@slicedearth/whoisleuth-cli 1.34.0 → 1.39.1

package/frontend/src/lib/analysis/visualization-models.js

@@ -0,0 +1,370 @@
+import { scaleBand, scaleLinear, scalePoint } from 'd3-scale';
+import { boundedVisualizationId as boundedId, boundedVisualizationNumber as boundedNumber, boundedVisualizationText as boundedText, validVisualizationDate as validDate, } from "./visualization-bounds.js";
+export { FORCE_GRAPH_LINK_KINDS, MAX_FORCE_GRAPH_LINKS, MAX_FORCE_GRAPH_NODES, projectBoundedForceGraph, } from "./visualization-force-graph.js";
+export { MAX_VISUAL_MATRIX_COLUMNS, MAX_VISUAL_MATRIX_ROWS, projectEvidenceMatrix, } from "./visualization-matrix.js";
+export { MAX_COLLECTION_TIMING_SOURCES, MAX_LIFECYCLE_EVENTS, MAX_TREND_POINTS, projectCollectionTiming, projectLifecycleEvents, projectTrendPoints, } from "./visualization-time-series.js";
+export const MAX_REDIRECT_NODES = 9;
+export const MAX_TRIAGE_PLOT_POINTS = 300;
+export const WATCHLIST_ACTIVITY_DAYS = 28;
+export const MAX_SCORE_FACTORS = 16;
+export const MAX_COVERAGE_BAR_GROUPS = 18;
+export const MAX_MONITOR_TIMELINE_EVENTS = 12;
+export const MAX_MONITOR_TIMELINE_LANES = 6;
+function boundedScore(value) {
+    if (value === null || value === undefined || value === '')
+        return null;
+    const score = Number(value);
+    return Number.isFinite(score) ? Math.max(0, Math.min(100, score)) : null;
+}
+function redirectLabel(value) {
+    const text = boundedText(value, 320);
+    try {
+        const parsed = new URL(text);
+        const path = parsed.pathname === '/' ? '' : parsed.pathname;
+        return `${parsed.hostname}${path}`.slice(0, 72);
+    }
+    catch {
+        return text.slice(0, 72);
+    }
+}
+export function projectRedirectPath(rawRedirects) {
+    const redirects = (Array.isArray(rawRedirects) ? rawRedirects : [])
+        .slice(0, MAX_REDIRECT_NODES - 1)
+        .map((redirect) => ({
+        status: boundedText(redirect?.status, 12) || '—',
+        from: redirectLabel(redirect?.from),
+        to: redirectLabel(redirect?.to),
+        queryOmitted: Boolean(redirect?.queryOmitted),
+    }))
+        .filter((redirect) => redirect.from && redirect.to);
+    const rawCount = Array.isArray(rawRedirects) ? rawRedirects.length : 0;
+    if (!redirects.length) {
+        return { width: 900, height: 150, nodes: [], edges: [], truncated: rawCount > 0 };
+    }
+    const firstRedirect = redirects[0];
+    if (!firstRedirect) {
+        return { width: 900, height: 150, nodes: [], edges: [], truncated: rawCount > 0 };
+    }
+    const nodes = [
+        { id: 'redirect-start', label: firstRedirect.from, status: 'start', queryOmitted: false },
+        ...redirects.map((redirect, index) => ({
+            id: `redirect-${index + 1}`,
+            label: redirect.to,
+            status: redirect.status,
+            queryOmitted: redirect.queryOmitted,
+        })),
+    ];
+    const x = scalePoint().domain(nodes.map((node) => node.id)).range([62, 838]).padding(0.35);
+    const projected = nodes.map((node) => ({ ...node, x: x(node.id) ?? 450, y: 70 }));
+    const edges = redirects.flatMap((redirect, index) => {
+        const from = projected[index];
+        const to = projected[index + 1];
+        return from && to ? [{
+                id: `redirect-edge-${index}`,
+                fromX: from.x,
+                toX: to.x,
+                y: 70,
+                status: redirect.status,
+            }] : [];
+    });
+    return {
+        width: 900,
+        height: 150,
+        nodes: projected,
+        edges,
+        truncated: rawCount > redirects.length,
+    };
+}
+function deterministicSample(items, limit) {
+    const boundedLimit = Number.isFinite(limit) ? Math.max(0, Math.floor(limit)) : 0;
+    if (boundedLimit === 0)
+        return [];
+    if (items.length <= boundedLimit)
+        return items;
+    if (boundedLimit === 1)
+        return items.slice(0, 1);
+    return Array.from({ length: boundedLimit }, (_, index) => {
+        const sourceIndex = Math.round(index * (items.length - 1) / (boundedLimit - 1));
+        return items[sourceIndex];
+    }).filter((item) => item !== undefined);
+}
+export function projectTriagePoints(rawPoints) {
+    const eligible = (Array.isArray(rawPoints) ? rawPoints : [])
+        .map((point) => ({
+        domain: boundedText(point?.domain, 253).toLowerCase(),
+        risk: boundedScore(point?.risk),
+        opportunity: boundedScore(point?.opportunity),
+        availability: boundedText(point?.availability, 30).toLowerCase() || 'unknown',
+        trusted: Boolean(point?.trusted),
+    }))
+        .filter((point) => point.domain && point.risk !== null && point.opportunity !== null)
+        .sort((a, b) => a.domain.localeCompare(b.domain));
+    const sampled = deterministicSample(eligible, MAX_TRIAGE_PLOT_POINTS);
+    const quadrants = eligible.reduce((counts, point) => {
+        if (point.risk >= 50) {
+            if (point.opportunity >= 50)
+                counts.priorityReview += 1;
+            else
+                counts.riskLedReview += 1;
+        }
+        else if (point.opportunity >= 50) {
+            counts.availableReview += 1;
+        }
+        else {
+            counts.lowerScores += 1;
+        }
+        return counts;
+    }, {
+        availableReview: 0,
+        priorityReview: 0,
+        lowerScores: 0,
+        riskLedReview: 0,
+    });
+    const x = scaleLinear().domain([0, 100]).range([58, 842]).clamp(true);
+    const y = scaleLinear().domain([0, 100]).range([308, 28]).clamp(true);
+    const points = sampled.map((point) => ({
+        ...point,
+        risk: point.risk,
+        opportunity: point.opportunity,
+        x: x(point.risk),
+        y: y(point.opportunity),
+        tone: point.trusted
+            ? 'trusted'
+            : point.availability === 'available'
+                ? 'available'
+                : point.availability === 'error'
+                    ? 'error'
+                    : 'registered',
+    }));
+    return {
+        width: 900,
+        height: 360,
+        points,
+        eligibleCount: eligible.length,
+        omittedCount: Math.max(0, (Array.isArray(rawPoints) ? rawPoints.length : 0) - eligible.length),
+        sampled: eligible.length > sampled.length,
+        quadrants,
+    };
+}
+function utcDayKey(milliseconds) {
+    return new Date(milliseconds).toISOString().slice(0, 10);
+}
+export function projectWatchlistActivity(rawEvents) {
+    const valid = (Array.isArray(rawEvents) ? rawEvents : [])
+        .map((event) => {
+        const date = validDate(event?.checkedAt);
+        if (!date)
+            return null;
+        const changeCount = Math.max(0, Math.min(10_000, Math.trunc(Number(event.changeCount) || 0)));
+        const resultCount = Math.max(0, Math.min(10_000, Math.trunc(Number(event.resultCount) || 0)));
+        const conclusiveCount = Math.max(0, Math.min(resultCount, Math.trunc(Number(event.conclusiveCount) || 0)));
+        return { ...date, changeCount, resultCount, conclusiveCount };
+    })
+        .filter((event) => Boolean(event));
+    if (!valid.length) {
+        return { width: 620, height: 190, days: [], maxChanges: 0, totalChecks: 0, totalChanges: 0 };
+    }
+    const latest = Math.max(...valid.map((event) => event.milliseconds));
+    const latestDay = Date.UTC(new Date(latest).getUTCFullYear(), new Date(latest).getUTCMonth(), new Date(latest).getUTCDate());
+    const start = latestDay - (WATCHLIST_ACTIVITY_DAYS - 1) * 86_400_000;
+    const windowEnd = latestDay + 86_400_000;
+    const windowEvents = valid.filter((event) => event.milliseconds >= start && event.milliseconds < windowEnd);
+    const byDay = new Map();
+    for (const event of windowEvents) {
+        const key = utcDayKey(event.milliseconds);
+        const current = byDay.get(key) ?? { checks: 0, changes: 0, results: 0, conclusive: 0 };
+        current.checks += 1;
+        current.changes += event.changeCount;
+        current.results += event.resultCount;
+        current.conclusive += event.conclusiveCount;
+        byDay.set(key, current);
+    }
+    const weekScale = scaleBand().domain([0, 1, 2, 3]).range([72, 580]).padding(0.12);
+    const dayScale = scaleBand().domain([0, 1, 2, 3, 4, 5, 6]).range([26, 165]).padding(0.12);
+    const dayWidth = weekScale.bandwidth();
+    const dayHeight = dayScale.bandwidth();
+    const days = Array.from({ length: WATCHLIST_ACTIVITY_DAYS }, (_, index) => {
+        const milliseconds = start + index * 86_400_000;
+        const key = utcDayKey(milliseconds);
+        const activity = byDay.get(key) ?? { checks: 0, changes: 0, results: 0, conclusive: 0 };
+        return {
+            date: key,
+            label: new Date(milliseconds).toLocaleDateString('en-AU', { day: 'numeric', month: 'short', timeZone: 'UTC' }),
+            week: Math.floor(index / 7),
+            weekday: index % 7,
+            x: weekScale(Math.floor(index / 7)) ?? 0,
+            y: dayScale(index % 7) ?? 0,
+            width: dayWidth,
+            height: dayHeight,
+            ...activity,
+        };
+    });
+    return {
+        width: 620,
+        height: 190,
+        days,
+        maxChanges: Math.max(0, ...days.map((day) => day.changes)),
+        totalChecks: windowEvents.length,
+        totalChanges: windowEvents.reduce((sum, event) => sum + event.changeCount, 0),
+    };
+}
+export function projectScoreFactors(rawFactors) {
+    const candidates = (Array.isArray(rawFactors) ? rawFactors : [])
+        .map((factor, index) => ({
+        id: `${boundedId(factor?.label) || 'factor'}-${index}`,
+        label: boundedText(factor?.label, 56) || `Factor ${index + 1}`,
+        delta: boundedNumber(factor?.delta, -100, 100),
+    }))
+        .filter((factor) => factor.delta !== 0);
+    const factors = candidates.slice(0, MAX_SCORE_FACTORS);
+    const maximum = Math.max(1, ...factors.map((factor) => Math.abs(factor.delta)));
+    const x = scaleLinear().domain([-maximum, maximum]).range([220, 860]).clamp(true);
+    const zeroX = x(0);
+    const rowHeight = 28;
+    return {
+        width: 900,
+        height: Math.max(74, 42 + factors.length * rowHeight),
+        zeroX,
+        maximum,
+        factors: factors.map((factor, index) => {
+            const valueX = x(factor.delta);
+            return {
+                ...factor,
+                x: Math.min(zeroX, valueX),
+                width: Math.max(2, Math.abs(valueX - zeroX)),
+                y: 24 + index * rowHeight,
+            };
+        }),
+        truncated: candidates.length > factors.length,
+    };
+}
+export function projectCoverageBars(rawGroups) {
+    const candidates = (Array.isArray(rawGroups) ? rawGroups : [])
+        .map((group, index) => {
+        const values = {
+            protected: Math.trunc(boundedNumber(group?.protected, 0, 100_000)),
+            registered: Math.trunc(boundedNumber(group?.registered, 0, 100_000)),
+            available: Math.trunc(boundedNumber(group?.available, 0, 100_000)),
+            unknown: Math.trunc(boundedNumber(group?.unknown, 0, 100_000)),
+        };
+        return {
+            id: boundedId(group?.id) || `group-${index}`,
+            label: boundedText(group?.label, 56) || `Group ${index + 1}`,
+            ...values,
+            total: Object.values(values).reduce((sum, value) => sum + value, 0),
+        };
+    })
+        .filter((group) => group.total > 0)
+        .sort((a, b) => b.total - a.total || a.label.localeCompare(b.label));
+    const groups = candidates.slice(0, MAX_COVERAGE_BAR_GROUPS);
+    const maximum = Math.max(1, ...groups.map((group) => group.total));
+    const x = scaleLinear().domain([0, maximum]).range([210, 860]).clamp(true);
+    const rowHeight = 31;
+    return {
+        width: 900,
+        height: Math.max(76, 40 + groups.length * rowHeight),
+        groups: groups.map((group, index) => {
+            let offset = 0;
+            const segments = ['protected', 'registered', 'available', 'unknown'].map((state) => {
+                const value = group[state];
+                const start = offset;
+                offset += value;
+                return {
+                    state,
+                    value,
+                    x: x(start),
+                    width: Math.max(value ? 1 : 0, x(offset) - x(start)),
+                };
+            });
+            return { ...group, y: 20 + index * rowHeight, segments };
+        }),
+        truncated: candidates.length > groups.length,
+    };
+}
+export function projectMonitorTimeline(rawEvents) {
+    const candidates = (Array.isArray(rawEvents) ? rawEvents : [])
+        .map((event, index) => {
+        const date = validDate(event?.checkedAt);
+        const id = boundedId(event?.id) || `event-${index}`;
+        if (!date)
+            return null;
+        return {
+            id,
+            checkedAt: date.text,
+            milliseconds: date.milliseconds,
+            mode: boundedText(event?.mode, 20).toLowerCase() || 'saved',
+            groups: (Array.isArray(event.groups) ? event.groups : [])
+                .map((group) => ({
+                key: boundedId(group?.key),
+                label: boundedText(group?.label, 40),
+                changeCount: Math.trunc(boundedNumber(group?.changeCount, 0, 10_000)),
+            }))
+                .filter((group) => group.key && group.label),
+        };
+    })
+        .filter((event) => Boolean(event))
+        .sort((a, b) => a.milliseconds - b.milliseconds || a.id.localeCompare(b.id));
+    const events = candidates.slice(-MAX_MONITOR_TIMELINE_EVENTS);
+    const laneMap = new Map();
+    for (const event of events) {
+        for (const group of event.groups) {
+            if (!laneMap.has(group.key) && laneMap.size < MAX_MONITOR_TIMELINE_LANES) {
+                laneMap.set(group.key, group.label);
+            }
+        }
+    }
+    const lanes = [...laneMap].map(([key, label]) => ({ key, label }));
+    const x = scaleBand().domain(events.map((event) => event.id)).range([170, 865]).padding(0.18);
+    const y = scaleBand().domain(lanes.map((lane) => lane.key)).range([42, 42 + lanes.length * 40]).padding(0.18);
+    const maxChanges = Math.max(1, ...events.flatMap((event) => event.groups.map((group) => group.changeCount)));
+    return {
+        width: 900,
+        height: Math.max(110, 64 + lanes.length * 40),
+        maxChanges,
+        events: events.map((event) => ({
+            ...event,
+            x: x(event.id) ?? 170,
+            width: x.bandwidth(),
+            cells: lanes.map((lane) => ({
+                key: lane.key,
+                label: lane.label,
+                count: event.groups.find((group) => group.key === lane.key)?.changeCount ?? 0,
+                y: y(lane.key) ?? 42,
+                height: y.bandwidth(),
+            })),
+        })),
+        lanes: lanes.map((lane) => ({ ...lane, y: y(lane.key) ?? 42, height: y.bandwidth() })),
+        truncated: candidates.length > events.length
+            || events.some((event) => event.groups.some((group) => !laneMap.has(group.key))),
+    };
+}
+export function projectCertificateValidity(input) {
+    const validFrom = validDate(input.validFrom);
+    const validTo = validDate(input.validTo);
+    const observed = validDate(input.observedAt);
+    if (!validFrom || !validTo || validTo.milliseconds <= validFrom.milliseconds) {
+        return { available: false, width: 900, height: 110 };
+    }
+    const observedMilliseconds = observed?.milliseconds ?? validFrom.milliseconds;
+    const span = validTo.milliseconds - validFrom.milliseconds;
+    const padding = Math.max(86_400_000, span * 0.08);
+    const x = scaleLinear()
+        .domain([validFrom.milliseconds - padding, validTo.milliseconds + padding])
+        .range([72, 828])
+        .clamp(true);
+    return {
+        available: true,
+        width: 900,
+        height: 110,
+        validFrom: validFrom.text,
+        validTo: validTo.text,
+        observedAt: observed?.text ?? '',
+        hasObservation: Boolean(observed),
+        fromX: x(validFrom.milliseconds),
+        toX: x(validTo.milliseconds),
+        observedX: x(observedMilliseconds),
+        observedWithinValidity: observedMilliseconds >= validFrom.milliseconds
+            && observedMilliseconds <= validTo.milliseconds,
+        elapsedPercent: Math.max(0, Math.min(100, ((observedMilliseconds - validFrom.milliseconds) / span) * 100)),
+    };
+}

package/frontend/src/lib/analysis/visualization-time-series.js

@@ -0,0 +1,144 @@
+import { scaleLinear, scalePoint } from 'd3-scale';
+import { boundedVisualizationId as boundedId, boundedVisualizationNumber as boundedNumber, boundedVisualizationText as boundedText, validVisualizationDate as validDate, } from "./visualization-bounds.js";
+export const MAX_LIFECYCLE_EVENTS = 8;
+export const MAX_COLLECTION_TIMING_SOURCES = 16;
+export const MAX_TREND_POINTS = 24;
+export function projectLifecycleEvents(rawEvents) {
+    const seen = new Set();
+    const candidates = (Array.isArray(rawEvents) ? rawEvents : [])
+        .map((event) => {
+        const id = boundedId(event?.id);
+        const label = boundedText(event?.label, 40);
+        const date = validDate(event?.date);
+        if (!id || !label || !date)
+            return null;
+        const kind = event.kind === 'certificate' || event.kind === 'observation'
+            ? event.kind
+            : 'registry';
+        return {
+            id,
+            label,
+            date: date.text,
+            milliseconds: date.milliseconds,
+            detail: boundedText(event.detail, 100),
+            kind,
+        };
+    })
+        .filter((event) => Boolean(event))
+        .sort((a, b) => a.milliseconds - b.milliseconds || a.id.localeCompare(b.id))
+        .filter((event) => {
+        if (seen.has(event.id))
+            return false;
+        seen.add(event.id);
+        return true;
+    });
+    const accepted = candidates.slice(0, MAX_LIFECYCLE_EVENTS);
+    const x = scalePoint()
+        .domain(accepted.map((event) => event.id))
+        .range([70, 830])
+        .padding(accepted.length > 1 ? 0.35 : 0.5);
+    const laneY = [48, 158, 27];
+    const events = accepted.map((event, index) => ({
+        ...event,
+        x: x(event.id) ?? 450,
+        labelY: laneY[index % laneY.length] ?? 102,
+        anchor: index === 0 ? 'start' : index === accepted.length - 1 ? 'end' : 'middle',
+    }));
+    return {
+        width: 900,
+        height: 205,
+        axisY: 102,
+        events,
+        truncated: candidates.length > accepted.length,
+    };
+}
+export function projectCollectionTiming(rawSources, rawTotalMs) {
+    const candidates = (Array.isArray(rawSources) ? rawSources : [])
+        .map((source, index) => {
+        const id = boundedId(source?.source) || `source-${index}`;
+        const durationMs = boundedNumber(source?.durationMs, 0, 300_000);
+        const completedAfterMs = boundedNumber(source?.completedAfterMs, 0, 300_000);
+        return {
+            id,
+            label: boundedText(source?.source, 48) || `Source ${index + 1}`,
+            outcome: boundedText(source?.outcome, 24).toLowerCase() || 'unknown',
+            durationMs,
+            completedAfterMs,
+            startedAfterMs: Math.max(0, completedAfterMs - durationMs),
+        };
+    })
+        .sort((a, b) => a.completedAfterMs - b.completedAfterMs || a.id.localeCompare(b.id));
+    const sources = candidates.slice(0, MAX_COLLECTION_TIMING_SOURCES);
+    const longestSource = [...sources]
+        .sort((a, b) => b.durationMs - a.durationMs
+        || b.completedAfterMs - a.completedAfterMs
+        || a.id.localeCompare(b.id))[0] ?? null;
+    const lastSettledSource = sources.at(-1) ?? null;
+    const requestErrorCount = sources.filter((source) => source.outcome === 'rejected').length;
+    const totalMs = Math.max(1, boundedNumber(rawTotalMs, 0, 300_000), ...sources.map((source) => source.completedAfterMs));
+    const x = scaleLinear().domain([0, totalMs]).range([190, 860]).clamp(true);
+    const rowHeight = 30;
+    return {
+        width: 900,
+        height: Math.max(92, 50 + sources.length * rowHeight),
+        totalMs,
+        longestSource,
+        lastSettledSource,
+        requestErrorCount,
+        ticks: x.ticks(5).map((value) => ({ value, x: x(value) })),
+        sources: sources.map((source, index) => ({
+            ...source,
+            x: x(source.startedAfterMs),
+            width: Math.max(3, x(source.completedAfterMs) - x(source.startedAfterMs)),
+            y: 30 + index * rowHeight,
+        })),
+        truncated: candidates.length > sources.length,
+    };
+}
+export function projectTrendPoints(rawPoints) {
+    const seen = new Set();
+    const candidates = (Array.isArray(rawPoints) ? rawPoints : [])
+        .map((point, index) => {
+        const date = validDate(point?.date);
+        const id = boundedId(point?.id) || `point-${index}`;
+        if (!date || seen.has(id))
+            return null;
+        seen.add(id);
+        return {
+            id,
+            date: date.text,
+            milliseconds: date.milliseconds,
+            total: Math.trunc(boundedNumber(point?.total, 0, 100_000)),
+            added: Math.trunc(boundedNumber(point?.added, 0, 100_000)),
+            partial: Boolean(point?.partial),
+        };
+    })
+        .filter((point) => Boolean(point))
+        .sort((a, b) => a.milliseconds - b.milliseconds || a.id.localeCompare(b.id));
+    const points = candidates.slice(-MAX_TREND_POINTS);
+    const x = scalePoint().domain(points.map((point) => point.id)).range([64, 850]).padding(0.45);
+    const maximum = Math.max(1, ...points.map((point) => point.total));
+    const y = scaleLinear().domain([0, maximum]).range([190, 24]).nice().clamp(true);
+    const first = points[0] ?? null;
+    const latest = points.at(-1) ?? null;
+    return {
+        width: 900,
+        height: 225,
+        maximum,
+        ticks: y.ticks(4).map((value) => ({ value, y: y(value) })),
+        points: points.map((point) => ({
+            ...point,
+            x: x(point.id) ?? 450,
+            y: y(point.total),
+            addedY: y(point.added),
+        })),
+        summary: {
+            firstTotal: first?.total ?? 0,
+            latestTotal: latest?.total ?? 0,
+            peakTotal: points.reduce((peak, point) => Math.max(peak, point.total), 0),
+            newlyObserved: points.reduce((total, point) => total + point.added, 0),
+            partialChecks: points.filter((point) => point.partial).length,
+        },
+        truncated: candidates.length > points.length,
+    };
+}

package/frontend/src/lib/analysis/website-snapshot-model.js

@@ -1,6 +1,6 @@
 import { normalizeDomain } from "./case-model.js";
 export const WEBSITE_SNAPSHOT_SCHEMA = 'whoisleuth.website-profile-snapshots';
-export const WEBSITE_SNAPSHOT_SCHEMA_VERSION = 3;
+export const WEBSITE_SNAPSHOT_SCHEMA_VERSION = 4;
 export const MAX_WEBSITE_SNAPSHOTS = 60;
 export const MAX_WEBSITE_SNAPSHOTS_PER_DOMAIN = 12;
 export const MAX_WEBSITE_SNAPSHOT_STORE_BYTES = 512 * 1024;
@@ -65,6 +65,23 @@ function source(value) {
     const state = text(item?.state, 40);
     return sourceName && state ? { source: sourceName, state } : null;
 }
+function dependency(value) {
+    const item = record(value);
+    const recordType = text(item?.recordType, 10);
+    const target = normalizeDomain(item?.target);
+    const state = text(item?.state, 40);
+    if (!target
+        || !['CNAME', 'HTTPS', 'NS', 'MX', 'HTTP'].includes(recordType)
+        || !['candidate', 'unresolved', 'active', 'unsupported', 'false_positive'].includes(state))
+        return null;
+    return {
+        recordType: recordType,
+        target,
+        state: state,
+        qualification: text(item?.qualification, 80) || 'inconclusive',
+        serviceFamily: nullableText(item?.serviceFamily, 120),
+    };
+}
 function nullableBoolean(value) {
     return typeof value === 'boolean' ? value : null;
 }
@@ -161,6 +178,7 @@ export function normalizeWebsiteProfileSnapshot(raw) {
         identity: identity(value?.identity),
         identityValues: identityValues(value?.identityValues),
         sources: values(value?.sources, 16, source),
+        dependencies: values(value?.dependencies, 20, dependency),
         certificate: certificate(value?.certificate),
     };
 }
@@ -242,13 +260,49 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
     const before = normalizeWebsiteProfileSnapshot(beforeRaw);
     const after = normalizeWebsiteProfileSnapshot(afterRaw);
     if (!before || !after || before.domain !== after.domain) {
-        return { compatible: false, changes: [{ field: 'snapshot', state: 'incomparable', before: before?.domain ?? null, after: after?.domain ?? null }] };
+        return {
+            compatible: false,
+            changes: [{ field: 'snapshot', state: 'incomparable', before: before?.domain ?? null, after: after?.domain ?? null }],
+            dependencyTransitions: [],
+        };
     }
     const changes = [
         ...compareMap('technology', new Map(before.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}`])), new Map(after.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}`]))),
         ...compareMap('posture', new Map(before.posture.map((item) => [item.id, item.state])), new Map(after.posture.map((item) => [item.id, item.state]))),
         ...compareMap('source', new Map(before.sources.map((item) => [item.source, item.state])), new Map(after.sources.map((item) => [item.source, item.state]))),
+        ...compareMap('dependency', new Map(before.dependencies.map((item) => [`${item.recordType}:${item.target}`, `${item.state}|${item.qualification}`])), new Map(after.dependencies.map((item) => [`${item.recordType}:${item.target}`, `${item.state}|${item.qualification}`]))),
     ];
+    const dependencyTransitions = [];
+    const beforeDependencies = new Map(before.dependencies.map((item) => [`${item.recordType}:${item.target}`, item]));
+    const afterDependencies = new Map(after.dependencies.map((item) => [`${item.recordType}:${item.target}`, item]));
+    for (const key of [...new Set([...beforeDependencies.keys(), ...afterDependencies.keys()])].sort()) {
+        const left = beforeDependencies.get(key);
+        const right = afterDependencies.get(key);
+        if (left?.state === 'active' && right?.qualification === 'known_deprovision_pattern') {
+            dependencyTransitions.push({
+                target: right.target,
+                recordType: right.recordType,
+                state: 'active_to_deprovision_cue',
+                detail: 'An earlier active navigation target now matches a reviewed passive deprovision-page cue. Verify the service account and DNS manually; this does not establish claimability.',
+            });
+        }
+        else if (left?.state === 'active' && right?.state === 'unresolved') {
+            dependencyTransitions.push({
+                target: right.target,
+                recordType: right.recordType,
+                state: 'active_to_unresolved',
+                detail: 'An earlier active dependency is unresolved in the later retained observation. Resolver or collection failure remains possible.',
+            });
+        }
+        else if (!left && right) {
+            dependencyTransitions.push({ target: right.target, recordType: right.recordType, state: 'added', detail: 'This dependency first appears in the later retained snapshot.' });
+        }
+        else if (left && !right && after.complete) {
+            dependencyTransitions.push({ target: left.target, recordType: left.recordType, state: 'removed', detail: 'This dependency is not represented in the later complete snapshot. It may have been intentionally removed or replaced.' });
+        }
+        if (dependencyTransitions.length >= 20)
+            break;
+    }
     for (const key of Object.keys(before.identity)) {
         const left = before.identity[key];
         const right = after.identity[key];
@@ -298,5 +352,5 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
     if (before.complete !== after.complete || before.truncated !== after.truncated) {
         changes.push({ field: 'completeness', state: 'incomparable', before: `${before.complete}/${before.truncated}`, after: `${after.complete}/${after.truncated}` });
     }
-    return { compatible: true, changes };
+    return { compatible: true, changes, dependencyTransitions };
 }

package/frontend/src/lib/analysis/workspace-archive-crypto.js

@@ -137,7 +137,7 @@ function validateEnvelope(raw) {
         throw new Error('The encrypted workspace archive declares an unsupported cipher contract.');
     }
     const salt = decodeBase64url(kdf.salt, SALT_BYTES, 'salt');
-    const iv = decodeBase64url(cipher.iv, IV_BYTES, 'initialization vector');
+    const iv = decodeBase64url(cipher.iv, IV_BYTES, 'initialisation vector');
     if (typeof value.ciphertext !== 'string' || value.ciphertext.length > MAX_CIPHERTEXT_BASE64URL_CHARACTERS) {
         throw new Error('The encrypted workspace archive ciphertext exceeds its byte limit.');
     }

package/frontend/src/lib/analysis/workspace-archive.js

@@ -48,7 +48,7 @@ function record(value) {
 function byteLength(value) {
     return new TextEncoder().encode(value).byteLength;
 }
-function serialize(value, message = 'The workspace archive contains data that cannot be serialized.') {
+function serialize(value, message = 'The workspace archive contains data that cannot be serialised.') {
     try {
         const serialized = JSON.stringify(value);
         if (typeof serialized !== 'string')
@@ -370,7 +370,7 @@ export async function readWorkspaceArchive(raw, options = {}) {
         let reason = '';
         if (!definition) {
             status = 'unsupported';
-            reason = 'This app does not recognize the archive section.';
+            reason = 'This app does not recognise the archive section.';
         }
         else if (entry.version !== definition.version || entry.schema !== definition.schema) {
             status = 'unsupported';