@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/packages/evidence/observation.mjs

@@ -106,6 +106,8 @@ const REGISTERED_DIAGNOSTIC_KEYS = [
     'queriedAuthorityCount',
     'redirectCount',
     'referencesExamined',
+    'referenceSignatureTimedOut',
+    'referenceSignatureUnavailable',
     'rejectedRows',
     'relationshipTagsExamined',
     'relationshipUrlsDiscarded',

package/packages/evidence/png-pixels.mjs

@@ -0,0 +1,117 @@
+import { decode, convertIndexedToRgb, hasPngSignature } from 'fast-png';
+import { Unzlib } from 'fflate';
+import { updateCrc32 } from "../interchange/crc32.mjs";
+import { readEvidenceImageDimensions } from "./image-regions.mjs";
+/** Admit PNG structure and inflated work before the image library allocates it. */
+export function decodeEvidencePng(bytes) {
+    if (!(bytes instanceof Uint8Array) || !(bytes.buffer instanceof ArrayBuffer) || !hasPngSignature(bytes) || bytes.byteLength < 33)
+        throw new TypeError('Select a valid PNG image.');
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    if (view.getUint32(8) !== 13 || String.fromCharCode(...bytes.subarray(12, 16)) !== 'IHDR')
+        throw new TypeError('The PNG header is malformed.');
+    const { width, height } = readEvidenceImageDimensions(view.getUint32(16), view.getUint32(20));
+    if (bytes[24] < 8 && bytes[28] !== 0)
+        throw new TypeError('Convert this interlaced low-bit-depth PNG to a non-interlaced image before review.');
+    const maximumInflatedBytes = width * height * 8 + height * 8 + 64;
+    let inflatedBytes = 0;
+    const inflater = new Unzlib(chunk => {
+        inflatedBytes += chunk.byteLength;
+        if (inflatedBytes > maximumInflatedBytes)
+            throw new TypeError('The PNG exceeds its dimension-derived decompression bound.');
+    });
+    const selected = [bytes.subarray(0, 8)];
+    let offset = 8, total = 8, ended = false, imageData = false, dataEnded = false, header = false, palette = false, transparency = false;
+    while (offset < bytes.byteLength) {
+        if (bytes.byteLength - offset < 12)
+            throw new TypeError('The PNG contains a truncated chunk.');
+        const length = view.getUint32(offset), end = offset + length + 12;
+        if (end > bytes.byteLength)
+            throw new TypeError('The PNG contains a truncated chunk.');
+        const kind = String.fromCharCode(...bytes.subarray(offset + 4, offset + 8));
+        if (!/^[A-Za-z]{4}$/u.test(kind))
+            throw new TypeError('The PNG contains an invalid chunk type.');
+        const crc = (updateCrc32(0xffff_ffff, bytes.subarray(offset + 4, end - 4)) ^ 0xffff_ffff) >>> 0;
+        if (crc !== view.getUint32(end - 4))
+            throw new TypeError('The PNG chunk checksum does not match.');
+        if (kind === 'acTL' || kind === 'fcTL' || kind === 'fdAT')
+            throw new TypeError('Select a still PNG image; animated frames are not silently omitted.');
+        if (kind === 'IHDR') {
+            if (header || offset !== 8 || length !== 13)
+                throw new TypeError('The PNG has conflicting headers.');
+            header = true;
+        }
+        else if (kind === 'PLTE') {
+            if (palette || imageData || !length || length > 768 || length % 3)
+                throw new TypeError('The PNG palette is malformed.');
+            palette = true;
+        }
+        else if (kind === 'tRNS') {
+            if (transparency || imageData || length > 256)
+                throw new TypeError('The PNG transparency data is malformed.');
+            transparency = true;
+        }
+        else if (kind === 'IDAT') {
+            if (dataEnded)
+                throw new TypeError('The PNG image-data chunks are not consecutive.');
+            imageData = true;
+            // A small compressed slice bounds transient inflation before the callback.
+            for (let position = offset + 8; position < end - 4; position += 1_024)
+                inflater.push(bytes.subarray(position, Math.min(position + 1_024, end - 4)), false);
+        }
+        else if (kind === 'IEND') {
+            if (length || !imageData || end !== bytes.byteLength)
+                throw new TypeError('The PNG trailer is malformed.');
+            ended = true;
+        }
+        else if (kind[0] === kind[0].toUpperCase())
+            throw new TypeError('The PNG has an unsupported critical chunk.');
+        if (imageData && kind !== 'IDAT')
+            dataEnded = true;
+        // Colour-profile and text metadata are irrelevant to QR pixel analysis and
+        // may contain independent compressed payloads. Never decode those payloads.
+        if (['IHDR', 'PLTE', 'tRNS', 'IDAT', 'IEND'].includes(kind)) {
+            const part = bytes.subarray(offset, end);
+            selected.push(part);
+            total += part.byteLength;
+        }
+        offset = end;
+    }
+    if (!ended)
+        throw new TypeError('The PNG trailer is missing.');
+    inflater.push(new Uint8Array(), true);
+    const admitted = new Uint8Array(total);
+    let position = 0;
+    for (const part of selected) {
+        admitted.set(part, position);
+        position += part.byteLength;
+    }
+    let image = decode(admitted, { checkCrc: true });
+    if (image.width !== width || image.height !== height)
+        throw new TypeError('The decoded PNG dimensions changed.');
+    if (image.depth < 8 && !image.palette && image.channels === 1) {
+        const maximum = (1 << image.depth) - 1;
+        // Use the library's packed-sample conversion for grayscale as well as
+        // indexed images; a generated grayscale palette does not parse new bytes.
+        image = { ...image, palette: Array.from({ length: maximum + 1 }, (_, value) => {
+                const grey = Math.round(value * 255 / maximum);
+                return [grey, grey, grey, image.transparency?.[0] === value ? 0 : 255];
+            }) };
+    }
+    const indexed = Boolean(image.palette), samples = indexed ? convertIndexedToRgb(image) : image.data;
+    const channels = indexed ? image.palette[0].length : image.channels;
+    if (![1, 2, 3, 4].includes(channels) || samples.length !== width * height * channels)
+        throw new TypeError('The PNG pixel layout is unsupported.');
+    const pixels = new Uint8ClampedArray(width * height * 4);
+    const sample = (index) => image.depth === 16 && !indexed ? Math.round(samples[index] / 257) : samples[index];
+    for (let index = 0; index < width * height; index++) {
+        const source = index * channels, target = index * 4;
+        pixels[target] = sample(source);
+        pixels[target + 1] = channels <= 2 ? sample(source) : sample(source + 1);
+        pixels[target + 2] = channels <= 2 ? sample(source) : sample(source + 2);
+        pixels[target + 3] = channels === 2 || channels === 4 ? sample(source + channels - 1) : 255;
+        if (!indexed && image.transparency && (channels === 1 ? samples[source] === image.transparency[0]
+            : channels === 3 && [0, 1, 2].every(channel => samples[source + channel] === image.transparency[channel])))
+            pixels[target + 3] = 0;
+    }
+    return { width, height, pixels };
+}

package/packages/evidence/public-address-policy.mjs

@@ -0,0 +1,83 @@
+// Browser-safe canonical public-address policy for analyst-supplied address
+// evidence. This performs no resolution or network work; transport owners must
+// still revalidate and pin addresses before making a request.
+import { ipv6Groups } from "../contracts/ip-address.mjs";
+const IPV4_RE = /^\d{1,3}(?:\.\d{1,3}){3}$/u;
+const IPV6_RE = /^[0-9a-f:]+$/iu;
+function canonicalIpv4(value) {
+    if (typeof value !== 'string' || !IPV4_RE.test(value.trim()))
+        return null;
+    const octets = value.trim().split('.').map(Number);
+    if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255))
+        return null;
+    return octets.join('.');
+}
+function isPublicIpv4(value) {
+    const octets = value.split('.').map(Number);
+    const [first = -1, second = -1, third = -1] = octets;
+    return octets.length === 4
+        && first !== 0
+        && first !== 10
+        && first !== 127
+        && first < 224
+        && !(first === 100 && second >= 64 && second <= 127)
+        && !(first === 169 && second === 254)
+        && !(first === 172 && second >= 16 && second <= 31)
+        && !(first === 192 && second === 168)
+        && !(first === 198 && (second === 18 || second === 19))
+        && !(first === 192 && second === 0 && third === 0)
+        && !(first === 192 && second === 0 && third === 2)
+        && !(first === 192 && second === 88 && third === 99)
+        && !(first === 198 && second === 51 && third === 100)
+        && !(first === 203 && second === 0 && third === 113);
+}
+function canonicalIpv6(value) {
+    if (typeof value !== 'string')
+        return null;
+    const candidate = value.trim().toLowerCase();
+    if (!candidate.includes(':') || candidate.includes('%') || candidate.includes('.') || !IPV6_RE.test(candidate)) {
+        return null;
+    }
+    try {
+        const host = new URL(`https://[${candidate}]/`).hostname;
+        return host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isPublicIpv6(value) {
+    const groups = ipv6Groups(value);
+    if (groups.length !== 8)
+        return false;
+    const [first = '', second = '', third = ''] = groups;
+    if (groups.every((group) => group === '0000'))
+        return false;
+    if (groups.slice(0, 7).every((group) => group === '0000') && groups[7] === '0001')
+        return false;
+    if (first.startsWith('ff') || /^fe[89ab]/u.test(first) || /^fe[cdef]/u.test(first) || /^f[cd]/u.test(first))
+        return false;
+    if (first === '0100' && groups.slice(1, 4).every((group) => group === '0000'))
+        return false;
+    if (first === '2001' && second === '0db8')
+        return false;
+    if (first === '3fff' && Number.parseInt(second, 16) <= 0x0fff)
+        return false;
+    if (first === '2001' && second === '0002' && third === '0000')
+        return false;
+    if (first === '2001' && /^00[1-2][0-9a-f]$/u.test(second))
+        return false;
+    if (first === '2001' && second === '0000')
+        return false;
+    if (first === '2002')
+        return false;
+    const firstValue = Number.parseInt(first, 16);
+    return Number.isInteger(firstValue) && firstValue >= 0x2000 && firstValue <= 0x3fff;
+}
+export function canonicalPublicIpAddress(value) {
+    const ipv4 = canonicalIpv4(value);
+    if (ipv4)
+        return isPublicIpv4(ipv4) ? ipv4 : null;
+    const ipv6 = canonicalIpv6(value);
+    return ipv6 && isPublicIpv6(ipv6) ? ipv6 : null;
+}

package/packages/evidence/record-identity.mjs

@@ -1,6 +1,7 @@
 // Shared collision-resistant identities for bounded, already normalised records.
 // Platform cryptography remains the owner of signatures and authentication.
 export const MAX_IDENTITY_DIGEST_BYTES = 1024 * 1024;
+export const MAX_INCREMENTAL_DIGEST_BYTES = 256 * 1024 * 1024;
 const SHA256_CONSTANTS = Object.freeze([
     0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
     0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
@@ -14,27 +15,21 @@ const SHA256_CONSTANTS = Object.freeze([
 function rotateRight(value, bits) {
     return (value >>> bits) | (value << (32 - bits));
 }
-export function sha256IdentityHex(bytes) {
-    if (bytes.byteLength > MAX_IDENTITY_DIGEST_BYTES)
-        throw new RangeError('Record identity exceeds its byte limit.');
-    // This digest is a collision-resistant record identity, not a password,
-    // signature, MAC, or substitute for the platform cryptography used there.
-    const paddedLength = Math.ceil((bytes.byteLength + 9) / 64) * 64;
-    const padded = new Uint8Array(paddedLength);
-    padded.set(bytes);
-    padded[bytes.byteLength] = 0x80;
-    const view = new DataView(padded.buffer);
-    const bitLength = bytes.byteLength * 8;
-    view.setUint32(paddedLength - 8, Math.floor(bitLength / 0x1_0000_0000), false);
-    view.setUint32(paddedLength - 4, bitLength >>> 0, false);
+/** Incremental content identity only; never authentication or publisher proof. */
+export function createIncrementalSha256(maximumBytes = MAX_IDENTITY_DIGEST_BYTES) {
+    if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 0 || maximumBytes > MAX_INCREMENTAL_DIGEST_BYTES)
+        throw new RangeError('Content identity has an invalid byte limit.');
     const state = new Uint32Array([
         0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
         0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
     ]);
     const words = new Uint32Array(64);
-    for (let offset = 0; offset < paddedLength; offset += 64) {
+    const pending = new Uint8Array(64);
+    let pendingBytes = 0, totalBytes = 0, finished = false;
+    function block(bytes, offset) {
+        const view = new DataView(bytes.buffer, bytes.byteOffset + offset, 64);
         for (let index = 0; index < 16; index += 1)
-            words[index] = view.getUint32(offset + index * 4, false);
+            words[index] = view.getUint32(index * 4, false);
         for (let index = 16; index < 64; index += 1) {
             const left = words[index - 15];
             const right = words[index - 2];
@@ -68,5 +63,54 @@ export function sha256IdentityHex(bytes) {
         state[6] = (state[6] + g) >>> 0;
         state[7] = (state[7] + h) >>> 0;
     }
-    return [...state].map((value) => value.toString(16).padStart(8, '0')).join('');
+    return Object.freeze({
+        update(bytes) {
+            if (finished)
+                throw new Error('Content identity is already finalised.');
+            if (!(bytes instanceof Uint8Array) || bytes.byteLength > maximumBytes - totalBytes)
+                throw new RangeError('Content identity exceeds its byte limit.');
+            totalBytes += bytes.byteLength;
+            let offset = 0;
+            if (pendingBytes) {
+                const length = Math.min(64 - pendingBytes, bytes.byteLength);
+                pending.set(bytes.subarray(0, length), pendingBytes);
+                pendingBytes += length;
+                offset += length;
+                if (pendingBytes === 64) {
+                    block(pending, 0);
+                    pendingBytes = 0;
+                }
+            }
+            while (offset + 64 <= bytes.byteLength) {
+                block(bytes, offset);
+                offset += 64;
+            }
+            if (offset < bytes.byteLength) {
+                pending.set(bytes.subarray(offset), 0);
+                pendingBytes = bytes.byteLength - offset;
+            }
+        },
+        digestHex() {
+            if (finished)
+                throw new Error('Content identity is already finalised.');
+            finished = true;
+            const padding = new Uint8Array(pendingBytes < 56 ? 64 : 128);
+            padding.set(pending.subarray(0, pendingBytes));
+            padding[pendingBytes] = 0x80;
+            const view = new DataView(padding.buffer), bits = totalBytes * 8;
+            view.setUint32(padding.length - 8, Math.floor(bits / 0x1_0000_0000), false);
+            view.setUint32(padding.length - 4, bits >>> 0, false);
+            block(padding, 0);
+            if (padding.length === 128)
+                block(padding, 64);
+            return [...state].map(value => value.toString(16).padStart(8, '0')).join('');
+        },
+    });
+}
+export function sha256IdentityHex(bytes) {
+    if (bytes.byteLength > MAX_IDENTITY_DIGEST_BYTES)
+        throw new RangeError('Record identity exceeds its byte limit.');
+    const digest = createIncrementalSha256();
+    digest.update(bytes);
+    return digest.digestHex();
 }

package/packages/evidence/technology-evidence-role.mjs

@@ -0,0 +1,51 @@
+const TECHNOLOGY_EVIDENCE_ROLE_ORDER = Object.freeze([
+    'observed_edge',
+    'application_platform',
+    'framework_runtime',
+    'embedded_dependency',
+]);
+const TECHNOLOGY_EVIDENCE_ROLE_SET = new Set(TECHNOLOGY_EVIDENCE_ROLE_ORDER);
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function technologyEvidenceRoles(value) {
+    const finding = record(value);
+    const roles = new Set();
+    let hasExplicitRole = false;
+    for (const role of Array.isArray(finding.roles) ? finding.roles.slice(0, 4) : []) {
+        if (typeof role === 'string' && TECHNOLOGY_EVIDENCE_ROLE_SET.has(role)) {
+            roles.add(role);
+            hasExplicitRole = true;
+        }
+    }
+    const evidenceValues = Array.isArray(finding.evidence) ? finding.evidence.slice(0, 4) : [];
+    for (const evidenceValue of evidenceValues) {
+        const evidence = record(evidenceValue);
+        if (typeof evidence.role === 'string'
+            && TECHNOLOGY_EVIDENCE_ROLE_SET.has(evidence.role)) {
+            roles.add(evidence.role);
+            hasExplicitRole = true;
+        }
+    }
+    if (!hasExplicitRole) {
+        const resourceOriginOnly = evidenceValues.length > 0
+            && evidenceValues.every((evidence) => (String(record(evidence).source).toLowerCase() === 'resource origin'));
+        if (evidenceValues.some((evidence) => String(record(evidence).source).toLowerCase() === 'resource origin')) {
+            roles.add('embedded_dependency');
+        }
+        if (!resourceOriginOnly) {
+            const category = String(finding.category).toLowerCase();
+            if (category === 'delivery platform')
+                roles.add('observed_edge');
+            else if (['application runtime', 'web framework', 'static site generator', 'web server'].includes(category)) {
+                roles.add('framework_runtime');
+            }
+            else
+                roles.add('application_platform');
+        }
+    }
+    return TECHNOLOGY_EVIDENCE_ROLE_ORDER.filter((role) => roles.has(role));
+}
+export { TECHNOLOGY_EVIDENCE_ROLE_ORDER, technologyEvidenceRoles, };

package/packages/interchange/defensive-indicator-export.mjs

@@ -0,0 +1,264 @@
+// Pure defensive-domain export formatting for filtered Bulk findings. These
+// files are generated locally and never submitted or applied automatically.
+import { caseDispositionSupportsDefensiveResponse } from "../cases/case-record-decisions.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { DEFENSIVE_INDICATOR_EXPORT_VERSION, DEFENSIVE_INDICATOR_MANIFEST_SCHEMA, DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA, } from "../contracts/analyst-interchange.mjs";
+export { DEFENSIVE_INDICATOR_EXPORT_VERSION, DEFENSIVE_INDICATOR_MANIFEST_SCHEMA, DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA, } from "../contracts/analyst-interchange.mjs";
+export const MAX_DEFENSIVE_INDICATORS = 2000;
+export const MAX_DEFENSIVE_INDICATOR_INPUTS = MAX_DEFENSIVE_INDICATORS * 4;
+export const DEFENSIVE_INDICATOR_FORMATS = Object.freeze(['domains', 'hosts', 'dnsmasq', 'rpz']);
+const REGISTERED_STATES = new Set(['registered', 'for_sale', 'expiring']);
+const MINIMUM_RISK_SCORE = 70;
+const CONTROL_RE = /[\x00-\x1f\x7f]/;
+function plainRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function riskScore(record) {
+    const value = record.risk ?? record.riskScore;
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+/** Source metadata shared by interchange writers; export time is not evidence time. */
+export function defensiveIndicatorProvenance(value) {
+    const source = plainRecord(value) ?? {};
+    const saved = plainRecord(source.saved) ?? {};
+    const score = riskScore(source);
+    const version = source.riskModelVersion ?? saved.riskModelVersion;
+    const depth = source.scanDepth ?? saved.scanDepth;
+    return Object.freeze({
+        riskScore: score === null ? null : Math.max(0, Math.min(100, Math.round(score))),
+        riskModelVersion: typeof version === 'number' && Number.isSafeInteger(version) && version > 0 && version <= 1_000 ? version : null,
+        scanDepth: depth === 'fast' || depth === 'deep' ? depth : 'unknown',
+        observedAt: normalizeExplicitIsoTimestamp(source.observedAt) || normalizeExplicitIsoTimestamp(saved.observedAt),
+    });
+}
+function normalizedDomainSet(value) {
+    if (!Array.isArray(value))
+        return new Set();
+    return new Set(value.slice(0, MAX_DEFENSIVE_INDICATOR_INPUTS)
+        .map((item) => normalizeDomain(item))
+        .filter((item) => Boolean(item)));
+}
+function analystDisposition(record) {
+    return typeof record.analystDisposition === 'string'
+        ? record.analystDisposition
+        : typeof record.disposition === 'string'
+            ? record.disposition
+            : '';
+}
+function hasReadyProfileContext(record) {
+    const saved = plainRecord(record.saved);
+    const profileContext = plainRecord(saved?.profileContext ?? record.profileContext);
+    return profileContext?.sourceState === 'ready';
+}
+export function isDefensiveIndicatorCandidate(value) {
+    const record = plainRecord(value);
+    if (!record
+        || !hasReadyProfileContext(record)
+        || record.trusted
+        || record.status === 'error'
+        || typeof record.availability !== 'string'
+        || !REGISTERED_STATES.has(record.availability))
+        return false;
+    return Boolean(normalizeDomain(record.domain)) && (riskScore(record) ?? -1) >= MINIMUM_RISK_SCORE;
+}
+export function collectDefensiveIndicatorCandidates(records, limit = MAX_DEFENSIVE_INDICATORS) {
+    if (!Array.isArray(records))
+        throw new TypeError('Defensive indicator export requires an array of Bulk results.');
+    const retainedLimit = Number.isSafeInteger(limit) && limit > 0
+        ? Math.min(limit, MAX_DEFENSIVE_INDICATORS)
+        : MAX_DEFENSIVE_INDICATORS;
+    const byDomain = new Map();
+    for (const item of records.slice(0, MAX_DEFENSIVE_INDICATOR_INPUTS)) {
+        if (!isDefensiveIndicatorCandidate(item))
+            continue;
+        const record = plainRecord(item);
+        const domain = normalizeDomain(record?.domain);
+        if (record && domain && !byDomain.has(domain))
+            byDomain.set(domain, record);
+    }
+    const candidates = [...byDomain.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([domain, source]) => ({ domain, source }));
+    const entries = candidates.slice(0, retainedLimit);
+    return {
+        entries,
+        domains: entries.map((entry) => entry.domain),
+        truncated: records.length > MAX_DEFENSIVE_INDICATOR_INPUTS || candidates.length > retainedLimit,
+    };
+}
+export function prepareDefensiveIndicatorExport(records, options = {}, limit = MAX_DEFENSIVE_INDICATORS) {
+    if (!Array.isArray(records))
+        throw new TypeError('Defensive indicator export requires an array of Bulk results.');
+    const explicitSelection = Array.isArray(options.selectedDomains);
+    const selected = normalizedDomainSet(options.selectedDomains);
+    const official = normalizedDomainSet(options.officialDomains);
+    const allowlisted = normalizedDomainSet(options.allowlistedDomains);
+    const common = normalizedDomainSet(options.commonInfrastructureDomains);
+    const retainedLimit = Number.isSafeInteger(limit) && limit > 0
+        ? Math.min(limit, MAX_DEFENSIVE_INDICATORS)
+        : MAX_DEFENSIVE_INDICATORS;
+    const exclusions = [];
+    const seenExclusions = new Set();
+    const accepted = new Map();
+    const exclude = (domain, reason) => {
+        const key = `${domain}\u0000${reason}`;
+        if (!seenExclusions.has(key)) {
+            exclusions.push({ domain, reason });
+            seenExclusions.add(key);
+        }
+    };
+    for (const item of records.slice(0, MAX_DEFENSIVE_INDICATOR_INPUTS)) {
+        const source = plainRecord(item);
+        const domain = normalizeDomain(source?.domain);
+        if (!source || !domain)
+            continue;
+        if (explicitSelection && !selected.has(domain)) {
+            exclude(domain, 'not_selected');
+            continue;
+        }
+        if (!hasReadyProfileContext(source)) {
+            exclude(domain, 'profile_context_unavailable');
+            continue;
+        }
+        if (official.has(domain)) {
+            exclude(domain, 'official_domain');
+            continue;
+        }
+        if (allowlisted.has(domain)) {
+            exclude(domain, 'allowlisted_domain');
+            continue;
+        }
+        if (common.has(domain) || source.commonInfrastructure === true) {
+            exclude(domain, 'common_infrastructure');
+            continue;
+        }
+        if (!isDefensiveIndicatorCandidate(source)) {
+            exclude(domain, 'not_eligible');
+            continue;
+        }
+        const disposition = analystDisposition(source);
+        if (explicitSelection && !caseDispositionSupportsDefensiveResponse(disposition)) {
+            exclude(domain, 'unreviewed_disposition');
+            continue;
+        }
+        if (!accepted.has(domain))
+            accepted.set(domain, source);
+    }
+    const candidates = [...accepted.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([domain, source]) => ({ domain, source }));
+    const entries = candidates.slice(0, retainedLimit);
+    return {
+        entries,
+        domains: entries.map((entry) => entry.domain),
+        exclusions: exclusions.sort((left, right) => left.domain.localeCompare(right.domain) || left.reason.localeCompare(right.reason)),
+        truncated: records.length > MAX_DEFENSIVE_INDICATOR_INPUTS || candidates.length > retainedLimit,
+        explicitSelection,
+    };
+}
+function timestamp(value) {
+    if (typeof value !== 'string' || value.length > 64 || CONTROL_RE.test(value))
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+function header(prefix, generatedAt, count) {
+    return [
+        `${prefix} WHOISleuth defensive domain indicators v${DEFENSIVE_INDICATOR_EXPORT_VERSION}`,
+        `${prefix} Generated ${generatedAt}`,
+        `${prefix} ${count} high-risk registered domain${count === 1 ? '' : 's'}`,
+        `${prefix} Review before use. Heuristic findings can include false positives.`,
+    ];
+}
+function formatDomains(domains, generatedAt) {
+    return [...header('#', generatedAt, domains.length), ...domains].join('\n');
+}
+function formatHosts(domains, generatedAt) {
+    return [...header('#', generatedAt, domains.length), ...domains.map((domain) => `0.0.0.0 ${domain}`)].join('\n');
+}
+function formatDnsmasq(domains, generatedAt) {
+    return [...header('#', generatedAt, domains.length), ...domains.map((domain) => `address=/${domain}/0.0.0.0`)].join('\n');
+}
+function formatRpz(domains, generatedAt, includeWildcards) {
+    const serial = Math.floor(Date.parse(generatedAt) / 1000) >>> 0;
+    return [
+        ...header(';', generatedAt, domains.length),
+        '$TTL 60',
+        `@ IN SOA localhost. root.localhost. (${serial} 60 60 60 60)`,
+        '@ IN NS localhost.',
+        ...domains.flatMap((domain) => [
+            `${domain} CNAME .`,
+            ...(includeWildcards ? [`*.${domain} CNAME .`] : []),
+        ]),
+    ].join('\n');
+}
+function contentFor(format, domains, generatedAt, includeWildcards) {
+    if (format === 'hosts')
+        return formatHosts(domains, generatedAt);
+    if (format === 'dnsmasq')
+        return formatDnsmasq(domains, generatedAt);
+    if (format === 'rpz')
+        return formatRpz(domains, generatedAt, includeWildcards);
+    return formatDomains(domains, generatedAt);
+}
+export function buildDefensiveIndicatorExport(records, options = {}) {
+    const format = (typeof options.format === 'string'
+        && DEFENSIVE_INDICATOR_FORMATS.includes(options.format)) ? options.format : 'domains';
+    const generatedAt = timestamp(options.generatedAt) || new Date().toISOString();
+    const includeWildcards = options.includeWildcards === true;
+    const expiryDays = typeof options.expiryDays === 'number' && Number.isSafeInteger(options.expiryDays)
+        ? Math.max(1, Math.min(365, options.expiryDays))
+        : 30;
+    const collected = prepareDefensiveIndicatorExport(records, options);
+    const expiresAt = new Date(Date.parse(generatedAt) + expiryDays * 86_400_000).toISOString();
+    const manifest = {
+        schema: DEFENSIVE_INDICATOR_MANIFEST_SCHEMA,
+        version: DEFENSIVE_INDICATOR_EXPORT_VERSION,
+        generatedAt,
+        expiresAt,
+        reviewRequired: true,
+        explicitSelection: collected.explicitSelection,
+        includeWildcards,
+        entries: collected.entries.map(({ domain, source }) => ({
+            domain,
+            disposition: analystDisposition(source) || 'not_recorded',
+            reason: `High-risk registered Bulk finding (risk ${riskScore(source) ?? 'unknown'}).`,
+            source: 'bulk',
+            generatedAt,
+            expiresAt,
+        })),
+        exclusions: collected.exclusions,
+    };
+    const rollback = {
+        schema: DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA,
+        version: DEFENSIVE_INDICATOR_EXPORT_VERSION,
+        generatedAt,
+        removes: collected.domains.map((domain) => ({
+            domain,
+            includeWildcard: includeWildcards,
+            reason: 'Remove the indicator generated by the paired reviewed manifest.',
+        })),
+    };
+    return {
+        version: DEFENSIVE_INDICATOR_EXPORT_VERSION,
+        format,
+        generatedAt,
+        expiresAt,
+        domains: collected.domains,
+        entries: collected.entries,
+        exclusions: collected.exclusions,
+        explicitSelection: collected.explicitSelection,
+        includeWildcards,
+        truncated: collected.truncated,
+        filename: `whoisleuth-defensive-domains-${generatedAt.slice(0, 10)}.${format === 'rpz' ? 'zone' : 'txt'}`,
+        manifestFilename: `whoisleuth-defensive-domains-${generatedAt.slice(0, 10)}.manifest.json`,
+        rollbackFilename: `whoisleuth-defensive-domains-${generatedAt.slice(0, 10)}.rollback.json`,
+        mimeType: 'text/plain;charset=utf-8',
+        content: `${contentFor(format, collected.domains, generatedAt, includeWildcards)}\n`,
+        manifestContent: `${JSON.stringify(manifest, null, 2)}\n`,
+        rollbackContent: `${JSON.stringify(rollback, null, 2)}\n`,
+    };
+}