@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/lib/bounded-file.mjs

@@ -1,12 +1,20 @@
 import { constants } from 'node:fs';
-import { open } from 'node:fs/promises';
+import { lstat, open, realpath } from 'node:fs/promises';
+import path from 'node:path';
 const MAX_BOUNDED_FILE_BYTES = 64 * 1024 * 1024;
 function boundedSize(value, fallback) {
     return Number.isSafeInteger(value) && Number(value) >= 0 && Number(value) <= MAX_BOUNDED_FILE_BYTES
         ? Number(value)
         : fallback;
 }
-export async function readBoundedRegularFile(filePath, options, dependencies = {}) {
+function throwIfAborted(signal) {
+    if (!signal?.aborted)
+        return;
+    throw signal.reason instanceof Error
+        ? signal.reason
+        : new DOMException('The operation was aborted.', 'AbortError');
+}
+async function readBoundedRegularFileIdentity(filePath, options, dependencies = {}) {
     const label = options.label?.trim().slice(0, 120) || 'Input file';
     const maximumBytes = boundedSize(options.maximumBytes, 0);
     const minimumBytes = boundedSize(options.minimumBytes, 0);
@@ -19,6 +27,7 @@ export async function readBoundedRegularFile(filePath, options, dependencies = {
     if (expectedBytes !== null && (expectedBytes < minimumBytes || expectedBytes > maximumBytes)) {
         throw new TypeError(`${label} expected size is outside its byte boundary.`);
     }
+    throwIfAborted(options.signal);
     // Non-blocking open prevents a named pipe from stalling the process before
     // the descriptor can be classified. Final-component symlinks remain denied
     // unless an analyst-facing input explicitly opts in; artefacts resolved
@@ -28,7 +37,9 @@ export async function readBoundedRegularFile(filePath, options, dependencies = {
         | (options.allowSymbolicLink ? 0 : constants.O_NOFOLLOW);
     const handle = await (dependencies.openFile ?? open)(filePath, flags);
     try {
+        throwIfAborted(options.signal);
         const before = await handle.stat();
+        throwIfAborted(options.signal);
         if (!before.isFile())
             throw new TypeError(`${label} must be a regular file.`);
         if (before.size < minimumBytes)
@@ -44,12 +55,15 @@ export async function readBoundedRegularFile(filePath, options, dependencies = {
         const storage = Buffer.allocUnsafe(Math.min(maximumBytes + 1, before.size + 1));
         let offset = 0;
         while (offset < storage.length) {
+            throwIfAborted(options.signal);
             const { bytesRead } = await handle.read(storage, offset, storage.length - offset, null);
             if (bytesRead === 0)
                 break;
             offset += bytesRead;
         }
+        throwIfAborted(options.signal);
         const after = await handle.stat();
+        throwIfAborted(options.signal);
         if (offset > maximumBytes
             || after.size !== before.size
             || offset !== after.size
@@ -57,13 +71,86 @@ export async function readBoundedRegularFile(filePath, options, dependencies = {
             || after.ctimeMs !== before.ctimeMs) {
             throw new TypeError(`${label} changed while it was being read.`);
         }
-        return Buffer.from(storage.subarray(0, offset));
+        return {
+            bytes: Buffer.from(storage.subarray(0, offset)),
+            device: before.dev,
+            inode: before.ino,
+        };
     }
     finally {
         await handle.close();
     }
 }
+export async function readBoundedRegularFile(filePath, options, dependencies = {}) {
+    return (await readBoundedRegularFileIdentity(filePath, options, dependencies)).bytes;
+}
+/**
+ * Decode admitted bytes without replacement-character normalisation.  The BOM
+ * is deliberately retained so re-encoding the returned string preserves the
+ * exact bytes used by artefact identity and manifest checks.
+ */
+export function decodeBoundedUtf8(bytes, label = 'Input') {
+    try {
+        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);
+    }
+    catch {
+        throw new TypeError(`${label.trim().slice(0, 120) || 'Input'} must contain valid UTF-8 text.`);
+    }
+}
 export async function readBoundedRegularTextFile(filePath, options, dependencies = {}) {
-    return (await readBoundedRegularFile(filePath, options, dependencies)).toString('utf8');
+    return decodeBoundedUtf8(await readBoundedRegularFile(filePath, options, dependencies), options.label);
+}
+function safeRelativeFilePath(value, label) {
+    if (!value || path.isAbsolute(value) || value.includes('\\')
+        || value.split('/').some((part) => !part || part === '.' || part === '..')) {
+        throw new TypeError(`${label} must be a safe relative file path.`);
+    }
+    return value;
+}
+/**
+ * Reads one regular file beneath a canonical root while rejecting final and
+ * intermediate symbolic links. The ordinary descriptor-level size/change
+ * checks still apply after path confinement is established.
+ */
+export async function readBoundedRegularFileWithin(rootDirectory, relativeFilePath, options, dependencies = {}) {
+    const label = options.label?.trim().slice(0, 120) || 'Input file';
+    const relativePath = safeRelativeFilePath(relativeFilePath, label);
+    const canonicalRoot = await realpath(rootDirectory);
+    const targetPath = path.resolve(canonicalRoot, relativePath);
+    const confined = path.relative(canonicalRoot, targetPath);
+    if (!confined || confined.startsWith(`..${path.sep}`) || confined === '..' || path.isAbsolute(confined)) {
+        throw new TypeError(`${label} escapes its configured root.`);
+    }
+    let cursor = canonicalRoot;
+    const components = relativePath.split('/');
+    let admittedDevice = -1;
+    let admittedInode = -1;
+    for (const [index, component] of components.entries()) {
+        cursor = path.join(cursor, component);
+        const metadata = await lstat(cursor);
+        if (metadata.isSymbolicLink())
+            throw new TypeError(`${label} must not traverse a symbolic link.`);
+        if (index === components.length - 1) {
+            admittedDevice = metadata.dev;
+            admittedInode = metadata.ino;
+        }
+    }
+    const canonicalTarget = await realpath(targetPath);
+    if (canonicalTarget !== targetPath)
+        throw new TypeError(`${label} must not traverse a symbolic link.`);
+    const identity = await readBoundedRegularFileIdentity(targetPath, {
+        ...options,
+        allowSymbolicLink: false,
+    }, dependencies);
+    const finalMetadata = await lstat(targetPath);
+    if (finalMetadata.isSymbolicLink()
+        || identity.device !== admittedDevice
+        || identity.inode !== admittedInode
+        || identity.device !== finalMetadata.dev
+        || identity.inode !== finalMetadata.ino
+        || await realpath(targetPath) !== canonicalTarget) {
+        throw new TypeError(`${label} changed while it was being read.`);
+    }
+    return identity.bytes;
 }
 export { MAX_BOUNDED_FILE_BYTES };

package/lib/bounded-json.mjs

@@ -0,0 +1,287 @@
+export const MAX_BOUNDED_JSON_DEPTH = 48;
+export const MAX_BOUNDED_JSON_KEYS = 50_000;
+export const MAX_BOUNDED_JSON_VALUES = 100_000;
+export const MAX_BOUNDED_JSON_CONTAINER_ITEMS = 10_000;
+export const UNSAFE_JSON_OBJECT_KEYS = Object.freeze(['__proto__']);
+function syntaxError() {
+    throw new TypeError('Artefact input is not valid JSON.');
+}
+export function isSafeJsonObjectKey(value) {
+    return !UNSAFE_JSON_OBJECT_KEYS.includes(value);
+}
+export function assertBoundedJsonStructure(value, label = 'JSON value', limits = {}) {
+    const maximumDepth = limits.maximumDepth ?? MAX_BOUNDED_JSON_DEPTH;
+    const maximumKeys = limits.maximumKeys ?? MAX_BOUNDED_JSON_KEYS;
+    const maximumValues = limits.maximumValues ?? MAX_BOUNDED_JSON_VALUES;
+    const maximumContainerItems = limits.maximumContainerItems ?? MAX_BOUNDED_JSON_CONTAINER_ITEMS;
+    let keys = 0;
+    let values = 0;
+    const ancestors = new Set();
+    const visit = (current, depth) => {
+        values += 1;
+        if (values > maximumValues) {
+            throw new TypeError(`${label} exceeds the ${maximumValues}-value limit.`);
+        }
+        if (depth > maximumDepth) {
+            throw new TypeError(`${label} exceeds the ${maximumDepth}-level nesting limit.`);
+        }
+        if (current === null || typeof current === 'string' || typeof current === 'boolean')
+            return;
+        if (typeof current === 'number') {
+            if (!Number.isFinite(current))
+                throw new TypeError(`${label} contains a non-JSON number.`);
+            return;
+        }
+        if (typeof current !== 'object')
+            throw new TypeError(`${label} contains a non-JSON value.`);
+        if (ancestors.has(current))
+            throw new TypeError(`${label} contains a cyclic object reference.`);
+        let prototype;
+        let ownKeys;
+        let descriptors;
+        try {
+            prototype = Object.getPrototypeOf(current);
+            ownKeys = Reflect.ownKeys(current);
+            descriptors = Object.getOwnPropertyDescriptors(current);
+        }
+        catch {
+            throw new TypeError(`${label} could not be inspected safely.`);
+        }
+        if (ownKeys.some((key) => typeof key !== 'string')) {
+            throw new TypeError(`${label} contains a symbol key.`);
+        }
+        if (ownKeys.some((key) => {
+            const descriptor = descriptors[String(key)];
+            return !descriptor || !Object.hasOwn(descriptor, 'value');
+        })) {
+            throw new TypeError(`${label} contains an accessor property.`);
+        }
+        ancestors.add(current);
+        if (Array.isArray(current)) {
+            if (prototype !== Array.prototype) {
+                throw new TypeError(`${label} contains an array with a custom prototype.`);
+            }
+            const length = descriptors.length?.value;
+            if (!Number.isSafeInteger(length) || length < 0 || length > maximumContainerItems) {
+                throw new TypeError(`${label} contains a container with more than ${maximumContainerItems} items.`);
+            }
+            const indexes = ownKeys.filter((key) => key !== 'length');
+            if (indexes.length !== length
+                || indexes.some((key, index) => key !== String(index) || descriptors[key]?.enumerable !== true)) {
+                throw new TypeError(`${label} contains a sparse, extended, or non-enumerable array.`);
+            }
+            for (const key of indexes)
+                visit(descriptors[key].value, depth + 1);
+        }
+        else {
+            if (prototype !== Object.prototype && prototype !== null) {
+                throw new TypeError(`${label} contains an object with a custom prototype.`);
+            }
+            const objectKeys = ownKeys;
+            if (objectKeys.length > maximumContainerItems) {
+                throw new TypeError(`${label} contains a container with more than ${maximumContainerItems} items.`);
+            }
+            if (objectKeys.some((key) => descriptors[key]?.enumerable !== true)) {
+                throw new TypeError(`${label} contains a non-enumerable object property.`);
+            }
+            keys += objectKeys.length;
+            if (keys > maximumKeys) {
+                throw new TypeError(`${label} exceeds the ${maximumKeys}-key limit.`);
+            }
+            for (const key of objectKeys) {
+                if (!isSafeJsonObjectKey(key))
+                    throw new TypeError(`${label} contains an unsafe object key.`);
+                visit(descriptors[key].value, depth + 1);
+            }
+        }
+        ancestors.delete(current);
+    };
+    visit(value, 0);
+}
+export function scanBoundedJson(raw, limits = {}) {
+    const maximumDepth = limits.maximumDepth ?? MAX_BOUNDED_JSON_DEPTH;
+    const maximumKeys = limits.maximumKeys ?? MAX_BOUNDED_JSON_KEYS;
+    const maximumValues = limits.maximumValues ?? MAX_BOUNDED_JSON_VALUES;
+    const maximumContainerItems = limits.maximumContainerItems ?? MAX_BOUNDED_JSON_CONTAINER_ITEMS;
+    let index = 0;
+    let keys = 0;
+    let values = 0;
+    const whitespace = () => {
+        while (index < raw.length && /[\t\n\r ]/u.test(raw[index]))
+            index += 1;
+    };
+    const stringToken = () => {
+        const start = index;
+        index += 1;
+        while (index < raw.length) {
+            const character = raw[index];
+            if (character === '"') {
+                index += 1;
+                try {
+                    return JSON.parse(raw.slice(start, index));
+                }
+                catch {
+                    syntaxError();
+                }
+            }
+            if (character === '\\') {
+                index += 1;
+                if (index >= raw.length)
+                    syntaxError();
+                if (raw[index] === 'u') {
+                    if (!/^[a-fA-F0-9]{4}$/u.test(raw.slice(index + 1, index + 5)))
+                        syntaxError();
+                    index += 5;
+                }
+                else {
+                    if (!/["\\/bfnrt]/u.test(raw[index]))
+                        syntaxError();
+                    index += 1;
+                }
+                continue;
+            }
+            if (character.charCodeAt(0) <= 0x1f)
+                syntaxError();
+            index += 1;
+        }
+        return syntaxError();
+    };
+    const literal = (token) => {
+        if (raw.slice(index, index + token.length) !== token)
+            syntaxError();
+        index += token.length;
+    };
+    const number = () => {
+        const match = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/u.exec(raw.slice(index));
+        if (!match)
+            syntaxError();
+        if (!Number.isFinite(Number(match[0]))) {
+            throw new TypeError('Artefact JSON contains a non-finite number.');
+        }
+        index += match[0].length;
+    };
+    const value = (depth) => {
+        values += 1;
+        if (values > maximumValues) {
+            throw new TypeError(`Artefact JSON exceeds the ${maximumValues}-value limit.`);
+        }
+        if (depth > maximumDepth) {
+            throw new TypeError(`Artefact JSON exceeds the ${maximumDepth}-level nesting limit.`);
+        }
+        whitespace();
+        const character = raw[index];
+        if (character === '"') {
+            stringToken();
+            return;
+        }
+        if (character === '{') {
+            index += 1;
+            whitespace();
+            const seen = new Set();
+            if (raw[index] === '}') {
+                index += 1;
+                return;
+            }
+            while (index < raw.length) {
+                if (raw[index] !== '"')
+                    syntaxError();
+                const key = stringToken();
+                if (seen.size >= maximumContainerItems) {
+                    throw new TypeError(`Artefact JSON contains a container with more than ${maximumContainerItems} items.`);
+                }
+                keys += 1;
+                if (keys > maximumKeys) {
+                    throw new TypeError(`Artefact JSON exceeds the ${maximumKeys}-key limit.`);
+                }
+                if (seen.has(key))
+                    throw new TypeError('Artefact JSON contains a duplicate object key.');
+                if (!isSafeJsonObjectKey(key))
+                    throw new TypeError('Artefact JSON contains an unsafe object key.');
+                seen.add(key);
+                whitespace();
+                if (raw[index] !== ':')
+                    syntaxError();
+                index += 1;
+                value(depth + 1);
+                whitespace();
+                if (raw[index] === '}') {
+                    index += 1;
+                    return;
+                }
+                if (raw[index] !== ',')
+                    syntaxError();
+                index += 1;
+                whitespace();
+            }
+            syntaxError();
+        }
+        if (character === '[') {
+            index += 1;
+            whitespace();
+            if (raw[index] === ']') {
+                index += 1;
+                return;
+            }
+            let items = 0;
+            while (index < raw.length) {
+                items += 1;
+                if (items > maximumContainerItems) {
+                    throw new TypeError(`Artefact JSON contains a container with more than ${maximumContainerItems} items.`);
+                }
+                value(depth + 1);
+                whitespace();
+                if (raw[index] === ']') {
+                    index += 1;
+                    return;
+                }
+                if (raw[index] !== ',')
+                    syntaxError();
+                index += 1;
+                whitespace();
+            }
+            syntaxError();
+        }
+        if (character === 't') {
+            literal('true');
+            return;
+        }
+        if (character === 'f') {
+            literal('false');
+            return;
+        }
+        if (character === 'n') {
+            literal('null');
+            return;
+        }
+        number();
+    };
+    whitespace();
+    value(0);
+    whitespace();
+    if (index !== raw.length)
+        syntaxError();
+}
+export function parseBoundedJson(raw, options) {
+    const label = options.label ?? 'Artefact input';
+    if (typeof raw !== 'string')
+        throw new TypeError(`${label} must be UTF-8 JSON text.`);
+    const bytes = new TextEncoder().encode(raw).byteLength;
+    if (bytes < 1 || bytes > options.maximumBytes) {
+        throw new TypeError(`${label} must be between 1 byte and ${options.maximumBytes} bytes.`);
+    }
+    scanBoundedJson(raw, options.limits);
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return syntaxError();
+    }
+}
+export function parseBoundedJsonObject(raw, options) {
+    const label = options.label ?? 'Artefact input';
+    const parsed = parseBoundedJson(raw, options);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new TypeError(`${label} must contain one JSON object.`);
+    }
+    return parsed;
+}

package/lib/browser-library-profile.mjs

@@ -7,7 +7,7 @@ import { createHash } from 'node:crypto';
 import { Worker } from 'node:worker_threads';
 import { RETIRE_BROWSER_CATALOG } from "./generated/retire-browser-catalog.mjs";
 import { CISA_KEV_CATALOG } from "./generated/cisa-kev-catalog.mjs";
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_STATIC_HTML_CHARS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 // Catalogue expressions are reviewed third-party inputs. Keep every individual
 // regular-expression evaluation and the aggregate inline-signature work small

package/lib/certificate-extension-profile.mjs

@@ -3,7 +3,8 @@
 // retained; malformed extensions fail soft and leave an explicit partial flag.
 import 'reflect-metadata';
 import { CertificatePolicyExtension, CRLDistributionPointsExtension, X509Certificate, } from '@peculiar/x509';
-export const MAX_CERTIFICATE_POLICIES = 16;
+import { MAX_LOOKUP_TLS_CERTIFICATE_POLICIES } from "./lookup-network-evidence-bounds.mjs";
+export const MAX_CERTIFICATE_POLICIES = MAX_LOOKUP_TLS_CERTIFICATE_POLICIES;
 export const MAX_CRL_DISTRIBUTION_POINTS = 32;
 function emptyProfile(partial = false) {
     return Object.freeze({

package/lib/classify.mjs

@@ -14,7 +14,9 @@
 // original input hostname and the resolved registrable domain are returned so
 // callers can look up the latter while still showing the user what they typed.
 import { isIP } from 'node:net';
+import { domainToASCII } from 'node:url';
 import { parse } from 'tldts';
+import { canonicalRegistrableDomain } from "./registrable-domain.mjs";
 // A CR/LF here would let one query become multiple lines once it reaches
 // lib/whois.mts's raw `socket.write(query + '\r\n')` - a normal URL-encoded
 // query string (?q=example.com%0D%0AHELP) decodes back into literal control
@@ -24,6 +26,9 @@ const CONTROL_CHAR_RE = /[\x00-\x1f\x7f]/;
 // 32-bit ASN ceiling (RFC 6793 four-octet ASNs). AS0 and AS4294967295 are
 // reserved but syntactically valid; anything above is not an ASN at all.
 const MAX_ASN = 4294967295;
+const MAX_DIRECT_LOOKUP_TARGET_LENGTH = 1024;
+const DIRECT_LOOKUP_RESERVED_SUFFIXES = new Set(['example', 'test']);
+const DIRECT_LOOKUP_EXCLUDED_PUBLIC_SUFFIXES = new Set(['onion']);
 // A registrable-domain label: LDH (letter/digit/hyphen), 1-63 characters, no
 // leading or trailing hyphen. tldts already rejects empty labels, over-long
 // labels, leading/trailing hyphens, and public-suffix-only inputs (all yield
@@ -33,6 +38,52 @@ const MAX_ASN = 4294967295;
 function isValidRegistrableLabel(label) {
     return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(label);
 }
+// Direct CLI shorthand is deliberately narrower than normal query
+// classification. classifyQuery() accepts pasted URLs and other convenient
+// input forms after normalisation, while a value occupying command position
+// must be unambiguously a target before it may select the networked Lookup
+// command. This predicate therefore accepts only a complete hostname, literal
+// IP address, or bounded ASN and never attempts to repair URL-like input.
+function isDirectLookupTarget(raw) {
+    if (typeof raw !== 'string'
+        || !raw
+        || raw.length > MAX_DIRECT_LOOKUP_TARGET_LENGTH
+        || raw.startsWith('-')
+        || raw.trim() !== raw
+        || /\s/u.test(raw)
+        || CONTROL_CHAR_RE.test(raw)) {
+        return false;
+    }
+    if (isIP(raw) !== 0)
+        return !raw.includes('%') && !raw.startsWith('[');
+    const asnMatch = raw.match(/^(?:AS)?(\d+)$/i);
+    if (asnMatch) {
+        const number = Number(asnMatch[1]);
+        return Number.isInteger(number) && number >= 0 && number <= MAX_ASN;
+    }
+    if (/[\\/@:?#%\[\]]/u.test(raw) || raw.endsWith('..'))
+        return false;
+    const hostname = raw.endsWith('.') ? raw.slice(0, -1) : raw;
+    if (!hostname.includes('.'))
+        return false;
+    const ascii = domainToASCII(hostname).toLowerCase();
+    if (!ascii || ascii.length > 253 || !ascii.split('.').every(isValidRegistrableLabel))
+        return false;
+    const parsed = parse(ascii);
+    const publicSuffix = parsed.publicSuffix || '';
+    if (DIRECT_LOOKUP_EXCLUDED_PUBLIC_SUFFIXES.has(publicSuffix)
+        || publicSuffix === 'arpa'
+        || publicSuffix.endsWith('.arpa'))
+        return false;
+    if (parsed.isIcann !== true && !DIRECT_LOOKUP_RESERVED_SUFFIXES.has(publicSuffix))
+        return false;
+    try {
+        return classifyQuery(raw).type === 'domain';
+    }
+    catch {
+        return false;
+    }
+}
 function classifyQuery(raw) {
     const trimmed = raw.trim();
     if (CONTROL_CHAR_RE.test(trimmed)) {
@@ -75,13 +126,13 @@ function classifyQuery(raw) {
     if (!inputHostname || !inputHostname.includes('.') || inputHostname.length > 253) {
         throw new Error(`"${trimmed}" is not a valid domain, IP, or ASN.`);
     }
-    const registrableDomain = parse(inputHostname).domain;
+    if (!inputHostname.split('.').every(isValidRegistrableLabel)) {
+        throw new Error(`"${trimmed}" contains an invalid domain label (underscores, empty, or malformed labels are not registrable).`);
+    }
+    const registrableDomain = canonicalRegistrableDomain(inputHostname);
     if (!registrableDomain) {
         throw new Error(`"${trimmed}" is not a registrable domain (no public-suffix match).`);
     }
-    if (!registrableDomain.split('.').every(isValidRegistrableLabel)) {
-        throw new Error(`"${trimmed}" contains an invalid domain label (underscores, empty, or malformed labels are not registrable).`);
-    }
     return {
         type: 'domain',
         value: registrableDomain,
@@ -90,4 +141,4 @@ function classifyQuery(raw) {
         isSubdomain: inputHostname !== registrableDomain,
     };
 }
-export { classifyQuery, MAX_ASN };
+export { classifyQuery, isDirectLookupTarget, MAX_ASN };

package/lib/client-behavior-profile.mjs

@@ -2,7 +2,7 @@
 // HTML tokenizer pass. Scripts are never fetched or executed. Only fixed
 // indicator identifiers, descriptions, evidence classes, and bounded counts
 // leave this module; script references and contents are discarded.
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 import { analyzeStaticHtml, } from "./static-html-analysis.mjs";
 const CLIENT_BEHAVIOR_PROFILE_VERSION = 1;
 const MAX_CLIENT_BEHAVIOR_INDICATORS = 12;

package/lib/credential-surface-profile.mjs

@@ -3,7 +3,7 @@
 // shared tokenizer projects only fixed categories and bounded counts; field
 // names, values, labels, placeholders, arbitrary attributes, and action URLs
 // never enter this profile.
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_STATIC_FORMS, MAX_STATIC_INPUTS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 const CREDENTIAL_SURFACE_PROFILE_VERSION = 1;
 function analyzeCredentialSurfaceProfile(input = {}) {