@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/lib/evidence-export.mjs

@@ -1,25 +1,576 @@
 import { compareRdapPublications, compareRegistrySources } from "./registry-comparison.mjs";
 import { buildRegistryInsights } from "./registry-insights.mjs";
-import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "./project-metadata.mjs";
-import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
+import { buildPortableGeneratorMetadata, isUriShapedLabel } from "./portable-generator.mjs";
+import { assertBoundedJsonStructure, isSafeJsonObjectKey } from "./bounded-json.mjs";
+import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "./homepage-metadata-contract.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
+import { defineSchemaCompatibility } from "../packages/contracts/schema-compatibility.mjs";
+import { isValidAsciiHostname } from "./hostname.mjs";
 export const LOOKUP_EVIDENCE_SCHEMA = 'whoisleuth.lookup-evidence';
-export const LOOKUP_EVIDENCE_SCHEMA_VERSION = 25;
+export const PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION = 26;
+export const LOOKUP_EVIDENCE_SCHEMA_VERSION = 27;
+export const SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS = Object.freeze([
+    PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION,
+    LOOKUP_EVIDENCE_SCHEMA_VERSION,
+]);
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES = 5 * 1024 * 1024;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_ENTRIES = 20_000;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_DEPTH = 24;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS = 10_000;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_KEY_LENGTH = 256;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_STRING_LENGTH = 1024 * 1024;
+export const LOOKUP_EVIDENCE_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.lookup-evidence',
+    kind: 'export',
+    schema: LOOKUP_EVIDENCE_SCHEMA,
+    currentVersion: LOOKUP_EVIDENCE_SCHEMA_VERSION,
+    supportedVersions: SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS,
+    acceptsUnversionedLegacy: false,
+    futureVersionBehavior: 'reject',
+    migration: 'read_only',
+    writeSemantics: 'read_only',
+    byteBudget: LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES,
+    owner: 'lib/evidence-export.mts',
+    note: 'Exact v1.47.4 version 26 remains replayable; version 27 is the single v2 successor with bounded homepage and privacy-minimised registration projections.',
+});
 const REGISTRAR_RDAP_STATUSES = new Set([
     'success', 'partial', 'error', 'unsupported', 'not_found', 'skipped', 'disabled',
 ]);
+const LOOKUP_QUERY_TYPES = new Set(['domain', 'ipv4', 'ipv6', 'asn']);
+const RDAP_SOURCE_STATUSES = new Set([
+    'success', 'partial', 'error', 'unsupported', 'not_found', 'skipped', 'disabled',
+]);
+const WHOIS_SOURCE_STATUSES = new Set([
+    'complete', 'partial', 'error', 'unsupported', 'not_found', 'skipped', 'disabled',
+]);
+const AVAILABILITY_DIAGNOSTIC_STATUSES = new Set(['complete', 'error', 'disabled', 'not_applicable']);
 const NETWORK_CONTEXT_STATUSES = new Set(['success', 'partial', 'not_found', 'unsupported', 'error']);
 const NETWORK_ADDRESS_SOURCES = new Set(['tls_connection', 'dns_a', 'dns_aaaa']);
 const REVERSE_DNS_STATUSES = new Set(['success', 'partial', 'not_found', 'unsupported', 'skipped', 'error']);
 const SECURITY_TXT_STATES = new Set(['present', 'stale', 'partial', 'absent', 'malformed', 'unsupported', 'unavailable']);
 const SSLBL_STATES = new Set(['success', 'stale', 'unavailable']);
 const SSLBL_VERDICTS = new Set(['listed', 'not_listed', 'inconclusive']);
+const RDAP_ATTEMPT_OUTCOMES = new Set([
+    'success', 'not_found', 'no_results', 'unsupported', 'rate_limited',
+    'server_error', 'client_error', 'invalid_json', 'invalid_response',
+    'timeout', 'network_error',
+]);
+const WHOIS_QUERY_PROFILES = new Set([
+    'plain-domain', 'denic-domain-ace', 'jprs-domain-english',
+    'registry-domain-unicode', 'not-issued',
+]);
+const LOOKUP_TIMING_SOURCES = new Set([
+    'rdap', 'whois', 'domain_evidence', 'reverse_dns', 'registrar_rdap',
+    'network_context', 'security_txt', 'external_intelligence',
+    'malware_host_intelligence', 'malware_ioc_intelligence',
+]);
+const PUBLIC_LOOKUP_AVAILABILITY_ANALYSIS_KEYS = new Set([
+    'applicable', 'type', 'domain', 'state', 'confidence', 'detail', 'source',
+    'rdapServer', 'nameservers', 'statuses', 'registrar', 'registrant', 'abuse',
+    'createdDate', 'expiryDate', 'createdDateIso', 'expiryDateIso', 'domainAgeDays',
+    'expiresInDays', 'privacyProtected', 'dnssec', 'activityStatus',
+    'websiteProbeStatus', 'websiteProbeDetail', 'http', 'deepScanComplete',
+    'faviconHash', 'faviconPHash', 'pageTitle', 'hasPasswordField',
+    'phishingLanguageMatch', 'hasExternalFormAction', 'externalAssetHosts',
+    'pageIdentity', 'credentialSurfaceProfile', 'structuredDataIdentity',
+    'technologyProfile', 'pageRoleProfile', 'clientBehaviorProfile',
+    'securityPosture', 'dns', 'tls', 'hasMx', 'hasNullMx', 'mxHosts', 'hasSpf',
+    'hasDmarc', 'bulkComparison', 'limitations',
+]);
+const LOOKUP_AVAILABILITY_ANALYSIS_KEYS = new Set([
+    ...[...PUBLIC_LOOKUP_AVAILABILITY_ANALYSIS_KEYS]
+        .filter((key) => !['registrar', 'registrant', 'abuse'].includes(key)),
+    'registryContactsExcluded',
+]);
+const LOOKUP_IDN_ANALYSIS_KEYS = new Set([
+    'version', 'mappingVersion', 'asciiDomain', 'unicodeDomain', 'hasIdn',
+    'scripts', 'labels', 'mixedScript', 'skeleton', 'referenceMatches', 'findings',
+    'truncated', 'limitations',
+]);
+const PRIVATE_EVIDENCE_KEYS = new Set([
+    'authorization', 'proxyauthorization', 'cookie', 'cookies', 'setcookie',
+    'session', 'sessionid', 'sessiontoken', 'token', 'accesstoken', 'refreshtoken',
+    'apikey', 'password', 'secret', 'credentials', 'requestheaders', 'responseheaders',
+    'headers', 'rawbody', 'responsebody',
+]);
+const SAFE_EVIDENCE_KEYS = new Set([
+    'credentialsurfaceprofile', 'credentialsurfaceversion', 'haspasswordfield', 'tokencount',
+]);
+const PORTABLE_URL_KEYS = new Set([
+    'endpoint', 'url', 'uri', 'href', 'rdapserver', 'finalurl', 'requestedurl',
+    'requesturl', 'officiallookupurl', 'declaredorigin', 'actionurl', 'from', 'to',
+]);
+const PORTABLE_ORIGIN_COLLECTION_KEYS = new Set([
+    'embeddedorigins', 'externalactionorigins', 'externalorigins',
+]);
+// Availability is assembled from a finite set of versioned, bounded analysis
+// models. Portable exports retain only their declared output vocabulary rather
+// than recursively copying arbitrary browser-local extensions. This set is
+// intentionally exact and case-sensitive; new model fields must be reviewed at
+// this privacy boundary before they can enter a portable artefact.
+const LOOKUP_AVAILABILITY_PORTABLE_NESTED_KEYS = new Set([
+    // Shared observation and summary fields.
+    'version', 'profileVersion', 'status', 'state', 'source', 'observedAt',
+    'scanMode', 'durationMs', 'complete', 'truncated', 'limitations',
+    'diagnostics', 'detail', 'error', 'count', 'total', 'discarded', 'summary',
+    'findings', 'id', 'label', 'tone', 'category', 'confidence', 'evidence',
+    'value', 'values', 'name', 'type', 'types', 'mode', 'owner', 'target',
+    'url', 'uri', 'href',
+    'priority', 'ttl', 'records',
+    // HTTP observation and retained response metadata.
+    'requestUrl', 'finalUrl', 'transportSecurity', 'redirectCount',
+    'redirectLimitReached', 'redirects', 'crossOriginRedirect', 'httpsDowngrade',
+    'attempts', 'response', 'contentType', 'contentLanguage', 'server',
+    'declaredContentLength', 'capturedBodyBytes', 'bodyInspected', 'bodyTruncated',
+    'bodyHash', 'securityHeaders', 'strictTransportSecurity',
+    'contentSecurityPolicy', 'xFrameOptions', 'xContentTypeOptions',
+    'referrerPolicy', 'algorithm', 'scope', 'bytes', 'from', 'to',
+    'queryOmitted', 'pathTruncated', 'outcome', 'httpStatus', 'attemptCount',
+    // DNS observation, effective CAA, and HTTPS/SVCB parameter summaries.
+    'a', 'aaaa', 'caa', 'cname', 'dmarc', 'https', 'mx', 'ns', 'ptr', 'soa',
+    'spf', 'delegation', 'caaPolicy', 'policyVersion', 'queryLimit',
+    'queriedOwners', 'effectiveOwner', 'inherited', 'tree', 'registryEvidence',
+    'exchange', 'nsname', 'hostmaster', 'serial', 'refresh', 'retry', 'expire', 'minttl',
+    'tag', 'critical', 'parameters', 'parametersIgnored', 'mandatory', 'alpn',
+    'noDefaultAlpn', 'port', 'ipv4hint', 'ipv6hint', 'opaque', 'key', 'length',
+    'unknownKeys', 'unsupportedMandatoryKeys', 'targetIsOwner',
+    'serviceUnavailable', 'compatible', 'effectiveOwner', 'queriedOwners',
+    // TLS profile, certificate, extension, and connection summaries. Runtime
+    // authorisation objects are deliberately absent from this portable set.
+    'connectedAddress', 'connectedFamily', 'sniHost', 'protocol', 'alpnProtocol',
+    'cipher', 'ephemeralKey', 'hostname', 'matches', 'validity', 'certificate',
+    'chain', 'chainTruncated', 'standardName', 'size', 'subject', 'issuer',
+    'serialNumber', 'validFrom', 'validTo', 'fingerprintSha1',
+    'fingerprintSha256', 'isCertificateAuthority', 'subjectAltNames',
+    'dnsNames', 'ipAddresses', 'otherNames', 'publicKey', 'bits', 'curve',
+    'signature', 'oid', 'extendedKeyUsage', 'authorityInformationAccess',
+    'ocsp', 'caIssuers', 'unknownMethods', 'extensionProfile', 'parsed', 'partial',
+    'certificatePolicies', 'crlDistributionPoints', 'commonNames',
+    'organizations', 'organizationalUnits', 'countries', 'localities', 'states',
+    'connectionAttempts', 'resolvedAddressCount', 'discardedFields',
+    // Page identity, relationships, and bounded fingerprints.
+    'identityVersion', 'documentLanguage', 'canonical', 'metaRefresh',
+    'openGraph', 'title', 'siteName', 'generator', 'forms', 'postCount',
+    'insecureActionCount', 'externalActionOrigins', 'resources', 'byType',
+    'image', 'script', 'stylesheet', 'link', 'frame', 'media', 'object',
+    'externalOrigins', 'embeddedOrigins', 'contactDomains', 'downloads',
+    'explicitCount', 'riskyCount', 'riskyFileTypes', 'trackingIdentifiers',
+    'fingerprints', 'fingerprintVersion', 'exact', 'normalizedHtml',
+    'visibleText', 'domStructure', 'formStructure', 'resourceHosts',
+    'identifiers', 'featureCount', 'nodeCount', 'formCount', 'controlCount',
+    'parser', 'tokenCount', 'tagsExamined', 'discardedUrls', 'formsObserved',
+    'relationshipTagsExamined', 'relationshipUrlsDiscarded',
+    'trackingIdentifiersTruncated',
+    // Credential, structured identity, role, behaviour, technology, and posture
+    // projections. Only fixed categories/counts and bounded descriptions enter.
+    'credentialSurfaceVersion', 'methods', 'actions', 'missing', 'get', 'post',
+    'dialog', 'other', 'sameOrigin', 'external', 'cleartext', 'unclassified',
+    'inputs', 'classifiedCount', 'categories', 'password', 'email', 'username',
+    'one_time_code', 'payment', 'inputsObserved', 'classifiedInputs',
+    'unclassifiedActions', 'structuredDataVersion', 'scriptsObserved',
+    'scriptsExamined', 'charactersExamined', 'documentsParsed', 'malformedScripts',
+    'externalScriptsSkipped', 'objectsExamined', 'arrayItemsExamined',
+    'discardedProperties', 'entities', 'declaredOrigin', 'sameAsHosts',
+    'pageRoleProfileVersion', 'primaryRole', 'role', 'rolesObserved',
+    'clientBehaviorProfileVersion', 'scriptSummary', 'elementsObserved',
+    'referencedScripts', 'inlineScripts', 'moduleScripts', 'indicators',
+    'evidenceClass', 'occurrences', 'explanation', 'indicatorsObserved',
+    'scriptElementsExamined', 'inlineCharactersExamined', 'technologyProfile',
+    'browserLibraryProfile', 'catalog', 'knownExploitedCatalog', 'releasedAt',
+    'sourceRevision', 'apparentVersion', 'detectionMethods', 'advisoryCount',
+    'highestSeverity', 'advisoryIdentifiers', 'knownExploitedCount',
+    'knownExploitedIdentifiers', 'weaknessClasses', 'htmlEvaluated',
+    'generatorEvaluated', 'serverEvaluated', 'resourceOriginsEvaluated',
+    'passiveHeadersEvaluated', 'tagLimitReached', 'referencesExamined',
+    'inlineScriptsExamined', 'inlineSignatureCharactersExamined',
+    'inlineSignatureTimedOut', 'inlineSignatureUnavailable', 'catalogComponents',
+    'advisoryMatches', 'knownExploitedMatches', 'postureVersion',
+    'potentialExposure', 'observedAbsence', 'unavailable',
+    // Bounded cross-row comparison evidence.
+    'bulkComparison', 'technology', 'tls', 'ids', 'issuerLabel', 'spkiSha256',
+]);
+const LOOKUP_AVAILABILITY_CREDENTIAL_CATEGORY_KEYS = new Set([
+    'password', 'email', 'username', 'one_time_code', 'payment',
+]);
+const LOOKUP_AVAILABILITY_VALUE_PATHS = new Set([
+    'dns.records.caa',
+    'dns.caaPolicy.records',
+    'http.response.bodyHash',
+    'pageIdentity.trackingIdentifiers',
+    'pageIdentity.fingerprints.exact',
+    'pageIdentity.fingerprints.normalizedHtml',
+    'pageIdentity.fingerprints.visibleText',
+    'pageIdentity.fingerprints.domStructure',
+    'pageIdentity.fingerprints.domStructure.similarity',
+    'pageIdentity.fingerprints.formStructure',
+    'pageIdentity.fingerprints.resourceHosts',
+    'pageIdentity.fingerprints.identifiers',
+    'pageIdentity.fingerprints.identifiers.values',
+]);
+const LOOKUP_AVAILABILITY_OWNER_PATHS = new Set([
+    'dns.records.https',
+    'dns.caaPolicy.queriedOwners',
+]);
 function recordOrNull(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
-function cloneJson(value) {
-    if (value === undefined)
+function normalizedEvidenceKey(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]/gu, '');
+}
+function privateEvidenceKey(value, item) {
+    const normalized = normalizedEvidenceKey(value);
+    if (SAFE_EVIDENCE_KEYS.has(normalized))
+        return false;
+    if (normalized === 'password' && (typeof item === 'number' || typeof item === 'boolean'))
+        return false;
+    return PRIVATE_EVIDENCE_KEYS.has(normalized)
+        || normalized.includes('authorization')
+        || normalized.includes('authheader')
+        || normalized.includes('cookie')
+        || normalized.includes('apikey')
+        || normalized.includes('secret')
+        || normalized.includes('sessionkey')
+        || normalized.includes('passwordvalue')
+        || normalized.endsWith('password')
+        || /(?:access|auth|bearer|csrf|refresh|session)token$/u.test(normalized)
+        || /(?:request|response|authorization|proxy)headers?$/u.test(normalized)
+        || (normalized.includes('credential') && !normalized.startsWith('credentialsurface'));
+}
+function portableUri(value) {
+    const text = boundedString(value, 2048);
+    if (!text)
         return null;
-    return JSON.parse(JSON.stringify(value));
+    try {
+        const url = new URL(text);
+        if (!['http:', 'https:', 'mailto:', 'tel:', 'dns:', 'openpgp4fpr:'].includes(url.protocol)
+            || url.username
+            || url.password)
+            return null;
+        if (url.protocol === 'http:' || url.protocol === 'https:') {
+            url.search = '';
+            url.hash = '';
+        }
+        return url.toString().slice(0, 2048);
+    }
+    catch {
+        return null;
+    }
+}
+function portableOrigin(value) {
+    const text = boundedString(value, 2048);
+    if (!text)
+        return null;
+    try {
+        const url = new URL(text);
+        return ['http:', 'https:'].includes(url.protocol) && !url.username && !url.password
+            ? url.origin
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function consumePortableProjectionEntry(state, depth) {
+    state.entries += 1;
+    if (state.entries > LOOKUP_EVIDENCE_PORTABLE_MAX_ENTRIES) {
+        throw new TypeError(`Lookup evidence projection exceeds the ${LOOKUP_EVIDENCE_PORTABLE_MAX_ENTRIES.toLocaleString('en')}-entry portable limit.`);
+    }
+    if (depth > LOOKUP_EVIDENCE_PORTABLE_MAX_DEPTH) {
+        throw new TypeError(`Lookup evidence projection exceeds the ${LOOKUP_EVIDENCE_PORTABLE_MAX_DEPTH}-level portable nesting limit.`);
+    }
+}
+function projectPortableString(value) {
+    const sanitized = value.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/gu, ' ');
+    return sanitized.length <= LOOKUP_EVIDENCE_PORTABLE_MAX_STRING_LENGTH
+        ? sanitized
+        : sanitized.slice(0, LOOKUP_EVIDENCE_PORTABLE_MAX_STRING_LENGTH);
+}
+function projectLookupEvidenceAvailabilityString(value) {
+    const sanitized = projectPortableString(value)
+        .replace(/[\u0080-\u009f]/gu, ' ')
+        .replace(/\p{Default_Ignorable_Code_Point}/gu, '');
+    return isUriShapedLabel(value) ? null : sanitized;
+}
+function projectLookupEvidencePrivacySafeTreeValue(value, state, depth) {
+    consumePortableProjectionEntry(state, depth);
+    if (value === null || typeof value === 'boolean' || typeof value === 'number')
+        return value;
+    if (typeof value === 'string')
+        return projectPortableString(value);
+    if (Array.isArray(value)) {
+        return value.slice(0, LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS)
+            .map((item) => projectLookupEvidencePrivacySafeTreeValue(item, state, depth + 1));
+    }
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const output = {};
+    for (const [key, item] of Object.entries(source).slice(0, LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS)) {
+        if (!isSafeJsonObjectKey(key))
+            throw new TypeError('Lookup evidence projection contains an unsafe object key.');
+        const normalized = normalizedEvidenceKey(key);
+        if (privateEvidenceKey(normalized, item))
+            continue;
+        if (typeof item === 'string' && PORTABLE_URL_KEYS.has(normalized)) {
+            consumePortableProjectionEntry(state, depth + 1);
+            output[key] = portableUri(item);
+            continue;
+        }
+        output[key] = projectLookupEvidencePrivacySafeTreeValue(item, state, depth + 1);
+    }
+    return output;
+}
+export function projectLookupEvidencePrivacySafeTree(value) {
+    return projectLookupEvidencePrivacySafeTreeValue(value, { entries: 0 }, 0);
+}
+function projectLookupEvidenceAvailabilityPublicValue(value, parentKey, state, depth) {
+    consumePortableProjectionEntry(state, depth);
+    if (value === null || typeof value === 'boolean' || typeof value === 'number')
+        return value;
+    if (typeof value === 'string') {
+        const normalizedParent = normalizedEvidenceKey(parentKey || '');
+        if (PORTABLE_URL_KEYS.has(normalizedParent))
+            return portableUri(value);
+        if (PORTABLE_ORIGIN_COLLECTION_KEYS.has(normalizedParent))
+            return portableOrigin(value);
+        return projectPortableString(value);
+    }
+    if (Array.isArray(value)) {
+        return value.slice(0, LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS)
+            .map((item) => projectLookupEvidenceAvailabilityPublicValue(item, parentKey, state, depth + 1));
+    }
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const output = {};
+    for (const [key, item] of Object.entries(source).slice(0, LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS)) {
+        if (!LOOKUP_AVAILABILITY_PORTABLE_NESTED_KEYS.has(key)
+            || privateEvidenceKey(key, item))
+            continue;
+        output[key] = projectLookupEvidenceAvailabilityPublicValue(item, key, state, depth + 1);
+    }
+    return output;
+}
+function projectLookupEvidenceAvailabilityValue(value, path, state, depth) {
+    consumePortableProjectionEntry(state, depth);
+    if (value === null || typeof value === 'boolean' || typeof value === 'number')
+        return value;
+    if (typeof value === 'string') {
+        const normalizedParent = normalizedEvidenceKey(path.at(-1) || '');
+        if (PORTABLE_URL_KEYS.has(normalizedParent))
+            return portableUri(value);
+        if (PORTABLE_ORIGIN_COLLECTION_KEYS.has(normalizedParent))
+            return portableOrigin(value);
+        return projectLookupEvidenceAvailabilityString(value);
+    }
+    if (Array.isArray(value)) {
+        return value.slice(0, LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS)
+            .map((item) => projectLookupEvidenceAvailabilityValue(item, path, state, depth + 1));
+    }
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const output = {};
+    for (const [key, item] of Object.entries(source).slice(0, LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS)) {
+        if (!LOOKUP_AVAILABILITY_PORTABLE_NESTED_KEYS.has(key)
+            || privateEvidenceKey(key, item))
+            continue;
+        const parentPath = path.join('.');
+        if (LOOKUP_AVAILABILITY_CREDENTIAL_CATEGORY_KEYS.has(key)
+            && (parentPath !== 'credentialSurfaceProfile.inputs.categories'
+                || !Number.isSafeInteger(item)
+                || Number(item) < 0
+                || Number(item) > LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS))
+            continue;
+        if (key === 'owner'
+            && (!LOOKUP_AVAILABILITY_OWNER_PATHS.has(parentPath) || typeof item !== 'string'))
+            continue;
+        if (key === 'value'
+            && (!LOOKUP_AVAILABILITY_VALUE_PATHS.has(parentPath)
+                || (item !== null && typeof item !== 'string')))
+            continue;
+        output[key] = projectLookupEvidenceAvailabilityValue(item, [...path, key], state, depth + 1);
+    }
+    return output;
+}
+/**
+ * Canonical portable projection for the bounded Lookup availability models.
+ * The root and every nested record are positive allowlists, so an imported
+ * extension cannot become authenticated evidence merely by avoiding a
+ * credential-key denylist.
+ */
+function projectLookupEvidenceAvailabilityWithKeys(value, rootKeys, registryContactsExcluded, currentPrivacyRules) {
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const state = { entries: 0 };
+    consumePortableProjectionEntry(state, 0);
+    const output = {};
+    for (const key of rootKeys) {
+        if (!Object.hasOwn(source, key))
+            continue;
+        const item = source[key];
+        if (privateEvidenceKey(key, item))
+            continue;
+        output[key] = currentPrivacyRules
+            ? projectLookupEvidenceAvailabilityValue(item, [key], state, 1)
+            : projectLookupEvidenceAvailabilityPublicValue(item, key, state, 1);
+    }
+    if (registryContactsExcluded)
+        output.registryContactsExcluded = true;
+    const pageIdentity = recordOrNull(source.pageIdentity);
+    const publicationMetadata = pageIdentity?.publicationMetadata;
+    if (publicationMetadata !== undefined) {
+        if (!['success', 'partial'].includes(String(pageIdentity?.status))
+            || !validPagePublicationMetadata(publicationMetadata)) {
+            throw new TypeError('Lookup evidence contains invalid page publication metadata.');
+        }
+        const projectedPageIdentity = recordOrNull(output.pageIdentity);
+        if (projectedPageIdentity) {
+            projectedPageIdentity.publicationMetadata = projectLookupEvidencePrivacySafeTree(publicationMetadata);
+        }
+    }
+    const httpResponse = recordOrNull(recordOrNull(source.http)?.response);
+    const sourceHttp = recordOrNull(source.http);
+    const deliveryMetadata = httpResponse?.deliveryMetadata;
+    if (deliveryMetadata !== undefined) {
+        if (!['success', 'partial'].includes(String(sourceHttp?.status))
+            || !validHttpDeliveryMetadata(deliveryMetadata)) {
+            throw new TypeError('Lookup evidence contains invalid HTTP delivery metadata.');
+        }
+        const projectedHttp = recordOrNull(output.http);
+        const projectedResponse = recordOrNull(projectedHttp?.response);
+        if (projectedResponse) {
+            projectedResponse.deliveryMetadata = projectLookupEvidencePrivacySafeTree(deliveryMetadata);
+        }
+    }
+    return output;
+}
+/** Exact availability projection used only to validate public schema 26. */
+export function projectLookupEvidenceAvailabilityPublic(value) {
+    return projectLookupEvidenceAvailabilityWithKeys(value, PUBLIC_LOOKUP_AVAILABILITY_ANALYSIS_KEYS, false, false);
+}
+/**
+ * Current availability projection. Registry-derived registrar, registrant,
+ * and abuse contact routes are deliberately excluded at the root boundary;
+ * the marker prevents that privacy omission from being read as source absence.
+ */
+export function projectLookupEvidenceAvailability(value) {
+    return projectLookupEvidenceAvailabilityWithKeys(value, LOOKUP_AVAILABILITY_ANALYSIS_KEYS, true, true);
+}
+export function assertLookupEvidencePrivacySafeTree(value) {
+    assertLookupEvidencePortableTree(value);
+    const pending = [value];
+    while (pending.length) {
+        const current = pending.pop();
+        if (current === null || typeof current === 'boolean' || typeof current === 'number')
+            continue;
+        if (typeof current === 'string') {
+            if (projectLookupEvidencePrivacySafeTree(current) !== current) {
+                throw new TypeError('Lookup evidence contains a non-portable string value.');
+            }
+            continue;
+        }
+        if (Array.isArray(current)) {
+            for (const item of current)
+                pending.push(item);
+            continue;
+        }
+        const source = recordOrNull(current);
+        if (!source)
+            throw new TypeError('Lookup evidence contains a non-JSON value.');
+        for (const [key, item] of Object.entries(source)) {
+            const normalized = normalizedEvidenceKey(key);
+            if (privateEvidenceKey(normalized, item)) {
+                throw new TypeError('Lookup evidence contains excluded private request or session material.');
+            }
+            if (typeof item === 'string' && PORTABLE_URL_KEYS.has(normalized) && portableUri(item) !== item) {
+                throw new TypeError('Lookup evidence contains a credential-bearing or non-portable URL.');
+            }
+            pending.push(item);
+        }
+    }
+}
+function projectedKnownRecord(value, keys) {
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const output = {};
+    for (const key of keys) {
+        if (Object.hasOwn(source, key))
+            output[key] = projectLookupEvidencePrivacySafeTree(source[key]);
+    }
+    return output;
+}
+export function assertLookupEvidencePortableTree(value) {
+    const pending = [{ value, depth: 0 }];
+    let entries = 0;
+    while (pending.length) {
+        const current = pending.pop();
+        if (!current)
+            break;
+        entries += 1;
+        if (entries > LOOKUP_EVIDENCE_PORTABLE_MAX_ENTRIES) {
+            throw new TypeError(`Lookup evidence exceeds the ${LOOKUP_EVIDENCE_PORTABLE_MAX_ENTRIES.toLocaleString('en')}-entry portable limit.`);
+        }
+        if (current.depth > LOOKUP_EVIDENCE_PORTABLE_MAX_DEPTH) {
+            throw new TypeError(`Lookup evidence exceeds the ${LOOKUP_EVIDENCE_PORTABLE_MAX_DEPTH}-level portable nesting limit.`);
+        }
+        if (typeof current.value === 'string') {
+            if (current.value.length > LOOKUP_EVIDENCE_PORTABLE_MAX_STRING_LENGTH) {
+                throw new TypeError('Lookup evidence contains an over-bound string.');
+            }
+            continue;
+        }
+        if (current.value === null || typeof current.value === 'boolean')
+            continue;
+        if (typeof current.value === 'number') {
+            if (!Number.isFinite(current.value)) {
+                throw new TypeError('Lookup evidence contains a non-finite number.');
+            }
+            continue;
+        }
+        if (Array.isArray(current.value)) {
+            if (current.value.length > LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS) {
+                throw new TypeError('Lookup evidence contains an over-bound array.');
+            }
+            for (const item of current.value)
+                pending.push({ value: item, depth: current.depth + 1 });
+            continue;
+        }
+        if (current.value && typeof current.value === 'object') {
+            const source = current.value;
+            const prototype = Object.getPrototypeOf(source);
+            if (prototype !== Object.prototype && prototype !== null) {
+                throw new TypeError('Lookup evidence contains a non-JSON object.');
+            }
+            const keys = Object.keys(source);
+            if (keys.length > LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS
+                || keys.some((key) => key.length > LOOKUP_EVIDENCE_PORTABLE_MAX_KEY_LENGTH
+                    || /[\u0000-\u001f\u007f]/u.test(key)
+                    || !isSafeJsonObjectKey(key))) {
+                throw new TypeError('Lookup evidence contains an over-bound object.');
+            }
+            for (const item of Object.values(source))
+                pending.push({ value: item, depth: current.depth + 1 });
+            continue;
+        }
+        throw new TypeError('Lookup evidence contains a non-JSON value.');
+    }
+}
+export function serializeLookupEvidence(value, pretty = false) {
+    assertLookupEvidencePortableTree(value);
+    let output;
+    try {
+        output = JSON.stringify(value, null, pretty ? 2 : 0);
+    }
+    catch {
+        throw new TypeError('Lookup evidence could not be serialized as JSON.');
+    }
+    if (new TextEncoder().encode(output).byteLength > LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES) {
+        throw new TypeError('Lookup evidence exceeds the 5 MiB portable file limit.');
+    }
+    return output;
 }
 function boundedString(value, maximum) {
     if (typeof value !== 'string' || value.length > maximum || /[\u0000-\u001f\u007f]/.test(value))
@@ -34,18 +585,7 @@ function boundedHttpStatus(value) {
 }
 function boundedTimestamp(value) {
     const text = boundedString(value, 64);
-    if (!text)
-        return null;
-    const time = Date.parse(text);
-    return Number.isFinite(time) ? new Date(time).toISOString() : null;
-}
-function boundedSemanticVersion(value) {
-    try {
-        return normalizeBoundedSemanticVersion(value, 'Evidence application');
-    }
-    catch {
-        return null;
-    }
+    return text ? normalizeExplicitIsoTimestamp(text) : null;
 }
 function boundedEndpoint(value) {
     const text = boundedString(value, 2048);
@@ -70,11 +610,76 @@ function boundedStringList(value, count, length) {
             .filter((item) => item !== null))];
 }
 function boundedHostname(value) {
-    const text = boundedString(value, 253)?.toLowerCase().replace(/\.+$/u, '') || null;
-    if (!text || !text.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/iu.test(label))) {
+    const text = boundedString(value, 253)?.replace(/\.+$/u, '') || null;
+    return text && isValidAsciiHostname(text, { requireDot: false }) ? text.toLowerCase() : null;
+}
+function canonicalIpv4(value) {
+    const text = boundedString(value, 64);
+    if (!text || !/^\d{1,3}(?:\.\d{1,3}){3}$/u.test(text))
+        return null;
+    const octets = text.split('.').map(Number);
+    if (octets.some((octet) => octet > 255))
+        return null;
+    return octets.join('.');
+}
+function canonicalIpv6(value) {
+    const text = boundedString(value, 64)?.toLowerCase();
+    if (!text || !text.includes(':') || text.includes('%'))
         return null;
+    try {
+        const hostname = new URL(`http://[${text}]/`).hostname;
+        return hostname.startsWith('[') && hostname.endsWith(']')
+            ? hostname.slice(1, -1).toLowerCase()
+            : null;
     }
-    return text;
+    catch {
+        return null;
+    }
+}
+function canonicalAsn(value) {
+    const text = boundedString(value, 32);
+    const match = text?.match(/^(?:AS)?(\d+)$/iu);
+    if (!match)
+        return null;
+    const number = Number(match[1]);
+    return Number.isInteger(number) && number >= 0 && number <= 4_294_967_295
+        ? `AS${number}`
+        : null;
+}
+export function projectLookupEvidenceQuery(value) {
+    const source = recordOrNull(value) || {};
+    const type = typeof source.type === 'string' && LOOKUP_QUERY_TYPES.has(source.type)
+        ? source.type
+        : 'domain';
+    if (type === 'domain') {
+        const inputHostname = [source.inputHostname, source.registrableDomain, source.submitted, source.query]
+            .map(boundedHostname)
+            .find((item) => Boolean(item)) || 'unknown.invalid';
+        const suppliedRegistrableDomain = boundedHostname(source.registrableDomain);
+        const registrableDomain = suppliedRegistrableDomain
+            && (inputHostname === suppliedRegistrableDomain || inputHostname.endsWith(`.${suppliedRegistrableDomain}`))
+            ? suppliedRegistrableDomain
+            : inputHostname;
+        return {
+            submitted: inputHostname,
+            type,
+            inputHostname,
+            registrableDomain,
+            isSubdomain: inputHostname !== registrableDomain,
+        };
+    }
+    const candidate = source.submitted ?? source.query;
+    const submitted = type === 'ipv4'
+        ? canonicalIpv4(candidate)
+        : type === 'ipv6'
+            ? canonicalIpv6(candidate)
+            : canonicalAsn(candidate);
+    if (!submitted)
+        throw new TypeError(`Lookup evidence contains an invalid ${type} query.`);
+    return { submitted, type, inputHostname: null, registrableDomain: null, isSubdomain: false };
+}
+function completeTerminalObservation(status, truncated) {
+    return truncated !== true && (status === 'success' || status === 'not_found');
 }
 function boundedPublishedUri(value, protocols) {
     const text = boundedString(value, 2048);
@@ -204,18 +809,189 @@ function sslblSource(value) {
         limitations: boundedStringList(source.limitations, 10, 300),
     };
 }
-function networkAttempt(value) {
+function rdapAttempt(value) {
     const attempt = recordOrNull(value) || {};
     const endpoint = boundedEndpoint(attempt.endpoint);
     return {
         endpoint,
         transportSecurity: endpoint ? endpoint.startsWith('https:') ? 'https' : 'http' : null,
         status: boundedHttpStatus(attempt.status),
-        outcome: boundedString(attempt.outcome, 40),
+        outcome: typeof attempt.outcome === 'string' && RDAP_ATTEMPT_OUTCOMES.has(attempt.outcome)
+            ? attempt.outcome
+            : 'unknown',
         detail: boundedString(attempt.detail, 240),
         selected: attempt.selected === true,
     };
 }
+function boundedRdapAttempts(value, maximum) {
+    return (Array.isArray(value) ? value : [])
+        .slice(0, maximum)
+        .map(rdapAttempt);
+}
+function whoisChainHop(value) {
+    const hop = recordOrNull(value) || {};
+    const queryProfile = typeof hop.queryProfile === 'string' && WHOIS_QUERY_PROFILES.has(hop.queryProfile)
+        ? hop.queryProfile
+        : null;
+    const error = boundedString(hop.error, 240);
+    return {
+        server: boundedHostname(hop.server),
+        address: boundedString(hop.address, 64),
+        queriedAt: boundedTimestamp(hop.queriedAt),
+        queryProfile,
+        responseEncoding: hop.responseEncoding === 'utf-8' ? 'utf-8' : null,
+        status: queryProfile === 'not-issued'
+            ? 'not_issued'
+            : error
+                ? 'error'
+                : typeof hop.response === 'string'
+                    ? 'success'
+                    : 'unknown',
+        detail: error,
+    };
+}
+function boundedWhoisChain(value) {
+    return (Array.isArray(value) ? value : [])
+        .slice(0, 16)
+        .map(whoisChainHop);
+}
+function lookupTimingDiagnostics(value) {
+    const source = recordOrNull(value);
+    if (source?.version !== 1)
+        return null;
+    return {
+        version: 1,
+        totalMs: boundedInteger(source.totalMs, 120_000),
+        sources: (Array.isArray(source.sources) ? source.sources : [])
+            .slice(0, LOOKUP_TIMING_SOURCES.size)
+            .flatMap((item) => {
+            const entry = recordOrNull(item);
+            if (!entry
+                || typeof entry.source !== 'string'
+                || !LOOKUP_TIMING_SOURCES.has(entry.source)
+                || (entry.outcome !== 'fulfilled' && entry.outcome !== 'rejected'))
+                return [];
+            return [{
+                    source: entry.source,
+                    outcome: entry.outcome,
+                    durationMs: boundedInteger(entry.durationMs, 120_000),
+                    completedAfterMs: boundedInteger(entry.completedAfterMs, 120_000),
+                }];
+        }),
+    };
+}
+function registryAccessDiagnostics(value) {
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const officialLookupUrl = portableUri(source.officialLookupUrl);
+    return {
+        suffix: boundedHostname(source.suffix),
+        coverageState: boundedString(source.coverageState, 40),
+        whoisAccessProfile: boundedString(source.whoisAccessProfile, 80),
+        rdapAccessProfile: boundedString(source.rdapAccessProfile, 80),
+        ...(officialLookupUrl ? { officialLookupUrl } : {}),
+        limitation: boundedString(source.limitation, 500),
+        authority: source.authority === 'context_only' ? 'context_only' : null,
+    };
+}
+function registrarRdapDiagnostics(value) {
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const endpoint = boundedEndpoint(source.endpoint);
+    return {
+        status: sourceStatus(source.status, REGISTRAR_RDAP_STATUSES, 'error'),
+        endpoint,
+        transportSecurity: endpoint ? endpoint.startsWith('https:') ? 'https' : 'http' : null,
+        httpStatus: boundedHttpStatus(source.httpStatus),
+        fetchedAt: boundedTimestamp(source.fetchedAt),
+        attempt: source.attempt === null || source.attempt === undefined ? null : rdapAttempt(source.attempt),
+    };
+}
+function lookupDiagnostics(value) {
+    const source = recordOrNull(value) || {};
+    const rdap = recordOrNull(source.rdap) || {};
+    const whois = recordOrNull(source.whois) || {};
+    const availability = recordOrNull(source.availability) || {};
+    const reverseDns = recordOrNull(source.reverseDns);
+    const network = recordOrNull(source.network);
+    const securityTxt = recordOrNull(source.securityTxt);
+    const sslbl = recordOrNull(source.sslbl);
+    const rdapEndpoint = boundedEndpoint(rdap.endpoint);
+    const networkEndpoint = boundedEndpoint(network?.endpoint);
+    const networkPublicationAvailable = network?.status === 'success' || network?.status === 'partial';
+    const securityTxtEndpoint = boundedPublishedUri(securityTxt?.endpoint, ['https:']);
+    const version = boundedInteger(source.version, 10);
+    const timing = lookupTimingDiagnostics(source.timing);
+    const registryAccess = registryAccessDiagnostics(source.registryAccess);
+    const registrar = registrarRdapDiagnostics(rdap.registrar);
+    return {
+        ...(version === null ? {} : { version }),
+        ...(timing ? { timing } : {}),
+        ...(registryAccess ? { registryAccess } : {}),
+        rdap: {
+            status: sourceStatus(rdap.status, RDAP_SOURCE_STATUSES, 'error'),
+            errorCode: boundedString(rdap.errorCode, 80),
+            endpoint: rdapEndpoint,
+            transportSecurity: rdapEndpoint ? rdapEndpoint.startsWith('https:') ? 'https' : 'http' : null,
+            httpStatus: boundedHttpStatus(rdap.httpStatus),
+            fetchedAt: boundedTimestamp(rdap.fetchedAt),
+            attempts: boundedRdapAttempts(rdap.attempts, 16),
+            ...(registrar ? { registrar } : {}),
+        },
+        whois: {
+            status: sourceStatus(whois.status, WHOIS_SOURCE_STATUSES, 'error'),
+            errorCode: boundedString(whois.errorCode, 80),
+            queriedAt: boundedTimestamp(whois.queriedAt),
+            authoritativeHop: boundedHostname(whois.authoritativeHop),
+            failedHop: boundedHostname(whois.failedHop),
+            conflictingHop: boundedHostname(whois.conflictingHop),
+        },
+        ...(recordOrNull(source.availability) ? { availability: {
+                status: sourceStatus(availability.status, AVAILABILITY_DIAGNOSTIC_STATUSES, 'error'),
+                errorCode: boundedString(availability.errorCode, 80),
+                resultState: boundedString(availability.resultState, 40),
+            } } : {}),
+        ...(reverseDns ? { reverseDns: {
+                status: sourceStatus(reverseDns.status, REVERSE_DNS_STATUSES, 'error'),
+                observedAt: boundedTimestamp(reverseDns.observedAt),
+                complete: completeTerminalObservation(sourceStatus(reverseDns.status, REVERSE_DNS_STATUSES, 'error'), reverseDns.truncated),
+                truncated: reverseDns.truncated === true,
+            } } : {}),
+        ...(network ? { network: {
+                status: sourceStatus(network.status, NETWORK_CONTEXT_STATUSES, 'error'),
+                address: networkPublicationAvailable ? boundedString(network.address, 64) : null,
+                family: networkPublicationAvailable && (network.family === 4 || network.family === 6) ? network.family : null,
+                addressSource: networkPublicationAvailable && typeof network.addressSource === 'string' && NETWORK_ADDRESS_SOURCES.has(network.addressSource)
+                    ? network.addressSource
+                    : null,
+                endpoint: networkPublicationAvailable ? networkEndpoint : null,
+                transportSecurity: networkPublicationAvailable && networkEndpoint ? networkEndpoint.startsWith('https:') ? 'https' : 'http' : null,
+                httpStatus: networkPublicationAvailable ? boundedHttpStatus(network.httpStatus) : null,
+                fetchedAt: networkPublicationAvailable ? boundedTimestamp(network.fetchedAt) : null,
+                attempts: networkPublicationAvailable ? boundedRdapAttempts(network.attempts, 3) : [],
+            } } : {}),
+        ...(securityTxt ? { securityTxt: {
+                status: boundedString(securityTxt.status, 40),
+                state: typeof securityTxt.state === 'string' && SECURITY_TXT_STATES.has(securityTxt.state)
+                    ? securityTxt.state
+                    : null,
+                endpoint: securityTxtEndpoint,
+                httpStatus: boundedHttpStatus(securityTxt.httpStatus),
+                observedAt: boundedTimestamp(securityTxt.observedAt),
+                complete: securityTxt.complete === true,
+                truncated: securityTxt.truncated === true,
+            } } : {}),
+        ...(sslbl ? { sslbl: {
+                status: typeof sslbl.status === 'string' && SSLBL_STATES.has(sslbl.status) ? sslbl.status : null,
+                verdict: typeof sslbl.verdict === 'string' && SSLBL_VERDICTS.has(sslbl.verdict) ? sslbl.verdict : null,
+                observedAt: boundedTimestamp(sslbl.observedAt),
+                complete: sslbl.complete === true,
+                snapshotUpdatedAt: boundedTimestamp(sslbl.snapshotUpdatedAt),
+            } } : {}),
+    };
+}
 function networkSource(value) {
     const source = recordOrNull(value);
     if (!source
@@ -228,6 +1004,7 @@ function networkSource(value) {
     const network = recordOrNull(source.network);
     const diagnostics = recordOrNull(source.diagnostics);
     const rdapEndpoint = boundedEndpoint(rdap?.endpoint);
+    const publicationAvailable = source.status === 'success' || source.status === 'partial';
     return {
         contextVersion: 1,
         version: source.version === 1 ? 1 : null,
@@ -236,7 +1013,7 @@ function networkSource(value) {
         scanMode: source.scanMode === 'deep' ? 'deep' : null,
         source: source.source === 'ip_rdap' ? 'ip_rdap' : null,
         durationMs: boundedInteger(source.durationMs, 120_000),
-        complete: source.complete === true,
+        complete: completeTerminalObservation(source.status, source.truncated),
         truncated: source.truncated === true,
         limitations: boundedStringList(source.limitations, 10, 300),
         diagnostics: diagnostics ? {
@@ -249,7 +1026,7 @@ function networkSource(value) {
             cidrCount: boundedInteger(diagnostics.cidrCount, 16),
         } : null,
         detail: boundedString(source.detail, 300),
-        endpoint: endpoint ? {
+        endpoint: publicationAvailable && endpoint ? {
             address: boundedString(endpoint.address, 64),
             family: endpoint.family === 4 || endpoint.family === 6 ? endpoint.family : null,
             selectedFrom: typeof endpoint.selectedFrom === 'string'
@@ -257,14 +1034,14 @@ function networkSource(value) {
                 ? endpoint.selectedFrom
                 : null,
         } : null,
-        rdap: rdap ? {
+        rdap: publicationAvailable && rdap ? {
             endpoint: rdapEndpoint,
             transportSecurity: rdapEndpoint ? rdapEndpoint.startsWith('https:') ? 'https' : 'http' : null,
             httpStatus: boundedHttpStatus(rdap.httpStatus),
             fetchedAt: boundedTimestamp(rdap.fetchedAt),
-            attempts: (Array.isArray(rdap.attempts) ? rdap.attempts : []).slice(0, 3).map(networkAttempt),
+            attempts: boundedRdapAttempts(rdap.attempts, 3),
         } : null,
-        network: network ? {
+        network: publicationAvailable && network ? {
             handle: boundedString(network.handle, 300),
             name: boundedString(network.name, 300),
             holder: boundedString(network.holder, 300),
@@ -289,7 +1066,8 @@ function reverseDnsSource(value) {
     const records = recordOrNull(source.records);
     const diagnostics = recordOrNull(source.diagnostics);
     const ptrDiagnostics = recordOrNull(diagnostics?.ptr);
-    const ptr = [...new Set((Array.isArray(records?.ptr) ? records.ptr : [])
+    const publicationAvailable = source.status === 'success' || source.status === 'partial';
+    const ptr = [...new Set((publicationAvailable && Array.isArray(records?.ptr) ? records.ptr : [])
             .slice(0, 8)
             .map(boundedHostname)
             .filter((item) => item !== null))].sort();
@@ -300,7 +1078,7 @@ function reverseDnsSource(value) {
         scanMode: source.scanMode === 'deep' ? 'deep' : null,
         source: 'reverse_dns',
         durationMs: boundedInteger(source.durationMs, 120_000),
-        complete: source.complete === true,
+        complete: completeTerminalObservation(source.status, source.truncated),
         truncated: source.truncated === true,
         limitations: boundedStringList(source.limitations, 10, 300),
         diagnostics: ptrDiagnostics ? {
@@ -314,40 +1092,405 @@ function reverseDnsSource(value) {
         records: { ptr },
     };
 }
-function rdapSource(rdap) {
+function boundedSourceError(value, fallback) {
+    const normalized = String(value ?? '')
+        .replace(/[\u0000-\u001f\u007f]+/gu, ' ')
+        .replace(/\s+/gu, ' ')
+        .trim();
+    return normalized.slice(0, 10_000) || fallback;
+}
+function nullableText(maximum) {
+    return (value) => value === null ? null : boundedString(value, maximum) ?? undefined;
+}
+function nullableTimestamp(value) {
+    return value === null ? null : boundedTimestamp(value) ?? undefined;
+}
+function booleanValue(nullable = false) {
+    return (value) => typeof value === 'boolean' ? value : nullable && value === null ? null : undefined;
+}
+function nullableInteger(maximum) {
+    return (value) => value === null ? null : boundedInteger(value, maximum) ?? undefined;
+}
+function enumeration(values, nullable = false) {
+    return (value) => typeof value === 'string' && values.has(value)
+        ? value
+        : nullable && value === null ? null : undefined;
+}
+const LOOKUP_RDAP_PORTABLE_SCALARS = Object.freeze({
+    objectClassName: nullableText(80),
+    language: nullableText(35),
+    conformanceTruncated: booleanValue(),
+    redactionsTruncated: booleanValue(),
+    port43: nullableText(300),
+    parentHandle: nullableText(300),
+    linksTruncated: booleanValue(),
+    noticesTruncated: booleanValue(),
+    remarksTruncated: booleanValue(),
+    serverTruncated: booleanValue(),
+    statusesTruncated: booleanValue(),
+    eventsTruncated: booleanValue(),
+    domain: nullableText(253),
+    unicodeDomain: nullableText(253),
+    handle: nullableText(300),
+    nameserversTruncated: booleanValue(),
+    nameserverAddressesTruncated: booleanValue(),
+    dnssec: enumeration(new Set(['Signed', 'Unsigned', 'Unknown']), true),
+    zoneSigned: booleanValue(true),
+    delegationSigned: booleanValue(true),
+    dsDataTruncated: booleanValue(),
+    variantsTruncated: booleanValue(),
+    registrarIanaId: nullableText(300),
+    entitiesTruncated: booleanValue(),
+    name: nullableText(300),
+    startAddress: nullableText(80),
+    endAddress: nullableText(80),
+    cidrsTruncated: booleanValue(),
+    country: nullableText(2),
+    networkType: nullableText(160),
+    startAutnum: nullableInteger(4_294_967_295),
+    endAutnum: nullableInteger(4_294_967_295),
+    autnumType: nullableText(160),
+});
+const LOOKUP_RDAP_PORTABLE_STRING_LISTS = Object.freeze({
+    conformance: [50, 160],
+    serverTruncationReasons: [8, 160],
+    statuses: [100, 160],
+    nameservers: [200, 253],
+    truncatedEntityRoles: [11, 80],
+    cidrs: [200, 160],
+});
+const LOOKUP_RDAP_EVENT_SCALARS = Object.freeze({
+    action: nullableText(100),
+    date: nullableText(64),
+});
+const LOOKUP_RDAP_LIFECYCLE_SCALARS = Object.freeze({
+    createdDate: nullableText(64),
+    reregistrationDate: nullableText(64),
+    expiryDate: nullableText(64),
+    updatedDate: nullableText(64),
+    transferDate: nullableText(64),
+    deletionDate: nullableText(64),
+    reinstantiationDate: nullableText(64),
+    databaseUpdatedDate: nullableText(64),
+    createdDateIso: nullableTimestamp,
+    reregistrationDateIso: nullableTimestamp,
+    expiryDateIso: nullableTimestamp,
+    updatedDateIso: nullableTimestamp,
+    transferDateIso: nullableTimestamp,
+    deletionDateIso: nullableTimestamp,
+    reinstantiationDateIso: nullableTimestamp,
+    databaseUpdatedDateIso: nullableTimestamp,
+});
+const LOOKUP_RDAP_REDACTION_SCALARS = Object.freeze({
+    name: nullableText(300),
+    reason: nullableText(300),
+    method: nullableText(80),
+    pathLanguage: nullableText(80),
+    prePath: nullableText(512),
+    postPath: nullableText(512),
+    replacementPath: nullableText(512),
+});
+const LOOKUP_RDAP_REGISTRAR_SCALARS = Object.freeze({
+    handle: nullableText(200),
+    name: nullableText(300),
+    org: nullableText(300),
+    truncated: booleanValue(),
+});
+const LOOKUP_RDAP_PUBLIC_ID_SCALARS = Object.freeze({
+    type: nullableText(160),
+    identifier: nullableText(300),
+});
+const LOOKUP_RDAP_NAMESERVER_SCALARS = Object.freeze({
+    name: nullableText(253),
+});
+const LOOKUP_RDAP_DS_SCALARS = Object.freeze({
+    keyTag: nullableInteger(65_535),
+    algorithm: nullableInteger(255),
+    digestType: nullableInteger(255),
+    digest: nullableText(512),
+});
+const LOOKUP_RDAP_VARIANT_SCALARS = Object.freeze({
+    idnTable: nullableText(300),
+});
+const LOOKUP_RDAP_VARIANT_NAME_SCALARS = Object.freeze({
+    ldhName: nullableText(253),
+    unicodeName: nullableText(253),
+});
+const LOOKUP_WHOIS_PORTABLE_SCALARS = Object.freeze({
+    domainName: nullableText(253),
+    registryDomainId: nullableText(300),
+    registrar: nullableText(300),
+    registrarIanaId: nullableText(300),
+    createdDate: nullableText(100),
+    expiryDate: nullableText(100),
+    updatedDate: nullableText(100),
+    createdDateIso: nullableTimestamp,
+    expiryDateIso: nullableTimestamp,
+    updatedDateIso: nullableTimestamp,
+    statusesTruncated: booleanValue(),
+    nameserversTruncated: booleanValue(),
+    dnssec: nullableText(300),
+    chainStatus: enumeration(new Set(['complete', 'partial'])),
+    authoritativeHop: nullableText(253),
+    failedHop: nullableText(253),
+    conflictingHop: nullableText(253),
+});
+const LOOKUP_REGISTRY_INSIGHT_PORTABLE_KEYS = new Set([
+    'version', 'contactDisclosure', 'lifecycle', 'reconciliation', 'publications',
+    'rdapCapabilities',
+]);
+function projectKnownArray(value, projectors, maximum) {
+    if (!Array.isArray(value))
+        return [];
+    return value.slice(0, maximum)
+        .map((item) => projectedKnownScalarRecord(item, projectors))
+        .filter((item) => item !== null);
+}
+function projectedKnownScalarRecord(value, projectors) {
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const output = {};
+    for (const [key, projector] of Object.entries(projectors)) {
+        if (!Object.hasOwn(source, key))
+            continue;
+        const item = projector(source[key]);
+        if (item !== undefined)
+            output[key] = item;
+    }
+    return output;
+}
+/**
+ * Positive portable projection for normalized RDAP. Contact entities, vCards,
+ * entity inventories, arbitrary links/notices/remarks, and raw payloads never
+ * cross this boundary. The marker prevents deliberate omission from becoming
+ * an apparent source assertion that contacts were absent.
+ */
+export function projectLookupEvidenceRdapPublication(value) {
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const output = projectedKnownScalarRecord(source, LOOKUP_RDAP_PORTABLE_SCALARS) || {};
+    for (const [key, [count, length]] of Object.entries(LOOKUP_RDAP_PORTABLE_STRING_LISTS)) {
+        if (Object.hasOwn(source, key))
+            output[key] = boundedStringList(source[key], count, length);
+    }
+    if (Object.hasOwn(source, 'events')) {
+        output.events = projectKnownArray(source.events, LOOKUP_RDAP_EVENT_SCALARS, 100)
+            .filter((event) => typeof event.action === 'string' || typeof event.date === 'string');
+    }
+    if (Object.hasOwn(source, 'lifecycle')) {
+        output.lifecycle = projectedKnownScalarRecord(source.lifecycle, LOOKUP_RDAP_LIFECYCLE_SCALARS);
+    }
+    if (Object.hasOwn(source, 'redactions')) {
+        const inputRedactions = Array.isArray(source.redactions) ? source.redactions : [];
+        const redactions = projectKnownArray(inputRedactions, LOOKUP_RDAP_REDACTION_SCALARS, 100)
+            .filter((redaction) => Object.values(redaction).some((item) => item !== null));
+        output.redactions = redactions;
+        output.redactionsTruncated = source.redactionsTruncated === true
+            || !Array.isArray(source.redactions)
+            || inputRedactions.length > 100
+            || redactions.length < Math.min(inputRedactions.length, 100);
+    }
+    if (Object.hasOwn(source, 'nameserverDetails')) {
+        output.nameserverDetails = (Array.isArray(source.nameserverDetails) ? source.nameserverDetails : [])
+            .slice(0, 200)
+            .map((item) => {
+            const nameserver = projectedKnownScalarRecord(item, LOOKUP_RDAP_NAMESERVER_SCALARS);
+            const original = recordOrNull(item);
+            if (!nameserver || !original || typeof nameserver.name !== 'string')
+                return null;
+            nameserver.addresses = boundedStringList(original.addresses, 20, 80);
+            return nameserver;
+        })
+            .filter((item) => item !== null);
+    }
+    if (Object.hasOwn(source, 'dsData')) {
+        output.dsData = projectKnownArray(source.dsData, LOOKUP_RDAP_DS_SCALARS, 50)
+            .filter((item) => Number.isInteger(item.keyTag)
+            && Number.isInteger(item.algorithm)
+            && Number.isInteger(item.digestType)
+            && typeof item.digest === 'string'
+            && item.digest.length % 2 === 0
+            && /^[0-9a-f]+$/iu.test(item.digest));
+    }
+    if (Object.hasOwn(source, 'variants') && Array.isArray(source.variants)) {
+        output.variants = source.variants.slice(0, 20).map((item) => {
+            const group = projectedKnownScalarRecord(item, LOOKUP_RDAP_VARIANT_SCALARS);
+            if (!group)
+                return null;
+            const original = recordOrNull(item);
+            const variantNames = projectKnownArray(original?.variantNames, LOOKUP_RDAP_VARIANT_NAME_SCALARS, 50)
+                .filter((name) => typeof name.ldhName === 'string' || typeof name.unicodeName === 'string');
+            const relation = boundedStringList(original?.relation, 20, 100);
+            group.variantNames = variantNames;
+            group.relation = relation;
+            return typeof group.idnTable === 'string' || variantNames.length || relation.length
+                ? group
+                : null;
+        }).filter((item) => item !== null);
+    }
+    if (Object.hasOwn(source, 'registrar')) {
+        const registrar = projectedKnownScalarRecord(source.registrar, LOOKUP_RDAP_REGISTRAR_SCALARS);
+        if (registrar) {
+            const original = recordOrNull(source.registrar);
+            registrar.roles = boundedStringList(original?.roles, 12, 80);
+            registrar.publicIds = projectKnownArray(original?.publicIds, LOOKUP_RDAP_PUBLIC_ID_SCALARS, 20)
+                .filter((publicId) => typeof publicId.type === 'string'
+                && typeof publicId.identifier === 'string');
+        }
+        output.registrar = registrar;
+    }
+    output.contactsExcluded = true;
+    return output;
+}
+/** Positive portable projection for normalized WHOIS publication fields. */
+export function projectLookupEvidenceWhoisPublication(value) {
+    const input = recordOrNull(value);
+    if (!input)
+        return null;
+    const output = projectedKnownScalarRecord(input, LOOKUP_WHOIS_PORTABLE_SCALARS) || {};
+    if (Object.hasOwn(input, 'lifecycle')) {
+        output.lifecycle = projectedKnownScalarRecord(input.lifecycle, LOOKUP_RDAP_LIFECYCLE_SCALARS);
+    }
+    for (const [key, count, length] of [
+        ['statuses', 100, 160],
+        ['nameservers', 200, 253],
+        ['fieldsTruncated', 64, 80],
+    ]) {
+        if (Object.hasOwn(input, key))
+            output[key] = boundedStringList(input[key], count, length);
+    }
+    output.contactsExcluded = true;
+    return output;
+}
+/** Exact positive projection for one current-schema RDAP source wrapper. */
+export function projectLookupEvidenceRdapSourcePublication(value) {
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const status = sourceStatus(source.status, RDAP_SOURCE_STATUSES, 'error');
+    const attempts = boundedRdapAttempts(source.attempts, 16);
+    if (status === 'error')
+        return {
+            status,
+            error: boundedSourceError(source.error, 'RDAP source reported an error.'),
+            attempts,
+        };
+    const endpoint = boundedEndpoint(source.endpoint);
+    const hasPublication = status === 'success' || status === 'partial';
+    const parsed = hasPublication ? projectLookupEvidenceRdapPublication(source.parsed) : null;
+    if (status === 'success' && parsed === null)
+        return null;
+    return {
+        status,
+        endpoint,
+        transportSecurity: endpoint ? endpoint.startsWith('https:') ? 'https' : 'http' : null,
+        httpStatus: boundedHttpStatus(source.httpStatus),
+        fetchedAt: boundedTimestamp(source.fetchedAt),
+        attempts,
+        parsed,
+    };
+}
+function projectedWhoisChainHop(value) {
+    const hop = recordOrNull(value);
+    if (!hop)
+        return null;
+    const queryProfile = typeof hop.queryProfile === 'string' && WHOIS_QUERY_PROFILES.has(hop.queryProfile)
+        ? hop.queryProfile
+        : null;
+    const status = typeof hop.status === 'string'
+        && ['success', 'error', 'not_issued', 'unknown'].includes(hop.status)
+        ? hop.status
+        : 'unknown';
+    return {
+        server: boundedHostname(hop.server),
+        address: boundedString(hop.address, 64),
+        queriedAt: boundedTimestamp(hop.queriedAt),
+        queryProfile,
+        responseEncoding: hop.responseEncoding === 'utf-8' ? 'utf-8' : null,
+        status,
+        detail: boundedString(hop.detail, 240),
+    };
+}
+/** Exact positive projection for one current-schema WHOIS source wrapper. */
+export function projectLookupEvidenceWhoisSourcePublication(value) {
+    const source = recordOrNull(value);
+    if (!source)
+        return null;
+    const status = sourceStatus(source.status, WHOIS_SOURCE_STATUSES, 'error');
+    if (status === 'error')
+        return {
+            status,
+            error: boundedSourceError(source.error, 'WHOIS source reported an error.'),
+        };
+    const hasPublication = status === 'complete' || status === 'partial';
+    const parsed = hasPublication ? projectLookupEvidenceWhoisPublication(source.parsed) : null;
+    if (status === 'complete' && parsed === null)
+        return null;
+    return {
+        status,
+        queriedAt: boundedTimestamp(source.queriedAt),
+        authoritativeHop: boundedHostname(source.authoritativeHop),
+        failedHop: boundedHostname(source.failedHop),
+        conflictingHop: boundedHostname(source.conflictingHop),
+        parsed,
+        chain: hasPublication
+            ? (Array.isArray(source.chain) ? source.chain : [])
+                .slice(0, 16)
+                .map(projectedWhoisChainHop)
+                .filter((hop) => hop !== null)
+            : [],
+    };
+}
+export function projectLookupEvidenceRegistryInsights(value) {
+    return projectedKnownRecord(value, LOOKUP_REGISTRY_INSIGHT_PORTABLE_KEYS);
+}
+function sourceStatus(value, allowed, fallback) {
+    return typeof value === 'string' && allowed.has(value) ? value : fallback;
+}
+function rdapSource(rdap, diagnostics) {
     const source = recordOrNull(rdap) || {};
-    if (source.error)
+    const status = sourceStatus(diagnostics?.status, RDAP_SOURCE_STATUSES, 'error');
+    const attempts = boundedRdapAttempts(source.attempts ?? diagnostics?.attempts, 16);
+    if (status === 'error')
         return {
             status: 'error',
-            error: String(source.error),
-            attempts: cloneJson(source.attempts || []),
+            error: boundedSourceError(source.error ?? diagnostics?.errorCode, 'RDAP source reported an error.'),
+            attempts,
         };
+    const hasPublication = status === 'success' || status === 'partial';
+    const endpoint = boundedEndpoint(source.rdapServer ?? diagnostics?.endpoint);
     return {
-        status: source.upstreamStatus === 404 ? 'not_found' : 'success',
-        endpoint: source.rdapServer || null,
-        transportSecurity: source.transportSecurity || null,
-        httpStatus: source.upstreamStatus ?? null,
-        fetchedAt: source.fetchedAt || null,
-        attempts: cloneJson(source.attempts || []),
-        parsed: cloneJson(source.parsed),
-        raw: cloneJson(source.data),
+        status,
+        endpoint,
+        transportSecurity: endpoint ? endpoint.startsWith('https:') ? 'https' : 'http' : null,
+        httpStatus: boundedHttpStatus(source.upstreamStatus ?? diagnostics?.httpStatus),
+        fetchedAt: boundedTimestamp(source.fetchedAt ?? diagnostics?.fetchedAt),
+        attempts,
+        parsed: hasPublication ? projectLookupEvidenceRdapPublication(source.parsed) : null,
     };
 }
-function whoisSource(whois) {
+function whoisSource(whois, diagnostics) {
     const source = recordOrNull(whois) || {};
-    if (source.error)
-        return { status: 'error', error: String(source.error) };
+    const status = sourceStatus(diagnostics?.status, WHOIS_SOURCE_STATUSES, 'error');
+    if (status === 'error')
+        return {
+            status: 'error',
+            error: boundedSourceError(source.error ?? diagnostics?.errorCode, 'WHOIS source reported an error.'),
+        };
     const parsed = recordOrNull(source.parsed);
-    const chain = Array.isArray(source.chain) ? source.chain : [];
+    const hasPublication = status === 'complete' || status === 'partial';
+    const chain = hasPublication ? boundedWhoisChain(source.chain) : [];
     const firstHop = recordOrNull(chain[0]);
     return {
-        status: parsed?.chainStatus || 'unknown',
-        queriedAt: firstHop?.queriedAt || null,
-        authoritativeHop: parsed?.authoritativeHop || null,
-        failedHop: parsed?.failedHop || null,
-        conflictingHop: parsed?.conflictingHop || null,
-        parsed: cloneJson(parsed),
-        chain: cloneJson(chain),
+        status,
+        queriedAt: boundedTimestamp(firstHop?.queriedAt ?? diagnostics?.queriedAt),
+        authoritativeHop: boundedHostname(parsed?.authoritativeHop ?? diagnostics?.authoritativeHop),
+        failedHop: boundedHostname(parsed?.failedHop ?? diagnostics?.failedHop),
+        conflictingHop: boundedHostname(parsed?.conflictingHop ?? diagnostics?.conflictingHop),
+        parsed: hasPublication ? projectLookupEvidenceWhoisPublication(parsed) : null,
+        chain,
     };
 }
 function registrarPublicationComparison(body, registryParsed) {
@@ -359,7 +1502,9 @@ function registrarPublicationComparison(body, registryParsed) {
     if (!registrar && !registrarDiagnostics)
         return null;
     const reportedStatus = registrar?.status ?? registrarDiagnostics?.status;
-    const parsed = recordOrNull(registrar?.parsed);
+    const parsed = ['success', 'partial'].includes(String(reportedStatus))
+        ? projectLookupEvidenceRdapPublication(registrar?.parsed)
+        : null;
     const registrarStatus = typeof reportedStatus === 'string' && REGISTRAR_RDAP_STATUSES.has(reportedStatus)
         ? (reportedStatus === 'success' && !parsed ? 'partial' : reportedStatus)
         : 'error';
@@ -369,17 +1514,35 @@ function registrarPublicationComparison(body, registryParsed) {
     });
 }
 export function buildLookupEvidence(response, options = {}) {
-    const { generatedAt = new Date().toISOString(), idnAnalysis = null, applicationVersion = null } = options;
+    assertBoundedJsonStructure(response, 'Lookup response');
+    const { generatedAt: generatedAtValue = new Date().toISOString(), idnAnalysis = null, applicationVersion = null } = options;
+    const generatedAt = normalizeExplicitIsoTimestamp(generatedAtValue);
+    if (!generatedAt) {
+        throw new TypeError('Lookup evidence generation time must be valid and include an explicit timezone.');
+    }
     const body = recordOrNull(response) || {};
     const rdap = recordOrNull(body.rdap);
     const whois = recordOrNull(body.whois);
     const diagnostics = recordOrNull(body.diagnostics);
-    const rdapDiagnostics = recordOrNull(diagnostics?.rdap);
-    const whoisDiagnostics = recordOrNull(diagnostics?.whois);
-    const rdapParsed = rdap && !rdap.error ? recordOrNull(rdap.parsed) : null;
-    const whoisParsed = whois && !whois.error ? recordOrNull(whois.parsed) : null;
-    const registrarRdap = recordOrNull(rdap?.registrarRdap);
-    const registrarRdapParsed = recordOrNull(registrarRdap?.parsed);
+    const projectedDiagnostics = lookupDiagnostics(diagnostics);
+    const rdapDiagnostics = recordOrNull(projectedDiagnostics.rdap);
+    const whoisDiagnostics = recordOrNull(projectedDiagnostics.whois);
+    const projectedRdap = projectLookupEvidenceRdapSourcePublication(rdapSource(rdap, rdapDiagnostics));
+    const projectedWhois = projectLookupEvidenceWhoisSourcePublication(whoisSource(whois, whoisDiagnostics));
+    if (!projectedRdap) {
+        throw new TypeError('Lookup evidence cannot publish successful RDAP without normalized publication data.');
+    }
+    if (!projectedWhois) {
+        throw new TypeError('Lookup evidence cannot publish complete WHOIS without normalized publication data.');
+    }
+    const projectedRdapRecord = recordOrNull(projectedRdap) || {};
+    const projectedWhoisRecord = recordOrNull(projectedWhois) || {};
+    const rdapParsed = ['success', 'partial'].includes(String(projectedRdapRecord.status))
+        ? recordOrNull(projectedRdapRecord.parsed)
+        : null;
+    const whoisParsed = ['complete', 'partial'].includes(String(projectedWhoisRecord.status))
+        ? recordOrNull(projectedWhoisRecord.parsed)
+        : null;
     // Rebuild the pure interpretation from bounded source fields instead of
     // trusting a supplied derived object. This adds no collection or network
     // work and lets saved or fast responses carry current source-health-aware
@@ -387,50 +1550,42 @@ export function buildLookupEvidence(response, options = {}) {
     const registryInsights = buildRegistryInsights({
         rdapParsed,
         rdapStatus: rdapDiagnostics?.status,
-        rdapFetchedAt: rdap?.fetchedAt,
+        rdapFetchedAt: projectedRdapRecord.fetchedAt,
         whoisParsed,
         whoisStatus: whoisDiagnostics?.status,
-        whoisQueriedAt: recordOrNull(Array.isArray(whois?.chain) ? whois.chain[0] : null)?.queriedAt,
-        registrarRdapParsed,
-        registrarRdapStatus: registrarRdap?.status ?? recordOrNull(rdapDiagnostics?.registrar)?.status,
-        registrarRdapFetchedAt: registrarRdap?.fetchedAt,
+        whoisQueriedAt: projectedWhoisRecord.queriedAt,
     });
-    return {
+    const query = projectLookupEvidenceQuery(body);
+    const availabilityAnalysis = projectLookupEvidenceAvailability(body.availability);
+    const idn = projectedKnownRecord(idnAnalysis, LOOKUP_IDN_ANALYSIS_KEYS);
+    const evidence = {
         schema: LOOKUP_EVIDENCE_SCHEMA,
         schemaVersion: LOOKUP_EVIDENCE_SCHEMA_VERSION,
         generatedAt,
-        application: {
-            name: 'WHOISleuth',
-            version: boundedSemanticVersion(applicationVersion),
-            projectUrl: WHOISLEUTH_SOURCE_REPOSITORY_URL,
-        },
-        query: {
-            submitted: body.query || null,
-            type: body.type || null,
-            inputHostname: body.inputHostname || null,
-            registrableDomain: body.registrableDomain || null,
-            isSubdomain: body.isSubdomain === true,
-        },
-        diagnostics: cloneJson(body.diagnostics),
+        application: buildPortableGeneratorMetadata(applicationVersion),
+        query,
+        diagnostics: projectedDiagnostics,
         sources: {
-            rdap: rdapSource(rdap),
-            whois: whoisSource(whois),
+            rdap: projectedRdap,
+            whois: projectedWhois,
             reverseDns: reverseDnsSource(body.reverseDns),
             network: networkSource(body.networkContext),
             securityTxt: securityTxtSource(body.securityTxt),
             sslbl: sslblSource(body.sslbl),
         },
         analysis: {
-            availability: cloneJson(body.availability),
-            idn: cloneJson(idnAnalysis),
-            registryInsights,
-            registryComparison: compareRegistrySources(rdapParsed, whoisParsed, {
+            availability: availabilityAnalysis,
+            idn,
+            registryInsights: projectLookupEvidenceRegistryInsights(registryInsights),
+            registryComparison: projectLookupEvidencePrivacySafeTree(compareRegistrySources(rdapParsed, whoisParsed, {
                 rdapStatus: rdapDiagnostics?.status,
                 whoisStatus: whoisDiagnostics?.status,
-            }),
-            registrarPublicationComparison: registrarPublicationComparison(body, rdapParsed),
+            })),
+            registrarPublicationComparison: projectLookupEvidencePrivacySafeTree(registrarPublicationComparison(body, rdapParsed)),
         },
     };
+    assertLookupEvidencePortableTree(evidence);
+    return evidence;
 }
 export function evidenceFilename(response, now = Date.now()) {
     const record = recordOrNull(response);