@slicedearth/whoisleuth-cli 1.39.1 → 1.43.0

package/cli/open-asset-model-bridge.mjs

@@ -0,0 +1,169 @@
+import { isIP } from 'node:net';
+import { parseExternalFindingsDocument, } from "../frontend/src/lib/analysis/external-findings-import.js";
+import { requireIsoTimestamp } from "../lib/bounded-contract-normalizers.mjs";
+export const OPEN_ASSET_MODEL_BRIDGE_SCHEMA = 'whoisleuth.open-asset-model-bridge';
+export const OPEN_ASSET_MODEL_BRIDGE_VERSION = 1;
+const SHA256_RE = /^[a-f0-9]{64}$/u;
+function fqdnId(domain) {
+    return `FQDN/${domain}`;
+}
+function certificateId(digest) {
+    return `TLSCertificate/sha256:${digest}`;
+}
+function ipId(address) {
+    return `IPAddress/${address}`;
+}
+function earlier(left, right) {
+    return left.localeCompare(right) <= 0 ? left : right;
+}
+function later(left, right) {
+    return left.localeCompare(right) >= 0 ? left : right;
+}
+function combinedCompleteness(left, right) {
+    return left === right ? right : 'partial';
+}
+function setObservedAsset(assets, key, value, observedAt, completeness) {
+    const existing = assets.get(key);
+    const existingDiscovery = existing?.discovery && typeof existing.discovery === 'object'
+        ? existing.discovery
+        : null;
+    if (!existing || !existingDiscovery || typeof existingDiscovery.observed_at !== 'string') {
+        assets.set(key, value);
+        return;
+    }
+    assets.set(key, {
+        ...existing,
+        discovery: {
+            ...existingDiscovery,
+            observed_at: later(existingDiscovery.observed_at, observedAt),
+            completeness: combinedCompleteness(existingDiscovery.completeness, completeness),
+        },
+    });
+}
+function setObservedRelation(relations, key, value, observedAt, completeness) {
+    const existing = relations.get(key);
+    const existingDiscovery = existing?.discovery && typeof existing.discovery === 'object'
+        ? existing.discovery
+        : null;
+    if (!existing
+        || typeof existing.created_at !== 'string'
+        || typeof existing.last_seen !== 'string'
+        || !existingDiscovery) {
+        relations.set(key, value);
+        return;
+    }
+    relations.set(key, {
+        ...existing,
+        created_at: earlier(existing.created_at, observedAt),
+        last_seen: later(existing.last_seen, observedAt),
+        discovery: {
+            ...existingDiscovery,
+            completeness: combinedCompleteness(existingDiscovery.completeness, completeness),
+        },
+    });
+}
+export function buildOpenAssetModelBridge(input, generatedAtValue = new Date().toISOString()) {
+    const document = parseExternalFindingsDocument(input);
+    const generatedAt = requireIsoTimestamp(generatedAtValue, 'generatedAt');
+    const assets = new Map();
+    const relations = new Map();
+    for (const finding of document.findings) {
+        const domainAssetId = fqdnId(finding.domain);
+        setObservedAsset(assets, domainAssetId, {
+            key: domainAssetId,
+            type: 'FQDN',
+            attributes: { name: finding.domain },
+            discovery: { source: document.source.name, observed_at: finding.observedAt, completeness: finding.completeness },
+        }, finding.observedAt, finding.completeness);
+        const observation = finding.structuredObservation;
+        if (!observation)
+            continue;
+        if (observation.sourceSchema === 'whoisleuth.certificate-observation-rows'
+            && (observation.field === 'certificateSha256' || observation.field === 'fingerprintSha256')) {
+            const digest = observation.value.toLowerCase();
+            if (!SHA256_RE.test(digest))
+                throw new TypeError('Certificate bridge observations require a SHA-256 hexadecimal digest.');
+            const certificateAssetId = certificateId(digest);
+            setObservedAsset(assets, certificateAssetId, {
+                key: certificateAssetId,
+                type: 'TLSCertificate',
+                attributes: {
+                    sha256: digest,
+                    issuer_common_name: observation.issuer,
+                    not_after: observation.notAfter,
+                },
+                discovery: { source: document.source.name, observed_at: finding.observedAt, completeness: finding.completeness },
+            }, finding.observedAt, finding.completeness);
+            const relationKey = `${certificateAssetId}\u0000san_dns_name\u0000${domainAssetId}`;
+            setObservedRelation(relations, relationKey, {
+                type: 'SimpleRelation',
+                label: 'san_dns_name',
+                source: certificateAssetId,
+                target: domainAssetId,
+                created_at: finding.observedAt,
+                last_seen: finding.observedAt,
+                discovery: { source: document.source.name, completeness: finding.completeness },
+            }, finding.observedAt, finding.completeness);
+        }
+        if (observation.sourceSchema === 'whoisleuth.dns-observation-rows'
+            && (observation.field === 'A' || observation.field === 'AAAA')) {
+            const ipVersion = isIP(observation.value);
+            const targetId = ipVersion ? ipId(observation.value) : null;
+            if (!targetId)
+                continue;
+            if ((observation.field === 'A' && ipVersion !== 4) || (observation.field === 'AAAA' && ipVersion !== 6))
+                continue;
+            setObservedAsset(assets, targetId, {
+                key: targetId,
+                type: 'IPAddress',
+                attributes: { address: observation.value, type: ipVersion === 4 ? 'IPv4' : 'IPv6' },
+                discovery: { source: document.source.name, observed_at: finding.observedAt, completeness: finding.completeness },
+            }, finding.observedAt, finding.completeness);
+            const relationKey = `${domainAssetId}\u0000dns_record\u0000${targetId}`;
+            setObservedRelation(relations, relationKey, {
+                type: 'BasicDNSRelation',
+                label: 'dns_record',
+                source: domainAssetId,
+                target: targetId,
+                created_at: finding.observedAt,
+                last_seen: finding.observedAt,
+                discovery: { source: document.source.name, completeness: finding.completeness },
+            }, finding.observedAt, finding.completeness);
+        }
+    }
+    return Object.freeze({
+        schema: OPEN_ASSET_MODEL_BRIDGE_SCHEMA,
+        version: OPEN_ASSET_MODEL_BRIDGE_VERSION,
+        generatedAt,
+        model: Object.freeze({
+            name: 'OWASP Open Asset Model',
+            profile: 'WHOISleuth bounded external-findings projection',
+            reference: 'https://github.com/owasp-amass/open-asset-model',
+        }),
+        assets: Object.freeze([...assets.values()].sort((left, right) => String(left.key).localeCompare(String(right.key)))),
+        relations: Object.freeze([...relations.values()].sort((left, right) => String(left.source).localeCompare(String(right.source)) || String(left.target).localeCompare(String(right.target)))),
+        provenance: Object.freeze({
+            source: document.source,
+            findingsReviewed: document.findings.length,
+            evidenceClasses: Object.freeze([...new Set(document.findings.map((finding) => finding.evidenceClass))].sort()),
+        }),
+        limitations: Object.freeze([
+            'This is a versioned WHOISleuth bridge projection using documented Open Asset Model asset and relation vocabulary; receiving tools must still validate it against their supported model version.',
+            'Only bounded FQDN, IPAddress, TLSCertificate, dns_record, and san_dns_name projections are emitted. Unsupported finding categories remain represented only by their FQDN asset.',
+            'Source completeness is preserved as discovery metadata and is not converted into an Open Asset Model confidence score.',
+            'Relations are observations and investigation pivots, not proof of ownership, control, coordination, intent, safety, or maliciousness.',
+        ]),
+    });
+}
+export function formatOpenAssetModelBridge(document) {
+    return [
+        'Open Asset Model bridge',
+        `Assets       ${document.assets.length}`,
+        `Relations    ${document.relations.length}`,
+        `Findings     ${document.provenance.findingsReviewed}`,
+        `Source       ${document.provenance.source.name}`,
+        '',
+        'Output is a bounded bridge projection; validate it against the receiving implementation before import.',
+        '',
+    ].join('\n');
+}

package/cli/registry-cohort.mjs

@@ -0,0 +1,121 @@
+import { Buffer } from 'node:buffer';
+import { CliUsageError } from "./errors.mjs";
+import { buildRegistryDoctorReport } from "./registry-doctor.mjs";
+export const REGISTRY_COHORT_SCHEMA = 'whoisleuth.cli.registry-cohort';
+export const REGISTRY_COHORT_VERSION = 1;
+export const MAX_REGISTRY_COHORT_INPUT_BYTES = 16 * 1024 * 1024;
+export const MAX_REGISTRY_COHORT_SAMPLES = 500;
+export const MIN_REGISTRY_COHORT_SAMPLE = 5;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function documents(text) {
+    if (Buffer.byteLength(text, 'utf8') > MAX_REGISTRY_COHORT_INPUT_BYTES) {
+        throw new CliUsageError(`Registry cohort input is limited to ${MAX_REGISTRY_COHORT_INPUT_BYTES} bytes.`);
+    }
+    const trimmed = text.replace(/^\uFEFF/u, '').trim();
+    if (!trimmed)
+        throw new CliUsageError('Registry cohort input is empty.');
+    let values;
+    if (trimmed.startsWith('[')) {
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch {
+            throw new CliUsageError('Registry cohort input must be valid JSON or JSONL.');
+        }
+        if (!Array.isArray(parsed))
+            throw new CliUsageError('Registry cohort JSON input must be an array.');
+        values = parsed;
+    }
+    else {
+        const lines = trimmed.split(/\r?\n/u).filter((line) => line.trim());
+        values = lines.map((line, index) => {
+            try {
+                return JSON.parse(line);
+            }
+            catch {
+                throw new CliUsageError(`Registry cohort JSONL line ${index + 1} is invalid.`);
+            }
+        });
+    }
+    if (!values.length || values.length > MAX_REGISTRY_COHORT_SAMPLES) {
+        throw new CliUsageError(`Registry cohort input must contain from 1 to ${MAX_REGISTRY_COHORT_SAMPLES} saved Lookups.`);
+    }
+    const output = values.map(record);
+    if (output.some((item) => !Object.keys(item).length))
+        throw new CliUsageError('Every registry cohort item must be one saved Lookup object.');
+    return output;
+}
+export function buildRegistryCohortReport(text, generatedAt = new Date().toISOString()) {
+    const reports = documents(text).map((item) => buildRegistryDoctorReport(JSON.stringify(item), generatedAt));
+    const groups = new Map();
+    for (const report of reports) {
+        const key = `${report.suffix}\u0000${report.profile.id}`;
+        const group = groups.get(key) ?? [];
+        group.push(report);
+        groups.set(key, group);
+    }
+    const cohorts = [...groups.values()].map((group) => {
+        const sample = group[0];
+        if (!sample)
+            throw new CliUsageError('Registry cohort grouping failed.');
+        const sampleCount = group.length;
+        const investigate = group.reduce((total, item) => total + item.summary.investigate, 0);
+        const publicationReviewItems = group.reduce((total, item) => total + item.publication.reviewItems, 0);
+        return Object.freeze({
+            suffix: sample.suffix,
+            profileId: sample.profile.id,
+            sampleCount,
+            state: sampleCount < MIN_REGISTRY_COHORT_SAMPLE
+                ? 'insufficient_sample'
+                : investigate || publicationReviewItems
+                    ? 'review'
+                    : 'consistent',
+            sourceAlignment: Object.freeze({
+                investigate,
+                expectedConstraints: group.reduce((total, item) => total + item.summary.expectedConstraints, 0),
+                observed: group.reduce((total, item) => total + item.summary.observed, 0),
+            }),
+            publication: Object.freeze({
+                reviewItems: publicationReviewItems,
+                objectIdentifiersObserved: group.filter((item) => item.publication.objectIdentifier.state === 'observed').length,
+                baseConformanceObserved: group.filter((item) => item.publication.baseConformance.state === 'observed').length,
+                selfLinksObserved: group.filter((item) => item.publication.selfLink.state === 'observed').length,
+                redactionMetadataObserved: group.filter((item) => item.publication.redactionMetadata.state === 'observed').length,
+            }),
+        });
+    }).sort((left, right) => left.suffix.localeCompare(right.suffix) || left.profileId.localeCompare(right.profileId));
+    return Object.freeze({
+        schema: REGISTRY_COHORT_SCHEMA,
+        version: REGISTRY_COHORT_VERSION,
+        generatedAt,
+        sampleCount: reports.length,
+        minimumCohortSample: MIN_REGISTRY_COHORT_SAMPLE,
+        cohorts: Object.freeze(cohorts),
+        limitations: Object.freeze([
+            'The report intentionally omits domains, queries and raw evidence. It groups saved observations only by suffix and capability profile.',
+            `Cohorts with fewer than ${MIN_REGISTRY_COHORT_SAMPLE} observations remain insufficient sample and must not drive catalogue changes.`,
+            'Repeated observations from one environment are not representative by themselves. Review fixture provenance and source health before changing a parser or access profile.',
+        ]),
+    });
+}
+export function formatRegistryCohortReport(report) {
+    const output = [
+        'Registry quality cohort',
+        `Saved observations  ${report.sampleCount}`,
+        `Minimum sample      ${report.minimumCohortSample}`,
+        '',
+    ];
+    for (const cohort of report.cohorts) {
+        output.push(`.${cohort.suffix} · ${cohort.profileId} [${cohort.state.replaceAll('_', ' ')}]`);
+        output.push(`  Samples: ${cohort.sampleCount}`);
+        output.push(`  Source review items: ${cohort.sourceAlignment.investigate}`);
+        output.push(`  Publication review items: ${cohort.publication.reviewItems}`);
+    }
+    output.push('', 'Limitations:');
+    for (const limitation of report.limitations)
+        output.push(`  - ${limitation}`);
+    return `${output.join('\n')}\n`;
+}

package/cli/registry-doctor.mjs

@@ -1,11 +1,9 @@
 import { registryCapabilityFor, REGISTRY_CAPABILITIES_VERSION } from "../lib/registry-capabilities.mjs";
+import { recordOrEmpty } from "../lib/bounded-contract-normalizers.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
 const REGISTRY_DOCTOR_SCHEMA = 'whoisleuth.cli.registry-doctor';
-const REGISTRY_DOCTOR_VERSION = 1;
-function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-}
+const REGISTRY_DOCTOR_VERSION = 2;
 function status(value) {
     return typeof value === 'string'
         ? value.replace(/[\u0000-\u001f\u007f]+/gu, ' ').trim().toLowerCase().slice(0, 40) || 'unavailable'
@@ -31,27 +29,114 @@ function normalizedObjectIdentifier(parsed) {
     const candidate = parsed.handle ?? parsed.objectIdentifier ?? parsed.registryObjectId ?? parsed.id;
     return typeof candidate === 'string' && candidate.trim() ? 'observed' : 'not_observed';
 }
+function stringArray(value, limit = 100) {
+    return Array.isArray(value)
+        ? [...new Set(value.slice(0, limit).filter((item) => typeof item === 'string').map((item) => item.trim().toLowerCase()).filter(Boolean))]
+        : [];
+}
+function publicationQuality(parsed, rdapStatus) {
+    if (!['success', 'partial'].includes(rdapStatus)) {
+        const unavailable = { state: 'unavailable', value: null };
+        return {
+            objectClass: unavailable,
+            objectIdentifier: unavailable,
+            mediaType: unavailable,
+            baseConformance: { state: 'unavailable', declarations: [] },
+            redactionMetadata: { state: 'unavailable', count: 0, truncated: false },
+            selfLink: { state: 'unavailable', observedRelations: [] },
+            events: { state: 'unavailable', count: 0, conflictingActions: [] },
+            reviewItems: 0,
+        };
+    }
+    const objectClassName = typeof parsed.objectClassName === 'string' ? parsed.objectClassName.trim().toLowerCase() : '';
+    const identifier = [parsed.handle, parsed.objectIdentifier, parsed.registryObjectId, parsed.id]
+        .find((value) => typeof value === 'string' && Boolean(value.trim()))?.trim() ?? null;
+    const declarations = stringArray(parsed.conformance);
+    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, 100) : [];
+    const links = Array.isArray(parsed.links) ? parsed.links.slice(0, 100).map(recordOrEmpty) : [];
+    const relations = [...new Set(links.flatMap((link) => stringArray(link.rel, 10).length
+            ? stringArray(link.rel, 10)
+            : typeof link.rel === 'string' ? [link.rel.trim().toLowerCase()] : []).filter(Boolean))];
+    const events = Array.isArray(parsed.events) ? parsed.events.slice(0, 100).map(recordOrEmpty) : [];
+    const actionDates = new Map();
+    for (const event of events) {
+        const action = typeof event.action === 'string' ? event.action.trim().toLowerCase() : '';
+        const date = typeof event.date === 'string' ? event.date.trim() : '';
+        if (!action || !date)
+            continue;
+        const dates = actionDates.get(action) ?? [];
+        dates.push(date);
+        actionDates.set(action, dates);
+    }
+    const lifecycle = recordOrEmpty(parsed.lifecycle);
+    const lifecycleMappings = [
+        ['registration', 'createdDateIso', false],
+        ['reregistration', 'reregistrationDateIso', true],
+        ['expiration', 'expiryDateIso', true],
+        ['last changed', 'updatedDateIso', true],
+        ['transfer', 'transferDateIso', true],
+        ['deletion', 'deletionDateIso', true],
+        ['reinstantiation', 'reinstantiationDateIso', true],
+        ['last update of rdap database', 'databaseUpdatedDateIso', true],
+    ];
+    const conflictingActions = lifecycleMappings.flatMap(([action, field, newest]) => {
+        const published = typeof lifecycle[field] === 'string' ? Date.parse(lifecycle[field]) : Number.NaN;
+        if (!Number.isFinite(published))
+            return [];
+        const dates = (actionDates.get(action) ?? []).map(Date.parse).filter(Number.isFinite);
+        if (!dates.length)
+            return [action];
+        const selected = newest ? Math.max(...dates) : Math.min(...dates);
+        return selected === published ? [] : [action];
+    }).sort();
+    const objectClassState = !objectClassName ? 'not_observed' : objectClassName === 'domain' ? 'observed' : 'inconsistent';
+    const baseConformanceState = declarations.includes('rdap_level_0') ? 'observed' : 'not_observed';
+    const selfLinkState = relations.includes('self') ? 'observed' : 'not_observed';
+    const hasLifecycle = lifecycleMappings.some(([, field]) => typeof lifecycle[field] === 'string');
+    const eventsState = conflictingActions.length
+        ? 'inconsistent'
+        : events.length && hasLifecycle
+            ? 'observed'
+            : events.length
+                ? 'unavailable'
+                : 'not_observed';
+    return {
+        objectClass: { state: objectClassState, value: objectClassName || null },
+        objectIdentifier: { state: identifier ? 'observed' : 'not_observed', value: identifier },
+        mediaType: { state: 'unavailable', value: null },
+        baseConformance: { state: baseConformanceState, declarations },
+        redactionMetadata: {
+            state: redactions.length ? 'observed' : 'not_observed',
+            count: redactions.length,
+            truncated: parsed.redactionsTruncated === true,
+        },
+        selfLink: { state: selfLinkState, observedRelations: relations.sort() },
+        events: { state: eventsState, count: events.length, conflictingActions },
+        reviewItems: [objectClassState, baseConformanceState, selfLinkState, eventsState]
+            .filter((state) => state === 'inconsistent' || state === 'not_observed').length,
+    };
+}
 function buildRegistryDoctorReport(raw, generatedAt = new Date().toISOString()) {
     const document = parseSavedLookupDocument(raw, { label: 'Registry doctor input' });
     const capability = registryCapabilityFor(document.registrableDomain);
     if (!capability)
         throw new CliUsageError('Registry doctor could not resolve a capability profile for this domain.');
-    const diagnostics = record(document.diagnostics);
-    const rdap = record(document.rdap);
-    const whois = record(document.whois);
-    const rdapParsed = record(rdap.parsed);
-    const whoisParsed = record(whois.parsed);
+    const diagnostics = recordOrEmpty(document.diagnostics);
+    const rdap = recordOrEmpty(document.rdap);
+    const whois = recordOrEmpty(document.whois);
+    const rdapParsed = recordOrEmpty(rdap.parsed);
+    const whoisParsed = recordOrEmpty(whois.parsed);
     const sourceInputs = [
         {
             source: 'rdap',
             expected: capability.rdapAccessProfile === 'iana-bootstrap' ? 'allowed' : 'unsupported',
-            observed: status(record(diagnostics.rdap).status),
+            observed: status(recordOrEmpty(diagnostics.rdap).status),
             parsed: rdapParsed,
         },
         {
             source: 'whois',
             expected: expectedWhois(capability.whoisAccessProfile),
-            observed: status(record(diagnostics.whois).status),
+            observed: status(recordOrEmpty(diagnostics.whois).status),
             parsed: whoisParsed,
         },
     ];
@@ -64,6 +149,7 @@ function buildRegistryDoctorReport(raw, generatedAt = new Date().toISOString())
         objectIdentifier: normalizedObjectIdentifier(source.parsed),
         limitation: capability.limitation.slice(0, 500),
     }));
+    const publication = publicationQuality(rdapParsed, sourceInputs[0]?.observed ?? 'unavailable');
     const recommendations = [
         ...sources.filter((source) => source.alignment === 'investigate').map((source) => (source.expected === 'allowed'
             ? `Review ${source.source.toUpperCase()} source health, transport attempts, and fixture coverage; the catalogue expected collection to be available.`
@@ -83,6 +169,7 @@ function buildRegistryDoctorReport(raw, generatedAt = new Date().toISOString())
             explicitSuffixProfile: capability.explicitSuffixProfile,
             coverageState: capability.coverageState,
         },
+        publication,
         sources,
         summary: {
             investigate: sources.filter((source) => source.alignment === 'investigate' || source.alignment === 'unexpected_observation').length,
@@ -94,6 +181,7 @@ function buildRegistryDoctorReport(raw, generatedAt = new Date().toISOString())
             'This diagnostic compares one saved observation with the local reviewed capability catalogue and makes no registry, registrar, RDAP, or WHOIS request.',
             'A catalogue alignment does not prove live reachability, parser completeness, current registry policy, registration, availability, ownership, safety, or maliciousness.',
             'A missing registry object identifier can be a publication characteristic. It remains not observed and is not converted into a collection failure.',
+            'Publication-quality observations describe the saved normalised RDAP object. The saved Lookup format does not retain the response media type, so that field remains unavailable.',
             'Use fixture-based maintenance checks before changing a registry parser or access profile; automated tests must not contact live registries.',
         ],
     };
@@ -112,6 +200,13 @@ function formatRegistryDoctorReport(report) {
         output.push(`  Observed: ${source.observed.replaceAll('_', ' ')}`);
         output.push(`  Object identifier: ${source.objectIdentifier.replaceAll('_', ' ')}`);
     }
+    output.push('', 'RDAP publication quality');
+    output.push(`  Object class: ${report.publication.objectClass.state.replaceAll('_', ' ')}`);
+    output.push(`  Object identifier: ${report.publication.objectIdentifier.state.replaceAll('_', ' ')}`);
+    output.push(`  Base conformance: ${report.publication.baseConformance.state.replaceAll('_', ' ')}`);
+    output.push(`  Self link: ${report.publication.selfLink.state.replaceAll('_', ' ')}`);
+    output.push(`  Events: ${report.publication.events.state.replaceAll('_', ' ')}`);
+    output.push('  Media type: unavailable in the saved Lookup contract');
     if (report.recommendations.length) {
         output.push('', 'Recommendations:');
         for (const item of report.recommendations)

package/cli/registry-fixture-scaffold.mjs

@@ -0,0 +1,73 @@
+import { registryCompatibilityMatrix } from "../lib/registry-capabilities.mjs";
+const SAFE_ID_RE = /^[a-z0-9](?:[a-z0-9-]{0,126}[a-z0-9])?$/u;
+const SAFE_SUFFIX_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
+const SCENARIOS = new Set(['registered', 'not_found', 'inconclusive']);
+export function buildRegistryFixtureScaffold(profileIdInput, suffixInput, scenarioInput) {
+    const profileId = typeof profileIdInput === 'string' ? profileIdInput.toLowerCase() : '';
+    const suffix = typeof suffixInput === 'string' ? suffixInput.toLowerCase().replace(/^\./u, '') : '';
+    const scenario = typeof scenarioInput === 'string' ? scenarioInput.toLowerCase() : '';
+    if (!SAFE_ID_RE.test(profileId))
+        throw new TypeError('The capability profile is invalid.');
+    if (!SAFE_SUFFIX_RE.test(suffix))
+        throw new TypeError('The suffix is invalid.');
+    if (!SCENARIOS.has(scenario))
+        throw new TypeError('Scenario must be registered, not_found, or inconclusive.');
+    const profile = registryCompatibilityMatrix().find((item) => item.id === profileId);
+    if (!profile)
+        throw new TypeError('The capability profile is not present in the registry catalogue.');
+    if (!profile.suffixes.includes(suffix))
+        throw new TypeError(`The capability profile does not cover .${suffix}.`);
+    const domain = `EXAMPLE.${suffix.toUpperCase()}`;
+    const response = scenario === 'registered'
+        ? [
+            `Domain Name: ${domain}`,
+            'Registry Domain ID: EXAMPLE-SYNTHETIC-ID',
+            'Registrar: Example Registrar',
+            'Creation Date: 2020-01-02T03:04:05Z',
+            'Updated Date: 2024-05-06T07:08:09Z',
+            'Registry Expiry Date: 2030-01-02T03:04:05Z',
+            'Domain Status: active',
+            'Registrant Organization: Example Organisation',
+            'Registrant Email: registrant@example.invalid',
+            'Name Server: NS1.EXAMPLE.INVALID',
+            'DNSSEC: unsigned',
+        ]
+        : scenario === 'not_found'
+            ? ['REPLACE WITH A SYNTHETIC AUTHORITATIVE NO-RECORD DIALECT']
+            : ['REPLACE WITH A SYNTHETIC RESTRICTED, RATE-LIMITED, OR TEMPORARY-FAILURE DIALECT'];
+    const expected = scenario === 'registered'
+        ? {
+            registrationStatus: 'registered',
+            domainName: domain,
+            registrar: 'Example Registrar',
+            registrantOrg: 'Example Organisation',
+            registrantEmail: 'registrant@example.invalid',
+            nameservers: ['NS1.EXAMPLE.INVALID'],
+        }
+        : scenario === 'not_found'
+            ? { registrationStatus: 'not_found', notFound: true }
+            : { registrationStatus: 'inconclusive', notFound: false };
+    return [
+        '// Synthetic scaffold only. Do not paste a live WHOIS response or personal registration data.',
+        '// Preserve the registry dialect while replacing domains, contacts, handles, addresses, phones,',
+        '// nameservers, dates, identifiers, and free text with reserved or fictional values.',
+        '{',
+        `  name: ${JSON.stringify(`.${suffix} ${scenario} synthetic response`)},`,
+        `  capabilityProfile: ${JSON.stringify(profileId)},`,
+        `  scenario: ${JSON.stringify(scenario)},`,
+        '  chain: [',
+        `    rootHop(${JSON.stringify(suffix.toUpperCase())}, ${JSON.stringify(`whois.${suffix}.invalid`)}),`,
+        `    registryHop(${JSON.stringify(`whois.${suffix}.invalid`)}, ${JSON.stringify(response, null, 2).replace(/\n/gu, '\n    ')}),`,
+        '  ],',
+        `  expected: ${JSON.stringify(expected, null, 2).replace(/\n/gu, '\n  ')},`,
+        '},',
+        '',
+        '// Review checklist:',
+        '// - every domain and hostname uses the requested suffix or .invalid;',
+        '// - every email ends in .invalid; IP examples use documentation ranges;',
+        '// - no real name, address, phone, handle, identifier, or free-text notice remains;',
+        '// - authoritative absence is asserted only for a documented registry response;',
+        '// - add or refresh the tracked provenance digest after review.',
+        '',
+    ].join('\n');
+}