@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/lib/lookup-response-contract.mjs

@@ -0,0 +1,1048 @@
+// Shared HTTP response boundary for the unified Lookup API.
+//
+// The backend owns the evidence collectors, but an HTTP response is still an
+// untrusted value when it reaches the browser. This module keeps the response
+// envelope typed and validates the small set of fields the Lookup controller
+// relies on before any evidence is derived or rendered. Nested source records
+// stay separately attributed and additive; their own normalizers remain the
+// authority for source-specific fields.
+import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_CATEGORIES, THREAT_INTELLIGENCE_CONFIDENCES, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_RESULT_STATES, THREAT_INTELLIGENCE_SCHEMA, THREAT_INTELLIGENCE_SEVERITIES, } from "./threat-intelligence-types.mjs";
+import { MAX_HTTP_ATTEMPTS, MAX_HTTP_ERROR_LENGTH, MAX_HTTP_EVIDENCE_REDIRECTS, } from "./http-evidence-bounds.mjs";
+import { MAX_OBSERVATION_LIMITATIONS, MAX_OBSERVATION_LIMITATION_LENGTH, normalizeExplicitIsoTimestamp, } from "../packages/evidence/observation.mjs";
+import { assertBoundedJsonStructure } from "./bounded-json.mjs";
+import { canonicalRegistrableDomain } from "./registrable-domain.mjs";
+import { validLookupObservationScope } from "../packages/evidence/lookup-target.mjs";
+import { MAX_LOOKUP_DNS_RECORDS_PER_TYPE, MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS, MAX_LOOKUP_TLS_ALT_NAMES, MAX_LOOKUP_TLS_CERTIFICATE_POLICIES, MAX_LOOKUP_TLS_CHAIN_CERTIFICATES, MAX_LOOKUP_TLS_FINDINGS, MAX_LOOKUP_TLS_NAME_VALUES, } from "./lookup-network-evidence-bounds.mjs";
+import { MAX_SECURITY_POSTURE_FINDINGS, sanitizeLookupChildProfiles, validSecurityPostureFinding, validTlsChainCertificate, validTlsFinding, } from "./lookup-child-profile-contract.mjs";
+import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "./homepage-metadata-contract.mjs";
+import { resolveRegistrarIanaId, validRegistrarStanding, } from "./registrar-standing-contract.mjs";
+import { LOOKUP_CONTROL_CHAR_RE as CONTROL_CHAR_RE, isJsonObject, normalizedDomain, validBoundedString, validHttpProvenanceUrl, validObservationDiagnostics, validOptionalNullableText, validStringArray, validUint, } from "./lookup-contract-primitives.mjs";
+const INVALID_LOOKUP_RESPONSE = 'INVALID_LOOKUP_RESPONSE';
+const INVALID_LOOKUP_RESPONSE_MESSAGE = 'Lookup returned an invalid response.';
+const INVALID_COMPACT_LOOKUP_RESPONSE = 'INVALID_COMPACT_LOOKUP_RESPONSE';
+const INVALID_COMPACT_LOOKUP_RESPONSE_MESSAGE = 'Bulk lookup returned an invalid response.';
+const MAX_LOOKUP_RESPONSE_QUERY_LENGTH = 4096;
+const MAX_LOOKUP_RESPONSE_HOST_LENGTH = 253;
+const MAX_LOOKUP_RESPONSE_PAGE_TITLE_LENGTH = 200;
+const MAX_LOOKUP_RESPONSE_TOP_LEVEL_KEYS = 32;
+const MAX_LOOKUP_RESPONSE_ERROR_LENGTH = 240;
+const MAX_LOOKUP_RESPONSE_CONTAINER_ITEMS = 500;
+const MAX_COMPACT_LOOKUP_RESPONSE_TOP_LEVEL_KEYS = 8;
+const MAX_COMPACT_LOOKUP_AVAILABILITY_KEYS = 128;
+const MAX_COMPACT_LOOKUP_DIAGNOSTIC_KEYS = 16;
+const MAX_COMPACT_BULK_TECHNOLOGY_IDS = 12;
+const MAX_THREAT_INTELLIGENCE_PROVIDERS = 10;
+const MAX_THREAT_INTELLIGENCE_FINDINGS = 100;
+const MAX_THREAT_INTELLIGENCE_LIMITATIONS = 10;
+const MAX_THREAT_INTELLIGENCE_TEXT_LENGTH = 500;
+const MAX_LOOKUP_TIMING_MS = 120_000;
+const MAX_LOOKUP_TIMING_SOURCES = 10;
+const QUERY_TYPES = new Set(['domain', 'ipv4', 'ipv6', 'asn']);
+const COMPACT_AVAILABILITY_STATES = new Set([
+    'available',
+    'expiring',
+    'for_sale',
+    'registered',
+    'unknown',
+]);
+const COMPACT_CONFIDENCE_LEVELS = new Set(['high', 'low', 'medium']);
+const COMPACT_AVAILABILITY_DIAGNOSTIC_STATES = new Set(['complete', 'disabled', 'error']);
+const COMPACT_BULK_COMPARISON_STATES = new Set([
+    'error',
+    'not_found',
+    'partial',
+    'success',
+    'unavailable',
+]);
+const COMPACT_BULK_TECHNOLOGY_ID_RE = /^[a-z0-9][a-z0-9_-]{0,79}$/u;
+const SHA256_RE = /^[a-f0-9]{64}$/u;
+const THREAT_INTELLIGENCE_PROVIDERS = Object.freeze({
+    urlscan_search: Object.freeze({ label: 'URLscan archived verdicts', host: 'urlscan.io' }),
+    urlhaus_host: Object.freeze({ label: 'URLhaus malware-host records', host: 'urlhaus.abuse.ch' }),
+    threatfox_domain_ioc: Object.freeze({ label: 'ThreatFox malware IOCs', host: 'threatfox.abuse.ch' }),
+});
+const THREAT_INTELLIGENCE_STATES = new Set(THREAT_INTELLIGENCE_RESULT_STATES);
+const THREAT_INTELLIGENCE_CATEGORY_SET = new Set(THREAT_INTELLIGENCE_CATEGORIES);
+const THREAT_INTELLIGENCE_SEVERITY_SET = new Set(THREAT_INTELLIGENCE_SEVERITIES);
+const THREAT_INTELLIGENCE_CONFIDENCE_SET = new Set(THREAT_INTELLIGENCE_CONFIDENCES);
+const LOOKUP_TIMING_SOURCES = new Set([
+    'rdap',
+    'whois',
+    'domain_evidence',
+    'reverse_dns',
+    'registrar_rdap',
+    'network_context',
+    'security_txt',
+    'external_intelligence',
+    'malware_host_intelligence',
+    'malware_ioc_intelligence',
+]);
+const LOOKUP_TIMING_OUTCOMES = new Set(['fulfilled', 'rejected']);
+const EMPTY_RECORD = Object.freeze({});
+function record(value) {
+    return isJsonObject(value) ? value : EMPTY_RECORD;
+}
+function boundedThreatText(value, maximum = MAX_THREAT_INTELLIGENCE_TEXT_LENGTH) {
+    if (typeof value !== 'string' || CONTROL_CHAR_RE.test(value))
+        return null;
+    const text = value.slice(0, maximum * 2).trim();
+    return text ? text.slice(0, maximum) : null;
+}
+function threatTimestamp(value) {
+    const text = boundedThreatText(value, 40);
+    return text ? normalizeExplicitIsoTimestamp(text) : null;
+}
+function attributedThreatUrl(value, providerId) {
+    const expectedHost = THREAT_INTELLIGENCE_PROVIDERS[providerId]?.host;
+    if (!expectedHost || typeof value !== 'string' || value.length > 1_024 || CONTROL_CHAR_RE.test(value))
+        return null;
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:' && !url.username && !url.password && url.hostname === expectedHost
+            ? url.href
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeThreatFinding(value, providerId) {
+    const input = record(value);
+    const category = boundedThreatText(input.category, 32);
+    if (!category || !THREAT_INTELLIGENCE_CATEGORY_SET.has(category))
+        return null;
+    const referenceUrl = attributedThreatUrl(input.referenceUrl, providerId);
+    const tags = Array.isArray(input.tags)
+        ? [...new Set(input.tags.slice(0, 40).map((tag) => boundedThreatText(tag, 80)).filter((tag) => tag !== null))].slice(0, 20)
+        : [];
+    const firstObservedAt = threatTimestamp(input.firstObservedAt);
+    const lastObservedAt = threatTimestamp(input.lastObservedAt);
+    const severity = boundedThreatText(input.severity, 32);
+    const confidence = boundedThreatText(input.confidence, 32);
+    if (firstObservedAt && lastObservedAt && Date.parse(firstObservedAt) > Date.parse(lastObservedAt))
+        return null;
+    return {
+        id: boundedThreatText(input.id, 160),
+        category,
+        severity: severity && THREAT_INTELLIGENCE_SEVERITY_SET.has(severity) ? severity : 'unknown',
+        confidence: confidence && THREAT_INTELLIGENCE_CONFIDENCE_SET.has(confidence) ? confidence : 'unknown',
+        providerVerdict: boundedThreatText(input.providerVerdict, 120),
+        detail: boundedThreatText(input.detail),
+        firstObservedAt,
+        lastObservedAt,
+        referenceUrl,
+        tags,
+    };
+}
+function normalizeThreatProvider(value, expectedDomain) {
+    const input = record(value);
+    if (input.schema !== THREAT_INTELLIGENCE_SCHEMA
+        || input.version !== THREAT_INTELLIGENCE_CONTRACT_VERSION)
+        return null;
+    const target = record(input.target);
+    if (target.type !== 'domain'
+        || target.exposure !== 'registrable_domain'
+        || target.value !== expectedDomain)
+        return null;
+    const identity = record(input.provider);
+    const providerId = boundedThreatText(identity.id, 80);
+    const providerDefinition = providerId ? THREAT_INTELLIGENCE_PROVIDERS[providerId] : null;
+    if (!providerId || !providerDefinition)
+        return null;
+    const state = boundedThreatText(input.state, 32);
+    if (!state || !THREAT_INTELLIGENCE_STATES.has(state))
+        return null;
+    const observationInput = record(input.observation);
+    const limitations = Array.isArray(observationInput.limitations)
+        ? observationInput.limitations
+            .slice(0, MAX_THREAT_INTELLIGENCE_LIMITATIONS * 2)
+            .map((limitation) => boundedThreatText(limitation))
+            .filter((limitation) => limitation !== null)
+            .slice(0, MAX_THREAT_INTELLIGENCE_LIMITATIONS)
+        : [];
+    const inputFindings = Array.isArray(input.findings) ? input.findings : [];
+    const normalizedFindings = inputFindings
+        .slice(0, MAX_THREAT_INTELLIGENCE_FINDINGS * 2)
+        .map((finding) => normalizeThreatFinding(finding, providerId))
+        .filter((finding) => finding !== null);
+    const findings = normalizedFindings.slice(0, MAX_THREAT_INTELLIGENCE_FINDINGS);
+    const omitted = inputFindings.length - findings.length;
+    const projectionIncomplete = omitted > 0 || !Array.isArray(input.findings);
+    const projectionTruncated = inputFindings.length > MAX_THREAT_INTELLIGENCE_FINDINGS * 2
+        || normalizedFindings.length > MAX_THREAT_INTELLIGENCE_FINDINGS;
+    if (projectionIncomplete) {
+        // Local qualification precedes supplied notices so a full limitation
+        // list cannot conceal evidence discarded at this trust boundary.
+        limitations.unshift(omitted > 0
+            ? `${omitted} invalid or over-limit provider finding${omitted === 1 ? ' was' : 's were'} omitted from this view.`
+            : 'Provider findings were not a supported array and were withheld from this view.');
+    }
+    return {
+        schema: THREAT_INTELLIGENCE_SCHEMA,
+        version: THREAT_INTELLIGENCE_CONTRACT_VERSION,
+        provider: {
+            id: providerId,
+            label: providerDefinition.label,
+        },
+        target: {
+            type: 'domain',
+            value: expectedDomain,
+            exposure: 'registrable_domain',
+        },
+        state: projectionIncomplete && ['success', 'not_found'].includes(state) ? 'partial' : state,
+        detail: boundedThreatText(input.detail),
+        findings,
+        observation: {
+            observedAt: threatTimestamp(observationInput.observedAt),
+            limitations: limitations.slice(0, MAX_THREAT_INTELLIGENCE_LIMITATIONS),
+            complete: projectionIncomplete ? false : typeof observationInput.complete === 'boolean' ? observationInput.complete : null,
+            truncated: projectionTruncated ? true : typeof observationInput.truncated === 'boolean' ? observationInput.truncated : null,
+        },
+    };
+}
+function projectThreatProviders(values, expectedDomain) {
+    const grouped = new Map();
+    for (const value of values.slice(0, MAX_THREAT_INTELLIGENCE_PROVIDERS * 2)) {
+        const provider = normalizeThreatProvider(value, expectedDomain);
+        if (!provider)
+            continue;
+        const providerId = String(record(provider.provider).id || '');
+        if (!providerId)
+            continue;
+        const signature = JSON.stringify(provider);
+        const existing = grouped.get(providerId);
+        if (existing) {
+            existing.signatures.add(signature);
+        }
+        else {
+            grouped.set(providerId, { first: provider, signatures: new Set([signature]) });
+        }
+    }
+    return [...grouped.values()].slice(0, MAX_THREAT_INTELLIGENCE_PROVIDERS).map(({ first, signatures }) => (signatures.size === 1
+        ? first
+        : {
+            ...first,
+            state: 'partial',
+            detail: 'Conflicting records were returned for this provider; no conclusive provider projection is available.',
+            findings: [],
+            observation: {
+                observedAt: null,
+                limitations: ['Conflicting records for the same provider identity were withheld rather than resolved by array order.'],
+                complete: false,
+                truncated: null,
+            },
+        }));
+}
+function optionalBoundedText(value, maxLength) {
+    return value === undefined || (typeof value === 'string'
+        && value.length <= maxLength
+        && !CONTROL_CHAR_RE.test(value));
+}
+function validCompactBulkComparison(value) {
+    if (!isJsonObject(value)
+        || Object.keys(value).length > 3
+        || value.version !== 1
+        || !isJsonObject(value.technology)
+        || Object.keys(value.technology).length > 3
+        || typeof value.technology.state !== 'string'
+        || !COMPACT_BULK_COMPARISON_STATES.has(value.technology.state)
+        || !Array.isArray(value.technology.ids)
+        || value.technology.ids.length > MAX_COMPACT_BULK_TECHNOLOGY_IDS
+        || typeof value.technology.truncated !== 'boolean'
+        || !isJsonObject(value.tls)
+        || Object.keys(value.tls).length > 3
+        || typeof value.tls.state !== 'string'
+        || !COMPACT_BULK_COMPARISON_STATES.has(value.tls.state)
+        || (value.tls.issuerLabel !== null && !optionalBoundedText(value.tls.issuerLabel, 240))
+        || (value.tls.spkiSha256 !== null
+            && (typeof value.tls.spkiSha256 !== 'string' || !SHA256_RE.test(value.tls.spkiSha256)))) {
+        return false;
+    }
+    const ids = value.technology.ids;
+    return ids.every((id) => typeof id === 'string' && COMPACT_BULK_TECHNOLOGY_ID_RE.test(id))
+        && new Set(ids).size === ids.length;
+}
+function invalidLookupResponse() {
+    return {
+        ok: false,
+        errorCode: INVALID_LOOKUP_RESPONSE,
+        error: INVALID_LOOKUP_RESPONSE_MESSAGE,
+    };
+}
+function invalidCompactLookupResponse() {
+    return {
+        ok: false,
+        errorCode: INVALID_COMPACT_LOOKUP_RESPONSE,
+        error: INVALID_COMPACT_LOOKUP_RESPONSE_MESSAGE,
+    };
+}
+function validOptionalHttpUrl(value) {
+    return value === undefined || value === null || validHttpProvenanceUrl(value);
+}
+function validOptionalHttpStatus(value) {
+    return value === undefined || value === null
+        || Number.isInteger(value) && Number(value) >= 100 && Number(value) <= 599;
+}
+function validObservationLimitations(value) {
+    return value === undefined || Array.isArray(value)
+        && value.length <= MAX_OBSERVATION_LIMITATIONS
+        && value.every((item) => typeof item === 'string'
+            && Boolean(item)
+            && item.length <= MAX_OBSERVATION_LIMITATION_LENGTH
+            && !CONTROL_CHAR_RE.test(item));
+}
+function validObservationFields(value) {
+    if (!isJsonObject(value))
+        return false;
+    return optionalBoundedText(value.status, 40)
+        && optionalBoundedText(value.source, 40)
+        && optionalBoundedText(value.observedAt, 64)
+        && (value.scanMode === undefined || value.scanMode === null
+            || typeof value.scanMode === 'string' && ['fast', 'deep'].includes(value.scanMode))
+        && (value.durationMs === undefined || value.durationMs === null
+            || Number.isFinite(value.durationMs) && Number(value.durationMs) >= 0
+                && Number(value.durationMs) <= 120_000)
+        && (value.complete === undefined || typeof value.complete === 'boolean')
+        && (value.truncated === undefined || typeof value.truncated === 'boolean')
+        && validObservationLimitations(value.limitations)
+        && validObservationDiagnostics(value.diagnostics);
+}
+function validSourceStatus(value) {
+    if (!isJsonObject(value))
+        return false;
+    return optionalBoundedText(value.status, 40)
+        && (value.error === undefined || value.error === null || optionalBoundedText(value.error, 240))
+        && (value.endpoint === undefined || value.endpoint === null || optionalBoundedText(value.endpoint, 2_048))
+        && (value.detail === undefined || value.detail === null || optionalBoundedText(value.detail, 500))
+        && (value.fetchedAt === undefined || value.fetchedAt === null || optionalBoundedText(value.fetchedAt, 64))
+        && (value.queriedAt === undefined || value.queriedAt === null || optionalBoundedText(value.queriedAt, 64))
+        && (value.attempts === undefined || Array.isArray(value.attempts)
+            && value.attempts.length <= 3
+            && value.attempts.every((item) => isJsonObject(item)
+                && optionalBoundedText(item.outcome, 40)));
+}
+function validNormalizedHttpEvidence(value) {
+    if (!validObservationFields(value)
+        || !validOptionalHttpUrl(value.requestUrl)
+        || !validOptionalHttpUrl(value.finalUrl)
+        || !validObservationLimitations(value.limitations))
+        return false;
+    const redirects = value.redirects;
+    if (redirects !== undefined && (!Array.isArray(redirects)
+        || redirects.length > MAX_HTTP_EVIDENCE_REDIRECTS
+        || !redirects.every((item) => isJsonObject(item)
+            && validHttpProvenanceUrl(item.from)
+            && validHttpProvenanceUrl(item.to)
+            && validOptionalHttpStatus(item.status)
+            && (item.queryOmitted === undefined || typeof item.queryOmitted === 'boolean'))))
+        return false;
+    const attempts = value.attempts;
+    if (attempts !== undefined && (!Array.isArray(attempts)
+        || attempts.length > MAX_HTTP_ATTEMPTS
+        || !attempts.every((item) => isJsonObject(item)
+            && validOptionalHttpUrl(item.url)
+            && validOptionalHttpStatus(item.httpStatus)
+            && (item.queryOmitted === undefined || typeof item.queryOmitted === 'boolean')
+            && (item.outcome === undefined || typeof item.outcome === 'string'
+                && ['error', 'response', 'unknown'].includes(item.outcome))
+            && (item.error === undefined || item.error === null || typeof item.error === 'string'
+                && item.error.length <= MAX_HTTP_ERROR_LENGTH && !CONTROL_CHAR_RE.test(item.error)))))
+        return false;
+    if (value.redirectCount !== undefined
+        && (!Number.isInteger(value.redirectCount)
+            || Number(value.redirectCount) < 0
+            || Number(value.redirectCount) > MAX_HTTP_EVIDENCE_REDIRECTS))
+        return false;
+    if (Array.isArray(redirects) && value.redirectCount !== undefined
+        && value.redirectCount !== redirects.length)
+        return false;
+    if (value.response !== undefined && value.response !== null) {
+        if (!isJsonObject(value.response)
+            || !validOptionalHttpStatus(value.response.status)
+            || value.response.deliveryMetadata !== undefined
+                && (!['success', 'partial'].includes(String(value.status))
+                    || !validHttpDeliveryMetadata(value.response.deliveryMetadata)))
+            return false;
+    }
+    return true;
+}
+function optionalStringArrayWithin(value, maximum) {
+    return value === undefined || Array.isArray(value)
+        && value.length <= maximum
+        && value.every((item) => typeof item === 'string');
+}
+function optionalRecordArrayWithin(value, maximum) {
+    return value === undefined || Array.isArray(value)
+        && value.length <= maximum
+        && value.every(isJsonObject);
+}
+function validDnsMxRecord(value) {
+    return isJsonObject(value)
+        && validUint(value.priority, 0xffff)
+        && validBoundedString(value.exchange, 253, true);
+}
+function validDnsCaaRecord(value) {
+    return isJsonObject(value)
+        && validUint(value.critical, 0xff)
+        && typeof value.tag === 'string'
+        && /^[a-z0-9-]{1,15}$/u.test(value.tag)
+        && validBoundedString(value.value, 1_024);
+}
+function validDnsSoaRecord(value) {
+    return isJsonObject(value)
+        && validBoundedString(value.nsname, 253)
+        && validBoundedString(value.hostmaster, 253)
+        && ['serial', 'refresh', 'retry', 'expire', 'minttl']
+            .every((key) => validUint(value[key], 0xffff_ffff));
+}
+function validUintArray(value, maximumItems) {
+    return Array.isArray(value)
+        && value.length <= maximumItems
+        && value.every((item) => validUint(item, 0xffff));
+}
+function validDnsHttpsRecord(value) {
+    if (!isJsonObject(value)
+        || value.type !== 'HTTPS'
+        || !validBoundedString(value.owner, 253)
+        || !validUint(value.ttl, 0xffff_ffff)
+        || !validUint(value.priority, 0xffff)
+        || typeof value.mode !== 'string'
+        || !['alias', 'service'].includes(value.mode)
+        || !(value.target === null || validBoundedString(value.target, 253))
+        || typeof value.targetIsOwner !== 'boolean'
+        || typeof value.serviceUnavailable !== 'boolean'
+        || typeof value.compatible !== 'boolean'
+        || typeof value.parametersIgnored !== 'boolean'
+        || !isJsonObject(value.parameters))
+        return false;
+    const parameters = value.parameters;
+    if (Object.keys(parameters).length > 24
+        || !validUintArray(parameters.mandatory, 24)
+        || !validStringArray(parameters.alpn, 16, 132)
+        || typeof parameters.noDefaultAlpn !== 'boolean'
+        || !(parameters.port === null || validUint(parameters.port, 0xffff))
+        || !validStringArray(parameters.ipv4hint, 8, 64)
+        || !validStringArray(parameters.ipv6hint, 8, 64)
+        || !validUintArray(parameters.unknownKeys, 24)
+        || !validUintArray(parameters.unsupportedMandatoryKeys, 24)
+        || !Array.isArray(parameters.opaque)
+        || parameters.opaque.length > 24)
+        return false;
+    return parameters.opaque.every((item) => isJsonObject(item)
+        && validUint(item.key, 0xffff)
+        && (item.name === null || typeof item.name === 'string' && /^[a-z0-9-]{1,63}$/u.test(item.name))
+        && validUint(item.length, 0xffff));
+}
+function validOptionalStringArray(value, maximumItems, maximumLength) {
+    return value === undefined || validStringArray(value, maximumItems, maximumLength);
+}
+function validOptionalRecordArray(value, maximumItems, validate) {
+    return value === undefined || Array.isArray(value)
+        && value.length <= maximumItems
+        && value.every(validate);
+}
+function validRdapLink(value) {
+    return isJsonObject(value)
+        && validBoundedString(value.href, 2_048)
+        && validOptionalNullableText(value.rel, 100)
+        && validOptionalNullableText(value.type, 160)
+        && validOptionalNullableText(value.title, 300);
+}
+function validRdapContact(value) {
+    if (!isJsonObject(value))
+        return false;
+    return validOptionalNullableText(value.handle, 200)
+        && validOptionalNullableText(value.name, 300)
+        && validOptionalNullableText(value.org, 300)
+        && validOptionalNullableText(value.email, 320)
+        && validOptionalNullableText(value.phone, 100)
+        && validOptionalNullableText(value.address, 1_000)
+        && validOptionalStringArray(value.roles, 12, 80)
+        && validOptionalStringArray(value.names, 8, 300)
+        && validOptionalStringArray(value.organizations, 8, 300)
+        && validOptionalStringArray(value.emails, 8, 320)
+        && validOptionalStringArray(value.phones, 8, 100)
+        && validOptionalStringArray(value.addresses, 8, 1_000)
+        && validOptionalRecordArray(value.publicIds, 20, (item) => isJsonObject(item)
+            && validBoundedString(item.type, 160)
+            && validBoundedString(item.identifier, 300))
+        && validOptionalRecordArray(value.links, 10, validRdapLink);
+}
+function validRdapTextBlock(value) {
+    return isJsonObject(value)
+        && validBoundedString(value.title, 160)
+        && validOptionalNullableText(value.type, 160)
+        && validStringArray(value.descriptions, 6, 800);
+}
+function validRdapParsed(value) {
+    if (!isJsonObject(value))
+        return false;
+    if (!validOptionalStringArray(value.statuses, 100, 160)
+        || !validOptionalStringArray(value.nameservers, 200, 253)
+        || !validOptionalStringArray(value.conformance, 50, 160)
+        || !validOptionalStringArray(value.serverTruncationReasons, 8, 160)
+        || !validOptionalStringArray(value.truncatedEntityRoles, 11, 80)
+        || !validOptionalRecordArray(value.events, 100, (item) => isJsonObject(item)
+            && validOptionalNullableText(item.action, 160)
+            && validOptionalNullableText(item.date, 64))
+        || !validOptionalRecordArray(value.links, 20, validRdapLink)
+        || !validOptionalRecordArray(value.nameserverDetails, 200, (item) => isJsonObject(item)
+            && validBoundedString(item.name, 253)
+            && validStringArray(item.addresses, 20, 80))
+        || !validOptionalRecordArray(value.dsData, 50, (item) => isJsonObject(item)
+            && validUint(item.keyTag, 0xffff)
+            && validUint(item.algorithm, 0xff)
+            && validUint(item.digestType, 0xff)
+            && validBoundedString(item.digest, 512))
+        || !validOptionalRecordArray(value.notices, 12, validRdapTextBlock)
+        || !validOptionalRecordArray(value.remarks, 12, validRdapTextBlock)
+        || !validOptionalRecordArray(value.redactions, 100, (item) => isJsonObject(item)
+            && ['name', 'method', 'reason'].every((key) => validOptionalNullableText(item[key], 500))
+            && ['prePath', 'postPath', 'replacementPath']
+                .every((key) => validOptionalNullableText(item[key], 512)))
+        || !validOptionalRecordArray(value.variants, 20, (group) => isJsonObject(group)
+            && validOptionalNullableText(group.idnTable, 300)
+            && validOptionalStringArray(group.relation, 20, 100)
+            && validOptionalRecordArray(group.variantNames, 50, (name) => isJsonObject(name)
+                && validOptionalNullableText(name.ldhName, 253)
+                && validOptionalNullableText(name.unicodeName, 253))))
+        return false;
+    const entitiesByRole = value.entitiesByRole;
+    if (entitiesByRole !== undefined) {
+        if (!isJsonObject(entitiesByRole) || Object.keys(entitiesByRole).length > 11)
+            return false;
+        for (const [role, contacts] of Object.entries(entitiesByRole)) {
+            if (!['registrar', 'registrant', 'administrative', 'technical', 'billing', 'abuse', 'noc', 'reseller', 'sponsor', 'proxy', 'notifications'].includes(role)
+                || !Array.isArray(contacts)
+                || contacts.length > 5
+                || !contacts.every(validRdapContact))
+                return false;
+        }
+    }
+    return true;
+}
+function validWhoisParsed(value) {
+    if (!isJsonObject(value)
+        || !validOptionalStringArray(value.statuses, 100, 160)
+        || !validOptionalStringArray(value.nameservers, 200, 253)
+        || !validOptionalStringArray(value.fieldsTruncated, 64, 80))
+        return false;
+    const contactsByRole = value.contactsByRole;
+    if (contactsByRole !== undefined) {
+        if (!isJsonObject(contactsByRole) || Object.keys(contactsByRole).length > 5)
+            return false;
+        for (const contacts of Object.values(contactsByRole)) {
+            if (!Array.isArray(contacts) || contacts.length > 1 || !contacts.every(validRdapContact))
+                return false;
+        }
+    }
+    return true;
+}
+function validRegistrationEvidence(value) {
+    const rdap = value.rdap;
+    const whois = value.whois;
+    const rdapDiagnostics = isJsonObject(value.diagnostics.rdap) ? value.diagnostics.rdap : null;
+    const whoisDiagnostics = isJsonObject(value.diagnostics.whois) ? value.diagnostics.whois : null;
+    if (!validSourceStatus(rdap)
+        || !validSourceStatus(whois)
+        || rdapDiagnostics !== null && !validSourceStatus(rdapDiagnostics)
+        || whoisDiagnostics !== null && !validSourceStatus(whoisDiagnostics)
+        || rdapDiagnostics?.status === 'success' && !isJsonObject(rdap.parsed)
+        || whoisDiagnostics?.status === 'complete' && !isJsonObject(whois.parsed))
+        return false;
+    if (rdap.parsed !== undefined && rdap.parsed !== null && !validRdapParsed(rdap.parsed))
+        return false;
+    if (whois.parsed !== undefined && whois.parsed !== null && !validWhoisParsed(whois.parsed))
+        return false;
+    const registrar = rdap.registrarRdap;
+    return registrar === undefined || registrar === null || validSourceStatus(registrar)
+        && (registrar.parsed === undefined || registrar.parsed === null || validRdapParsed(registrar.parsed));
+}
+function validPageEvidence(value) {
+    const availability = value.availability;
+    const page = availability.pageIdentity;
+    if (page !== undefined && page !== null) {
+        if (!validObservationFields(page)
+            || page.publicationMetadata !== undefined
+                && (!['success', 'partial'].includes(String(page.status))
+                    || !validPagePublicationMetadata(page.publicationMetadata))
+            || !validOptionalStringArray(page.embeddedOrigins, 20, 2_048)
+            || !validOptionalStringArray(page.contactDomains, 20, 253)
+            || !validOptionalRecordArray(page.trackingIdentifiers, 30, (item) => isJsonObject(item)
+                && validBoundedString(item.type, 80)
+                && validBoundedString(item.value, 240)))
+            return false;
+        if (page.forms !== undefined && (!isJsonObject(page.forms)
+            || !validOptionalStringArray(page.forms.externalActionOrigins, 10, 2_048)))
+            return false;
+        if (page.resources !== undefined && (!isJsonObject(page.resources)
+            || !validOptionalStringArray(page.resources.externalOrigins, 30, 2_048)))
+            return false;
+        if (page.downloads !== undefined && (!isJsonObject(page.downloads)
+            || !validOptionalStringArray(page.downloads.riskyFileTypes, 20, 80)
+            || !validOptionalStringArray(page.downloads.externalOrigins, 20, 2_048)))
+            return false;
+    }
+    const technology = availability.technologyProfile;
+    if (technology !== undefined && technology !== null) {
+        if (!validObservationFields(technology)
+            || !validOptionalRecordArray(technology.findings, 24, (finding) => isJsonObject(finding)
+                && validOptionalRecordArray(finding.evidence, 4, (item) => isJsonObject(item)
+                    && validBoundedString(item.source, 80)
+                    && validBoundedString(item.description, 180))))
+            return false;
+        const libraries = technology.browserLibraryProfile;
+        if (libraries !== undefined && libraries !== null && (!validObservationFields(libraries)
+            || !validOptionalRecordArray(libraries.findings, 16, (item) => isJsonObject(item))))
+            return false;
+    }
+    const structured = availability.structuredDataIdentity;
+    if (structured !== undefined && structured !== null && (!validObservationFields(structured)
+        || !validOptionalRecordArray(structured.entities, 16, (entity) => isJsonObject(entity)
+            && validOptionalStringArray(entity.types, 8, 160)
+            && validOptionalStringArray(entity.sameAsHosts, 12, 253))))
+        return false;
+    const roles = availability.pageRoleProfile;
+    if (roles !== undefined && roles !== null && (!validObservationFields(roles)
+        || !validOptionalRecordArray(roles.findings, 4, (finding) => isJsonObject(finding)
+            && validOptionalStringArray(finding.evidence, 4, 300))))
+        return false;
+    const behavior = availability.clientBehaviorProfile;
+    if (behavior !== undefined && behavior !== null && (!validObservationFields(behavior)
+        || !validOptionalRecordArray(behavior.indicators, 12, (item) => isJsonObject(item))))
+        return false;
+    const credential = availability.credentialSurfaceProfile;
+    return credential === undefined || credential === null || validObservationFields(credential);
+}
+function validAvailabilityScalars(value) {
+    return (value.applicable === undefined || typeof value.applicable === 'boolean')
+        && validOptionalNullableText(value.domain, MAX_LOOKUP_RESPONSE_HOST_LENGTH)
+        && validOptionalNullableText(value.state, 40)
+        && validOptionalNullableText(value.confidence, 40)
+        && validOptionalNullableText(value.activityStatus, 40)
+        && validOptionalNullableText(value.websiteProbeDetail, 500)
+        && validOptionalNullableText(value.pageTitle, MAX_LOOKUP_RESPONSE_PAGE_TITLE_LENGTH)
+        && validOptionalNullableText(value.dnssec, 40)
+        && (value.deepScanComplete === undefined || typeof value.deepScanComplete === 'boolean')
+        && (value.hasMx === undefined || value.hasMx === null || typeof value.hasMx === 'boolean')
+        && (value.hasNullMx === undefined || value.hasNullMx === null || typeof value.hasNullMx === 'boolean')
+        && (value.hasSpf === undefined || value.hasSpf === null || typeof value.hasSpf === 'boolean')
+        && (value.hasDmarc === undefined || value.hasDmarc === null || typeof value.hasDmarc === 'boolean')
+        && validOptionalStringArray(value.mxHosts, MAX_LOOKUP_DNS_RECORDS_PER_TYPE, 253);
+}
+function validLookupDomainIdentity(value) {
+    if (value.type !== 'domain')
+        return true;
+    const availability = record(value.availability);
+    const queryDomain = canonicalRegistrableDomain(value.query);
+    if (!queryDomain)
+        return false;
+    if (availability.domain !== undefined && availability.domain !== null
+        && (canonicalRegistrableDomain(availability.domain) !== queryDomain
+            || normalizedDomain(availability.domain) !== queryDomain))
+        return false;
+    if (!validLookupObservationScope(availability, {
+        inputHostname: normalizedDomain(value.inputHostname ?? value.query), registrableDomain: queryDomain,
+    }))
+        return false;
+    if (value.inputHostname !== undefined
+        && canonicalRegistrableDomain(value.inputHostname) !== queryDomain)
+        return false;
+    if (value.registrableDomain !== undefined
+        && normalizedDomain(value.registrableDomain) !== queryDomain)
+        return false;
+    if (value.isSubdomain !== undefined) {
+        const inputHostname = normalizedDomain(value.inputHostname ?? value.query);
+        if (!inputHostname || value.isSubdomain !== (inputHostname !== queryDomain))
+            return false;
+    }
+    return true;
+}
+function optionalTlsNameWithin(value) {
+    if (value === undefined || value === null)
+        return true;
+    if (!isJsonObject(value))
+        return false;
+    return optionalStringArrayWithin(value.commonNames, MAX_LOOKUP_TLS_NAME_VALUES)
+        && (!Array.isArray(value.commonNames)
+            || value.commonNames.every((item) => validBoundedString(item, 256)))
+        && optionalStringArrayWithin(value.organizations, MAX_LOOKUP_TLS_NAME_VALUES)
+        && (!Array.isArray(value.organizations)
+            || value.organizations.every((item) => validBoundedString(item, 256)));
+}
+function validNormalizedNetworkEvidence(value) {
+    const availability = value.availability;
+    const dns = availability.dns;
+    if (dns !== undefined) {
+        if (!validObservationFields(dns))
+            return false;
+        if (dns.records !== undefined) {
+            if (!isJsonObject(dns.records))
+                return false;
+            for (const [key, maximumLength] of [
+                ['a', 64], ['aaaa', 64], ['cname', 253], ['ns', 253], ['spf', 1_024], ['dmarc', 1_024],
+            ]) {
+                if (!optionalStringArrayWithin(dns.records[key], MAX_LOOKUP_DNS_RECORDS_PER_TYPE)
+                    || Array.isArray(dns.records[key])
+                        && !dns.records[key].every((item) => validBoundedString(item, maximumLength)))
+                    return false;
+            }
+            if (dns.records.mx !== undefined && (!Array.isArray(dns.records.mx)
+                || dns.records.mx.length > MAX_LOOKUP_DNS_RECORDS_PER_TYPE
+                || !dns.records.mx.every(validDnsMxRecord)))
+                return false;
+            if (dns.records.caa !== undefined && (!Array.isArray(dns.records.caa)
+                || dns.records.caa.length > MAX_LOOKUP_DNS_RECORDS_PER_TYPE
+                || !dns.records.caa.every(validDnsCaaRecord)))
+                return false;
+            if (dns.records.soa !== undefined && (!Array.isArray(dns.records.soa)
+                || dns.records.soa.length > 1
+                || !dns.records.soa.every(validDnsSoaRecord)))
+                return false;
+            if (dns.records.https !== undefined && (!Array.isArray(dns.records.https)
+                || dns.records.https.length > MAX_LOOKUP_DNS_RECORDS_PER_TYPE
+                || !dns.records.https.every(validDnsHttpsRecord)))
+                return false;
+        }
+    }
+    const reverseDns = value.reverseDns;
+    if (reverseDns !== undefined) {
+        if (!validObservationFields(reverseDns)
+            || reverseDns.records !== undefined
+                && (!isJsonObject(reverseDns.records)
+                    || !optionalStringArrayWithin(reverseDns.records.ptr, MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS)
+                    || Array.isArray(reverseDns.records.ptr)
+                        && !reverseDns.records.ptr.every((item) => validBoundedString(item, 253))))
+            return false;
+    }
+    const tls = availability.tls;
+    if (tls !== undefined) {
+        if (!validObservationFields(tls)
+            || !optionalRecordArrayWithin(tls.findings, MAX_LOOKUP_TLS_FINDINGS)
+            || Array.isArray(tls.findings) && !tls.findings.every(validTlsFinding)
+            || !optionalRecordArrayWithin(tls.chain, MAX_LOOKUP_TLS_CHAIN_CERTIFICATES)
+            || Array.isArray(tls.chain) && !tls.chain.every(validTlsChainCertificate))
+            return false;
+        const certificate = tls.certificate;
+        if (certificate !== undefined && certificate !== null) {
+            if (!isJsonObject(certificate)
+                || !optionalTlsNameWithin(certificate.subject)
+                || !optionalTlsNameWithin(certificate.issuer))
+                return false;
+            const altNames = certificate.subjectAltNames;
+            if (altNames !== undefined && altNames !== null) {
+                if (!isJsonObject(altNames)
+                    || !optionalStringArrayWithin(altNames.dnsNames, MAX_LOOKUP_TLS_ALT_NAMES)
+                    || Array.isArray(altNames.dnsNames)
+                        && !altNames.dnsNames.every((item) => validBoundedString(item, 253))
+                    || !optionalStringArrayWithin(altNames.ipAddresses, MAX_LOOKUP_TLS_ALT_NAMES)
+                    || Array.isArray(altNames.ipAddresses)
+                        && !altNames.ipAddresses.every((item) => validBoundedString(item, 64)))
+                    return false;
+                const totalAltNames = (Array.isArray(altNames.dnsNames) ? altNames.dnsNames.length : 0)
+                    + (Array.isArray(altNames.ipAddresses) ? altNames.ipAddresses.length : 0);
+                if (totalAltNames > MAX_LOOKUP_TLS_ALT_NAMES)
+                    return false;
+            }
+            const extensionProfile = certificate.extensionProfile;
+            if (extensionProfile !== undefined && extensionProfile !== null) {
+                if (!isJsonObject(extensionProfile))
+                    return false;
+                const certificatePolicies = extensionProfile.certificatePolicies;
+                if (certificatePolicies !== undefined && certificatePolicies !== null
+                    && (!isJsonObject(certificatePolicies)
+                        || !optionalStringArrayWithin(certificatePolicies.oids, MAX_LOOKUP_TLS_CERTIFICATE_POLICIES)
+                        || Array.isArray(certificatePolicies.oids)
+                            && !certificatePolicies.oids.every((item) => validBoundedString(item, 128))))
+                    return false;
+            }
+        }
+        for (const child of [tls.authorization, tls.hostname]) {
+            if (child !== undefined && child !== null && (!isJsonObject(child)
+                || !validOptionalNullableText(child.error, 240)))
+                return false;
+        }
+    }
+    const securityPosture = availability.securityPosture;
+    if (securityPosture !== undefined && securityPosture !== null) {
+        if (!validObservationFields(securityPosture)
+            || !optionalRecordArrayWithin(securityPosture.findings, MAX_SECURITY_POSTURE_FINDINGS)
+            || Array.isArray(securityPosture.findings)
+                && !securityPosture.findings.every(validSecurityPostureFinding))
+            return false;
+    }
+    return true;
+}
+function parseLookupHttpResponse(value) {
+    try {
+        assertBoundedJsonStructure(value, 'Lookup response', {
+            maximumContainerItems: MAX_LOOKUP_RESPONSE_CONTAINER_ITEMS,
+        });
+    }
+    catch {
+        return invalidLookupResponse();
+    }
+    if (!isJsonObject(value) || Object.keys(value).length > MAX_LOOKUP_RESPONSE_TOP_LEVEL_KEYS) {
+        return invalidLookupResponse();
+    }
+    if (typeof value.query !== 'string'
+        || !value.query.trim()
+        || value.query.length > MAX_LOOKUP_RESPONSE_QUERY_LENGTH
+        || CONTROL_CHAR_RE.test(value.query)
+        || typeof value.type !== 'string'
+        || !QUERY_TYPES.has(value.type)
+        || !isJsonObject(value.rdap)
+        || !isJsonObject(value.whois)
+        || !isJsonObject(value.availability)
+        || !isJsonObject(value.diagnostics)
+        || !optionalBoundedText(value.inputHostname, MAX_LOOKUP_RESPONSE_HOST_LENGTH)
+        || !optionalBoundedText(value.registrableDomain, MAX_LOOKUP_RESPONSE_HOST_LENGTH)
+        || (value.isSubdomain !== undefined && typeof value.isSubdomain !== 'boolean')) {
+        return invalidLookupResponse();
+    }
+    for (const key of ['reverseDns', 'networkContext', 'securityTxt', 'sslbl', 'threatIntelligence', 'registryInsights', 'registrarStanding']) {
+        const section = value[key];
+        if (section !== undefined && !isJsonObject(section))
+            return invalidLookupResponse();
+    }
+    const lookupResponse = sanitizeLookupChildProfiles(value);
+    if (lookupResponse.registrarStanding !== undefined
+        && (!validRegistrarStanding(lookupResponse.registrarStanding)
+            || lookupResponse.registrarStanding.ianaId !== resolveRegistrarIanaId(lookupResponse.rdap.parsed, lookupResponse.whois.parsed)))
+        return invalidLookupResponse();
+    if (!validAvailabilityScalars(lookupResponse.availability)
+        || !validLookupDomainIdentity(lookupResponse)
+        || !validRegistrationEvidence(lookupResponse))
+        return invalidLookupResponse();
+    if (lookupResponse.availability.http !== undefined && !validNormalizedHttpEvidence(lookupResponse.availability.http)) {
+        return invalidLookupResponse();
+    }
+    for (const section of [value.reverseDns, value.networkContext, value.securityTxt]) {
+        if (section !== undefined && !validObservationFields(section))
+            return invalidLookupResponse();
+    }
+    if (!validNormalizedNetworkEvidence(lookupResponse)
+        || !validPageEvidence(lookupResponse))
+        return invalidLookupResponse();
+    return { ok: true, value: lookupResponse };
+}
+function parseCompactLookupHttpResponse(value, expectedDomain) {
+    try {
+        assertBoundedJsonStructure(value, 'Compact Lookup response');
+    }
+    catch {
+        return invalidCompactLookupResponse();
+    }
+    if (!isJsonObject(value) || Object.keys(value).length > MAX_COMPACT_LOOKUP_RESPONSE_TOP_LEVEL_KEYS) {
+        return invalidCompactLookupResponse();
+    }
+    const availability = value.availability;
+    const diagnostics = value.diagnostics;
+    const expectedHostname = normalizedDomain(expectedDomain);
+    const expectedRegistrableDomain = canonicalRegistrableDomain(expectedDomain);
+    const compactPageIdentity = isJsonObject(availability) && isJsonObject(availability.pageIdentity)
+        ? availability.pageIdentity
+        : null;
+    const compactHttpResponse = isJsonObject(availability) && isJsonObject(availability.http)
+        && isJsonObject(availability.http.response)
+        ? availability.http.response
+        : null;
+    if (!isJsonObject(availability)
+        || !expectedHostname
+        || !expectedRegistrableDomain
+        || Object.keys(availability).length > MAX_COMPACT_LOOKUP_AVAILABILITY_KEYS
+        || availability.observationHostname !== undefined
+        || availability.webObservationMode !== undefined
+        || availability.applicable !== true
+        || normalizedDomain(availability.domain) !== expectedRegistrableDomain
+        || typeof availability.state !== 'string'
+        || !COMPACT_AVAILABILITY_STATES.has(availability.state)
+        || typeof availability.confidence !== 'string'
+        || !COMPACT_CONFIDENCE_LEVELS.has(availability.confidence)
+        || (availability.deepScanComplete !== undefined && typeof availability.deepScanComplete !== 'boolean')
+        || (availability.bulkComparison !== undefined
+            && !validCompactBulkComparison(availability.bulkComparison))
+        || compactPageIdentity !== null && Object.hasOwn(compactPageIdentity, 'publicationMetadata')
+        || compactHttpResponse !== null && Object.hasOwn(compactHttpResponse, 'deliveryMetadata')
+        || (value.query !== undefined && normalizedDomain(value.query) !== expectedHostname)
+        || (value.type !== undefined && value.type !== 'domain')
+        || (value.inputHostname !== undefined && normalizedDomain(value.inputHostname) !== expectedHostname)
+        || (value.registrableDomain !== undefined
+            && normalizedDomain(value.registrableDomain) !== expectedRegistrableDomain)
+        || (value.isSubdomain !== undefined
+            && (typeof value.isSubdomain !== 'boolean'
+                || value.isSubdomain !== (expectedHostname !== expectedRegistrableDomain)))
+        || !isJsonObject(diagnostics)
+        || Object.keys(diagnostics).length > MAX_COMPACT_LOOKUP_DIAGNOSTIC_KEYS
+        || diagnostics.version !== 7
+        || !isJsonObject(diagnostics.rdap)
+        || !isJsonObject(diagnostics.whois)
+        || !isJsonObject(diagnostics.availability)
+        || typeof diagnostics.availability.status !== 'string'
+        || !COMPACT_AVAILABILITY_DIAGNOSTIC_STATES.has(diagnostics.availability.status)) {
+        return invalidCompactLookupResponse();
+    }
+    return { ok: true, value: value };
+}
+function lookupHttpErrorMessage(value, status) {
+    const source = record(value);
+    const message = typeof source.error === 'string'
+        ? source.error
+            .replace(/[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/gu, ' ')
+            .replace(/\s+/gu, ' ')
+            .trim()
+            .slice(0, MAX_LOOKUP_RESPONSE_ERROR_LENGTH)
+        : '';
+    return message || `Lookup failed (${status})`;
+}
+function isBoundedTimingMs(value, totalMs) {
+    return Number.isInteger(value)
+        && Number(value) >= 0
+        && Number(value) <= totalMs
+        && Number(value) <= MAX_LOOKUP_TIMING_MS;
+}
+function normalizeLookupTiming(value) {
+    if (!isJsonObject(value)
+        || value.version !== 1
+        || !Number.isInteger(value.totalMs)
+        || Number(value.totalMs) < 0
+        || Number(value.totalMs) > MAX_LOOKUP_TIMING_MS
+        || !Array.isArray(value.sources)
+        || value.sources.length > MAX_LOOKUP_TIMING_SOURCES) {
+        return null;
+    }
+    const totalMs = Number(value.totalMs);
+    const seen = new Set();
+    const sources = [];
+    for (const candidate of value.sources) {
+        if (!isJsonObject(candidate)
+            || typeof candidate.source !== 'string'
+            || !LOOKUP_TIMING_SOURCES.has(candidate.source)
+            || seen.has(candidate.source)
+            || typeof candidate.outcome !== 'string'
+            || !LOOKUP_TIMING_OUTCOMES.has(candidate.outcome)
+            || !isBoundedTimingMs(candidate.durationMs, totalMs)
+            || !isBoundedTimingMs(candidate.completedAfterMs, totalMs)
+            || Number(candidate.durationMs) > Number(candidate.completedAfterMs)) {
+            return null;
+        }
+        const source = candidate.source;
+        seen.add(source);
+        sources.push({
+            source,
+            outcome: candidate.outcome,
+            durationMs: Number(candidate.durationMs),
+            completedAfterMs: Number(candidate.completedAfterMs),
+        });
+    }
+    return {
+        version: 1,
+        totalMs,
+        sources,
+    };
+}
+function createLookupHttpResponse(query, classified, result) {
+    return {
+        ...result,
+        query,
+        type: classified.type,
+        inputHostname: classified.inputHostname,
+        registrableDomain: classified.registrableDomain,
+        isSubdomain: classified.isSubdomain,
+    };
+}
+function createLookupViewModel(response) {
+    const availability = record(response?.availability);
+    const rdap = record(response?.rdap);
+    const registrarRdap = record(rdap.registrarRdap);
+    const whois = record(response?.whois);
+    const diagnostics = record(response?.diagnostics);
+    const reverseDns = record(response?.reverseDns);
+    const observedNetworkContext = record(response?.networkContext);
+    const registryInsights = record(response?.registryInsights);
+    const registrarStanding = record(response?.registrarStanding);
+    const securityTxt = record(response?.securityTxt);
+    const sslbl = record(response?.sslbl);
+    const rawThreatIntelligence = record(response?.threatIntelligence);
+    const expectedThreatDomain = response?.type === 'domain'
+        ? canonicalRegistrableDomain(response.registrableDomain)
+            ?? canonicalRegistrableDomain(availability.domain)
+        : null;
+    const providers = expectedThreatDomain
+        && rawThreatIntelligence.version === THREAT_INTELLIGENCE_ENVELOPE_VERSION
+        && Array.isArray(rawThreatIntelligence.providers)
+        ? projectThreatProviders(rawThreatIntelligence.providers, expectedThreatDomain)
+        : [];
+    const threatIntelligence = providers.length
+        ? { version: THREAT_INTELLIGENCE_ENVELOPE_VERSION, providers }
+        : {};
+    const dnsEvidence = record(availability.dns);
+    const httpEvidence = record(availability.http);
+    const httpResponse = record(httpEvidence.response);
+    const tlsEvidence = record(availability.tls);
+    const tlsCertificate = record(tlsEvidence.certificate);
+    const pageIdentity = record(availability.pageIdentity);
+    const pageOpenGraph = record(pageIdentity.openGraph);
+    const pageResources = record(pageIdentity.resources);
+    const securityPosture = record(availability.securityPosture);
+    return {
+        availability,
+        rdap,
+        registrarRdap,
+        registrarRdapParsed: record(registrarRdap.parsed),
+        whois,
+        rdapParsed: record(rdap.parsed),
+        whoisParsed: record(whois.parsed),
+        diagnostics,
+        timing: normalizeLookupTiming(diagnostics.timing),
+        registryAccess: record(diagnostics.registryAccess),
+        registryInsights,
+        registrarStanding,
+        reverseDns,
+        reverseDnsRecords: record(reverseDns.records),
+        observedNetworkContext,
+        observedNetworkEndpoint: record(observedNetworkContext.endpoint),
+        observedNetworkRdap: record(observedNetworkContext.rdap),
+        observedNetwork: record(observedNetworkContext.network),
+        securityTxt,
+        sslbl,
+        threatIntelligence,
+        threatIntelligenceProviders: providers,
+        dnsEvidence,
+        dnsRecords: record(dnsEvidence.records),
+        httpEvidence,
+        httpResponse,
+        httpSecurityHeaders: record(httpResponse.securityHeaders),
+        httpDeliveryMetadata: record(httpResponse.deliveryMetadata),
+        tlsEvidence,
+        tlsCertificate,
+        tlsSubject: record(tlsCertificate.subject),
+        tlsIssuer: record(tlsCertificate.issuer),
+        tlsAltNames: record(tlsCertificate.subjectAltNames),
+        tlsPublicKey: record(tlsCertificate.publicKey),
+        tlsCipher: record(tlsEvidence.cipher),
+        tlsAuthorization: record(tlsEvidence.authorization),
+        tlsHostname: record(tlsEvidence.hostname),
+        tlsValidity: record(tlsEvidence.validity),
+        tlsDiagnostics: record(tlsEvidence.diagnostics),
+        pageIdentity,
+        pagePublicationMetadata: record(pageIdentity.publicationMetadata),
+        pageCanonical: record(pageIdentity.canonical),
+        pageMetaRefresh: record(pageIdentity.metaRefresh),
+        pageOpenGraph,
+        pageOpenGraphUrl: record(pageOpenGraph.url),
+        pageForms: record(pageIdentity.forms),
+        pageResources,
+        pageResourceTypes: record(pageResources.byType),
+        pageDownloads: record(pageIdentity.downloads),
+        pageFingerprints: record(pageIdentity.fingerprints),
+        credentialSurfaceProfile: record(availability.credentialSurfaceProfile),
+        structuredDataIdentity: record(availability.structuredDataIdentity),
+        technologyProfile: record(availability.technologyProfile),
+        pageRoleProfile: record(availability.pageRoleProfile),
+        clientBehaviorProfile: record(availability.clientBehaviorProfile),
+        securityPosture,
+        securityPostureSummary: record(securityPosture.summary),
+    };
+}
+export { INVALID_COMPACT_LOOKUP_RESPONSE, INVALID_COMPACT_LOOKUP_RESPONSE_MESSAGE, INVALID_LOOKUP_RESPONSE, INVALID_LOOKUP_RESPONSE_MESSAGE, MAX_COMPACT_LOOKUP_AVAILABILITY_KEYS, MAX_COMPACT_LOOKUP_DIAGNOSTIC_KEYS, MAX_COMPACT_LOOKUP_RESPONSE_TOP_LEVEL_KEYS, MAX_LOOKUP_RESPONSE_ERROR_LENGTH, MAX_LOOKUP_RESPONSE_CONTAINER_ITEMS, MAX_LOOKUP_RESPONSE_HOST_LENGTH, MAX_LOOKUP_RESPONSE_QUERY_LENGTH, MAX_LOOKUP_RESPONSE_TOP_LEVEL_KEYS, MAX_LOOKUP_DNS_RECORDS_PER_TYPE, MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS, MAX_LOOKUP_TLS_ALT_NAMES, MAX_LOOKUP_TLS_CERTIFICATE_POLICIES, MAX_LOOKUP_TLS_CHAIN_CERTIFICATES, MAX_LOOKUP_TLS_FINDINGS, MAX_LOOKUP_TLS_NAME_VALUES, MAX_LOOKUP_TIMING_MS, MAX_LOOKUP_TIMING_SOURCES, MAX_THREAT_INTELLIGENCE_PROVIDERS, MAX_THREAT_INTELLIGENCE_FINDINGS, MAX_THREAT_INTELLIGENCE_LIMITATIONS, validNormalizedHttpEvidence, createLookupHttpResponse, createLookupViewModel, isJsonObject, lookupHttpErrorMessage, normalizeLookupTiming, parseCompactLookupHttpResponse, parseLookupHttpResponse, record as lookupRecord, };