@slicedearth/whoisleuth-cli 2.6.0 → 2.7.0

package/packages/contracts/cli-lookup.mjs

@@ -2,9 +2,12 @@ import { defineSchemaCompatibility } from "./schema-compatibility.mjs";
 import { defineSchemaLifecycleFamily } from "./schema-lifecycle.mjs";
 export const CLI_LOOKUP_SCHEMA = 'whoisleuth.cli.lookup';
 export const PUBLIC_CLI_LOOKUP_VERSION = 1;
-export const CLI_LOOKUP_VERSION = 2;
+export const HOMEPAGE_CLI_LOOKUP_VERSION = 2;
+export const COLLECTION_RECEIPT_CLI_LOOKUP_VERSION = 3;
+export const CLI_LOOKUP_VERSION = COLLECTION_RECEIPT_CLI_LOOKUP_VERSION;
 export const SUPPORTED_CLI_LOOKUP_VERSIONS = Object.freeze([
     PUBLIC_CLI_LOOKUP_VERSION,
+    HOMEPAGE_CLI_LOOKUP_VERSION,
     CLI_LOOKUP_VERSION,
 ]);
 export const MAX_CLI_LOOKUP_BYTES = 8 * 1024 * 1024;
@@ -43,6 +46,7 @@ export const CLI_LOOKUP_OPTIONAL_ROOT_KEYS = Object.freeze([
     'sslbl',
     'threatIntelligence',
     'collectionContext',
+    'collectionReceipt',
 ]);
 export const CLI_LOOKUP_DIAGNOSTIC_REQUIRED_KEYS = Object.freeze([
     'rdap',
@@ -60,7 +64,7 @@ export const CLI_LOOKUP_COMPATIBILITY = defineSchemaCompatibility({
     writeSemantics: 'normalized_rewrite',
     byteBudget: MAX_CLI_LOOKUP_BYTES,
     owner: 'packages/contracts/cli-lookup.mts',
-    note: 'Saved Lookup documents preserve version 1 domain, IP and ASN compatibility while version 2 can additionally retain bounded Deep homepage metadata and optional official registrar-standing context.',
+    note: 'Saved Lookup documents preserve versions 1 and 2; version 3 may retain a bounded collection receipt for the completed operation. Homepage metadata and registrar-standing context remain supported from version 2.',
 });
 export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
     id: 'cli-lookup',
@@ -87,11 +91,11 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
         {
             compatibilityId: CLI_LOOKUP_COMPATIBILITY.id,
             schema: CLI_LOOKUP_SCHEMA,
-            version: CLI_LOOKUP_VERSION,
+            version: HOMEPAGE_CLI_LOOKUP_VERSION,
             role: 'document',
-            lifecycle: 'current',
+            lifecycle: 'legacy',
             readable: true,
-            emitted: true,
+            emitted: false,
             exactKeys: false,
             extensionPolicy: 'preserve_bounded',
             futureVersionBehaviour: 'reject',
@@ -100,8 +104,29 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
             byteBudget: MAX_CLI_LOOKUP_BYTES,
             fixtureIds: ['cli-lookup-v2', 'cli-lookup-asn-v2'],
         },
+        {
+            compatibilityId: CLI_LOOKUP_COMPATIBILITY.id,
+            schema: CLI_LOOKUP_SCHEMA,
+            version: CLI_LOOKUP_VERSION,
+            role: 'document', lifecycle: 'current', readable: true, emitted: true,
+            exactKeys: false, extensionPolicy: 'preserve_bounded', futureVersionBehaviour: 'reject',
+            migrationTarget: null, canonicalisation: null, byteBudget: MAX_CLI_LOOKUP_BYTES,
+            fixtureIds: ['cli-lookup-v3', 'cli-lookup-asn-v3'],
+        },
     ],
     fixtures: [
+        {
+            id: 'cli-lookup-v3', path: 'test/fixtures/cli-lookup-v3.json',
+            bytes: 7151, sha256: 'ee06201deb99ef1cdc5e79dc026a733fb14494593ee7ffdff3035b1fbc19d61e', contentDigestSha256: null,
+            schema: CLI_LOOKUP_SCHEMA, version: CLI_LOOKUP_VERSION, role: 'current',
+            expectation: 'accepted_exact', expectedOutputFixtureId: null, scope: 'repository',
+        },
+        {
+            id: 'cli-lookup-asn-v3', path: 'test/fixtures/cli-lookup-asn-v3.json',
+            bytes: 3506, sha256: 'c0a3dfe9d9c13d3f03079c6c76b33b353a6029b9a9893cbdb743b3f4d864c74e', contentDigestSha256: null,
+            schema: CLI_LOOKUP_SCHEMA, version: CLI_LOOKUP_VERSION, role: 'current',
+            expectation: 'accepted_exact', expectedOutputFixtureId: null, scope: 'repository',
+        },
         {
             id: 'cli-lookup-v1',
             path: 'test/fixtures/cli-lookup-v1.json',
@@ -122,8 +147,8 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
             sha256: 'd98356ede18ddd12fde8cf10b0cfa43c42f6c9a09f1951e0605e1ec912892778',
             contentDigestSha256: null,
             schema: CLI_LOOKUP_SCHEMA,
-            version: CLI_LOOKUP_VERSION,
-            role: 'current',
+            version: HOMEPAGE_CLI_LOOKUP_VERSION,
+            role: 'historical',
             expectation: 'accepted_exact',
             expectedOutputFixtureId: null,
             scope: 'repository',
@@ -148,8 +173,8 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
             sha256: 'a3ee74df02050d6efd935784734c8c4cfd5fcb9833393de68935f5040faf2856',
             contentDigestSha256: null,
             schema: CLI_LOOKUP_SCHEMA,
-            version: CLI_LOOKUP_VERSION,
-            role: 'current',
+            version: HOMEPAGE_CLI_LOOKUP_VERSION,
+            role: 'historical',
             expectation: 'accepted_exact',
             expectedOutputFixtureId: null,
             scope: 'repository',
@@ -158,26 +183,12 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
     metadata: {
         enforcement: 'declarative_only',
         shapes: [
-            {
-                id: 'cli-lookup.document.v1',
-                schema: CLI_LOOKUP_SCHEMA,
-                versions: [PUBLIC_CLI_LOOKUP_VERSION],
-                objects: [
-                    { path: '$', requiredKeys: CLI_LOOKUP_REQUIRED_ROOT_KEYS, optionalKeys: CLI_LOOKUP_OPTIONAL_ROOT_KEYS, unknownKeys: 'preserve_bounded' },
-                    { path: '$.diagnostics', requiredKeys: CLI_LOOKUP_DIAGNOSTIC_REQUIRED_KEYS, optionalKeys: [], unknownKeys: 'preserve_bounded' },
-                    { path: '$.diagnostics.rdap', requiredKeys: ['status'], optionalKeys: [], unknownKeys: 'preserve_bounded' },
-                    { path: '$.diagnostics.whois', requiredKeys: ['status'], optionalKeys: [], unknownKeys: 'preserve_bounded' },
-                ],
-                fixedArrays: [],
-                normalisation: 'preserve_bounded_document',
-                target: null,
-            },
-            {
-                id: 'cli-lookup.document.v2',
+            ...SUPPORTED_CLI_LOOKUP_VERSIONS.map(version => ({
+                id: `cli-lookup.document.v${version}`,
                 schema: CLI_LOOKUP_SCHEMA,
-                versions: [CLI_LOOKUP_VERSION],
+                versions: [version],
                 objects: [
-                    { path: '$', requiredKeys: CLI_LOOKUP_REQUIRED_ROOT_KEYS, optionalKeys: CLI_LOOKUP_OPTIONAL_ROOT_KEYS, unknownKeys: 'preserve_bounded' },
+                    { path: '$', requiredKeys: CLI_LOOKUP_REQUIRED_ROOT_KEYS, optionalKeys: CLI_LOOKUP_OPTIONAL_ROOT_KEYS.filter(key => version >= COLLECTION_RECEIPT_CLI_LOOKUP_VERSION || key !== 'collectionReceipt'), unknownKeys: 'preserve_bounded' },
                     { path: '$.diagnostics', requiredKeys: CLI_LOOKUP_DIAGNOSTIC_REQUIRED_KEYS, optionalKeys: [], unknownKeys: 'preserve_bounded' },
                     { path: '$.diagnostics.rdap', requiredKeys: ['status'], optionalKeys: [], unknownKeys: 'preserve_bounded' },
                     { path: '$.diagnostics.whois', requiredKeys: ['status'], optionalKeys: [], unknownKeys: 'preserve_bounded' },
@@ -185,7 +196,7 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 fixedArrays: [],
                 normalisation: 'preserve_bounded_document',
                 target: null,
-            },
+            })),
         ],
         boundProfiles: [
             {
@@ -214,9 +225,9 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
         ],
         serialisationProfiles: [
             {
-                id: 'cli-lookup.json.v1-v2',
+                id: 'cli-lookup.json.v1-v3',
                 schema: CLI_LOOKUP_SCHEMA,
-                versions: [PUBLIC_CLI_LOOKUP_VERSION, CLI_LOOKUP_VERSION],
+                versions: SUPPORTED_CLI_LOOKUP_VERSIONS,
                 mediaType: 'application/json',
                 encoding: 'utf-8',
                 bom: false,
@@ -234,7 +245,7 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'cli-lookup.sensitive-collection.v1',
                 classification: 'analyst_authored_sensitive',
                 projection: 'full_manifest',
-                includedCategories: ['target-identifiers', 'query-and-mode', 'raw-rdap-publications', 'raw-whois-responses', 'published-contacts', 'source-endpoints', 'source-timings', 'normalised-evidence', 'registrar-standing-official-projection', 'collection-context'],
+                includedCategories: ['target-identifiers', 'query-and-mode', 'raw-rdap-publications', 'raw-whois-responses', 'published-contacts', 'source-endpoints', 'source-timings', 'normalised-evidence', 'registrar-standing-official-projection', 'collection-context', 'collection-receipt'],
                 excludedCategories: ['credentials', 'cookies', 'sessions', 'authorisation-material'],
                 notePolicy: 'not_applicable',
                 retention: 'operator_controlled_output',
@@ -245,7 +256,7 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'cli-lookup.sensitive-file.v1',
                 classification: 'analyst_authored_sensitive',
                 projection: 'full_manifest',
-                includedCategories: ['target-identifiers', 'query-and-mode', 'raw-rdap-publications', 'raw-whois-responses', 'published-contacts', 'source-endpoints', 'source-timings', 'normalised-evidence', 'registrar-standing-official-projection', 'collection-context'],
+                includedCategories: ['target-identifiers', 'query-and-mode', 'raw-rdap-publications', 'raw-whois-responses', 'published-contacts', 'source-endpoints', 'source-timings', 'normalised-evidence', 'registrar-standing-official-projection', 'collection-context', 'collection-receipt'],
                 excludedCategories: ['credentials', 'cookies', 'sessions', 'authorisation-material'],
                 notePolicy: 'not_applicable',
                 retention: 'deliberate_local_file',
@@ -257,7 +268,7 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 classification: 'metadata_only',
                 projection: 'metadata_only',
                 includedCategories: ['schema-and-version', 'source-state-counts', 'bounded-timings', 'integrity-state'],
-                excludedCategories: ['target-identifiers', 'query-and-mode', 'raw-rdap-publications', 'raw-whois-responses', 'published-contacts', 'source-endpoints', 'normalised-evidence', 'collection-context'],
+                excludedCategories: ['target-identifiers', 'query-and-mode', 'raw-rdap-publications', 'raw-whois-responses', 'published-contacts', 'source-endpoints', 'normalised-evidence', 'collection-context', 'collection-receipt'],
                 notePolicy: 'not_applicable',
                 retention: 'transient_report',
                 network: 'none',
@@ -268,7 +279,7 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 classification: 'metadata_only',
                 projection: 'metadata_only',
                 includedCategories: ['schema-and-version', 'source-state-counts', 'bounded-timings', 'truncation-and-rate-limit-counts', 'aggregate-lookup-mode-counts'],
-                excludedCategories: ['target-identifiers', 'query-values', 'per-document-linkage', 'raw-rdap-publications', 'raw-whois-responses', 'published-contacts', 'source-endpoints', 'normalised-evidence', 'collection-context'],
+                excludedCategories: ['target-identifiers', 'query-values', 'per-document-linkage', 'raw-rdap-publications', 'raw-whois-responses', 'published-contacts', 'source-endpoints', 'normalised-evidence', 'collection-context', 'collection-receipt'],
                 notePolicy: 'not_applicable',
                 retention: 'transient_report',
                 network: 'none',
@@ -292,10 +303,10 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 operation: 'collect-and-serialise-fast-or-deep',
                 acceptedContracts: [],
                 emittedContract: { schema: CLI_LOOKUP_SCHEMA, version: CLI_LOOKUP_VERSION },
-                shapeIds: ['cli-lookup.document.v2'],
+                shapeIds: [`cli-lookup.document.v${CLI_LOOKUP_VERSION}`],
                 boundProfileIds: ['cli-lookup.document-bounds.v1'],
                 hookIds: ['cli-lookup.cli.build', 'cli-lookup.cli.serialise'],
-                serialisationProfileId: 'cli-lookup.json.v1-v2',
+                serialisationProfileId: 'cli-lookup.json.v1-v3',
                 privacyProfileId: 'cli-lookup.sensitive-collection.v1',
                 expiryPolicyId: 'cli-lookup.expiry.not-applicable.v1',
                 requestMode: 'explicit_bounded_passive_fast_or_deep',
@@ -307,9 +318,9 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'cli-lookup.cli-read-all',
                 plane: 'cli',
                 operation: 'read-all-query-types',
-                acceptedContracts: [{ schema: CLI_LOOKUP_SCHEMA, versions: [PUBLIC_CLI_LOOKUP_VERSION, CLI_LOOKUP_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: CLI_LOOKUP_SCHEMA, versions: SUPPORTED_CLI_LOOKUP_VERSIONS, mode: 'direct' }],
                 emittedContract: null,
-                shapeIds: ['cli-lookup.document.v1', 'cli-lookup.document.v2'],
+                shapeIds: SUPPORTED_CLI_LOOKUP_VERSIONS.map(version => `cli-lookup.document.v${version}`),
                 boundProfileIds: ['cli-lookup.document-bounds.v1'],
                 hookIds: ['cli-lookup.cli.parse-all'],
                 serialisationProfileId: null,
@@ -324,9 +335,9 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'cli-lookup.cli-read-domain',
                 plane: 'cli',
                 operation: 'read-domain-only',
-                acceptedContracts: [{ schema: CLI_LOOKUP_SCHEMA, versions: [PUBLIC_CLI_LOOKUP_VERSION, CLI_LOOKUP_VERSION], mode: 'direct', discriminator: { path: '$.type', values: ['domain'] } }],
+                acceptedContracts: [{ schema: CLI_LOOKUP_SCHEMA, versions: SUPPORTED_CLI_LOOKUP_VERSIONS, mode: 'direct', discriminator: { path: '$.type', values: ['domain'] } }],
                 emittedContract: null,
-                shapeIds: ['cli-lookup.document.v1', 'cli-lookup.document.v2'],
+                shapeIds: SUPPORTED_CLI_LOOKUP_VERSIONS.map(version => `cli-lookup.document.v${version}`),
                 boundProfileIds: ['cli-lookup.document-bounds.v1'],
                 hookIds: ['cli-lookup.cli.parse-domain'],
                 serialisationProfileId: null,
@@ -341,9 +352,9 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'cli-lookup.cli-source-report',
                 plane: 'cli',
                 operation: 'build-source-reliability-report',
-                acceptedContracts: [{ schema: CLI_LOOKUP_SCHEMA, versions: [PUBLIC_CLI_LOOKUP_VERSION, CLI_LOOKUP_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: CLI_LOOKUP_SCHEMA, versions: SUPPORTED_CLI_LOOKUP_VERSIONS, mode: 'direct' }],
                 emittedContract: null,
-                shapeIds: ['cli-lookup.document.v1', 'cli-lookup.document.v2'],
+                shapeIds: SUPPORTED_CLI_LOOKUP_VERSIONS.map(version => `cli-lookup.document.v${version}`),
                 boundProfileIds: ['cli-lookup.document-bounds.v1'],
                 hookIds: ['cli-lookup.cli.normalise', 'cli-lookup.cli.source-report'],
                 serialisationProfileId: null,
@@ -358,9 +369,9 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'cli-lookup.cli-offline-verify',
                 plane: 'cli',
                 operation: 'verify-structure',
-                acceptedContracts: [{ schema: CLI_LOOKUP_SCHEMA, versions: [PUBLIC_CLI_LOOKUP_VERSION, CLI_LOOKUP_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: CLI_LOOKUP_SCHEMA, versions: SUPPORTED_CLI_LOOKUP_VERSIONS, mode: 'direct' }],
                 emittedContract: null,
-                shapeIds: ['cli-lookup.document.v1', 'cli-lookup.document.v2'],
+                shapeIds: SUPPORTED_CLI_LOOKUP_VERSIONS.map(version => `cli-lookup.document.v${version}`),
                 boundProfileIds: ['cli-lookup.document-bounds.v1'],
                 hookIds: ['cli-lookup.cli.parse-all', 'cli-lookup.cli.offline-verify'],
                 serialisationProfileId: null,
@@ -375,9 +386,9 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'cli-lookup.cli-sharing-review',
                 plane: 'cli',
                 operation: 'build-redacted-sharing-review',
-                acceptedContracts: [{ schema: CLI_LOOKUP_SCHEMA, versions: [PUBLIC_CLI_LOOKUP_VERSION, CLI_LOOKUP_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: CLI_LOOKUP_SCHEMA, versions: SUPPORTED_CLI_LOOKUP_VERSIONS, mode: 'direct' }],
                 emittedContract: null,
-                shapeIds: ['cli-lookup.document.v1', 'cli-lookup.document.v2'],
+                shapeIds: SUPPORTED_CLI_LOOKUP_VERSIONS.map(version => `cli-lookup.document.v${version}`),
                 boundProfileIds: ['cli-lookup.document-bounds.v1'],
                 hookIds: ['cli-lookup.cli.parse-all', 'cli-lookup.cli.sharing-review'],
                 serialisationProfileId: null,

package/packages/contracts/lookup-evidence.mjs

@@ -1,4 +1,5 @@
 import { defineSchemaCompatibility } from "./schema-compatibility.mjs";
+import { LEGACY_REGISTRY_INSIGHTS_VERSION, REGISTRY_INSIGHTS_VERSION } from "./registry-insights.mjs";
 export const LOOKUP_EVIDENCE_SCHEMA = 'whoisleuth.lookup-evidence';
 export const V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION = 26;
 export const PUBLISHED_V2_LOOKUP_EVIDENCE_SCHEMA_VERSION = 27;
@@ -6,14 +7,23 @@ export const REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION = 28;
 export const LATEST_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION = REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION;
 export const HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION = 29;
 export const PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION = PUBLISHED_V2_LOOKUP_EVIDENCE_SCHEMA_VERSION;
-export const LOOKUP_EVIDENCE_SCHEMA_VERSION = 30;
+export const FORM_ATTRIBUTED_LOOKUP_EVIDENCE_SCHEMA_VERSION = 30;
+export const AUTHORITY_AWARE_LOOKUP_EVIDENCE_SCHEMA_VERSION = 31;
+export const LOOKUP_EVIDENCE_SCHEMA_VERSION = AUTHORITY_AWARE_LOOKUP_EVIDENCE_SCHEMA_VERSION;
 export const SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS = Object.freeze([
     V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION,
     PUBLISHED_V2_LOOKUP_EVIDENCE_SCHEMA_VERSION,
     LATEST_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION,
     HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION,
+    FORM_ATTRIBUTED_LOOKUP_EVIDENCE_SCHEMA_VERSION,
     LOOKUP_EVIDENCE_SCHEMA_VERSION,
 ]);
+export function lookupEvidenceRegistryInsightsVersion(schemaVersion) {
+    if (!SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS.includes(schemaVersion))
+        throw new TypeError('Unsupported Lookup evidence version.');
+    return schemaVersion >= AUTHORITY_AWARE_LOOKUP_EVIDENCE_SCHEMA_VERSION
+        ? REGISTRY_INSIGHTS_VERSION : LEGACY_REGISTRY_INSIGHTS_VERSION;
+}
 export const LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES = 5 * 1024 * 1024;
 export const LOOKUP_EVIDENCE_PORTABLE_MAX_ENTRIES = 20_000;
 export const LOOKUP_EVIDENCE_PORTABLE_MAX_DEPTH = 24;
@@ -32,5 +42,5 @@ export const LOOKUP_EVIDENCE_COMPATIBILITY = defineSchemaCompatibility({
     writeSemantics: 'read_only',
     byteBudget: LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES,
     owner: 'packages/contracts/lookup-evidence.mts',
-    note: 'Published versions 26–29 retain their original collection scope. Version 30 adds attributed password-form destinations; older page-wide flags are not form ownership evidence. Registration authority remains separate.',
+    note: 'Versions 26–30 retain their registry insight derivation. Version 30 adds attributed form destinations. Version 31 retains WHOIS registration classification; collection completion is not positive registration evidence.',
 });

package/packages/contracts/registry-insights.mjs

@@ -0,0 +1,6 @@
+/** Version 1 is retained for exact historical evidence verification. */
+export const LEGACY_REGISTRY_INSIGHTS_VERSION = 1;
+export const REGISTRY_INSIGHTS_VERSION = 2;
+export function isSupportedRegistryInsightsVersion(value) {
+    return value === LEGACY_REGISTRY_INSIGHTS_VERSION || value === REGISTRY_INSIGHTS_VERSION;
+}

package/packages/evidence/dmarc-policy-context.mjs

@@ -0,0 +1,80 @@
+import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
+import { normalizeExplicitIsoTimestamp } from "./observation.mjs";
+export const MAX_DMARC_DISCOVERY_OWNERS = 8;
+function closedRecord(value, keys) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)
+        || ![Object.prototype, null].includes(Object.getPrototypeOf(value))
+        || Reflect.ownKeys(value).length !== keys.length)
+        throw new TypeError('DMARC policy context has an invalid structure.');
+    const result = {};
+    for (const key of keys) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor?.enumerable || !('value' in descriptor))
+            throw new TypeError('DMARC policy context requires ordinary data fields.');
+        result[key] = descriptor.value;
+    }
+    return result;
+}
+function owner(value) {
+    return typeof value === 'string' && value.length <= 253
+        && isValidAsciiHostname(value, { requireDot: false, requireLowercase: true });
+}
+function time(value) {
+    if (value === null)
+        return null;
+    const normalized = typeof value === 'string' && value.length <= 64 ? normalizeExplicitIsoTimestamp(value) : null;
+    if (normalized === null)
+        throw new TypeError('DMARC policy context has an invalid observation time.');
+    return normalized;
+}
+/** Current opted-in review only; absent historical context is never reconstructed. */
+export function normalizeDmarcPolicyContext(value, expectedDomain) {
+    if (value === undefined)
+        return undefined;
+    const input = closedRecord(value, ['version', 'source', 'relation', 'complete', 'owner', 'observedAt', 'policy', 'subdomainPolicy', 'nonexistentPolicy', 'psd', 'testMode', 'discovery']);
+    if (input.version !== 1 || input.source !== 'recursive_dns_txt' || typeof input.complete !== 'boolean'
+        || typeof input.relation !== 'string' || !['exact', 'inherited', 'undetermined'].includes(input.relation)
+        || !Array.isArray(input.discovery) || input.discovery.length < 1 || input.discovery.length > MAX_DMARC_DISCOVERY_OWNERS) {
+        throw new TypeError('DMARC policy context has an unsupported version or discovery state.');
+    }
+    const discovery = [];
+    for (let index = 0; index < input.discovery.length; index++) {
+        const entry = Object.getOwnPropertyDescriptor(input.discovery, String(index));
+        if (!entry?.enumerable || !('value' in entry))
+            throw new TypeError('DMARC discovery requires ordinary entries.');
+        const row = closedRecord(entry.value, ['owner', 'state', 'observedAt']);
+        if (!owner(row.owner) || typeof row.state !== 'string' || !['observed', 'not_found', 'invalid', 'unavailable'].includes(row.state)) {
+            throw new TypeError('DMARC discovery has an invalid owner or state.');
+        }
+        discovery.push(Object.freeze({ owner: row.owner, state: row.state, observedAt: time(row.observedAt) }));
+    }
+    if (new Set(discovery.map(row => row.owner)).size !== discovery.length
+        || (expectedDomain !== undefined && discovery[0].owner !== expectedDomain)
+        || discovery.some((row, index) => index > 0 && !discovery[index - 1].owner.endsWith(`.${row.owner}`))
+        || (input.complete && discovery.some(row => row.state === 'unavailable'))) {
+        throw new TypeError('DMARC discovery does not match one bounded owner walk.');
+    }
+    const observedAt = time(input.observedAt);
+    if (input.relation === 'undetermined') {
+        if ([input.owner, observedAt, input.policy, input.subdomainPolicy, input.nonexistentPolicy, input.psd, input.testMode].some(field => field !== null)) {
+            throw new TypeError('Undetermined DMARC policy must not declare a selected policy.');
+        }
+    }
+    else {
+        const selected = discovery.find(row => row.owner === input.owner);
+        if (!input.complete || !owner(input.owner) || !selected || selected.state !== 'observed' || selected.observedAt !== observedAt
+            || (input.relation === 'exact') !== (input.owner === discovery[0].owner)
+            || [input.policy, input.subdomainPolicy, input.nonexistentPolicy].some(field => typeof field !== 'string' || !['none', 'quarantine', 'reject'].includes(field))
+            || typeof input.psd !== 'string' || !['u', 'n', 'y'].includes(input.psd) || typeof input.testMode !== 'boolean') {
+            throw new TypeError('DMARC policy does not match a complete selected observation.');
+        }
+    }
+    return Object.freeze({
+        version: 1, source: 'recursive_dns_txt', relation: input.relation,
+        complete: input.complete, owner: input.owner, observedAt,
+        policy: input.policy, subdomainPolicy: input.subdomainPolicy,
+        nonexistentPolicy: input.nonexistentPolicy,
+        psd: input.psd, testMode: input.testMode,
+        discovery: Object.freeze(discovery),
+    });
+}

package/packages/evidence/lookup-collection-receipt.mjs

@@ -0,0 +1,140 @@
+// A bounded account of one completed Lookup operation. This records collector
+// execution, not proof of network delivery, independent verification or history.
+export const LOOKUP_SOURCE_IDS = Object.freeze([
+    'rdap', 'whois', 'domain_evidence', 'reverse_dns', 'registrar_rdap',
+    'network_context', 'security_txt', 'external_intelligence',
+    'malware_host_intelligence', 'malware_ioc_intelligence',
+]);
+export const LOOKUP_SOURCE_STATES = Object.freeze([
+    'success', 'partial', 'not_found', 'skipped', 'error', 'unsupported',
+    'not_applicable', 'unavailable', 'rate_limited', 'complete', 'disabled', 'stale',
+]);
+export const LOOKUP_COLLECTION_RECEIPT_VERSION = 1;
+export const LOOKUP_CHOICE_KEYS = Object.freeze([
+    'securityTxt', 'externalIntelligence', 'malwareHostIntelligence', 'malwareIocIntelligence',
+]);
+export const LOOKUP_CHOICE_SOURCES = Object.freeze({
+    securityTxt: 'security_txt', externalIntelligence: 'external_intelligence',
+    malwareHostIntelligence: 'malware_host_intelligence', malwareIocIntelligence: 'malware_ioc_intelligence',
+});
+const ADMISSIONS = ['admitted', 'disabled', 'unsupported', 'not_applicable', 'prerequisite_unavailable', 'unknown'];
+function fields(value, keys) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new TypeError('Collection receipt must contain ordinary objects.');
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        throw new TypeError('Collection receipt must contain ordinary objects.');
+    const own = Reflect.ownKeys(value);
+    if (own.length !== keys.length || own.some(key => typeof key !== 'string' || !keys.includes(key))) {
+        throw new TypeError('Collection receipt contains an unsupported field set.');
+    }
+    const output = {};
+    for (const key of keys) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor?.enumerable || !('value' in descriptor))
+            throw new TypeError('Collection receipt contains an invalid field.');
+        output[key] = descriptor.value;
+    }
+    return output;
+}
+function oneOf(value, options) {
+    if (typeof value !== 'string' || !options.includes(value))
+        throw new TypeError('Collection receipt contains an invalid state.');
+    return value;
+}
+function quality(value) {
+    if (value !== null && typeof value !== 'boolean')
+        throw new TypeError('Collection receipt quality must be explicit or unknown.');
+    return value;
+}
+export function lookupCollectionChoices(input) {
+    return Object.freeze({
+        securityTxt: input.securityTxt === true,
+        externalIntelligence: input.externalIntelligence === true,
+        malwareHostIntelligence: input.malwareHostIntelligence === true,
+        malwareIocIntelligence: input.malwareIocIntelligence === true,
+    });
+}
+/** Absence is historical unknown, never reconstructed as a negative choice. */
+export function parseLookupCollectionReceipt(raw) {
+    if (raw === undefined)
+        return null;
+    const value = fields(raw, ['version', 'requestedDepth', 'targetClass', 'webSelection', 'originalChoices', 'sources']);
+    if (value.version !== LOOKUP_COLLECTION_RECEIPT_VERSION)
+        throw new TypeError('Collection receipt version is unsupported.');
+    const choices = fields(value.originalChoices, LOOKUP_CHOICE_KEYS);
+    if (Object.values(choices).some(choice => typeof choice !== 'boolean'))
+        throw new TypeError('Collection receipt choices must be explicit.');
+    const requestedDepth = oneOf(value.requestedDepth, ['fast', 'deep']);
+    const targetClass = oneOf(value.targetClass, ['domain', 'ipv4', 'ipv6', 'asn']);
+    const webSelection = oneOf(value.webSelection, ['hostname', 'selected_url', 'not_applicable']);
+    if ((targetClass !== 'domain' && webSelection !== 'not_applicable') || (webSelection === 'selected_url' && requestedDepth !== 'deep')) {
+        throw new TypeError('Collection receipt target and web selection disagree.');
+    }
+    if (!Array.isArray(value.sources) || Object.getPrototypeOf(value.sources) !== Array.prototype
+        || value.sources.length !== LOOKUP_SOURCE_IDS.length
+        || Reflect.ownKeys(value.sources).length !== LOOKUP_SOURCE_IDS.length + 1)
+        throw new TypeError('Collection receipt source inventory is invalid.');
+    const bySource = new Map();
+    for (let index = 0; index < LOOKUP_SOURCE_IDS.length; index++) {
+        const descriptor = Object.getOwnPropertyDescriptor(value.sources, String(index));
+        if (!descriptor?.enumerable || !('value' in descriptor))
+            throw new TypeError('Collection receipt source entry is invalid.');
+        const row = fields(descriptor.value, ['source', 'intent', 'admission', 'attempt', 'settlement', 'complete', 'truncated']);
+        const source = oneOf(row.source, LOOKUP_SOURCE_IDS);
+        if (bySource.has(source))
+            throw new TypeError('Collection receipt source is duplicated.');
+        const attempt = oneOf(row.attempt, ['started', 'not_started', 'unknown']);
+        const admission = oneOf(row.admission, ADMISSIONS);
+        const complete = quality(row.complete), truncated = quality(row.truncated);
+        const intent = oneOf(row.intent, ['requested', 'not_requested']);
+        const settlement = oneOf(row.settlement, [...LOOKUP_SOURCE_STATES, 'unknown']);
+        if (attempt === 'started' && admission !== 'admitted'
+            || attempt === 'started' && intent !== 'requested'
+            || attempt !== 'started' && (complete !== null || truncated !== null)
+            || attempt === 'not_started' && settlement !== 'unknown'
+            || complete === true && !['success', 'complete', 'not_found'].includes(settlement)
+            || complete === true && truncated === true)
+            throw new TypeError('Collection receipt execution and quality disagree.');
+        bySource.set(source, Object.freeze({
+            source, intent, admission, attempt, settlement, complete, truncated,
+        }));
+    }
+    for (const choice of LOOKUP_CHOICE_KEYS) {
+        if ((bySource.get(LOOKUP_CHOICE_SOURCES[choice]).intent === 'requested') !== choices[choice]) {
+            throw new TypeError('Collection receipt choice and source intent disagree.');
+        }
+    }
+    return Object.freeze({ version: LOOKUP_COLLECTION_RECEIPT_VERSION, requestedDepth, targetClass, webSelection,
+        originalChoices: lookupCollectionChoices(choices),
+        sources: Object.freeze(LOOKUP_SOURCE_IDS.map(source => bySource.get(source))),
+    });
+}
+/** Bind a validated execution account to this submission's pre-filter choices.
+ * A browser may omit an ineligible optional request; the server cannot know
+ * which unchecked/disabled control led to that omission. Do not invent why. */
+export function bindLookupCollectionChoices(raw, originalChoices) {
+    const receipt = parseLookupCollectionReceipt(raw);
+    if (!receipt)
+        return null;
+    const choices = fields(originalChoices, LOOKUP_CHOICE_KEYS);
+    if (Object.values(choices).some(choice => typeof choice !== 'boolean'))
+        throw new TypeError('Collection receipt choices must be explicit.');
+    const sources = receipt.sources.map(row => {
+        const choice = LOOKUP_CHOICE_KEYS.find(key => LOOKUP_CHOICE_SOURCES[key] === row.source);
+        if (!choice || choices[choice] === receipt.originalChoices[choice])
+            return { ...row };
+        if (receipt.originalChoices[choice] || choices[choice] !== true || row.attempt !== 'not_started') {
+            throw new TypeError('Collection receipt does not match the submitted choices.');
+        }
+        return { ...row, intent: 'requested', admission: 'unknown' };
+    });
+    const bound = { ...receipt, originalChoices: lookupCollectionChoices(choices), sources };
+    parseLookupCollectionReceipt(bound);
+    return bound;
+}
+/** Stable, payload-free material comparison. Parsing also removes key order as a difference. */
+export function lookupCollectionReceiptIdentity(raw) {
+    const receipt = parseLookupCollectionReceipt(raw);
+    return receipt ? JSON.stringify(receipt) : null;
+}

package/packages/evidence/lookup-collection-review.mjs

@@ -0,0 +1,74 @@
+import { LOOKUP_CHOICE_KEYS, LOOKUP_CHOICE_SOURCES, parseLookupCollectionReceipt } from "./lookup-collection-receipt.mjs";
+export const LOOKUP_SOURCE_LABELS = Object.freeze({
+    rdap: 'Registry RDAP', whois: 'WHOIS chain', domain_evidence: 'Domain evidence',
+    reverse_dns: 'Reverse DNS', registrar_rdap: 'Registrar RDAP', network_context: 'Network context',
+    security_txt: 'security.txt', external_intelligence: 'Archived web intelligence',
+    malware_host_intelligence: 'Malware host intelligence', malware_ioc_intelligence: 'Malware infrastructure intelligence',
+});
+const ADMISSION_LABELS = Object.freeze({
+    admitted: 'Admitted', disabled: 'Disabled by policy', unsupported: 'Unsupported', not_applicable: 'Not applicable',
+    prerequisite_unavailable: 'Required earlier evidence unavailable', unknown: 'Admission not recorded',
+});
+const ATTEMPT_LABELS = Object.freeze({ started: 'Collector started', not_started: 'Collector not started', unknown: 'Collector start unknown' });
+/** Inert guidance from recorded states, never an admission or retry decision. */
+export function lookupSourceStateExplanation(state, source, receipt) {
+    if (receipt && receipt.source === source && receipt.attempt === 'not_started') {
+        if (receipt.intent === 'not_requested')
+            return 'Not requested in this Lookup. Select it explicitly in a new Lookup if needed.';
+        if (receipt.admission === 'disabled')
+            return 'Collection was disabled by policy. Retrying does not change that policy.';
+        if (receipt.admission === 'prerequisite_unavailable')
+            return 'Required earlier evidence was unavailable, so this collector did not start. Review that source first.';
+        if (receipt.admission === 'not_applicable')
+            return 'This collector did not apply to the submitted target or mode.';
+        if (receipt.admission === 'unsupported')
+            return 'Collection was not supported for this target; retrying unchanged inputs will not add evidence.';
+    }
+    switch (state) {
+        case 'success':
+        case 'complete':
+            return 'Collection completed within this source’s scope. Review its observations and time below.';
+        case 'not_found':
+            return 'This source returned no matching record. Its authority and search scope determine what that means.';
+        case 'partial':
+        case 'inconclusive':
+            return 'Evidence is incomplete or inconclusive. Missing fields remain unknown; a later retry may help if source conditions change.';
+        case 'error':
+        case 'unavailable':
+            return 'Usable evidence was not obtained. This is not an absence finding; retry may help after the reported problem changes.';
+        case 'rate_limited':
+            return 'The source reported a rate limit. Wait for its permitted retry window; no reset time is assumed.';
+        case 'unsupported':
+            return source === 'rdap' || source === 'whois'
+                ? 'No applicable service was recorded by registry policy or discovery. Retrying unchanged discovery may not add evidence.'
+                : 'This source does not support the target or request. Use an applicable source rather than repeating the same request.';
+        case 'skipped':
+            return 'This source was not queried under the selected mode or access policy. Review its source details before requesting it again.';
+        case 'disabled':
+            return 'Collection was disabled by policy. Retrying does not change that policy.';
+        case 'not_applicable':
+            return 'This source does not apply to the submitted target or mode.';
+        case 'stale':
+            return 'Retained evidence is out of date for this review. A deliberate refresh may provide a newer observation.';
+        default:
+            return 'The source outcome was not retained. Its request history and retry usefulness are unknown.';
+    }
+}
+/** One presentation of the closed receipt vocabulary for browser and terminal. */
+export function lookupCollectionReceiptReview(raw) {
+    const receipt = parseLookupCollectionReceipt(raw);
+    if (!receipt)
+        return null;
+    return {
+        receipt,
+        selection: `${receipt.requestedDepth === 'deep' ? 'Deep' : 'Fast'} Lookup · ${receipt.webSelection === 'selected_url'
+            ? 'selected URL' : receipt.webSelection === 'hostname' ? 'hostname' : 'no web target'}`,
+        choices: LOOKUP_CHOICE_KEYS.map(choice => ({ label: LOOKUP_SOURCE_LABELS[LOOKUP_CHOICE_SOURCES[choice]], selected: receipt.originalChoices[choice] })),
+        sources: receipt.sources.map(row => ({
+            id: row.source, label: LOOKUP_SOURCE_LABELS[row.source],
+            summary: `${row.intent === 'requested' ? 'Requested' : 'Not requested'} · ${ADMISSION_LABELS[row.admission]} · ${ATTEMPT_LABELS[row.attempt]}`,
+            outcome: `Source result: ${row.settlement.replaceAll('_', ' ')} · ${row.complete === null ? 'completeness unknown' : row.complete ? 'complete' : 'not complete'} · ${row.truncated === null ? 'truncation unknown' : row.truncated ? 'truncated' : 'not truncated'}`,
+            explanation: lookupSourceStateExplanation(row.settlement, row.source, row),
+        })),
+    };
+}