@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/packages/investigation/mail-header-identity.mjs

@@ -0,0 +1,209 @@
+import { isValidAsciiDomainName } from "../contracts/domain-name.mjs";
+import { MAIL_AUTHENTICATION_METHODS } from "../contracts/mail-authentication.mjs";
+export const MAX_MAIL_REVIEW_DOMAINS = 128;
+export const AUTHENTICATION_METHODS = MAIL_AUTHENTICATION_METHODS;
+export function normalizeHeaderDomain(value) {
+    const normalized = value.trim().toLowerCase().replace(/^\[|\]$/gu, '').replace(/\.$/u, '');
+    return isValidAsciiDomainName(normalized, { requireLowercase: true }) ? normalized : null;
+}
+export function lexicalSegments(value, delimiter, trackAngles = false) {
+    const segments = [];
+    let start = 0;
+    let quoted = false;
+    let escaped = false;
+    let commentDepth = 0;
+    let angleDepth = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        const character = value[index] ?? '';
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (character === '\\' && (quoted || commentDepth > 0)) {
+            escaped = true;
+            continue;
+        }
+        if (commentDepth > 0) {
+            if (character === '(')
+                commentDepth += 1;
+            else if (character === ')')
+                commentDepth -= 1;
+            continue;
+        }
+        if (quoted) {
+            if (character === '"')
+                quoted = false;
+            continue;
+        }
+        if (character === '"')
+            quoted = true;
+        else if (character === '(')
+            commentDepth = 1;
+        else if (character === ')')
+            return null;
+        else if (trackAngles && character === '<') {
+            if (angleDepth !== 0)
+                return null;
+            angleDepth = 1;
+        }
+        else if (trackAngles && character === '>') {
+            if (angleDepth !== 1)
+                return null;
+            angleDepth = 0;
+        }
+        else if (character === delimiter && angleDepth === 0) {
+            segments.push(value.slice(start, index));
+            start = index + 1;
+        }
+    }
+    if (escaped || quoted || commentDepth !== 0 || angleDepth !== 0)
+        return null;
+    segments.push(value.slice(start));
+    return segments;
+}
+function angleAddress(value) {
+    let quoted = false;
+    let escaped = false;
+    let commentDepth = 0;
+    let start = -1;
+    let end = -1;
+    for (let index = 0; index < value.length; index += 1) {
+        const character = value[index] ?? '';
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (character === '\\' && (quoted || commentDepth > 0)) {
+            escaped = true;
+            continue;
+        }
+        if (commentDepth > 0) {
+            if (character === '(')
+                commentDepth += 1;
+            else if (character === ')')
+                commentDepth -= 1;
+            continue;
+        }
+        if (quoted) {
+            if (character === '"')
+                quoted = false;
+            continue;
+        }
+        if (character === '"')
+            quoted = true;
+        else if (character === '(')
+            commentDepth = 1;
+        else if (character === ')')
+            return null;
+        else if (character === '<') {
+            if (start >= 0 || end >= 0)
+                return null;
+            start = index;
+        }
+        else if (character === '>') {
+            if (start < 0 || end >= 0)
+                return null;
+            end = index;
+        }
+    }
+    if (escaped || quoted || commentDepth !== 0 || (start >= 0) !== (end >= 0))
+        return null;
+    return start >= 0 ? value.slice(start + 1, end) : value;
+}
+function addressDomain(value) {
+    let candidate = '';
+    let quoted = false;
+    let escaped = false;
+    let commentDepth = 0;
+    const separators = [];
+    for (const character of value) {
+        if (escaped) {
+            candidate += character;
+            escaped = false;
+            continue;
+        }
+        if (character === '\\' && (quoted || commentDepth > 0)) {
+            if (quoted)
+                candidate += character;
+            escaped = true;
+            continue;
+        }
+        if (commentDepth > 0) {
+            if (character === '(')
+                commentDepth += 1;
+            else if (character === ')')
+                commentDepth -= 1;
+            continue;
+        }
+        if (quoted) {
+            candidate += character;
+            if (character === '"')
+                quoted = false;
+            continue;
+        }
+        if (character === '"') {
+            quoted = true;
+            candidate += character;
+        }
+        else if (character === '(')
+            commentDepth = 1;
+        else if (character === ')')
+            return null;
+        else {
+            if (character === '@')
+                separators.push(candidate.length);
+            candidate += character;
+        }
+    }
+    if (escaped || quoted || commentDepth !== 0 || separators.length !== 1)
+        return null;
+    const separator = separators[0] ?? -1;
+    const local = candidate.slice(0, separator).trim();
+    const domain = candidate.slice(separator + 1).trim();
+    const validLocal = /^(?:[^\s"<>(),:;@]+|"(?:[^"\\]|\\.)+")$/u.test(local);
+    if (!validLocal || !domain || /\s/u.test(domain))
+        return null;
+    return normalizeHeaderDomain(domain);
+}
+export function addressDomains(values) {
+    const domains = new Set();
+    for (const value of values) {
+        const mailboxes = lexicalSegments(value, ',', true);
+        if (!mailboxes)
+            continue;
+        for (const mailbox of mailboxes) {
+            const selected = angleAddress(mailbox);
+            const domain = selected === null ? null : addressDomain(selected);
+            if (domain)
+                domains.add(domain);
+            if (domains.size >= MAX_MAIL_REVIEW_DOMAINS)
+                return [...domains].sort();
+        }
+    }
+    return [...domains].sort();
+}
+export function messageIdDomains(values) {
+    return addressDomains(values.map((value) => value.replace(/[<>]/gu, '')));
+}
+export function authenticationServiceDomains(values) {
+    const output = new Set();
+    for (const value of values) {
+        const clauses = lexicalSegments(value, ';');
+        const service = normalizeHeaderDomain((clauses?.[0] ?? '').trim().split(/\s/u, 1)[0] ?? '');
+        if (service)
+            output.add(service);
+    }
+    return [...output].sort().slice(0, MAX_MAIL_REVIEW_DOMAINS);
+}
+export function dkimSigningDomains(values) {
+    const output = new Set();
+    for (const value of values) {
+        for (const clause of lexicalSegments(value, ';') ?? []) {
+            const match = /^\s*d\s*=\s*([^\s;]+)/iu.exec(clause);
+            const domain = normalizeHeaderDomain(match?.[1] ?? '');
+            if (domain)
+                output.add(domain);
+        }
+    }
+    return [...output].sort().slice(0, MAX_MAIL_REVIEW_DOMAINS);
+}

package/packages/investigation/message-intake.mjs

@@ -0,0 +1,235 @@
+import PostalMime, {} from 'postal-mime';
+import { parse, defaultTreeAdapter } from 'parse5';
+import { sha256ArtifactBytes } from "../evidence/artifact-integrity.mjs";
+import { createLinkIntake } from "./link-intake.mjs";
+import { createIndicatorIntake, MAX_INTAKE_INDICATOR_TEXT } from "./intake-indicators.mjs";
+import { reviewPhoneCandidates } from "./intake-phones.mjs";
+import { AUTHENTICATION_METHODS, addressDomains, authenticationServiceDomains, dkimSigningDomains } from "./mail-header-identity.mjs";
+import { createIntakeReport } from "./intake-report.mjs";
+export { assertMessageBytes } from "./intake-report.mjs";
+import { requestedActionHints } from "./requested-action-hints.mjs";
+import { reviewMailAuthentication, aggregateMailAuthentication } from "./mail-authentication-review.mjs";
+import { MAX_AUTHENTICATION_HEADERS } from "../contracts/mail-authentication.mjs";
+import { MAX_MESSAGE_INTAKE_BYTES, MAX_MESSAGE_PARTS, MAX_MESSAGE_DEPTH, MAX_MESSAGE_HTML_NODES } from "../contracts/message-intake.mjs";
+const HTML_TEXT_BLOCK = /^(?:address|article|aside|blockquote|body|dd|div|dl|dt|fieldset|figcaption|figure|footer|form|h[1-6]|header|hr|li|main|nav|ol|p|pre|section|table|tr|ul)$/u;
+/** All parsing is inert. Only HTTP(S) link targets are offered for deliberate collection. */
+export async function reviewMessageInput(bytes, kind, reviewedAt, qrText) {
+    const base = await createIntakeReport(bytes, kind, reviewedAt);
+    if (!['text', 'email', 'calendar', 'qr'].includes(kind))
+        throw new TypeError('Use the selected-file intake entry point for this format.');
+    const links = createLinkIntake(), indicators = createIndicatorIntake(), identities = [], authenticationClaims = [];
+    const actionHints = new Set(), bounds = new Set();
+    const authenticationHeaders = [];
+    const messageParts = [];
+    let omittedAuthenticationHeaders = 0;
+    let partialAuthentication = false;
+    let reviewedParts = 0, unreviewedAttachments = 0, decodedBytes = 0;
+    const text = (value, source, partId, includeIndicators = true) => {
+        for (const hint of requestedActionHints(value))
+            actionHints.add(hint);
+        links.addText(value, source);
+        if (includeIndicators)
+            indicators.addText(value, source, { partId, page: null });
+    };
+    function html(value, partId) {
+        // parse5 never renders, loads resources, or runs supplied script.
+        let allocated = 0;
+        const htmlBound = new Error('HTML work bound');
+        const admit = () => { if (++allocated > MAX_MESSAGE_HTML_NODES)
+            throw htmlBound; };
+        let tree;
+        try {
+            tree = parse(value, { treeAdapter: { ...defaultTreeAdapter,
+                    createElement(...args) { admit(); return defaultTreeAdapter.createElement(...args); },
+                    createTextNode(...args) { admit(); return defaultTreeAdapter.createTextNode(...args); },
+                    createCommentNode(...args) { admit(); return defaultTreeAdapter.createCommentNode(...args); },
+                } });
+        }
+        catch (cause) {
+            if (cause !== htmlBound)
+                throw cause;
+            bounds.add('HTML nodes');
+            return;
+        }
+        const queue = [tree];
+        const indicatorText = [];
+        let indicatorCharacters = 0, indicatorOverflow = false;
+        const appendIndicatorText = (value) => {
+            if (indicatorOverflow)
+                return;
+            if (value.length > MAX_INTAKE_INDICATOR_TEXT - indicatorCharacters) {
+                indicatorOverflow = true;
+                indicatorText.length = 0;
+                indicators.markPartial();
+                return;
+            }
+            indicatorCharacters += value.length;
+            indicatorText.push(value);
+        };
+        let nodes = 0;
+        while (queue.length) {
+            const node = queue.pop();
+            if (node === null) {
+                appendIndicatorText('\n');
+                continue;
+            }
+            if (++nodes > MAX_MESSAGE_HTML_NODES) {
+                bounds.add('HTML nodes');
+                break;
+            }
+            if ('tagName' in node) {
+                const attrs = new Map(node.attrs.map(attr => [attr.name, attr.value]));
+                if (node.tagName === 'a' && attrs.has('href')) {
+                    const shown = [], children = [...node.childNodes];
+                    let count = 0;
+                    while (children.length && ++count <= MAX_MESSAGE_HTML_NODES) {
+                        const child = children.pop();
+                        if ('value' in child)
+                            shown.push(child.value);
+                        if ('childNodes' in child)
+                            children.push(...child.childNodes);
+                    }
+                    links.add(attrs.get('href'), 'html_link', shown.reverse().join('').trim());
+                }
+                if (node.tagName === 'form' && attrs.has('action'))
+                    links.add(attrs.get('action'), 'html_form');
+                if ((node.tagName === 'iframe' || node.tagName === 'frame') && attrs.has('src'))
+                    links.add(attrs.get('src'), 'html_frame');
+                if (node.tagName === 'script' || node.tagName === 'style')
+                    continue;
+                if (HTML_TEXT_BLOCK.test(node.tagName)) {
+                    appendIndicatorText('\n');
+                    queue.push(null);
+                }
+                else if (node.tagName === 'br' || node.tagName === 'td' || node.tagName === 'th')
+                    appendIndicatorText(' ');
+            }
+            if ('value' in node) {
+                text(node.value, 'text', partId, false);
+                // Inline markup must not separate a credential label from its value.
+                // Block boundaries keep unrelated visible paragraphs independently usable.
+                appendIndicatorText(node.value.replace(/\s+/gu, ' '));
+            }
+            if ('childNodes' in node)
+                for (let index = node.childNodes.length - 1; index >= 0; index--)
+                    queue.push(node.childNodes[index]);
+        }
+        if (!indicatorOverflow)
+            indicators.addText(indicatorText.join(''), 'text', { partId, page: null });
+    }
+    function calendar(value, partId) {
+        const unfolded = value.replace(/\r?\n[ \t]/gu, '');
+        // No attendee names, addresses, descriptions or event identifiers enter the report.
+        for (const line of unfolded.split(/\r?\n/u)) {
+            const colon = line.indexOf(':');
+            if (colon < 0)
+                continue;
+            const key = line.slice(0, colon).split(';', 1)[0]?.toUpperCase();
+            if (['URL', 'DESCRIPTION', 'LOCATION', 'X-ALT-DESC'].includes(key ?? ''))
+                text(line.slice(colon + 1).replace(/\\n/giu, '\n').replace(/\\([,;\\])/gu, '$1'), 'calendar', partId);
+        }
+    }
+    function identity(part, role, domains) {
+        for (const domain of domains)
+            identities.push({ part, role, domain });
+    }
+    function headers(mail, part) {
+        const sourceReview = reviewMailAuthentication(mail.headers.map(header => ({ name: header.key, value: header.value })), part, MAX_AUTHENTICATION_HEADERS - authenticationHeaders.length);
+        authenticationHeaders.push(...sourceReview.headers);
+        omittedAuthenticationHeaders += sourceReview.omittedHeaders;
+        partialAuthentication ||= sourceReview.headers.some(header => !['parsed', 'none'].includes(header.state));
+        if (sourceReview.omittedHeaders)
+            bounds.add('Authentication headers');
+        const values = (name) => mail.headers.filter(header => header.key === name).map(header => header.value);
+        identity(part, 'from', addressDomains(values('from')));
+        identity(part, 'reply_to', addressDomains(values('reply-to')));
+        identity(part, 'return_path', addressDomains(values('return-path')));
+        identity(part, 'dkim', dkimSigningDomains(values('dkim-signature')));
+        const reported = values('authentication-results');
+        identity(part, 'authentication_service', authenticationServiceDomains(reported));
+        const aggregate = aggregateMailAuthentication(sourceReview);
+        for (const method of AUTHENTICATION_METHODS) {
+            const claim = aggregate[method];
+            if (claim.observations)
+                authenticationClaims.push({ part, method, result: claim.state });
+        }
+    }
+    async function message(input, depth, parentPart) {
+        if (depth > MAX_MESSAGE_DEPTH || reviewedParts >= MAX_MESSAGE_PARTS) {
+            bounds.add('Message nesting or parts');
+            unreviewedAttachments++;
+            return;
+        }
+        decodedBytes += input.byteLength;
+        if (decodedBytes > MAX_MESSAGE_INTAKE_BYTES * 2) {
+            bounds.add('Decoded message bytes');
+            unreviewedAttachments++;
+            return;
+        }
+        let mail;
+        try {
+            mail = await PostalMime.parse(input, { maxNestingDepth: MAX_MESSAGE_DEPTH, maxHeadersSize: 256 * 1024, rfc822Attachments: true, forceRfc822Attachments: true, attachmentEncoding: 'arraybuffer' });
+        }
+        catch {
+            throw new TypeError('The message could not be decoded within the MIME nesting and header limits. No input was retained.');
+        }
+        const part = ++reviewedParts;
+        messageParts.push({ part, parentPart, digestSha256: parentPart === null ? base.source.digestSha256 : await sha256ArtifactBytes(input), byteLength: input.byteLength });
+        headers(mail, part);
+        if (mail.text)
+            text(mail.text, 'text', `message-${part}`);
+        if (mail.html)
+            html(mail.html, `message-${part}`);
+        for (const attachment of mail.attachments) {
+            if (reviewedParts >= MAX_MESSAGE_PARTS) {
+                bounds.add('Message parts');
+                unreviewedAttachments++;
+                continue;
+            }
+            const body = typeof attachment.content === 'string' ? new TextEncoder().encode(attachment.content) : new Uint8Array(attachment.content);
+            if (attachment.mimeType === 'message/rfc822')
+                await message(body, depth + 1, part);
+            else if (attachment.mimeType === 'text/calendar') {
+                const calendarPart = ++reviewedParts;
+                messageParts.push({ part: calendarPart, parentPart: part, digestSha256: await sha256ArtifactBytes(body), byteLength: body.byteLength });
+                calendar(new TextDecoder().decode(body), `message-${calendarPart}`);
+            }
+            else {
+                unreviewedAttachments++;
+            }
+        }
+    }
+    if (kind === 'email')
+        await message(bytes, 0, null);
+    else if (kind === 'qr') {
+        if (!Array.isArray(qrText) || qrText.length > MAX_MESSAGE_PARTS || qrText.some(value => typeof value !== 'string' || value.length > 8_192))
+            throw new TypeError('QR review requires bounded decoded text.');
+        reviewedParts = qrText.length;
+        for (const value of qrText) {
+            for (const hint of requestedActionHints(value))
+                actionHints.add(hint);
+            links.addQr(value);
+        }
+    }
+    else {
+        reviewedParts = 1;
+        const value = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        if (kind === 'calendar')
+            calendar(value, 'input');
+        else
+            text(value, 'text', 'input');
+    }
+    const result = links.result();
+    for (const limitation of result.limitations)
+        bounds.add(limitation);
+    if (result.bounded)
+        bounds.add('Link extraction');
+    const indicatorResult = indicators.result();
+    if (indicatorResult.indicatorCoverage.state === 'partial')
+        bounds.add('Indicator extraction');
+    const phoneReview = kind === 'text' ? reviewPhoneCandidates(new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes), base.source.digestSha256) : undefined;
+    return { report: { ...base,
+            coverage: { state: bounds.size || unreviewedAttachments || partialAuthentication ? 'partial' : 'reviewed', reviewedParts, unreviewedAttachments, rejectedLinks: result.rejected, boundsReached: [...bounds] },
+            identities, authenticationClaims, authenticationReview: { headers: authenticationHeaders, omittedHeaders: omittedAuthenticationHeaders }, messageParts,
+            ...indicatorResult, links: result.links, actionHints: [...actionHints] }, targets: result.targets, ...(phoneReview ? { phoneReview } : {}) };
+}

package/packages/investigation/page-behaviour.mjs

@@ -0,0 +1,113 @@
+import { array, boolean, enumeration, exact, integer, text, HEX_DIGEST_RE } from "../evidence/artifact-structure.mjs";
+import { MESSAGE_ACTION_HINTS } from "../contracts/message-intake.mjs";
+import { readCaptureCoverage, captureCoverageIsPartial, captureAttemptDescription } from "./capture-coverage.mjs";
+export const PAGE_BEHAVIOUR_VERSION = 1;
+// Separate from the capture's request, DOM traversal and aggregate byte bounds.
+export const MAX_PAGE_OBSERVATIONS = 500;
+export const PAGE_ACTION_HINTS = MESSAGE_ACTION_HINTS;
+export function pageObservationOrigin(raw, base) {
+    if (typeof raw !== 'string' || raw.length > 8_192 || /[\u0000-\u0020\u007f]/u.test(raw))
+        return null;
+    try {
+        const url = new URL(raw, base);
+        return ['https:', 'http:'].includes(url.protocol) && !url.username && !url.password ? url.origin : null;
+    }
+    catch {
+        return null;
+    }
+}
+function origin(value, nullable = false) {
+    if (nullable && value === null)
+        return null;
+    const candidate = text(value, 'Page observation origin', 500);
+    if (pageObservationOrigin(candidate) !== candidate)
+        throw new TypeError('Page observations retain origins only.');
+    return candidate;
+}
+function hash(value) {
+    if (value === null)
+        return null;
+    if (typeof value !== 'string' || !HEX_DIGEST_RE.test(value))
+        throw new TypeError('Page observation digest must be SHA-256.');
+    return value;
+}
+function ordered(values) {
+    if (values.some((value, index) => index > 0 && value.position <= values[index - 1].position))
+        throw new TypeError('Page observation positions must be unique and increasing.');
+    return values;
+}
+export function readPageBehaviour(raw) {
+    const value = exact(raw, ['version', 'state', 'requests', 'elements', 'actionHints', 'clipboardWriteAttempts', 'coverage'], 'Page behaviour');
+    if (value.version !== PAGE_BEHAVIOUR_VERSION)
+        throw new TypeError('Unsupported page behaviour version.');
+    const requests = ordered(array(value.requests, 'Page requests', MAX_PAGE_OBSERVATIONS).map(raw => {
+        const item = exact(raw, ['position', 'kind', 'origin', 'contentSha256', 'status', 'cspEnforced', 'cspReportOnly'], 'Page request');
+        boolean(item.cspEnforced, 'Enforced policy presence');
+        boolean(item.cspReportOnly, 'Report-only policy presence');
+        const kind = enumeration(item.kind, ['navigation', 'script', 'frame', 'document'], 'Page request kind'), contentSha256 = hash(item.contentSha256);
+        if (kind !== 'script' && contentSha256 !== null)
+            throw new TypeError('Only script response bodies are hashed in page observations.');
+        return { position: integer(item.position, 'Request position', 1, 10_000), kind, origin: origin(item.origin), contentSha256,
+            status: integer(item.status, 'Response status', 100, 599), cspEnforced: item.cspEnforced, cspReportOnly: item.cspReportOnly };
+    }));
+    const elements = ordered(array(value.elements, 'Page elements', MAX_PAGE_OBSERVATIONS).map(raw => {
+        const item = exact(raw, ['position', 'kind', 'origin', 'inline', 'integrity', 'method', 'passwordFields', 'scriptSha256'], 'Page element');
+        const kind = enumeration(item.kind, ['script', 'frame', 'form'], 'Page element kind');
+        boolean(item.inline, 'Inline script');
+        const method = item.method === null ? null : enumeration(item.method, ['get', 'post', 'other'], 'Form method');
+        const passwordFields = integer(item.passwordFields, 'Password field count', 0, 20_000), scriptSha256 = hash(item.scriptSha256);
+        const integrity = enumeration(item.integrity, ['present', 'absent', 'not_applicable'], 'Integrity attribute');
+        if (kind !== 'form' && (method !== null || passwordFields !== 0) || kind === 'form' && method === null
+            || kind !== 'script' && (item.inline || scriptSha256 !== null || integrity !== 'not_applicable')
+            || kind === 'script' && (item.inline && item.origin !== null || !item.inline && scriptSha256 !== null))
+            throw new TypeError('Page element fields do not match their kind.');
+        return { position: integer(item.position, 'Element position', 1, 20_000), kind, origin: origin(item.origin, true), inline: item.inline, integrity, method, passwordFields, scriptSha256 };
+    }));
+    const actionHints = array(value.actionHints, 'Requested-action hints', PAGE_ACTION_HINTS.length).map(raw => enumeration(raw, PAGE_ACTION_HINTS, 'Requested-action hint'));
+    if (new Set(actionHints).size !== actionHints.length)
+        throw new TypeError('Page action hints must not repeat.');
+    const coverage = readCaptureCoverage(value.coverage);
+    if (value.state === 'observed' && captureCoverageIsPartial(coverage))
+        throw new TypeError('Partial request coverage cannot declare complete page observations.');
+    return { version: PAGE_BEHAVIOUR_VERSION, state: enumeration(value.state, ['observed', 'partial'], 'Page observation state'), requests, elements, actionHints,
+        clipboardWriteAttempts: integer(value.clipboardWriteAttempts, 'Blocked clipboard attempts', 0, 1_000_000), coverage };
+}
+export function readManifestPageBehaviour(value, manifestVersion) {
+    if (manifestVersion === 2 && value === undefined)
+        return null;
+    if (manifestVersion !== 3)
+        throw new TypeError('Page behaviour requires capture manifest version 3.');
+    return readPageBehaviour(value);
+}
+/** A missing/partial observation cannot establish removal or unchanged content. */
+export function pageBehaviourRows(input) {
+    return [
+        ...input.requests.map(value => ({ identity: JSON.stringify(['request', value.kind, value.origin, value.contentSha256, value.status, value.cspEnforced, value.cspReportOnly]),
+            label: `${value.kind} response ${value.position} · HTTP ${value.status} · enforced CSP ${value.cspEnforced ? 'present' : 'absent'} · report-only CSP ${value.cspReportOnly ? 'present' : 'absent'}`, origin: value.origin, digest: value.contentSha256 })),
+        ...input.elements.map(value => ({ identity: JSON.stringify(['element', value.kind, value.origin, value.inline, value.integrity, value.method, value.passwordFields, value.scriptSha256]),
+            label: `${value.kind} element ${value.position}${value.inline ? ' · inline' : ''}${value.kind === 'form' ? ` · ${value.method} · ${value.passwordFields} password fields` : value.kind === 'script' ? ` · integrity attribute ${value.integrity}` : ''}`,
+            origin: value.origin, digest: value.scriptSha256 })),
+        ...input.actionHints.map(value => ({ identity: JSON.stringify(['action_wording', value]), label: `Body text wording · ${value.replaceAll('_', ' ')}`, origin: null, digest: null })),
+        ...input.coverage.attempts.filter(value => !['navigation', 'script', 'frame', 'document'].includes(value.channel) || value.state !== 'observed').map(value => ({
+            identity: JSON.stringify(['request_channel', value.channel, value.method, value.origin, value.state, value.reason, value.collectionStarted]),
+            label: `${value.channel.replaceAll('_', ' ')} request ${value.position} · ${captureAttemptDescription(value)}`,
+            origin: value.origin, digest: null,
+        })),
+    ];
+}
+export function comparePageBehaviour(before, after) {
+    const counts = (input) => { const map = new Map(); for (const row of input ? pageBehaviourRows(input) : [])
+        map.set(row.identity, { ...row, count: (map.get(row.identity)?.count ?? 0) + 1 }); return map; };
+    const left = counts(before), right = counts(after), complete = before?.state === 'observed' && after?.state === 'observed';
+    const difference = (a, b) => [...a.values()].filter(row => row.count > (b.get(row.identity)?.count ?? 0))
+        .map(row => ({ ...row, count: row.count - (b.get(row.identity)?.count ?? 0) }));
+    const added = difference(right, left), notReobserved = difference(left, right);
+    const navigation = (value) => value.requests.filter(row => row.kind === 'navigation').map(row => [row.origin, row.status]);
+    const navigationChanged = before && after ? JSON.stringify(navigation(before)) !== JSON.stringify(navigation(after)) : null;
+    const clipboardWriteDelta = before && after ? after.clipboardWriteAttempts - before.clipboardWriteAttempts : null;
+    const requestChannelsChanged = before && after ? JSON.stringify(before.coverage) !== JSON.stringify(after.coverage) : null;
+    return { state: !before || !after ? 'unavailable' : complete ? added.length || notReobserved.length || navigationChanged || clipboardWriteDelta || requestChannelsChanged ? 'changed' : 'unchanged' : 'inconclusive',
+        navigationChanged, clipboardWriteDelta, requestChannelsChanged,
+        added: before ? added : [], notReobserved: after ? notReobserved : [], removalEstablished: false,
+        boundary: 'Selected capture observations, not proof of authorisation, worldwide removal or compromise. Script hashes identify collected bytes; an integrity attribute is not a verified integrity result.' };
+}