@slicedearth/whoisleuth-cli 2.0.1 → 2.1.0

package/cli/lookup-brief.mjs

@@ -1,7 +1,8 @@
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
 import { safeTerminalValue } from "./formatters/terminal.mjs";
+import { compareRdapPublications, compareRegistrySources } from "../lib/registry-comparison.mjs";
 export const CLI_LOOKUP_BRIEF_SCHEMA = 'whoisleuth.cli.lookup-brief';
-export const CLI_LOOKUP_BRIEF_VERSION = 2;
+export const CLI_LOOKUP_BRIEF_VERSION = 3;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -18,41 +19,145 @@ function text(value, maximum = 300) {
 function sourceState(value) {
     return text(value, 40)?.toLowerCase() ?? 'unavailable';
 }
+function joinedText(value, maximumItems = 8) {
+    if (!Array.isArray(value))
+        return null;
+    const retained = value.slice(0, maximumItems).flatMap((item) => {
+        const normalized = text(item, 253);
+        return normalized ? [normalized] : [];
+    });
+    if (!retained.length)
+        return null;
+    return `${retained.join(', ')}${value.length > retained.length ? ` (+${value.length - retained.length} more)` : ''}`;
+}
+function observedBoolean(value, positive, negative) {
+    return value === true ? positive : value === false ? negative : null;
+}
+function sourceObservation(id, label, stateValue, ...timeValues) {
+    return Object.freeze({
+        id,
+        label,
+        state: sourceState(stateValue),
+        observedAt: timeValues.map((value) => text(value, 64)).find(Boolean) ?? null,
+    });
+}
+function contradictionRows(value, left, right, leftStateKey, rightStateKey, leftDisplayKey, rightDisplayKey) {
+    const fields = Array.isArray(record(value).fields) ? record(value).fields : [];
+    return fields.flatMap((fieldValue) => {
+        const field = record(fieldValue);
+        if (field.status !== 'conflict')
+            return [];
+        const label = text(field.label, 120) ?? 'Registration publication field';
+        const observations = [
+            Object.freeze({
+                source: left,
+                state: sourceState(field[leftStateKey] ?? left.state),
+                value: text(field[leftDisplayKey], 300) ?? 'Value not retained',
+            }),
+            Object.freeze({
+                source: right,
+                state: sourceState(field[rightStateKey] ?? right.state),
+                value: text(field[rightDisplayKey], 300) ?? 'Value not retained',
+            }),
+        ];
+        return [Object.freeze({
+                field: label,
+                detail: `${left.label} and ${right.label} publish different values for ${label}.`,
+                observations: Object.freeze(observations),
+            })];
+    });
+}
 export function buildCliLookupBrief(input, generatedAt = new Date().toISOString()) {
     const document = parseSavedLookupDocument(input, { label: 'Lookup brief input' });
     const diagnostics = record(document.diagnostics);
     const availability = record(document.availability);
+    const rdapDiagnostics = record(diagnostics.rdap);
+    const registrarRdapDiagnostics = record(rdapDiagnostics.registrar);
+    const whoisDiagnostics = record(diagnostics.whois);
+    const availabilityDiagnostics = record(diagnostics.availability);
     const rdap = record(record(document.rdap).parsed);
     const whois = record(record(document.whois).parsed);
+    const registrarRdap = record(record(record(document.rdap).registrarRdap).parsed);
     const preferred = Object.keys(rdap).length ? rdap : whois;
-    const sources = ['rdap', 'whois', 'availability', 'dns', 'http', 'tls'].map((id) => {
-        const nested = id === 'dns' || id === 'http' || id === 'tls' ? record(availability[id]) : record(diagnostics[id]);
-        return Object.freeze({ id, state: sourceState(nested.status ?? nested.state), observedAt: text(nested.observedAt ?? nested.fetchedAt ?? nested.queriedAt, 64) });
-    });
+    const rdapSource = sourceObservation('rdap', 'Registry RDAP', rdapDiagnostics.status, rdapDiagnostics.observedAt, rdapDiagnostics.fetchedAt, record(document.rdap).observedAt, record(document.rdap).fetchedAt);
+    const registrarRdapSource = sourceObservation('registrar_rdap', 'Registrar RDAP', registrarRdapDiagnostics.status, registrarRdapDiagnostics.observedAt, registrarRdapDiagnostics.fetchedAt);
+    const whoisSource = sourceObservation('whois', 'WHOIS', whoisDiagnostics.status, whoisDiagnostics.observedAt, whoisDiagnostics.queriedAt, record(document.whois).observedAt, record(document.whois).queriedAt);
+    const availabilitySource = sourceObservation('availability', 'Authority-aware availability', availabilityDiagnostics.status ?? availability.status, availabilityDiagnostics.observedAt, availability.observedAt);
+    const dns = record(availability.dns);
+    const http = record(availability.http);
+    const tls = record(availability.tls);
+    const dnsSource = sourceObservation('dns', 'DNS', dns.status ?? dns.state, dns.observedAt, dns.checkedAt);
+    const httpSource = sourceObservation('http', 'HTTP and static page identity', http.status ?? http.state, http.observedAt, http.checkedAt, record(availability.pageIdentity).observedAt);
+    const tlsSource = sourceObservation('tls', 'TLS', tls.status ?? tls.state, tls.observedAt, tls.checkedAt);
+    const pageIdentity = record(availability.pageIdentity);
+    const technology = record(availability.technologyProfile);
+    const sslbl = record(document.sslbl);
+    const pageAnalysisSource = sourceObservation('page_analysis', 'Static page analysis', pageIdentity.status ?? technology.status, pageIdentity.observedAt, technology.observedAt, http.observedAt);
+    const sslblSource = sourceObservation('sslbl', 'Local SSLBL certificate snapshot', sslbl.status, sslbl.observedAt, record(sslbl.snapshot).sourceUpdatedAt);
+    const sources = [
+        rdapSource,
+        registrarRdapSource,
+        whoisSource,
+        availabilitySource,
+        dnsSource,
+        httpSource,
+        tlsSource,
+        pageAnalysisSource,
+        ...(Object.keys(sslbl).length ? [sslblSource] : []),
+    ];
+    const sourceById = new Map(sources.map((source) => [source.id, source]));
+    const preferredRegistrationSource = Object.keys(rdap).length ? rdapSource : whoisSource;
+    const externalFormActions = record(pageIdentity.forms).externalActionOrigins;
     const facts = [
-        ['Registration state', availability.state, 'Authority-aware availability'],
-        ['Registrar', record(preferred.registrar).name ?? preferred.registrar, Object.keys(rdap).length ? 'Registry RDAP' : 'WHOIS'],
-        ['Created', record(preferred.lifecycle).createdIso ?? preferred.createdDateIso, Object.keys(rdap).length ? 'Registry RDAP' : 'WHOIS'],
-        ['Expires', record(preferred.lifecycle).expiryIso ?? preferred.expiryDateIso, Object.keys(rdap).length ? 'Registry RDAP' : 'WHOIS'],
-        ['Website activity', availability.activityStatus, 'HTTP'],
-        ['Page title', availability.pageTitle, 'Static page identity'],
-    ].flatMap(([label, value, source]) => {
+        ['registration-state', 'Registration state', availability.state, availabilitySource.id],
+        ['registrar', 'Registrar', record(preferred.registrar).name ?? preferred.registrar, preferredRegistrationSource.id],
+        ['created', 'Created', record(preferred.lifecycle).createdIso ?? preferred.createdDateIso, preferredRegistrationSource.id],
+        ['expires', 'Expires', record(preferred.lifecycle).expiryIso ?? preferred.expiryDateIso, preferredRegistrationSource.id],
+        ['name-servers', 'Name servers', joinedText(preferred.nameservers), preferredRegistrationSource.id],
+        ['website-activity', 'Website activity', availability.activityStatus, httpSource.id],
+        ['page-title', 'Page title', availability.pageTitle, httpSource.id],
+        ['dnssec', 'DNSSEC publication', availability.dnssec, dnsSource.id],
+        ['mail-exchanger', 'Mail exchanger', observedBoolean(availability.hasMx, 'Observed', 'Not observed in retained DNS evidence'), dnsSource.id],
+        ['spf', 'SPF publication', observedBoolean(availability.hasSpf, 'Observed', 'Not observed in retained DNS evidence'), dnsSource.id],
+        ['dmarc', 'DMARC publication', observedBoolean(availability.hasDmarc, 'Observed', 'Not observed in retained DNS evidence'), dnsSource.id],
+        ['password-input', 'Password input', observedBoolean(availability.hasPasswordField, 'Observed in static HTML', 'Not observed in retained static HTML'), pageAnalysisSource.id],
+        ['external-form-actions', 'External form actions', Array.isArray(externalFormActions)
+                ? `${externalFormActions.length} retained origin${externalFormActions.length === 1 ? '' : 's'}`
+                : null, pageAnalysisSource.id],
+        ['page-role', 'Page role', record(availability.pageRoleProfile).primaryRole, pageAnalysisSource.id],
+        ['technology-indicators', 'Technology indicators', joinedText(Array.isArray(technology.findings)
+                ? technology.findings.map((finding) => record(finding).name ?? record(finding).id)
+                : null), pageAnalysisSource.id],
+        ['certificate-warning-data', 'Certificate warning data', sslbl.verdict === 'listed'
+                ? 'Listed certificate review lead'
+                : sslbl.verdict === 'not_listed' && sslbl.status === 'success' && sslbl.complete === true
+                    ? 'No match in retained local snapshot'
+                    : Object.keys(sslbl).length
+                        ? 'Inconclusive'
+                        : null, sslblSource.id],
+    ].flatMap(([id, label, value, sourceId]) => {
         const normalized = text(value);
-        return normalized ? [Object.freeze({ label: String(label), value: normalized, source: String(source) })] : [];
+        const source = sourceById.get(String(sourceId));
+        return normalized && source ? [Object.freeze({ id: String(id), label: String(label), value: normalized, source })] : [];
     });
     const incomplete = sources.filter((item) => !['complete', 'success'].includes(item.state));
-    const analysis = record(document.analysis);
-    const contradictions = [analysis.registryComparison, document.registryComparison, document.registrarPublicationComparison]
-        .flatMap((value) => Array.isArray(record(value).fields) ? record(value).fields : [])
-        .flatMap((value) => {
-        const item = record(value);
-        return item.status === 'conflict' ? [text(item.label, 120) ?? 'Registration publication conflict'] : [];
-    }).slice(0, 16);
+    const registryComparison = compareRegistrySources(rdap, whois, {
+        rdapStatus: rdapDiagnostics.status,
+        whoisStatus: whoisDiagnostics.status,
+    });
+    const registrarComparison = compareRdapPublications(rdap, registrarRdap, {
+        registryStatus: rdapDiagnostics.status,
+        registrarStatus: registrarRdapDiagnostics.status,
+    });
+    const contradictions = [
+        ...contradictionRows(registryComparison, rdapSource, whoisSource, 'rdapState', 'whoisState', 'rdapDisplay', 'whoisDisplay'),
+        ...contradictionRows(registrarComparison, rdapSource, registrarRdapSource, 'registryState', 'registrarState', 'registryDisplay', 'registrarDisplay'),
+    ].slice(0, 16);
     const actionPlan = [
         ...(contradictions.length ? [{
                 id: 'registration-publication-review',
                 action: 'Review the separately attributed registration publications before relying on the conflicting fields.',
-                reason: `${contradictions.length} conflicting publication field${contradictions.length === 1 ? '' : 's'} were retained.`,
+                reason: `${contradictions.length} conflicting publication field${contradictions.length === 1 ? '' : 's'} were retained with separate source values.`,
                 expectedOutcome: 'Establish which observation is current, authoritative, or still unresolved.',
                 evidence: 'registry publication comparison',
             }] : []),
@@ -70,6 +175,13 @@ export function buildCliLookupBrief(input, generatedAt = new Date().toISOString(
                 expectedOutcome: 'Collect the explicitly selected additional source classes without implying that unavailable evidence is absent.',
                 evidence: 'collection mode',
             }] : []),
+        ...(sslbl.verdict === 'listed' ? [{
+                id: 'certificate-warning-review',
+                action: 'Review the matching certificate fingerprint alongside current TLS, page, and infrastructure evidence.',
+                reason: 'The retained local warning-data snapshot contains the observed certificate fingerprint as a review lead.',
+                expectedOutcome: 'Determine whether the listing is relevant and current without treating it alone as a maliciousness verdict.',
+                evidence: 'local SSLBL certificate snapshot',
+            }] : []),
         {
             id: 'case-evidence-review',
             action: 'Pin only the facts needed for the decision and keep analyst hypotheses separate from observations.',
@@ -105,8 +217,14 @@ export function formatCliLookupBrief(document) {
         `Observed  ${safeTerminalValue(document.observedAt)}`,
         `Mode      ${safeTerminalValue(document.mode)}`,
         '',
-        'Verified facts',
-        ...(document.facts.length ? document.facts.map((item) => `  ${safeTerminalValue(item.label)}: ${safeTerminalValue(item.value)} (${safeTerminalValue(item.source)})`) : ['  No bounded fact was available.']),
+        'Source-attributed facts',
+        ...(document.facts.length ? document.facts.map((item) => `  ${safeTerminalValue(item.label)}: ${safeTerminalValue(item.value)} (${safeTerminalValue(item.source.label)}; ${safeTerminalValue(item.source.state)}; ${item.source.observedAt ? `observed ${safeTerminalValue(item.source.observedAt)}` : 'source time not recorded'})`) : ['  No bounded fact was available.']),
+        '',
+        'Contradictions',
+        ...(document.contradictions.length ? document.contradictions.flatMap((item) => [
+            `  ${safeTerminalValue(item.field)}: ${safeTerminalValue(item.detail)}`,
+            ...item.observations.map((observation) => `    ${safeTerminalValue(observation.source.label)}: ${safeTerminalValue(observation.value)} (${safeTerminalValue(observation.state)}; ${observation.source.observedAt ? `observed ${safeTerminalValue(observation.source.observedAt)}` : 'source time not recorded'})`),
+        ]) : ['  No conflicting publication field was retained.']),
         '',
         'Unknown or incomplete',
         ...(document.unknowns.length ? document.unknowns.map((item) => `  ${safeTerminalValue(item)}`) : ['  No incomplete source state was identified.']),

package/cli/lookup-browser-view.mjs

@@ -0,0 +1,289 @@
+import { formatTerminalLookup, safeTerminalValue } from "./formatters/terminal.mjs";
+import { presentTerminalOutput, wrapTerminalOutput, } from "./terminal-presentation.mjs";
+const MIN_LOOKUP_BROWSER_HEIGHT = 12;
+const MAX_LOOKUP_BROWSER_HEIGHT = 80;
+const MAX_LOOKUP_BROWSER_PANELS = 9;
+const MAX_LOOKUP_BROWSER_SEARCH_BYTES = 256;
+const MAX_LOOKUP_BROWSER_SEARCH_SCALARS = 80;
+const MAX_LOOKUP_BROWSER_SEARCH_MATCHES = 256;
+const ANSI_SEQUENCE_RE = /\u001b\[[0-?]*[ -/]*[@-~]/gu;
+function boundedHeight(value) {
+    const height = Number(value);
+    if (!Number.isSafeInteger(height))
+        return 24;
+    return Math.max(MIN_LOOKUP_BROWSER_HEIGHT, Math.min(MAX_LOOKUP_BROWSER_HEIGHT, height));
+}
+function panelId(value, index) {
+    const normalized = value.toLowerCase().replace(/[^a-z0-9]+/gu, '-').replace(/^-|-$/gu, '');
+    return normalized || `panel-${index + 1}`;
+}
+function terminalCharacterWidth(character) {
+    const codePoint = character.codePointAt(0) || 0;
+    if (/\p{Mark}/u.test(character)
+        || codePoint === 0x200d
+        || codePoint >= 0xfe00 && codePoint <= 0xfe0f
+        || codePoint >= 0xe0100 && codePoint <= 0xe01ef)
+        return 0;
+    return codePoint >= 0x1100 && (codePoint <= 0x115f
+        || codePoint === 0x2329
+        || codePoint === 0x232a
+        || codePoint >= 0x2e80 && codePoint <= 0xa4cf && codePoint !== 0x303f
+        || codePoint >= 0xac00 && codePoint <= 0xd7a3
+        || codePoint >= 0xf900 && codePoint <= 0xfaff
+        || codePoint >= 0xfe10 && codePoint <= 0xfe19
+        || codePoint >= 0xfe30 && codePoint <= 0xfe6f
+        || codePoint >= 0xff00 && codePoint <= 0xff60
+        || codePoint >= 0xffe0 && codePoint <= 0xffe6
+        || codePoint >= 0x1f300 && codePoint <= 0x1faff
+        || codePoint >= 0x20000 && codePoint <= 0x3fffd) ? 2 : 1;
+}
+function terminalDisplayWidth(value) {
+    return Array.from(value.replace(ANSI_SEQUENCE_RE, ''))
+        .reduce((total, character) => total + terminalCharacterWidth(character), 0);
+}
+function hardWrapTerminalLine(line, width) {
+    if (!line || terminalDisplayWidth(line) <= width)
+        return [line];
+    const lines = [];
+    let current = '';
+    let currentWidth = 0;
+    for (const character of line) {
+        const characterWidth = terminalCharacterWidth(character);
+        if (current && currentWidth + characterWidth > width) {
+            lines.push(current);
+            current = '';
+            currentWidth = 0;
+        }
+        current += character;
+        currentWidth += characterWidth;
+    }
+    if (current || !lines.length)
+        lines.push(current);
+    return lines;
+}
+function clipTerminalLine(line, width) {
+    if (terminalDisplayWidth(line) <= width)
+        return line;
+    const maximumContentWidth = Math.max(1, width - 1);
+    let clipped = '';
+    let clippedWidth = 0;
+    for (const character of line) {
+        const characterWidth = terminalCharacterWidth(character);
+        if (clippedWidth + characterWidth > maximumContentWidth)
+            break;
+        clipped += character;
+        clippedWidth += characterWidth;
+    }
+    return `${clipped}…`;
+}
+function wrapLookupBrowserLines(value, width) {
+    const softlyWrapped = wrapTerminalOutput(`${value}\n`, width).replace(/\n$/u, '').split('\n');
+    return softlyWrapped.flatMap((line) => hardWrapTerminalLine(line, width));
+}
+function buildLookupBrowserPanels(document) {
+    const blocks = formatTerminalLookup(document, { detail: 'verbose' })
+        .trimEnd()
+        .split(/\n\n/gu)
+        .slice(0, MAX_LOOKUP_BROWSER_PANELS);
+    return blocks.flatMap((block, index) => {
+        const [heading, ...lines] = block.split('\n');
+        if (!heading?.endsWith(':') || lines.length === 0)
+            return [];
+        const label = heading.slice(0, -1);
+        return [Object.freeze({
+                id: panelId(label, index),
+                label,
+                lines: Object.freeze(lines),
+            })];
+    });
+}
+function browserTabLine(panels, activeIndex, width) {
+    const labels = panels.map((panel, index) => index === activeIndex
+        ? `[${index + 1} ${panel.label}]`
+        : `${index + 1} ${panel.label}`);
+    const complete = labels.join('  ');
+    if (terminalDisplayWidth(complete) <= width)
+        return complete;
+    const visible = [activeIndex - 1, activeIndex, activeIndex + 1]
+        .filter((index) => index >= 0 && index < panels.length)
+        .map((index) => labels[index]);
+    const windowed = `${activeIndex > 1 ? '‹  ' : ''}${visible.join('  ')}${activeIndex + 2 < panels.length ? '  ›' : ''}`;
+    return clipTerminalLine(windowed, width);
+}
+function boundedTargetLine(query, width) {
+    return clipTerminalLine(`Target  ${query}`, width);
+}
+function boundedBrowserDimensions(options) {
+    return {
+        width: Math.max(40, Math.min(160, Number.isSafeInteger(options.width) ? Number(options.width) : 100)),
+        height: boundedHeight(options.height),
+    };
+}
+function boundedSearchText(value) {
+    const text = typeof value === 'string' ? value : '';
+    if (Buffer.byteLength(text, 'utf8') > MAX_LOOKUP_BROWSER_SEARCH_BYTES
+        || Array.from(text).length > MAX_LOOKUP_BROWSER_SEARCH_SCALARS
+        || /[\u0000-\u001f\u007f-\u009f\u061c\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/u.test(text)) {
+        throw new RangeError(`Lookup browser search is limited to ${MAX_LOOKUP_BROWSER_SEARCH_SCALARS} characters and ${MAX_LOOKUP_BROWSER_SEARCH_BYTES} UTF-8 bytes.`);
+    }
+    return text;
+}
+function findLookupBrowserMatches(panels, query) {
+    const normalized = boundedSearchText(query).trim().toLocaleLowerCase('en-US');
+    if (!normalized)
+        return { matches: [], truncated: false };
+    const matches = [];
+    let truncated = false;
+    outer: for (let panelIndex = 0; panelIndex < panels.length; panelIndex += 1) {
+        const panel = panels[panelIndex];
+        const lines = [panel.label, ...panel.lines];
+        for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+            if (!String(lines[lineIndex] || '').toLocaleLowerCase('en-US').includes(normalized))
+                continue;
+            if (matches.length >= MAX_LOOKUP_BROWSER_SEARCH_MATCHES) {
+                truncated = true;
+                break outer;
+            }
+            matches.push(Object.freeze({ panelIndex, lineIndex: Math.max(0, lineIndex - 1) }));
+        }
+    }
+    return { matches, truncated };
+}
+function renderedPanelLineOffset(panel, lineIndex, width) {
+    if (lineIndex <= 0)
+        return 0;
+    return panel.lines
+        .slice(0, Math.min(lineIndex, panel.lines.length))
+        .reduce((total, line) => total + wrapLookupBrowserLines(line, width).length, 0);
+}
+function renderStandaloneBrowserFrame(lines, options) {
+    const { width, height } = boundedBrowserDimensions(options);
+    const clipped = lines.slice(0, height).map((line) => clipTerminalLine(line, width));
+    return presentTerminalOutput(`${clipped.join('\n')}\n`, {
+        color: options.color === true,
+        interactive: true,
+        palette: options.palette || 'auto',
+        width: null,
+    });
+}
+function buildLookupBrowserHelpFrame(document, options = {}) {
+    const query = safeTerminalValue(document?.query ?? options.query, 'unknown target');
+    const mode = safeTerminalValue(document?.mode ?? options.mode, 'unknown mode');
+    return renderStandaloneBrowserFrame([
+        'WHOISleuth evidence browser help',
+        boundedTargetLine(query, boundedBrowserDimensions(options).width),
+        `Mode    ${mode}`,
+        '',
+        options.collecting ? 'Collection' : 'Panels',
+        options.collecting
+            ? '  q / Ctrl-C  cancel the active collection'
+            : '  ←/→ h/l Tab  move panels · 1-9 select',
+        options.collecting
+            ? '  progress is transient and is never retained'
+            : '  ↑/↓ j/k PgUp/PgDn Home/End  scroll',
+        options.collecting ? '  ? / Esc  return to collection progress' : '  /  search rendered panels · n/N matches',
+        '  ? / Esc  return · q  close',
+    ], options);
+}
+function buildLookupBrowserSearchFrame(document, query, notice, options = {}) {
+    return renderStandaloneBrowserFrame([
+        'WHOISleuth evidence browser search',
+        boundedTargetLine(safeTerminalValue(document.query, 'unknown target'), boundedBrowserDimensions(options).width),
+        `Mode    ${safeTerminalValue(document.mode, 'unknown mode')}`,
+        '',
+        `Search  ${query || 'type a bounded term'}`,
+        notice || 'Search covers only the bounded text rendered in the evidence panels.',
+        '',
+        'Enter apply · Backspace edit · Esc cancel',
+    ], options);
+}
+function buildLookupCollectionFrame(queryValue, modeValue, sources, options = {}) {
+    const { width, height } = boundedBrowserDimensions(options);
+    const query = safeTerminalValue(queryValue, 'unknown target');
+    const mode = modeValue === 'deep' ? 'deep' : 'fast';
+    const header = [
+        'WHOISleuth evidence browser',
+        boundedTargetLine(query, width),
+        `Mode    ${mode}`,
+        'Collection in progress:',
+    ];
+    const footer = ['? help · progress is transient', 'q/Esc/Ctrl-C cancel'];
+    const bodyCapacity = Math.max(1, height - header.length - footer.length);
+    const body = mode === 'fast'
+        ? [
+            'Registration evidence  collecting',
+            'Fast mode waits for the final bounded result.',
+            'Per-source states are not fabricated.',
+        ]
+        : sources.flatMap((source) => {
+            const state = source.state === 'pending'
+                ? 'pending'
+                : `${source.state}${source.complete ? ' · complete' : ' · incomplete'}${source.truncated ? ' · truncated' : ''}`;
+            const limitation = source.state !== 'pending' && source.limitation
+                ? ` · ${source.limitation}`
+                : '';
+            return [clipTerminalLine(`${source.source.replaceAll('_', ' ')}  ${state}${limitation}`, width)];
+        });
+    const visible = body.slice(0, bodyCapacity);
+    if (body.length > visible.length && visible.length) {
+        visible[visible.length - 1] = `+${body.length - visible.length + 1} source states not visible at this height`;
+    }
+    return renderStandaloneBrowserFrame([...header, ...visible, ...footer], {
+        ...options,
+        width,
+        height,
+    });
+}
+function buildLookupBrowserFrame(document, options = {}) {
+    const panels = buildLookupBrowserPanels(document);
+    const { width, height } = boundedBrowserDimensions(options);
+    if (!panels.length)
+        return Object.freeze({
+            value: `${clipTerminalLine('WHOISleuth evidence browser', width)}\n${clipTerminalLine('No bounded terminal panels were available.', width)}\n`,
+            scrollOffset: 0,
+            maximumScrollOffset: 0,
+            pageSize: 0,
+            totalBodyLines: 0,
+        });
+    const activeIndex = Math.max(0, Math.min(panels.length - 1, Number.isSafeInteger(options.activeIndex) ? Number(options.activeIndex) : 0));
+    const panel = panels[activeIndex];
+    const query = safeTerminalValue(document.query, 'unknown target');
+    const mode = safeTerminalValue(document.mode, 'unknown mode');
+    const header = [
+        'WHOISleuth evidence browser',
+        boundedTargetLine(query, width),
+        `Mode    ${clipTerminalLine(mode, Math.max(1, width - 8))}`,
+        browserTabLine(panels, activeIndex, width),
+        `${panel.label}:`,
+    ];
+    const footerLineCount = 2;
+    const body = wrapLookupBrowserLines(panel.lines.join('\n'), width);
+    const bodyCapacity = Math.max(1, height - header.length - footerLineCount);
+    const maximumScrollOffset = Math.max(0, body.length - bodyCapacity);
+    const requestedScrollOffset = Number.isSafeInteger(options.scrollOffset) ? Number(options.scrollOffset) : 0;
+    const scrollOffset = Math.max(0, Math.min(maximumScrollOffset, requestedScrollOffset));
+    const visibleBody = body.slice(scrollOffset, scrollOffset + bodyCapacity);
+    const firstVisibleLine = body.length ? scrollOffset + 1 : 0;
+    const lastVisibleLine = body.length ? scrollOffset + visibleBody.length : 0;
+    const footer = [
+        options.searchStatus || `View ${activeIndex + 1}/${panels.length} · lines ${firstVisibleLine}-${lastVisibleLine}/${body.length}`,
+        '←/→ panels · ↑/↓ scroll · / search · ? help · q close',
+    ].map((line) => clipTerminalLine(line, width));
+    const value = [...header, ...visibleBody, ...footer].slice(0, height).join('\n');
+    return Object.freeze({
+        value: presentTerminalOutput(`${value}\n`, {
+            color: options.color === true,
+            interactive: true,
+            palette: options.palette || 'auto',
+            width: null,
+        }),
+        scrollOffset,
+        maximumScrollOffset,
+        pageSize: bodyCapacity,
+        totalBodyLines: body.length,
+    });
+}
+function renderLookupBrowser(document, options = {}) {
+    return buildLookupBrowserFrame(document, options).value;
+}
+export { MIN_LOOKUP_BROWSER_HEIGHT, MAX_LOOKUP_BROWSER_PANELS, MAX_LOOKUP_BROWSER_SEARCH_BYTES, MAX_LOOKUP_BROWSER_SEARCH_MATCHES, MAX_LOOKUP_BROWSER_SEARCH_SCALARS, boundedBrowserDimensions, boundedSearchText, buildLookupBrowserHelpFrame, buildLookupBrowserFrame, buildLookupBrowserPanels, buildLookupBrowserSearchFrame, buildLookupCollectionFrame, findLookupBrowserMatches, renderedPanelLineOffset, renderLookupBrowser, terminalDisplayWidth, };