@slicedearth/whoisleuth-cli 2.5.1 → 2.7.0

package/docs/contextual-reviews.md

@@ -17,8 +17,9 @@ The CLI uses the same models:
 whoisleuth review-evidence selected-input.json --json --strict-exit
 ```
 
-Each input has `schema`, `version: 1` and `evidence`. Unknown versions and fields
-are rejected. Inputs are bounded to 16 MiB; each supplied context list permits
+Each input has `schema`, a supported `version` and `evidence`. Most inputs use
+version 1; domain history also supports version 2 as described below. Unknown
+versions and fields are rejected. Inputs are bounded to 16 MiB; each supplied context list permits
 200 records. `--strict-exit` returns 4 for a partial contextual review. Neither
 adapter contacts a destination or executes selected software.
 
@@ -57,8 +58,12 @@ later. These stages never execute a command, submit a form or open a destination
 
 The Case view compares retained snapshots using the existing source, hostname,
 scan-depth and model-version rules. Registration, DNS, mail and web changes are
-shown alongside source-qualified certificate pins. Equal-time observations are
-not ordered into a change sequence. Retired dependencies must involve the Case
+shown alongside source-qualified certificate pins.
+Registration and nameserver changes target the Case registration domain; mail
+and web changes target the explicit observation hostname. Certificate pins keep
+their own hostname, or an unknown target when none was retained. These targets
+are preserved in review downloads, retained reports and print previews.
+Equal-time observations are not ordered into a change sequence. Retired dependencies must involve the Case
 domain or one of its hostnames. An expected window qualifies the review; it does
 not approve a change automatically or establish transfer or takeover.
 Review prompts connect comparable page, mail, delegation and registration changes
@@ -66,12 +71,23 @@ to the retained concern. Incomplete comparisons remain visible. A changed creati
 date asks for reassessment of earlier decisions without asserting a new owner,
 resetting a baseline or discarding history; expiry alone never establishes deletion.
 
+Open **Retirement review checklist** for DNS-alias, recovery-email and retained
+integration-reference prompts. Review the configuration you control, then use
+the existing declaration form to record the affected hostnames, evidence family,
+retirement time and source. The draft shows these details before you prepare a
+review. Prefer a configuration or change-reference label; do not enter recovery
+addresses, credentials or complete URLs. Reports with declared retired dependencies
+include the same suggested next reviews in the browser and CLI. Suggestions do not
+record checks as completed or establish takeover availability. Saving preserves
+the source-qualified declaration, not confirmation that configuration was changed.
+
 Schema: `whoisleuth.domain-history.input`. Its `evidence` contains:
 
 - `caseExport`: an ordinary supported editable Case export, with `version` and
   `cases`; the exact existing Case reader rejects data loss or silent repair.
 - `caseId`: the Case selected from that export.
-- `declarations`: `expectedChanges` and `retiredDependencies` arrays.
+- `declarations`: `expectedChanges` and `retiredDependencies` arrays; version 2
+  also requires `registrationBoundaries`. Version 1 remains readable unchanged.
 
 An expected change is `{family, start, end, reason}`. A retired dependency is
 `{asset, dependency, family, retiredAt, source}`. Families are `registration`,
@@ -79,6 +95,23 @@ An expected change is `{family, start, end, reason}`. A retired dependency is
 reusable input download includes the selected Case and is not duplicated in
 workspace storage when saving the report.
 
+Version-2 registration boundaries are analyst declarations, not confirmed
+registration epochs. Each has `{kind, occurredAt, source, rationale,
+snapshotIds, evidencePinIds}`. Kinds are `registration_reported`,
+`deletion_reported`, `reregistration_reported`, `transfer_reported` and
+`review_boundary`. Supply an explicit ISO time and at least one exact reference
+to a snapshot or evidence pin retained in the selected Case. References must be
+unique; unavailable references fail rather than selecting a replacement.
+Up to 40 boundaries and 20 references of each type per boundary are accepted.
+
+The Case history form exposes the same declarations. Reports count retained
+observations before and at/after a declared time without assigning ownership or
+asserting that deletion, re-registration or transfer occurred. Earlier evidence,
+decisions, exceptions and open follow-ups are not rewritten. Reports retain the
+declared source and exact evidence references, and can be deliberately saved as
+ordinary Case files. The reusable input remains a separate download containing
+the selected Case, not an additional workspace copy.
+
 ## Platform objects
 
 Schema: `whoisleuth.platform-continuity.input`. `evidence` is an array:

package/docs/infrastructure-observations.md

@@ -0,0 +1,135 @@
+# Source-qualified infrastructure snapshots
+
+The retained infrastructure inventory combines admitted browser-local evidence,
+not all infrastructure belonging to an organisation. It makes no requests on
+import, opening a view, filtering, selecting a host or comparing history.
+
+Import a `whoisleuth.infrastructure-observation` version 1 document through the
+existing external-findings import. The exact bounded snapshot is retained as one
+Case evidence pin. Review the preview before confirming the mutation. The source
+descriptions are supplied provenance, not authenticated source identities.
+Legacy DNS and certificate imports remain readable: an old Case-domain DNS pin
+does not acquire a precise queried hostname or complete collection scope.
+
+The document records an explicit target, selected full hostnames and DNS types,
+collection mode, observation time and coverage. Each DNS response retains its
+queried name, response owner, type, outcome and source. An alias link uses its
+record owner; an address returned after an alias belongs to the returned address
+owner, not automatically to the initial query. Only retained alias links are
+drawn. Links from different dates do not prove one contemporaneous alias chain.
+No-data, NXDOMAIN, failed and not-checked outcomes remain different observations
+and do not decide registration availability.
+
+Certificate-log and TLS observations keep distinct sources and exact SHA-256
+identities. Full names remain visible; `*.example.test` is a wildcard pattern,
+not an enumerated hostname, and cannot be selected for Lookup or Bulk.
+Certificate names alone do not establish current resolution or activity.
+
+DNS operator, observed edge/CDN/proxy, application platform, runtime, embedded
+dependency, address registration, routing origin and independently observed
+origin are distinct source-qualified roles. Routing requires a routing source;
+IP-registration data cannot substitute for it. Edge indicators cannot identify
+a hidden origin. Multiple providers and conflicting observations remain separate.
+The snapshot reader does not derive physical location, responsibility, ownership,
+safety or maliciousness from these roles.
+
+## Review and deliberately act
+
+Open the inventory from saved-work search. Type, source and date filters apply to
+the admitted set before pagination. Inspect one snapshot to review every retained
+DNS outcome, certificate name and provider role, or select two snapshots in
+chronological order to compare. Export preserves the exact snapshot format.
+Topology search applies to the complete admitted one-hop relationship set, not
+the current source page. Its diagram has a 50-relationship budget; the paginated
+source list and exact snapshot review retain access to evidence beyond the diagram.
+
+Follow a retained domain to an address or certificate, then open its supporting
+Case. **Return to retained infrastructure** restores the exact query, filters,
+page positions and selected identity. **Tab references → Navigation trail** also
+lets you return to earlier successful pivots. This trail lives only in the
+current tab and workspace; it creates no observed relationships. Sources are
+read again rather than copied into navigation state. A removed identity stays
+unavailable, and clearing references or locking the workspace expires the links.
+Certificate identities here are leaf-certificate SHA-256, not SPKI digests.
+
+Lookup links fill the selected target for review without submitting it. Explicitly
+selected hostnames can be prepared in existing Bulk. That handoff does not scan,
+recursively expand targets, change a watchlist or enrol a host in monitoring.
+Use the existing reviewed Lookup/Bulk/Monitor collection plans and explicit
+save actions to collect or retain another observation.
+
+## Historical comparison and CLI
+
+Source, mode and exact selection scope must match, and the later snapshot must
+have a strictly later observation time. Newly observed means newly present in
+retained evidence, not newly created. A value not returned by a complete,
+comparable selected collection is labelled **not returned**, never confirmed
+absence or disappearance. Failed, partial, limited, changed-source and
+incomparable snapshots cannot generate removal findings. Equal-time observations
+have no temporal order. Provider-reported history stays labelled separately from
+supplied local observations.
+
+Comparison rows retain the exact DNS query, response owner and record type, or
+the certificate SHA-256, alongside their source and observation clocks. Labels
+are presentation only: relationship groups and graph exports use canonical
+entity identities, including when long nameserver-set labels look identical.
+
+Derived relationship-group, graph-node and cluster IDs can change when their
+identity calculation changes, including for short labels. They are not durable
+cross-export keys; use the canonical `entityId` where provided. Historical groups
+without it use their complete retained value. Graph fields named `canonical`
+and `value` are bounded display text, not a replacement for that identity. Inspect
+the contributing Case evidence for full nameserver members. Component selections
+and cluster adjustments are transient and are not persisted review history.
+
+In GraphML and GEXF, the display label for `node_canonical` is now
+`Bounded display value` (previously `Canonical value`). The field key, JSON
+property, entity identities and values are unchanged; XML consumers should use
+the field key rather than its display label.
+
+The existing offline command shares the website reader and comparison owner:
+
+```sh
+whoisleuth review-evidence infrastructure-observation.json --json
+whoisleuth review-evidence infrastructure-comparison.json --json
+```
+
+The comparison input is exactly:
+
+```json
+{
+  "schema": "whoisleuth.infrastructure-comparison.input",
+  "version": 1,
+  "earlier": { "...": "complete version-1 snapshot" },
+  "later": { "...": "complete version-1 snapshot" }
+}
+```
+
+The placeholders above are illustrative, not valid evidence. See the reserved
+fixture in `test/fixtures/infrastructure-observations/` for an exact snapshot.
+The CLI performs no DNS, registry, BGP, TLS, HTTP or provider request.
+
+Changed or incomplete latest retained pairs surface as existing local Review
+Items with supporting Case navigation. Complete earlier snapshots remain
+available as stronger baselines; later failures do not rewrite them. There is no
+new history store or scheduling engine.
+
+## Resource and compatibility boundary
+
+One snapshot is limited to 128 KiB, 128 selected hostnames, six DNS types, 16
+source identities, 512 DNS response rows with at most 32 values each, 32
+certificate observations with at most 128 exact names each, 128 role observations
+and 12 bounded limitations. Bounds reject oversized documents rather than
+silently prune accepted snapshot evidence. Existing Case/workspace quotas still
+apply. Projection/diagram budgets may admit a smaller disposable view, with
+incomplete coverage disclosed; exact snapshot review/export remains available.
+
+Version 1 has exact keys and refuses future versions. Existing external-findings
+version 4 and typed version-1 row imports preserve their historical meaning;
+version 5 adds the optional exact infrastructure snapshot. No external discovery
+API, new provider, dependency, collector or automatic request is required.
+Current snapshot and version-5 findings exports use compact UTF-8 JSON with a
+terminal line feed so the emitted representation stays within its parser ceiling.
+An offline comparison input is bounded to two snapshot budgets plus 1 KiB of
+framing. Historical version-4 fixture bytes and reader meaning remain unchanged;
+new typed row conversions emit version 5.

package/docs/offline-intake-context.md

@@ -0,0 +1,213 @@
+# Selected-input indicators and internal containment
+
+Message intake remains local and inert. It does not resolve indicators, open
+links, consult reputation services, execute attachments or apply controls.
+
+## Source-linked indicator review
+
+Version 2 of `whoisleuth.message-intake` adds literal IPv4/IPv6 observations and
+explicitly labelled MD5, SHA-1 and SHA-256 strings from selected plain text,
+message body text, supported calendar fields and extracted document text.
+Private and reserved addresses are valid textual observations, not permission
+to contact them. A labelled hash string is a supplied claim, not proof that a
+file has that digest. Bare opaque hexadecimal values are not interpreted.
+
+Each indicator identifies its input/message/document part and page when known.
+The review retains the source-byte and part digests separately. Identical values
+from different parts remain separately attributed; repeated identical values
+within one part are deduplicated. The UI can copy a source citation. Indicators
+are not added to Lookup targets and do not become a risk score or finding.
+
+Complete URL spans, address local parts, recognised credential-bearing lines,
+message headers and QR payloads are not scanned for indicators. MIME HTML
+extraction also excludes script and style nodes. Explicit plaintext is literal
+supplied text: an IP inside a pasted code snippet can be an inert observation;
+the code is never executed. Phone candidates have their own stricter markup
+exclusions. HAR and identity-event imports keep their existing restricted
+projections: no broad scan of their original fields occurs. Extraction is
+limited to 512 observations, 4,096 candidate checks and 2,097,152 text code
+units across an input. Reached bounds are partial coverage, never proof that
+no further indicators exist.
+
+Version-1 reports remain readable without invented indicator coverage. Their
+original source digests do not acquire new observations retrospectively.
+
+### Supplied phone candidates
+
+Plain-text intake can also identify possible telephone numbers, including a
+support number in a supplied snippet with no link. Candidates are review leads:
+they do not authenticate a caller, identify an operator or establish wrongdoing.
+No number is dialled, resolved or checked against a reputation service.
+
+Review and select each observation deliberately before including it in a saved
+review. Unselected candidates remain transient. The selected observation keeps
+its original spelling, source digest and exact text range, not the surrounding
+snippet. Text ranges use zero-based, end-exclusive UTF-16 code-unit offsets;
+supplementary characters occupy two units. A declared source time is separate
+from the local review time. Identify manual transcription or OCR-derived text
+when that is how the supplied text was obtained.
+
+The browser provides a shared declaration for selected occurrences. Open
+**Declaration for candidate** to override a source label, role, observation time
+or text basis for one occurrence. Apply or clear edits before saving or
+downloading; only equivalent numbers with equivalent declarations share a group.
+
+An advertised support contact and a sender or caller-ID claim describe different
+roles; neither verifies ownership. International formatting can be compared only
+where its prefix and supported separators permit a defensible normalisation.
+National-format numbers, conflicting country context and unsupported characters
+remain uncertain. Extensions are separate, not appended to the destination.
+Dates, identifiers and unsupported forms must not be treated as verified numbers.
+
+Selected numbers can still be private contacts. Review the selected content
+before saving or sharing it. Ordinary public/trusted Case projections do not
+include the private intake attachment; domain-focused interchange does not invent
+a telephone mapping. A missing exported phone observation is not evidence that
+none was supplied.
+
+### Compare a displayed claim with a supplied destination
+
+Use the intake's manual destination comparison when supplied ad, search or
+screenshot material shows one destination and a separate source supplies another.
+Identify each source, any known observation time, and whether its text is a claim,
+transcription or supplied observation. The comparison uses the same safe hostname
+parsing as an HTML link's displayed-host comparison.
+
+Review the exact hostname and registrable boundary. A hostname such as
+`store.example.test.attacker.invalid` is not `store.example.test`. Legitimate
+tracking destinations can also differ. Missing, malformed or credential-bearing
+input leaves insufficient evidence rather than inventing a redirect chain.
+
+Exact entered URLs stay in the private transient view. Retained output uses the
+minimised hostname/origin projection and supplied qualifications, not private
+paths, query values or fragments. Comparing the pair never follows either URL
+and does not establish that a redirect occurred.
+
+## Optional distribution declarations
+
+After reviewing input in Lookup or a Case, open **Declare distribution
+context**. Supply a channel, non-sensitive source label and optional declared
+time, reference, observer and vantage labels. Apply or clear changed declarations
+before saving or downloading. These are analyst claims, not verified delivery,
+capture conditions, network location or independent collection. The local review
+time remains separate from a declared observation time.
+
+The CLI accepts the same explicit declaration:
+
+```sh
+whoisleuth intake text selected.txt --intake-context context.json --json
+```
+
+```json
+{
+  "schema": "whoisleuth.intake-context",
+  "version": 1,
+  "context": {
+    "channel": "sms",
+    "observedAt": "2026-01-02T03:04:05.000Z",
+    "sourceLabel": "Reported message",
+    "reference": "CASE-17",
+    "observerLabel": "Reviewer A",
+    "vantageLabel": "Selected device"
+  }
+}
+```
+
+The separate context file is limited to 8 KiB; stdin is not accepted for it.
+Use `null` for unknown optional values. Channels are `email`, `sms`, `messaging`,
+`social`, `advertisement`, `website`, `document`, `other` and `unknown`.
+Do not supply credentials, recipients, personal account identifiers or exact
+URLs in labels. All declarations are included in the downloaded or deliberately
+retained review. The Case summary pin contains counts and the report identity,
+not the indicator values or declaration text. Retaining original input remains
+a separate choice.
+
+### Select phone observations in the CLI
+
+First run `whoisleuth intake text selected.txt --json`. Standard error shows a
+candidate count, the full source digest, UTF-16 ranges and uncertainty, but not
+the numbers themselves. JSON output excludes unselected candidates. `--quiet`
+suppresses this discovery guidance. Inspect the corresponding text in your
+selected file before choosing a range.
+
+A version-2 context file binds selections to those exact input bytes. For
+example, a file containing `Support: +1 202 555 0107` followed by one LF newline
+has this selection:
+
+```json
+{
+  "schema": "whoisleuth.intake-context",
+  "version": 2,
+  "context": null,
+  "review": {
+    "sourceDigestSha256": "sha256:4ff4224ff4ed496fb67fa2ccb25f87b284d1d291f8e79b57646d6c32700eeb52",
+    "phones": [{
+      "start": 9,
+      "end": 24,
+      "declaration": {
+        "sourceLabel": "Selected support snippet",
+        "observedAt": null,
+        "basis": "supplied_text",
+        "role": "advertised_support_contact",
+        "countryCallingCode": null
+      }
+    }],
+    "destinationPair": null
+  }
+}
+```
+
+Run the earlier `--intake-context context.json` command to include that selected
+observation. A changed file or incorrect range is rejected; obtain its current
+digest and review it again. `context` can also carry the existing distribution
+declaration. Version-1 context files remain supported.
+
+## Selected internal containment handoff
+
+In **Case → Response → Account and device recovery**, open **Prepare an internal
+containment handoff**. Select retained next-step assertions and, independently,
+their linked evidence pins. Choose security operations, identity response,
+endpoint response or network response for tailored review guidance.
+
+The preview displays the selected statements, rationale, recorded state,
+times, pin values and source metadata. **Exact JSON disclosure** exposes the
+complete download, including selected pin scope, provenance and recheck fields.
+Supports, contradicts, unresolved and
+unrecorded relationships remain distinct. A linked pin that is not selected is
+not silently included; an unavailable referenced pin remains unavailable.
+The handoff is limited to 20 requests, 40 pins and 128 KiB, with no silent
+truncation. No original file bytes or unrelated Case notes, title, contacts,
+recipient values, assertions or pins are included.
+
+Review the audience disclosure before copy, download or explicit retention.
+Internal and trusted audiences use the existing Case disclosure policy. Public
+preview excludes internal requests and supporting pins and cannot produce a
+containment export. Selected analyst text may still be sensitive: minimisation
+does not provide anonymisation. Saving uses an ordinary retained Case file and
+a source-hashed summary pin, not another task or state store.
+
+The existing `review-evidence` CLI command accepts an equivalent selected input:
+
+```json
+{
+  "schema": "whoisleuth.internal-containment.input",
+  "version": 1,
+  "caseExport": { "version": 18, "cases": [] },
+  "caseId": "selected-case-id",
+  "selection": {
+    "audience": "internal",
+    "recipientRole": "identity_response",
+    "assertionIds": ["selected-next-step-id"],
+    "evidencePinIds": ["selected-linked-pin-id"]
+  },
+  "disclosureReviewed": true
+}
+```
+
+Replace the empty example with a supported ordinary Case export and exact
+retained IDs after reviewing its selected content. The CLI does not write the
+Case; `--strict-exit` returns 4 when selected supporting context is incomplete.
+Output uses `whoisleuth.internal-containment` version 1 inside the existing
+offline-review envelope. Neither external resolution nor a resolved Case closes
+an open internal request. The handoff performs no assignment, notification,
+blocking, credential change, isolation or other containment action.

package/lib/credential-form-attribution.mjs

@@ -0,0 +1,136 @@
+import { classifyStaticCredentialInput, staticControlDisabled, MAX_STATIC_FORMS, MAX_STATIC_INPUTS, } from "./static-html-analysis.mjs";
+import { CREDENTIAL_CATEGORY_NAMES, MAX_FORM_DESTINATIONS, } from "../packages/evidence/credential-form-attribution.mjs";
+const attribute = (element, name) => element.attributes.find(item => item.name === name)?.value;
+/** HTML Auto buttons submit only without command attributes or a select parent. */
+export function staticControlIsSubmitter(element, parent) {
+    const type = (attribute(element, 'type') ?? '').toLowerCase();
+    if (element.name === 'input')
+        return type === 'submit' || type === 'image';
+    if (element.name !== 'button')
+        return false;
+    if (type === 'submit')
+        return true;
+    if (type === 'button' || type === 'reset')
+        return false;
+    return attribute(element, 'command') === undefined && attribute(element, 'commandfor') === undefined
+        && !(parent?.html && parent.name === 'select');
+}
+// Uses the existing bounded, inert-template-free tree. IDs and control values
+// are transient association inputs; only ordinal forms and fixed categories
+// leave this projection.
+export function attributeCredentialForms(analysis, documentUrl, sourceTruncated = false) {
+    const elements = analysis.elements;
+    const firstId = new Map();
+    const firstLegends = new Map();
+    let firstUncertainId = Number.POSITIVE_INFINITY;
+    const formIndices = [];
+    let complete = !sourceTruncated && !analysis.inputLimitReached && !analysis.tagLimitReached && !analysis.forms.truncated;
+    for (const [index, element] of elements.entries()) {
+        if (element.attributesTruncated && attribute(element, 'id') === undefined)
+            firstUncertainId = Math.min(firstUncertainId, index);
+        const id = attribute(element, 'id');
+        if (id !== undefined && id.length <= 4096 && !firstId.has(id))
+            firstId.set(id, index);
+        if (element.html && element.name === 'form') {
+            if (formIndices.length < MAX_STATIC_FORMS)
+                formIndices.push(index);
+            else
+                complete = false;
+        }
+        if (element.html && element.name === 'legend' && element.parent !== null && !firstLegends.has(element.parent))
+            firstLegends.set(element.parent, index);
+    }
+    const ancestor = (index, name) => {
+        for (let parent = elements[index]?.parent ?? null; parent !== null; parent = elements[parent]?.parent ?? null) {
+            const element = elements[parent];
+            if (element.html && element.name === name)
+                return parent;
+        }
+        return null;
+    };
+    const owner = (index) => {
+        const element = elements[index];
+        if (element.attributesTruncated)
+            return null;
+        for (let parent = element.parent; parent !== null; parent = elements[parent]?.parent ?? null) {
+            if (elements[parent]?.name === 'fieldset' && elements[parent]?.attributesTruncated)
+                return null;
+        }
+        const explicit = attribute(element, 'form');
+        if (explicit !== undefined) {
+            const selected = firstId.get(explicit);
+            // A clipped earlier ID could shadow this form in the browser's first-ID
+            // lookup. Do not attribute its controls to the later retained match.
+            return selected !== undefined && selected < firstUncertainId && elements[selected]?.html && elements[selected]?.name === 'form' ? selected : null;
+        }
+        return ancestor(index, 'form');
+    };
+    const destination = (form, submitter) => {
+        const method = (submitter && attribute(submitter, 'formmethod')) ?? attribute(form, 'method') ?? 'get';
+        if (method.toLowerCase() === 'dialog')
+            return { relationship: 'no_submission', origin: null };
+        if (form.attributesTruncated || submitter?.attributesTruncated)
+            return { relationship: 'unknown', origin: null };
+        const action = (submitter && attribute(submitter, 'formaction')) ?? attribute(form, 'action');
+        if (action !== undefined && (action.length > 4096 || /[\u0000-\u001f\u007f]/u.test(action)))
+            return { relationship: 'unknown', origin: null };
+        try {
+            const source = new URL(documentUrl);
+            // Missing/empty actions use the document URL, not the <base> URL.
+            if (action?.trim() && analysis.baseHrefState === 'invalid')
+                return { relationship: 'unknown', origin: null };
+            const target = new URL(action?.trim() || documentUrl, analysis.effectiveBaseUrl ?? documentUrl);
+            if (!['http:', 'https:'].includes(target.protocol) || target.username || target.password || target.origin.length > 320)
+                return { relationship: 'unknown', origin: null };
+            return { relationship: target.origin === source.origin ? 'same_origin' : 'external', origin: target.origin };
+        }
+        catch {
+            return { relationship: 'unknown', origin: null };
+        }
+    };
+    const forms = formIndices.map((index, ordinal) => ({
+        index: ordinal + 1,
+        categories: Object.fromEntries(CREDENTIAL_CATEGORY_NAMES.map(name => [name, 0])),
+        destinations: [destination(elements[index])],
+    }));
+    const formRows = new Map(formIndices.map((index, ordinal) => [index, forms[ordinal]]));
+    let unassociatedInputs = 0;
+    let controls = 0;
+    for (const [index, element] of elements.entries()) {
+        if (!element.html || !['input', 'button'].includes(element.name))
+            continue;
+        if (++controls > MAX_STATIC_INPUTS) {
+            complete = false;
+            break;
+        }
+        if (staticControlDisabled(elements, index, firstLegends))
+            continue;
+        const categories = element.name === 'input' ? classifyStaticCredentialInput(element.attributes) : { values: [], truncated: false };
+        if (categories.truncated || element.attributesTruncated)
+            complete = false;
+        const ownerIndex = owner(index);
+        const row = ownerIndex === null ? undefined : formRows.get(ownerIndex);
+        if (categories.values.length) {
+            if (!row) {
+                unassociatedInputs++;
+                complete = false;
+            }
+            else
+                for (const category of categories.values)
+                    row.categories[category]++;
+        }
+        const submitter = staticControlIsSubmitter(element, element.parent === null ? undefined : elements[element.parent]);
+        if (row && ownerIndex !== null && submitter && (attribute(element, 'formaction') !== undefined || attribute(element, 'formmethod') !== undefined)) {
+            const next = destination(elements[ownerIndex], element);
+            if (!row.destinations.some(value => value.relationship === next.relationship && value.origin === next.origin)) {
+                if (row.destinations.length >= MAX_FORM_DESTINATIONS)
+                    complete = false;
+                else
+                    row.destinations.push(next);
+            }
+        }
+    }
+    if (forms.some(form => form.destinations.some(value => value.relationship === 'unknown')))
+        complete = false;
+    return { forms, unassociatedInputs, complete };
+}

package/lib/credential-surface-profile.mjs

@@ -5,22 +5,25 @@
 // never enter this profile.
 import { createObservation } from "../packages/evidence/observation.mjs";
 import { CREDENTIAL_SURFACE_PROFILE_VERSION } from "./lookup-child-profile-contract.mjs";
+import { attributeCredentialForms } from "./credential-form-attribution.mjs";
 import { MAX_STATIC_FORMS, MAX_STATIC_INPUTS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 function analyzeCredentialSurfaceProfile(input = {}) {
     const htmlAnalysis = input.htmlAnalysis ?? analyzeStaticHtml(input.html, { baseUrl: input.baseUrl });
     const forms = htmlAnalysis.forms;
+    const formAttribution = input.formAttribution ?? attributeCredentialForms(htmlAnalysis, typeof input.baseUrl === 'string' ? input.baseUrl : '', input.sourceTruncated === true);
     const sourceTruncated = input.sourceTruncated === true;
     const truncated = sourceTruncated
         || htmlAnalysis.inputLimitReached
         || htmlAnalysis.tagLimitReached
         || forms.truncated;
     const unclassifiedActions = forms.actions.unclassified;
-    const partial = truncated || unclassifiedActions > 0;
+    const partial = truncated || unclassifiedActions > 0 || !formAttribution.complete;
     const limitations = [
         'Static input categories use only bounded type and autocomplete declarations; JavaScript-rendered, non-semantic, disabled, and hidden controls are not classified.',
         'Category counts can overlap when one input declares more than one recognised purpose.',
         'External submission can be legitimate and does not establish phishing, unsafe handling, ownership, intent, or maliciousness.',
-        'No field names, values, labels, placeholders, complete action URLs, paths, queries, fragments, or arbitrary attributes are retained.',
+        'Only form ordinals, input-purpose counts and declared destination origins are retained; no field names, values, labels, placeholders, URL paths, queries or fragments.',
+        'Declared destinations, including submitter overrides, are not observed submissions. Script-created or changed forms are not evaluated.',
     ];
     if (sourceTruncated || htmlAnalysis.inputLimitReached) {
         limitations.push('The captured homepage body was truncated, so credential-surface evidence may be incomplete.');
@@ -36,6 +39,7 @@ function analyzeCredentialSurfaceProfile(input = {}) {
     }
     return {
         credentialSurfaceVersion: CREDENTIAL_SURFACE_PROFILE_VERSION,
+        formAttribution,
         ...createObservation({
             status: partial ? 'partial' : 'success',
             observedAt: input.observedAt,

package/lib/dmarc-discovery.mjs

@@ -1,6 +1,7 @@
 import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { parseDmarcRecords } from "./domain-posture-parsers.mjs";
+import { MAX_DMARC_DISCOVERY_OWNERS } from "../packages/evidence/dmarc-policy-context.mjs";
 export function requireDmarcDomain(domain) {
     if (typeof domain !== 'string' || domain.length > 253 || !isValidAsciiHostname(domain) || domain !== domain.toLowerCase()) {
         throw new TypeError('The additional DNS review requires a normalised domain.');
@@ -29,7 +30,8 @@ export function dmarcPolicyObservation(owner, observation) {
         : state;
     const time = typeof observation.observedAt === 'string' && observation.observedAt.length <= 64
         ? normalizeExplicitIsoTimestamp(observation.observedAt) : null;
-    return { owner, parsed, psd, valid, unavailable, incomplete,
+    return { owner, parsed, psd, valid, unavailable, incomplete, observedAt: time,
+        state: unavailable ? 'unavailable' : valid ? 'observed' : parsed.records.length ? 'invalid' : 'not_found',
         record: `Recursive DNS TXT _dmarc.${owner} · ${time ?? 'time unavailable'} · ${description}` };
 }
 /** RFC 9989 sections 4.10–4.10.2: at most eight owners, never PSL inference. */
@@ -38,7 +40,7 @@ export async function walkDmarcTree(domain, exact, resolve, purpose) {
     const rows = [dmarcPolicyObservation(domain, exact)];
     const first = rows[0];
     const labels = domain.split('.');
-    let next = labels.length >= 8 ? labels.slice(-7) : labels.slice(1);
+    let next = labels.length >= MAX_DMARC_DISCOVERY_OWNERS ? labels.slice(-(MAX_DMARC_DISCOVERY_OWNERS - 1)) : labels.slice(1);
     const policyOnly = purpose === 'policy' && first.valid;
     if (!policyOnly && !first.unavailable && !(first.valid && ['n', 'y'].includes(first.psd))) {
         while (next.length) {