7 +156,9 @@ async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
             ...parsed.includes.map((domain) => ({ relation: 'include', domain })),
             ...(parsed.redirect ? [{ relation: 'redirect', domain: parsed.redirect }] : []),
         ];
-        for (const dependency of dependencies) {
+        for (const [dependencyIndex, dependency] of dependencies.entries()) {
+            const policy = { parsed: null, children: new Map() };
+            item.policy.children.set(dependencyIndex, policy);
             const normalized = strictHostname(dependency.domain);
             if (!normalized) {
                 branches.push(branchFor({
@@ -120,6 +167,7 @@ async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
                     relation: dependency.relation,
                     depth: item.depth + 1,
                     path: item.path,
+                    policy,
                 }, 'invalid', null, 0, ['The SPF dependency is not a literal public hostname; macros are not expanded by this audit.']));
                 continue;
             }
@@ -129,6 +177,7 @@ async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
                 relation: dependency.relation,
                 depth: item.depth + 1,
                 path: [...item.path, normalized],
+                policy,
             });
         }
     }
@@ -145,6 +194,8 @@ async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
             : incomplete
                 ? 'partial'
                 : 'complete';
+    if (rootPolicy.parsed?.terminalPolicy !== 'pass' && spfStaticResult(rootPolicy).permissive)
+        issues.unshift(SPF_PERMISSIVE_PATH_ISSUE);
     return {
         version: 1,
         state,
@@ -293,4 +344,4 @@ function buildExternalDependencies({ domain, nameservers, mx, spfExpansion, dmar
         || left.target.localeCompare(right.target)
         || left.source.localeCompare(right.source)));
 }
-export { SPF_LOOKUP_LIMIT, SPF_MAX_DEPTH, SPF_VOID_LOOKUP_LIMIT, buildExternalDependencies, expandSpfPolicy, reportDestinationDomain, validateDmarcExternalReporting, };
+export { SPF_PERMISSIVE_PATH_ISSUE, SPF_LOOKUP_LIMIT, SPF_MAX_DEPTH, SPF_VOID_LOOKUP_LIMIT, buildExternalDependencies, expandSpfPolicy, reportDestinationDomain, validateDmarcExternalReporting, };

package/lib/domain-posture-parsers.mjs

@@ -48,6 +48,7 @@ function parseSpfRecords(records) {
         terminalPolicy: null,
         redirect: null,
         includes: [],
+        mechanisms: [],
         authorizingTerms: [],
         dnsLookupTerms: 0,
         issues: [],
@@ -175,6 +176,14 @@ function parseSpfRecords(records) {
     result.includes = terms
         .map((term) => term.match(/^[+?~-]?include:(.+)$/i)?.[1] || '')
         .filter(Boolean);
+    let includeIndex = 0;
+    result.mechanisms = terms.filter(term => !/^[+?~-]?[a-z][a-z0-9_.-]*=/iu.test(term)).map(term => {
+        const qualifier = (/^[+?~-]/u.test(term) ? term[0] : '+');
+        const body = /^[+?~-]/u.test(term) ? term.slice(1) : term;
+        const include = body.match(/^include:(.+)$/iu);
+        return { kind: /^all$/iu.test(body) ? 'all' : include ? 'include' : 'other', qualifier,
+            includeIndex: include ? includeIndex++ : null };
+    });
     if (terms.some((term) => /^[+?~-]?ptr(?::|$)/i.test(term))) {
         result.issues.push('The deprecated ptr mechanism should not be used.');
     }

package/lib/domain-posture.mjs

@@ -12,7 +12,7 @@ import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.
 import { DOMAIN_POSTURE_COMPARISON_VERSION, MAX_POSTURE_CHECK_RECORDS, POSTURE_CHECK_SOURCES } from "../packages/evidence/domain-posture-context.mjs";
 import { canonicalPostureRecords } from "../packages/evidence/domain-control-runtime.mjs";
 import { parseSpfRecords, parseDmarcRecords, parseMtaStsDnsRecords, parseMtaStsPolicy, parseTlsRptRecords, parseBimiRecords, parseDkimRecords, } from "./domain-posture-parsers.mjs";
-import { buildExternalDependencies, expandSpfPolicy, validateDmarcExternalReporting, } from "./domain-posture-analysis.mjs";
+import { SPF_PERMISSIVE_PATH_ISSUE, buildExternalDependencies, expandSpfPolicy, validateDmarcExternalReporting, } from "./domain-posture-analysis.mjs";
 const DNS_TIMEOUT_MS = 6000;
 const POLICY_TIMEOUT_MS = 7000;
 const MAX_POLICY_BYTES = 64 * 1024;
@@ -156,7 +156,8 @@ function spfCheck(query, expansion) {
             remediation: 'Replace +all with an explicit sender allowlist and a restrictive terminal policy.',
         });
     }
-    if (parsed.terminalPolicy === 'fail' && parsed.issues.length === 0 && (!expansion || expansion.state === 'complete')) {
+    const permissiveExpansion = expansion?.issues.includes(SPF_PERMISSIVE_PATH_ISSUE) ?? false;
+    if (parsed.terminalPolicy === 'fail' && parsed.issues.length === 0 && !permissiveExpansion && (!expansion || expansion.state === 'complete')) {
         return check('spf', 'SPF', 'pass', 'Restrictive fail-all policy', { detail: details.join(' '), records: parsed.records });
     }
     if (expansion && expansion.state !== 'complete') {
@@ -166,6 +167,12 @@ function spfCheck(query, expansion) {
             remediation: 'Review unresolved, invalid, cyclic, or budget-limited include and redirect branches before treating the policy as complete.',
         });
     }
+    if (permissiveExpansion) {
+        return check('spf', 'SPF', 'warning', 'SPF authorisation needs review', {
+            detail: details.join(' '), records: parsed.records,
+            remediation: 'Review the positive include or redirect path containing +all; complete collection does not establish restrictive sender authorisation.',
+        });
+    }
     if (parsed.terminalPolicy === 'redirect') {
         return check('spf', 'SPF', 'info', 'Policy delegates evaluation with redirect', {
             detail: details.join(' '), records: parsed.records,
@@ -301,6 +308,11 @@ function dnssecDelegationConsistencyCheck(input, registry) {
     }
     const value = String(input.value || '').toLowerCase();
     const hasDsRecords = registry.dsRecordCount > 0;
+    if (registry.dsDataTruncated) {
+        return check('dnssec_delegation_consistency', 'DNSSEC delegation consistency', 'info', 'Retained DS evidence is incomplete', {
+            detail: 'The normalised registry response reported truncated DS data, so delegation consistency is inconclusive.',
+        });
+    }
     if (value === 'signed' && hasDsRecords) {
         return check('dnssec_delegation_consistency', 'DNSSEC delegation consistency', 'pass', 'Signed state and retained DS records agree', {
             detail: `${registry.dsRecordCount} registry DS record${registry.dsRecordCount === 1 ? '' : 's'} retained.`,
@@ -311,11 +323,6 @@ function dnssecDelegationConsistencyCheck(input, registry) {
             detail: 'This is a consistency result, not a recommendation to leave DNSSEC disabled.',
         });
     }
-    if (registry.dsDataTruncated) {
-        return check('dnssec_delegation_consistency', 'DNSSEC delegation consistency', 'info', 'Retained DS evidence is incomplete', {
-            detail: 'The normalised registry response reported truncated DS data, so apparent disagreement is inconclusive.',
-        });
-    }
     if (value === 'signed' && !hasDsRecords) {
         return check('dnssec_delegation_consistency', 'DNSSEC delegation consistency', 'warning', 'Signed state reported without retained DS records', {
             detail: 'This can reflect registry publication differences or incomplete upstream data and should be reviewed before changing delegation.',
@@ -360,13 +367,25 @@ function matchesMtaPattern(host, pattern) {
     }
     return normalizedHost === normalizedPattern;
 }
+function mailPolicyApplicability(mxQuery) {
+    if (mxQuery.error)
+        return { hasMx: false, detail: 'Receiving-mail applicability is unknown because the MX lookup failed.' };
+    const records = completeMxRecords(mxQuery.records);
+    if (!records)
+        return { hasMx: false, detail: 'Receiving-mail applicability is unknown because the MX evidence is incomplete.' };
+    const { hasMx, hasNullMx } = classifyMxRecords(records);
+    return { hasMx, detail: hasMx ? '' : hasNullMx
+            ? 'Null MX explicitly declares that this domain does not accept inbound mail.'
+            : 'No MX records were observed. This alone does not establish that the domain cannot receive mail.' };
+}
 function mtaStsCheck(dnsQuery, policyFetch, mxQuery) {
     if (dnsQuery.error)
         return queryFailureCheck('mta_sts', 'MTA-STS', dnsQuery.error);
     const dnsPolicy = parseMtaStsDnsRecords(dnsQuery.records);
-    const hasMx = !mxQuery.error && classifyMxRecords(asMxRecords(mxQuery.records)).hasMx;
     if (dnsPolicy.records.length === 0) {
+        const { hasMx, detail } = mailPolicyApplicability(mxQuery);
         return check('mta_sts', 'MTA-STS', hasMx ? 'warning' : 'info', 'No MTA-STS policy advertised', {
+            detail,
             remediation: hasMx ? 'Publish _mta-sts and serve a valid policy over HTTPS to require authenticated TLS for inbound mail.' : '',
         });
     }
@@ -436,9 +455,9 @@ function tlsRptCheck(query, mxQuery) {
         return queryFailureCheck('tls_rpt', 'TLS-RPT', query.error);
     const parsed = parseTlsRptRecords(query.records);
     if (parsed.records.length === 0) {
-        const hasMx = !mxQuery.error && classifyMxRecords(asMxRecords(mxQuery.records)).hasMx;
+        const { hasMx, detail } = mailPolicyApplicability(mxQuery);
         return check('tls_rpt', 'TLS-RPT', hasMx ? 'warning' : 'info', 'No SMTP TLS reporting policy', {
-            detail: hasMx ? '' : 'The domain has no receiving mail exchanger, so SMTP TLS reporting is not currently actionable.',
+            detail,
             remediation: hasMx ? 'Publish a v=TLSRPTv1 record at _smtp._tls with a monitored rua destination.' : '',
         });
     }

package/lib/evidence-export-privacy.mjs

@@ -13,7 +13,7 @@ const PUBLIC_LOOKUP_AVAILABILITY_ANALYSIS_KEYS = new Set([
     'expiresInDays', 'privacyProtected', 'dnssec', 'activityStatus',
     'websiteProbeStatus', 'websiteProbeDetail', 'http', 'deepScanComplete',
     'faviconHash', 'faviconPHash', 'pageTitle', 'hasPasswordField',
-    'phishingLanguageMatch', 'hasExternalFormAction', 'externalAssetHosts',
+    'phishingLanguageMatch', 'hasExternalFormAction', 'hasExternalPasswordForm', 'externalAssetHosts',
     'pageIdentity', 'credentialSurfaceProfile', 'structuredDataIdentity',
     'technologyProfile', 'pageRoleProfile', 'clientBehaviorProfile',
     'securityPosture', 'dns', 'tls', 'hasMx', 'hasNullMx', 'mxHosts', 'hasSpf',
@@ -105,6 +105,7 @@ const LOOKUP_AVAILABILITY_PORTABLE_NESTED_KEYS = new Set([
     // Credential, structured identity, role, behaviour, technology, and posture
     // projections. Only fixed categories/counts and bounded descriptions enter.
     'credentialSurfaceVersion', 'methods', 'actions', 'missing', 'get', 'post',
+    'formAttribution', 'unassociatedInputs', 'index', 'destinations', 'relationship', 'origin',
     'dialog', 'other', 'sameOrigin', 'external', 'cleartext', 'unclassified',
     'inputs', 'classifiedCount', 'categories', 'password', 'email', 'username',
     'one_time_code', 'payment', 'inputsObserved', 'classifiedInputs',
@@ -322,6 +323,8 @@ function projectLookupEvidenceAvailabilityValue(value, path, state, depth, legac
         return value;
     if (typeof value === 'string') {
         const normalizedParent = normalizedEvidenceKey(path.at(-1) || '');
+        if (path.join('.') === 'credentialSurfaceProfile.formAttribution.forms.destinations.origin')
+            return portableOrigin(value);
         if (PORTABLE_URL_KEYS.has(normalizedParent))
             return portableUri(value, legacyUris);
         if (PORTABLE_ORIGIN_COLLECTION_KEYS.has(normalizedParent))
@@ -344,7 +347,7 @@ function projectLookupEvidenceAvailabilityValue(value, path, state, depth, legac
         const boundedCount = Number.isSafeInteger(item)
             && Number(item) >= 0
             && Number(item) <= LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS;
-        const credentialCategoryCount = parentPath === 'credentialSurfaceProfile.inputs.categories'
+        const credentialCategoryCount = ['credentialSurfaceProfile.inputs.categories', 'credentialSurfaceProfile.formAttribution.forms.categories'].includes(parentPath)
             && boundedCount;
         const sanClassCount = parentPath === 'tls.certificate.subjectAltNames.classes'
             && LOOKUP_AVAILABILITY_TLS_SAN_CLASS_KEYS.has(key)

package/lib/evidence-report.mjs

@@ -267,6 +267,7 @@ function buildLookupEvidenceReport(document, options = {}) {
                 reportField('Redirects', http.redirectCount),
                 reportField('Page title', availability.pageTitle),
                 reportField('Password field observed', yesNoUnknown(availability.hasPasswordField)),
+                reportField('Password form declares external destination', yesNoUnknown(availability.hasExternalPasswordForm)),
                 reportField('Authoritative nameserver evidence', listText(availability.nameservers)),
                 reportField('Observed edge, CDN, reverse proxy or WAF', reportTechnologyNames(technologyFindings, 'observed_edge')),
                 reportField('Application-platform indicators', reportTechnologyNames(technologyFindings, 'application_platform')),

package/lib/favicon.mjs

@@ -146,13 +146,18 @@ function isFaviconImage(bytes) {
 }
 // Returns the favicon bytes for one candidate URL (a real fetch, or an inline
 // data: decode), or null if it can't be retrieved/used.
-async function fetchFaviconBytes(url, headers, fetcher, timeoutMs) {
+async function fetchFaviconBytes(url, headers, fetcher, timeoutMs, signal) {
+    signal?.throwIfAborted();
     if (/^data:/i.test(url))
         return decodeDataUri(url);
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const res = await fetcher(url, { signal: controller.signal, headers });
+        const res = await fetcher(url, { signal: signal ? AbortSignal.any([signal, controller.signal]) : controller.signal, headers });
+        if (signal?.aborted) {
+            await res.body?.cancel().catch(() => { });
+            signal.throwIfAborted();
+        }
         if (!res.ok) {
             // Not reading this body - release it explicitly instead of leaving an
             // unconsumed stream (and the connection it's tied to) open until
@@ -165,10 +170,12 @@ async function fetchFaviconBytes(url, headers, fetcher, timeoutMs) {
         // headers immediately and then trickle or stall the body forever, hanging
         // this worker with no deadline once disarmed.
         const { bytes, truncated } = await readBytesCapped(res, MAX_FAVICON_BYTES);
+        signal?.throwIfAborted();
         // A truncated or empty file can't be hashed meaningfully.
         return truncated || bytes.length === 0 ? null : bytes;
     }
     catch {
+        signal?.throwIfAborted();
         return null;
     }
     finally {
@@ -196,7 +203,8 @@ function buildFaviconCandidates(domain, html = '', options = {}) {
     add(`http://${domain}/favicon.svg`);
     return candidates.slice(0, MAX_FAVICON_CANDIDATES);
 }
-async function fetchFaviconHash(domain, { html = '', baseUrl, htmlAnalysis, fetcher = safeFetch, timeoutMs = FAVICON_FETCH_TIMEOUT_MS } = {}) {
+async function fetchFaviconHash(domain, { html = '', baseUrl, htmlAnalysis, fetcher = safeFetch, timeoutMs = FAVICON_FETCH_TIMEOUT_MS, signal } = {}) {
+    signal?.throwIfAborted();
     const headers = whoisleuthRequestHeaders();
     const candidates = buildFaviconCandidates(domain, html, {
         ...(baseUrl !== undefined ? { baseUrl } : {}),
@@ -207,7 +215,8 @@ async function fetchFaviconHash(domain, { html = '', baseUrl, htmlAnalysis, fetc
         : FAVICON_FETCH_TIMEOUT_MS;
     for (const url of candidates) {
         // eslint-disable-next-line no-await-in-loop
-        const bytes = await fetchFaviconBytes(url, headers, fetcher, requestTimeoutMs);
+        const bytes = await fetchFaviconBytes(url, headers, fetcher, requestTimeoutMs, signal);
+        signal?.throwIfAborted();
         if (bytes && isFaviconImage(bytes)) {
             return {
                 hash: crypto.createHash('sha256').update(bytes).digest('hex'),

package/lib/html-signals.mjs

@@ -6,6 +6,8 @@
 import { isIP } from 'node:net';
 import { domainToASCII } from 'node:url';
 import { analyzeCredentialSurfaceProfile } from "./credential-surface-profile.mjs";
+import { attributeCredentialForms } from "./credential-form-attribution.mjs";
+import { externalPasswordFormObservation } from "../packages/evidence/credential-form-attribution.mjs";
 import { analyzeClientBehavior } from "./client-behavior-profile.mjs";
 import { createObservation } from "../packages/evidence/observation.mjs";
 import { createPageFingerprints } from "./page-fingerprints.mjs";
@@ -719,10 +721,12 @@ async function extractHtmlSignals(html, domain, options = {}) {
     const pageLanguageSignal = detectPageLanguageSignal(html, pageIdentity?.documentLanguage, htmlAnalysis);
     const domainSaleSignal = options.sourceTruncated !== true && domainSaleLandingPage(htmlAnalysis, domain)
         ? 'explicit domain-sale landing-page content' : null;
+    const formAttribution = attributeCredentialForms(htmlAnalysis, documentUrl, options.sourceTruncated);
     return {
         domainSaleSignal,
         pageTitle: htmlAnalysis.title,
         hasPasswordField: htmlAnalysis.forms.categories.password > 0,
+        hasExternalPasswordForm: externalPasswordFormObservation(formAttribution),
         phishingLanguageMatch: pageLanguageSignal?.label ?? null,
         hasExternalFormAction: pageIdentity
             ? pageIdentity.forms.externalActionOrigins.length > 0
@@ -732,6 +736,8 @@ async function extractHtmlSignals(html, domain, options = {}) {
         pageIdentity: pageIdentityOutput,
         credentialSurfaceProfile: includeCredentialSurfaceProfile && htmlAnalysis ? analyzeCredentialSurfaceProfile({
             htmlAnalysis,
+            formAttribution,
+            baseUrl: documentUrl,
             observedAt: options.observedAt,
             sourceTruncated: options.sourceTruncated,
         }) : null,

package/lib/lookup-child-profile-contract.mjs

@@ -8,6 +8,7 @@ import { MAX_LOOKUP_TLS_ALT_NAMES, MAX_LOOKUP_TLS_CERTIFICATE_POLICIES, MAX_LOOK
 import { isJsonObject, normalizedDomain, validBoundedString, validHttpProvenanceUrl, validObservationDiagnostics, validOptionalNullableText, validStringArray, validUint, } from "./lookup-contract-primitives.mjs";
 import { TECHNOLOGY_EVIDENCE_ROLE_ORDER } from "./technology-evidence-role.mjs";
 import { MAX_HOMEPAGE_BYTES } from "./outbound-request-bounds.mjs";
+import { CREDENTIAL_CATEGORY_NAMES, MAX_CREDENTIAL_FORMS, MAX_CREDENTIAL_INPUTS, externalPasswordFormObservation, validCredentialFormAttribution } from "../packages/evidence/credential-form-attribution.mjs";
 export const TECHNOLOGY_PROFILE_VERSION = 12;
 export const SUPPORTED_TECHNOLOGY_PROFILE_VERSIONS = Object.freeze([10, 11, TECHNOLOGY_PROFILE_VERSION]);
 export const MAX_TECHNOLOGY_FINDINGS = 24;
@@ -17,7 +18,7 @@ export const BROWSER_LIBRARY_PROFILE_VERSION = 2;
 export const MAX_LIBRARY_FINDINGS = 16;
 export const WEBSITE_SECURITY_POSTURE_VERSION = 3;
 export const MAX_SECURITY_POSTURE_FINDINGS = 32;
-export const CREDENTIAL_SURFACE_PROFILE_VERSION = 1;
+export const CREDENTIAL_SURFACE_PROFILE_VERSION = 2;
 export const STRUCTURED_DATA_IDENTITY_VERSION = 1;
 export const MAX_STRUCTURED_DATA_ENTITIES = 16;
 export const MAX_STRUCTURED_DATA_SAME_AS_HOSTS = 12;
@@ -66,7 +67,7 @@ const SIMHASH64_RE = /^[a-f0-9]{16}$/u;
 const OID_RE = /^\d{1,10}(?:\.\d{1,10}){1,31}$/u;
 const CREDENTIAL_METHOD_KEYS = Object.freeze(['missing', 'get', 'post', 'dialog', 'other']);
 const CREDENTIAL_ACTION_KEYS = Object.freeze(['sameOrigin', 'external', 'missing', 'cleartext', 'unclassified']);
-const CREDENTIAL_CATEGORY_KEYS = Object.freeze(['password', 'email', 'username', 'one_time_code', 'payment']);
+const CREDENTIAL_CATEGORY_KEYS = CREDENTIAL_CATEGORY_NAMES;
 const TLS_NAME_KEYS = Object.freeze([
     'commonNames', 'organizations', 'organizationalUnits', 'countries', 'localities', 'states',
 ]);
@@ -683,28 +684,37 @@ function securityPostureContractState(value) {
     return 'supported';
 }
 function credentialSurfaceContractState(value) {
-    const versionState = childVersionState(value, 'credentialSurfaceVersion', [CREDENTIAL_SURFACE_PROFILE_VERSION]);
+    const versionState = childVersionState(value, 'credentialSurfaceVersion', [1, CREDENTIAL_SURFACE_PROFILE_VERSION]);
     if (versionState !== 'supported')
         return versionState;
     const profile = value;
     const forms = profile.forms;
     const inputs = profile.inputs;
-    if (!hasExactKeys(profile, [...OBSERVATION_FIELDS, 'credentialSurfaceVersion', 'forms', 'inputs'])
+    if (!hasExactKeys(profile, [...OBSERVATION_FIELDS, 'credentialSurfaceVersion', 'forms', 'inputs', ...(profile.credentialSurfaceVersion === 2 ? ['formAttribution'] : [])])
         || !validProfileObservation(profile, new Set(['success', 'partial']), new Set(['html']))
         || !isJsonObject(forms)
         || !hasExactKeys(forms, ['count', 'methods', 'actions'])
-        || !validUint(forms.count, 50)
-        || !validCredentialCountRecord(forms.methods, CREDENTIAL_METHOD_KEYS, 50)
-        || !validCredentialCountRecord(forms.actions, CREDENTIAL_ACTION_KEYS, 50)
+        || !validUint(forms.count, MAX_CREDENTIAL_FORMS)
+        || !validCredentialCountRecord(forms.methods, CREDENTIAL_METHOD_KEYS, MAX_CREDENTIAL_FORMS)
+        || !validCredentialCountRecord(forms.actions, CREDENTIAL_ACTION_KEYS, MAX_CREDENTIAL_FORMS)
         || CREDENTIAL_METHOD_KEYS.reduce((sum, key) => sum + Number(forms.methods[key]), 0) !== forms.count
         || CREDENTIAL_ACTION_KEYS.reduce((sum, key) => sum + Number(forms.actions[key]), 0) !== forms.count
         || !isJsonObject(inputs)
         || !hasExactKeys(inputs, ['count', 'classifiedCount', 'categories'])
-        || !validUint(inputs.count, 500)
-        || !validUint(inputs.classifiedCount, 500)
+        || !validUint(inputs.count, MAX_CREDENTIAL_INPUTS)
+        || !validUint(inputs.classifiedCount, MAX_CREDENTIAL_INPUTS)
         || Number(inputs.classifiedCount) > Number(inputs.count)
-        || !validCredentialCountRecord(inputs.categories, CREDENTIAL_CATEGORY_KEYS, 500))
+        || !validCredentialCountRecord(inputs.categories, CREDENTIAL_CATEGORY_KEYS, MAX_CREDENTIAL_INPUTS))
         return 'invalid';
+    if (profile.credentialSurfaceVersion === 2 && (!validCredentialFormAttribution(profile.formAttribution)
+        || profile.formAttribution.forms.length !== forms.count
+        || (profile.complete === true && !profile.formAttribution.complete)))
+        return 'invalid';
+    if (profile.credentialSurfaceVersion === 2 && validCredentialFormAttribution(profile.formAttribution)) {
+        const attribution = profile.formAttribution;
+        if (CREDENTIAL_CATEGORY_KEYS.some(key => attribution.forms.reduce((sum, form) => sum + form.categories[key], 0) > Number(inputs.categories[key])))
+            return 'invalid';
+    }
     return 'supported';
 }
 function structuredDataContractState(value) {
@@ -819,6 +829,13 @@ function sanitizeLookupChildProfiles(value) {
     replaceChild('tls', 'TLS profile', 'tls', tlsProfileContractState);
     replaceChild('securityPosture', 'Security-posture profile', 'derived', securityPostureContractState);
     replaceChild('credentialSurfaceProfile', 'Credential-surface profile', 'html', credentialSurfaceContractState);
+    if (availability.hasExternalPasswordForm !== undefined && availability.credentialSurfaceProfile != null) {
+        const credential = availability.credentialSurfaceProfile;
+        if (!isJsonObject(credential) || credential.credentialSurfaceVersion !== 2
+            || availability.hasExternalPasswordForm !== externalPasswordFormObservation(credential.formAttribution)) {
+            mutableAvailability().hasExternalPasswordForm = null;
+        }
+    }
     replaceChild('structuredDataIdentity', 'Structured-data identity profile', 'html', structuredDataContractState);
     replaceChild('pageRoleProfile', 'Page-role profile', 'derived', pageRoleContractState);
     replaceChild('clientBehaviorProfile', 'Client-behaviour profile', 'derived', clientBehaviorContractState);
@@ -864,4 +881,4 @@ function sanitizeLookupChildProfiles(value) {
     }
     return output;
 }
-export { sanitizeLookupChildProfiles, technologyProfileContractState, validSecurityPostureFinding, validTlsChainCertificate, validTlsFinding, };
+export { sanitizeLookupChildProfiles, credentialSurfaceContractState, technologyProfileContractState, validSecurityPostureFinding, validTlsChainCertificate, validTlsFinding, };

package/lib/lookup-response-contract.mjs

@@ -646,6 +646,7 @@ function validAvailabilityScalars(value) {
         && (value.hasNullMx === undefined || value.hasNullMx === null || typeof value.hasNullMx === 'boolean')
         && (value.hasSpf === undefined || value.hasSpf === null || typeof value.hasSpf === 'boolean')
         && (value.hasDmarc === undefined || value.hasDmarc === null || typeof value.hasDmarc === 'boolean')
+        && (value.hasExternalPasswordForm === undefined || value.hasExternalPasswordForm === null || typeof value.hasExternalPasswordForm === 'boolean')
         && validOptionalStringArray(value.mxHosts, MAX_LOOKUP_DNS_RECORDS_PER_TYPE, 253);
 }
 function validLookupDomainIdentity(value) {

package/lib/operation-budget.mjs

@@ -34,6 +34,7 @@ const OPERATION_FEATURES = Object.freeze({
     AVAILABILITY_FAST: 'availability_fast',
     AVAILABILITY_DEEP: 'availability_deep',
     CERTIFICATE_TRANSPARENCY: 'certificate_transparency',
+    DOMAIN_FEED_SEARCH: 'domain_feed_search',
     DOMAIN_POSTURE: 'domain_posture',
 });
 const OPERATION_FEATURE_CLASSES = Object.freeze({
@@ -47,6 +48,7 @@ const OPERATION_FEATURE_CLASSES = Object.freeze({
     [OPERATION_FEATURES.AVAILABILITY_FAST]: OPERATION_CLASSES.REGISTRY_LIGHT,
     [OPERATION_FEATURES.AVAILABILITY_DEEP]: OPERATION_CLASSES.REGISTRY_DEEP,
     [OPERATION_FEATURES.CERTIFICATE_TRANSPARENCY]: OPERATION_CLASSES.CERTIFICATE_SEARCH,
+    [OPERATION_FEATURES.DOMAIN_FEED_SEARCH]: OPERATION_CLASSES.CERTIFICATE_SEARCH,
     [OPERATION_FEATURES.DOMAIN_POSTURE]: OPERATION_CLASSES.POSTURE_AUDIT,
 });
 // The browser currently runs at most 12 fast Bulk workers, 4 deep Bulk
@@ -87,6 +89,8 @@ function operationFeatureFor(feature, { fast = false, compact = false } = {}) {
         return OPERATION_FEATURES.WHOIS;
     if (feature === 'certificate_transparency')
         return OPERATION_FEATURES.CERTIFICATE_TRANSPARENCY;
+    if (feature === 'domain_feed_search')
+        return OPERATION_FEATURES.DOMAIN_FEED_SEARCH;
     if (feature === 'domain_posture')
         return OPERATION_FEATURES.DOMAIN_POSTURE;
     return null;

package/lib/service-binding-dns.mjs

@@ -526,6 +526,8 @@ function defaultTcpExchange(query, resolver, options) {
             }
         });
         socket.once('connect', () => {
+            if (settled)
+                return;
             const length = Buffer.alloc(2);
             length.writeUInt16BE(query.length, 0);
             socket.write(Buffer.concat([length, query]));
@@ -534,6 +536,7 @@ function defaultTcpExchange(query, resolver, options) {
 }
 function defaultDnsExchange(query, resolver, options) {
     return new Promise((resolve, reject) => {
+        options.signal?.throwIfAborted();
         const socket = createSocket(resolver.family === 6 ? 'udp6' : 'udp4');
         let settled = false;
         const timer = setTimeout(() => {
@@ -544,6 +547,7 @@ function defaultDnsExchange(query, resolver, options) {
                 return;
             settled = true;
             clearTimeout(timer);
+            options.signal?.removeEventListener('abort', cancelled);
             try {
                 socket.close();
             }
@@ -555,6 +559,12 @@ function defaultDnsExchange(query, resolver, options) {
             else
                 resolve(response);
         };
+        const cancelled = () => finish(options.signal?.reason ?? new Error('DNS UDP query cancelled'));
+        options.signal?.addEventListener('abort', cancelled, { once: true });
+        if (options.signal?.aborted) {
+            cancelled();
+            return;
+        }
         socket.once('error', (error) => finish(error));
         socket.once('message', (message) => {
             if (message.length > MAX_DNS_MESSAGE_BYTES) {
@@ -565,6 +575,8 @@ function defaultDnsExchange(query, resolver, options) {
             }
         });
         socket.connect(resolver.port, resolver.address, () => {
+            if (settled)
+                return;
             socket.send(query, (error) => {
                 if (error)
                     finish(error);
@@ -592,6 +604,7 @@ function missingResponseError(rcode) {
     return new ServiceBindingDnsError(`DNS resolver returned ${names[rcode] || `rcode ${rcode}`}`, 'EDNSFAIL');
 }
 async function resolveServiceBindingRecords(nameValue, type, options = {}) {
+    options.signal?.throwIfAborted();
     const name = normalizeQueryName(nameValue);
     const transactionId = options.transactionId ?? randomInt(0x1_0000);
     const query = buildServiceBindingDnsQuery(name, type, transactionId);
@@ -608,17 +621,20 @@ async function resolveServiceBindingRecords(nameValue, type, options = {}) {
     const deadline = Date.now() + timeoutMs;
     let lastError = null;
     for (const resolver of resolvers) {
+        options.signal?.throwIfAborted();
         const udpTimeoutMs = deadline - Date.now();
         if (udpTimeoutMs <= 0)
             break;
         try {
-            let response = await exchange(query, resolver, { timeoutMs: udpTimeoutMs });
+            let response = await exchange(query, resolver, { timeoutMs: udpTimeoutMs, ...(options.signal ? { signal: options.signal } : {}) });
+            options.signal?.throwIfAborted();
             if (isTruncatedDnsResponse(response, transactionId)) {
                 const tcpTimeoutMs = deadline - Date.now();
                 if (tcpTimeoutMs <= 0) {
                     throw new ServiceBindingDnsError('DNS service-binding query timed out', 'ETIMEOUT');
                 }
-                response = await (options.tcpExchange || defaultTcpExchange)(query, resolver, { timeoutMs: tcpTimeoutMs });
+                response = await (options.tcpExchange || defaultTcpExchange)(query, resolver, { timeoutMs: tcpTimeoutMs, ...(options.signal ? { signal: options.signal } : {}) });
+                options.signal?.throwIfAborted();
             }
             const parsed = parseServiceBindingDnsResponse(response, { transactionId, name, type });
             if (parsed.truncatedResponse)
@@ -631,6 +647,7 @@ async function resolveServiceBindingRecords(nameValue, type, options = {}) {
             return { records: parsed.records, truncated: parsed.truncated };
         }
         catch (error) {
+            options.signal?.throwIfAborted();
             lastError = error;
             const code = error && typeof error === 'object' ? String(error.code || '') : '';
             if (code === 'ENODATA' || code === 'ENOTFOUND')