@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/cli/domain-control-observations.mjs

@@ -1,12 +1,21 @@
 import { Buffer } from 'node:buffer';
+import { latestObservationCohort } from "../packages/evidence/latest-observations.mjs";
+import { canonicalCaaRecord, canonicalDsRecord, canonicalMxRecord, canonicalDomainControlRecords, canonicalPostureRecords } from "../packages/evidence/domain-control-runtime.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
+import { postureTransferRestriction } from "../packages/evidence/domain-posture-context.mjs";
+import { MAX_DOMAIN_CONTROL_INPUT_RECORDS, PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION } from "../packages/contracts/domain-control-manifest.mjs";
 import { scanBoundedJson, } from "../lib/bounded-json.mjs";
-import { CLI_DOMAIN_CONTROL_REVIEW_INPUT_KEYS, CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS, CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_VERSION, DOMAIN_CONTROL_REVIEW_VERSION, MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES, MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH, MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS, MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES, MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS, MIN_DOMAIN_CONTROL_REVIEW_LOOKUPS, } from "../packages/contracts/domain-control-review.mjs";
-import { DOMAIN_CONTROL_FLIGHT_RECORDER_FIELDS, } from "../lib/domain-control-flight-recorder.mjs";
+import { CLI_DOMAIN_CONTROL_REVIEW_INPUT_KEYS, CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS, CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_VERSION, PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION, SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS, DOMAIN_CONTROL_REVIEW_VERSION, MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES, MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH, MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS, MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES, MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS, MIN_DOMAIN_CONTROL_REVIEW_LOOKUPS, } from "../packages/contracts/domain-control-review.mjs";
+import { MAX_FLIGHT_RECORDER_VALUES, mergeConcurrentDomainControlFields, } from "../lib/domain-control-flight-recorder.mjs";
 import { DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, reviewDomainControlManifest, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
 export { CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_VERSION, MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES, MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH, MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS, MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES, MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS, };
 const CLI_REVIEW_INPUT_KEY_SET = new Set(CLI_DOMAIN_CONTROL_REVIEW_INPUT_KEYS);
+export const DOMAIN_CONTROL_REVIEW_SOURCE_FIELDS = Object.freeze({
+    registry_nameservers: 'nameservers', delegation_ds: 'ds', mail_exchangers: 'mx', caa_policy: 'caa',
+    tls_certificate: 'tlsIssuer', tls_public_key: 'tlsSpkiSha256', registrar_lock: 'registrarLock',
+});
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -21,116 +30,147 @@ function state(value) {
     return 'unavailable';
 }
 function text(value, maximum = 500) {
-    if (typeof value !== 'string')
+    if (typeof value !== 'string' || value.length > maximum || /[\u0000-\u001f\u007f]/u.test(value))
         return null;
-    const normalized = value.replace(/[\u0000-\u001f\u007f]+/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum);
+    const normalized = value.trim();
     return normalized || null;
 }
-function list(value, normalizer = (item) => text(item)) {
-    if (!Array.isArray(value))
-        return [];
-    return [...new Set(value.slice(0, 128).flatMap((item) => {
-            const normalized = normalizer(item);
-            return normalized ? [normalized.toLowerCase()] : [];
-        }))].sort().slice(0, 32);
-}
-function hostname(value) {
-    return text(value, 253)?.toLowerCase().replace(/\.$/u, '') ?? null;
-}
-function mxValue(value) {
-    const item = record(value);
-    const exchange = hostname(item.exchange ?? item.host ?? item.value);
-    if (!exchange)
-        return text(value);
-    const priority = Number.isSafeInteger(item.priority) && Number(item.priority) >= 0 ? Number(item.priority) : null;
-    return priority === null ? exchange : `${priority} ${exchange}`;
-}
-function caaValue(value) {
-    const item = record(value);
-    const tag = text(item.tag, 32)?.toLowerCase();
-    const recordValue = text(item.value, 500)?.toLowerCase();
-    if (!tag || !recordValue)
-        return text(value);
-    const critical = Number.isSafeInteger(item.critical) ? Number(item.critical) : Number.isSafeInteger(item.flags) ? Number(item.flags) : 0;
-    return `${critical} ${tag} ${recordValue}`;
-}
-function dsValue(value) {
-    const item = record(value);
-    const keyTag = Number.isSafeInteger(item.keyTag) ? item.keyTag : null;
-    const algorithm = Number.isSafeInteger(item.algorithm) ? item.algorithm : null;
-    const digestType = Number.isSafeInteger(item.digestType) ? item.digestType : null;
-    const digest = text(item.digest, 512)?.toLowerCase();
-    return keyTag !== null && algorithm !== null && digestType !== null && digest
-        ? `${keyTag} ${algorithm} ${digestType} ${digest}`
-        : text(value);
-}
-function field(id, source, sourceState, values) {
-    return Object.freeze({ id, source, state: sourceState, values: Object.freeze([...values].sort()) });
+function sourceClock(...values) {
+    const declared = values.filter((value) => value !== undefined && value !== null);
+    const times = declared.map(normalizeExplicitIsoTimestamp);
+    return times.length && times.every((time) => time !== null && time === times[0]) ? times[0] : null;
+}
+function sourceState(value) {
+    const result = state(value.status);
+    return result === 'observed' && (value.complete === false || value.truncated === true) ? 'partial' : result;
+}
+function dnsRecordState(dns, name) {
+    const query = record(record(dns.diagnostics)[name]);
+    if (!Object.keys(query).length)
+        return sourceState(dns);
+    const values = record(dns.records)[name];
+    const contradictoryAbsence = query.status === 'not_found' && Array.isArray(values) && values.length > 0;
+    if ((query.status === 'success' || query.status === 'not_found') && query.truncated === false && query.discarded === 0
+        && !contradictoryAbsence && (query.error === undefined || query.error === null))
+        return 'observed';
+    return state(query.status) === 'observed' || query.status === 'not_found' ? 'partial' : state(query.status);
+}
+function field(id, source, sourceState, values, observedAt) {
+    return Object.freeze({ id, source, state: sourceState, values: Object.freeze([...values].sort()), observedAt });
+}
+function recordField(id, source, sourceState, input, normalize, observedAt) {
+    const rows = Array.isArray(input) ? input.slice(0, MAX_DOMAIN_CONTROL_INPUT_RECORDS) : [];
+    const values = new Set();
+    let invalid = Array.isArray(input) || (input === undefined && sourceState !== 'observed') ? 0 : 1;
+    for (const row of rows) {
+        let value = '';
+        try {
+            value = normalize(row);
+        }
+        catch (error) {
+            if (!(error instanceof TypeError))
+                throw error;
+        }
+        if (value)
+            values.add(value);
+        else
+            invalid += 1;
+    }
+    const sorted = [...values].sort();
+    const omitted = Math.max(0, (Array.isArray(input) ? input.length : 0) - rows.length)
+        + Math.max(0, sorted.length - MAX_FLIGHT_RECORDER_VALUES);
+    return field(id, invalid || omitted ? `${source} (${invalid} invalid; ${omitted} omitted records)` : source, sourceState === 'observed' && (invalid || omitted) ? 'partial' : sourceState, sorted.slice(0, MAX_FLIGHT_RECORDER_VALUES), observedAt);
 }
 function diagnostic(document, key) {
-    return state(record(document.diagnostics)[key] && record(record(document.diagnostics)[key]).status);
+    return sourceState(record(record(document.diagnostics)[key]));
+}
+function registryClock(document, key) {
+    const detail = record(record(document.diagnostics)[key]);
+    const publication = record(document[key]);
+    const named = key === 'rdap' ? 'fetchedAt' : 'queriedAt';
+    return sourceClock(detail.observedAt, detail[named], publication.observedAt, publication[named]);
 }
 function registryParsed(document) {
     const rdapState = diagnostic(document, 'rdap');
     const whoisState = diagnostic(document, 'whois');
     const rdap = record(record(document.rdap).parsed);
     if (rdapState === 'observed' && Object.keys(rdap).length)
-        return { parsed: rdap, source: 'Registry RDAP', sourceState: rdapState };
+        return { parsed: rdap, source: 'Registry RDAP', sourceState: rdapState, observedAt: registryClock(document, 'rdap') };
     const whois = record(record(document.whois).parsed);
-    return { parsed: whois, source: 'WHOIS', sourceState: whoisState };
+    return { parsed: whois, source: 'WHOIS', sourceState: whoisState, observedAt: registryClock(document, 'whois') };
 }
 function lockValue(parsed) {
-    const statuses = list(parsed.statuses ?? parsed.status, (item) => text(item, 120)?.replace(/[\s_-]+/gu, '').toLowerCase() ?? null);
-    return [statuses.some((item) => item.includes('transferprohibited')) ? 'required' : 'not_required'];
+    const input = parsed.statuses ?? parsed.status;
+    const statuses = Array.isArray(input) ? canonicalPostureRecords('registration_lock', input) : null;
+    return statuses ? postureTransferRestriction(statuses) : null;
 }
 function pageIdentityValue(availability) {
     const identity = record(availability.pageIdentity);
     const components = [
-        text(identity.bodySha256 ?? availability.pageBodySha256, 64),
-        text(identity.faviconHash ?? availability.faviconHash, 128),
-        text(identity.title ?? availability.pageTitle, 240),
+        text(identity.bodySha256, 64),
+        text(identity.faviconHash, 128),
+        text(identity.title, 240),
     ].filter((item) => Boolean(item));
-    return components.length ? [components.join(' | ').toLowerCase()] : [];
+    return components.length ? [components.join(' | ')] : [];
 }
 export function domainControlObservationFromSavedLookup(document) {
     const availability = record(document.availability);
     const dns = record(availability.dns);
     const dnsRecords = record(dns.records);
+    const dnsAt = sourceClock(dns.observedAt, dns.checkedAt);
     const delegation = record(dns.delegation);
     const delegationRecords = record(delegation.records);
     const tls = record(availability.tls);
-    const tlsState = state(tls.status);
+    const tlsState = sourceState(tls);
+    const tlsAt = sourceClock(tls.observedAt, tls.checkedAt);
     const certificate = record(tls.certificate);
     const publicKey = record(certificate.publicKey);
     const http = record(availability.http);
-    const httpState = state(http.status);
     const registry = registryParsed(document);
     const rdapParsed = record(record(document.rdap).parsed);
     const rdapState = diagnostic(document, 'rdap');
-    const dnsState = state(dns.status);
+    const rdapAt = registryClock(document, 'rdap');
+    const scalar = (id, source, status, value, observedAt, maximum = 500) => recordField(id, source, status, [value], (item) => text(item, maximum) ?? '', observedAt);
+    const hostname = (value) => canonicalDomainControlRecords([value], 'nameservers')[0] ?? '';
+    const identity = record(availability.pageIdentity);
+    const identityValues = pageIdentityValue(availability);
     const fields = [
-        field('registrar', registry.source, registry.sourceState, list([record(registry.parsed.registrar).name ?? registry.parsed.registrar], (item) => text(item, 300))),
-        field('registrar_lock', registry.source, registry.sourceState, registry.sourceState === 'observed' ? lockValue(registry.parsed) : []),
-        field('registry_dnssec', 'Registry RDAP', rdapState, list([rdapParsed.dnssec], (item) => text(item, 80))),
-        field('registry_nameservers', 'Registry RDAP', rdapState, list(rdapParsed.nameservers, hostname)),
-        field('whois_nameservers', 'WHOIS', diagnostic(document, 'whois'), list(record(record(document.whois).parsed).nameservers, hostname)),
-        field('delegated_nameservers', 'DNS', dnsState, list(dnsRecords.ns, hostname)),
-        field('delegation_ds', 'DNS delegation', state(delegation.status), list(delegationRecords.ds, dsValue)),
-        field('mail_exchangers', 'DNS', dnsState, list(dnsRecords.mx, mxValue)),
-        field('caa_policy', 'DNS', dnsState, list(record(dns.caaPolicy).records ?? dnsRecords.caa, caaValue)),
-        field('tls_certificate', 'TLS', tlsState, list([certificate.fingerprintSha256 ?? tls.fingerprintSha256], (item) => text(item, 128))),
-        field('tls_public_key', 'TLS', tlsState, list([publicKey.fingerprintSha256 ?? tls.spkiSha256], (item) => text(item, 128))),
-        field('http_origin', 'HTTP', httpState, list([http.finalOrigin ?? availability.httpFinalOrigin], (item) => text(item, 500))),
-        field('page_identity', 'Static page identity', state(record(availability.pageIdentity).status ?? availability.pageIdentityStatus ?? http.status), pageIdentityValue(availability)),
+        scalar('registrar', registry.source, registry.sourceState, record(registry.parsed.registrar).name ?? registry.parsed.registrar, registry.observedAt, 300),
+        scalar('registrar_lock', registry.source, registry.sourceState, lockValue(registry.parsed), registry.observedAt, 20),
+        scalar('registry_dnssec', 'Registry RDAP', rdapState, rdapParsed.dnssec, rdapAt, 80),
+        recordField('registry_nameservers', 'Registry RDAP', rdapState, rdapParsed.nameservers, hostname, rdapAt),
+        recordField('whois_nameservers', 'WHOIS', diagnostic(document, 'whois'), record(record(document.whois).parsed).nameservers, hostname, registryClock(document, 'whois')),
+        recordField('delegated_nameservers', 'DNS NS', dnsRecordState(dns, 'ns'), dnsRecords.ns, hostname, dnsAt),
+        recordField('delegation_ds', 'DNS delegation', Object.hasOwn(delegationRecords, 'ds') ? sourceState(delegation) : 'unsupported', delegationRecords.ds, canonicalDsRecord, sourceClock(delegation.observedAt)),
+        recordField('mail_exchangers', 'DNS MX', dnsRecordState(dns, 'mx'), dnsRecords.mx, canonicalMxRecord, dnsAt),
+        recordField('caa_policy', 'DNS CAA', dnsRecordState(dns, 'caa'), dnsRecords.caa, canonicalCaaRecord, dnsAt),
+        scalar('tls_certificate', 'TLS', tlsState, certificate.fingerprintSha256 ?? tls.fingerprintSha256, tlsAt, 128),
+        scalar('tls_public_key', 'TLS', tlsState, publicKey.fingerprintSha256 ?? tls.spkiSha256, tlsAt, 128),
+        scalar('http_origin', 'HTTP', sourceState(http), http.finalOrigin, sourceClock(http.observedAt, http.checkedAt)),
+        field('page_identity', 'Static page identity', sourceState(identity) === 'observed' && !identityValues.length ? 'partial' : sourceState(identity), identityValues, sourceClock(identity.observedAt)),
     ];
     return Object.freeze({
-        domain: document.registrableDomain,
-        observedAt: document.generatedAt,
-        collectionDepth: document.mode,
-        fields: Object.freeze(fields.filter((item) => DOMAIN_CONTROL_FLIGHT_RECORDER_FIELDS.includes(item.id))),
+        domain: document.registrableDomain, capturedAt: document.generatedAt, collectionDepth: document.mode,
+        fields: Object.freeze(fields.map((item) => item.state === 'observed' && item.observedAt !== null
+            && Date.parse(item.observedAt) > Date.parse(document.generatedAt) ? Object.freeze({ ...item, state: 'partial' }) : item)),
+    });
+}
+function reviewFields(document, observation) {
+    return observation.fields.map((candidate) => {
+        if (candidate.id !== 'tls_certificate')
+            return candidate;
+        const issuer = record(record(record(document.availability).tls).certificate).issuer;
+        const value = record(issuer);
+        const commonNames = Array.isArray(value.commonNames) ? value.commonNames : [];
+        const organisationNames = Array.isArray(value.organizationNames) ? value.organizationNames : [];
+        return recordField(candidate.id, candidate.source, candidate.state, [commonNames[0] ?? organisationNames[0] ?? issuer], (item) => text(item, 300) ?? '', candidate.observedAt);
     });
 }
 export function buildCliDomainControlReview(inputText, generatedAt = new Date().toISOString()) {
+    const reviewTime = normalizeExplicitIsoTimestamp(generatedAt);
+    if (!reviewTime)
+        throw new CliUsageError('Domain-control review time must include a valid explicit timezone.');
+    generatedAt = reviewTime;
     if (Buffer.byteLength(inputText, 'utf8') > MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES) {
         throw new CliUsageError(`Domain-control review input is limited to ${MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES} bytes.`);
     }
@@ -161,7 +201,7 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
     }
     const input = record(parsed);
     if (input.schema !== CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA
-        || input.version !== CLI_DOMAIN_CONTROL_REVIEW_VERSION
+        || !SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS.some((version) => version === input.version)
         || !Array.isArray(input.lookups)) {
         throw new CliUsageError(`Domain-control review input must use ${CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA} version ${CLI_DOMAIN_CONTROL_REVIEW_VERSION}.`);
     }
@@ -173,42 +213,49 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
         throw new CliUsageError(`Domain-control review requires from ${MIN_DOMAIN_CONTROL_REVIEW_LOOKUPS} to ${MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS} saved Lookup documents.`);
     }
     const manifest = verifyDomainControlManifest(input.manifest);
+    if (input.version === PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION && manifest.version !== PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION) {
+        throw new CliUsageError(`Public domain-control review input version ${PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION} requires manifest version ${PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION}.`);
+    }
     const lookups = input.lookups.map((item, index) => parseSavedLookupDocument(JSON.stringify(item), { label: `Lookup ${index + 1}` }));
-    const latest = new Map();
+    const byDomain = new Map();
     for (const lookup of lookups) {
-        const current = latest.get(lookup.registrableDomain);
-        if (!current || Date.parse(lookup.generatedAt) > Date.parse(current.generatedAt))
-            latest.set(lookup.registrableDomain, lookup);
+        const group = byDomain.get(lookup.registrableDomain) ?? [];
+        group.push(lookup);
+        byDomain.set(lookup.registrableDomain, group);
     }
-    const observations = [...latest.values()].map(domainControlObservationFromSavedLookup);
+    let ignoredHistoricalLookups = 0;
+    const selected = [...byDomain.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([domain, documents]) => {
+        const cohort = latestObservationCohort(documents, (document) => document.generatedAt);
+        ignoredHistoricalLookups += cohort.superseded;
+        const captures = cohort.latest.map((document) => ({ document, observation: domainControlObservationFromSavedLookup(document) }));
+        const first = captures[0];
+        if (!first || !cohort.observedAt || cohort.undated.length)
+            throw new CliUsageError('Saved Lookup observation times could not be ordered.');
+        const mergedFields = mergeConcurrentDomainControlFields(captures.map((capture) => capture.observation.fields));
+        const futureCapture = Date.parse(cohort.observedAt) > Date.parse(generatedAt);
+        const observation = Object.freeze({
+            domain,
+            capturedAt: cohort.observedAt,
+            collectionDepth: captures.every((capture) => capture.observation.collectionDepth === first.observation.collectionDepth)
+                ? first.observation.collectionDepth : 'unknown',
+            fields: futureCapture ? mergedFields.map((field) => ({ ...field, state: 'partial' })) : mergedFields,
+        });
+        const fields = mergeConcurrentDomainControlFields(captures.map((capture) => reviewFields(capture.document, capture.observation)));
+        return { observation, reviewFields: futureCapture || observation.collectionDepth === 'unknown'
+                ? fields.map((field) => ({ ...field, state: 'partial' })) : fields };
+    });
+    const observations = selected.map((item) => item.observation);
     const review = reviewDomainControlManifest({
         schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA,
         version: DOMAIN_CONTROL_REVIEW_VERSION,
         manifest,
-        observations: observations.map((item) => ({
-            domain: item.domain,
-            fields: Object.fromEntries(item.fields.flatMap((candidate) => {
-                const mapping = {
-                    registry_nameservers: 'nameservers',
-                    delegation_ds: 'ds',
-                    mail_exchangers: 'mx',
-                    caa_policy: 'caa',
-                    tls_certificate: 'tlsIssuer',
-                    tls_public_key: 'tlsSpkiSha256',
-                    registrar_lock: 'registrarLock',
-                };
-                const target = mapping[candidate.id];
+        observations: selected.map(({ observation, reviewFields: fields }) => ({
+            domain: observation.domain,
+            fields: Object.fromEntries(fields.flatMap((candidate) => {
+                const target = DOMAIN_CONTROL_REVIEW_SOURCE_FIELDS[candidate.id];
                 if (!target)
                     return [];
-                const candidateValues = candidate.id === 'tls_certificate'
-                    ? list([record(record(record(latest.get(item.domain)?.availability).tls).certificate).issuer], (value) => {
-                        const issuer = record(value);
-                        const commonNames = Array.isArray(issuer.commonNames) ? issuer.commonNames : [];
-                        const organisationNames = Array.isArray(issuer.organizationNames) ? issuer.organizationNames : [];
-                        return text(commonNames[0] ?? organisationNames[0] ?? value, 300);
-                    })
-                    : candidate.values;
-                return [[target, { state: candidate.state, values: candidateValues, source: candidate.source, observedAt: item.observedAt }]];
+                return [[target, { state: candidate.state, values: candidate.values, source: candidate.source, observedAt: candidate.observedAt }]];
             })),
         })),
     }, generatedAt);
@@ -221,7 +268,7 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
         input: Object.freeze({
             lookupsReceived: lookups.length,
             latestDomainObservations: observations.length,
-            ignoredHistoricalLookups: lookups.length - observations.length,
+            ignoredHistoricalLookups,
         }),
         limitations: CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS,
     });

package/cli/errors.mjs

@@ -1,4 +1,6 @@
+import { stripVTControlCharacters } from 'node:util';
 const MAX_CLI_ERROR_MESSAGE_LENGTH = 300;
+const MAX_CLI_DIAGNOSTIC_BYTES = 4_096;
 const CLI_DEFAULT_IGNORABLE_RE = /\p{Default_Ignorable_Code_Point}/u;
 const CLI_DEFAULT_IGNORABLE_GLOBAL_RE = /\p{Default_Ignorable_Code_Point}/gu;
 class CliUsageError extends Error {
@@ -23,10 +25,40 @@ function boundedCliErrorMessage(error, fallback = 'Unexpected command failure')
 function hasUnsafeCliText(value) {
     return /[\x00-\x1f\x7f-\x9f]/u.test(value) || CLI_DEFAULT_IGNORABLE_RE.test(value);
 }
+// A transient stderr preview, never a checkpoint field. Bound before collecting
+// and redact request URLs and credential-shaped fields before shortening text.
+function createCliDiagnosticOutput() {
+    const chunks = [];
+    let remaining = MAX_CLI_DIAGNOSTIC_BYTES;
+    return Object.freeze({
+        stream: {
+            isTTY: false,
+            columns: 80,
+            write(chunk) {
+                if (remaining > 0 && chunk.length > 0) {
+                    const bytes = Buffer.from(chunk.slice(0, remaining), 'utf8').subarray(0, remaining);
+                    chunks.push(bytes.toString('utf8'));
+                    remaining -= bytes.byteLength;
+                }
+                return true;
+            },
+        },
+        value() {
+            const source = stripVTControlCharacters(chunks.join('')).replace(CLI_DEFAULT_IGNORABLE_GLOBAL_RE, '');
+            if (!source.trim())
+                return '';
+            const redacted = source
+                .replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s<>"']*/giu, '[URL omitted]')
+                .replace(/\b(authorization|cookie|password|passphrase|token|secret|api[-_ ]?key)\s*[:=]\s*(?:"[^"]*(?:"|$)|'[^']*(?:'|$)|[^\r\n,;]*)/giu, '$1=[omitted]')
+                .replace(/\b(?:bearer|basic)\s+[^\s,;]+/giu, '[credential omitted]');
+            return boundedCliErrorMessage(redacted);
+        },
+    });
+}
 function boundedCliInputError(error, label) {
     if (error instanceof CliUsageError)
         return error;
     const safeLabel = label.replace(/[^A-Za-z0-9 ()_-]+/gu, '').trim().slice(0, 80) || 'Input';
     return new CliUsageError(`${safeLabel} could not be read as a bounded regular file.`);
 }
-export { CliUsageError, MAX_CLI_ERROR_MESSAGE_LENGTH, boundedCliErrorMessage, boundedCliInputError, hasUnsafeCliText, };
+export { CliUsageError, MAX_CLI_ERROR_MESSAGE_LENGTH, boundedCliErrorMessage, boundedCliInputError, createCliDiagnosticOutput, hasUnsafeCliText, };

package/cli/evidence-command-runner.mjs

@@ -5,6 +5,7 @@ import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 import { formatJsonDocument } from "./formatters/json.mjs";
 import { readCliTextInput } from "./input.mjs";
+import { assessEvidenceSignerTrust, formatSignerTrustReport, MAX_SIGNER_TRUST_STORE_BYTES } from "./signer-trust.mjs";
 import { runDiscriminatedCommandHandler } from "./discriminated-command-handlers.mjs";
 export function isEvidenceCommand(args) {
     return args.action === 'inspect-archive'
@@ -18,12 +19,12 @@ export function evidenceCommandFailureLabel(action) {
         return 'Evidence signing';
     return 'Evidence signature verification';
 }
-async function readArtifact(source, label, dependencies) {
+async function readArtifact(source, label, dependencies, maximumBytes = MAX_OFFLINE_ARTIFACT_BYTES) {
     try {
         return dependencies.readArtifactInput
             ? await dependencies.readArtifactInput(source)
             : await readCliTextInput(source, dependencies.stdin, {
-                maximumBytes: MAX_OFFLINE_ARTIFACT_BYTES,
+                maximumBytes,
                 label,
                 ...(dependencies.signal ? { signal: dependencies.signal } : {}),
             });
@@ -105,12 +106,22 @@ async function runVerifySignatureCommand(args, dependencies) {
         ? await readKey(args.publicKeySource, 'Public key file', dependencies.readPublicKeyFile, dependencies)
         : null;
     const report = await verifyEvidencePackageSignature(input, publicKey);
+    let trustReport = null;
+    if (args.trustStoreSource) {
+        const trustRaw = await readArtifact(args.trustStoreSource, 'Signer trust store', dependencies, MAX_SIGNER_TRUST_STORE_BYTES);
+        try {
+            trustReport = assessEvidenceSignerTrust(report, trustRaw, dependencies.now ? dependencies.now() : new Date().toISOString());
+        }
+        catch (error) {
+            throw new CliUsageError(boundedCliErrorMessage(error, 'Invalid signer trust store.'));
+        }
+    }
     if (!args.quiet) {
         dependencies.stdout.write(args.output === 'json'
-            ? formatJsonDocument(report)
-            : formatEvidenceSignatureVerification(report));
+            ? formatJsonDocument(trustReport ?? report)
+            : trustReport ? formatSignerTrustReport(trustReport) : formatEvidenceSignatureVerification(report));
     }
-    return EXIT_CODES.SUCCESS;
+    return trustReport && trustReport.state !== 'trusted' ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
 }
 const EVIDENCE_COMMAND_HANDLERS = Object.freeze({
     'inspect-archive': runInspectArchiveCommand,

package/cli/evidence-signing.mjs

@@ -216,11 +216,11 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
         ]),
     });
 }
-export function formatEvidenceSignatureVerification(report) {
+export function formatEvidenceSignatureVerification(report, includeStandaloneTrust = true) {
     const lines = [
         'WHOISleuth evidence signature verification',
         `State: ${report.state}`,
-        `Signer trust: ${report.signature.signerTrust}`,
+        ...(includeStandaloneTrust ? [`Signer trust: ${report.signature.signerTrust}`] : []),
         `Artifact: ${report.artifact.kind} · ${report.artifact.schema ?? 'unrecognised'} v${report.artifact.version ?? 'unrecognised'}`,
         `Artifact assurance: ${report.artifact.assurance.state}`,
         `Signed: ${report.signature.signedAt}`,

package/cli/external-observation-mapping.mjs

@@ -1,6 +1,6 @@
 import { domainToASCII } from 'node:url';
 import { exactKeys, requireBoundedString, requireIsoTimestamp, requireRecord, } from "../lib/bounded-contract-normalizers.mjs";
-import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, EXTERNAL_FINDING_CATEGORIES, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, MAX_EXTERNAL_FINDING_DOMAINS, parseExternalFindingsDocument, } from "../packages/interchange/external-findings-import.mjs";
+import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, EXTERNAL_FINDING_CATEGORIES, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDING_LIMITATIONS, MAX_EXTERNAL_FINDING_LIMITATION_LENGTH, parseExternalFindingsDocument, retainExternalFindingLimitations, } from "../packages/interchange/external-findings-import.mjs";
 export const EXTERNAL_OBSERVATION_MAPPING_SCHEMA = 'whoisleuth.external-observation-mapping';
 export const EXTERNAL_OBSERVATION_MAPPING_VERSION = 1;
 export const MAX_EXTERNAL_OBSERVATION_MAPPING_BYTES = 4 * 1024 * 1024;
@@ -49,9 +49,9 @@ function domain(value, label) {
 function limitations(value) {
     if (value === undefined)
         return Object.freeze([]);
-    if (!Array.isArray(value) || value.length > 8)
-        throw new TypeError('profile.limitations must contain no more than 8 entries.');
-    return Object.freeze([...new Set(value.map((entry, index) => requireBoundedString(entry, `profile.limitations[${index}]`, 240)))]);
+    if (!Array.isArray(value) || value.length > MAX_EXTERNAL_FINDING_LIMITATIONS)
+        throw new TypeError(`profile.limitations must contain no more than ${MAX_EXTERNAL_FINDING_LIMITATIONS} entries.`);
+    return Object.freeze([...new Set(value.map((entry, index) => requireBoundedString(entry, `profile.limitations[${index}]`, MAX_EXTERNAL_FINDING_LIMITATION_LENGTH)))]);
 }
 export function mapExternalObservations(inputRaw) {
     const input = requireRecord(inputRaw, 'External observation mapping');
@@ -140,11 +140,10 @@ export function mapExternalObservations(inputRaw) {
         source,
         findings: selected.map((finding) => ({
             ...finding,
-            limitations: [
-                ...finding.limitations,
+            limitations: retainExternalFindingLimitations(finding.limitations, [
                 `Mapped locally with declarative profile ${profile.id} version ${profile.version}; the profile does not verify the upstream field semantics.`,
-                ...(truncated ? ['The supplied records exceeded the browser import boundary; only the first deterministic bounded findings were retained.'] : []),
-            ].slice(0, 8),
+                ...(truncated ? [`The supplied records exceeded the browser import boundary; ${selected.length} of ${seen.size} unique findings were retained in deterministic order.`] : []),
+            ]),
         })),
     };
     return parseExternalFindingsDocument(document);

package/cli/formatters/terminal-lookup.mjs

@@ -1,6 +1,7 @@
 import { registryAccessProfileLabel } from "../registry-access.mjs";
-import { technologyEvidenceRoles, } from "../../lib/technology-evidence-role.mjs";
+import { appendTechnologyLines } from "./terminal-technology.mjs";
 import { appendDeliveryMetadataLines, appendPublicationMetadataLines } from "./terminal-metadata.mjs";
+import { securityPostureReview, summarizeSecurityPostureReview } from "../../lib/website-security-posture.mjs";
 import { appendSection, boundedTerminalComponent, boundedTerminalList, boundedTerminalWithSuffix, MAX_TLS_TERMINAL_ALT_NAMES, MAX_TLS_TERMINAL_PURPOSES, safeTerminalValue, terminalCount, terminalCountSummary, terminalDisplayCount, terminalRecord, titleCase, } from "./terminal-shared.mjs";
 const MAX_LOOKUP_TERMINAL_RECORDS = 5;
 const MAX_LOOKUP_TERMINAL_NAMES = 5;
@@ -10,13 +11,6 @@ const MAX_LOOKUP_TERMINAL_LIMITATIONS = 3;
 const MAX_LOOKUP_TERMINAL_CIDRS = 5;
 const MAX_LOOKUP_TERMINAL_FINDINGS = 5;
 const MAX_LOOKUP_TERMINAL_ABUSE_ROUTES = 6;
-function terminalTechnologyRoleNames(findings, role) {
-    const names = findings
-        .filter((finding) => technologyEvidenceRoles(finding).includes(role))
-        .slice(0, 6)
-        .map((finding) => safeTerminalValue(terminalRecord(finding).name, 'Unnamed indicator'));
-    return names.length ? boundedTerminalList(names, Math.max(0, findings.filter((finding) => technologyEvidenceRoles(finding).includes(role)).length - names.length)) : 'None retained';
-}
 function formatLookupDnsRecord(value) {
     if (typeof value === 'string' || typeof value === 'number')
         return safeTerminalValue(value);
@@ -244,6 +238,11 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
         targetLines.push(`Input host     ${safeTerminalValue(document.inputHostname)}`);
         targetLines.push(`Registry query ${safeTerminalValue(document.registrableDomain)}`);
     }
+    if (availability.observationHostname) {
+        targetLines.push(`DNS/TLS/web    ${safeTerminalValue(availability.observationHostname)}`);
+    }
+    if (availability.webObservationMode === 'selected_url')
+        targetLines.push('Website scope  Explicitly selected URL; query omitted from provenance');
     if (availability.applicable) {
         targetLines.push(`Availability   ${titleCase(availability.state)}`);
         targetLines.push(`Confidence     ${titleCase(availability.confidence)}`);
@@ -486,7 +485,7 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
         const technology = terminalRecord(availability.technologyProfile);
         const browserLibraries = terminalRecord(technology.browserLibraryProfile);
         const posture = terminalRecord(availability.securityPosture);
-        const postureSummary = terminalRecord(posture.summary);
+        const postureReview = summarizeSecurityPostureReview(posture.findings);
         const pageIdentity = terminalRecord(availability.pageIdentity);
         const pageRole = terminalRecord(availability.pageRoleProfile);
         const clientBehavior = terminalRecord(availability.clientBehaviorProfile);
@@ -578,47 +577,20 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
             if (detail !== 'summary' && visible.length)
                 websiteLines.push(`Declarations   ${safeTerminalValue(visible.join('; '))}`);
         }
-        if (technology.status || technology.source === 'derived') {
-            const findings = Array.isArray(technology.findings) ? technology.findings : [];
-            websiteLines.push(`Technology     ${titleCase(technology.status)} · ${findings.length} indicator${findings.length === 1 ? '' : 's'}`);
-            const visible = findings.slice(0, 6).map((finding) => {
-                const item = terminalRecord(finding);
-                const qualifiers = [item.category, item.confidence ? `${item.confidence} signature strength` : null].filter(Boolean).map((value) => safeTerminalValue(value));
-                return `${safeTerminalValue(item.name, 'Unnamed indicator')}${qualifiers.length ? ` (${qualifiers.join(', ')})` : ''}`;
-            });
-            if (detail !== 'summary' && visible.length) {
-                const omitted = findings.length - visible.length;
-                websiteLines.push(`Indicators     ${safeTerminalValue(`${visible.join('; ')}${omitted > 0 ? `; +${omitted} more` : ''}`)}`);
-            }
-            if (detail !== 'summary') {
-                const nameservers = Array.isArray(availability.nameservers)
-                    ? availability.nameservers.slice(0, MAX_LOOKUP_TERMINAL_NAMES).map((value) => safeTerminalValue(value))
-                    : [];
-                websiteLines.push(`Nameservers   ${nameservers.length ? boundedTerminalList(nameservers, Math.max(0, availability.nameservers.length - nameservers.length)) : 'Unavailable'} · identity does not establish operator or web-host ownership`);
-                websiteLines.push(`Observed edge  ${terminalTechnologyRoleNames(findings, 'observed_edge')}`);
-                websiteLines.push(`App platform   ${terminalTechnologyRoleNames(findings, 'application_platform')}`);
-                websiteLines.push(`Framework/run  ${terminalTechnologyRoleNames(findings, 'framework_runtime')}`);
-                websiteLines.push(`Embedded deps  ${terminalTechnologyRoleNames(findings, 'embedded_dependency')}`);
-                websiteLines.push('Origin host    Not established from retained evidence');
-            }
-            if (detail !== 'summary' && (browserLibraries.profileVersion === 1 || browserLibraries.source === 'derived')) {
-                const libraries = Array.isArray(browserLibraries.findings) ? browserLibraries.findings : [];
-                const advisoryMatches = libraries.filter((finding) => terminalCount(terminalRecord(finding).advisoryCount) > 0).length;
-                websiteLines.push(`JS libraries   ${titleCase(browserLibraries.status)} · ${libraries.length} apparent · `
-                    + `${advisoryMatches} with catalogue advisory match${advisoryMatches === 1 ? '' : 'es'}`);
-            }
-        }
+        appendTechnologyLines(websiteLines, {
+            technology, libraries: browserLibraries, nameservers: availability.nameservers,
+            generatedAt: document.generatedAt, detail,
+        });
         if (posture.status || posture.source === 'derived') {
             websiteLines.push(`Posture        ${titleCase(posture.status)}`);
-            if (detail !== 'summary' && Object.keys(postureSummary).length)
-                websiteLines.push(`Posture counts ${terminalCount(postureSummary.observed)} observed · `
-                    + `${terminalCount(postureSummary.potentialExposure)} potential exposure · `
-                    + `${terminalCount(postureSummary.observedAbsence)} observed absence · `
-                    + `${terminalCount(postureSummary.unavailable)} unavailable`);
+            if (detail !== 'summary' && Array.isArray(posture.findings))
+                websiteLines.push(`Posture checks Needs review ${postureReview.needsReview} · `
+                    + `Other findings ${postureReview.otherFindings} · `
+                    + `Could not assess ${postureReview.unavailable}`);
             if (detail === 'verbose' && positiveSourceStatus(posture.status)) {
                 const findings = boundedFindingLabels(posture.findings, (finding) => {
-                    const state = finding.state ? ` (${titleCase(finding.state)})` : '';
-                    return `${safeTerminalValue(finding.label, 'Unlabelled finding')}${state}`;
+                    const review = securityPostureReview(finding);
+                    return `${safeTerminalValue(finding.label, 'Unlabelled finding')}${review.label ? ` (${review.label})` : ''}`;
                 });
                 if (findings)
                     websiteLines.push(`Posture labels ${findings}`);

package/cli/formatters/terminal-shared.mjs

@@ -6,7 +6,9 @@ const MAX_TLS_TERMINAL_PURPOSES = 8;
 // through soft hyphens, combining grapheme joiners, variation selectors, tag
 // characters, bidi controls, or other zero-width formatting code points.
 const TERMINAL_DEFAULT_IGNORABLE_RE = /\p{Default_Ignorable_Code_Point}/gu;
-function safeTerminalValue(value, fallback = '—') {
+function safeTerminalValue(value, fallback = '—', maximum = MAX_TERMINAL_VALUE_LENGTH) {
+    if (!Number.isSafeInteger(maximum) || maximum < 1)
+        throw new TypeError('Terminal text requires a positive finite character bound.');
     if (value === null || value === undefined || value === '')
         return fallback;
     const normalized = String(value)
@@ -16,8 +18,8 @@ function safeTerminalValue(value, fallback = '—') {
         .trim();
     if (!normalized)
         return fallback;
-    return normalized.length > MAX_TERMINAL_VALUE_LENGTH
-        ? `${normalized.slice(0, MAX_TERMINAL_VALUE_LENGTH - 1)}…`
+    return normalized.length > maximum
+        ? `${normalized.slice(0, maximum - 1)}…`
         : normalized;
 }
 function boundedTerminalList(values, omitted) {