@slicedearth/whoisleuth-cli 1.32.0

package/lib/registry-insights.mjs

@@ -0,0 +1,325 @@
+// Bounded interpretation of already-collected registry and WHOIS evidence.
+//
+// This module performs no network work. It keeps raw source statuses alongside
+// conservative lifecycle, disclosure, reconciliation, publication-quality,
+// and abuse-routing summaries so a missing field never becomes a claim that
+// contact data or a registration condition is absent.
+import { compareRegistrySources } from "./registry-comparison.mjs";
+import { inspectRdapCapabilities } from "./rdap-capabilities.mjs";
+export const REGISTRY_INSIGHTS_VERSION = 1;
+export const MAX_REGISTRY_INSIGHT_STATUSES = 40;
+export const MAX_REGISTRY_INSIGHT_ISSUES = 12;
+export const MAX_REGISTRY_ABUSE_ROUTES = 8;
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+const PRIVACY_PROXY_RE = /(?:privacy|proxy|whoisguard|data protected|identity protect|private registration)/iu;
+const REDACTED_RE = /(?:redacted|masked|not published)/iu;
+const WITHHELD_RE = /(?:withheld|not disclosed|restricted disclosure)/iu;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function text(value, maximum = 320) {
+    return typeof value === 'string' && !CONTROL_RE.test(value)
+        ? value.trim().slice(0, maximum)
+        : '';
+}
+function strings(value, maximum = MAX_REGISTRY_INSIGHT_STATUSES) {
+    if (!Array.isArray(value))
+        return [];
+    const unique = new Set();
+    for (const item of value.slice(0, maximum * 2)) {
+        const normalized = text(item, 160);
+        if (normalized)
+            unique.add(normalized);
+        if (unique.size >= maximum)
+            break;
+    }
+    return [...unique];
+}
+function normalizedStatus(value) {
+    return text(value, 160).toLowerCase().replace(/[^\p{L}\p{N}]+/gu, '');
+}
+function sourceState(status, partial) {
+    if (partial || status === 'partial')
+        return 'partial';
+    return typeof status === 'string'
+        && ['success', 'complete'].includes(status)
+        ? 'complete'
+        : 'unavailable';
+}
+function redactionBlob(parsed) {
+    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, 50) : [];
+    return redactions.map((item) => {
+        const value = record(item);
+        return [
+            value.name,
+            value.reason,
+            value.method,
+            value.prePath,
+            value.postPath,
+            value.replacementPath,
+        ].map((part) => text(part, 240)).join(' ');
+    }).join(' ');
+}
+function contactBlob(contact) {
+    const value = record(contact);
+    return [
+        value.name,
+        value.org,
+        value.email,
+        value.phone,
+        value.address,
+        ...(Array.isArray(value.names) ? value.names.slice(0, 10) : []),
+        ...(Array.isArray(value.organizations) ? value.organizations.slice(0, 10) : []),
+        ...(Array.isArray(value.emails) ? value.emails.slice(0, 10) : []),
+    ].map((part) => text(part, 320)).filter(Boolean).join(' ');
+}
+function disclosure(source, parsedValue, status) {
+    if (!isRecord(parsedValue)) {
+        return {
+            source,
+            state: 'unavailable',
+            detail: 'The source did not provide a usable normalized publication.',
+        };
+    }
+    const parsed = record(parsedValue);
+    const partial = source === 'whois'
+        ? parsed.chainStatus === 'partial' || strings(parsed.fieldsTruncated, 20).length > 0
+        : parsed.serverTruncated === true
+            || parsed.entitiesTruncated === true
+            || parsed.statusesTruncated === true;
+    const publicationState = sourceState(status, partial);
+    if (publicationState === 'unavailable') {
+        return {
+            source,
+            state: 'unavailable',
+            detail: 'The source was unavailable, skipped, unsupported, or did not return a usable publication.',
+        };
+    }
+    const registrant = source === 'registry_rdap'
+        ? contactBlob(parsed.registrant)
+        : [
+            parsed.registrantName,
+            parsed.registrantOrg,
+            parsed.registrantEmail,
+            parsed.registrantPhone,
+            parsed.registrantAddress,
+        ].map((part) => text(part, 320)).filter(Boolean).join(' ');
+    const redactions = redactionBlob(parsed);
+    const combined = `${registrant} ${redactions}`.trim();
+    if (WITHHELD_RE.test(combined)) {
+        return { source, state: 'withheld', detail: 'The publication indicates that registrant data was withheld or not disclosed.' };
+    }
+    if (REDACTED_RE.test(combined) || redactions) {
+        return { source, state: 'redacted', detail: 'The publication explicitly marks registrant data as redacted or removed.' };
+    }
+    if (PRIVACY_PROXY_RE.test(registrant)) {
+        return { source, state: 'privacy_proxy', detail: 'The published registrant fields appear to identify a privacy or proxy service.' };
+    }
+    if (registrant) {
+        return { source, state: 'public', detail: 'The source published at least one usable registrant contact field.' };
+    }
+    if (publicationState === 'partial') {
+        return {
+            source,
+            state: 'unavailable',
+            detail: 'The publication was partial, so missing registrant fields are not treated as evidence of absence.',
+        };
+    }
+    return {
+        source,
+        state: 'absent',
+        detail: 'The source completed without a usable registrant contact or an explicit disclosure marker.',
+    };
+}
+function lifecycle(statusesValue) {
+    const rawStatuses = strings(statusesValue);
+    const normalized = rawStatuses.map(normalizedStatus);
+    const has = (value) => normalized.includes(value);
+    const pendingDelete = has('pendingdelete');
+    const redemption = has('redemptionperiod');
+    const pendingTransfer = has('pendingtransfer');
+    const serverHold = has('serverhold');
+    const clientHold = has('clienthold');
+    const serverLocks = normalized.filter((value) => /^server(?:delete|renew|transfer|update)prohibited$/u.test(value));
+    const clientLocks = normalized.filter((value) => /^client(?:delete|renew|transfer|update)prohibited$/u.test(value));
+    let stage = 'registered';
+    let label = 'Registered';
+    let acquisitionPath = ['Continue monitoring registry status and expiry.'];
+    if (pendingDelete) {
+        stage = 'pending_delete';
+        label = 'Pending delete';
+        acquisitionPath = [
+            'Confirm the status from the authoritative registry publication.',
+            'Monitor for deletion without assuming a release time or successful registration.',
+            'Use a registrar or registry-supported acquisition path when policy permits.',
+        ];
+    }
+    else if (redemption) {
+        stage = 'redemption';
+        label = 'Redemption period';
+        acquisitionPath = [
+            'The current registrant may still be able to restore the registration.',
+            'Monitor for restoration or a later pending-delete transition.',
+            'Do not treat the domain as available or guaranteed to drop.',
+        ];
+    }
+    else if (pendingTransfer) {
+        stage = 'pending_transfer';
+        label = 'Pending transfer';
+        acquisitionPath = ['A registrar transfer is pending; this is not an availability signal.'];
+    }
+    else if (serverHold || clientHold) {
+        stage = 'hold';
+        label = 'Registration hold';
+        acquisitionPath = ['A hold affects delegation or publication; it does not mean the registration is available.'];
+    }
+    return {
+        stage,
+        label,
+        rawStatuses,
+        redemption,
+        pendingDelete,
+        pendingTransfer,
+        hold: { client: clientHold, server: serverHold },
+        locks: {
+            client: clientLocks.length > 0,
+            server: serverLocks.length > 0,
+            clientStatuses: clientLocks,
+            serverStatuses: serverLocks,
+        },
+        acquisitionPath,
+        limitation: 'EPP statuses describe the current registry lifecycle. They do not guarantee deletion, release timing, transfer completion, eligibility, price, or acquisition success.',
+    };
+}
+function publicationDiagnostic(source, parsedValue, status, observedAt) {
+    const usablePublication = isRecord(parsedValue);
+    const parsed = record(parsedValue);
+    const partial = parsed.serverTruncated === true
+        || parsed.chainStatus === 'partial'
+        || parsed.entitiesTruncated === true
+        || parsed.statusesTruncated === true
+        || strings(parsed.fieldsTruncated, 20).length > 0;
+    const state = usablePublication ? sourceState(status, partial) : 'unavailable';
+    const issues = [];
+    if (state === 'unavailable')
+        issues.push('No usable publication was available from this source.');
+    if (parsed.serverTruncated === true)
+        issues.push('The RDAP server declared a truncated response.');
+    if (parsed.entitiesTruncated === true)
+        issues.push('The normalized entity inventory was capped.');
+    if (parsed.statusesTruncated === true)
+        issues.push('The normalized status inventory was capped.');
+    if (strings(parsed.fieldsTruncated, 20).length)
+        issues.push('One or more normalized WHOIS fields were capped.');
+    if (parsed.chainStatus === 'partial')
+        issues.push('The WHOIS referral chain was incomplete or conflicting.');
+    const conformance = strings(parsed.conformance, 30);
+    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, 50) : [];
+    return {
+        source,
+        state,
+        observedAt: text(observedAt, 64) || null,
+        conformance,
+        redactionCount: redactions.length,
+        issueCount: Math.min(issues.length, MAX_REGISTRY_INSIGHT_ISSUES),
+        issues: issues.slice(0, MAX_REGISTRY_INSIGHT_ISSUES),
+    };
+}
+function contactRoute(kind, contact, source) {
+    const value = record(contact);
+    return [
+        { channel: 'email', contact: text(value.email, 320) },
+        { channel: 'phone', contact: text(value.phone, 80) },
+    ].filter((item) => item.contact).map((item) => ({
+        kind,
+        contact: item.contact,
+        channel: item.channel,
+        source,
+        limitations: [
+            'A published contact does not prove that the destination is monitored, appropriate for the incident, or responsible for the observed content.',
+        ],
+    }));
+}
+export function buildRegistryInsights(input) {
+    const rdap = record(input.rdapParsed);
+    const whois = record(input.whoisParsed);
+    const registrarRdap = record(input.registrarRdapParsed);
+    const comparison = compareRegistrySources(rdap, whois, {
+        rdapStatus: input.rdapStatus,
+        whoisStatus: input.whoisStatus,
+    });
+    const counts = comparison.counts;
+    const conflictCount = counts.conflict;
+    const sourceOnlyCount = counts.rdap_only + counts.whois_only;
+    const redactedCount = counts.rdap_redacted + counts.whois_redacted;
+    const unavailableCount = counts.rdap_unavailable
+        + counts.whois_unavailable
+        + counts.rdap_incomplete
+        + counts.whois_incomplete;
+    const reconciliationState = conflictCount
+        ? 'conflict'
+        : unavailableCount
+            ? 'partial'
+            : sourceOnlyCount || redactedCount
+                ? 'source_specific'
+                : counts.equivalent
+                    ? 'consistent'
+                    : 'unavailable';
+    const statuses = strings(rdap.statuses).length ? rdap.statuses : whois.statuses;
+    const routes = [
+        ...contactRoute('registry', rdap.abuse, 'Registry RDAP abuse entity'),
+        ...contactRoute('registrar', rdap.registrar, 'Registry RDAP registrar entity'),
+        ...contactRoute('registrar', registrarRdap.abuse, 'Registrar RDAP abuse entity'),
+        ...contactRoute('registrar', registrarRdap.registrar, 'Registrar RDAP registrar entity'),
+        ...contactRoute('registrar', { email: whois.abuseEmail, phone: whois.abusePhone }, 'WHOIS registrar abuse fields'),
+    ];
+    const uniqueRoutes = new Map();
+    for (const route of routes) {
+        const key = `${route.kind}\u0000${route.channel}\u0000${route.contact.toLowerCase()}`;
+        if (!uniqueRoutes.has(key))
+            uniqueRoutes.set(key, route);
+        if (uniqueRoutes.size >= MAX_REGISTRY_ABUSE_ROUTES)
+            break;
+    }
+    return {
+        version: REGISTRY_INSIGHTS_VERSION,
+        contactDisclosure: {
+            registryRdap: disclosure('registry_rdap', input.rdapParsed, input.rdapStatus),
+            whois: disclosure('whois', input.whoisParsed, input.whoisStatus),
+            limitation: 'Disclosure state describes what each point-in-time source published. It does not infer the identity, intent, reachability, or legal status of a registrant.',
+        },
+        lifecycle: lifecycle(statuses),
+        reconciliation: {
+            state: reconciliationState,
+            conflictCount,
+            equivalentCount: counts.equivalent,
+            sourceOnlyCount,
+            redactedCount,
+            unavailableCount,
+            summary: conflictCount
+                ? `${conflictCount} normalized registry conflict${conflictCount === 1 ? '' : 's'} require source review.`
+                : unavailableCount
+                    ? 'The comparison is partial because at least one publication was unavailable or incomplete.'
+                    : sourceOnlyCount || redactedCount
+                        ? 'The sources differ in publication or disclosure without a normalized conflict.'
+                        : counts.equivalent
+                            ? 'The comparable fields are normalized as equivalent.'
+                            : 'No comparable fields were available.',
+        },
+        publications: [
+            publicationDiagnostic('registry_rdap', input.rdapParsed, input.rdapStatus, input.rdapFetchedAt),
+            publicationDiagnostic('whois', input.whoisParsed, input.whoisStatus, input.whoisQueriedAt),
+            publicationDiagnostic('registrar_rdap', input.registrarRdapParsed, input.registrarRdapStatus, input.registrarRdapFetchedAt),
+        ],
+        rdapCapabilities: {
+            registry: inspectRdapCapabilities(input.rdapParsed, input.rdapStatus),
+            registrar: inspectRdapCapabilities(input.registrarRdapParsed, input.registrarRdapStatus),
+        },
+        abuseRouting: [...uniqueRoutes.values()],
+    };
+}

package/lib/response-policy.mjs

@@ -0,0 +1,256 @@
+// Privacy-minimized interpretation of selected response policies. Header and
+// cookie values are read transiently from the already-selected homepage
+// response and reduced to fixed signal identifiers plus bounded counts.
+export const RESPONSE_POLICY_VERSION = 1;
+export const MAX_RESPONSE_POLICY_HEADER_BYTES = 8 * 1024;
+export const MAX_RESPONSE_POLICY_DIRECTIVES = 64;
+export const MAX_RESPONSE_POLICY_TOKENS = 128;
+export const MAX_RESPONSE_COOKIES = 32;
+export const MAX_RESPONSE_COOKIE_BYTES = 4 * 1024;
+export const MAX_RESPONSE_COOKIE_TOTAL_BYTES = 32 * 1024;
+export const MIN_RECOMMENDED_HSTS_SECONDS = 180 * 24 * 60 * 60;
+const CONTROL_RE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
+const DIRECTIVE_NAME_RE = /^[a-z][a-z0-9-]{0,63}$/;
+const ATTRIBUTE_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]{1,128}$/;
+const CSP_NONCE_OR_HASH_RE = /^'(?:nonce-[^']+|sha(?:256|384|512)-[^']+)'$/i;
+const REFERRER_POLICIES = new Set([
+    'no-referrer',
+    'no-referrer-when-downgrade',
+    'origin',
+    'origin-when-cross-origin',
+    'same-origin',
+    'strict-origin',
+    'strict-origin-when-cross-origin',
+    'unsafe-url',
+]);
+const PERMISSIVE_REFERRER_POLICIES = new Set(['no-referrer-when-downgrade', 'unsafe-url']);
+function boundedCount(value, maximum) {
+    return Math.max(0, Math.min(maximum, Math.trunc(value)));
+}
+function readHeader(headers, name) {
+    if (!headers || typeof headers.get !== 'function')
+        return { state: 'absent', value: null };
+    let raw;
+    try {
+        raw = headers.get(name);
+    }
+    catch {
+        return { state: 'malformed', value: null };
+    }
+    if (raw === null || raw.trim() === '')
+        return { state: 'absent', value: null };
+    if (CONTROL_RE.test(raw))
+        return { state: 'malformed', value: null };
+    if (new TextEncoder().encode(raw).byteLength > MAX_RESPONSE_POLICY_HEADER_BYTES) {
+        return { state: 'partial', value: null };
+    }
+    return { state: 'present', value: raw.trim() };
+}
+function addSignal(signals, id, count) {
+    if (signals.some((signal) => signal.id === id))
+        return;
+    signals.push(count === undefined ? { id } : { id, count: boundedCount(count, MAX_RESPONSE_COOKIES) });
+}
+function unavailableHeaderState(header) {
+    return header.state === 'present' ? 'malformed' : header.state;
+}
+function analyzeCsp(header, signals) {
+    if (header.state !== 'present' || !header.value) {
+        return unavailableHeaderState(header);
+    }
+    const directives = new Map();
+    let tokenCount = 0;
+    let partial = false;
+    for (const rawDirective of header.value.split(';')) {
+        const normalized = rawDirective.trim();
+        if (!normalized)
+            continue;
+        const [rawName = '', ...rawTokens] = normalized.split(/\s+/u);
+        const name = rawName.toLowerCase();
+        if (!DIRECTIVE_NAME_RE.test(name))
+            return 'malformed';
+        if (directives.has(name))
+            continue;
+        if (directives.size >= MAX_RESPONSE_POLICY_DIRECTIVES) {
+            partial = true;
+            break;
+        }
+        const remaining = Math.max(0, MAX_RESPONSE_POLICY_TOKENS - tokenCount);
+        const tokens = rawTokens.slice(0, remaining).map((token) => token.toLowerCase());
+        if (tokens.length !== rawTokens.length)
+            partial = true;
+        tokenCount += tokens.length;
+        directives.set(name, tokens);
+    }
+    if (!directives.size)
+        return 'malformed';
+    const defaultSources = directives.get('default-src');
+    const scriptSources = directives.get('script-src') || defaultSources;
+    if (!defaultSources)
+        addSignal(signals, 'csp_default_source_missing');
+    if (!directives.has('base-uri'))
+        addSignal(signals, 'csp_base_uri_missing');
+    if (!directives.has('object-src') && !defaultSources)
+        addSignal(signals, 'csp_object_source_unbounded');
+    if (scriptSources) {
+        if (scriptSources.some((token) => ['*', 'http:', 'https:', 'data:', 'blob:'].includes(token))) {
+            addSignal(signals, 'csp_permissive_script_source');
+        }
+        if (scriptSources.includes("'unsafe-eval'"))
+            addSignal(signals, 'csp_unsafe_eval');
+        if (scriptSources.includes("'unsafe-inline'")
+            && !scriptSources.some((token) => CSP_NONCE_OR_HASH_RE.test(token))) {
+            addSignal(signals, 'csp_unsafe_inline');
+        }
+    }
+    return partial ? 'partial' : 'parsed';
+}
+function analyzeHsts(header, signals) {
+    if (header.state !== 'present' || !header.value) {
+        return unavailableHeaderState(header);
+    }
+    const directives = header.value.split(';').map((part) => part.trim()).filter(Boolean);
+    if (directives.length > MAX_RESPONSE_POLICY_DIRECTIVES)
+        return 'partial';
+    const maxAge = directives
+        .map((part) => part.match(/^max-age\s*=\s*(\d+)$/iu)?.[1] || null)
+        .find((value) => value !== null);
+    if (!maxAge || maxAge.length > 12)
+        return 'malformed';
+    const seconds = Number(maxAge);
+    if (!Number.isSafeInteger(seconds) || seconds < 0)
+        return 'malformed';
+    if (seconds === 0)
+        addSignal(signals, 'hsts_disabled');
+    else if (seconds < MIN_RECOMMENDED_HSTS_SECONDS)
+        addSignal(signals, 'hsts_short_max_age');
+    return 'parsed';
+}
+function analyzeReferrerPolicy(header, signals) {
+    if (header.state !== 'present' || !header.value) {
+        return unavailableHeaderState(header);
+    }
+    const candidates = header.value
+        .split(',')
+        .map((item) => item.trim().toLowerCase())
+        .filter(Boolean)
+        .slice(0, MAX_RESPONSE_POLICY_TOKENS);
+    const effective = candidates.filter((candidate) => REFERRER_POLICIES.has(candidate)).at(-1);
+    if (!effective)
+        return 'malformed';
+    if (PERMISSIVE_REFERRER_POLICIES.has(effective)) {
+        addSignal(signals, 'referrer_policy_permissive');
+    }
+    return candidates.length >= MAX_RESPONSE_POLICY_TOKENS ? 'partial' : 'parsed';
+}
+function responseCookies(headers) {
+    if (!headers)
+        return { state: 'absent', values: [], truncated: false };
+    let values = [];
+    try {
+        const combined = typeof headers.getSetCookie === 'function' ? null : headers.get('set-cookie');
+        values = typeof headers.getSetCookie === 'function'
+            ? headers.getSetCookie()
+            : combined
+                ? [combined]
+                : [];
+    }
+    catch {
+        return { state: 'malformed', values: [], truncated: false };
+    }
+    if (!values.length)
+        return { state: 'absent', values: [], truncated: false };
+    const retained = [];
+    let totalBytes = 0;
+    let truncated = values.length > MAX_RESPONSE_COOKIES;
+    for (const value of values.slice(0, MAX_RESPONSE_COOKIES)) {
+        if (typeof value !== 'string' || CONTROL_RE.test(value))
+            return { state: 'malformed', values: [], truncated };
+        const bytes = new TextEncoder().encode(value).byteLength;
+        if (bytes > MAX_RESPONSE_COOKIE_BYTES || totalBytes + bytes > MAX_RESPONSE_COOKIE_TOTAL_BYTES) {
+            truncated = true;
+            continue;
+        }
+        totalBytes += bytes;
+        retained.push(value);
+    }
+    return { state: truncated ? 'partial' : 'parsed', values: retained, truncated };
+}
+function analyzeCookies(headers, signals) {
+    const result = responseCookies(headers);
+    if (!result.values.length)
+        return { state: result.state, count: 0, truncated: result.truncated };
+    let missingSecure = 0;
+    let missingHttpOnly = 0;
+    let missingSameSite = 0;
+    let sameSiteNoneWithoutSecure = 0;
+    for (const value of result.values) {
+        const segments = value.split(';');
+        if (!segments[0]?.includes('='))
+            return { state: 'malformed', count: result.values.length, truncated: result.truncated };
+        const attributes = new Map();
+        for (const rawAttribute of segments.slice(1, MAX_RESPONSE_POLICY_TOKENS + 1)) {
+            const [rawName = '', ...rawValue] = rawAttribute.trim().split('=');
+            const name = rawName.toLowerCase();
+            if (!name || !ATTRIBUTE_NAME_RE.test(name))
+                continue;
+            attributes.set(name, rawValue.length ? rawValue.join('=').trim().toLowerCase() : null);
+        }
+        const secure = attributes.has('secure');
+        const httpOnly = attributes.has('httponly');
+        const sameSite = attributes.get('samesite');
+        if (!secure)
+            missingSecure++;
+        if (!httpOnly)
+            missingHttpOnly++;
+        if (!sameSite)
+            missingSameSite++;
+        if (sameSite === 'none' && !secure)
+            sameSiteNoneWithoutSecure++;
+    }
+    if (missingSecure)
+        addSignal(signals, 'cookies_missing_secure', missingSecure);
+    if (missingHttpOnly)
+        addSignal(signals, 'cookies_missing_http_only', missingHttpOnly);
+    if (missingSameSite)
+        addSignal(signals, 'cookies_missing_same_site', missingSameSite);
+    if (sameSiteNoneWithoutSecure) {
+        addSignal(signals, 'cookies_same_site_none_without_secure', sameSiteNoneWithoutSecure);
+    }
+    return { state: result.state, count: result.values.length, truncated: result.truncated };
+}
+export function analyzeResponsePolicyHeaders(headers) {
+    const signals = [];
+    const contentSecurityPolicy = analyzeCsp(readHeader(headers, 'content-security-policy'), signals);
+    const strictTransportSecurity = analyzeHsts(readHeader(headers, 'strict-transport-security'), signals);
+    const referrerPolicy = analyzeReferrerPolicy(readHeader(headers, 'referrer-policy'), signals);
+    const cookies = analyzeCookies(headers, signals);
+    const components = {
+        contentSecurityPolicy,
+        strictTransportSecurity,
+        referrerPolicy,
+        responseCookies: cookies.state,
+    };
+    const partial = Object.values(components).some((state) => state === 'partial' || state === 'malformed');
+    const limitations = [
+        'Policy findings describe only the selected HTTP response and are not a site-wide vulnerability or exploitability assessment.',
+        'Header and cookie values, names, paths, domains, nonces, hashes, and reporting endpoints are discarded after analysis.',
+    ];
+    if (partial)
+        limitations.push('One or more selected policy values could not be interpreted completely.');
+    if (cookies.truncated)
+        limitations.push('Response-cookie analysis reached its configured count or byte limit.');
+    return {
+        responsePolicyVersion: RESPONSE_POLICY_VERSION,
+        status: partial ? 'partial' : 'success',
+        complete: !partial,
+        components,
+        signals: signals.slice(0, 16),
+        diagnostics: {
+            signalCount: Math.min(signals.length, 16),
+            cookieCount: boundedCount(cookies.count, MAX_RESPONSE_COOKIES),
+            cookiesTruncated: cookies.truncated,
+        },
+        limitations,
+    };
+}