@slicedearth/whoisleuth-cli 2.5.1 → 2.7.0

package/lib/static-html-analysis.mjs

@@ -4,6 +4,7 @@
 import { htmlTreeEvents, isHtmlElement, parseBoundedHtml, MAX_STATIC_HTML_CHARS, MAX_STATIC_HTML_TAGS, MAX_STATIC_HTML_TREE_EVENTS, } from "./bounded-html-document.mjs";
 import { MAX_CSP_META_POLICIES, MAX_RESPONSE_POLICY_HEADER_BYTES, } from "./response-policy.mjs";
 import { MAX_FAVICON_BYTES, MAX_FAVICON_CANDIDATES } from "./outbound-request-bounds.mjs";
+import { CREDENTIAL_CATEGORY_NAMES, MAX_CREDENTIAL_FORMS, MAX_CREDENTIAL_INPUTS } from "../packages/evidence/credential-form-attribution.mjs";
 import { MAX_PAGE_PUBLICATION_DECLARATIONS, MAX_PAGE_PUBLICATION_META_ELEMENTS, MAX_PAGE_PUBLICATION_ROBOTS_DIRECTIVES, } from "./homepage-metadata-contract.mjs";
 const MAX_STATIC_STRUCTURE_TOKENS = MAX_STATIC_HTML_TREE_EVENTS;
 const MAX_TAG_LENGTH = 4_096;
@@ -14,8 +15,8 @@ const MAX_SCRIPT_MEDIA_TYPE_LENGTH = 120;
 const MAX_INLINE_SCRIPT_TOTAL_CHARS = 65_536;
 const MAX_INLINE_SCRIPT_CHARS = MAX_INLINE_SCRIPT_TOTAL_CHARS;
 const MAX_STATIC_VISIBLE_TEXT_CHARS = MAX_STATIC_HTML_CHARS;
-const MAX_STATIC_FORMS = 50;
-const MAX_STATIC_INPUTS = 500;
+const MAX_STATIC_FORMS = MAX_CREDENTIAL_FORMS;
+const MAX_STATIC_INPUTS = MAX_CREDENTIAL_INPUTS;
 const MAX_STATIC_PUBLICATION_META_ELEMENTS = MAX_PAGE_PUBLICATION_META_ELEMENTS;
 const MAX_STATIC_PUBLICATION_DECLARATIONS = MAX_PAGE_PUBLICATION_DECLARATIONS;
 const MAX_STATIC_ROBOTS_DIRECTIVES = MAX_PAGE_PUBLICATION_ROBOTS_DIRECTIVES;
@@ -197,6 +198,29 @@ function stylesheetCandidate(attributes) {
         truncated: rel.truncated || href.truncated || disabled.truncated || media.truncated,
     };
 }
+export function staticControlDisabled(elements, index, firstLegends) {
+    const hasDisabled = (element) => element.attributes.some(attribute => attribute.name === 'disabled');
+    if (hasDisabled(elements[index]))
+        return true;
+    for (let parent = elements[index]?.parent ?? null; parent !== null; parent = elements[parent]?.parent ?? null) {
+        const fieldset = elements[parent];
+        if (!fieldset.html || fieldset.name !== 'fieldset' || !hasDisabled(fieldset))
+            continue;
+        const legend = firstLegends.get(parent);
+        let underLegend = false;
+        for (let current = index; current !== null; current = elements[current]?.parent ?? null) {
+            if (current === legend) {
+                underLegend = true;
+                break;
+            }
+            if (current === parent)
+                break;
+        }
+        if (!underLegend)
+            return true;
+    }
+    return false;
+}
 function analyzeStaticHtml(value, options = {}) {
     const parsed = parseBoundedHtml(value);
     const { inputLimitReached } = parsed;
@@ -209,6 +233,7 @@ function analyzeStaticHtml(value, options = {}) {
     const iconCounts = [0, 0];
     const tokens = [];
     const elementStack = [];
+    const firstLegends = new Map();
     const visibleTextParts = [];
     const structureTokens = [];
     const scripts = [];
@@ -386,6 +411,8 @@ function analyzeStaticHtml(value, options = {}) {
             };
             elementStack.push(elements.length);
             elements.push(element);
+            if (htmlElement && tagName === 'legend' && element.parent !== null && !firstLegends.has(element.parent))
+                firstLegends.set(element.parent, elements.length - 1);
             appendToken({ kind: 'start', element });
             // Foreign drawing attributes are not HTML technology, form or resource
             // inputs. Their per-element omission still reaches fingerprinting, but
@@ -628,7 +655,8 @@ function analyzeStaticHtml(value, options = {}) {
                 }
                 else {
                     forms.inputsObserved += 1;
-                    const categories = inputCategories(token.attrs);
+                    const categories = staticControlDisabled(elements, elements.length - 1, firstLegends)
+                        ? { values: [], truncated: false } : inputCategories(token.attrs);
                     if (categories.truncated)
                         forms.truncated = true;
                     if (categories.values.length)
@@ -716,4 +744,4 @@ function analyzeStaticHtml(value, options = {}) {
         inlineCharactersExamined,
     };
 }
-export { MAX_ATTRIBUTES_PER_TAG, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_SCRIPT_REFERENCE_LENGTH, MAX_SCRIPT_MEDIA_TYPE_LENGTH, MAX_STATIC_FORMS, MAX_STATIC_HTML_CHARS, MAX_STATIC_INPUTS, MAX_STATIC_PUBLICATION_META_ELEMENTS, MAX_STATIC_PUBLICATION_DECLARATIONS, MAX_STATIC_ROBOTS_DIRECTIVES, MAX_STATIC_HTML_TAGS, MAX_STATIC_STRUCTURE_TOKENS, MAX_STATIC_VISIBLE_TEXT_CHARS, MAX_TAG_LENGTH, analyzeStaticHtml, };
+export { MAX_ATTRIBUTES_PER_TAG, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_SCRIPT_REFERENCE_LENGTH, MAX_SCRIPT_MEDIA_TYPE_LENGTH, MAX_STATIC_FORMS, MAX_STATIC_HTML_CHARS, MAX_STATIC_INPUTS, MAX_STATIC_PUBLICATION_META_ELEMENTS, MAX_STATIC_PUBLICATION_DECLARATIONS, MAX_STATIC_ROBOTS_DIRECTIVES, MAX_STATIC_HTML_TAGS, MAX_STATIC_STRUCTURE_TOKENS, MAX_STATIC_VISIBLE_TEXT_CHARS, MAX_TAG_LENGTH, analyzeStaticHtml, inputCategories as classifyStaticCredentialInput, };

package/lib/technology-evidence-role.mjs

@@ -1,51 +1 @@
-const TECHNOLOGY_EVIDENCE_ROLE_ORDER = Object.freeze([
-    'observed_edge',
-    'application_platform',
-    'framework_runtime',
-    'embedded_dependency',
-]);
-const TECHNOLOGY_EVIDENCE_ROLE_SET = new Set(TECHNOLOGY_EVIDENCE_ROLE_ORDER);
-function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : {};
-}
-function technologyEvidenceRoles(value) {
-    const finding = record(value);
-    const roles = new Set();
-    let hasExplicitRole = false;
-    for (const role of Array.isArray(finding.roles) ? finding.roles.slice(0, 4) : []) {
-        if (typeof role === 'string' && TECHNOLOGY_EVIDENCE_ROLE_SET.has(role)) {
-            roles.add(role);
-            hasExplicitRole = true;
-        }
-    }
-    const evidenceValues = Array.isArray(finding.evidence) ? finding.evidence.slice(0, 4) : [];
-    for (const evidenceValue of evidenceValues) {
-        const evidence = record(evidenceValue);
-        if (typeof evidence.role === 'string'
-            && TECHNOLOGY_EVIDENCE_ROLE_SET.has(evidence.role)) {
-            roles.add(evidence.role);
-            hasExplicitRole = true;
-        }
-    }
-    if (!hasExplicitRole) {
-        const resourceOriginOnly = evidenceValues.length > 0
-            && evidenceValues.every((evidence) => (String(record(evidence).source).toLowerCase() === 'resource origin'));
-        if (evidenceValues.some((evidence) => String(record(evidence).source).toLowerCase() === 'resource origin')) {
-            roles.add('embedded_dependency');
-        }
-        if (!resourceOriginOnly) {
-            const category = String(finding.category).toLowerCase();
-            if (category === 'delivery platform')
-                roles.add('observed_edge');
-            else if (['application runtime', 'web framework', 'static site generator', 'web server'].includes(category)) {
-                roles.add('framework_runtime');
-            }
-            else
-                roles.add('application_platform');
-        }
-    }
-    return TECHNOLOGY_EVIDENCE_ROLE_ORDER.filter((role) => roles.has(role));
-}
-export { TECHNOLOGY_EVIDENCE_ROLE_ORDER, technologyEvidenceRoles, };
+export { TECHNOLOGY_EVIDENCE_ROLE_ORDER, technologyEvidenceRoles, } from "../packages/evidence/technology-evidence-role.mjs";

package/lib/tls-intelligence.mjs

@@ -705,6 +705,7 @@ function skippedTlsObservation(detail = 'TLS evidence collection is disabled by
     };
 }
 async function collectTlsIntelligence(hostname, options = {}) {
+    options.signal?.throwIfAborted();
     const normalizedHostname = normalizeTlsHostname(hostname);
     const now = options.now || Date.now;
     const observedAt = options.observedAt || (() => new Date().toISOString());
@@ -725,9 +726,11 @@ async function collectTlsIntelligence(hostname, options = {}) {
                 resolutionDeadline = setTimer(() => reject(new Error('TLS resolution timed out')), timeoutMs);
             }),
         ]);
+        options.signal?.throwIfAborted();
         records = normalizePublicAddressRecords(resolved);
     }
     catch (error) {
+        options.signal?.throwIfAborted();
         return failedTlsObservation(error, { sniHost: normalizedHostname, observedAt: observedAt(), durationMs: now() - started });
     }
     finally {
@@ -755,18 +758,29 @@ async function collectTlsIntelligence(hostname, options = {}) {
             durationMs: now() - started,
         });
     }
-    return new Promise((resolve) => {
+    return new Promise((resolve, reject) => {
         let socket;
         let deadline;
         let settled = false;
-        const finish = (result) => {
-            if (settled)
-                return;
-            settled = true;
+        const cleanup = () => {
             if (deadline !== undefined)
                 clearTimer(deadline);
+            options.signal?.removeEventListener('abort', cancelled);
             if (socket && typeof socket.destroy === 'function')
                 socket.destroy();
+        };
+        const cancelled = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(options.signal.reason);
+        };
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
             resolve(result);
         };
         const fail = (error) => finish(failedTlsObservation(error, {
@@ -776,6 +790,11 @@ async function collectTlsIntelligence(hostname, options = {}) {
             observedAt: observedAt(),
             durationMs: now() - started,
         }));
+        options.signal?.addEventListener('abort', cancelled, { once: true });
+        if (options.signal?.aborted) {
+            cancelled();
+            return;
+        }
         try {
             socket = connect({
                 host: selected.address,
@@ -787,6 +806,8 @@ async function collectTlsIntelligence(hostname, options = {}) {
                 checkServerIdentity: () => undefined,
                 ALPNProtocols: ['h2', 'http/1.1'],
             }, () => {
+                if (settled)
+                    return;
                 try {
                     const peerCertificate = socket.getPeerCertificate(true);
                     let hostnameError = null;
@@ -816,6 +837,10 @@ async function collectTlsIntelligence(hostname, options = {}) {
                     fail(error);
                 }
             });
+            if (settled) {
+                socket.destroy();
+                return;
+            }
             socket.once('error', fail);
             deadline = setTimer(() => fail(new Error('TLS handshake timed out')), remainingMs);
             if (settled && deadline !== undefined)

package/lib/website-enrichment.mjs

@@ -1,5 +1,6 @@
 // Bounded website and network enrichment, independent of registration authority.
 import { capturedWebCollectionQuality } from "../packages/evidence/collection-quality.mjs";
+import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { recordOrEmpty as errorRecord } from "./json-record.mjs";
 import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
@@ -21,26 +22,34 @@ import { HOMEPAGE_FETCH_TIMEOUT_MS, MAX_HOMEPAGE_BYTES, } from "./outbound-reque
 // what's checkable without credentials is the parking/landing-page
 // nameservers and homepage copy these services actually use, which is
 // broader coverage of the same signal, not a live cross-marketplace lookup.
-const PARKING_NS_PATTERNS = [
-    /sedoparking\.com$/i,
-    /sedo\.com$/i,
-    /above\.com$/i,
-    /bodis\.com$/i,
-    /parkingcrew\.net$/i,
-    /dan\.com$/i,
-    /hugedomains\.com$/i,
-    /uniregistry/i,
-    /squadhelp/i,
-    /afternic/i,
-    /voodoo\.com$/i,
-    /fabulous\.com$/i,
-    /namedrive/i,
-    /smartname\.com$/i,
-    /domainsponsor\.com$/i,
-    /undeveloped\.com$/i,
-    /trafficz\.com$/i,
-    /dsredirection\.com$/i,
+const PARKING_NS_DOMAINS = [
+    'sedoparking.com',
+    'sedo.com',
+    'above.com',
+    'bodis.com',
+    'parkingcrew.net',
+    'dan.com',
+    'hugedomains.com',
+    // https://www.atom.com/help/article/how-to-verify-your-standard-premium-domains
+    'squadhelp.com',
+    // https://blog.afternic.com/lander-selection-redefining-your-use-of-afternic-landing-pages/
+    'afternic.com',
+    'voodoo.com',
+    'fabulous.com',
+    'smartname.com',
+    'domainsponsor.com',
+    'undeveloped.com',
+    'trafficz.com',
+    'dsredirection.com',
 ];
+function isParkingNameserver(value) {
+    const hostname = value.trim().replace(/\.$/u, '');
+    // Validate before case folding: non-ASCII letters can lowercase to ASCII.
+    if (!isValidAsciiHostname(hostname))
+        return false;
+    const normalised = hostname.toLowerCase();
+    return PARKING_NS_DOMAINS.some(domain => normalised === domain || normalised.endsWith(`.${domain}`));
+}
 const FOR_SALE_PATH_RE = /\/(?:premium-)?domains?-for-sale(?:\/|$)/i;
 function forSaleRedirectSignal(httpObservation) {
     if (!httpObservation || typeof httpObservation !== 'object')
@@ -180,6 +189,7 @@ function deriveWebsiteActivity(homepageStatus, hasFavicon, alreadyParked = false
     return 'unreachable';
 }
 async function enrichWebsite(context, options, featurePolicy) {
+    options.signal?.throwIfAborted();
     const { domain, observationHostname, selectedUrl, registration, registryDnsEvidence, nameservers, dnssec } = context;
     const websiteProbeEnabled = featureDecision('website_probe', featurePolicy).enabled;
     const collectDns = options.collectDnsIntelligence || collectDnsIntelligence;
@@ -194,7 +204,7 @@ async function enrichWebsite(context, options, featurePolicy) {
     // deep mode only), and check for a configured mail exchanger as a
     // phishing-risk signal (a lookalike domain that can receive/send mail is
     // capable of running credential-harvesting or BEC campaigns).
-    const nsSignal = registration.state === 'registered' ? nameservers.find((ns) => PARKING_NS_PATTERNS.some((re) => re.test(ns))) : undefined;
+    const nsSignal = registration.state === 'registered' ? nameservers.find(isParkingNameserver) : undefined;
     let forSaleSignal = nsSignal ? `parking nameserver (${nsSignal})` : null;
     let activityStatus = nsSignal && observationHostname === domain ? 'parked' : 'unknown';
     // Homepage + bounded DNS evidence resolve in parallel; the favicon fetch is sequenced after
@@ -202,7 +212,7 @@ async function enrichWebsite(context, options, featurePolicy) {
     // sites serve no /favicon.ico and only point to a CDN PNG this way). One
     // extra round-trip on the already-slow deep path, in exchange for finding
     // favicons the bare /favicon.ico probe would miss.
-    const [homepage, dnsIntelligence, tlsIntelligence] = await Promise.all([
+    const pending = [
         websiteProbeEnabled ? fetchHomepageForDomain(observationHostname, {
             ...(selectedUrl ? { selectedUrl } : {}), ...(options.signal ? { signal: options.signal } : {}),
         }).catch((err) => ({
@@ -221,6 +231,7 @@ async function enrichWebsite(context, options, featurePolicy) {
         }),
         dnsIntelligenceEnabled
             ? collectDns(observationHostname, {
+                ...(options.signal ? { signal: options.signal } : {}),
                 ...(options.dnsResolvers ? { resolvers: options.dnsResolvers } : {}),
                 includeExtendedContext: options.includeExtendedDnsContext === true,
                 includeInheritedCaa: options.includeInheritedCaa === true,
@@ -232,9 +243,11 @@ async function enrichWebsite(context, options, featurePolicy) {
                 includeInheritedCaa: options.includeInheritedCaa === true,
             })),
         tlsIntelligenceEnabled
-            ? collectTls(observationHostname)
+            ? collectTls(observationHostname, { ...(options.signal ? { signal: options.signal } : {}) })
             : Promise.resolve(skippedTlsObservation()),
-    ]);
+    ];
+    const [homepage, dnsIntelligence, tlsIntelligence] = await Promise.all(pending)
+        .finally(() => Promise.allSettled(pending));
     options.signal?.throwIfAborted();
     const page = homepage.text;
     const pageBaseUrl = homepage.analysisBaseUrl ?? (typeof homepage.http?.finalUrl === 'string' ? homepage.http.finalUrl : `https://${observationHostname}/`);
@@ -243,6 +256,7 @@ async function enrichWebsite(context, options, featurePolicy) {
         domainSaleSignal: null,
         pageTitle: null,
         hasPasswordField: false,
+        hasExternalPasswordForm: null,
         phishingLanguageMatch: null,
         hasExternalFormAction: null,
         externalAssetHosts: [],
@@ -312,8 +326,10 @@ async function enrichWebsite(context, options, featurePolicy) {
     const favicon = websiteProbeEnabled
         ? await fetchFaviconForDomain(observationHostname, {
             baseUrl: pageBaseUrl, ...(faviconEvidence ? { htmlAnalysis: faviconEvidence } : {}),
+            ...(options.signal ? { signal: options.signal } : {}),
         }).catch(() => null)
         : null;
+    options.signal?.throwIfAborted();
     const faviconHash = favicon ? favicon.hash : null;
     const faviconPHash = favicon ? favicon.phash : null;
     const responsePolicy = qualifyResponsePolicyWithCspMeta(homepage.responsePolicy, htmlSignals.cspMetaPolicy);

package/lib/whois-authority.mjs

@@ -2,6 +2,7 @@
 // registry response referred by IANA can decide existence; later registrar
 // output is diagnostic and cannot replace an inconclusive registry result.
 import { normalizeWhoisChain } from "./whois-normalization.mjs";
+import { MAX_WHOIS_BYTES } from "./whois-transport.mjs";
 import { domainToASCII } from 'node:url';
 import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { parseIndentedWhoisValue, whoisFieldLimit, } from "./whois-values.mjs";
@@ -133,6 +134,52 @@ function ianaRegistryReferral(hop) {
     }
     return null;
 }
+/** A complete, target-bound delegation record can establish missing service;
+ * merely reaching the end of an unrecognised response cannot. */
+function ianaDiscoveryHasNoWhoisService(chain, hop, requestedDomain) {
+    const expectedRoot = requestedDomain === undefined ? null : canonicalObjectName(requestedDomain)?.split('.').at(-1);
+    if (!expectedRoot || normalizedWhoisServer(hop.server) !== 'whois.iana.org')
+        return false;
+    if (!Array.isArray(chain) || chain.length !== 1)
+        return false;
+    const original = chain[0]?.response;
+    // Normalisation bounds imported text. Do not interpret a clipped prefix as
+    // an entire discovery record with no referral in its omitted remainder.
+    if (typeof original !== 'string' || original.length > MAX_WHOIS_BYTES
+        || Buffer.byteLength(original, 'utf8') > MAX_WHOIS_BYTES)
+        return false;
+    const text = hop.response ?? '';
+    if (/[\u0000-\u0008\u000b-\u001f\u007f]/u.test(text)
+        || classifyHopEvidence(hop, 0) !== 'inconclusive')
+        return false;
+    const fields = new Map();
+    const emptyServiceFields = new Set();
+    let previousServiceField = false;
+    for (const line of text.split('\n')) {
+        if (previousServiceField && /^[ \t]+\S/u.test(line))
+            return false;
+        previousServiceField = false;
+        if (/^[ \t]*(?:refer|ReferralServer|whois)\b/iu.test(line)) {
+            const service = line.match(/^[ \t]*(refer|ReferralServer|whois):[ \t]*$/iu)?.[1]?.toLowerCase();
+            if (!service || emptyServiceFields.has(service))
+                return false;
+            emptyServiceFields.add(service);
+            previousServiceField = true;
+        }
+        const field = line.match(/^[ \t]*(domain|organisation|status|source):[ \t]*(.*)$/iu);
+        if (!field)
+            continue;
+        const key = field[1].toLowerCase();
+        if (fields.has(key))
+            return false;
+        fields.set(key, field[2].trim());
+    }
+    return emptyServiceFields.size > 0
+        && fields.get('domain')?.toLowerCase() === expectedRoot
+        && Boolean(fields.get('organisation'))
+        && fields.get('status')?.toUpperCase() === 'ACTIVE'
+        && fields.get('source')?.toUpperCase() === 'IANA';
+}
 export function analyzeWhoisChainAuthority(chain, requestedDomain) {
     const source = normalizeWhoisChain(chain);
     const evidence = source.map((hop, index) => ({
@@ -177,7 +224,15 @@ export function whoisCollectionStatus(chain, requestedDomain) {
     const source = normalizeWhoisChain(chain);
     if (!source.length || source[0]?.error)
         return 'error';
+    const first = source[0];
+    if (first.server === 'registry capability policy') {
+        if (source.length === 1 && first.queryProfile === 'not-issued' && first.response === undefined
+            && first.address === undefined && first.queriedAt === undefined
+            && (first.status === 'unsupported' || first.status === 'skipped'))
+            return first.status;
+        return 'error';
+    }
     if (source.length === 1)
-        return 'unsupported';
+        return ianaDiscoveryHasNoWhoisService(chain, first, requestedDomain) ? 'unsupported' : 'partial';
     return analyzeWhoisChainAuthority(source, requestedDomain).chainStatus;
 }

package/lib/whois-chain.mjs

@@ -65,7 +65,8 @@ export async function buildWhoisChainUncached(query, options = {}) {
                 server: 'registry capability policy',
                 queryProfile: 'not-issued',
                 responseEncoding: 'utf-8',
-                error: admission.state === 'permission_required'
+                status: admission.state === 'permission_required' ? 'skipped' : 'unsupported',
+                detail: admission.state === 'permission_required'
                     ? 'WHOIS collection requires registry permission or source authorisation; no socket was opened.'
                     : 'IANA publishes no domain WHOIS service for this suffix; no socket was opened.',
             }];
@@ -146,7 +147,16 @@ export async function buildWhoisChainUncached(query, options = {}) {
     return chain;
 }
 export async function buildWhoisChain(query, options = {}) {
-    if (options.signal)
-        return buildWhoisChainUncached(query, options);
-    return cached(`whois:${query.toLowerCase()}`, () => buildWhoisChainUncached(query));
+    let ownedCollection;
+    try {
+        return await cached(`whois:${query.toLowerCase()}`, () => {
+            ownedCollection = buildWhoisChainUncached(query, options);
+            return ownedCollection;
+        }, options.signal);
+    }
+    finally {
+        // Cache cancellation rejects promptly, but a started transport still belongs
+        // to this lookup lease. Drain it before its caller can release that lease.
+        await ownedCollection?.catch(() => { });
+    }
 }

package/lib/whois-common-formats.mjs

@@ -245,7 +245,9 @@ function applyWhoisCommonFormats(text, isRootHop, dialects, context) {
     // sometimes just a hostname, sometimes "hostname  ip.addr" - rather
     // than a per-line "Name Server:" label. Only meaningful on non-root hops.
     if (!isRootHop && nameservers.size === 0) {
-        const headerMatch = text.match(/^[ \t*]*(?:Name ?[Ss]ervers|Domain Servers|DNS servers)[ \t.]*:?[ \t]*$/mi);
+        // Whitespace after a colon belongs to that colon: two independent runs
+        // around an optional colon allow quadratic backtracking on invalid lines.
+        const headerMatch = text.match(/^[ \t*]*(?:Name ?[Ss]ervers|Domain Servers|DNS servers)[ \t.]*(?::[ \t]*)?$/mi);
         if (headerMatch) {
             let found = 0;
             for (const line of text.slice((headerMatch.index ?? 0) + headerMatch[0].length).split('\n')) {

package/lib/whois-contacts.mjs

@@ -30,7 +30,9 @@ export function resolveIsnicRole(text, handle) {
     if (!handle)
         return null;
     const escaped = handle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    const headerMatch = text.match(new RegExp(`^[ \\t]*role:[ \\t]*(.+)\\r?\\n[ \\t]*nic-hdl:[ \\t]*${escaped}[ \\t]*$`, 'im'));
+    // Capture the whole role value, including leading whitespace. A separate
+    // whitespace run overlaps this capture and backtracks when the handle fails.
+    const headerMatch = text.match(new RegExp(`^[ \\t]*role:(.+)\\r?\\n[ \\t]*nic-hdl:[ \\t]*${escaped}[ \\t]*$`, 'im'));
     if (!headerMatch)
         return null;
     const lines = text
@@ -143,7 +145,7 @@ export function parseIndentedContactBlock(text, headerRe) {
     if (lines.length === 0)
         return null;
     const remaining = [...lines];
-    const emailIndex = remaining.findIndex((line) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(line));
+    const emailIndex = remaining.findIndex(isIndentedContactEmail);
     const email = emailIndex !== -1
         ? remaining.splice(emailIndex, 1)[0]
         : null;
@@ -161,3 +163,12 @@ export function parseIndentedContactBlock(text, headerRe) {
         truncated: allLines.length > lines.length,
     };
 }
+// Preserve the legacy contact classifier (not a mailbox validator), without
+// repeatedly trying a different separator in a long, dot-heavy failed match.
+function isIndentedContactEmail(line) {
+    const at = line.indexOf('@');
+    if (at <= 0 || line.indexOf('@', at + 1) !== -1 || /\s/.test(line))
+        return false;
+    const dot = line.indexOf('.', at + 2);
+    return dot !== -1 && dot < line.length - 1;
+}

package/lib/whois-contracts.mjs

@@ -2,3 +2,5 @@
 // consumers can depend on the record shape without importing network code.
 export const MAX_WHOIS_STATUSES = 100;
 export const MAX_WHOIS_QUERY_HOPS = 6;
+// A stopped referral remains evidence even when no further request is issued.
+export const MAX_WHOIS_CHAIN_HOPS = MAX_WHOIS_QUERY_HOPS + 1;

package/lib/whois-normalization.mjs

@@ -2,14 +2,12 @@
 // Keeping this separate lets authority analysis and field parsing share the
 // exact same defensive input boundary.
 import { MAX_WHOIS_BYTES } from "./whois-transport.mjs";
-// Collection performs at most six network queries and may retain one seventh,
-// non-issued hop explaining a loop or hop-limit termination.
-const MAX_WHOIS_HOPS = 7;
+import { MAX_WHOIS_CHAIN_HOPS } from "./whois-contracts.mjs";
 export function normalizeWhoisChain(value) {
     if (!Array.isArray(value))
         return [];
     const normalized = [];
-    for (const hopValue of value.slice(0, MAX_WHOIS_HOPS)) {
+    for (const hopValue of value.slice(0, MAX_WHOIS_CHAIN_HOPS)) {
         if (!hopValue || typeof hopValue !== 'object' || Array.isArray(hopValue))
             continue;
         const hop = hopValue;
@@ -25,6 +23,8 @@ export function normalizeWhoisChain(value) {
             // original hop retains its wire text. Lone and embedded controls remain.
             ...(typeof hop.response === 'string' ? { response: hop.response.slice(0, MAX_WHOIS_BYTES).replace(/\r\n/g, '\n') } : {}),
             ...(typeof hop.error === 'string' ? { error: hop.error.slice(0, 1000) } : {}),
+            ...(hop.status === 'unsupported' || hop.status === 'skipped' ? { status: hop.status } : {}),
+            ...(typeof hop.detail === 'string' ? { detail: hop.detail.slice(0, 1000) } : {}),
         });
     }
     return normalized;

package/package.json

@@ -29,24 +29,24 @@
     "type": "git",
     "url": "git+https://github.com/slicedearth/whoisleuth.git"
   },
-  "homepage": "https://www.whoisleuth.com/",
+  "homepage": "https://www.whoisleuth.com",
   "bugs": {
     "url": "https://github.com/slicedearth/whoisleuth/issues"
   },
-  "version": "2.5.1",
+  "version": "2.7.0",
   "dependencies": {
     "@nuintun/qrcode": "5.0.3",
-    "@peculiar/x509": "2.1.0",
+    "@peculiar/x509": "2.2.0",
     "fast-png": "8.0.0",
     "fflate": "0.8.3",
     "maxmind": "5.0.7",
     "parse5": "8.0.1",
-    "pdfjs-dist": "6.3.289",
-    "postal-mime": "3.0.0",
+    "pdfjs-dist": "6.4.299",
+    "postal-mime": "4.0.7",
     "reflect-metadata": "0.2.2",
     "saxes": "6.0.0",
-    "tldts": "7.4.14",
-    "undici": "8.11.0"
+    "tldts": "7.4.18",
+    "undici": "8.12.2"
   },
   "files": [
     "bin/**/*.mjs",
@@ -58,6 +58,8 @@
     "docs/cli.md",
     "docs/cli-reference.md",
     "docs/contextual-reviews.md",
+    "docs/offline-intake-context.md",
+    "docs/infrastructure-observations.md",
     "DISCLOSURE",
     "LICENSE",
     "NOTICE",

package/packages/analysis/bounded-json.mjs

@@ -127,7 +127,7 @@ export function assertBoundedJsonStructure(value, label = 'JSON value', limits =
     };
     visit(value, 0);
 }
-export function scanBoundedJson(raw, limits = {}, observeString) {
+export function scanBoundedJson(raw, limits = {}, observeString, observeStringLocation) {
     const maximumDepth = limits.maximumDepth ?? MAX_BOUNDED_JSON_DEPTH;
     const maximumKeys = limits.maximumKeys ?? MAX_BOUNDED_JSON_KEYS;
     const maximumValues = limits.maximumValues ?? MAX_BOUNDED_JSON_VALUES;
@@ -136,6 +136,7 @@ export function scanBoundedJson(raw, limits = {}, observeString) {
     let keys = 0;
     let values = 0;
     let stringCodeUnits = 0;
+    const path = [];
     const whitespace = () => {
         while (index < raw.length) {
             const code = raw.charCodeAt(index);
@@ -213,6 +214,7 @@ export function scanBoundedJson(raw, limits = {}, observeString) {
         if (character === '"') {
             const parsedString = stringToken();
             observeString?.({ ...parsedString, kind: 'value', ...(propertyKey === undefined ? {} : { propertyKey }) });
+            observeStringLocation?.({ ...parsedString, end: index, path: [...path] });
             return;
         }
         if (character === '{') {
@@ -245,7 +247,11 @@ export function scanBoundedJson(raw, limits = {}, observeString) {
                 if (raw[index] !== ':')
                     syntaxError();
                 index += 1;
+                if (observeStringLocation)
+                    path.push(key);
                 value(depth + 1, key);
+                if (observeStringLocation)
+                    path.pop();
                 whitespace();
                 if (raw[index] === '}') {
                     index += 1;
@@ -271,7 +277,11 @@ export function scanBoundedJson(raw, limits = {}, observeString) {
                 if (items > maximumContainerItems) {
                     throw new TypeError(`Artefact JSON contains a container with more than ${maximumContainerItems} items.`);
                 }
+                if (observeStringLocation)
+                    path.push(items - 1);
                 value(depth + 1);
+                if (observeStringLocation)
+                    path.pop();
                 whitespace();
                 if (raw[index] === ']') {
                     index += 1;
@@ -312,7 +322,7 @@ export function parseBoundedJson(raw, options) {
     if (bytes < 1 || bytes > options.maximumBytes) {
         throw new TypeError(`${label} must be between 1 byte and ${options.maximumBytes} bytes.`);
     }
-    scanBoundedJson(raw, options.limits);
+    scanBoundedJson(raw, options.limits, undefined, options.observeStringLocation);
     try {
         return JSON.parse(raw);
     }