@slicedearth/whoisleuth-cli 1.36.1 → 1.43.0

package/cli/lookup-diff.mjs

@@ -1,13 +1,11 @@
 import { buildBulkComparisonEvidence } from "../lib/bulk-comparison-evidence.mjs";
+import { recordOrEmpty } from "../lib/bounded-contract-normalizers.mjs";
 import { buildBulkDomainComparison, } from "../frontend/src/lib/analysis/bulk-domain-comparison.js";
 import { relationshipObservation } from "../frontend/src/lib/analysis/relationship-evidence.js";
 import { CliUsageError } from "./errors.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
 export const CLI_LOOKUP_DIFF_SCHEMA = 'whoisleuth.cli.lookup-diff';
 export const CLI_LOOKUP_DIFF_VERSION = 1;
-function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-}
 function text(value, maximum = 300) {
     if (typeof value !== 'string')
         return null;
@@ -23,14 +21,14 @@ function stringList(value, maximum = 100) {
         }))].slice(0, maximum);
 }
 function lifecycleValue(parsed, field) {
-    const lifecycle = record(parsed.lifecycle);
+    const lifecycle = recordOrEmpty(parsed.lifecycle);
     return text(lifecycle[`${field}Iso`] ?? lifecycle[field] ?? parsed[`${field}Iso`] ?? parsed[field], 64);
 }
 function registrarLabel(parsed) {
     const registrar = parsed.registrar;
     if (typeof registrar === 'string')
         return text(registrar);
-    const source = record(registrar);
+    const source = recordOrEmpty(registrar);
     return text(source.name ?? source.org ?? source.handle);
 }
 function sourceState(value) {
@@ -50,25 +48,25 @@ function sourceState(value) {
     return 'unavailable';
 }
 function sourceCoverage(document, availability) {
-    const diagnostics = record(document.diagnostics);
+    const diagnostics = recordOrEmpty(document.diagnostics);
     const entries = [
-        ['rdap', record(diagnostics.rdap).status],
-        ['whois', record(diagnostics.whois).status],
-        ['availability', record(diagnostics.availability).status],
-        ['dns', record(availability.dns).status],
-        ['http', record(availability.http).status],
-        ['tls', record(availability.tls).status],
+        ['rdap', recordOrEmpty(diagnostics.rdap).status],
+        ['whois', recordOrEmpty(diagnostics.whois).status],
+        ['availability', recordOrEmpty(diagnostics.availability).status],
+        ['dns', recordOrEmpty(availability.dns).status],
+        ['http', recordOrEmpty(availability.http).status],
+        ['tls', recordOrEmpty(availability.tls).status],
     ];
     return entries.map(([source, status]) => ({ source, state: sourceState(status) }));
 }
 function lookupComparisonInput(document) {
-    const availability = record(document.availability);
-    const rdapParsed = record(record(document.rdap).parsed);
-    const whoisParsed = record(record(document.whois).parsed);
+    const availability = recordOrEmpty(document.availability);
+    const rdapParsed = recordOrEmpty(recordOrEmpty(document.rdap).parsed);
+    const whoisParsed = recordOrEmpty(recordOrEmpty(document.whois).parsed);
     const preferredRegistry = Object.keys(rdapParsed).length ? rdapParsed : whoisParsed;
     const relationship = relationshipObservation(availability);
-    const dns = record(availability.dns);
-    const dnsRecords = record(dns.records);
+    const dns = recordOrEmpty(availability.dns);
+    const dnsRecords = recordOrEmpty(dns.records);
     const comparisonEvidence = buildBulkComparisonEvidence(availability);
     return {
         domain: document.registrableDomain,
@@ -97,8 +95,8 @@ function lookupComparisonInput(document) {
         faviconMatch: false,
         faviconNearMatch: false,
         reusesOfficialAssets: false,
-        hasPasswordField: record(record(availability.credentialSurfaceProfile).inputs).categories
-            ? Number(record(record(record(availability.credentialSurfaceProfile).inputs).categories).password) > 0
+        hasPasswordField: recordOrEmpty(recordOrEmpty(availability.credentialSurfaceProfile).inputs).categories
+            ? Number(recordOrEmpty(recordOrEmpty(recordOrEmpty(availability.credentialSurfaceProfile).inputs).categories).password) > 0
             : false,
         hasExternalFormAction: null,
         phishingLanguageMatch: null,

package/cli/lookup-plan.mjs

@@ -3,13 +3,13 @@ export const CLI_LOOKUP_PLAN_VERSION = 1;
 const RDAP = Object.freeze({
     source: 'rdap',
     purpose: 'Collect authoritative registration or allocation evidence where supported.',
-    disclosure: 'The normalized target is sent to the applicable RDAP bootstrap and service endpoints.',
+    disclosure: 'The normalised target is sent to the applicable RDAP bootstrap and service endpoints.',
     conditional: false,
 });
 const WHOIS = Object.freeze({
     source: 'whois',
     purpose: 'Collect separately attributed registry and referral publications.',
-    disclosure: 'The normalized target is sent over bounded TCP connections to applicable WHOIS services.',
+    disclosure: 'The normalised target is sent over bounded TCP connections to applicable WHOIS services.',
     conditional: false,
 });
 const FAST_DOMAIN_EVIDENCE = Object.freeze({
@@ -39,7 +39,7 @@ const NETWORK_CONTEXT = Object.freeze({
 const REVERSE_DNS = Object.freeze({
     source: 'reverse_dns',
     purpose: 'Collect operator-published reverse-DNS context for a public IP address.',
-    disclosure: 'A DNS resolver receives the reverse lookup for the normalized IP address.',
+    disclosure: 'A DNS resolver receives the reverse lookup for the normalised IP address.',
     conditional: false,
 });
 function plannedSources(classified, deep) {

package/cli/lookup-reconcile.mjs

@@ -0,0 +1,141 @@
+import { CliUsageError } from "./errors.mjs";
+import { buildCliLookupDiff } from "./lookup-diff.mjs";
+import { parseSavedLookupDocument } from "./saved-lookup.mjs";
+const CLI_LOOKUP_RECONCILIATION_SCHEMA = 'whoisleuth.cli.lookup-reconciliation';
+const CLI_LOOKUP_RECONCILIATION_VERSION = 1;
+const MAX_LOOKUP_RECONCILIATION_INPUT_BYTES = 32 * 1024 * 1024;
+function object(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function label(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.replace(/[\u0000-\u001f\u007f]+/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, 80);
+    return normalized || null;
+}
+function observationContext(document) {
+    const context = object(document.collectionContext);
+    return {
+        generatedAt: document.generatedAt,
+        mode: document.mode,
+        observerLabel: label(context.observerLabel),
+        vantageLabel: label(context.vantageLabel),
+    };
+}
+function comparable(value, sourceState) {
+    if (['error', 'not_recorded', 'partial', 'skipped', 'unavailable', 'unsupported'].includes(sourceState))
+        return false;
+    return value !== 'Not observed' && value !== 'Not recorded in compact Bulk evidence';
+}
+function normalizedValue(value) {
+    return value.replace(/\s+/gu, ' ').trim().toLocaleLowerCase('en-US');
+}
+function buildCliLookupReconciliation(inputs, generatedAt = new Date().toISOString()) {
+    if (inputs.length < 2 || inputs.length > 5)
+        throw new CliUsageError('Lookup reconciliation requires from 2 to 5 observations.');
+    const documents = inputs.map((input, index) => parseSavedLookupDocument(input, {
+        label: `Lookup reconciliation observation ${index + 1}`,
+    }));
+    const domain = documents[0]?.registrableDomain;
+    if (!domain || documents.some((document) => document.registrableDomain !== domain)) {
+        throw new CliUsageError('Lookup reconciliation requires observations for one domain.');
+    }
+    const comparisons = documents.slice(1).map((document, index) => buildCliLookupDiff(inputs[0], inputs[index + 1], generatedAt, { domainMode: 'same' }));
+    const firstRows = comparisons[0]?.comparison.rows || [];
+    const fields = firstRows.map((firstRow) => {
+        const values = [{
+                observation: 0,
+                value: firstRow.left,
+                sourceState: firstRow.leftSourceState,
+                comparable: comparable(firstRow.left, firstRow.leftSourceState),
+            }];
+        for (let index = 0; index < comparisons.length; index++) {
+            const row = comparisons[index].comparison.rows.find((candidate) => candidate.id === firstRow.id);
+            if (!row)
+                continue;
+            values.push({
+                observation: index + 1,
+                value: row.right,
+                sourceState: row.rightSourceState,
+                comparable: comparable(row.right, row.rightSourceState),
+            });
+        }
+        const comparableValues = values.filter((value) => value.comparable);
+        const distinctValues = new Set(comparableValues.map((value) => normalizedValue(value.value)));
+        const state = comparableValues.length < 2
+            ? 'non_comparable'
+            : distinctValues.size === 1
+                ? 'agreement'
+                : 'disagreement';
+        return {
+            id: firstRow.id,
+            category: firstRow.category,
+            label: firstRow.label,
+            source: firstRow.source,
+            state,
+            method: firstRow.method,
+            values,
+            limitations: firstRow.limitations,
+        };
+    });
+    const observations = documents.map(observationContext);
+    const identities = observations.map((observation) => (observation.observerLabel && observation.vantageLabel
+        ? `${observation.observerLabel}\u0000${observation.vantageLabel}`
+        : null));
+    const labelsComplete = identities.every((identity) => identity !== null);
+    const labelsDistinct = labelsComplete && new Set(identities).size === identities.length;
+    const independence = labelsDistinct
+        ? {
+            state: 'verified_distinct_labels',
+            reason: 'Every observation carries a different analyst-supplied observer and vantage label.',
+        }
+        : {
+            state: 'unverified',
+            reason: 'Observer and vantage labels are missing or repeated; independent collection cannot be inferred.',
+        };
+    return {
+        schema: CLI_LOOKUP_RECONCILIATION_SCHEMA,
+        version: CLI_LOOKUP_RECONCILIATION_VERSION,
+        generatedAt,
+        domain,
+        independence,
+        observations,
+        fields,
+        summary: {
+            observationCount: observations.length,
+            agreement: fields.filter((field) => field.state === 'agreement').length,
+            disagreement: fields.filter((field) => field.state === 'disagreement').length,
+            nonComparable: fields.filter((field) => field.state === 'non_comparable').length,
+        },
+        privacy: { filenamesRetained: 0, rawRegistryPayloadsCopied: 0 },
+        limitations: [
+            'This report reconciles only bounded normalised values already present in saved Lookup documents and makes no network request.',
+            'Observer and vantage labels are analyst-supplied metadata. Distinct labels do not prove independent resolvers, networks, providers, caches, or collection paths.',
+            'Agreement can reflect shared upstream data or collection conditions. Disagreement can reflect collection timing, propagation, source health, or a real domain change.',
+            'Non-comparable evidence remains separate from agreement and is never interpreted as absence, safety, or a negative finding.',
+        ],
+    };
+}
+function formatCliLookupReconciliation(document) {
+    const output = [
+        'Lookup observation reconciliation',
+        `Domain             ${document.domain}`,
+        `Observations       ${document.summary.observationCount}`,
+        `Independence       ${document.independence.state.replaceAll('_', ' ')}`,
+        `Agreement          ${document.summary.agreement}`,
+        `Disagreement       ${document.summary.disagreement}`,
+        `Non-comparable     ${document.summary.nonComparable}`,
+        '',
+    ];
+    for (const field of document.fields.filter((candidate) => candidate.state !== 'agreement')) {
+        output.push(`${field.label} [${field.state.replaceAll('_', ' ')}]`);
+        for (const value of field.values) {
+            output.push(`  Observation ${value.observation + 1}: ${value.value} (${value.sourceState.replaceAll('_', ' ')})`);
+        }
+    }
+    output.push('', 'Limitations:');
+    for (const limitation of document.limitations)
+        output.push(`  - ${limitation}`);
+    return `${output.join('\n')}\n`;
+}
+export { CLI_LOOKUP_RECONCILIATION_SCHEMA, CLI_LOOKUP_RECONCILIATION_VERSION, MAX_LOOKUP_RECONCILIATION_INPUT_BYTES, buildCliLookupReconciliation, formatCliLookupReconciliation, };

package/cli/lookup-timeline.mjs

@@ -85,7 +85,7 @@ function buildCliLookupTimeline(inputs, generatedAt = new Date().toISOString())
             rawRegistryPayloadsCopied: 0,
         },
         limitations: [
-            'The timeline compares only bounded normalized fields already present in the selected saved Lookup documents and makes no network request.',
+            'The timeline compares only bounded normalised fields already present in the selected saved Lookup documents and makes no network request.',
             'Input filenames and raw registry payloads are not copied into the timeline output.',
             'Missing, unavailable, and not-recorded evidence remain separate from an observed difference.',
             'A difference can reflect a domain change or changed collection conditions and does not by itself establish current state, ownership, intent, safety, or maliciousness.',

package/cli/mail-review.mjs

@@ -213,7 +213,7 @@ function buildCliMailReview(textValue, generatedAt = new Date().toISOString()) {
             'This review is passive and uses DNS evidence already retained in a WHOISleuth Bulk result; it makes no network request.',
             'Null MX, no explicit MX, receiving mail, authentication gaps, and incomplete evidence remain separate states.',
             'Optional TLSA evidence is compared offline. A DANE match requires separately validated DNSSEC evidence from the same observation.',
-            'SMTP delivery, mailbox existence, catch-all behavior, banner collection, and message acceptance were not tested.',
+            'SMTP delivery, mailbox existence, catch-all behaviour, banner collection, and message acceptance were not tested.',
         ],
     };
 }

package/cli/network-command-runner.mjs

@@ -8,6 +8,7 @@ import { formatTerminalCtSearch, formatTerminalHttp, formatTerminalPosture, form
 import { buildHttpProbeResult } from "./http.mjs";
 import { normalizePostureSelectors } from "./posture.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
+import { buildPostureSarif } from "./ci-report.mjs";
 async function runNetworkCommand(args, dependencies, context) {
     if (args.action === 'ct-search') {
         const keyword = args.keyword || await context.readSingleInput();
@@ -46,7 +47,9 @@ async function runNetworkCommand(args, dependencies, context) {
         if (!args.quiet) {
             context.writeStdout(args.output === 'json'
                 ? formatJsonDocument(document)
-                : context.terminal(formatTerminalPosture(document), args.color));
+                : args.output === 'sarif'
+                    ? formatJsonDocument(buildPostureSarif(document))
+                    : context.terminal(formatTerminalPosture(document), args.color));
         }
         return EXIT_CODES.SUCCESS;
     }

package/cli/offline-evidence-review.mjs

@@ -1,11 +1,18 @@
 import { Buffer } from 'node:buffer';
 import { normalizeEncryptedDnsAdapter, planEncryptedDnsQuery, } from "../lib/encrypted-dns-contract.mjs";
 import { validateDnssecEvidence } from "../lib/dnssec-evidence-validation.mjs";
+import { reviewDomainChange } from "../lib/domain-change-review.mjs";
+import { reviewDomainPortfolio } from "../lib/domain-portfolio-review.mjs";
+import { reviewNameserverPreflight } from "../lib/nameserver-preflight-review.mjs";
 import { buildLocalGeoIpDatabase, lookupLocalGeoIp, } from "../lib/local-geoip-evidence.mjs";
-import { normalizeRdapSearchHelp, planRdapReverseSearch, } from "../lib/rdap-search-workbench.mjs";
+import { inspectRdapReverseSearchResponse, normalizeRdapSearchHelp, planRdapReverseSearch, } from "../lib/rdap-search-workbench.mjs";
 import { reviewRpkiRoute } from "../lib/rpki-evidence.mjs";
 import { analyzeTlsaEvidence } from "../lib/tlsa-evidence.mjs";
+import { reviewZoneIntent } from "../lib/zone-intent-review.mjs";
+import { reviewDnsConvergence } from "../lib/dns-convergence-review.mjs";
+import { compareTrustStoreEvidence } from "../lib/trust-store-comparison.mjs";
 import { CliUsageError } from "./errors.mjs";
+import { LOCAL_MMDB_QUERY_SCHEMA, reviewLocalMmdb } from "./local-mmdb-review.mjs";
 const OFFLINE_EVIDENCE_REVIEW_SCHEMA = 'whoisleuth.cli.offline-evidence-review';
 const OFFLINE_EVIDENCE_REVIEW_VERSION = 1;
 const MAX_OFFLINE_EVIDENCE_INPUT_BYTES = 16 * 1024 * 1024;
@@ -37,14 +44,18 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
         kind = 'rdap_search';
         const request = record(input.request);
         const help = normalizeRdapSearchHelp(input.help);
+        const plan = planRdapReverseSearch(help, {
+            searchableResourceType: String(request.searchableResourceType ?? ''),
+            relatedResourceType: String(request.relatedResourceType ?? ''),
+            property: String(request.property ?? ''),
+            value: request.value,
+        });
         result = Object.freeze({
             help,
-            plan: planRdapReverseSearch(help, {
-                searchableResourceType: String(request.searchableResourceType ?? ''),
-                relatedResourceType: String(request.relatedResourceType ?? ''),
-                property: String(request.property ?? ''),
-                value: request.value,
-            }),
+            plan,
+            responseInspection: input.response === undefined
+                ? null
+                : inspectRdapReverseSearchResponse(input.response, [request.property]),
         });
     }
     else if (input.schema === 'whoisleuth.dnssec-evidence-input') {
@@ -87,8 +98,32 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
         const query = record(input.query);
         result = planEncryptedDnsQuery(normalizeEncryptedDnsAdapter(input.adapter), { name: query.name, type: query.type });
     }
+    else if (input.schema === 'whoisleuth.zone-intent.input') {
+        kind = 'zone_intent';
+        result = reviewZoneIntent(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.domain-portfolio.input') {
+        kind = 'domain_portfolio';
+        result = reviewDomainPortfolio(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.domain-change.input') {
+        kind = 'domain_change';
+        result = reviewDomainChange(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.dns-convergence.input') {
+        kind = 'dns_convergence';
+        result = reviewDnsConvergence(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.nameserver-preflight.input') {
+        kind = 'nameserver_preflight';
+        result = reviewNameserverPreflight(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.trust-store-comparison.input') {
+        kind = 'trust_store';
+        result = compareTrustStoreEvidence(input, generatedAt);
+    }
     else {
-        throw new CliUsageError('Offline evidence review does not recognize this input schema.');
+        throw new CliUsageError('Offline evidence review does not recognise this input schema.');
     }
     return Object.freeze({
         schema: OFFLINE_EVIDENCE_REVIEW_SCHEMA,
@@ -101,9 +136,39 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
         ]),
     });
 }
+async function buildOfflineEvidenceReviewWithLocalResources(value, generatedAt = new Date().toISOString(), options = {}) {
+    const input = parseInput(value);
+    if (input.schema !== LOCAL_MMDB_QUERY_SCHEMA)
+        return buildOfflineEvidenceReview(value, generatedAt);
+    if (!options.mmdbPath)
+        throw new CliUsageError('Local MMDB review requires --mmdb <database-file>.');
+    return Object.freeze({
+        schema: OFFLINE_EVIDENCE_REVIEW_SCHEMA,
+        version: OFFLINE_EVIDENCE_REVIEW_VERSION,
+        generatedAt,
+        kind: 'geoip',
+        result: await reviewLocalMmdb(input, options.mmdbPath),
+        limitations: Object.freeze([
+            'The review is local and uses only the supplied query metadata and analyst-supplied database. It does not transmit the address or refresh the database.',
+        ]),
+    });
+}
 function formatOfflineEvidenceReview(document) {
     const result = record(document.result);
-    const state = typeof result.state === 'string' ? result.state : 'reviewed';
+    const gate = record(result.gate);
+    const counts = record(result.counts);
+    const count = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : 0;
+    const listLength = (value) => Array.isArray(value) ? value.length : 0;
+    const state = typeof result.state === 'string'
+        ? result.state
+        : document.kind === 'zone_intent'
+            ? result.complete === true
+                && ['different', 'missing', 'unexpected', 'incomplete'].every((key) => count(counts[key]) === 0)
+                ? 'aligned'
+                : 'review'
+            : typeof gate.pass === 'boolean'
+                ? gate.pass ? 'ready' : 'review'
+                : document.kind === 'domain_portfolio' ? 'inventory' : 'reviewed';
     const lines = [
         'Offline evidence review',
         `Kind   ${document.kind.replaceAll('_', ' ')}`,
@@ -112,8 +177,48 @@ function formatOfflineEvidenceReview(document) {
     if (document.kind === 'rdap_search') {
         const help = record(result.help);
         const plan = record(result.plan);
+        const responseInspection = record(result.responseInspection);
         lines.push(`Help   ${String(help.state ?? 'unavailable').replaceAll('_', ' ')}`);
         lines.push(`Plan   ${String(plan.state ?? 'unavailable').replaceAll('_', ' ')}`);
+        if (result.responseInspection !== null)
+            lines.push(`Result ${String(responseInspection.state ?? 'invalid').replaceAll('_', ' ')}`);
+    }
+    else if (document.kind === 'zone_intent') {
+        const desired = record(result.desired);
+        lines.push(`Desired ${listLength(desired.records)}`);
+        lines.push(`Compared ${listLength(result.comparisons)}`);
+        lines.push(`Aligned ${count(counts.aligned)}`);
+        lines.push(`Changed ${count(counts.different) + count(counts.missing) + count(counts.unexpected)}`);
+        lines.push(`Partial ${count(counts.incomplete)}`);
+        lines.push(`Rejected ${listLength(desired.rejected)}`);
+    }
+    else if (document.kind === 'domain_change') {
+        lines.push(`Authority ${listLength(result.authoritativeRecordMatrix)} rows`);
+        lines.push(`Resolvers ${listLength(result.resolverDivergenceMatrix)} rows`);
+    }
+    else if (document.kind === 'dns_convergence') {
+        lines.push(`Observers ${listLength(result.observers)}`);
+        lines.push(`Snapshots ${listLength(result.snapshots)}`);
+        lines.push(`Record sets ${listLength(result.rows)}`);
+    }
+    else if (document.kind === 'nameserver_preflight') {
+        const rows = Array.isArray(result.rows) ? result.rows : [];
+        lines.push(`Servers ${rows.length}`);
+        lines.push(`Ready  ${rows.filter((item) => record(item).ready === true).length}`);
+    }
+    else if (document.kind === 'trust_store') {
+        lines.push(`Stores ${count(counts.stores)}`);
+        lines.push(`Matched ${count(counts.anchorObserved)}`);
+        lines.push(`Not observed ${count(counts.notObserved)}`);
+        lines.push(`Inconclusive ${count(counts.inconclusive)}`);
+    }
+    else if (document.kind === 'domain_portfolio') {
+        const unknownCounts = record(result.unknownCounts);
+        lines.push(`Assets ${listLength(result.assets)}`);
+        lines.push(`Dependencies ${listLength(result.simulations)}`);
+        lines.push(`Renewals ${listLength(result.renewalQueue)}`);
+        lines.push(`Recovery ${listLength(result.recoveryCycles)}`);
+        lines.push(`Unknown ${Object.values(unknownCounts).reduce((total, value) => total + count(value), 0)}`);
     }
     else {
         for (const [label, key] of [
@@ -128,6 +233,16 @@ function formatOfflineEvidenceReview(document) {
                 lines.push(`${label.padEnd(7)}${candidate}`);
         }
     }
+    const reasons = Array.isArray(gate.reasons) ? gate.reasons : [];
+    if (reasons.length) {
+        lines.push('', 'Review reasons:');
+        for (const reason of reasons.slice(0, 8)) {
+            if (typeof reason === 'string')
+                lines.push(`  - ${reason.replace(/[\u0000-\u001f\u007f]+/gu, ' ').trim().slice(0, 240)}`);
+        }
+        if (reasons.length > 8)
+            lines.push(`  - ${reasons.length - 8} more reason(s) omitted.`);
+    }
     lines.push('', 'Limitations:');
     for (const limitation of document.limitations)
         lines.push(`  - ${limitation}`);
@@ -138,4 +253,4 @@ function formatOfflineEvidenceReview(document) {
     }
     return `${lines.join('\n')}\n`;
 }
-export { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, OFFLINE_EVIDENCE_REVIEW_SCHEMA, OFFLINE_EVIDENCE_REVIEW_VERSION, buildOfflineEvidenceReview, formatOfflineEvidenceReview, };
+export { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, OFFLINE_EVIDENCE_REVIEW_SCHEMA, OFFLINE_EVIDENCE_REVIEW_VERSION, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, };

package/cli/open-asset-model-bridge.mjs

@@ -0,0 +1,169 @@
+import { isIP } from 'node:net';
+import { parseExternalFindingsDocument, } from "../frontend/src/lib/analysis/external-findings-import.js";
+import { requireIsoTimestamp } from "../lib/bounded-contract-normalizers.mjs";
+export const OPEN_ASSET_MODEL_BRIDGE_SCHEMA = 'whoisleuth.open-asset-model-bridge';
+export const OPEN_ASSET_MODEL_BRIDGE_VERSION = 1;
+const SHA256_RE = /^[a-f0-9]{64}$/u;
+function fqdnId(domain) {
+    return `FQDN/${domain}`;
+}
+function certificateId(digest) {
+    return `TLSCertificate/sha256:${digest}`;
+}
+function ipId(address) {
+    return `IPAddress/${address}`;
+}
+function earlier(left, right) {
+    return left.localeCompare(right) <= 0 ? left : right;
+}
+function later(left, right) {
+    return left.localeCompare(right) >= 0 ? left : right;
+}
+function combinedCompleteness(left, right) {
+    return left === right ? right : 'partial';
+}
+function setObservedAsset(assets, key, value, observedAt, completeness) {
+    const existing = assets.get(key);
+    const existingDiscovery = existing?.discovery && typeof existing.discovery === 'object'
+        ? existing.discovery
+        : null;
+    if (!existing || !existingDiscovery || typeof existingDiscovery.observed_at !== 'string') {
+        assets.set(key, value);
+        return;
+    }
+    assets.set(key, {
+        ...existing,
+        discovery: {
+            ...existingDiscovery,
+            observed_at: later(existingDiscovery.observed_at, observedAt),
+            completeness: combinedCompleteness(existingDiscovery.completeness, completeness),
+        },
+    });
+}
+function setObservedRelation(relations, key, value, observedAt, completeness) {
+    const existing = relations.get(key);
+    const existingDiscovery = existing?.discovery && typeof existing.discovery === 'object'
+        ? existing.discovery
+        : null;
+    if (!existing
+        || typeof existing.created_at !== 'string'
+        || typeof existing.last_seen !== 'string'
+        || !existingDiscovery) {
+        relations.set(key, value);
+        return;
+    }
+    relations.set(key, {
+        ...existing,
+        created_at: earlier(existing.created_at, observedAt),
+        last_seen: later(existing.last_seen, observedAt),
+        discovery: {
+            ...existingDiscovery,
+            completeness: combinedCompleteness(existingDiscovery.completeness, completeness),
+        },
+    });
+}
+export function buildOpenAssetModelBridge(input, generatedAtValue = new Date().toISOString()) {
+    const document = parseExternalFindingsDocument(input);
+    const generatedAt = requireIsoTimestamp(generatedAtValue, 'generatedAt');
+    const assets = new Map();
+    const relations = new Map();
+    for (const finding of document.findings) {
+        const domainAssetId = fqdnId(finding.domain);
+        setObservedAsset(assets, domainAssetId, {
+            key: domainAssetId,
+            type: 'FQDN',
+            attributes: { name: finding.domain },
+            discovery: { source: document.source.name, observed_at: finding.observedAt, completeness: finding.completeness },
+        }, finding.observedAt, finding.completeness);
+        const observation = finding.structuredObservation;
+        if (!observation)
+            continue;
+        if (observation.sourceSchema === 'whoisleuth.certificate-observation-rows'
+            && (observation.field === 'certificateSha256' || observation.field === 'fingerprintSha256')) {
+            const digest = observation.value.toLowerCase();
+            if (!SHA256_RE.test(digest))
+                throw new TypeError('Certificate bridge observations require a SHA-256 hexadecimal digest.');
+            const certificateAssetId = certificateId(digest);
+            setObservedAsset(assets, certificateAssetId, {
+                key: certificateAssetId,
+                type: 'TLSCertificate',
+                attributes: {
+                    sha256: digest,
+                    issuer_common_name: observation.issuer,
+                    not_after: observation.notAfter,
+                },
+                discovery: { source: document.source.name, observed_at: finding.observedAt, completeness: finding.completeness },
+            }, finding.observedAt, finding.completeness);
+            const relationKey = `${certificateAssetId}\u0000san_dns_name\u0000${domainAssetId}`;
+            setObservedRelation(relations, relationKey, {
+                type: 'SimpleRelation',
+                label: 'san_dns_name',
+                source: certificateAssetId,
+                target: domainAssetId,
+                created_at: finding.observedAt,
+                last_seen: finding.observedAt,
+                discovery: { source: document.source.name, completeness: finding.completeness },
+            }, finding.observedAt, finding.completeness);
+        }
+        if (observation.sourceSchema === 'whoisleuth.dns-observation-rows'
+            && (observation.field === 'A' || observation.field === 'AAAA')) {
+            const ipVersion = isIP(observation.value);
+            const targetId = ipVersion ? ipId(observation.value) : null;
+            if (!targetId)
+                continue;
+            if ((observation.field === 'A' && ipVersion !== 4) || (observation.field === 'AAAA' && ipVersion !== 6))
+                continue;
+            setObservedAsset(assets, targetId, {
+                key: targetId,
+                type: 'IPAddress',
+                attributes: { address: observation.value, type: ipVersion === 4 ? 'IPv4' : 'IPv6' },
+                discovery: { source: document.source.name, observed_at: finding.observedAt, completeness: finding.completeness },
+            }, finding.observedAt, finding.completeness);
+            const relationKey = `${domainAssetId}\u0000dns_record\u0000${targetId}`;
+            setObservedRelation(relations, relationKey, {
+                type: 'BasicDNSRelation',
+                label: 'dns_record',
+                source: domainAssetId,
+                target: targetId,
+                created_at: finding.observedAt,
+                last_seen: finding.observedAt,
+                discovery: { source: document.source.name, completeness: finding.completeness },
+            }, finding.observedAt, finding.completeness);
+        }
+    }
+    return Object.freeze({
+        schema: OPEN_ASSET_MODEL_BRIDGE_SCHEMA,
+        version: OPEN_ASSET_MODEL_BRIDGE_VERSION,
+        generatedAt,
+        model: Object.freeze({
+            name: 'OWASP Open Asset Model',
+            profile: 'WHOISleuth bounded external-findings projection',
+            reference: 'https://github.com/owasp-amass/open-asset-model',
+        }),
+        assets: Object.freeze([...assets.values()].sort((left, right) => String(left.key).localeCompare(String(right.key)))),
+        relations: Object.freeze([...relations.values()].sort((left, right) => String(left.source).localeCompare(String(right.source)) || String(left.target).localeCompare(String(right.target)))),
+        provenance: Object.freeze({
+            source: document.source,
+            findingsReviewed: document.findings.length,
+            evidenceClasses: Object.freeze([...new Set(document.findings.map((finding) => finding.evidenceClass))].sort()),
+        }),
+        limitations: Object.freeze([
+            'This is a versioned WHOISleuth bridge projection using documented Open Asset Model asset and relation vocabulary; receiving tools must still validate it against their supported model version.',
+            'Only bounded FQDN, IPAddress, TLSCertificate, dns_record, and san_dns_name projections are emitted. Unsupported finding categories remain represented only by their FQDN asset.',
+            'Source completeness is preserved as discovery metadata and is not converted into an Open Asset Model confidence score.',
+            'Relations are observations and investigation pivots, not proof of ownership, control, coordination, intent, safety, or maliciousness.',
+        ]),
+    });
+}
+export function formatOpenAssetModelBridge(document) {
+    return [
+        'Open Asset Model bridge',
+        `Assets       ${document.assets.length}`,
+        `Relations    ${document.relations.length}`,
+        `Findings     ${document.provenance.findingsReviewed}`,
+        `Source       ${document.provenance.source.name}`,
+        '',
+        'Output is a bounded bridge projection; validate it against the receiving implementation before import.',
+        '',
+    ].join('\n');
+}