@slicedearth/whoisleuth-cli 1.47.4 → 2.0.0

package/{frontend/src/lib/analysis/investigation-capsule.js → packages/investigation/investigation-capsule.mjs}

@@ -1,7 +1,8 @@
-import { canonicalArtifactJson, canonicalArtifactJsonV2, sha256ArtifactDigest, sha256ArtifactDigestV2, SORTED_JSON_V2, } from "./artifact-integrity.js";
-export const INVESTIGATION_CAPSULE_SCHEMA = 'whoisleuth.investigation-capsule';
-export const INVESTIGATION_CAPSULE_VERSION = 2;
-export const LEGACY_INVESTIGATION_CAPSULE_VERSION = 1;
+import { canonicalArtifactJsonV2, sha256ArtifactDigestV2, SORTED_JSON_V2, } from "../evidence/artifact-integrity.mjs";
+import { LOOKUP_ASSET_GRAPH_SCHEMA, } from "./lookup-asset-graph.mjs";
+import { LOOKUP_INVESTIGATION_BRIEF_SCHEMA, LOOKUP_INVESTIGATION_BRIEF_VERSION, } from "./lookup-investigation-brief.mjs";
+import { INVESTIGATION_CAPSULE_ANALYST_RECORDS_SCHEMA, INVESTIGATION_CAPSULE_ANALYST_RECORDS_VERSION, INVESTIGATION_CAPSULE_SCHEMA, INVESTIGATION_CAPSULE_VERSION, PUBLIC_INVESTIGATION_CAPSULE_VERSION, SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS, } from "../contracts/investigation-portability.mjs";
+export { INVESTIGATION_CAPSULE_ANALYST_RECORDS_SCHEMA, INVESTIGATION_CAPSULE_ANALYST_RECORDS_VERSION, INVESTIGATION_CAPSULE_SCHEMA, INVESTIGATION_CAPSULE_VERSION, PUBLIC_INVESTIGATION_CAPSULE_VERSION, SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS, };
 function safeVersion(value) {
     return typeof value === 'string' && /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u.test(value)
         ? value
@@ -62,10 +63,16 @@ export async function buildInvestigationCapsule(input) {
         target: { value: input.brief.target, type: input.brief.targetType },
         sourceContracts: [
             { id: 'lookup-evidence', schema: evidenceSchema, version: evidenceVersion, digest: evidenceDigest, embedded: false },
-            { id: 'investigation-brief', schema: input.brief.schema, version: input.brief.schemaVersion, digest: briefDigest, embedded: true },
-            { id: 'asset-graph', schema: 'whoisleuth.lookup-asset-graph', version: input.graph.version, digest: graphDigest, embedded: true },
+            { id: 'investigation-brief', schema: LOOKUP_INVESTIGATION_BRIEF_SCHEMA, version: LOOKUP_INVESTIGATION_BRIEF_VERSION, digest: briefDigest, embedded: true },
+            { id: 'asset-graph', schema: LOOKUP_ASSET_GRAPH_SCHEMA, version: input.graph.version, digest: graphDigest, embedded: true },
             ...(analystRecords && analystRecordsDigest
-                ? [{ id: 'analyst-records', schema: 'whoisleuth.case-analyst-records', version: 1, digest: analystRecordsDigest, embedded: true }]
+                ? [{
+                        id: 'analyst-records',
+                        schema: INVESTIGATION_CAPSULE_ANALYST_RECORDS_SCHEMA,
+                        version: INVESTIGATION_CAPSULE_ANALYST_RECORDS_VERSION,
+                        digest: analystRecordsDigest,
+                        embedded: true,
+                    }]
                 : []),
         ],
         investigationBrief: input.brief,
@@ -74,7 +81,7 @@ export async function buildInvestigationCapsule(input) {
         limitations: [
             'The Lookup evidence file is linked by digest but is not embedded; keep or share that exact file separately when verification is required.',
             'Digest verification can detect changed content but does not establish who created the capsule. No digital signature is applied.',
-            'The graph and brief are bounded projections of collected and derived evidence, not attribution, ownership, safety, availability, or maliciousness conclusions.',
+            'The graph and canonical Decision Fact brief are bounded projections of collected and derived evidence, not attribution, ownership, safety, availability, or maliciousness conclusions.',
             analystRecords
                 ? 'Analyst decisions and assertions were deliberately included; review them for sensitive or personal information before sharing.'
                 : 'Analyst decisions, assertions, notes, contacts, actions, and raw source payloads are excluded.',
@@ -95,21 +102,17 @@ export async function buildInvestigationCapsule(input) {
 }
 export async function verifyInvestigationCapsule(capsule) {
     const current = capsule.schemaVersion === INVESTIGATION_CAPSULE_VERSION;
-    const legacy = capsule.schemaVersion === LEGACY_INVESTIGATION_CAPSULE_VERSION;
+    const publicVersion = capsule.schemaVersion === PUBLIC_INVESTIGATION_CAPSULE_VERSION;
     const integrityRecord = capsule.integrity;
-    if ((!current && !legacy)
-        || (current && (integrityRecord.canonicalization !== SORTED_JSON_V2
-            || integrityRecord.scope !== 'capsule excluding integrity'))
-        || (legacy && (Object.hasOwn(integrityRecord, 'canonicalization')
-            || Object.hasOwn(integrityRecord, 'scope')
-            || Object.hasOwn(integrityRecord, 'digestSha256')))) {
-        return { valid: false, brief: false, graph: false, analystRecords: null, whole: current ? false : null };
+    if ((!current && !publicVersion)
+        || integrityRecord.canonicalization !== SORTED_JSON_V2
+        || integrityRecord.scope !== 'capsule excluding integrity') {
+        return { valid: false, brief: false, graph: false, analystRecords: null, whole: false };
     }
-    const projectionDigest = current ? sha256ArtifactDigestV2 : sha256ArtifactDigest;
     const [briefDigest, graphDigest, analystRecordsDigest] = await Promise.all([
-        projectionDigest(capsule.investigationBrief),
-        projectionDigest(capsule.graphSnapshot),
-        capsule.analystRecords ? projectionDigest(capsule.analystRecords) : Promise.resolve(null),
+        sha256ArtifactDigestV2(capsule.investigationBrief),
+        sha256ArtifactDigestV2(capsule.graphSnapshot),
+        capsule.analystRecords ? sha256ArtifactDigestV2(capsule.analystRecords) : Promise.resolve(null),
     ]);
     const brief = briefDigest === capsule.integrity.briefDigest;
     const graph = graphDigest === capsule.integrity.graphDigest;
@@ -118,22 +121,17 @@ export async function verifyInvestigationCapsule(capsule) {
         : capsule.integrity.analystRecordsDigest === null
             ? null
             : false;
-    let whole = null;
-    if (current) {
-        const { integrity, ...unsigned } = capsule;
-        whole = integrity.algorithm === 'SHA-256'
-            && integrity.canonicalization === SORTED_JSON_V2
-            && integrity.scope === 'capsule excluding integrity'
-            && integrity.digestSha256 === await sha256ArtifactDigestV2(unsigned);
-    }
-    return { valid: brief && graph && analystRecords !== false && whole !== false, brief, graph, analystRecords, whole };
+    const { integrity: _integrity, ...unsigned } = capsule;
+    const whole = integrityRecord.algorithm === 'SHA-256'
+        && integrityRecord.canonicalization === SORTED_JSON_V2
+        && integrityRecord.scope === 'capsule excluding integrity'
+        && integrityRecord.digestSha256 === await sha256ArtifactDigestV2(unsigned);
+    return { valid: brief && graph && analystRecords !== false && whole, brief, graph, analystRecords, whole };
 }
 export function investigationCapsuleFilename(capsule) {
     const target = capsule.target.value.toLowerCase().replace(/[^a-z0-9.-]+/gu, '-').replace(/^-|-$/gu, '').slice(0, 80) || 'lookup';
     return `whoisleuth-investigation-capsule-${target}-${capsule.generatedAt.slice(0, 10)}.json`;
 }
 export function serializeInvestigationCapsule(capsule) {
-    return `${capsule.schemaVersion === INVESTIGATION_CAPSULE_VERSION
-        ? canonicalArtifactJsonV2(capsule)
-        : canonicalArtifactJson(capsule)}\n`;
+    return `${canonicalArtifactJsonV2(capsule)}\n`;
 }

package/packages/investigation/lookup-artefact-inputs.mjs

@@ -0,0 +1 @@
+export {};

package/{frontend/src/lib/analysis/lookup-asset-graph.js → packages/investigation/lookup-asset-graph.mjs}

@@ -1,3 +1,5 @@
+import { LOOKUP_ASSET_GRAPH_SCHEMA, LOOKUP_ASSET_GRAPH_VERSION, } from "../contracts/investigation-portability.mjs";
+export { LOOKUP_ASSET_GRAPH_SCHEMA, LOOKUP_ASSET_GRAPH_VERSION };
 const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/gu;
 const MAX_NODES = 72;
 const MAX_EDGES = 120;
@@ -158,7 +160,7 @@ export function buildLookupAssetGraph(input) {
     const target = hostname(input.target);
     if (!target) {
         return {
-            version: 2,
+            version: LOOKUP_ASSET_GRAPH_VERSION,
             targetId: '',
             nodes: [],
             edges: [],
@@ -705,7 +707,7 @@ export function buildLookupAssetGraph(input) {
         }
     }
     return {
-        version: 2,
+        version: LOOKUP_ASSET_GRAPH_VERSION,
         targetId,
         nodes: [...nodes.values()],
         edges: [...edges.values()],

package/{frontend/src/lib/analysis/lookup-claim-passport.js → packages/investigation/lookup-claim-passport.mjs}

@@ -1,11 +1,7 @@
-import { LOOKUP_CLAIM_READINESS_VERSION, LOOKUP_CLAIM_IDS, LOOKUP_CLAIM_REQUIREMENT_IDS, } from "./lookup-claim-readiness.js";
-import { SORTED_JSON_V2, sha256ArtifactDigestV2, } from "./artifact-integrity.js";
-export const LOOKUP_CLAIM_PASSPORT_SCHEMA = 'whoisleuth.lookup-claim-passport';
-export const LOOKUP_CLAIM_PASSPORT_VERSION = 1;
-export const MAX_LOOKUP_CLAIM_PASSPORT_BYTES = 64 * 1024;
-export const MAX_LOOKUP_CLAIM_PASSPORT_REQUIREMENTS = 16;
-export const MAX_LOOKUP_CLAIM_PASSPORT_LIMITATIONS = 16;
-export const LOOKUP_CLAIM_PASSPORT_TARGET_TYPES = ['domain', 'ipv4', 'ipv6', 'asn'];
+import { LOOKUP_CLAIM_READINESS_VERSION, LOOKUP_CLAIM_IDS, LOOKUP_CLAIM_REQUIREMENT_IDS, } from "./lookup-claim-readiness.mjs";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2, } from "../evidence/artifact-integrity.mjs";
+import { LOOKUP_CLAIM_PASSPORT_SCHEMA, LOOKUP_CLAIM_PASSPORT_TARGET_TYPES, LOOKUP_CLAIM_PASSPORT_VERSION, MAX_LOOKUP_CLAIM_PASSPORT_BYTES, MAX_LOOKUP_CLAIM_PASSPORT_LIMITATIONS, MAX_LOOKUP_CLAIM_PASSPORT_REQUIREMENTS, } from "../contracts/investigation-portability.mjs";
+export { LOOKUP_CLAIM_PASSPORT_SCHEMA, LOOKUP_CLAIM_PASSPORT_TARGET_TYPES, LOOKUP_CLAIM_PASSPORT_VERSION, MAX_LOOKUP_CLAIM_PASSPORT_BYTES, MAX_LOOKUP_CLAIM_PASSPORT_LIMITATIONS, MAX_LOOKUP_CLAIM_PASSPORT_REQUIREMENTS, };
 const SOURCE_STATES = new Set([
     'complete',
     'not_found',
@@ -118,10 +114,10 @@ function requirementId(value) {
 }
 export async function buildLookupClaimPassport(input) {
     if (input.readiness.version !== LOOKUP_CLAIM_READINESS_VERSION) {
-        throw new TypeError('The claim-readiness contract is not supported for passport export.');
+        throw new TypeError('The Evidence Readiness contract is not supported for passport export.');
     }
     if (input.readiness.entries.length > LOOKUP_CLAIM_IDS.length) {
-        throw new TypeError('The claim-readiness contract contains too many entries for passport export.');
+        throw new TypeError('The Evidence Readiness contract contains too many entries for passport export.');
     }
     const rawClaimId = exactText(input.claimId, 80);
     if (!CLAIM_IDS.has(rawClaimId))

package/{frontend/src/lib/analysis/lookup-claim-readiness.js → packages/investigation/lookup-claim-readiness.mjs}

@@ -1,4 +1,5 @@
-export const LOOKUP_CLAIM_READINESS_VERSION = 2;
+import { LOOKUP_CLAIM_READINESS_VERSION } from "../contracts/investigation-portability.mjs";
+export { LOOKUP_CLAIM_READINESS_VERSION };
 export const LOOKUP_CLAIM_IDS = [
     'registration-state',
     'current-web-observation',
@@ -89,6 +90,7 @@ function requirement(id, coverage, override) {
     const definition = LOOKUP_CLAIM_REQUIREMENTS[id];
     const evidence = definition.evidenceId ? coverage.get(definition.evidenceId) : undefined;
     const state = override?.state ?? evidence?.state ?? 'unknown';
+    const coverageState = definition.evidenceId ? evidence?.state ?? 'unknown' : null;
     const limitations = override?.limitation
         ? [override.limitation]
         : evidence?.limitations.length
@@ -96,7 +98,12 @@ function requirement(id, coverage, override) {
             : state === 'complete'
                 ? []
                 : [evidence?.statusLabel || 'Not supplied'];
-    return Object.freeze({ ...definition, state, limitations: Object.freeze(limitations) });
+    return Object.freeze({
+        ...definition,
+        coverageState,
+        state,
+        limitations: Object.freeze(limitations),
+    });
 }
 function readinessEntry(input) {
     const evaluated = evaluateRequirements(input.requirements);

package/packages/investigation/lookup-investigation-brief.mjs

@@ -0,0 +1,172 @@
+import { DECISION_FACT_PRESENTATION_LABELS, projectDecisionFacts, } from "../evidence/decision-fact.mjs";
+import { PUBLIC_LOOKUP_INVESTIGATION_BRIEF_VERSION, LOOKUP_INVESTIGATION_BRIEF_SCHEMA, LOOKUP_INVESTIGATION_BRIEF_VERSION, MAX_LOOKUP_INVESTIGATION_BRIEF_BYTES, SUPPORTED_LOOKUP_INVESTIGATION_BRIEF_VERSIONS, } from "../contracts/investigation-portability.mjs";
+export { PUBLIC_LOOKUP_INVESTIGATION_BRIEF_VERSION, LOOKUP_INVESTIGATION_BRIEF_SCHEMA, LOOKUP_INVESTIGATION_BRIEF_VERSION, MAX_LOOKUP_INVESTIGATION_BRIEF_BYTES, SUPPORTED_LOOKUP_INVESTIGATION_BRIEF_VERSIONS, };
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/gu;
+const MAX_LIMITATIONS = 20;
+function text(value, maximum = 320) {
+    return String(value ?? '')
+        .replace(CONTROL_CHARACTERS, ' ')
+        .replace(/\s+/gu, ' ')
+        .trim()
+        .slice(0, maximum);
+}
+function timestamp(value) {
+    if (typeof value !== 'string')
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+function uniqueText(values, maximum = MAX_LIMITATIONS) {
+    const output = [];
+    const seen = new Set();
+    for (const value of values) {
+        const normalized = text(value);
+        if (!normalized || seen.has(normalized))
+            continue;
+        output.push(normalized);
+        seen.add(normalized);
+        if (output.length >= maximum)
+            break;
+    }
+    return output;
+}
+function taskQuestion(support) {
+    return support.guidance.questions[0]
+        ?? 'What does the collected evidence establish, and what remains uncertain?';
+}
+export function buildLookupInvestigationBrief(input) {
+    const generatedAt = timestamp(input.generatedAt) ?? new Date().toISOString();
+    const decisionFacts = projectDecisionFacts(input.decisionFacts);
+    const limitedSources = input.quality.entries
+        .filter((entry) => entry.state !== 'complete')
+        .map((entry) => `${entry.label}: ${entry.statusLabel}`);
+    const graphKinds = uniqueText(input.graph.edges.map((edge) => edge.label), 12);
+    const brief = Object.freeze({
+        schema: LOOKUP_INVESTIGATION_BRIEF_SCHEMA,
+        schemaVersion: LOOKUP_INVESTIGATION_BRIEF_VERSION,
+        generatedAt,
+        target: text(input.target, 253) || 'Unknown target',
+        targetType: text(input.targetType, 40) || 'unknown',
+        task: input.task,
+        taskLabel: input.decisionSupport.guidance.label,
+        question: taskQuestion(input.decisionSupport),
+        summary: input.decisionSupport.guidance.summary,
+        observation: Object.freeze({
+            observedAt: input.quality.observedAt,
+            evidenceAgeDays: input.quality.ageDays,
+            completeSources: input.quality.completeCount,
+            limitedSources: input.quality.limitedCount,
+            freshnessPolicy: input.quality.freshnessPolicy,
+        }),
+        decisionFacts,
+        relationships: Object.freeze({
+            nodes: input.graph.nodes.length,
+            edges: input.graph.edges.length,
+            truncated: input.graph.truncated,
+            kinds: Object.freeze(graphKinds),
+        }),
+        limitations: Object.freeze(uniqueText([
+            ...limitedSources,
+            ...input.graph.limitations,
+            'This brief is a deterministic organisation of collected and derived evidence, not an attribution, ownership, safety, availability, or maliciousness conclusion.',
+            'Analyst assertions, hypotheses, and decisions must remain separate from observed evidence.',
+        ])),
+    });
+    if (new TextEncoder().encode(JSON.stringify(brief)).byteLength > MAX_LOOKUP_INVESTIGATION_BRIEF_BYTES) {
+        throw new RangeError('Lookup investigation brief exceeded its byte limit.');
+    }
+    return brief;
+}
+function markdown(value) {
+    return text(value, 2_000)
+        .replace(/&/gu, '&')
+        .replace(/</gu, '&lt;')
+        .replace(/>/gu, '&gt;')
+        .replace(/([\\`*_{}[\]()#+\-.!|=~])/gu, '\\$1');
+}
+function countedValues(collection) {
+    const values = collection.items.length ? collection.items.map(markdown).join(', ') : 'none';
+    return `${collection.displayed} of ${collection.total} displayed; ${collection.omitted} omitted. ${values}`;
+}
+function decisionFactLines(fact) {
+    const lines = [
+        `### ${markdown(fact.question)}`,
+        '',
+        `- **Fact ID:** ${markdown(fact.id)}`,
+        `- **Conclusion:** ${markdown(fact.conclusion)}`,
+        `- **Importance:** ${markdown(DECISION_FACT_PRESENTATION_LABELS.importance[fact.importance])}`,
+        `- **Evidence state:** ${markdown(DECISION_FACT_PRESENTATION_LABELS.evidenceState[fact.evidenceState])} (${markdown(fact.evidenceState)})`,
+        `- **Completeness:** ${markdown(DECISION_FACT_PRESENTATION_LABELS.completeness[fact.completeness])} (${markdown(fact.completeness)})`,
+        `- **Freshness:** ${markdown(DECISION_FACT_PRESENTATION_LABELS.freshness[fact.freshness])} (${markdown(fact.freshness)})`,
+        `- **Consistency:** ${markdown(DECISION_FACT_PRESENTATION_LABELS.consistency[fact.consistency])} (${markdown(fact.consistency)})`,
+        `- **Dependencies:** ${countedValues(fact.dependencies)}`,
+        `- **Source references:** ${countedValues(fact.sourceReferences)}`,
+        `- **Attributed sources:** ${fact.sources.displayed} of ${fact.sources.total} displayed; ${fact.sources.omitted} omitted.`,
+    ];
+    if (fact.sources.items.length) {
+        for (const source of fact.sources.items) {
+            lines.push(`  - **${markdown(source.label)}** (${markdown(source.id)}): ${markdown(DECISION_FACT_PRESENTATION_LABELS.provenance[source.provenance])}; ${markdown(DECISION_FACT_PRESENTATION_LABELS.evidenceState[source.evidenceState])}; observed ${markdown(source.observedAt ?? 'not reported')}.`, `    - References: ${countedValues(source.references)}`, `    - Limitations: ${countedValues(source.limitations)}`);
+        }
+    }
+    else {
+        lines.push('  - No attributed source was retained for this fact.');
+    }
+    lines.push(`- **Contradictions:** ${countedValues(fact.contradictions)}`, `- **Limitations:** ${countedValues(fact.limitations)}`, `- **Safe next actions:** ${fact.safeNextActions.displayed} of ${fact.safeNextActions.total} displayed; ${fact.safeNextActions.omitted} omitted.`);
+    if (fact.safeNextActions.items.length) {
+        for (const action of fact.safeNextActions.items) {
+            lines.push(`  - **${markdown(action.label)}** (${markdown(action.id)}; ${markdown(action.importance)}): ${markdown(action.reason)} Expected outcome: ${markdown(action.expectedOutcome)} Review destination: ${markdown(action.href)}.`);
+        }
+    }
+    else {
+        lines.push('  - No fact-specific action was retained. Review the attributed evidence and limitations.');
+    }
+    lines.push('');
+    return lines;
+}
+export function formatLookupInvestigationBriefMarkdown(brief) {
+    const lines = [
+        `# Investigation brief: ${markdown(brief.target)}`,
+        '',
+        `Generated ${markdown(brief.generatedAt)} from a ${markdown(brief.targetType)} Lookup.`,
+        '',
+        '## Decision context',
+        '',
+        `- **Task:** ${markdown(brief.taskLabel)}`,
+        `- **Question:** ${markdown(brief.question)}`,
+        `- **Summary:** ${markdown(brief.summary)}`,
+        `- **Evidence observed:** ${markdown(brief.observation.observedAt ?? 'not reported')}`,
+        `- **Source quality:** ${brief.observation.completeSources} complete; ${brief.observation.limitedSources} limited`,
+        `- **Freshness policy:** v${brief.observation.freshnessPolicy.version} ${markdown(brief.observation.freshnessPolicy.id)} for ${markdown(brief.observation.freshnessPolicy.task)}; registration ${brief.observation.freshnessPolicy.thresholdsDays.registration}d, network ${brief.observation.freshnessPolicy.thresholdsDays.network}d, web ${brief.observation.freshnessPolicy.thresholdsDays.web}d`,
+        '',
+        '## Canonical Decision Facts',
+        '',
+        `Displaying ${brief.decisionFacts.displayed} of ${brief.decisionFacts.total} canonical Decision Facts; ${brief.decisionFacts.omitted} omitted by the bounded projection. ${brief.decisionFacts.contradictory} contradictory and ${brief.decisionFacts.unresolved} unresolved across the complete canonical set.`,
+        '',
+        ...(brief.decisionFacts.facts.length
+            ? brief.decisionFacts.facts.flatMap(decisionFactLines)
+            : ['No canonical Decision Fact was available. Review source quality before drawing a conclusion.', '']),
+        '',
+        '## Observed relationship map',
+        '',
+        `- ${brief.relationships.nodes} nodes and ${brief.relationships.edges} edges${brief.relationships.truncated ? '; bounded output was truncated' : ''}.`,
+        `- Relationship types: ${brief.relationships.kinds.map(markdown).join(', ') || 'none observed'}.`,
+        '',
+        '## Limitations',
+        '',
+        ...brief.limitations.map((limitation) => `- ${markdown(limitation)}`),
+        '',
+    ];
+    const output = lines.join('\n');
+    if (new TextEncoder().encode(output).byteLength > MAX_LOOKUP_INVESTIGATION_BRIEF_BYTES) {
+        throw new RangeError('Lookup investigation brief Markdown exceeded its byte limit.');
+    }
+    return output;
+}
+export function lookupInvestigationBriefFilename(brief) {
+    const target = brief.target
+        .toLowerCase()
+        .replace(/[^a-z0-9.-]+/gu, '-')
+        .replace(/^-+|-+$/gu, '')
+        .slice(0, 80) || 'lookup';
+    return `whoisleuth-investigation-brief-${target}-${brief.generatedAt.slice(0, 10)}.md`;
+}