@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/lib/http-intelligence.mjs

@@ -2,15 +2,15 @@
 // by deep availability analysis. This module does not perform network work; it
 // converts the shared safe-fetch trace and selected response metadata into an
 // additive evidence object suitable for API responses and exports.
-import { createObservation } from "./observation.mjs";
-import { MAX_HTTP_EVIDENCE_REDIRECTS } from "./http-evidence-bounds.mjs";
-const MAX_HTTP_PROVENANCE_URL = 2048;
+import { createObservation } from "../packages/evidence/observation.mjs";
+import { MAX_HTTP_ATTEMPTS, MAX_HTTP_ERROR_LENGTH, MAX_HTTP_EVIDENCE_REDIRECTS, MAX_HTTP_PROVENANCE_URL, } from "./http-evidence-bounds.mjs";
+import { HTTP_DELIVERY_LIMITATIONS, HTTP_DELIVERY_METADATA_VERSION, MAX_HTTP_CACHE_SECONDS, MAX_HTTP_DELIVERY_HEADER_BYTES, MAX_HTTP_DELIVERY_TOKENS, } from "./homepage-metadata-contract.mjs";
 const MAX_HTTP_REDIRECTS = MAX_HTTP_EVIDENCE_REDIRECTS;
-const MAX_HTTP_ATTEMPTS = 2;
-const MAX_HTTP_ERROR_LENGTH = 180;
 const MAX_HTTP_HEADER_LENGTH = 1024;
+const MAX_HTTP_DELIVERY_HEADER_LENGTH = MAX_HTTP_DELIVERY_HEADER_BYTES;
 const MAX_CAPTURED_BODY_BYTES = 5 * 1024 * 1024;
 const OBSERVED_HEADER_MARKER = 'observed';
+const HTTP_TOKEN_RE = /^[!#$%&'*+.^_`|~0-9a-z-]+$/u;
 const SECURITY_HEADERS = Object.freeze({
     'strict-transport-security': 'strictTransportSecurity',
     'content-security-policy': 'contentSecurityPolicy',
@@ -60,6 +60,331 @@ function headerValue(headers, name, maxLength = MAX_HTTP_HEADER_LENGTH) {
         return null;
     return boundedString(headers.get(name), maxLength);
 }
+function deliveryHeader(headers, name, maximum = MAX_HTTP_DELIVERY_HEADER_LENGTH) {
+    if (!headers || typeof headers.get !== 'function')
+        return { state: 'not_observed', value: null };
+    let raw;
+    try {
+        raw = headers.get(name);
+    }
+    catch {
+        return { state: 'malformed', value: null };
+    }
+    if (raw === null)
+        return { state: 'not_observed', value: null };
+    if (typeof raw !== 'string' || /[\u0000-\u001f\u007f-\u009f]/u.test(raw))
+        return { state: 'malformed', value: null };
+    if (raw.length > maximum || Buffer.byteLength(raw, 'utf8') > maximum)
+        return { state: 'partial', value: null };
+    const value = raw.trim();
+    return value ? { state: 'observed', value } : { state: 'malformed', value: null };
+}
+function parseContentEncoding(headers) {
+    const header = deliveryHeader(headers, 'content-encoding');
+    if (header.state !== 'observed' || !header.value) {
+        return { status: header.state, codings: [], encoded: null, unknownCodingCount: 0 };
+    }
+    const supplied = header.value.split(',').map((item) => item.trim().toLowerCase());
+    const malformed = supplied.some((item) => !item || !HTTP_TOKEN_RE.test(item));
+    const truncated = supplied.length > MAX_HTTP_DELIVERY_TOKENS;
+    if (malformed)
+        return { status: 'malformed', codings: [], encoded: null, unknownCodingCount: 0 };
+    if (truncated)
+        return { status: 'partial', codings: [], encoded: null, unknownCodingCount: 0 };
+    const unknownCodingCount = supplied.filter((coding) => !['gzip', 'br', 'deflate', 'zstd', 'identity'].includes(coding)).length;
+    const codings = [...new Set(supplied.map((coding) => (['gzip', 'br', 'deflate', 'zstd', 'identity'].includes(coding) ? coding : 'other')))].sort();
+    if (codings.includes('identity') && codings.length > 1) {
+        return { status: 'malformed', codings: [], encoded: null, unknownCodingCount: 0 };
+    }
+    return {
+        status: 'observed',
+        codings,
+        encoded: codings.some((coding) => coding !== 'identity'),
+        unknownCodingCount,
+    };
+}
+function splitCacheControl(value) {
+    const directives = [];
+    let current = '';
+    let quoted = false;
+    let escaped = false;
+    for (const character of value) {
+        if (escaped) {
+            current += character;
+            escaped = false;
+            continue;
+        }
+        if (quoted && character === '\\') {
+            current += character;
+            escaped = true;
+            continue;
+        }
+        if (character === '"') {
+            quoted = !quoted;
+            current += character;
+            continue;
+        }
+        if (character === ',' && !quoted) {
+            directives.push(current.trim());
+            current = '';
+            continue;
+        }
+        current += character;
+    }
+    directives.push(current.trim());
+    return {
+        directives: directives.slice(0, MAX_HTTP_DELIVERY_TOKENS),
+        truncated: directives.length > MAX_HTTP_DELIVERY_TOKENS,
+        malformed: quoted || escaped || directives.some((item) => !item),
+    };
+}
+function cacheSeconds(value, allowQuoted = true) {
+    if (value === null)
+        return null;
+    const quoted = value.startsWith('"') && value.endsWith('"');
+    if (quoted && !allowQuoted)
+        return null;
+    const unquoted = quoted ? value.slice(1, -1) : value;
+    if (!/^\d+$/u.test(unquoted))
+        return null;
+    const parsed = Number(unquoted);
+    return Number.isSafeInteger(parsed) && parsed >= 0 && parsed <= MAX_HTTP_CACHE_SECONDS ? parsed : null;
+}
+function validCacheFieldNameList(value) {
+    if (value === null)
+        return true;
+    if (value.length < 3 || value[0] !== '"' || value.at(-1) !== '"')
+        return false;
+    const fields = value.slice(1, -1).split(',').map((field) => field.trim());
+    return fields.length > 0 && fields.every((field) => Boolean(field) && HTTP_TOKEN_RE.test(field));
+}
+function headerValidity(header, validator) {
+    if (header.state === 'not_observed')
+        return { present: false, valid: null };
+    if (header.state === 'partial')
+        return { present: true, valid: null };
+    return { present: true, valid: header.state === 'observed' && Boolean(header.value && validator(header.value)) };
+}
+function validHttpDate(value) {
+    const months = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+    const weekdays = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+    const longWeekdays = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday'];
+    const time = '([01]\\d|2[0-3]):([0-5]\\d):([0-5]\\d)';
+    const imfFixdate = value.match(new RegExp(`^(${weekdays.join('|')}), (0[1-9]|[12]\\d|3[01]) (${months.join('|')}) (\\d{4}) ${time} GMT$`, 'u'));
+    const rfc850 = value.match(new RegExp(`^(${longWeekdays.join('|')}), (0[1-9]|[12]\\d|3[01])-(${months.join('|')})-(\\d{2}) ${time} GMT$`, 'u'));
+    const asctime = value.match(new RegExp(`^(${weekdays.join('|')}) (${months.join('|')}) ( {2}[1-9]| [12]\\d| 3[01]) ${time} (\\d{4})$`, 'u'));
+    let weekday;
+    let day;
+    let month;
+    let year;
+    let hour;
+    let minute;
+    let second;
+    let expectedWeekdays;
+    if (imfFixdate) {
+        weekday = imfFixdate[1];
+        day = Number(imfFixdate[2]);
+        month = months.indexOf(imfFixdate[3]);
+        year = Number(imfFixdate[4]);
+        hour = Number(imfFixdate[5]);
+        minute = Number(imfFixdate[6]);
+        second = Number(imfFixdate[7]);
+        expectedWeekdays = weekdays;
+    }
+    else if (rfc850) {
+        weekday = rfc850[1];
+        day = Number(rfc850[2]);
+        month = months.indexOf(rfc850[3]);
+        const shortYear = Number(rfc850[4]);
+        year = shortYear >= 70 ? 1900 + shortYear : 2000 + shortYear;
+        hour = Number(rfc850[5]);
+        minute = Number(rfc850[6]);
+        second = Number(rfc850[7]);
+        expectedWeekdays = longWeekdays;
+    }
+    else if (asctime) {
+        weekday = asctime[1];
+        month = months.indexOf(asctime[2]);
+        day = Number(asctime[3].trim());
+        hour = Number(asctime[4]);
+        minute = Number(asctime[5]);
+        second = Number(asctime[6]);
+        year = Number(asctime[7]);
+        expectedWeekdays = weekdays;
+    }
+    else
+        return false;
+    if (year < 1601 || month < 0)
+        return false;
+    const parsed = new Date(0);
+    parsed.setUTCFullYear(year, month, day);
+    parsed.setUTCHours(hour, minute, second, 0);
+    return parsed.getUTCFullYear() === year
+        && parsed.getUTCMonth() === month
+        && parsed.getUTCDate() === day
+        && expectedWeekdays[parsed.getUTCDay()] === weekday;
+}
+function parseCachePolicy(headers) {
+    const cacheControl = deliveryHeader(headers, 'cache-control');
+    const age = deliveryHeader(headers, 'age', 64);
+    const etagHeader = deliveryHeader(headers, 'etag');
+    const lastModifiedHeader = deliveryHeader(headers, 'last-modified');
+    const expiresHeader = deliveryHeader(headers, 'expires');
+    const parsed = cacheControl.state === 'observed' && cacheControl.value
+        ? splitCacheControl(cacheControl.value)
+        : { directives: [], truncated: false, malformed: false };
+    const flags = {
+        noStore: false,
+        noCache: false,
+        mustRevalidate: false,
+        public: false,
+        private: false,
+        immutable: false,
+    };
+    let maxAgeSeconds = null;
+    let sMaxAgeSeconds = null;
+    let maxAgeSeen = false;
+    let sMaxAgeSeen = false;
+    let maxAgeMalformed = false;
+    let sMaxAgeMalformed = false;
+    let unknownDirectiveCount = 0;
+    let malformed = parsed.malformed;
+    for (const directive of parsed.truncated ? [] : parsed.directives) {
+        const separator = directive.indexOf('=');
+        const name = (separator === -1 ? directive : directive.slice(0, separator)).trim().toLowerCase();
+        const value = separator === -1 ? null : directive.slice(separator + 1).trim();
+        if (!HTTP_TOKEN_RE.test(name)) {
+            malformed = true;
+            continue;
+        }
+        if (name === 'no-store') {
+            flags.noStore = true;
+            if (value !== null)
+                malformed = true;
+        }
+        else if (name === 'no-cache') {
+            flags.noCache = true;
+            if (!validCacheFieldNameList(value))
+                malformed = true;
+        }
+        else if (name === 'must-revalidate') {
+            flags.mustRevalidate = true;
+            if (value !== null)
+                malformed = true;
+        }
+        else if (name === 'public') {
+            flags.public = true;
+            if (value !== null)
+                malformed = true;
+        }
+        else if (name === 'private') {
+            flags.private = true;
+            if (!validCacheFieldNameList(value))
+                malformed = true;
+        }
+        else if (name === 'immutable') {
+            flags.immutable = true;
+            if (value !== null)
+                malformed = true;
+        }
+        else if (name === 'max-age') {
+            const parsedSeconds = cacheSeconds(value);
+            if (parsedSeconds === null || maxAgeSeen && parsedSeconds !== maxAgeSeconds) {
+                malformed = true;
+                maxAgeMalformed = true;
+                maxAgeSeconds = null;
+            }
+            else if (!maxAgeMalformed)
+                maxAgeSeconds = parsedSeconds;
+            maxAgeSeen = true;
+        }
+        else if (name === 's-maxage') {
+            const parsedSeconds = cacheSeconds(value);
+            if (parsedSeconds === null || sMaxAgeSeen && parsedSeconds !== sMaxAgeSeconds) {
+                malformed = true;
+                sMaxAgeMalformed = true;
+                sMaxAgeSeconds = null;
+            }
+            else if (!sMaxAgeMalformed)
+                sMaxAgeSeconds = parsedSeconds;
+            sMaxAgeSeen = true;
+        }
+        else
+            unknownDirectiveCount += 1;
+    }
+    if (parsed.truncated) {
+        flags.noStore = false;
+        flags.noCache = false;
+        flags.mustRevalidate = false;
+        flags.public = false;
+        flags.private = false;
+        flags.immutable = false;
+        maxAgeSeconds = null;
+        sMaxAgeSeconds = null;
+        maxAgeSeen = false;
+        sMaxAgeSeen = false;
+        unknownDirectiveCount = 0;
+    }
+    const ageSeconds = age.state === 'observed' ? cacheSeconds(age.value, false) : null;
+    if (age.state === 'observed' && ageSeconds === null)
+        malformed = true;
+    const etag = headerValidity(etagHeader, (value) => /^(?:W\/)?"[\x21\x23-\x7e]*"$/u.test(value));
+    const lastModified = headerValidity(lastModifiedHeader, validHttpDate);
+    const expires = headerValidity(expiresHeader, validHttpDate);
+    malformed = malformed || [etag, lastModified, expires].some((item) => item.present && item.valid === false);
+    const headersObserved = [cacheControl, age, etagHeader, lastModifiedHeader, expiresHeader]
+        .some((header) => header.state !== 'not_observed');
+    const partial = parsed.truncated || [cacheControl, age, etagHeader, lastModifiedHeader, expiresHeader]
+        .some((header) => header.state === 'partial');
+    malformed = malformed || [cacheControl, age, etagHeader, lastModifiedHeader, expiresHeader]
+        .some((header) => header.state === 'malformed');
+    const status = partial
+        ? 'partial'
+        : malformed
+            ? 'malformed'
+            : headersObserved ? 'observed' : 'not_observed';
+    return {
+        value: {
+            status,
+            ...flags,
+            maxAgeSeconds,
+            sMaxAgeSeconds,
+            ageSeconds,
+            maxAgePresent: maxAgeSeen,
+            sMaxAgePresent: sMaxAgeSeen,
+            agePresent: age.state !== 'not_observed',
+            unknownDirectiveCount,
+            etag,
+            lastModified,
+            expires,
+        },
+        malformed,
+        truncated: partial,
+    };
+}
+function buildDeliveryMetadata(headers) {
+    const contentEncoding = parseContentEncoding(headers);
+    const cacheResult = parseCachePolicy(headers);
+    const cachePolicy = cacheResult.value;
+    const incomplete = [contentEncoding.status, cachePolicy.status].some((status) => ['partial', 'malformed'].includes(status));
+    const truncated = contentEncoding.status === 'partial' || cacheResult.truncated;
+    const limitations = [
+        HTTP_DELIVERY_LIMITATIONS.scope,
+    ];
+    if (truncated)
+        limitations.push(HTTP_DELIVERY_LIMITATIONS.bounds);
+    if (contentEncoding.status === 'malformed' || cacheResult.malformed)
+        limitations.push(HTTP_DELIVERY_LIMITATIONS.malformed);
+    return {
+        version: HTTP_DELIVERY_METADATA_VERSION,
+        status: incomplete ? 'partial' : 'success',
+        complete: !incomplete,
+        truncated,
+        limitations,
+        contentEncoding,
+        cachePolicy,
+    };
+}
 function declaredContentLength(headers) {
     const raw = headerValue(headers, 'content-length', 32);
     if (!raw || !/^\d+$/.test(raw))
@@ -181,6 +506,7 @@ function buildHttpObservation(detail, options = {}) {
                 bytes: capturedBodyBytes,
             } : null,
             securityHeaders: securityHeaders(response && response.headers),
+            deliveryMetadata: buildDeliveryMetadata(response && response.headers),
         },
     };
 }
@@ -230,4 +556,4 @@ function skippedHttpObservation() {
         response: null,
     };
 }
-export { MAX_HTTP_PROVENANCE_URL, MAX_HTTP_REDIRECTS, MAX_HTTP_ATTEMPTS, normalizeProvenanceUrl, buildHttpObservation, failedHttpObservation, skippedHttpObservation, };
+export { MAX_HTTP_ERROR_LENGTH, MAX_HTTP_PROVENANCE_URL, MAX_HTTP_REDIRECTS, MAX_HTTP_ATTEMPTS, HTTP_DELIVERY_METADATA_VERSION, MAX_HTTP_DELIVERY_HEADER_LENGTH, MAX_HTTP_DELIVERY_TOKENS, normalizeProvenanceUrl, buildHttpObservation, failedHttpObservation, skippedHttpObservation, };

package/lib/interchange-fidelity-registry.mjs

@@ -0,0 +1,124 @@
+import { DOMAIN_CONTROL_MANIFEST_COMPATIBILITY } from "../packages/contracts/domain-control-manifest.mjs";
+import { CLI_CASE_PACK_COMPATIBILITY, ENCRYPTED_WORKSPACE_ARCHIVE_COMPATIBILITY, WORKSPACE_ARCHIVE_COMPATIBILITY, } from "../packages/contracts/case-portability.mjs";
+import { LOOKUP_CLAIM_PASSPORT_COMPATIBILITY } from "../packages/contracts/investigation-portability.mjs";
+import { BRAND_PROFILE_EXPORT_COMPATIBILITY } from "../packages/contracts/workspace-portability.mjs";
+import { LOOKUP_EVIDENCE_COMPATIBILITY } from "./evidence-export.mjs";
+const exact = Object.freeze(['domain_identity', 'dns_control_expectations', 'certificate_control_expectations', 'registrar_control_expectations', 'renewal_review']);
+function compatibilityReference(descriptor) {
+    if (!descriptor.schema || descriptor.futureVersionBehavior !== 'reject') {
+        throw new TypeError(`Interchange compatibility ${descriptor.id} must name a schema and reject future versions.`);
+    }
+    return Object.freeze({
+        compatibilityEntryId: descriptor.id,
+        schema: descriptor.schema,
+        versions: descriptor.supportedVersions,
+        futureVersionBehaviour: 'reject',
+    });
+}
+export const INTERCHANGE_ARTIFACT_CONTRACTS = Object.freeze([
+    Object.freeze({
+        id: 'lookup_claim_passport',
+        ...compatibilityReference(LOOKUP_CLAIM_PASSPORT_COMPATIBILITY),
+        versionField: 'version',
+        nestedSchemaPath: Object.freeze([]),
+        browser: Object.freeze({ import: 'unsupported', export: 'supported' }),
+        cli: Object.freeze({ read: 'supported', write: 'unsupported', verify: 'supported' }),
+        fidelity: 'semantic_exact_after_normalisation',
+        requiredAssurance: 'whole_integrity',
+        preservedFieldGroups: Object.freeze(['target_identity', 'claim_identity', 'evidence_requirement_ids', 'source_states', 'observation_times', 'model_versions', 'limitations']),
+        excludedFieldGroups: Object.freeze(['raw_registry_payloads', 'contacts', 'page_values', 'request_paths', 'credentials', 'browser_local_records', 'signer_authentication']),
+    }),
+    Object.freeze({
+        id: 'lookup_evidence',
+        ...compatibilityReference(LOOKUP_EVIDENCE_COMPATIBILITY),
+        versionField: 'schemaVersion',
+        nestedSchemaPath: Object.freeze([]),
+        browser: Object.freeze({ import: 'supported', export: 'supported' }),
+        cli: Object.freeze({ read: 'supported', write: 'supported', verify: 'supported' }),
+        fidelity: 'lossy_by_design',
+        requiredAssurance: 'structure',
+        preservedFieldGroups: Object.freeze(['query_context', 'generator_metadata', 'source_health', 'normalised_registration_evidence', 'bounded_replay_facts', 'observation_times', 'limitations']),
+        excludedFieldGroups: Object.freeze(['browser_local_records', 'case_context', 'brand_profiles', 'credentials', 'session_material', 'request_headers', 'cookies', 'signer_authentication', 'raw_payload_rendering_during_replay']),
+    }),
+    Object.freeze({
+        id: 'domain_control_passport',
+        ...compatibilityReference(DOMAIN_CONTROL_MANIFEST_COMPATIBILITY),
+        versionField: 'version',
+        nestedSchemaPath: Object.freeze([]),
+        browser: Object.freeze({ import: 'supported', export: 'supported' }),
+        cli: Object.freeze({ read: 'supported', write: 'supported', verify: 'supported' }),
+        fidelity: 'normalised_merge',
+        requiredAssurance: 'whole_integrity',
+        preservedFieldGroups: exact,
+        excludedFieldGroups: Object.freeze(['profile_identity', 'brand_context', 'contacts', 'notes', 'observations', 'planning_context', 'suppression_context']),
+    }),
+    Object.freeze({
+        id: 'brand_profiles',
+        ...compatibilityReference(BRAND_PROFILE_EXPORT_COMPATIBILITY),
+        versionField: 'version',
+        nestedSchemaPath: Object.freeze([]),
+        browser: Object.freeze({ import: 'supported', export: 'supported' }),
+        cli: Object.freeze({ read: 'supported', write: 'unsupported', verify: 'verification_only' }),
+        fidelity: 'normalised_merge',
+        requiredAssurance: 'structure',
+        preservedFieldGroups: Object.freeze(['profile_identity', 'brand_context', 'domain_scope', 'mail_posture', 'desired_posture', 'reviewed_planning', 'retained_observations']),
+        excludedFieldGroups: Object.freeze(['login_sessions', 'credentials', 'raw_upstream_payloads']),
+    }),
+    Object.freeze({
+        id: 'workspace',
+        ...compatibilityReference(WORKSPACE_ARCHIVE_COMPATIBILITY),
+        versionField: 'version',
+        nestedSchemaPath: Object.freeze([]),
+        browser: Object.freeze({ import: 'supported', export: 'supported' }),
+        cli: Object.freeze({ read: 'verification_only', write: 'unsupported', verify: 'supported' }),
+        fidelity: 'normalised_merge',
+        requiredAssurance: 'applicable_integrity',
+        preservedFieldGroups: Object.freeze(['supported_workspace_sections', 'section_versions', 'section_checksums', 'merge_metadata', 'analyst_review_lifecycle']),
+        excludedFieldGroups: Object.freeze(['login_sessions', 'credentials', 'hosted_monitor_keys', 'raw_upstream_payloads', 'tab_state', 'certificate_transparency_history']),
+    }),
+    Object.freeze({
+        id: 'encrypted_workspace',
+        ...compatibilityReference(ENCRYPTED_WORKSPACE_ARCHIVE_COMPATIBILITY),
+        versionField: 'version',
+        nestedSchemaPath: Object.freeze([]),
+        browser: Object.freeze({ import: 'supported', export: 'supported' }),
+        cli: Object.freeze({ read: 'verification_only', write: 'unsupported', verify: 'supported' }),
+        fidelity: 'verification_only',
+        requiredAssurance: 'authenticated_whole_integrity',
+        preservedFieldGroups: Object.freeze(['encrypted_workspace_envelope', 'authenticated_ciphertext', 'inner_workspace_after_decryption']),
+        excludedFieldGroups: Object.freeze(['passphrase', 'derived_key']),
+    }),
+    Object.freeze({
+        id: 'case_pack',
+        ...compatibilityReference(CLI_CASE_PACK_COMPATIBILITY),
+        versionField: 'version',
+        nestedSchemaPath: Object.freeze(['packet']),
+        browser: Object.freeze({ import: 'supported', export: 'unsupported' }),
+        cli: Object.freeze({ read: 'supported', write: 'supported', verify: 'supported' }),
+        fidelity: 'lossy_by_design',
+        requiredAssurance: 'whole_integrity',
+        preservedFieldGroups: Object.freeze(['redacted_case_collection', 'case_schema_version', 'trusted_internal_case_brand_profile_references']),
+        excludedFieldGroups: Object.freeze(['package_reports', 'package_redaction_manifest', 'package_integrity_envelope', 'audience_excluded_case_fields', 'public_audience_case_brand_profile_references']),
+    }),
+    Object.freeze({
+        id: 'legacy_desired_baseline',
+        compatibilityEntryId: null,
+        schema: 'whoisleuth.desired-posture-baseline',
+        versions: Object.freeze([1]),
+        versionField: 'schemaVersion',
+        nestedSchemaPath: Object.freeze([]),
+        browser: Object.freeze({ import: 'unsupported', export: 'unsupported' }),
+        cli: Object.freeze({ read: 'unsupported', write: 'unsupported', verify: 'unsupported' }),
+        fidelity: 'unsupported',
+        requiredAssurance: 'unsupported',
+        preservedFieldGroups: Object.freeze([]),
+        excludedFieldGroups: Object.freeze(['entire_legacy_document']),
+        futureVersionBehaviour: 'reject',
+    }),
+]);
+export function interchangeContractFor(id) {
+    const contract = INTERCHANGE_ARTIFACT_CONTRACTS.find((item) => item.id === id);
+    if (!contract)
+        throw new TypeError('Interchange contract is not registered.');
+    return contract;
+}

package/lib/local-geoip-evidence.mjs

@@ -64,8 +64,9 @@ function lookupLocalGeoIp(database, address) {
         return Object.freeze({ state: 'invalid', address: null, match: null, source: null, limitations: Object.freeze([]) });
     }
     const match = database.records.find((item) => prefixContains(item.parsedNetwork, target)) ?? null;
+    const incomplete = database.truncated || database.rejectedCount > 0;
     return Object.freeze({
-        state: match ? database.truncated || database.rejectedCount > 0 ? 'partial' : 'matched' : 'not_found',
+        state: match ? incomplete ? 'partial' : 'matched' : incomplete ? 'partial' : 'not_found',
         address: normalized,
         match: match ? Object.freeze({
             network: match.network,

package/lib/lookup-cache.mjs

@@ -18,10 +18,12 @@ const SWEEP_INTERVAL_MS = 5 * 60 * 1000;
 // RDAP/WHOIS response, before the next sweep has a chance to run; repeated
 // or concurrent large scans compound that. `Map` preserves insertion
 // order, so the oldest entry is always `store.keys().next().value` -
-// simple FIFO eviction, not a full LRU (re-caching an existing key doesn't
-// move it), which is a fine fit for a cache whose primary job is
-// deduplicating near-simultaneous repeat lookups within a few minutes, not
-// long-term hit-rate optimization.
+// simple FIFO eviction by expiry, not a full LRU (a cache *hit* doesn't
+// move an entry). Re-caching a key does move it, because setCached deletes
+// the key before re-inserting it, which keeps insertion order aligned with
+// the refreshed expiresAt. That is a fine fit for a cache whose primary job
+// is deduplicating near-simultaneous repeat lookups within a few minutes,
+// not long-term hit-rate optimization.
 const MAX_ENTRIES = 3000;
 // MAX_ENTRIES alone bounds count, not size - it doesn't stop a hostile or
 // compromised registry from serving a near-maximum-size response (RDAP:

package/lib/lookup-network-evidence-bounds.mjs

@@ -0,0 +1,9 @@
+// Browser-safe collection bounds shared by the network evidence producers,
+// the Lookup response trust boundary, and the display projection.
+export const MAX_LOOKUP_DNS_RECORDS_PER_TYPE = 16;
+export const MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS = 8;
+export const MAX_LOOKUP_TLS_CHAIN_CERTIFICATES = 8;
+export const MAX_LOOKUP_TLS_ALT_NAMES = 50;
+export const MAX_LOOKUP_TLS_NAME_VALUES = 4;
+export const MAX_LOOKUP_TLS_FINDINGS = 5;
+export const MAX_LOOKUP_TLS_CERTIFICATE_POLICIES = 16;

package/lib/lookup.mjs

@@ -21,6 +21,7 @@ import { lookupUrlhausDomain } from "./urlhaus-intelligence.mjs";
 import { lookupThreatfoxDomain } from "./threatfox-intelligence.mjs";
 import { THREATFOX_PROVIDER, URLHAUS_PROVIDER, URLSCAN_PROVIDER, } from "./lookup-threat-provider-inventory.mjs";
 import { createThreatIntelligenceResult } from "./threat-intelligence-contract.mjs";
+import { THREAT_INTELLIGENCE_ENVELOPE_VERSION } from "./threat-intelligence-types.mjs";
 import { buildRegistryInsights } from "./registry-insights.mjs";
 import { inspectSslblCertificate } from "./sslbl-intelligence.mjs";
 import { normalizeLookupSourceSettlement, plannedLookupProgressSources, } from "./lookup-source-progress.mjs";
@@ -67,6 +68,24 @@ function boundedSourceDetail(err, fallback) {
         .trim()
         .slice(0, 240) || fallback;
 }
+function withoutNestedPublicationMetadata(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const output = { ...value };
+    delete output.publicationMetadata;
+    return output;
+}
+function withoutNestedDeliveryMetadata(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const output = { ...value };
+    if (output.response && typeof output.response === 'object' && !Array.isArray(output.response)) {
+        const response = { ...output.response };
+        delete response.deliveryMetadata;
+        output.response = response;
+    }
+    return output;
+}
 function boundedTimingMs(value) {
     if (!Number.isFinite(value))
         return 0;
@@ -167,6 +186,8 @@ async function runUnifiedLookup(classified, options = {}) {
             includeExtendedDnsContext: !compact,
             includeInheritedCaa: !fast && !compact,
             includeCredentialSurfaceProfile: !fast && !compact,
+            includePublicationMetadata: !fast && !compact,
+            includeDeliveryMetadata: !fast && !compact,
             includeStructuredDataIdentity: !fast && !compact,
             includeTechnologyProfile: !fast,
             includeSecurityPosture: !compact,
@@ -320,7 +341,7 @@ async function runUnifiedLookup(classified, options = {}) {
             ? { ...rdapRecord, ...(registrarRdap ? { registrarRdap } : {}) }
             : {
                 error: rdapResult.status === 'rejected'
-                    ? errorMessage(rdapResult.reason, 'RDAP lookup failed')
+                    ? boundedSourceDetail(rdapResult.reason, 'RDAP lookup failed')
                     : 'No RDAP registry found for this query via IANA bootstrap',
                 attempts: rdapAttempts,
             };
@@ -337,7 +358,7 @@ async function runUnifiedLookup(classified, options = {}) {
     else {
         whois = {
             error: whoisResult.status === 'rejected'
-                ? errorMessage(whoisResult.reason, 'WHOIS lookup failed')
+                ? boundedSourceDetail(whoisResult.reason, 'WHOIS lookup failed')
                 : 'WHOIS returned no referral chain',
         };
     }
@@ -528,10 +549,12 @@ async function runUnifiedLookup(classified, options = {}) {
         const bulkComparison = !fast
             ? buildBulkComparisonEvidence(availability)
             : null;
-        const { credentialSurfaceProfile: _credentialSurfaceProfile, structuredDataIdentity: _structuredDataIdentity, technologyProfile: _technologyProfile, pageRoleProfile: _pageRoleProfile, clientBehaviorProfile: _clientBehaviorProfile, securityPosture: _securityPosture, ...compactAvailability } = availability;
+        const { credentialSurfaceProfile: _credentialSurfaceProfile, structuredDataIdentity: _structuredDataIdentity, technologyProfile: _technologyProfile, pageRoleProfile: _pageRoleProfile, clientBehaviorProfile: _clientBehaviorProfile, securityPosture: _securityPosture, pageIdentity: richPageIdentity, http: richHttp, ...compactAvailability } = availability;
         return {
             availability: {
                 ...compactAvailability,
+                ...(richPageIdentity !== undefined ? { pageIdentity: withoutNestedPublicationMetadata(richPageIdentity) } : {}),
+                ...(richHttp !== undefined ? { http: withoutNestedDeliveryMetadata(richHttp) } : {}),
                 ...(bulkComparison ? { bulkComparison } : {}),
             },
             diagnostics,
@@ -555,7 +578,7 @@ async function runUnifiedLookup(classified, options = {}) {
             : createThreatIntelligenceResult(THREATFOX_PROVIDER, { type: 'domain', value: targetDomain }, { state: 'error', detail: 'Malware-IOC intelligence could not be completed.' }));
     }
     const threatIntelligence = threatIntelligenceProviders.length
-        ? { version: 1, providers: threatIntelligenceProviders }
+        ? { version: THREAT_INTELLIGENCE_ENVELOPE_VERSION, providers: threatIntelligenceProviders }
         : null;
     const registrarRdapParsed = registrarRdap
         && typeof registrarRdap.parsed === 'object'

package/lib/observed-network-context.mjs

@@ -4,7 +4,7 @@
 // evidence. It performs one logical IP RDAP enrichment through the existing
 // cached, SSRF-safe RDAP boundary and never participates in domain availability.
 import * as net from 'node:net';
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 import { fetchRdapRecord } from "./rdap.mjs";
 import { isPrivateAddress } from "./safe-fetch.mjs";
 const OBSERVED_NETWORK_CONTEXT_VERSION = 1;

package/lib/outbound-identity.mjs

@@ -1,8 +1,7 @@
-import packageDocument from '../package.json' with { type: 'json' };
+import { WHOISLEUTH_APPLICATION_VERSION } from "./application-version.mjs";
 import { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL, } from "./project-metadata.mjs";
-import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
 export { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL };
-export const WHOISLEUTH_USER_AGENT_VERSION = normalizeBoundedSemanticVersion(packageDocument.version, 'Application manifest');
+export const WHOISLEUTH_USER_AGENT_VERSION = WHOISLEUTH_APPLICATION_VERSION;
 export const WHOISLEUTH_USER_AGENT = `WHOISleuth/${WHOISLEUTH_USER_AGENT_VERSION} (+${WHOISLEUTH_REQUEST_POLICY_URL})`;
 export function whoisleuthRequestHeaders(headers = {}) {
     return { ...headers, 'User-Agent': WHOISLEUTH_USER_AGENT };

package/lib/page-fingerprints.mjs

@@ -13,8 +13,8 @@ const MAX_FORM_FINGERPRINTS = 50;
 const MAX_FORM_CONTROLS = 500;
 const MAX_RESOURCE_HOSTS = 30;
 const MAX_IDENTIFIER_VALUES = 30;
-const CONTROL_RE = /[\u0000-\u001f\u007f]/g;
-const HAS_CONTROL_RE = /[\u0000-\u001f\u007f]/;
+const CONTROL_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/gu;
+const HAS_CONTROL_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/u;
 const COMMENT_RE = /<!--[\s\S]*?(?:-->|$)/g;
 const RAW_BODY_RE = /<(script|style|noscript|textarea|template)\b([^>]*)>[\s\S]*?(?:<\/\1\s*>|$)/gi;
 const MARKUP_TOKEN_RE = /<\/?[A-Za-z][A-Za-z0-9:-]*\b[^>]*>|[^<]+/g;

package/lib/page-role-profile.mjs

@@ -2,7 +2,7 @@
 // captured by Deep Lookup. The classifier emits fixed labels and evidence
 // descriptions only; it does not retain page text, arbitrary attributes, URLs,
 // or matched markup, and it never treats a role as proof of intent or safety.
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 import { analyzeStaticHtml, } from "./static-html-analysis.mjs";
 const PAGE_ROLE_PROFILE_VERSION = 1;
 const MAX_PAGE_ROLE_FINDINGS = 4;