@slicedearth/whoisleuth-cli 1.47.4 → 2.0.0

package/cli/formatters/terminal.mjs

@@ -1,6 +1,15 @@
 import { registryAccessProfileLabel } from "../registry-access.mjs";
 import { unicodeDomainFromAscii } from "../../lib/idn-confusables.mjs";
+import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "../../lib/homepage-metadata-contract.mjs";
 const MAX_TERMINAL_VALUE_LENGTH = 240;
+const MAX_LOOKUP_TERMINAL_RECORDS = 5;
+const MAX_LOOKUP_TERMINAL_NAMES = 5;
+const MAX_LOOKUP_TERMINAL_ALPN_IDS = 4;
+const MAX_LOOKUP_TERMINAL_ALPN_ID_LENGTH = 32;
+const MAX_LOOKUP_TERMINAL_LIMITATIONS = 3;
+const MAX_LOOKUP_TERMINAL_CIDRS = 5;
+const MAX_LOOKUP_TERMINAL_FINDINGS = 5;
+const MAX_LOOKUP_TERMINAL_ABUSE_ROUTES = 6;
 const MAX_CT_TERMINAL_MATCHES = 100;
 const MAX_CT_TERMINAL_HOSTNAMES = 5;
 const MAX_DISCOVER_TERMINAL_CANDIDATES = 200;
@@ -8,15 +17,49 @@ const MAX_POSTURE_TERMINAL_RECORDS = 5;
 const MAX_TLS_TERMINAL_ALT_NAMES = 10;
 const MAX_TLS_TERMINAL_PURPOSES = 8;
 const MAX_RISK_CALIBRATION_TERMINAL_RECORDS = 100;
+// Archive values are attacker-controlled evidence. Remove the complete Unicode
+// default-ignorable class so visually identical identifiers cannot differ only
+// through soft hyphens, combining grapheme joiners, variation selectors, tag
+// characters, bidi controls, or other zero-width formatting code points.
+const TERMINAL_DEFAULT_IGNORABLE_RE = /\p{Default_Ignorable_Code_Point}/gu;
 function safeTerminalValue(value, fallback = '—') {
     if (value === null || value === undefined || value === '')
         return fallback;
     const normalized = String(value)
-        .replace(/[\x00-\x1f\x7f]+/g, ' ')
+        .replace(/[\x00-\x1f\x7f-\x9f]+/g, ' ')
+        .replace(TERMINAL_DEFAULT_IGNORABLE_RE, '')
         .replace(/\s+/g, ' ')
-        .trim()
-        .slice(0, MAX_TERMINAL_VALUE_LENGTH);
-    return normalized || fallback;
+        .trim();
+    if (!normalized)
+        return fallback;
+    return normalized.length > MAX_TERMINAL_VALUE_LENGTH
+        ? `${normalized.slice(0, MAX_TERMINAL_VALUE_LENGTH - 1)}…`
+        : normalized;
+}
+function boundedTerminalList(values, omitted) {
+    const suffix = omitted > 0 ? ` · +${omitted} more` : '';
+    const maximumBodyLength = Math.max(1, MAX_TERMINAL_VALUE_LENGTH - suffix.length);
+    const joined = values.join(', ');
+    const body = joined.length > maximumBodyLength
+        ? `${joined.slice(0, Math.max(0, maximumBodyLength - 1))}…`
+        : joined;
+    return `${body}${suffix}`;
+}
+function boundedTerminalComponent(value, maximum) {
+    const normalized = safeTerminalValue(value);
+    return normalized.length > maximum ? `${normalized.slice(0, Math.max(0, maximum - 1))}…` : normalized;
+}
+function boundedTerminalWithSuffix(value, suffix) {
+    if (!suffix)
+        return safeTerminalValue(value);
+    const retainedSuffix = suffix.length >= MAX_TERMINAL_VALUE_LENGTH
+        ? `${suffix.slice(0, MAX_TERMINAL_VALUE_LENGTH - 1)}…`
+        : suffix;
+    const maximumValueLength = Math.max(1, MAX_TERMINAL_VALUE_LENGTH - retainedSuffix.length);
+    const retainedValue = value.length > maximumValueLength
+        ? `${value.slice(0, Math.max(0, maximumValueLength - 1))}…`
+        : value;
+    return `${retainedValue}${retainedSuffix}`;
 }
 function titleCase(value) {
     const text = safeTerminalValue(value, 'unknown').replaceAll('_', ' ');
@@ -31,14 +74,76 @@ function terminalCount(value) {
     const count = Number(value);
     return Number.isSafeInteger(count) && count >= 0 ? Math.min(count, 999) : 0;
 }
+function terminalDisplayCount(value) {
+    const count = Number(value);
+    return Number.isSafeInteger(count) && count >= 0 ? String(count) : '0';
+}
 function terminalCountSummary(value, labels) {
     const source = terminalRecord(value);
     return labels
-        .map(([key, label]) => [label, terminalCount(source[key])])
+        .map(([key, label]) => {
+        const count = Number(source[key]);
+        return [label, Number.isSafeInteger(count) && count >= 0 ? count : 0];
+    })
         .filter(([, count]) => count > 0)
-        .map(([label, count]) => `${label} ${count}`)
+        .map(([label, count]) => `${label} ${terminalDisplayCount(count)}`)
         .join(', ');
 }
+function appendPublicationMetadataLines(lines, value, detail) {
+    if (detail === 'summary' || !validPagePublicationMetadata(value))
+        return;
+    const metadata = terminalRecord(value);
+    const robots = terminalRecord(metadata.robots);
+    const twitter = terminalRecord(metadata.twitterCard);
+    const headings = terminalRecord(metadata.headings);
+    const images = terminalRecord(metadata.images);
+    const blocking = terminalRecord(metadata.renderBlockingCandidates);
+    lines.push(`Publication    ${metadata.complete === true ? 'Complete' : 'Partial'} · robots ${titleCase(robots.status)} · card ${titleCase(twitter.status)}`);
+    const directives = Array.isArray(robots.directives) ? robots.directives.map((item) => safeTerminalValue(item)) : [];
+    if (directives.length)
+        lines.push(`Robots         ${safeTerminalValue(directives.join(', '))}${robots.conflicting === true ? ' · conflicting' : ''}`);
+    else if (robots.status === 'not_observed')
+        lines.push('Robots         No declaration observed in captured static HTML');
+    if (twitter.cardType)
+        lines.push(`Card type      ${safeTerminalValue(twitter.cardType)}`);
+    lines.push(`Static page    headings ${terminalDisplayCount(headings.total)} · images ${terminalDisplayCount(images.total)} · blocking candidates ${terminalDisplayCount(blocking.total)}`);
+    if (detail === 'verbose') {
+        lines.push(`Image alt      missing ${terminalDisplayCount(images.altMissing)} · empty ${terminalDisplayCount(images.altEmpty)} · non-empty ${terminalDisplayCount(images.altNonEmpty)} · unclassified ${terminalDisplayCount(images.altUnclassified)}`);
+        lines.push(`Blocking       scripts ${terminalDisplayCount(blocking.script)} · stylesheets ${terminalDisplayCount(blocking.stylesheet)} · static candidates only`);
+    }
+}
+function appendDeliveryMetadataLines(lines, value, verbose = false) {
+    if (!validHttpDeliveryMetadata(value))
+        return;
+    const metadata = terminalRecord(value);
+    const encoding = terminalRecord(metadata.contentEncoding);
+    const cache = terminalRecord(metadata.cachePolicy);
+    const codings = Array.isArray(encoding.codings) ? encoding.codings.map((item) => safeTerminalValue(item)) : [];
+    lines.push(`Delivery       ${metadata.complete === true ? 'Complete' : 'Partial'} · encoding ${titleCase(encoding.status)} · cache ${titleCase(cache.status)}`);
+    if (codings.length)
+        lines.push(`Content coding ${safeTerminalValue(codings.join(', '))}`);
+    const cacheDirectives = [
+        ['no-store', cache.noStore], ['no-cache', cache.noCache], ['must-revalidate', cache.mustRevalidate],
+        ['public', cache.public], ['private', cache.private], ['immutable', cache.immutable],
+    ].filter(([, present]) => present === true).map(([label]) => label);
+    if (cacheDirectives.length)
+        lines.push(`Cache policy   ${safeTerminalValue(cacheDirectives.join(', '))}`);
+    if (verbose) {
+        const seconds = [
+            cache.maxAgeSeconds === null ? null : `max-age ${terminalDisplayCount(cache.maxAgeSeconds)}s`,
+            cache.sMaxAgeSeconds === null ? null : `s-maxage ${terminalDisplayCount(cache.sMaxAgeSeconds)}s`,
+            cache.ageSeconds === null ? null : `Age ${terminalDisplayCount(cache.ageSeconds)}s`,
+        ].filter(Boolean);
+        if (seconds.length)
+            lines.push(`Cache timing   ${safeTerminalValue(seconds.join(' · '))}`);
+        const declared = [
+            terminalRecord(cache.etag).present === true ? 'ETag' : null,
+            terminalRecord(cache.lastModified).present === true ? 'Last-Modified' : null,
+            terminalRecord(cache.expires).present === true ? 'Expires' : null,
+        ].filter(Boolean);
+        lines.push(`Validators     ${declared.length ? safeTerminalValue(declared.join(', ')) : 'No validator declaration observed'}`);
+    }
+}
 function appendSection(lines, label, values) {
     if (!values.length)
         return;
@@ -46,6 +151,197 @@ function appendSection(lines, label, values) {
         lines.push('');
     lines.push(`${label}:`, ...values);
 }
+function formatLookupDnsRecord(value) {
+    if (typeof value === 'string' || typeof value === 'number')
+        return safeTerminalValue(value);
+    const record = terminalRecord(value);
+    if (!Object.keys(record).length)
+        return null;
+    if ('exchange' in record) {
+        return safeTerminalValue(`${safeTerminalValue(record.priority, '0')} ${record.exchange ? safeTerminalValue(record.exchange) : '.'}`);
+    }
+    if ('tag' in record && 'value' in record) {
+        return safeTerminalValue(`${record.critical ? 'critical ' : ''}${safeTerminalValue(record.tag)} ${safeTerminalValue(record.value)}`);
+    }
+    if ('nsname' in record) {
+        return safeTerminalValue(`${safeTerminalValue(record.nsname)} · serial ${safeTerminalValue(record.serial, 'unknown')}`);
+    }
+    if (record.type === 'HTTPS') {
+        const parameters = terminalRecord(record.parameters);
+        const alpnValues = Array.isArray(parameters.alpn) ? parameters.alpn : [];
+        const alpnVisible = alpnValues
+            .slice(0, MAX_LOOKUP_TERMINAL_ALPN_IDS)
+            .map((item) => boundedTerminalComponent(item, MAX_LOOKUP_TERMINAL_ALPN_ID_LENGTH));
+        const alpn = alpnVisible.length
+            ? boundedTerminalList(alpnVisible, Math.max(0, alpnValues.length - alpnVisible.length))
+            : '';
+        const suffix = [parameters.port ? `port ${safeTerminalValue(parameters.port)}` : '', alpn ? `ALPN ${alpn}` : ''].filter(Boolean).join(' · ');
+        const target = `${safeTerminalValue(record.priority, '0')} ${safeTerminalValue(record.target, '.')}`;
+        return boundedTerminalWithSuffix(target, suffix ? ` · ${suffix}` : '');
+    }
+    return null;
+}
+function appendLookupRecordLine(lines, label, value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return;
+    const visible = value
+        .slice(0, MAX_LOOKUP_TERMINAL_RECORDS)
+        .map(formatLookupDnsRecord)
+        .filter((item) => item !== null);
+    if (!visible.length)
+        return;
+    const omitted = Math.max(0, value.length - visible.length);
+    lines.push(`${label.padEnd(14)}${boundedTerminalList(visible, omitted)}`);
+}
+function lookupObservationLabel(value, observed, notObserved) {
+    return value === true ? observed : value === false ? notObserved : 'Unavailable';
+}
+function boundedTerminalNames(value) {
+    if (typeof value === 'string')
+        return safeTerminalValue(value);
+    if (!Array.isArray(value))
+        return null;
+    const names = value
+        .filter((item) => typeof item === 'string' && Boolean(item.trim()))
+        .slice(0, MAX_LOOKUP_TERMINAL_NAMES)
+        .map((item) => safeTerminalValue(item));
+    if (!names.length)
+        return null;
+    return boundedTerminalList(names, Math.max(0, value.length - names.length));
+}
+function boundedTerminalStrings(value, maximum = MAX_LOOKUP_TERMINAL_NAMES) {
+    if (!Array.isArray(value))
+        return null;
+    const inspected = Math.min(value.length, maximum);
+    const retained = [];
+    let invalid = 0;
+    for (let index = 0; index < inspected; index += 1) {
+        const item = value[index];
+        if (typeof item === 'string' || typeof item === 'number')
+            retained.push(safeTerminalValue(item));
+        else
+            invalid += 1;
+    }
+    const uninspected = Math.max(0, value.length - inspected);
+    const disclosures = [
+        invalid > 0 ? `${invalid} malformed retained entr${invalid === 1 ? 'y' : 'ies'} omitted` : null,
+        uninspected > 0 ? `+${uninspected} more retained entr${uninspected === 1 ? 'y' : 'ies'}` : null,
+    ].filter(Boolean).join(' · ');
+    if (!retained.length)
+        return disclosures || null;
+    return boundedTerminalWithSuffix(retained.join(', '), disclosures ? ` · ${disclosures}` : '');
+}
+function sourceCompleteness(value) {
+    if (value.complete === true && value.truncated !== true)
+        return 'Complete';
+    if (value.complete === false || value.truncated === true)
+        return value.truncated === true ? 'Incomplete · truncated' : 'Incomplete';
+    return null;
+}
+function positiveSourceStatus(value) {
+    return value === 'success' || value === 'partial';
+}
+function lifecycleDate(value, field) {
+    const lifecycle = terminalRecord(value.lifecycle);
+    return lifecycle[`${field}Iso`] ?? lifecycle[field];
+}
+function addressSelectionLabel(value) {
+    const labels = {
+        tls_connection: 'TLS connection',
+        dns_a: 'DNS A',
+        dns_aaaa: 'DNS AAAA',
+    };
+    return labels[String(value)] || titleCase(value);
+}
+function retainedUrlRelationship(value, target) {
+    const urlValue = terminalRecord(value);
+    if (typeof urlValue.url !== 'string')
+        return null;
+    try {
+        const declared = new URL(urlValue.url);
+        const targetValue = String(target || '').trim().replace(/\.$/u, '');
+        const targetHost = new URL(`http://${targetValue}`).hostname.toLowerCase();
+        const relationship = declared.hostname.toLowerCase() === targetHost
+            ? 'Same target host'
+            : 'Different host declared';
+        return [
+            relationship,
+            urlValue.queryOmitted === true ? 'query omitted' : null,
+            urlValue.pathTruncated === true ? 'path shortened' : null,
+        ].filter(Boolean).join(' · ');
+    }
+    catch {
+        return null;
+    }
+}
+function boundedFindingLabels(value, formatter) {
+    if (!Array.isArray(value))
+        return null;
+    const inspected = Math.min(value.length, MAX_LOOKUP_TERMINAL_FINDINGS);
+    const retained = value
+        .slice(0, inspected)
+        .map(terminalRecord)
+        .map(formatter)
+        .filter(Boolean);
+    if (!retained.length)
+        return null;
+    return boundedTerminalList(retained, Math.max(0, value.length - inspected));
+}
+function appendNetworkRegistrationLines(lines, parsed, type, detail) {
+    if (!Object.keys(parsed).length || detail === 'summary')
+        return;
+    if (parsed.handle)
+        lines.push(`RDAP handle    ${safeTerminalValue(parsed.handle)}`);
+    if (parsed.name)
+        lines.push(`RDAP name      ${safeTerminalValue(parsed.name)}`);
+    if (type === 'asn') {
+        if (parsed.startAutnum !== undefined && parsed.endAutnum !== undefined) {
+            const range = parsed.startAutnum === parsed.endAutnum
+                ? safeTerminalValue(parsed.startAutnum)
+                : `${safeTerminalValue(parsed.startAutnum)} to ${safeTerminalValue(parsed.endAutnum)}`;
+            lines.push(`ASN range      ${range}`);
+        }
+        else if (parsed.startAutnum !== undefined) {
+            lines.push(`ASN start      ${safeTerminalValue(parsed.startAutnum)}`);
+        }
+        else if (parsed.endAutnum !== undefined) {
+            lines.push(`ASN end        ${safeTerminalValue(parsed.endAutnum)}`);
+        }
+        if (parsed.autnumType)
+            lines.push(`Allocation     ${safeTerminalValue(parsed.autnumType)}`);
+    }
+    else {
+        if (parsed.startAddress && parsed.endAddress) {
+            lines.push(`Address range  ${safeTerminalValue(parsed.startAddress)} to ${safeTerminalValue(parsed.endAddress)}`);
+        }
+        else if (parsed.startAddress) {
+            lines.push(`Address start  ${safeTerminalValue(parsed.startAddress)}`);
+        }
+        else if (parsed.endAddress) {
+            lines.push(`Address end    ${safeTerminalValue(parsed.endAddress)}`);
+        }
+        const cidrs = boundedTerminalStrings(parsed.cidrs, MAX_LOOKUP_TERMINAL_CIDRS);
+        if (cidrs)
+            lines.push(`CIDR prefixes  ${cidrs}`);
+        if (parsed.networkType)
+            lines.push(`Allocation     ${safeTerminalValue(parsed.networkType)}`);
+    }
+    if (parsed.country)
+        lines.push(`Country        ${safeTerminalValue(parsed.country)}`);
+    const statuses = boundedTerminalStrings(parsed.statuses);
+    if (statuses)
+        lines.push(`Statuses       ${statuses}`);
+    if (detail === 'verbose') {
+        const created = lifecycleDate(parsed, 'createdDate');
+        const updated = lifecycleDate(parsed, 'updatedDate');
+        if (created)
+            lines.push(`Created        ${safeTerminalValue(created)}`);
+        if (updated)
+            lines.push(`Updated        ${safeTerminalValue(updated)}`);
+        if (parsed.serverTruncated === true || parsed.cidrsTruncated === true)
+            lines.push('RDAP detail    Source declared or local list truncation');
+    }
+}
 function formatTerminalLookup(document, { detail = 'standard' } = {}) {
     const availability = terminalRecord(document.availability);
     const diagnostics = terminalRecord(document.diagnostics);
@@ -78,6 +374,10 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
             registrationLines.push(`Registrar source ${safeTerminalValue(registrarRdap.endpoint)}`);
         }
     }
+    if (['ipv4', 'ipv6', 'asn'].includes(String(document.type)) && positiveSourceStatus(rdapDiagnostics.status)) {
+        const rdap = terminalRecord(document.rdap);
+        appendNetworkRegistrationLines(registrationLines, terminalRecord(rdap.parsed), document.type, detail);
+    }
     const registryInsights = terminalRecord(document.registryInsights);
     if (detail !== 'summary' && registryInsights.version === 1) {
         const lifecycle = terminalRecord(registryInsights.lifecycle);
@@ -98,24 +398,161 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
         registrationLines.push(`Reconciliation ${titleCase(reconciliation.state)}`);
         registrationLines.push(`Publications   ${publicationCounts.complete} complete · ${publicationCounts.partial} partial · ${publicationCounts.unavailable} unavailable`);
     }
-    const websiteLines = [];
+    const dnsLines = [];
+    const mailLines = [];
+    const tlsLines = [];
     if (document.mode === 'deep' && document.type === 'domain') {
         const dns = terminalRecord(availability.dns);
+        const dnsRecords = terminalRecord(dns.records);
+        const dnsDiagnostics = terminalRecord(dns.diagnostics);
+        if (Object.keys(dns).length) {
+            dnsLines.push(`Evidence       ${titleCase(dns.status)}`);
+            dnsLines.push(`Completeness   ${dns.complete === true ? 'Complete' : 'Incomplete'}`);
+            const recordTypes = [
+                ['a', 'A'], ['aaaa', 'AAAA'], ['cname', 'CNAME'], ['ns', 'NS'],
+                ['mx', 'MX'], ['spf', 'SPF'], ['dmarc', 'DMARC'], ['caa', 'CAA'],
+                ['soa', 'SOA'], ['https', 'HTTPS'],
+            ];
+            const retainedCounts = recordTypes
+                .map(([key, label]) => [label, Array.isArray(dnsRecords[key]) ? dnsRecords[key].length : 0])
+                .filter(([, count]) => count > 0)
+                .map(([label, count]) => `${label} ${count}`);
+            dnsLines.push(`Retained       ${retainedCounts.length ? safeTerminalValue(retainedCounts.join(' · ')) : 'No records retained'}`);
+            if (detail === 'verbose') {
+                const unsettled = recordTypes.flatMap(([key, label]) => {
+                    const diagnostic = terminalRecord(dnsDiagnostics[key]);
+                    return diagnostic.status && !['success', 'not_found'].includes(String(diagnostic.status))
+                        ? [`${label} ${titleCase(diagnostic.status)}`]
+                        : [];
+                });
+                if (unsettled.length)
+                    dnsLines.push(`Query states   ${safeTerminalValue(unsettled.join(' · '))}`);
+            }
+            if (detail !== 'summary') {
+                for (const [key, label] of recordTypes)
+                    appendLookupRecordLine(dnsLines, label, dnsRecords[key]);
+            }
+            mailLines.push(`Evidence       ${titleCase(dns.status)}`);
+            mailLines.push(`Mail exchange  ${lookupObservationLabel(dns.hasNullMx === true ? true : dns.hasMx, dns.hasNullMx === true ? 'Null MX observed' : 'MX observed', 'No MX observed')}`);
+            mailLines.push(`SPF            ${lookupObservationLabel(dns.hasSpf, 'Record observed', 'No record observed')}`);
+            mailLines.push(`DMARC          ${lookupObservationLabel(dns.hasDmarc, 'Record observed', 'No record observed')}`);
+            if (detail !== 'summary') {
+                appendLookupRecordLine(mailLines, 'MX hosts', Array.isArray(dns.mxHosts) ? dns.mxHosts : []);
+                appendLookupRecordLine(mailLines, 'SPF policy', dnsRecords.spf);
+                appendLookupRecordLine(mailLines, 'DMARC policy', dnsRecords.dmarc);
+            }
+        }
+        const tls = terminalRecord(availability.tls);
+        if (Object.keys(tls).length) {
+            const usableTls = positiveSourceStatus(tls.status);
+            const certificate = usableTls ? terminalRecord(tls.certificate) : {};
+            const subject = terminalRecord(certificate.subject);
+            const issuer = terminalRecord(certificate.issuer);
+            const authorization = usableTls ? terminalRecord(tls.authorization) : {};
+            const hostname = usableTls ? terminalRecord(tls.hostname) : {};
+            const validity = usableTls ? terminalRecord(tls.validity) : {};
+            const cipher = usableTls ? terminalRecord(tls.cipher) : {};
+            tlsLines.push(`Evidence       ${titleCase(tls.status)}`);
+            const completeness = sourceCompleteness(tls);
+            if (completeness)
+                tlsLines.push(`Completeness   ${completeness}`);
+            if (usableTls && tls.connectedAddress && detail !== 'summary')
+                tlsLines.push(`Address        ${safeTerminalValue(tls.connectedAddress)}`);
+            if (usableTls && tls.protocol)
+                tlsLines.push(`Protocol       ${safeTerminalValue(tls.protocol)}`);
+            if (usableTls && tls.alpnProtocol && detail !== 'summary')
+                tlsLines.push(`ALPN           ${safeTerminalValue(tls.alpnProtocol)}`);
+            if (cipher.standardName || cipher.name)
+                tlsLines.push(`Cipher         ${safeTerminalValue(cipher.standardName || cipher.name)}`);
+            tlsLines.push(`Chain trust    ${authorization.authorized === true ? 'Authorised' : authorization.authorized === false ? 'Not authorised' : 'Unavailable'}`);
+            tlsLines.push(`Hostname       ${hostname.matches === true ? 'Matched' : hostname.matches === false ? 'Not matched' : 'Unavailable'}`);
+            tlsLines.push(`Validity       ${validity.status ? titleCase(validity.status) : 'Unavailable'}`);
+            const subjectName = boundedTerminalNames(subject.commonNames ?? subject.CN);
+            const issuerName = boundedTerminalNames(issuer.commonNames ?? issuer.CN);
+            if (detail !== 'summary' && subjectName)
+                tlsLines.push(`Subject        ${subjectName}`);
+            if (detail !== 'summary' && issuerName)
+                tlsLines.push(`Issuer         ${issuerName}`);
+            if (detail !== 'summary' && certificate.validFrom)
+                tlsLines.push(`Valid from     ${safeTerminalValue(certificate.validFrom)}`);
+            if (detail !== 'summary' && certificate.validTo)
+                tlsLines.push(`Valid until    ${safeTerminalValue(certificate.validTo)}`);
+            const publicKey = terminalRecord(certificate.publicKey);
+            if (detail !== 'summary' && (publicKey.type || publicKey.bits || publicKey.curve)) {
+                tlsLines.push(`Public key     ${safeTerminalValue([publicKey.type, publicKey.bits ? `${publicKey.bits} bits` : null, publicKey.curve].filter(Boolean).join(' '))}`);
+            }
+            const signature = terminalRecord(certificate.signature);
+            if (detail !== 'summary' && (signature.algorithm || signature.oid)) {
+                tlsLines.push(`Signature      ${safeTerminalValue(signature.algorithm || signature.oid)}`);
+            }
+            const altNames = terminalRecord(certificate.subjectAltNames);
+            const dnsAltNames = Array.isArray(altNames.dnsNames) ? altNames.dnsNames : [];
+            const ipAltNames = Array.isArray(altNames.ipAddresses) ? altNames.ipAddresses : [];
+            const sanClasses = terminalCountSummary(altNames.classes, [
+                ['dns', 'DNS'], ['ip', 'IP'], ['email', 'email'], ['uri', 'URI'],
+                ['directoryName', 'directory name'], ['registeredId', 'registered ID'],
+                ['otherName', 'other name'], ['unclassified', 'other'],
+            ]);
+            if (detail !== 'summary' && (dnsAltNames.length || ipAltNames.length || sanClasses)) {
+                tlsLines.push(`SAN summary    ${sanClasses || `DNS ${dnsAltNames.length} · IP ${ipAltNames.length}`}${altNames.truncated ? ' · truncated' : ''}`);
+            }
+            const chainCount = Array.isArray(tls.chain) ? tls.chain.length : 0;
+            if (detail !== 'summary' && (chainCount || tls.chainTruncated === true)) {
+                tlsLines.push(`Chain          ${chainCount} retained certificate${chainCount === 1 ? '' : 's'}${tls.chainTruncated ? ' · truncated' : ''}`);
+            }
+            const aia = terminalRecord(certificate.authorityInformationAccess);
+            if (detail !== 'summary' && Object.keys(aia).length) {
+                const ocsp = terminalRecord(aia.ocsp);
+                const caIssuers = terminalRecord(aia.caIssuers);
+                tlsLines.push(`AIA presence   OCSP ${terminalCount(ocsp.total)} · CA issuers ${terminalCount(caIssuers.total)} · `
+                    + `unknown methods ${terminalCount(aia.unknownMethods)}${aia.truncated ? ' · truncated' : ''}`);
+            }
+            if (detail === 'verbose') {
+                const visibleAltNames = [...dnsAltNames, ...ipAltNames]
+                    .slice(0, MAX_TLS_TERMINAL_ALT_NAMES)
+                    .map((value) => safeTerminalValue(value));
+                if (visibleAltNames.length)
+                    tlsLines.push(`Alt names      ${boundedTerminalList(visibleAltNames, Math.max(0, dnsAltNames.length + ipAltNames.length - visibleAltNames.length))}`);
+                const purposes = terminalRecord(certificate.extendedKeyUsage);
+                const purposeValues = Array.isArray(purposes.values) ? purposes.values : [];
+                const visiblePurposes = purposeValues.slice(0, MAX_TLS_TERMINAL_PURPOSES).map((value) => {
+                    const purpose = terminalRecord(value);
+                    return safeTerminalValue(purpose.name || purpose.oid || 'Unrecognized purpose');
+                });
+                if (visiblePurposes.length)
+                    tlsLines.push(`Purposes       ${boundedTerminalList(visiblePurposes, Math.max(0, purposeValues.length - visiblePurposes.length))}${purposes.truncated ? ' · truncated' : ''}`);
+                const findings = boundedFindingLabels(tls.findings, (finding) => safeTerminalValue(finding.label, 'Unlabelled finding'));
+                if (findings)
+                    tlsLines.push(`Findings       ${findings}`);
+            }
+            if (detail === 'verbose' && certificate.fingerprintSha256)
+                tlsLines.push(`SHA-256        ${safeTerminalValue(certificate.fingerprintSha256)}`);
+            if (detail === 'verbose' && Array.isArray(tls.limitations)) {
+                for (const limitation of tls.limitations.slice(0, MAX_LOOKUP_TERMINAL_LIMITATIONS))
+                    tlsLines.push(`Limitation     ${safeTerminalValue(limitation)}`);
+                const omittedLimitations = Math.max(0, tls.limitations.length - MAX_LOOKUP_TERMINAL_LIMITATIONS);
+                if (omittedLimitations)
+                    tlsLines.push(`Limitation     +${omittedLimitations} more retained limitation${omittedLimitations === 1 ? '' : 's'}`);
+            }
+        }
+    }
+    const websiteLines = [];
+    if (document.mode === 'deep' && document.type === 'domain') {
         const http = terminalRecord(availability.http);
         const httpResponse = terminalRecord(http.response);
-        const tls = terminalRecord(availability.tls);
         const credentialSurface = terminalRecord(availability.credentialSurfaceProfile);
         const structuredIdentity = terminalRecord(availability.structuredDataIdentity);
         const technology = terminalRecord(availability.technologyProfile);
         const browserLibraries = terminalRecord(technology.browserLibraryProfile);
         const posture = terminalRecord(availability.securityPosture);
         const postureSummary = terminalRecord(posture.summary);
+        const pageIdentity = terminalRecord(availability.pageIdentity);
+        const pageRole = terminalRecord(availability.pageRoleProfile);
+        const clientBehavior = terminalRecord(availability.clientBehaviorProfile);
         if (availability.activityStatus)
             websiteLines.push(`Web activity   ${titleCase(availability.activityStatus)}`);
         if (detail !== 'summary' && availability.pageTitle)
             websiteLines.push(`Page title     ${safeTerminalValue(availability.pageTitle)}`);
-        if (dns.status)
-            websiteLines.push(`DNS evidence   ${titleCase(dns.status)}`);
         if (http.status) {
             websiteLines.push(`HTTP evidence  ${titleCase(http.status)}`);
             const responseDetail = [
@@ -124,11 +561,49 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
             ].filter(Boolean).join(' · ');
             if (detail !== 'summary' && responseDetail)
                 websiteLines.push(`HTTP response  ${responseDetail}`);
+            if (detail !== 'summary')
+                appendDeliveryMetadataLines(websiteLines, httpResponse.deliveryMetadata, detail === 'verbose');
         }
-        if (tls.status) {
-            websiteLines.push(`TLS evidence   ${titleCase(tls.status)}`);
-            if (detail !== 'summary' && tls.protocol)
-                websiteLines.push(`TLS protocol   ${safeTerminalValue(tls.protocol)}`);
+        if (pageIdentity.status || pageIdentity.source === 'html') {
+            websiteLines.push(`Page identity  ${titleCase(pageIdentity.status)}`);
+            const completeness = sourceCompleteness(pageIdentity);
+            if (completeness)
+                websiteLines.push(`Page coverage  ${completeness}`);
+            if (positiveSourceStatus(pageIdentity.status) && detail !== 'summary') {
+                if (pageIdentity.documentLanguage)
+                    websiteLines.push(`Language       ${safeTerminalValue(pageIdentity.documentLanguage)}`);
+                const canonical = retainedUrlRelationship(pageIdentity.canonical, document.registrableDomain || availability.domain || document.query);
+                if (canonical)
+                    websiteLines.push(`Canonical      ${canonical}`);
+                const openGraph = terminalRecord(pageIdentity.openGraph);
+                if (openGraph.title || openGraph.siteName) {
+                    websiteLines.push(`Open Graph     ${safeTerminalValue([openGraph.siteName, openGraph.title].filter(Boolean).join(' · '))}`);
+                }
+                if (pageIdentity.generator)
+                    websiteLines.push(`Generator      ${safeTerminalValue(pageIdentity.generator)}`);
+                const forms = terminalRecord(pageIdentity.forms);
+                if (Object.keys(forms).length)
+                    websiteLines.push(`Page forms     ${terminalDisplayCount(forms.count)} total · ${terminalDisplayCount(forms.postCount)} POST · ${terminalDisplayCount(forms.insecureActionCount)} insecure action`);
+                const resources = terminalRecord(pageIdentity.resources);
+                const resourceTypes = terminalCountSummary(resources.byType, [
+                    ['image', 'image'], ['script', 'script'], ['stylesheet', 'stylesheet'], ['link', 'link'],
+                    ['frame', 'frame'], ['media', 'media'], ['object', 'object'],
+                ]);
+                if (Object.keys(resources).length)
+                    websiteLines.push(`Resources      ${terminalDisplayCount(resources.count)} retained${resourceTypes ? ` · ${resourceTypes}` : ''}${resources.truncated ? ' · truncated' : ''}`);
+                const downloads = terminalRecord(pageIdentity.downloads);
+                if (Object.keys(downloads).length)
+                    websiteLines.push(`Downloads      ${terminalDisplayCount(downloads.count)} retained · ${terminalDisplayCount(downloads.riskyCount)} review file${Number(downloads.riskyCount) === 1 ? '' : 's'}${downloads.truncated ? ' · truncated' : ''}`);
+                if ([pageIdentity.embeddedOrigins, pageIdentity.contactDomains, pageIdentity.trackingIdentifiers].some(Array.isArray)) {
+                    websiteLines.push(`Relationships  ${Array.isArray(pageIdentity.embeddedOrigins) ? pageIdentity.embeddedOrigins.length : 0} embedded retained · `
+                        + `${Array.isArray(pageIdentity.contactDomains) ? pageIdentity.contactDomains.length : 0} contact domain${Array.isArray(pageIdentity.contactDomains) && pageIdentity.contactDomains.length === 1 ? '' : 's'} retained · `
+                        + `${Array.isArray(pageIdentity.trackingIdentifiers) ? pageIdentity.trackingIdentifiers.length : 0} tracking identifier${Array.isArray(pageIdentity.trackingIdentifiers) && pageIdentity.trackingIdentifiers.length === 1 ? '' : 's'} retained`);
+                }
+                appendPublicationMetadataLines(websiteLines, pageIdentity.publicationMetadata, detail);
+            }
+        }
+        if (availability.phishingLanguageMatch && detail !== 'summary') {
+            websiteLines.push(`Content cue    ${safeTerminalValue(availability.phishingLanguageMatch)} · static review label`);
         }
         if (credentialSurface.status || credentialSurface.source === 'html') {
             const forms = terminalRecord(credentialSurface.forms);
@@ -183,35 +658,117 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
         }
         if (posture.status || posture.source === 'derived') {
             websiteLines.push(`Posture        ${titleCase(posture.status)}`);
-            if (detail !== 'summary')
+            if (detail !== 'summary' && Object.keys(postureSummary).length)
                 websiteLines.push(`Posture counts ${terminalCount(postureSummary.observed)} observed · `
                     + `${terminalCount(postureSummary.potentialExposure)} potential exposure · `
                     + `${terminalCount(postureSummary.observedAbsence)} observed absence · `
                     + `${terminalCount(postureSummary.unavailable)} unavailable`);
+            if (detail === 'verbose' && positiveSourceStatus(posture.status)) {
+                const findings = boundedFindingLabels(posture.findings, (finding) => {
+                    const state = finding.state ? ` (${titleCase(finding.state)})` : '';
+                    return `${safeTerminalValue(finding.label, 'Unlabelled finding')}${state}`;
+                });
+                if (findings)
+                    websiteLines.push(`Posture labels ${findings}`);
+            }
+        }
+        if (pageRole.status || pageRole.source === 'derived') {
+            websiteLines.push(`Page role      ${titleCase(pageRole.status)}`);
+            const roleFindings = Array.isArray(pageRole.findings) ? pageRole.findings : [];
+            const primary = roleFindings.map(terminalRecord).find((finding) => finding.role === pageRole.primaryRole)
+                || terminalRecord(roleFindings[0]);
+            if (positiveSourceStatus(pageRole.status) && detail !== 'summary' && Object.keys(primary).length) {
+                websiteLines.push(`Primary role   ${safeTerminalValue(primary.label, 'Unclassified')} · ${titleCase(primary.confidence)}`);
+            }
+            if (positiveSourceStatus(pageRole.status) && detail === 'verbose') {
+                const findings = boundedFindingLabels(roleFindings, (finding) => `${safeTerminalValue(finding.label, 'Unclassified')} (${titleCase(finding.confidence)})`);
+                if (findings)
+                    websiteLines.push(`Role labels    ${findings}`);
+            }
+        }
+        if (clientBehavior.status || clientBehavior.source === 'derived') {
+            websiteLines.push(`Client signals ${titleCase(clientBehavior.status)}`);
+            const scriptSummary = terminalRecord(clientBehavior.scriptSummary);
+            if (positiveSourceStatus(clientBehavior.status) && detail !== 'summary' && Object.keys(scriptSummary).length)
+                websiteLines.push(`Scripts        ${terminalCount(scriptSummary.elementsObserved)} elements · ${terminalCount(scriptSummary.referencedScripts)} referenced · `
+                    + `${terminalCount(scriptSummary.inlineScripts)} inline · ${terminalCount(scriptSummary.moduleScripts)} modules`);
+            if (positiveSourceStatus(clientBehavior.status) && detail === 'verbose') {
+                const indicators = boundedFindingLabels(clientBehavior.indicators, (indicator) => {
+                    const occurrences = terminalCount(indicator.occurrences);
+                    return `${safeTerminalValue(indicator.label, 'Static indicator')} (${titleCase(indicator.evidenceClass)}, ${occurrences})`;
+                });
+                if (indicators)
+                    websiteLines.push(`Client labels  ${indicators}`);
+            }
         }
     }
     const networkLines = [];
     if (document.mode === 'deep' && (document.type === 'ipv4' || document.type === 'ipv6')) {
         const reverseDns = terminalRecord(document.reverseDns);
         const reverseDnsRecords = terminalRecord(reverseDns.records);
-        const ptrNames = Array.isArray(reverseDnsRecords.ptr)
-            ? reverseDnsRecords.ptr.slice(0, 5).map((value) => safeTerminalValue(value))
-            : [];
+        const ptrNames = boundedTerminalStrings(reverseDnsRecords.ptr);
         if (reverseDns.status)
             networkLines.push(`Reverse DNS    ${titleCase(reverseDns.status)}`);
-        if (detail !== 'summary' && ptrNames.length)
-            networkLines.push(`PTR names      ${safeTerminalValue(ptrNames.join(', '))}`);
+        const completeness = sourceCompleteness(reverseDns);
+        if (completeness)
+            networkLines.push(`PTR coverage   ${completeness}`);
+        if (detail !== 'summary' && ptrNames)
+            networkLines.push(`PTR names      ${ptrNames}`);
+        if (detail !== 'summary' && !ptrNames && reverseDns.status)
+            networkLines.push('PTR names      No names retained; source state remains inconclusive');
     }
     const network = terminalRecord(document.networkContext);
     if (network.contextVersion === 1) {
         const endpoint = terminalRecord(network.endpoint);
         const networkRecord = terminalRecord(network.network);
         networkLines.push(`Network RDAP   ${titleCase(network.status)}`);
+        const completeness = sourceCompleteness(network);
+        if (completeness)
+            networkLines.push(`Completeness   ${completeness}`);
         if (detail !== 'summary' && endpoint.address)
             networkLines.push(`Selected IP    ${safeTerminalValue(endpoint.address)}`);
-        if (networkRecord.name || networkRecord.holder) {
+        if (detail !== 'summary' && endpoint.selectedFrom)
+            networkLines.push(`Selected from  ${addressSelectionLabel(endpoint.selectedFrom)}`);
+        if (positiveSourceStatus(network.status) && (networkRecord.name || networkRecord.holder)) {
             networkLines.push(`Network        ${safeTerminalValue(networkRecord.name || networkRecord.holder)}`);
         }
+        if (positiveSourceStatus(network.status) && detail !== 'summary') {
+            if (networkRecord.handle)
+                networkLines.push(`Network handle ${safeTerminalValue(networkRecord.handle)}`);
+            if (networkRecord.holder && networkRecord.holder !== networkRecord.name)
+                networkLines.push(`Holder         ${safeTerminalValue(networkRecord.holder)}`);
+            const cidrs = boundedTerminalStrings(networkRecord.cidrs, MAX_LOOKUP_TERMINAL_CIDRS);
+            if (cidrs)
+                networkLines.push(`CIDR prefixes  ${cidrs}`);
+            if (networkRecord.startAddress || networkRecord.endAddress)
+                networkLines.push(`Address range  ${safeTerminalValue(networkRecord.startAddress)} to ${safeTerminalValue(networkRecord.endAddress)}`);
+            if (networkRecord.country)
+                networkLines.push(`Country        ${safeTerminalValue(networkRecord.country)}`);
+            if (networkRecord.networkType)
+                networkLines.push(`Allocation     ${safeTerminalValue(networkRecord.networkType)}`);
+            const allAbuseRoutes = Array.isArray(network.abuseRouting) ? network.abuseRouting : [];
+            const inspectedRoutes = Math.min(allAbuseRoutes.length, MAX_LOOKUP_TERMINAL_ABUSE_ROUTES);
+            const abuseRoutes = allAbuseRoutes.slice(0, inspectedRoutes).map(terminalRecord);
+            if (abuseRoutes.length) {
+                const channelCounts = new Map();
+                for (const route of abuseRoutes) {
+                    const channel = ['email', 'phone'].includes(String(route.channel)) ? String(route.channel) : 'other';
+                    channelCounts.set(channel, (channelCounts.get(channel) || 0) + 1);
+                }
+                const summary = [...channelCounts].map(([channel, count]) => `${channel} ${count}`).join(' · ');
+                const omittedRoutes = Math.max(0, allAbuseRoutes.length - inspectedRoutes);
+                networkLines.push(`Published routes ${abuseRoutes.length} retained${omittedRoutes ? ` · +${omittedRoutes} more entries` : ''} (${summary}); values omitted`);
+            }
+            if (detail === 'verbose' && networkRecord.databaseUpdatedAt)
+                networkLines.push(`Registry date  ${safeTerminalValue(networkRecord.databaseUpdatedAt)}`);
+            if (detail === 'verbose' && Array.isArray(network.limitations)) {
+                for (const limitation of network.limitations.slice(0, MAX_LOOKUP_TERMINAL_LIMITATIONS))
+                    networkLines.push(`Limitation     ${safeTerminalValue(limitation)}`);
+                const omitted = Math.max(0, network.limitations.length - MAX_LOOKUP_TERMINAL_LIMITATIONS);
+                if (omitted)
+                    networkLines.push(`Limitation     +${omitted} more retained limitation${omitted === 1 ? '' : 's'}`);
+            }
+        }
     }
     const sourceHealthLines = [];
     const registryAccess = terminalRecord(diagnostics.registryAccess);
@@ -236,7 +793,10 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
     const lines = [];
     appendSection(lines, 'Target', targetLines);
     appendSection(lines, 'Registration', registrationLines);
+    appendSection(lines, 'DNS', dnsLines);
+    appendSection(lines, 'Mail', mailLines);
     appendSection(lines, 'Website and security', websiteLines);
+    appendSection(lines, 'TLS and certificate', tlsLines);
     appendSection(lines, 'Network', networkLines);
     appendSection(lines, 'Source health', sourceHealthLines);
     appendSection(lines, 'Collection', collectionLines);
@@ -446,6 +1006,7 @@ function formatTerminalHttp(document) {
     ];
     if (document.detail)
         lines.push(`Detail         ${safeTerminalValue(document.detail)}`);
+    appendDeliveryMetadataLines(lines, response.deliveryMetadata, true);
     const bodyHash = terminalRecord(response.bodyHash);
     if (bodyHash.value) {
         lines.push(`Body hash      ${safeTerminalValue(`${bodyHash.algorithm}:${bodyHash.value} (${bodyHash.scope})`)}`);
@@ -668,4 +1229,4 @@ function formatTerminalRiskCalibration(document) {
     lines.push('', safeTerminalValue(terminalRecord(document.interpretation).statement));
     return `${lines.join('\n')}\n`;
 }
-export { MAX_CT_TERMINAL_HOSTNAMES, MAX_CT_TERMINAL_MATCHES, MAX_DISCOVER_TERMINAL_CANDIDATES, MAX_POSTURE_TERMINAL_RECORDS, MAX_TLS_TERMINAL_ALT_NAMES, MAX_TLS_TERMINAL_PURPOSES, MAX_RISK_CALIBRATION_TERMINAL_RECORDS, MAX_TERMINAL_VALUE_LENGTH, formatTerminalBulk, formatTerminalCompare, formatTerminalCtSearch, formatTerminalDiscover, formatTerminalHttp, formatTerminalLookup, formatTerminalPosture, formatTerminalRegistrySupport, formatTerminalRiskCalibration, formatTerminalTls, safeTerminalValue, };
+export { MAX_CT_TERMINAL_HOSTNAMES, MAX_CT_TERMINAL_MATCHES, MAX_DISCOVER_TERMINAL_CANDIDATES, MAX_LOOKUP_TERMINAL_ALPN_IDS, MAX_LOOKUP_TERMINAL_ALPN_ID_LENGTH, MAX_LOOKUP_TERMINAL_LIMITATIONS, MAX_LOOKUP_TERMINAL_NAMES, MAX_LOOKUP_TERMINAL_RECORDS, MAX_POSTURE_TERMINAL_RECORDS, MAX_TLS_TERMINAL_ALT_NAMES, MAX_TLS_TERMINAL_PURPOSES, MAX_RISK_CALIBRATION_TERMINAL_RECORDS, MAX_TERMINAL_VALUE_LENGTH, formatTerminalBulk, formatTerminalCompare, formatTerminalCtSearch, formatTerminalDiscover, formatTerminalHttp, formatTerminalLookup, formatTerminalPosture, formatTerminalRegistrySupport, formatTerminalRiskCalibration, formatTerminalTls, safeTerminalValue, };