@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/lib/evidence-export.mjs

@@ -1,25 +1,441 @@
 import { compareRdapPublications, compareRegistrySources } from "./registry-comparison.mjs";
 import { buildRegistryInsights } from "./registry-insights.mjs";
-import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "./project-metadata.mjs";
-import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
+import { buildPortableGeneratorMetadata } from "./portable-generator.mjs";
+import { assertBoundedJsonStructure, isSafeJsonObjectKey } from "./bounded-json.mjs";
 export const LOOKUP_EVIDENCE_SCHEMA = 'whoisleuth.lookup-evidence';
-export const LOOKUP_EVIDENCE_SCHEMA_VERSION = 25;
+export const LEGACY_LOOKUP_EVIDENCE_SCHEMA_VERSION = 25;
+export const LOOKUP_EVIDENCE_SCHEMA_VERSION = 26;
+export const SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS = Object.freeze([
+    LEGACY_LOOKUP_EVIDENCE_SCHEMA_VERSION,
+    LOOKUP_EVIDENCE_SCHEMA_VERSION,
+]);
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES = 5 * 1024 * 1024;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_ENTRIES = 20_000;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_DEPTH = 24;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS = 10_000;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_KEY_LENGTH = 256;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_STRING_LENGTH = 1024 * 1024;
 const REGISTRAR_RDAP_STATUSES = new Set([
     'success', 'partial', 'error', 'unsupported', 'not_found', 'skipped', 'disabled',
 ]);
+const LOOKUP_QUERY_TYPES = new Set(['domain', 'ipv4', 'ipv6', 'asn']);
+const RDAP_SOURCE_STATUSES = new Set([
+    'success', 'partial', 'error', 'unsupported', 'not_found', 'skipped', 'disabled',
+]);
+const WHOIS_SOURCE_STATUSES = new Set([
+    'complete', 'partial', 'error', 'unsupported', 'not_found', 'skipped', 'disabled',
+]);
+const AVAILABILITY_DIAGNOSTIC_STATUSES = new Set(['complete', 'error', 'disabled', 'not_applicable']);
 const NETWORK_CONTEXT_STATUSES = new Set(['success', 'partial', 'not_found', 'unsupported', 'error']);
 const NETWORK_ADDRESS_SOURCES = new Set(['tls_connection', 'dns_a', 'dns_aaaa']);
 const REVERSE_DNS_STATUSES = new Set(['success', 'partial', 'not_found', 'unsupported', 'skipped', 'error']);
 const SECURITY_TXT_STATES = new Set(['present', 'stale', 'partial', 'absent', 'malformed', 'unsupported', 'unavailable']);
 const SSLBL_STATES = new Set(['success', 'stale', 'unavailable']);
 const SSLBL_VERDICTS = new Set(['listed', 'not_listed', 'inconclusive']);
+const RDAP_ATTEMPT_OUTCOMES = new Set([
+    'success', 'not_found', 'no_results', 'unsupported', 'rate_limited',
+    'server_error', 'client_error', 'invalid_json', 'invalid_response',
+    'timeout', 'network_error',
+]);
+const WHOIS_QUERY_PROFILES = new Set([
+    'plain-domain', 'denic-domain-ace', 'jprs-domain-english',
+    'registry-domain-unicode', 'not-issued',
+]);
+const LOOKUP_TIMING_SOURCES = new Set([
+    'rdap', 'whois', 'domain_evidence', 'reverse_dns', 'registrar_rdap',
+    'network_context', 'security_txt', 'external_intelligence',
+    'malware_host_intelligence', 'malware_ioc_intelligence',
+]);
+const LOOKUP_AVAILABILITY_ANALYSIS_KEYS = new Set([
+    'applicable', 'type', 'domain', 'state', 'confidence', 'detail', 'source',
+    'rdapServer', 'nameservers', 'statuses', 'registrar', 'registrant', 'abuse',
+    'createdDate', 'expiryDate', 'createdDateIso', 'expiryDateIso', 'domainAgeDays',
+    'expiresInDays', 'privacyProtected', 'dnssec', 'activityStatus',
+    'websiteProbeStatus', 'websiteProbeDetail', 'http', 'deepScanComplete',
+    'faviconHash', 'faviconPHash', 'pageTitle', 'hasPasswordField',
+    'phishingLanguageMatch', 'hasExternalFormAction', 'externalAssetHosts',
+    'pageIdentity', 'credentialSurfaceProfile', 'structuredDataIdentity',
+    'technologyProfile', 'pageRoleProfile', 'clientBehaviorProfile',
+    'securityPosture', 'dns', 'tls', 'hasMx', 'hasNullMx', 'mxHosts', 'hasSpf',
+    'hasDmarc', 'bulkComparison', 'limitations',
+]);
+const LOOKUP_IDN_ANALYSIS_KEYS = new Set([
+    'version', 'mappingVersion', 'asciiDomain', 'unicodeDomain', 'hasIdn',
+    'scripts', 'labels', 'mixedScript', 'skeleton', 'referenceMatches', 'findings',
+    'truncated', 'limitations',
+]);
+const PRIVATE_EVIDENCE_KEYS = new Set([
+    'authorization', 'proxyauthorization', 'cookie', 'cookies', 'setcookie',
+    'session', 'sessionid', 'sessiontoken', 'token', 'accesstoken', 'refreshtoken',
+    'apikey', 'password', 'secret', 'credentials', 'requestheaders', 'responseheaders',
+    'headers', 'rawbody', 'responsebody',
+]);
+const SAFE_EVIDENCE_KEYS = new Set([
+    'credentialsurfaceprofile', 'credentialsurfaceversion', 'haspasswordfield', 'tokencount',
+]);
+const PORTABLE_URL_KEYS = new Set([
+    'endpoint', 'url', 'uri', 'href', 'rdapserver', 'finalurl', 'requestedurl',
+    'requesturl', 'officiallookupurl', 'declaredorigin', 'actionurl', 'from', 'to',
+]);
+const PORTABLE_ORIGIN_COLLECTION_KEYS = new Set([
+    'embeddedorigins', 'externalactionorigins', 'externalorigins',
+]);
+// Availability is assembled from a finite set of versioned, bounded analysis
+// models. Portable exports retain only their declared output vocabulary rather
+// than recursively copying arbitrary browser-local extensions. This set is
+// intentionally exact and case-sensitive; new model fields must be reviewed at
+// this privacy boundary before they can enter a portable artefact.
+const LOOKUP_AVAILABILITY_PORTABLE_NESTED_KEYS = new Set([
+    // Shared observation and summary fields.
+    'version', 'profileVersion', 'status', 'state', 'source', 'observedAt',
+    'scanMode', 'durationMs', 'complete', 'truncated', 'limitations',
+    'diagnostics', 'detail', 'error', 'count', 'total', 'discarded', 'summary',
+    'findings', 'id', 'label', 'tone', 'category', 'confidence', 'evidence',
+    'value', 'values', 'name', 'type', 'types', 'mode', 'owner', 'target',
+    'url', 'uri', 'href',
+    'priority', 'ttl', 'records',
+    // HTTP observation and retained response metadata.
+    'requestUrl', 'finalUrl', 'transportSecurity', 'redirectCount',
+    'redirectLimitReached', 'redirects', 'crossOriginRedirect', 'httpsDowngrade',
+    'attempts', 'response', 'contentType', 'contentLanguage', 'server',
+    'declaredContentLength', 'capturedBodyBytes', 'bodyInspected', 'bodyTruncated',
+    'bodyHash', 'securityHeaders', 'strictTransportSecurity',
+    'contentSecurityPolicy', 'xFrameOptions', 'xContentTypeOptions',
+    'referrerPolicy', 'algorithm', 'scope', 'bytes', 'from', 'to',
+    'queryOmitted', 'pathTruncated', 'outcome', 'httpStatus', 'attemptCount',
+    // DNS observation, effective CAA, and HTTPS/SVCB parameter summaries.
+    'a', 'aaaa', 'caa', 'cname', 'dmarc', 'https', 'mx', 'ns', 'ptr', 'soa',
+    'spf', 'delegation', 'caaPolicy', 'policyVersion', 'queryLimit',
+    'queriedOwners', 'effectiveOwner', 'inherited', 'tree', 'registryEvidence',
+    'exchange', 'nsname', 'hostmaster', 'serial', 'refresh', 'retry', 'expire', 'minttl',
+    'tag', 'critical', 'parameters', 'parametersIgnored', 'mandatory', 'alpn',
+    'noDefaultAlpn', 'port', 'ipv4hint', 'ipv6hint', 'opaque', 'key', 'length',
+    'unknownKeys', 'unsupportedMandatoryKeys', 'targetIsOwner',
+    'serviceUnavailable', 'compatible', 'effectiveOwner', 'queriedOwners',
+    // TLS profile, certificate, extension, and connection summaries. Runtime
+    // authorisation objects are deliberately absent from this portable set.
+    'connectedAddress', 'connectedFamily', 'sniHost', 'protocol', 'alpnProtocol',
+    'cipher', 'ephemeralKey', 'hostname', 'matches', 'validity', 'certificate',
+    'chain', 'chainTruncated', 'standardName', 'size', 'subject', 'issuer',
+    'serialNumber', 'validFrom', 'validTo', 'fingerprintSha1',
+    'fingerprintSha256', 'isCertificateAuthority', 'subjectAltNames',
+    'dnsNames', 'ipAddresses', 'otherNames', 'publicKey', 'bits', 'curve',
+    'signature', 'oid', 'extendedKeyUsage', 'authorityInformationAccess',
+    'ocsp', 'caIssuers', 'unknownMethods', 'extensionProfile', 'parsed', 'partial',
+    'certificatePolicies', 'crlDistributionPoints', 'commonNames',
+    'organizations', 'organizationalUnits', 'countries', 'localities', 'states',
+    'connectionAttempts', 'resolvedAddressCount', 'discardedFields',
+    // Page identity, relationships, and bounded fingerprints.
+    'identityVersion', 'documentLanguage', 'canonical', 'metaRefresh',
+    'openGraph', 'title', 'siteName', 'generator', 'forms', 'postCount',
+    'insecureActionCount', 'externalActionOrigins', 'resources', 'byType',
+    'image', 'script', 'stylesheet', 'link', 'frame', 'media', 'object',
+    'externalOrigins', 'embeddedOrigins', 'contactDomains', 'downloads',
+    'explicitCount', 'riskyCount', 'riskyFileTypes', 'trackingIdentifiers',
+    'fingerprints', 'fingerprintVersion', 'exact', 'normalizedHtml',
+    'visibleText', 'domStructure', 'formStructure', 'resourceHosts',
+    'identifiers', 'featureCount', 'nodeCount', 'formCount', 'controlCount',
+    'parser', 'tokenCount', 'tagsExamined', 'discardedUrls', 'formsObserved',
+    'relationshipTagsExamined', 'relationshipUrlsDiscarded',
+    'trackingIdentifiersTruncated',
+    // Credential, structured identity, role, behaviour, technology, and posture
+    // projections. Only fixed categories/counts and bounded descriptions enter.
+    'credentialSurfaceVersion', 'methods', 'actions', 'missing', 'get', 'post',
+    'dialog', 'other', 'sameOrigin', 'external', 'cleartext', 'unclassified',
+    'inputs', 'classifiedCount', 'categories', 'password', 'email', 'username',
+    'one_time_code', 'payment', 'inputsObserved', 'classifiedInputs',
+    'unclassifiedActions', 'structuredDataVersion', 'scriptsObserved',
+    'scriptsExamined', 'charactersExamined', 'documentsParsed', 'malformedScripts',
+    'externalScriptsSkipped', 'objectsExamined', 'arrayItemsExamined',
+    'discardedProperties', 'entities', 'declaredOrigin', 'sameAsHosts',
+    'pageRoleProfileVersion', 'primaryRole', 'role', 'rolesObserved',
+    'clientBehaviorProfileVersion', 'scriptSummary', 'elementsObserved',
+    'referencedScripts', 'inlineScripts', 'moduleScripts', 'indicators',
+    'evidenceClass', 'occurrences', 'explanation', 'indicatorsObserved',
+    'scriptElementsExamined', 'inlineCharactersExamined', 'technologyProfile',
+    'browserLibraryProfile', 'catalog', 'knownExploitedCatalog', 'releasedAt',
+    'sourceRevision', 'apparentVersion', 'detectionMethods', 'advisoryCount',
+    'highestSeverity', 'advisoryIdentifiers', 'knownExploitedCount',
+    'knownExploitedIdentifiers', 'weaknessClasses', 'htmlEvaluated',
+    'generatorEvaluated', 'serverEvaluated', 'resourceOriginsEvaluated',
+    'passiveHeadersEvaluated', 'tagLimitReached', 'referencesExamined',
+    'inlineScriptsExamined', 'inlineSignatureCharactersExamined',
+    'inlineSignatureTimedOut', 'inlineSignatureUnavailable', 'catalogComponents',
+    'advisoryMatches', 'knownExploitedMatches', 'postureVersion',
+    'potentialExposure', 'observedAbsence', 'unavailable',
+    // Bounded cross-row comparison evidence.
+    'bulkComparison', 'technology', 'tls', 'ids', 'issuerLabel', 'spkiSha256',
+]);
 function recordOrNull(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
-function cloneJson(value) {
-    if (value === undefined)
+function normalizedEvidenceKey(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]/gu, '');
+}
+function privateEvidenceKey(value, item) {
+    const normalized = normalizedEvidenceKey(value);
+    if (SAFE_EVIDENCE_KEYS.has(normalized))
+        return false;
+    if (normalized === 'password' && (typeof item === 'number' || typeof item === 'boolean'))
+        return false;
+    return PRIVATE_EVIDENCE_KEYS.has(normalized)
+        || normalized.includes('authorization')
+        || normalized.includes('authheader')
+        || normalized.includes('cookie')
+        || normalized.includes('apikey')
+        || normalized.includes('secret')
+        || normalized.includes('sessionkey')
+        || normalized.includes('passwordvalue')
+        || normalized.endsWith('password')
+        || /(?:access|auth|bearer|csrf|refresh|session)token$/u.test(normalized)
+        || /(?:request|response|authorization|proxy)headers?$/u.test(normalized)
+        || (normalized.includes('credential') && !normalized.startsWith('credentialsurface'));
+}
+function portableUri(value) {
+    const text = boundedString(value, 2048);
+    if (!text)
+        return null;
+    try {
+        const url = new URL(text);
+        if (!['http:', 'https:', 'mailto:', 'tel:', 'dns:', 'openpgp4fpr:'].includes(url.protocol)
+            || url.username
+            || url.password)
+            return null;
+        if (url.protocol === 'http:' || url.protocol === 'https:') {
+            url.search = '';
+            url.hash = '';
+        }
+        return url.toString().slice(0, 2048);
+    }
+    catch {
+        return null;
+    }
+}
+function portableOrigin(value) {
+    const text = boundedString(value, 2048);
+    if (!text)
+        return null;
+    try {
+        const url = new URL(text);
+        return ['http:', 'https:'].includes(url.protocol) && !url.username && !url.password
+            ? url.origin
+            : null;
+    }
+    catch {
         return null;
-    return JSON.parse(JSON.stringify(value));
+    }
+}
+function consumePortableProjectionEntry(state, depth) {
+    state.entries += 1;
+    if (state.entries > LOOKUP_EVIDENCE_PORTABLE_MAX_ENTRIES) {
+        throw new TypeError(`Lookup evidence projection exceeds the ${LOOKUP_EVIDENCE_PORTABLE_MAX_ENTRIES.toLocaleString('en')}-entry portable limit.`);
+    }
+    if (depth > LOOKUP_EVIDENCE_PORTABLE_MAX_DEPTH) {
+        throw new TypeError(`Lookup evidence projection exceeds the ${LOOKUP_EVIDENCE_PORTABLE_MAX_DEPTH}-level portable nesting limit.`);
+    }
+}
+function projectPortableString(value) {
+    const sanitized = value.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/gu, ' ');
+    return sanitized.length <= LOOKUP_EVIDENCE_PORTABLE_MAX_STRING_LENGTH
+        ? sanitized
+        : sanitized.slice(0, LOOKUP_EVIDENCE_PORTABLE_MAX_STRING_LENGTH);
+}
+function projectLookupEvidencePrivacySafeTreeValue(value, state, depth) {
+    consumePortableProjectionEntry(state, depth);
+    if (value === null || typeof value === 'boolean' || typeof value === 'number')
+        return value;
+    if (typeof value === 'string')
+        return projectPortableString(value);
+    if (Array.isArray(value)) {
+        return value.slice(0, LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS)
+            .map((item) => projectLookupEvidencePrivacySafeTreeValue(item, state, depth + 1));
+    }
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const output = {};
+    for (const [key, item] of Object.entries(source).slice(0, LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS)) {
+        if (!isSafeJsonObjectKey(key))
+            throw new TypeError('Lookup evidence projection contains an unsafe object key.');
+        const normalized = normalizedEvidenceKey(key);
+        if (privateEvidenceKey(normalized, item))
+            continue;
+        if (typeof item === 'string' && PORTABLE_URL_KEYS.has(normalized)) {
+            consumePortableProjectionEntry(state, depth + 1);
+            output[key] = portableUri(item);
+            continue;
+        }
+        output[key] = projectLookupEvidencePrivacySafeTreeValue(item, state, depth + 1);
+    }
+    return output;
+}
+export function projectLookupEvidencePrivacySafeTree(value) {
+    return projectLookupEvidencePrivacySafeTreeValue(value, { entries: 0 }, 0);
+}
+function projectLookupEvidenceAvailabilityValue(value, parentKey, state, depth) {
+    consumePortableProjectionEntry(state, depth);
+    if (value === null || typeof value === 'boolean' || typeof value === 'number')
+        return value;
+    if (typeof value === 'string') {
+        const normalizedParent = normalizedEvidenceKey(parentKey || '');
+        if (PORTABLE_URL_KEYS.has(normalizedParent))
+            return portableUri(value);
+        if (PORTABLE_ORIGIN_COLLECTION_KEYS.has(normalizedParent))
+            return portableOrigin(value);
+        return projectPortableString(value);
+    }
+    if (Array.isArray(value)) {
+        return value.slice(0, LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS)
+            .map((item) => projectLookupEvidenceAvailabilityValue(item, parentKey, state, depth + 1));
+    }
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const output = {};
+    for (const [key, item] of Object.entries(source).slice(0, LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS)) {
+        if (!LOOKUP_AVAILABILITY_PORTABLE_NESTED_KEYS.has(key)
+            || privateEvidenceKey(key, item))
+            continue;
+        output[key] = projectLookupEvidenceAvailabilityValue(item, key, state, depth + 1);
+    }
+    return output;
+}
+/**
+ * Canonical portable projection for the bounded Lookup availability models.
+ * The root and every nested record are positive allowlists, so an imported
+ * extension cannot become authenticated evidence merely by avoiding a
+ * credential-key denylist.
+ */
+export function projectLookupEvidenceAvailability(value) {
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const state = { entries: 0 };
+    consumePortableProjectionEntry(state, 0);
+    const output = {};
+    for (const key of LOOKUP_AVAILABILITY_ANALYSIS_KEYS) {
+        if (!Object.hasOwn(source, key))
+            continue;
+        const item = source[key];
+        if (privateEvidenceKey(key, item))
+            continue;
+        output[key] = projectLookupEvidenceAvailabilityValue(item, key, state, 1);
+    }
+    return output;
+}
+export function assertLookupEvidencePrivacySafeTree(value) {
+    assertLookupEvidencePortableTree(value);
+    const pending = [value];
+    while (pending.length) {
+        const current = pending.pop();
+        if (current === null || typeof current === 'boolean' || typeof current === 'number')
+            continue;
+        if (typeof current === 'string') {
+            if (projectLookupEvidencePrivacySafeTree(current) !== current) {
+                throw new TypeError('Lookup evidence contains a non-portable string value.');
+            }
+            continue;
+        }
+        if (Array.isArray(current)) {
+            for (const item of current)
+                pending.push(item);
+            continue;
+        }
+        const source = recordOrNull(current);
+        if (!source)
+            throw new TypeError('Lookup evidence contains a non-JSON value.');
+        for (const [key, item] of Object.entries(source)) {
+            const normalized = normalizedEvidenceKey(key);
+            if (privateEvidenceKey(normalized, item)) {
+                throw new TypeError('Lookup evidence contains excluded private request or session material.');
+            }
+            if (typeof item === 'string' && PORTABLE_URL_KEYS.has(normalized) && portableUri(item) !== item) {
+                throw new TypeError('Lookup evidence contains a credential-bearing or non-portable URL.');
+            }
+            pending.push(item);
+        }
+    }
+}
+function projectedKnownRecord(value, keys) {
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const output = {};
+    for (const key of keys) {
+        if (Object.hasOwn(source, key))
+            output[key] = projectLookupEvidencePrivacySafeTree(source[key]);
+    }
+    return output;
+}
+export function assertLookupEvidencePortableTree(value) {
+    const pending = [{ value, depth: 0 }];
+    let entries = 0;
+    while (pending.length) {
+        const current = pending.pop();
+        if (!current)
+            break;
+        entries += 1;
+        if (entries > LOOKUP_EVIDENCE_PORTABLE_MAX_ENTRIES) {
+            throw new TypeError(`Lookup evidence exceeds the ${LOOKUP_EVIDENCE_PORTABLE_MAX_ENTRIES.toLocaleString('en')}-entry portable limit.`);
+        }
+        if (current.depth > LOOKUP_EVIDENCE_PORTABLE_MAX_DEPTH) {
+            throw new TypeError(`Lookup evidence exceeds the ${LOOKUP_EVIDENCE_PORTABLE_MAX_DEPTH}-level portable nesting limit.`);
+        }
+        if (typeof current.value === 'string') {
+            if (current.value.length > LOOKUP_EVIDENCE_PORTABLE_MAX_STRING_LENGTH) {
+                throw new TypeError('Lookup evidence contains an over-bound string.');
+            }
+            continue;
+        }
+        if (current.value === null || typeof current.value === 'boolean')
+            continue;
+        if (typeof current.value === 'number') {
+            if (!Number.isFinite(current.value)) {
+                throw new TypeError('Lookup evidence contains a non-finite number.');
+            }
+            continue;
+        }
+        if (Array.isArray(current.value)) {
+            if (current.value.length > LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS) {
+                throw new TypeError('Lookup evidence contains an over-bound array.');
+            }
+            for (const item of current.value)
+                pending.push({ value: item, depth: current.depth + 1 });
+            continue;
+        }
+        if (current.value && typeof current.value === 'object') {
+            const source = current.value;
+            const prototype = Object.getPrototypeOf(source);
+            if (prototype !== Object.prototype && prototype !== null) {
+                throw new TypeError('Lookup evidence contains a non-JSON object.');
+            }
+            const keys = Object.keys(source);
+            if (keys.length > LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS
+                || keys.some((key) => key.length > LOOKUP_EVIDENCE_PORTABLE_MAX_KEY_LENGTH
+                    || /[\u0000-\u001f\u007f]/u.test(key)
+                    || !isSafeJsonObjectKey(key))) {
+                throw new TypeError('Lookup evidence contains an over-bound object.');
+            }
+            for (const item of Object.values(source))
+                pending.push({ value: item, depth: current.depth + 1 });
+            continue;
+        }
+        throw new TypeError('Lookup evidence contains a non-JSON value.');
+    }
+}
+export function serializeLookupEvidence(value, pretty = false) {
+    assertLookupEvidencePortableTree(value);
+    let output;
+    try {
+        output = JSON.stringify(value, null, pretty ? 2 : 0);
+    }
+    catch {
+        throw new TypeError('Lookup evidence could not be serialized as JSON.');
+    }
+    if (new TextEncoder().encode(output).byteLength > LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES) {
+        throw new TypeError('Lookup evidence exceeds the 5 MiB portable file limit.');
+    }
+    return output;
 }
 function boundedString(value, maximum) {
     if (typeof value !== 'string' || value.length > maximum || /[\u0000-\u001f\u007f]/.test(value))
@@ -39,14 +455,6 @@ function boundedTimestamp(value) {
     const time = Date.parse(text);
     return Number.isFinite(time) ? new Date(time).toISOString() : null;
 }
-function boundedSemanticVersion(value) {
-    try {
-        return normalizeBoundedSemanticVersion(value, 'Evidence application');
-    }
-    catch {
-        return null;
-    }
-}
 function boundedEndpoint(value) {
     const text = boundedString(value, 2048);
     if (!text)
@@ -76,6 +484,74 @@ function boundedHostname(value) {
     }
     return text;
 }
+function canonicalIpv4(value) {
+    const text = boundedString(value, 64);
+    if (!text || !/^\d{1,3}(?:\.\d{1,3}){3}$/u.test(text))
+        return null;
+    const octets = text.split('.').map(Number);
+    if (octets.some((octet) => octet > 255))
+        return null;
+    return octets.join('.');
+}
+function canonicalIpv6(value) {
+    const text = boundedString(value, 64)?.toLowerCase();
+    if (!text || !text.includes(':') || text.includes('%'))
+        return null;
+    try {
+        const hostname = new URL(`http://[${text}]/`).hostname;
+        return hostname.startsWith('[') && hostname.endsWith(']')
+            ? hostname.slice(1, -1).toLowerCase()
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function canonicalAsn(value) {
+    const text = boundedString(value, 32);
+    const match = text?.match(/^(?:AS)?(\d+)$/iu);
+    if (!match)
+        return null;
+    const number = Number(match[1]);
+    return Number.isInteger(number) && number >= 0 && number <= 4_294_967_295
+        ? `AS${number}`
+        : null;
+}
+export function projectLookupEvidenceQuery(value) {
+    const source = recordOrNull(value) || {};
+    const type = typeof source.type === 'string' && LOOKUP_QUERY_TYPES.has(source.type)
+        ? source.type
+        : 'domain';
+    if (type === 'domain') {
+        const inputHostname = [source.inputHostname, source.registrableDomain, source.submitted, source.query]
+            .map(boundedHostname)
+            .find((item) => Boolean(item)) || 'unknown.invalid';
+        const suppliedRegistrableDomain = boundedHostname(source.registrableDomain);
+        const registrableDomain = suppliedRegistrableDomain
+            && (inputHostname === suppliedRegistrableDomain || inputHostname.endsWith(`.${suppliedRegistrableDomain}`))
+            ? suppliedRegistrableDomain
+            : inputHostname;
+        return {
+            submitted: inputHostname,
+            type,
+            inputHostname,
+            registrableDomain,
+            isSubdomain: inputHostname !== registrableDomain,
+        };
+    }
+    const candidate = source.submitted ?? source.query;
+    const submitted = type === 'ipv4'
+        ? canonicalIpv4(candidate)
+        : type === 'ipv6'
+            ? canonicalIpv6(candidate)
+            : canonicalAsn(candidate);
+    if (!submitted)
+        throw new TypeError(`Lookup evidence contains an invalid ${type} query.`);
+    return { submitted, type, inputHostname: null, registrableDomain: null, isSubdomain: false };
+}
+function completeTerminalObservation(status, truncated) {
+    return truncated !== true && (status === 'success' || status === 'not_found');
+}
 function boundedPublishedUri(value, protocols) {
     const text = boundedString(value, 2048);
     if (!text)
@@ -204,18 +680,189 @@ function sslblSource(value) {
         limitations: boundedStringList(source.limitations, 10, 300),
     };
 }
-function networkAttempt(value) {
+function rdapAttempt(value) {
     const attempt = recordOrNull(value) || {};
     const endpoint = boundedEndpoint(attempt.endpoint);
     return {
         endpoint,
         transportSecurity: endpoint ? endpoint.startsWith('https:') ? 'https' : 'http' : null,
         status: boundedHttpStatus(attempt.status),
-        outcome: boundedString(attempt.outcome, 40),
+        outcome: typeof attempt.outcome === 'string' && RDAP_ATTEMPT_OUTCOMES.has(attempt.outcome)
+            ? attempt.outcome
+            : 'unknown',
         detail: boundedString(attempt.detail, 240),
         selected: attempt.selected === true,
     };
 }
+function boundedRdapAttempts(value, maximum) {
+    return (Array.isArray(value) ? value : [])
+        .slice(0, maximum)
+        .map(rdapAttempt);
+}
+function whoisChainHop(value) {
+    const hop = recordOrNull(value) || {};
+    const queryProfile = typeof hop.queryProfile === 'string' && WHOIS_QUERY_PROFILES.has(hop.queryProfile)
+        ? hop.queryProfile
+        : null;
+    const error = boundedString(hop.error, 240);
+    return {
+        server: boundedHostname(hop.server),
+        address: boundedString(hop.address, 64),
+        queriedAt: boundedTimestamp(hop.queriedAt),
+        queryProfile,
+        responseEncoding: hop.responseEncoding === 'utf-8' ? 'utf-8' : null,
+        status: queryProfile === 'not-issued'
+            ? 'not_issued'
+            : error
+                ? 'error'
+                : typeof hop.response === 'string'
+                    ? 'success'
+                    : 'unknown',
+        detail: error,
+    };
+}
+function boundedWhoisChain(value) {
+    return (Array.isArray(value) ? value : [])
+        .slice(0, 16)
+        .map(whoisChainHop);
+}
+function lookupTimingDiagnostics(value) {
+    const source = recordOrNull(value);
+    if (source?.version !== 1)
+        return null;
+    return {
+        version: 1,
+        totalMs: boundedInteger(source.totalMs, 120_000),
+        sources: (Array.isArray(source.sources) ? source.sources : [])
+            .slice(0, LOOKUP_TIMING_SOURCES.size)
+            .flatMap((item) => {
+            const entry = recordOrNull(item);
+            if (!entry
+                || typeof entry.source !== 'string'
+                || !LOOKUP_TIMING_SOURCES.has(entry.source)
+                || (entry.outcome !== 'fulfilled' && entry.outcome !== 'rejected'))
+                return [];
+            return [{
+                    source: entry.source,
+                    outcome: entry.outcome,
+                    durationMs: boundedInteger(entry.durationMs, 120_000),
+                    completedAfterMs: boundedInteger(entry.completedAfterMs, 120_000),
+                }];
+        }),
+    };
+}
+function registryAccessDiagnostics(value) {
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const officialLookupUrl = portableUri(source.officialLookupUrl);
+    return {
+        suffix: boundedHostname(source.suffix),
+        coverageState: boundedString(source.coverageState, 40),
+        whoisAccessProfile: boundedString(source.whoisAccessProfile, 80),
+        rdapAccessProfile: boundedString(source.rdapAccessProfile, 80),
+        ...(officialLookupUrl ? { officialLookupUrl } : {}),
+        limitation: boundedString(source.limitation, 500),
+        authority: source.authority === 'context_only' ? 'context_only' : null,
+    };
+}
+function registrarRdapDiagnostics(value) {
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const endpoint = boundedEndpoint(source.endpoint);
+    return {
+        status: sourceStatus(source.status, REGISTRAR_RDAP_STATUSES, 'error'),
+        endpoint,
+        transportSecurity: endpoint ? endpoint.startsWith('https:') ? 'https' : 'http' : null,
+        httpStatus: boundedHttpStatus(source.httpStatus),
+        fetchedAt: boundedTimestamp(source.fetchedAt),
+        attempt: source.attempt === null || source.attempt === undefined ? null : rdapAttempt(source.attempt),
+    };
+}
+function lookupDiagnostics(value) {
+    const source = recordOrNull(value) || {};
+    const rdap = recordOrNull(source.rdap) || {};
+    const whois = recordOrNull(source.whois) || {};
+    const availability = recordOrNull(source.availability) || {};
+    const reverseDns = recordOrNull(source.reverseDns);
+    const network = recordOrNull(source.network);
+    const securityTxt = recordOrNull(source.securityTxt);
+    const sslbl = recordOrNull(source.sslbl);
+    const rdapEndpoint = boundedEndpoint(rdap.endpoint);
+    const networkEndpoint = boundedEndpoint(network?.endpoint);
+    const networkPublicationAvailable = network?.status === 'success' || network?.status === 'partial';
+    const securityTxtEndpoint = boundedPublishedUri(securityTxt?.endpoint, ['https:']);
+    const version = boundedInteger(source.version, 10);
+    const timing = lookupTimingDiagnostics(source.timing);
+    const registryAccess = registryAccessDiagnostics(source.registryAccess);
+    const registrar = registrarRdapDiagnostics(rdap.registrar);
+    return {
+        ...(version === null ? {} : { version }),
+        ...(timing ? { timing } : {}),
+        ...(registryAccess ? { registryAccess } : {}),
+        rdap: {
+            status: sourceStatus(rdap.status, RDAP_SOURCE_STATUSES, 'error'),
+            errorCode: boundedString(rdap.errorCode, 80),
+            endpoint: rdapEndpoint,
+            transportSecurity: rdapEndpoint ? rdapEndpoint.startsWith('https:') ? 'https' : 'http' : null,
+            httpStatus: boundedHttpStatus(rdap.httpStatus),
+            fetchedAt: boundedTimestamp(rdap.fetchedAt),
+            attempts: boundedRdapAttempts(rdap.attempts, 16),
+            ...(registrar ? { registrar } : {}),
+        },
+        whois: {
+            status: sourceStatus(whois.status, WHOIS_SOURCE_STATUSES, 'error'),
+            errorCode: boundedString(whois.errorCode, 80),
+            queriedAt: boundedTimestamp(whois.queriedAt),
+            authoritativeHop: boundedHostname(whois.authoritativeHop),
+            failedHop: boundedHostname(whois.failedHop),
+            conflictingHop: boundedHostname(whois.conflictingHop),
+        },
+        ...(recordOrNull(source.availability) ? { availability: {
+                status: sourceStatus(availability.status, AVAILABILITY_DIAGNOSTIC_STATUSES, 'error'),
+                errorCode: boundedString(availability.errorCode, 80),
+                resultState: boundedString(availability.resultState, 40),
+            } } : {}),
+        ...(reverseDns ? { reverseDns: {
+                status: sourceStatus(reverseDns.status, REVERSE_DNS_STATUSES, 'error'),
+                observedAt: boundedTimestamp(reverseDns.observedAt),
+                complete: completeTerminalObservation(sourceStatus(reverseDns.status, REVERSE_DNS_STATUSES, 'error'), reverseDns.truncated),
+                truncated: reverseDns.truncated === true,
+            } } : {}),
+        ...(network ? { network: {
+                status: sourceStatus(network.status, NETWORK_CONTEXT_STATUSES, 'error'),
+                address: networkPublicationAvailable ? boundedString(network.address, 64) : null,
+                family: networkPublicationAvailable && (network.family === 4 || network.family === 6) ? network.family : null,
+                addressSource: networkPublicationAvailable && typeof network.addressSource === 'string' && NETWORK_ADDRESS_SOURCES.has(network.addressSource)
+                    ? network.addressSource
+                    : null,
+                endpoint: networkPublicationAvailable ? networkEndpoint : null,
+                transportSecurity: networkPublicationAvailable && networkEndpoint ? networkEndpoint.startsWith('https:') ? 'https' : 'http' : null,
+                httpStatus: networkPublicationAvailable ? boundedHttpStatus(network.httpStatus) : null,
+                fetchedAt: networkPublicationAvailable ? boundedTimestamp(network.fetchedAt) : null,
+                attempts: networkPublicationAvailable ? boundedRdapAttempts(network.attempts, 3) : [],
+            } } : {}),
+        ...(securityTxt ? { securityTxt: {
+                status: boundedString(securityTxt.status, 40),
+                state: typeof securityTxt.state === 'string' && SECURITY_TXT_STATES.has(securityTxt.state)
+                    ? securityTxt.state
+                    : null,
+                endpoint: securityTxtEndpoint,
+                httpStatus: boundedHttpStatus(securityTxt.httpStatus),
+                observedAt: boundedTimestamp(securityTxt.observedAt),
+                complete: securityTxt.complete === true,
+                truncated: securityTxt.truncated === true,
+            } } : {}),
+        ...(sslbl ? { sslbl: {
+                status: typeof sslbl.status === 'string' && SSLBL_STATES.has(sslbl.status) ? sslbl.status : null,
+                verdict: typeof sslbl.verdict === 'string' && SSLBL_VERDICTS.has(sslbl.verdict) ? sslbl.verdict : null,
+                observedAt: boundedTimestamp(sslbl.observedAt),
+                complete: sslbl.complete === true,
+                snapshotUpdatedAt: boundedTimestamp(sslbl.snapshotUpdatedAt),
+            } } : {}),
+    };
+}
 function networkSource(value) {
     const source = recordOrNull(value);
     if (!source
@@ -228,6 +875,7 @@ function networkSource(value) {
     const network = recordOrNull(source.network);
     const diagnostics = recordOrNull(source.diagnostics);
     const rdapEndpoint = boundedEndpoint(rdap?.endpoint);
+    const publicationAvailable = source.status === 'success' || source.status === 'partial';
     return {
         contextVersion: 1,
         version: source.version === 1 ? 1 : null,
@@ -236,7 +884,7 @@ function networkSource(value) {
         scanMode: source.scanMode === 'deep' ? 'deep' : null,
         source: source.source === 'ip_rdap' ? 'ip_rdap' : null,
         durationMs: boundedInteger(source.durationMs, 120_000),
-        complete: source.complete === true,
+        complete: completeTerminalObservation(source.status, source.truncated),
         truncated: source.truncated === true,
         limitations: boundedStringList(source.limitations, 10, 300),
         diagnostics: diagnostics ? {
@@ -249,7 +897,7 @@ function networkSource(value) {
             cidrCount: boundedInteger(diagnostics.cidrCount, 16),
         } : null,
         detail: boundedString(source.detail, 300),
-        endpoint: endpoint ? {
+        endpoint: publicationAvailable && endpoint ? {
             address: boundedString(endpoint.address, 64),
             family: endpoint.family === 4 || endpoint.family === 6 ? endpoint.family : null,
             selectedFrom: typeof endpoint.selectedFrom === 'string'
@@ -257,14 +905,14 @@ function networkSource(value) {
                 ? endpoint.selectedFrom
                 : null,
         } : null,
-        rdap: rdap ? {
+        rdap: publicationAvailable && rdap ? {
             endpoint: rdapEndpoint,
             transportSecurity: rdapEndpoint ? rdapEndpoint.startsWith('https:') ? 'https' : 'http' : null,
             httpStatus: boundedHttpStatus(rdap.httpStatus),
             fetchedAt: boundedTimestamp(rdap.fetchedAt),
-            attempts: (Array.isArray(rdap.attempts) ? rdap.attempts : []).slice(0, 3).map(networkAttempt),
+            attempts: boundedRdapAttempts(rdap.attempts, 3),
         } : null,
-        network: network ? {
+        network: publicationAvailable && network ? {
             handle: boundedString(network.handle, 300),
             name: boundedString(network.name, 300),
             holder: boundedString(network.holder, 300),
@@ -289,7 +937,8 @@ function reverseDnsSource(value) {
     const records = recordOrNull(source.records);
     const diagnostics = recordOrNull(source.diagnostics);
     const ptrDiagnostics = recordOrNull(diagnostics?.ptr);
-    const ptr = [...new Set((Array.isArray(records?.ptr) ? records.ptr : [])
+    const publicationAvailable = source.status === 'success' || source.status === 'partial';
+    const ptr = [...new Set((publicationAvailable && Array.isArray(records?.ptr) ? records.ptr : [])
             .slice(0, 8)
             .map(boundedHostname)
             .filter((item) => item !== null))].sort();
@@ -300,7 +949,7 @@ function reverseDnsSource(value) {
         scanMode: source.scanMode === 'deep' ? 'deep' : null,
         source: 'reverse_dns',
         durationMs: boundedInteger(source.durationMs, 120_000),
-        complete: source.complete === true,
+        complete: completeTerminalObservation(source.status, source.truncated),
         truncated: source.truncated === true,
         limitations: boundedStringList(source.limitations, 10, 300),
         diagnostics: ptrDiagnostics ? {
@@ -314,40 +963,62 @@ function reverseDnsSource(value) {
         records: { ptr },
     };
 }
-function rdapSource(rdap) {
+function boundedSourceError(value, fallback) {
+    const normalized = String(value ?? '')
+        .replace(/[\u0000-\u001f\u007f]+/gu, ' ')
+        .replace(/\s+/gu, ' ')
+        .trim();
+    return normalized.slice(0, 10_000) || fallback;
+}
+function sourceStatus(value, allowed, fallback) {
+    return typeof value === 'string' && allowed.has(value) ? value : fallback;
+}
+function rdapSource(rdap, diagnostics) {
     const source = recordOrNull(rdap) || {};
-    if (source.error)
+    const status = sourceStatus(diagnostics?.status, RDAP_SOURCE_STATUSES, 'error');
+    const attempts = boundedRdapAttempts(source.attempts ?? diagnostics?.attempts, 16);
+    if (status === 'error')
         return {
             status: 'error',
-            error: String(source.error),
-            attempts: cloneJson(source.attempts || []),
+            error: boundedSourceError(source.error ?? diagnostics?.errorCode, 'RDAP source reported an error.'),
+            attempts,
         };
+    const hasPublication = status === 'success' || status === 'partial';
     return {
-        status: source.upstreamStatus === 404 ? 'not_found' : 'success',
-        endpoint: source.rdapServer || null,
-        transportSecurity: source.transportSecurity || null,
-        httpStatus: source.upstreamStatus ?? null,
-        fetchedAt: source.fetchedAt || null,
-        attempts: cloneJson(source.attempts || []),
-        parsed: cloneJson(source.parsed),
-        raw: cloneJson(source.data),
+        status,
+        endpoint: boundedEndpoint(source.rdapServer ?? diagnostics?.endpoint),
+        transportSecurity: source.transportSecurity === 'http' || source.transportSecurity === 'https'
+            ? source.transportSecurity
+            : diagnostics?.transportSecurity === 'http' || diagnostics?.transportSecurity === 'https'
+                ? diagnostics.transportSecurity
+                : null,
+        httpStatus: boundedHttpStatus(source.upstreamStatus ?? diagnostics?.httpStatus),
+        fetchedAt: boundedTimestamp(source.fetchedAt ?? diagnostics?.fetchedAt),
+        attempts,
+        parsed: hasPublication ? projectLookupEvidencePrivacySafeTree(source.parsed) : null,
+        raw: hasPublication ? projectLookupEvidencePrivacySafeTree(source.data) : null,
     };
 }
-function whoisSource(whois) {
+function whoisSource(whois, diagnostics) {
     const source = recordOrNull(whois) || {};
-    if (source.error)
-        return { status: 'error', error: String(source.error) };
+    const status = sourceStatus(diagnostics?.status, WHOIS_SOURCE_STATUSES, 'error');
+    if (status === 'error')
+        return {
+            status: 'error',
+            error: boundedSourceError(source.error ?? diagnostics?.errorCode, 'WHOIS source reported an error.'),
+        };
     const parsed = recordOrNull(source.parsed);
-    const chain = Array.isArray(source.chain) ? source.chain : [];
+    const hasPublication = status === 'complete' || status === 'partial';
+    const chain = hasPublication ? boundedWhoisChain(source.chain) : [];
     const firstHop = recordOrNull(chain[0]);
     return {
-        status: parsed?.chainStatus || 'unknown',
-        queriedAt: firstHop?.queriedAt || null,
-        authoritativeHop: parsed?.authoritativeHop || null,
-        failedHop: parsed?.failedHop || null,
-        conflictingHop: parsed?.conflictingHop || null,
-        parsed: cloneJson(parsed),
-        chain: cloneJson(chain),
+        status,
+        queriedAt: boundedTimestamp(firstHop?.queriedAt ?? diagnostics?.queriedAt),
+        authoritativeHop: boundedHostname(parsed?.authoritativeHop ?? diagnostics?.authoritativeHop),
+        failedHop: boundedHostname(parsed?.failedHop ?? diagnostics?.failedHop),
+        conflictingHop: boundedHostname(parsed?.conflictingHop ?? diagnostics?.conflictingHop),
+        parsed: hasPublication ? projectLookupEvidencePrivacySafeTree(parsed) : null,
+        chain,
     };
 }
 function registrarPublicationComparison(body, registryParsed) {
@@ -359,7 +1030,9 @@ function registrarPublicationComparison(body, registryParsed) {
     if (!registrar && !registrarDiagnostics)
         return null;
     const reportedStatus = registrar?.status ?? registrarDiagnostics?.status;
-    const parsed = recordOrNull(registrar?.parsed);
+    const parsed = ['success', 'partial'].includes(String(reportedStatus))
+        ? recordOrNull(projectLookupEvidencePrivacySafeTree(registrar?.parsed))
+        : null;
     const registrarStatus = typeof reportedStatus === 'string' && REGISTRAR_RDAP_STATUSES.has(reportedStatus)
         ? (reportedStatus === 'success' && !parsed ? 'partial' : reportedStatus)
         : 'error';
@@ -369,17 +1042,25 @@ function registrarPublicationComparison(body, registryParsed) {
     });
 }
 export function buildLookupEvidence(response, options = {}) {
+    assertBoundedJsonStructure(response, 'Lookup response');
     const { generatedAt = new Date().toISOString(), idnAnalysis = null, applicationVersion = null } = options;
     const body = recordOrNull(response) || {};
     const rdap = recordOrNull(body.rdap);
     const whois = recordOrNull(body.whois);
     const diagnostics = recordOrNull(body.diagnostics);
-    const rdapDiagnostics = recordOrNull(diagnostics?.rdap);
-    const whoisDiagnostics = recordOrNull(diagnostics?.whois);
-    const rdapParsed = rdap && !rdap.error ? recordOrNull(rdap.parsed) : null;
-    const whoisParsed = whois && !whois.error ? recordOrNull(whois.parsed) : null;
-    const registrarRdap = recordOrNull(rdap?.registrarRdap);
-    const registrarRdapParsed = recordOrNull(registrarRdap?.parsed);
+    const projectedDiagnostics = lookupDiagnostics(diagnostics);
+    const rdapDiagnostics = recordOrNull(projectedDiagnostics.rdap);
+    const whoisDiagnostics = recordOrNull(projectedDiagnostics.whois);
+    const projectedRdap = rdapSource(rdap, rdapDiagnostics);
+    const projectedWhois = whoisSource(whois, whoisDiagnostics);
+    const projectedRdapRecord = recordOrNull(projectedRdap) || {};
+    const projectedWhoisRecord = recordOrNull(projectedWhois) || {};
+    const rdapParsed = ['success', 'partial'].includes(String(projectedRdapRecord.status))
+        ? recordOrNull(projectedRdapRecord.parsed)
+        : null;
+    const whoisParsed = ['complete', 'partial'].includes(String(projectedWhoisRecord.status))
+        ? recordOrNull(projectedWhoisRecord.parsed)
+        : null;
     // Rebuild the pure interpretation from bounded source fields instead of
     // trusting a supplied derived object. This adds no collection or network
     // work and lets saved or fast responses carry current source-health-aware
@@ -391,46 +1072,38 @@ export function buildLookupEvidence(response, options = {}) {
         whoisParsed,
         whoisStatus: whoisDiagnostics?.status,
         whoisQueriedAt: recordOrNull(Array.isArray(whois?.chain) ? whois.chain[0] : null)?.queriedAt,
-        registrarRdapParsed,
-        registrarRdapStatus: registrarRdap?.status ?? recordOrNull(rdapDiagnostics?.registrar)?.status,
-        registrarRdapFetchedAt: registrarRdap?.fetchedAt,
     });
-    return {
+    const query = projectLookupEvidenceQuery(body);
+    const availabilityAnalysis = projectLookupEvidenceAvailability(body.availability);
+    const idn = projectedKnownRecord(idnAnalysis, LOOKUP_IDN_ANALYSIS_KEYS);
+    const evidence = {
         schema: LOOKUP_EVIDENCE_SCHEMA,
         schemaVersion: LOOKUP_EVIDENCE_SCHEMA_VERSION,
         generatedAt,
-        application: {
-            name: 'WHOISleuth',
-            version: boundedSemanticVersion(applicationVersion),
-            projectUrl: WHOISLEUTH_SOURCE_REPOSITORY_URL,
-        },
-        query: {
-            submitted: body.query || null,
-            type: body.type || null,
-            inputHostname: body.inputHostname || null,
-            registrableDomain: body.registrableDomain || null,
-            isSubdomain: body.isSubdomain === true,
-        },
-        diagnostics: cloneJson(body.diagnostics),
+        application: buildPortableGeneratorMetadata(applicationVersion),
+        query,
+        diagnostics: projectedDiagnostics,
         sources: {
-            rdap: rdapSource(rdap),
-            whois: whoisSource(whois),
+            rdap: projectedRdap,
+            whois: projectedWhois,
             reverseDns: reverseDnsSource(body.reverseDns),
             network: networkSource(body.networkContext),
             securityTxt: securityTxtSource(body.securityTxt),
             sslbl: sslblSource(body.sslbl),
         },
         analysis: {
-            availability: cloneJson(body.availability),
-            idn: cloneJson(idnAnalysis),
-            registryInsights,
-            registryComparison: compareRegistrySources(rdapParsed, whoisParsed, {
+            availability: availabilityAnalysis,
+            idn,
+            registryInsights: projectLookupEvidencePrivacySafeTree(registryInsights),
+            registryComparison: projectLookupEvidencePrivacySafeTree(compareRegistrySources(rdapParsed, whoisParsed, {
                 rdapStatus: rdapDiagnostics?.status,
                 whoisStatus: whoisDiagnostics?.status,
-            }),
-            registrarPublicationComparison: registrarPublicationComparison(body, rdapParsed),
+            })),
+            registrarPublicationComparison: projectLookupEvidencePrivacySafeTree(registrarPublicationComparison(body, rdapParsed)),
         },
     };
+    assertLookupEvidencePortableTree(evidence);
+    return evidence;
 }
 export function evidenceFilename(response, now = Date.now()) {
     const record = recordOrNull(response);