@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/lib/generated/retire-browser-catalog.mjs

@@ -1,10 +1,11 @@
 // Generated by tools/retire-browser-catalog.mts from the pinned Retire.js
 // browser-library catalogue. Apache-2.0 licensed source; do not edit by hand.
 const RETIRE_BROWSER_CATALOG = Object.freeze({
-    catalogVersion: "retire.js-5.4.3",
-    sourceRevision: "db79fa77c86e24d91c9ce1934ad9f2a640242774",
-    sourceSha256: "574f68690a6f5031ac7602936196a3f4531407bc79fafec0f49278241fda857a",
-    sourceUrl: "https://github.com/RetireJS/retire.js/blob/db79fa77c86e24d91c9ce1934ad9f2a640242774/repository/jsrepository.json",
+    catalogVersion: "retire.js-2026.10.02",
+    sourceRevision: "305423aa277cd6aa55c75c37c51090eb98e72e62",
+    sourceUpdatedAt: "2026-10-02T11:46:05.000Z",
+    sourceSha256: "3b444e8cec14dfb4c77f519db559a6c03d626b4c5730cd062b07ca4395c96ad7",
+    sourceUrl: "https://github.com/RetireJS/retire.js/blob/305423aa277cd6aa55c75c37c51090eb98e72e62/repository/jsrepository.json",
     components: {
         "jquery": {
             "extractors": {
@@ -3545,6 +3546,17 @@ const RETIRE_BROWSER_CATALOG = Object.freeze({
                         ],
                         "githubID": "GHSA-55Q2-FJHQ-7XH7"
                     }
+                },
+                {
+                    "below": "3.4.16",
+                    "severity": "low",
+                    "atOrAbove": "3.4.13",
+                    "cwe": [
+                        "CWE-79"
+                    ],
+                    "identifiers": {
+                        "githubID": "GHSA-P98J-92PF-MC4P"
+                    }
                 }
             ]
         },
@@ -3911,6 +3923,20 @@ const RETIRE_BROWSER_CATALOG = Object.freeze({
                         ],
                         "githubID": "GHSA-WC69-RHJR-HC9G"
                     }
+                },
+                {
+                    "below": "2.31.0",
+                    "severity": "medium",
+                    "atOrAbove": "2.29.2",
+                    "cwe": [
+                        "CWE-27"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-17495"
+                        ],
+                        "githubID": "GHSA-4P3W-J4W9-5JQW"
+                    }
                 }
             ]
         },
@@ -5222,21 +5248,6 @@ const RETIRE_BROWSER_CATALOG = Object.freeze({
                         "githubID": "GHSA-42H9-826W-CGV3"
                     }
                 },
-                {
-                    "below": "0.33.0",
-                    "severity": "medium",
-                    "atOrAbove": "0.28.0",
-                    "cwe": [
-                        "CWE-400",
-                        "CWE-770"
-                    ],
-                    "identifiers": {
-                        "CVE": [
-                            "CVE-2026-67312"
-                        ],
-                        "githubID": "GHSA-PMV8-RQ9R-6J72"
-                    }
-                },
                 {
                     "below": "0.33.0",
                     "severity": "medium",
@@ -5295,6 +5306,49 @@ const RETIRE_BROWSER_CATALOG = Object.freeze({
                         "githubID": "GHSA-MMX7-HFXF-JPPX"
                     }
                 },
+                {
+                    "below": "0.33.0",
+                    "severity": "medium",
+                    "atOrAbove": "0.28.0",
+                    "cwe": [
+                        "CWE-400",
+                        "CWE-770"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-67312"
+                        ],
+                        "githubID": "GHSA-PMV8-RQ9R-6J72"
+                    }
+                },
+                {
+                    "below": "0.34.0",
+                    "severity": "medium",
+                    "atOrAbove": "0.27.2",
+                    "cwe": [
+                        "CWE-1321"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101902"
+                        ],
+                        "githubID": "GHSA-9FR6-4GFG-395G"
+                    }
+                },
+                {
+                    "below": "0.34.0",
+                    "severity": "high",
+                    "atOrAbove": "0.28.0",
+                    "cwe": [
+                        "CWE-1321"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101909"
+                        ],
+                        "githubID": "GHSA-X97P-JQ2G-JP4F"
+                    }
+                },
                 {
                     "below": "1.6.0",
                     "severity": "medium",
@@ -5881,6 +5935,180 @@ const RETIRE_BROWSER_CATALOG = Object.freeze({
                         ],
                         "githubID": "GHSA-XJ6Q-8X83-JV6G"
                     }
+                },
+                {
+                    "below": "1.20.0",
+                    "severity": "medium",
+                    "atOrAbove": "1.0.0",
+                    "cwe": [
+                        "CWE-1321"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101902"
+                        ],
+                        "githubID": "GHSA-9FR6-4GFG-395G"
+                    }
+                },
+                {
+                    "below": "1.20.0",
+                    "severity": "medium",
+                    "atOrAbove": "1.0.0",
+                    "cwe": [
+                        "CWE-1321",
+                        "CWE-74"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101904"
+                        ],
+                        "githubID": "GHSA-J8RH-479H-CP32"
+                    }
+                },
+                {
+                    "below": "1.20.0",
+                    "severity": "medium",
+                    "atOrAbove": "1.7.0",
+                    "cwe": [
+                        "CWE-1321"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101908"
+                        ],
+                        "githubID": "GHSA-VH66-26GQ-Q6X8"
+                    }
+                },
+                {
+                    "below": "1.20.0",
+                    "severity": "medium",
+                    "atOrAbove": "1.12.0",
+                    "cwe": [
+                        "CWE-1321",
+                        "CWE-693",
+                        "CWE-74"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101900"
+                        ],
+                        "githubID": "GHSA-4HQW-QXG8-JXX2"
+                    }
+                },
+                {
+                    "below": "1.20.0",
+                    "severity": "high",
+                    "atOrAbove": "1.13.0",
+                    "cwe": [
+                        "CWE-918"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101898"
+                        ],
+                        "githubID": "GHSA-3PQ3-5FJ3-CG6V"
+                    }
+                },
+                {
+                    "below": "1.20.0",
+                    "severity": "high",
+                    "atOrAbove": "1.13.0",
+                    "cwe": [
+                        "CWE-400"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101901"
+                        ],
+                        "githubID": "GHSA-542G-H47M-68V8"
+                    }
+                },
+                {
+                    "below": "1.20.0",
+                    "severity": "medium",
+                    "atOrAbove": "1.15.0",
+                    "cwe": [
+                        "CWE-693"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101899"
+                        ],
+                        "githubID": "GHSA-44G4-M2MJ-WPVX"
+                    }
+                },
+                {
+                    "below": "1.20.0",
+                    "severity": "high",
+                    "atOrAbove": "1.15.0",
+                    "cwe": [
+                        "CWE-1333",
+                        "CWE-400"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101906"
+                        ],
+                        "githubID": "GHSA-MGHH-PGCX-3JJJ"
+                    }
+                },
+                {
+                    "below": "1.20.0",
+                    "severity": "high",
+                    "atOrAbove": "1.15.1",
+                    "cwe": [
+                        "CWE-1321"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101909"
+                        ],
+                        "githubID": "GHSA-X97P-JQ2G-JP4F"
+                    }
+                },
+                {
+                    "below": "1.20.0",
+                    "severity": "high",
+                    "atOrAbove": "1.15.2",
+                    "cwe": [
+                        "CWE-1321",
+                        "CWE-441"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101905"
+                        ],
+                        "githubID": "GHSA-M8M8-QJ5V-23W3"
+                    }
+                },
+                {
+                    "below": "1.20.0",
+                    "severity": "high",
+                    "atOrAbove": "1.16.1",
+                    "cwe": [
+                        "CWE-1333"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101903"
+                        ],
+                        "githubID": "GHSA-C29M-XWM3-CM6R"
+                    }
+                },
+                {
+                    "below": "1.20.0",
+                    "severity": "high",
+                    "atOrAbove": "1.17.0",
+                    "cwe": [
+                        "CWE-441",
+                        "CWE-601"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-101907"
+                        ],
+                        "githubID": "GHSA-R4GJ-5M52-G5WH"
+                    }
                 }
             ]
         },
@@ -5986,6 +6214,30 @@ const RETIRE_BROWSER_CATALOG = Object.freeze({
                         ],
                         "githubID": "GHSA-6V5V-WF23-FMFQ"
                     }
+                },
+                {
+                    "below": "14.3.1",
+                    "severity": "medium",
+                    "atOrAbove": "0",
+                    "cwe": [
+                        "CWE-400",
+                        "CWE-407"
+                    ],
+                    "identifiers": {
+                        "githubID": "GHSA-253C-MCHW-3W2R"
+                    }
+                },
+                {
+                    "below": "15.0.1",
+                    "severity": "medium",
+                    "atOrAbove": "15.0.0",
+                    "cwe": [
+                        "CWE-400",
+                        "CWE-407"
+                    ],
+                    "identifiers": {
+                        "githubID": "GHSA-253C-MCHW-3W2R"
+                    }
                 }
             ]
         },
@@ -7740,6 +7992,31 @@ const RETIRE_BROWSER_CATALOG = Object.freeze({
                         "githubID": "GHSA-Q8WF-6R8G-63CH"
                     }
                 },
+                {
+                    "below": "15.5.24",
+                    "severity": "critical",
+                    "atOrAbove": "10.0.0",
+                    "cwe": [
+                        "CWE-1395"
+                    ],
+                    "identifiers": {
+                        "githubID": "GHSA-2XP9-VWFH-VXW4"
+                    }
+                },
+                {
+                    "below": "15.5.24",
+                    "severity": "critical",
+                    "atOrAbove": "13.4.0",
+                    "cwe": [
+                        "CWE-22"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-75604"
+                        ],
+                        "githubID": "GHSA-P293-QW3H-JR36"
+                    }
+                },
                 {
                     "below": "15.6.0-canary.59",
                     "severity": "high",
@@ -8336,6 +8613,42 @@ const RETIRE_BROWSER_CATALOG = Object.freeze({
                         ],
                         "githubID": "GHSA-Q8WF-6R8G-63CH"
                     }
+                },
+                {
+                    "below": "16.3.3",
+                    "severity": "critical",
+                    "atOrAbove": "16.0.0",
+                    "cwe": [
+                        "CWE-1395"
+                    ],
+                    "identifiers": {
+                        "githubID": "GHSA-2XP9-VWFH-VXW4"
+                    }
+                },
+                {
+                    "below": "16.3.3",
+                    "severity": "critical",
+                    "atOrAbove": "16.0.0",
+                    "cwe": [
+                        "CWE-22"
+                    ],
+                    "identifiers": {
+                        "CVE": [
+                            "CVE-2026-75604"
+                        ],
+                        "githubID": "GHSA-P293-QW3H-JR36"
+                    }
+                },
+                {
+                    "below": "16.3.6",
+                    "severity": "critical",
+                    "atOrAbove": "16.2.0",
+                    "cwe": [
+                        "CWE-1395"
+                    ],
+                    "identifiers": {
+                        "githubID": "GHSA-VCVR-R3JV-PC5J"
+                    }
                 }
             ]
         },

package/lib/generated/{unicode-confusables-17.mjs → unicode-confusables.mjs}

@@ -1,11 +1,11 @@
 // Generated by tools/unicode-confusable-audit.mts from the pinned Unicode
 // UTS #39 data file. Do not edit this projection by hand.
-export const GENERATED_CONFUSABLE_MAPPING_VERSION = "tr39-17.0.0-bounded-ascii-v3";
+export const GENERATED_CONFUSABLE_MAPPING_VERSION = "tr39-18.0.0-bounded-ascii-v3";
 export const GENERATED_CONFUSABLE_SOURCE = Object.freeze({
     "standard": "Unicode UTS #39",
-    "unicodeVersion": "17.0.0",
-    "url": "https://www.unicode.org/Public/17.0.0/security/confusables.txt",
-    "sha256": "091c7f82fc39ef208faf8f94d29c244de99254675e09de163160c810d13ef22a",
+    "unicodeVersion": "18.0.0",
+    "url": "https://www.unicode.org/Public/18.0.0/security/confusables.txt",
+    "sha256": "6ed3ee967c9dfdf6677d563c9985182fbc50a2efb7d6059cd57b2e2ce18f5b92",
     "license": "Unicode-3.0"
 });
 export const GENERATED_CONFUSABLE_POLICY = Object.freeze({
@@ -24,33 +24,33 @@ export const GENERATED_CONFUSABLE_POLICY = Object.freeze({
     "totalMappings": 312
 });
 export const GENERATED_CONFUSABLE_STATS = Object.freeze({
-    "sourceBytes": 745683,
-    "sourceLines": 9995,
-    "parsedMappings": 6565,
-    "eligibleMappings": 232,
-    "projectedMappings": 111,
-    "generationMappings": 101,
+    "sourceBytes": 763128,
+    "sourceLines": 9863,
+    "parsedMappings": 6712,
+    "eligibleMappings": 255,
+    "projectedMappings": 126,
+    "generationMappings": 115,
     "rejectedMalformedLines": 0,
-    "rejectedOutsidePolicy": 5695,
+    "rejectedOutsidePolicy": 5780,
     "skeletonCapHits": 0,
-    "generationCapHits": 3
+    "generationCapHits": 4
 });
 export const GENERATED_CONFUSABLE_GROUPS = Object.freeze({
-    a: "аαɑ",
-    b: "ьƄ",
-    c: "сϲⅽᴄⲥ𐐽",
-    d: "ԁⅾꓒ",
+    a: "аαɑꭤ",
+    b: "ьƄ𝈇",
+    c: "сϲⅽᴄⲥ𐐽ᲃ",
+    d: "ԁⅾꓒ𐆋",
     e: "еεҽꬲ",
-    f: "ϝꞙƒẝꬵք",
+    f: "ϝꞙƒʄẝꬵ𐅾ք",
     g: "ɡƍᶃց",
     h: "һհ",
     i: "іιıɪɩⲓꙇւ",
-    j: "јϳ",
+    j: "јϳȷյ",
     k: "κк",
-    l: "ӏⅼǀꓲ",
-    m: "мⅿ",
+    l: "ӏⅼǀꓲꞁꟾ",
+    m: "мⅿՠ",
     n: "ոռ",
-    o: "оοօᴏⲟᴑꬽσϭ𐐬",
+    o: "оοօᴏⲟᴑꬽᲂσϭ𐐬",
     p: "рρϱⲣþƿϸⳏ",
     q: "ԛգզ",
     r: "гꭇꭈᴦⲅ",
@@ -58,25 +58,25 @@ export const GENERATED_CONFUSABLE_GROUPS = Object.freeze({
     t: "тτ",
     u: "υսᴜꭎʋꞟꭒ",
     v: "ѵνᴠ",
-    w: "ԝաᴡшɯѡⲽ",
+    w: "ԝաᴡшɯꟺѡⲽ",
     x: "хχ",
     y: "уүʏγⲩɣᶌỿꭚ",
-    z: "ᴢ",
+    z: "ᴢⱬⲍ",
 });
 export const GENERATED_GENERATION_CONFUSABLE_GROUPS = Object.freeze({
-    a: "аαɑ",
-    b: "ь",
-    c: "сᴄⲥ𐐽",
-    d: "ԁꓒ",
+    a: "аαɑꭤ",
+    b: "ь𝈇",
+    c: "сᴄⲥ𐐽ᲃ",
+    d: "ԁꓒ𐆋",
     e: "еεҽꬲ",
-    f: "ϝꞙƒẝꬵք",
+    f: "ϝꞙƒʄẝꬵ𐅾ք",
     g: "ɡƍᶃց",
     h: "һհ",
     i: "іιıɪɩⲓꙇւ",
-    j: "јϳ",
+    j: "јϳȷյ",
     k: "κк",
-    l: "ӏǀꓲ",
-    m: "м",
+    l: "ӏǀꓲꞁꟾ",
+    m: "мՠ",
     n: "ոռ",
     o: "оοօᴏⲟᴑꬽσ",
     p: "рρⲣþƿϸⳏ",
@@ -86,8 +86,8 @@ export const GENERATED_GENERATION_CONFUSABLE_GROUPS = Object.freeze({
     t: "тτ",
     u: "υսᴜꭎʋꞟꭒ",
     v: "ѵνᴠ",
-    w: "ԝաᴡшɯѡⲽ",
+    w: "ԝաᴡшɯꟺѡⲽ",
     x: "хχ",
     y: "уүʏγⲩɣᶌỿ",
-    z: "ᴢ",
+    z: "ᴢⱬⲍ",
 });

package/lib/html-signals.mjs

@@ -6,6 +6,8 @@
 import { isIP } from 'node:net';
 import { domainToASCII } from 'node:url';
 import { analyzeCredentialSurfaceProfile } from "./credential-surface-profile.mjs";
+import { attributeCredentialForms } from "./credential-form-attribution.mjs";
+import { externalPasswordFormObservation } from "../packages/evidence/credential-form-attribution.mjs";
 import { analyzeClientBehavior } from "./client-behavior-profile.mjs";
 import { createObservation } from "../packages/evidence/observation.mjs";
 import { createPageFingerprints } from "./page-fingerprints.mjs";
@@ -280,6 +282,7 @@ function extractPageRelationships(analysis, domain, options = {}) {
     let downloadFileTypeLimitReached = false;
     let perTagLimitReached = false;
     let resourceCountLimitReached = false;
+    let resourceIdentityTruncated = false;
     for (const element of analysis.elements) {
         if (!element.html || !RELATIONSHIP_TAGS.has(element.name))
             continue;
@@ -337,6 +340,8 @@ function extractPageRelationships(analysis, domain, options = {}) {
                     discardedUrls += 1;
                 continue;
             }
+            if (normalized.pathTruncated)
+                resourceIdentityTruncated = true;
             const key = `${reference.type}:${normalized.url}`;
             if (!resourceKeys.has(key)) {
                 if (resourceKeys.size >= MAX_RESOURCE_TAGS) {
@@ -362,7 +367,7 @@ function extractPageRelationships(analysis, domain, options = {}) {
         tracking.truncated = true;
     const truncated = tagLimitReached || resourceOriginLimitReached || embeddedOriginLimitReached
         || contactDomainLimitReached || downloadOriginLimitReached || downloadFileTypeLimitReached
-        || perTagLimitReached || resourceCountLimitReached || tracking.truncated;
+        || perTagLimitReached || resourceCountLimitReached || resourceIdentityTruncated || tracking.truncated;
     const limitations = [];
     if (tagLimitReached)
         limitations.push(`Resource parsing reached the ${MAX_RESOURCE_TAGS}-tag or ${MAX_IDENTITY_TAG_LENGTH}-character tag limit.`);
@@ -380,6 +385,8 @@ function extractPageRelationships(analysis, domain, options = {}) {
         limitations.push(`Some srcset URL candidates could not be safely enumerated within the ${MAX_URLS_PER_TAG}-candidate per-tag boundary.`);
     if (resourceCountLimitReached)
         limitations.push(`Only the first ${MAX_RESOURCE_TAGS} distinct resource references were examined.`);
+    if (resourceIdentityTruncated)
+        limitations.push('Overlong resource paths were reduced to origins; distinct resource counts may be incomplete.');
     if (tracking.truncated)
         limitations.push(`Only the first ${MAX_TRACKING_IDENTIFIERS} tracking identifiers were retained.`);
     return {
@@ -387,7 +394,7 @@ function extractPageRelationships(analysis, domain, options = {}) {
             count: resourceKeys.size,
             byType,
             externalOrigins: [...resourceOrigins].sort(),
-            truncated: tagLimitReached || resourceOriginLimitReached || perTagLimitReached || resourceCountLimitReached,
+            truncated: tagLimitReached || resourceOriginLimitReached || perTagLimitReached || resourceCountLimitReached || resourceIdentityTruncated,
         },
         embeddedOrigins: [...embeddedOrigins].sort(),
         contactDomains: [...contactDomains].sort(),
@@ -714,10 +721,12 @@ async function extractHtmlSignals(html, domain, options = {}) {
     const pageLanguageSignal = detectPageLanguageSignal(html, pageIdentity?.documentLanguage, htmlAnalysis);
     const domainSaleSignal = options.sourceTruncated !== true && domainSaleLandingPage(htmlAnalysis, domain)
         ? 'explicit domain-sale landing-page content' : null;
+    const formAttribution = attributeCredentialForms(htmlAnalysis, documentUrl, options.sourceTruncated);
     return {
         domainSaleSignal,
         pageTitle: htmlAnalysis.title,
         hasPasswordField: htmlAnalysis.forms.categories.password > 0,
+        hasExternalPasswordForm: externalPasswordFormObservation(formAttribution),
         phishingLanguageMatch: pageLanguageSignal?.label ?? null,
         hasExternalFormAction: pageIdentity
             ? pageIdentity.forms.externalActionOrigins.length > 0
@@ -727,6 +736,8 @@ async function extractHtmlSignals(html, domain, options = {}) {
         pageIdentity: pageIdentityOutput,
         credentialSurfaceProfile: includeCredentialSurfaceProfile && htmlAnalysis ? analyzeCredentialSurfaceProfile({
             htmlAnalysis,
+            formAttribution,
+            baseUrl: documentUrl,
             observedAt: options.observedAt,
             sourceTruncated: options.sourceTruncated,
         }) : null,

package/lib/http-evidence-bounds.mjs

@@ -1,8 +1,2 @@
-// Browser-safe bounds for the rich HTTP evidence contract and its compact
-// browser-local projection. Both producers and consumers import these values
-// so valid retained evidence is not rejected by a stale projection.
-import { MAX_OUTBOUND_HTTP_URL_CHARACTERS } from "../packages/contracts/http-url.mjs";
-export const MAX_HTTP_EVIDENCE_REDIRECTS = 5;
-export const MAX_HTTP_ATTEMPTS = 2;
-export const MAX_HTTP_PROVENANCE_URL = MAX_OUTBOUND_HTTP_URL_CHARACTERS;
-export const MAX_HTTP_ERROR_LENGTH = 180;
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/http-evidence-bounds.mjs";

package/lib/http-intelligence.mjs

@@ -4,8 +4,20 @@
 // additive evidence object suitable for API responses and exports.
 import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_OUTBOUND_HTTP_URL_CHARACTERS } from "../packages/contracts/http-url.mjs";
-import { MAX_HTTP_ATTEMPTS, MAX_HTTP_ERROR_LENGTH, MAX_HTTP_EVIDENCE_REDIRECTS, MAX_HTTP_PROVENANCE_URL, } from "./http-evidence-bounds.mjs";
+import { MAX_HTTP_ATTEMPTS, MAX_HTTP_ERROR_LENGTH, MAX_HTTP_EVIDENCE_REDIRECTS, MAX_HTTP_PROVENANCE_URL, } from "../packages/analysis/http-evidence-bounds.mjs";
 import { HTTP_DELIVERY_LIMITATIONS, HTTP_DELIVERY_METADATA_VERSION, MAX_HTTP_CACHE_SECONDS, MAX_HTTP_DELIVERY_HEADER_BYTES, MAX_HTTP_DELIVERY_TOKENS, } from "./homepage-metadata-contract.mjs";
+/** Publish delivery metadata only at its owning response boundary. */
+export function withoutHttpDeliveryMetadata(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const output = { ...value };
+    if (output.response && typeof output.response === 'object' && !Array.isArray(output.response)) {
+        const response = { ...output.response };
+        delete response.deliveryMetadata;
+        output.response = response;
+    }
+    return output;
+}
 const MAX_HTTP_REDIRECTS = MAX_HTTP_EVIDENCE_REDIRECTS;
 const MAX_HTTP_HEADER_LENGTH = 1024;
 const MAX_HTTP_DELIVERY_HEADER_LENGTH = MAX_HTTP_DELIVERY_HEADER_BYTES;

package/lib/idn-confusable-policy.mjs

@@ -1,9 +1,9 @@
 // Versioned policy for projecting the Unicode UTS #39 confusables data into
 // WHOISleuth's intentionally small domain-label mapping. The full upstream
 // table is never shipped to browsers or consulted at runtime.
-export const UNICODE_CONFUSABLE_DATA_VERSION = '17.0.0';
-export const UNICODE_CONFUSABLE_SOURCE_URL = 'https://www.unicode.org/Public/17.0.0/security/confusables.txt';
-export const UNICODE_CONFUSABLE_SOURCE_SHA256 = '091c7f82fc39ef208faf8f94d29c244de99254675e09de163160c810d13ef22a';
+export const UNICODE_CONFUSABLE_DATA_VERSION = '18.0.0';
+export const UNICODE_CONFUSABLE_SOURCE_URL = `https://www.unicode.org/Public/${UNICODE_CONFUSABLE_DATA_VERSION}/security/confusables.txt`;
+export const UNICODE_CONFUSABLE_SOURCE_SHA256 = '6ed3ee967c9dfdf6677d563c9985182fbc50a2efb7d6059cd57b2e2ce18f5b92';
 export const UNICODE_CONFUSABLE_LICENSE = 'Unicode-3.0';
 export const CONFUSABLE_PROJECTION_SCHEMA = 'whoisleuth.unicode-confusable-projection';
 export const CONFUSABLE_PROJECTION_VERSION = 1;
@@ -71,7 +71,9 @@ export const REVIEWED_GENERATION_CONFUSABLES = Object.freeze({
     l: 'ӏǀꓲ',
     m: 'м',
     n: 'ոռ',
-    o: 'оοօᴏⲟ',
+    // Keep the complete previously generated o-set when newer source mappings
+    // compete for the same bounded generation slots.
+    o: 'оοօᴏⲟᴑꬽσ',
     p: 'рρⲣ',
     q: 'ԛգզ',
     r: 'гꭇ',

package/lib/idn-confusables.mjs

@@ -4,7 +4,7 @@
 // bounded projection of Unicode Technical Standard #39 data plus the existing
 // reviewed compatibility set. It focuses on characters that visually collapse
 // to common ASCII domain-label characters.
-import { GENERATED_CONFUSABLE_GROUPS, GENERATED_CONFUSABLE_MAPPING_VERSION, GENERATED_GENERATION_CONFUSABLE_GROUPS, } from "./generated/unicode-confusables-17.mjs";
+import { GENERATED_CONFUSABLE_GROUPS, GENERATED_CONFUSABLE_MAPPING_VERSION, GENERATED_GENERATION_CONFUSABLE_GROUPS, } from "./generated/unicode-confusables.mjs";
 import { MAX_GENERATION_CONFUSABLES_PER_ASCII, REVIEWED_GENERATION_CONFUSABLES, } from "./idn-confusable-policy.mjs";
 export const IDN_ANALYSIS_VERSION = 1;
 export const CONFUSABLE_MAPPING_VERSION = GENERATED_CONFUSABLE_MAPPING_VERSION;