M&A Digital Due Diligence

async function assessAcquisitionTarget(targetDomains) {
  const headers = { 'Authorization': 'Bearer YOUR_API_KEY' };

  const assessments = await Promise.all(
    targetDomains.map(async (domain) => {
      // Domain-intelligence is the workhorse — WHOIS + RDAP contacts + SSL +
      // CAA + HTTP security headers + threat feeds + DNSSEC + registrar
      // reputation, all in one call. Add tech / CDN detection alongside.
      const [intelRes, techRes, cdnRes] = await Promise.all([
        fetch(`https://api.edgedns.dev/v1/composite/domain-intelligence?domain=${domain}`, { headers }),
        fetch(`https://api.edgedns.dev/v1/domain/tech?domain=${domain}`, { headers }),
        fetch(`https://api.edgedns.dev/v1/domain/cdn?domain=${domain}`, { headers }),
      ]);
      const intel = (await intelRes.json()).data;
      const tech = (await techRes.json()).data;
      const cdn = (await cdnRes.json()).data;

      const risks = [];

      // 1. Ownership transparency: surface RDAP contacts or flag if hidden
      const ownership = intel.whois?.privacy_proxy_in_use
        ? { hidden_behind_privacy_proxy: true }
        : intel.whois?.contacts ?? null;
      if (intel.whois?.privacy_proxy_in_use) {
        risks.push('Ownership hidden behind privacy proxy — request unmasked contact details during diligence');
      }

      // 2. Certificate-authority controls
      if (intel.caa && !intel.caa.enforces_restriction) {
        risks.push('No CAA restriction — any public CA may issue certificates for this domain');
      }
      if (intel.caa?.matches_current_issuer === false) {
        risks.push('Live cert issuer is not in the CAA allowlist — renewal will be denied');
      }

      // 3. HTTP security headers grade
      const hdr = intel.http_headers;
      if (hdr?.fetched && ['D', 'F'].includes(hdr.grade)) {
        risks.push(`HTTP security headers grade ${hdr.grade} — HSTS/CSP/XFO gaps need remediation`);
      }

      // 4. Confidence-weighted infrastructure assessment
      const infraConf = intel.summary?.infrastructure_score_confidence ?? 0;
      if (infraConf < 0.7) {
        risks.push(`Infrastructure scan confidence ${(infraConf * 100).toFixed(0)}% — re-run before relying on score ${intel.summary.infrastructure_score}`);
      }

      // 5. Threat intelligence
      if (intel.threat?.is_threat) {
        risks.push('Domain appears in threat intelligence feeds — investigate before proceeding');
      }

      return {
        domain,
        ownership,
        infrastructure: {
          cdn: cdn.provider,
          technologies: tech.technologies?.map(t => t.name),
          dns_provider: intel.dns_provider?.provider,
          dnssec: intel.whois?.dnssec ?? false,
          ssl_valid: intel.summary?.ssl_valid,
          ssl_days_until_expiry: intel.ssl?.days_until_expiry,
          caa_restricts_issuance: intel.caa?.enforces_restriction ?? false,
          security_headers_grade: intel.http_headers?.grade ?? null,
          infrastructure_score: intel.summary?.infrastructure_score,
          confidence: intel.summary?.infrastructure_score_confidence,
          registrar: intel.whois?.registrar?.name,
          registrar_grade: intel.registrar_reputation?.grade,
        },
        risks,
      };
    })
  );

  return {
    target: targetDomains[0],
    domainCount: assessments.length,
    assessments,
    overallRisk: assessments.some(a => a.risks.length > 2) ? 'elevated' : 'acceptable',
  };
}