@slicedearth/whoisleuth-cli 1.34.0 → 1.39.1

package/frontend/src/lib/analysis/acquisition-decision-packet.js

@@ -72,7 +72,7 @@ export async function buildAcquisitionDecisionPacket(input) {
         },
         evidenceReview: input.review,
         limitations: [
-            'This local artifact records an analyst review of bounded point-in-time evidence and does not submit, reserve, value, purchase, or transfer a domain.',
+            'This local artefact records an analyst review of bounded point-in-time evidence and does not submit, reserve, value, purchase, or transfer a domain.',
             'A reviewed state records completion of the displayed manual checklist, not the accuracy of external statements or a legal, financial, eligibility, or ownership determination.',
             'Refresh authoritative registration and policy evidence immediately before acting.',
             ...(input.synthetic === true

package/frontend/src/lib/analysis/acquisition-due-diligence.js

@@ -102,7 +102,7 @@ function lifecycleItem(availability, lifecycle, publications) {
             label: 'Lifecycle date observed',
             state: expiresInDays !== null && expiresInDays <= 30 ? 'review' : 'observed',
             detail: timing,
-            provenance: 'Normalized RDAP or WHOIS lifecycle',
+            provenance: 'Normalised RDAP or WHOIS lifecycle',
         };
     }
     return {
@@ -110,7 +110,7 @@ function lifecycleItem(availability, lifecycle, publications) {
         label: completePublication ? 'Expiry date not published' : 'Lifecycle timing unavailable',
         state: completePublication ? 'observed' : 'unavailable',
         detail: completePublication
-            ? 'A usable publication was collected without a normalized expiry date. Registry policy and renewal state still require manual confirmation.'
+            ? 'A usable publication was collected without a normalised expiry date. Registry policy and renewal state still require manual confirmation.'
             : 'Incomplete or unavailable registry publications cannot establish an expiry or release window.',
         provenance: 'Registry publication quality',
     };
@@ -135,7 +135,7 @@ function transferItem(lifecycle, publications) {
             id: 'transfer',
             label: 'No interpreted lock status observed',
             state: 'review',
-            detail: 'The collected statuses did not contain a recognized client or server lock. This does not prove transfer eligibility or that other policy restrictions are absent.',
+            detail: 'The collected statuses did not contain a recognised client or server lock. This does not prove transfer eligibility or that other policy restrictions are absent.',
             provenance: 'EPP status interpretation',
         };
     }
@@ -307,7 +307,7 @@ function registryPolicyChecks(availability, lifecycle, publications) {
             detail: statuses.length
                 ? `The collected publication included ${statuses.slice(0, 6).join(', ')}${statuses.length > 6 ? ', …' : ''}. Confirm current registry timing and restoration or deletion rules; WHOISleuth does not predict release.`
                 : publicationAvailable
-                    ? 'No recognized lifecycle status was retained. Confirm renewal, grace, redemption, restoration, and deletion rules with the current registry or registrar.'
+                    ? 'No recognised lifecycle status was retained. Confirm renewal, grace, redemption, restoration, and deletion rules with the current registry or registrar.'
                     : 'No usable registry publication was available for a current lifecycle-policy review.',
             provenance: 'Separately attributed RDAP and WHOIS lifecycle publications',
         },
@@ -316,9 +316,9 @@ function registryPolicyChecks(availability, lifecycle, publications) {
             label: locks.client === true || locks.server === true ? 'Confirm observed transfer constraints' : 'Confirm transfer and change-of-control requirements',
             state: publicationAvailable ? 'review' : 'unavailable',
             detail: locks.client === true || locks.server === true
-                ? 'Recognized client or server lock evidence was observed. Confirm authorization codes, lock removal, waiting periods, identity checks, and any registrar change-of-control process.'
+                ? 'Recognised client or server lock evidence was observed. Confirm authorisation codes, lock removal, waiting periods, identity checks, and any registrar change-of-control process.'
                 : publicationAvailable
-                    ? 'No recognized lock was retained, but that does not establish transfer eligibility. Confirm authorization, waiting periods, identity checks, and registrar requirements.'
+                    ? 'No recognised lock was retained, but that does not establish transfer eligibility. Confirm authorisation, waiting periods, identity checks, and registrar requirements.'
                     : 'No usable status publication was available to describe current transfer constraints.',
             provenance: 'EPP status interpretation and manual policy requirements',
         },

package/frontend/src/lib/analysis/bulk-domain-comparison.js

@@ -168,32 +168,32 @@ export function buildBulkDomainComparison(leftRaw, rightRaw, observedAtRaw = nul
         .some((value) => ['conflict', 'conflicting'].includes(value.toLowerCase()));
     const rows = [
         row('registration', 'registration', 'Registration', left.availability, right.availability, 'Authority-aware compact availability state', registry, [], { conflicting: registrationConflicting }),
-        row('registrar', 'registration', 'Registrar', left.registrar, right.registrar, 'Normalized registrar display identity', registry),
+        row('registrar', 'registration', 'Registrar', left.registrar, right.registrar, 'Normalised registrar display identity', registry),
         row('created', 'lifecycle', 'Created', left.createdDate, right.createdDate, 'Source-reported lifecycle date', registry),
         row('expires', 'lifecycle', 'Expires', left.expiryDate, right.expiryDate, 'Source-reported lifecycle date', registry),
-        row('nameservers', 'infrastructure', 'Nameservers', left.nameservers, right.nameservers, 'Normalized exact set comparison', registry),
-        row('dns-a', 'dns', 'A records', dnsValues(left, 'a'), dnsValues(right, 'a'), 'Normalized exact retained DNS answer set', dns),
-        row('dns-aaaa', 'dns', 'AAAA records', dnsValues(left, 'aaaa'), dnsValues(right, 'aaaa'), 'Normalized exact retained DNS answer set', dns),
-        row('dns-cname', 'dns', 'CNAME records', dnsValues(left, 'cname'), dnsValues(right, 'cname'), 'Normalized exact retained DNS answer set', dns),
-        row('dns-caa', 'dns', 'CAA records', dnsValues(left, 'caa'), dnsValues(right, 'caa'), 'Normalized exact retained DNS answer set', dns),
+        row('nameservers', 'infrastructure', 'Nameservers', left.nameservers, right.nameservers, 'Normalised exact set comparison', registry),
+        row('dns-a', 'dns', 'A records', dnsValues(left, 'a'), dnsValues(right, 'a'), 'Normalised exact retained DNS answer set', dns),
+        row('dns-aaaa', 'dns', 'AAAA records', dnsValues(left, 'aaaa'), dnsValues(right, 'aaaa'), 'Normalised exact retained DNS answer set', dns),
+        row('dns-cname', 'dns', 'CNAME records', dnsValues(left, 'cname'), dnsValues(right, 'cname'), 'Normalised exact retained DNS answer set', dns),
+        row('dns-caa', 'dns', 'CAA records', dnsValues(left, 'caa'), dnsValues(right, 'caa'), 'Normalised exact retained DNS answer set', dns),
         row('dnssec', 'dns', 'DNSSEC state', left.dnssec, right.dnssec, 'Separately attributed compact DNSSEC observation', dns),
-        row('ip-addresses', 'infrastructure', 'Observed IP addresses', left.relationship.ipAddresses, right.relationship.ipAddresses, 'Normalized exact set comparison', dns, ['Shared hosting and CDNs are common and do not prove common control.']),
+        row('ip-addresses', 'infrastructure', 'Observed IP addresses', left.relationship.ipAddresses, right.relationship.ipAddresses, 'Normalised exact set comparison', dns, ['Shared hosting and CDNs are common and do not prove common control.']),
         row('tls-source', 'certificate', 'TLS collection', tls.leftSourceState, tls.rightSourceState, 'Retained compact source-state comparison', tls),
         row('certificate', 'certificate', 'Leaf certificate fingerprint', left.relationship.certificateFingerprint, right.relationship.certificateFingerprint, 'Exact SHA-256 comparison', tls, ['Multi-domain certificates and managed hosting are common.']),
-        row('tls-issuer', 'certificate', 'TLS issuer label', left.comparisonEvidence?.tls.issuerLabel ?? null, right.comparisonEvidence?.tls.issuerLabel ?? null, 'Normalized retained issuer-label comparison', compactTls, ['Issuer labels are certificate metadata and do not establish common ownership or control.']),
+        row('tls-issuer', 'certificate', 'TLS issuer label', left.comparisonEvidence?.tls.issuerLabel ?? null, right.comparisonEvidence?.tls.issuerLabel ?? null, 'Normalised retained issuer-label comparison', compactTls, ['Issuer labels are certificate metadata and do not establish common ownership or control.']),
         row('tls-spki', 'certificate', 'TLS public-key fingerprint', left.comparisonEvidence?.tls.spkiSha256 ?? null, right.comparisonEvidence?.tls.spkiSha256 ?? null, 'Exact SPKI SHA-256 comparison', compactTls, ['Public-key reuse can be an investigative lead but does not establish ownership, intent, safety, or maliciousness.']),
         row('mail', 'mail', 'MX observed', left.hasMx, right.hasMx, 'Compact Deep DNS observation', dns),
         row('null-mx', 'mail', 'Null MX observed', left.hasNullMx, right.hasNullMx, 'Compact Deep DNS observation', dns),
         row('spf', 'mail', 'SPF observed', left.hasSpf, right.hasSpf, 'Compact Deep DNS observation', dns),
         row('dmarc', 'mail', 'DMARC observed', left.hasDmarc, right.hasDmarc, 'Compact Deep DNS observation', dns),
         row('website', 'web', 'Website activity', left.activityStatus, right.activityStatus, 'Bounded homepage observation', http),
-        row('page-title', 'identity', 'Page title', left.pageTitle, right.pageTitle, 'Normalized bounded title equality', http),
+        row('page-title', 'identity', 'Page title', left.pageTitle, right.pageTitle, 'Normalised bounded title equality', http),
         row('favicon', 'identity', 'Favicon fingerprint', left.faviconHash, right.faviconHash, 'Exact SHA-256 comparison', http),
-        row('tracking', 'identity', 'Tracking identifiers', left.relationship.trackingIdentifiers, right.relationship.trackingIdentifiers, 'Normalized exact set comparison', http, ['Shared identifiers are an investigative lead, not proof of ownership.']),
+        row('tracking', 'identity', 'Tracking identifiers', left.relationship.trackingIdentifiers, right.relationship.trackingIdentifiers, 'Normalised exact set comparison', http, ['Shared identifiers are an investigative lead, not proof of ownership.']),
         row('password-field', 'identity', 'Password field', left.hasPasswordField, right.hasPasswordField, 'Bounded static form observation', http),
         row('phishing-language', 'identity', 'Phishing-language indicator', left.phishingLanguageMatch, right.phishingLanguageMatch, 'Bounded explainable page-language signal', http, ['A wording match is a review lead, not proof of malicious intent.']),
         row('official-assets', 'identity', 'Official asset reuse', left.reusesOfficialAssets, right.reusesOfficialAssets, 'Configured Brand Profile comparison', http),
-        row('technology', 'technology', 'Technology identifiers', left.comparisonEvidence?.technology.ids ?? [], right.comparisonEvidence?.technology.ids ?? [], 'Normalized exact set comparison of at most 12 curated identifiers', compactTechnology, ['An unmatched identifier is not evidence that a technology is absent. Shared technologies do not establish common ownership or control.']),
+        row('technology', 'technology', 'Technology identifiers', left.comparisonEvidence?.technology.ids ?? [], right.comparisonEvidence?.technology.ids ?? [], 'Normalised exact set comparison of at most 12 curated identifiers', compactTechnology, ['An unmatched identifier is not evidence that a technology is absent. Shared technologies do not establish common ownership or control.']),
         row('source-health', 'source', 'Recorded source coverage', sourceSummary(left), sourceSummary(right), 'Source-by-source compact state comparison', source, ['A source-state difference can reflect collection conditions rather than a domain change.']),
     ];
     const counts = {
@@ -216,7 +216,7 @@ export function buildBulkDomainComparison(leftRaw, rightRaw, observedAtRaw = nul
         counts,
         limitations: options.allowSameDomain
             ? [
-                'This compares normalized evidence already present in two saved observations for the same domain and makes no new request.',
+                'This compares normalised evidence already present in two saved observations for the same domain and makes no new request.',
                 'Missing, unavailable, and differently collected evidence remain distinct from an observed difference.',
                 'An observed difference can reflect changed collection conditions and does not by itself establish current state, ownership, intent, safety, or maliciousness.',
             ]

package/frontend/src/lib/analysis/bulk-mail-exposure.js

@@ -169,7 +169,7 @@ export function buildBulkMailExposureReport(rowsRaw, options = {}) {
         limitations: [
             'This review uses compact Bulk evidence already collected and makes no additional request.',
             'Null MX, no explicit MX, receiving mail, authentication gaps, and incomplete evidence remain separate states.',
-            'SMTP delivery, mailbox existence, catch-all behavior, and message acceptance were not tested.',
+            'SMTP delivery, mailbox existence, catch-all behaviour, and message acceptance were not tested.',
         ],
     };
 }

package/frontend/src/lib/analysis/bulk-retry-plan.js

@@ -1,13 +1,7 @@
 import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
+import { limitedBulkSources } from "./bulk-source-coverage.js";
 export const MAX_BULK_RETRY_ROWS = 200;
 export const BULK_REVIEW_STALE_AFTER_DAYS = 7;
-const LIMITED_STATES = new Set([
-    'error',
-    'partial',
-    'skipped',
-    'unavailable',
-    'unsupported',
-]);
 function freshness(value, now = Date.now()) {
     if (typeof value !== 'string' || !Number.isFinite(Date.parse(value))) {
         return { observedAt: null, ageDays: null, state: 'unknown' };
@@ -21,9 +15,7 @@ function freshness(value, now = Date.now()) {
     };
 }
 function retryRow(value, isStale) {
-    const limitedSources = value.sourceCoverage
-        .filter((item) => LIMITED_STATES.has(item.state))
-        .map((item) => item.source)
+    const limitedSources = limitedBulkSources(value.domain, value.sourceCoverage)
         .sort()
         .slice(0, 12);
     const reasons = [];
@@ -56,6 +48,7 @@ export function buildBulkRetryPlan(values, mode, observedAtRaw = null, now = Dat
             'This repeats the selected lookup profile; the current API does not request only one upstream source.',
             `Evidence is marked stale after ${BULK_REVIEW_STALE_AFTER_DAYS} days for review purposes; this is a local observation age, not an upstream record age.`,
             'Optional third-party intelligence providers are not contacted by Bulk.',
+            'Sources deliberately skipped by the selected scan profile or deployment policy do not independently trigger a retry.',
             'A retry can remain partial or fail and does not convert unavailable evidence into absence.',
         ],
     };

package/frontend/src/lib/analysis/bulk-session-model.js

@@ -4,8 +4,8 @@
 import { normalizeDomain } from "./case-model.js";
 import { normalizeCaaCritical } from "./dns-record-normalization.js";
 export const BULK_SESSION_SCHEMA = 'whoisleuth.bulk-sessions';
-export const BULK_SESSION_SCHEMA_VERSION = 2;
-export const SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS = Object.freeze([1, BULK_SESSION_SCHEMA_VERSION]);
+export const BULK_SESSION_SCHEMA_VERSION = 3;
+export const SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS = Object.freeze([1, 2, BULK_SESSION_SCHEMA_VERSION]);
 export const MAX_BULK_SESSIONS = 10;
 export const MAX_BULK_SESSION_ROWS = 2_000;
 export const MAX_BULK_SESSION_STORE_BYTES = 4 * 1024 * 1024;
@@ -231,6 +231,7 @@ export function normalizeBulkSessionResult(value) {
         scanDepth: scanDepth,
         createdDate: boundedText(item.createdDate, 64) || null,
         expiryDate: boundedText(item.expiryDate, 64) || null,
+        privacyProtected: nullableBoolean(item.privacyProtected),
         nameservers: boundedStrings(item.nameservers, 20),
         hasMx: nullableBoolean(item.hasMx),
         hasNullMx: nullableBoolean(item.hasNullMx),
@@ -246,7 +247,11 @@ export function normalizeBulkSessionResult(value) {
         hasPasswordField: item.hasPasswordField === true,
         hasExternalFormAction: nullableBoolean(item.hasExternalFormAction),
         phishingLanguageMatch: boundedText(item.phishingLanguageMatch, 300) || null,
+        idnReferenceMatch: nullableBoolean(item.idnReferenceMatch),
+        pageBaselineMatch: nullableBoolean(item.pageBaselineMatch),
+        hasActiveBrandProfile: nullableBoolean(item.hasActiveBrandProfile),
         riskModelVersion: nullableVersion(item.riskModelVersion),
+        opportunityModelVersion: nullableVersion(item.opportunityModelVersion),
         riskFactors: normalizeRiskFactors(item.riskFactors),
         dns: normalizeDns(item.dns),
         dnssec: boundedText(item.dnssec, 40) || null,

package/frontend/src/lib/analysis/bulk-source-coverage.js

@@ -0,0 +1,76 @@
+// Authority-aware interpretation for compact Bulk source observations. Raw
+// source states remain unchanged; this layer only decides whether an observed
+// limitation was unexpected for the registry's published service paths.
+import { registryCapabilityFor } from "../../../../lib/registry-capabilities.mjs";
+const MAX_SOURCE_OBSERVATIONS = 32;
+const MAX_SOURCE_TEXT_LENGTH = 40;
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+const LIMITED_SOURCE_STATES = new Set([
+    'error',
+    'failed',
+    'inconclusive',
+    'partial',
+    'rate_limited',
+    'unavailable',
+    'unsupported',
+]);
+function text(value) {
+    return typeof value === 'string'
+        && value.length <= MAX_SOURCE_TEXT_LENGTH
+        && !CONTROL_RE.test(value)
+        ? value.trim().toLowerCase()
+        : '';
+}
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function observations(value) {
+    return Array.isArray(value)
+        ? value.slice(0, MAX_SOURCE_OBSERVATIONS).flatMap((entry) => {
+            const item = record(entry);
+            const source = text(item?.source);
+            const state = text(item?.state);
+            return source && state ? [{ source, state }] : [];
+        })
+        : [];
+}
+function expectedUnsupportedSources(domain) {
+    const capability = registryCapabilityFor(domain);
+    if (!capability)
+        return new Set();
+    const expected = new Set();
+    if (capability.rdapAccessProfile === 'no-iana-service')
+        expected.add('rdap');
+    if (capability.whoisAccessProfile === 'no-iana-service')
+        expected.add('whois');
+    return expected;
+}
+export function isExpectedUnsupportedBulkSource(domain, observation) {
+    const source = text(observation.source);
+    const state = text(observation.state);
+    return state === 'unsupported' && expectedUnsupportedSources(domain).has(source);
+}
+export function limitedBulkSources(domain, coverage) {
+    const expectedUnsupported = expectedUnsupportedSources(domain);
+    return observations(coverage)
+        .filter(({ source, state }) => (LIMITED_SOURCE_STATES.has(state)
+        && !(state === 'unsupported' && expectedUnsupported.has(source))))
+        .map(({ source }) => source);
+}
+export function classifyBulkSourceCoverage(domain, coverage) {
+    const retained = observations(coverage);
+    if (!retained.length)
+        return 'unrecorded';
+    return limitedBulkSources(domain, retained).length ? 'limited' : 'complete';
+}
+export function describeBulkSourceCoverage(domain, observation) {
+    const source = text(observation.source);
+    const state = text(observation.state);
+    if (!source || !state)
+        return 'unrecorded source';
+    return isExpectedUnsupportedBulkSource(domain, observation)
+        ? `${source}: unsupported (no IANA-published service)`
+        : `${source}: ${state}`;
+}

package/frontend/src/lib/analysis/case-evidence-model.js

@@ -1,7 +1,7 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
 import { normalizeHttpSummary } from "./http-summary.js";
-import { normalizeRiskModelVersion } from "./scoring.js";
+import { normalizeOpportunityModelVersion, normalizeRiskModelVersion } from "./scoring.js";
 import { CASE_DISPOSITIONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_CASES, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.js";
 import { CONCLUSIVE_AVAILABILITY, DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_RANK, EVIDENCE_SOURCE_SET, REGISTERED_LIKE, hashString, isoOrNull, objectRecord, safeId, } from "./case-record-core.js";
 function evidenceString(value, max = MAX_EVIDENCE_STRING_LENGTH) {
@@ -97,6 +97,7 @@ const DEEP_SIGNAL_FIELDS = [
     'httpSummaryVersion', 'httpEvidenceStatus', 'httpFinalOrigin', 'httpResponseStatus', 'httpTransportSecurity', 'httpRedirectCount',
     'httpCrossOriginRedirect', 'httpHttpsDowngrade', 'httpContentType', 'httpSecurityHeaders',
     'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets', 'hasPasswordField', 'hasExternalFormAction', 'phishingLanguageMatch',
+    'pageBaselineMatch',
 ];
 // Ordered list of the fields that make up a snapshot's *material* identity -
 // everything except capture timestamps, snapshot id and source. `scanDepth` is
@@ -104,7 +105,7 @@ const DEEP_SIGNAL_FIELDS = [
 // another. Deterministic ordering here is what makes the fingerprint stable.
 const MATERIAL_FIELD_ORDER = [
     'scanDepth',
-    'availability', 'confidence', 'riskModelVersion', 'riskScore', 'opportunityScore',
+    'availability', 'confidence', 'riskModelVersion', 'riskScore', 'opportunityModelVersion', 'opportunityScore',
     'riskFactors', 'opportunityFactors',
     'registrar', 'createdDate', 'expiryDate', 'nameservers',
     'hasMx', 'hasSpf', 'hasDmarc',
@@ -112,6 +113,7 @@ const MATERIAL_FIELD_ORDER = [
     'httpSummaryVersion', 'httpEvidenceStatus', 'httpFinalOrigin', 'httpResponseStatus', 'httpTransportSecurity', 'httpRedirectCount',
     'httpCrossOriginRedirect', 'httpHttpsDowngrade', 'httpContentType', 'httpSecurityHeaders',
     'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets', 'hasPasswordField', 'hasExternalFormAction', 'phishingLanguageMatch',
+    'privacyProtected', 'idnReferenceMatch', 'pageBaselineMatch', 'hasActiveBrandProfile',
     'mutationTypes',
 ];
 // The canonical, comparison-safe value of a material field. Registrar casing,
@@ -203,6 +205,7 @@ function buildSnapshot(raw, options) {
         confidence: evidenceString(record.confidence),
         riskModelVersion: normalizeRiskModelVersion(record.riskModelVersion),
         riskScore: clampScore(record.riskScore),
+        opportunityModelVersion: normalizeOpportunityModelVersion(record.opportunityModelVersion),
         opportunityScore: clampScore(record.opportunityScore),
         riskFactors: normalizeFactors(record.riskFactors),
         opportunityFactors: normalizeFactors(record.opportunityFactors),
@@ -232,12 +235,18 @@ function buildSnapshot(raw, options) {
         hasPasswordField: boolOrNull(record.hasPasswordField),
         hasExternalFormAction: boolOrNull(record.hasExternalFormAction),
         phishingLanguageMatch: evidenceString(record.phishingLanguageMatch),
+        privacyProtected: boolOrNull(record.privacyProtected),
+        idnReferenceMatch: boolOrNull(record.idnReferenceMatch),
+        pageBaselineMatch: boolOrNull(record.pageBaselineMatch),
+        hasActiveBrandProfile: boolOrNull(record.hasActiveBrandProfile),
         mutationTypes: normalizeMutationList(record.mutationTypes),
     };
     // A version without an actual risk assessment is orphaned metadata. Drop it
     // so it cannot make otherwise-identical evidence look materially different.
     if (fields.riskScore === null && fields.riskFactors.length === 0)
         fields.riskModelVersion = null;
+    if (fields.opportunityScore === null && fields.opportunityFactors.length === 0)
+        fields.opportunityModelVersion = null;
     // A fast capture never evaluates the deep signals, so any value supplied for
     // them (e.g. a profile's default `false`) is discarded as unevaluated.
     if (scanDepth === 'fast') {
@@ -264,6 +273,7 @@ function buildSnapshot(raw, options) {
             hasPasswordField: null,
             hasExternalFormAction: null,
             phishingLanguageMatch: null,
+            pageBaselineMatch: null,
         });
     }
     if (!hasMaterialEvidence(fields))
@@ -391,8 +401,8 @@ const COMPARE_FIELDS = [
     { field: 'confidence', label: 'Confidence', type: 'token' },
     { field: 'riskScore', label: 'Risk score', type: 'score', depthGate: 'comparable', modelGate: 'risk', direction: 'risk' },
     { field: 'riskFactors', label: 'Risk factors', type: 'factors', depthGate: 'comparable', modelGate: 'risk' },
-    { field: 'opportunityScore', label: 'Opportunity score', type: 'score' },
-    { field: 'opportunityFactors', label: 'Opportunity factors', type: 'factors' },
+    { field: 'opportunityScore', label: 'Opportunity score', type: 'score', modelGate: 'opportunity' },
+    { field: 'opportunityFactors', label: 'Opportunity factors', type: 'factors', modelGate: 'opportunity' },
     { field: 'registrar', label: 'Registrar', type: 'registrar' },
     { field: 'createdDate', label: 'Creation date', type: 'date' },
     { field: 'expiryDate', label: 'Expiry date', type: 'date' },
@@ -428,6 +438,11 @@ function riskModelComparable(previous, current) {
     const after = normalizeRiskModelVersion(current?.riskModelVersion);
     return before !== null && before === after;
 }
+function opportunityModelComparable(previous, current) {
+    const before = normalizeOpportunityModelVersion(previous?.opportunityModelVersion);
+    const after = normalizeOpportunityModelVersion(current?.opportunityModelVersion);
+    return before !== null && before === after;
+}
 function valuesMateriallyEqual(field, previous, current) {
     return JSON.stringify(materialValue(field, previous)) === JSON.stringify(materialValue(field, current));
 }
@@ -448,6 +463,10 @@ export function caseEvidenceIncomparableReasons(previous, current) {
         || previous.riskFactors.length > 0 || current.riskFactors.length > 0;
     if (hasRiskEvidence && !riskModelComparable(previous, current))
         reasons.push('risk-model');
+    const hasOpportunityEvidence = previous.opportunityScore !== null || current.opportunityScore !== null
+        || previous.opportunityFactors.length > 0 || current.opportunityFactors.length > 0;
+    if (hasOpportunityEvidence && !opportunityModelComparable(previous, current))
+        reasons.push('opportunity-model');
     if (!depthComparable(previous.scanDepth, current.scanDepth)) {
         const deepOnlyChanged = DEEP_SIGNAL_FIELDS.some((field) => !valuesMateriallyEqual(field, previous, current));
         const comparableRiskChanged = riskModelComparable(previous, current)
@@ -623,6 +642,7 @@ export function compareCaseEvidence(previous, current) {
     const bothDeep = previous.scanDepth === 'deep' && current.scanDepth === 'deep';
     const comparableDepth = depthComparable(previous.scanDepth, current.scanDepth);
     const comparableRiskModel = riskModelComparable(previous, current);
+    const comparableOpportunityModel = opportunityModelComparable(previous, current);
     const changes = [];
     for (const spec of COMPARE_FIELDS) {
         if (spec.depthGate === 'both-deep' && !bothDeep)
@@ -631,6 +651,8 @@ export function compareCaseEvidence(previous, current) {
             continue;
         if (spec.modelGate === 'risk' && !comparableRiskModel)
             continue;
+        if (spec.modelGate === 'opportunity' && !comparableOpportunityModel)
+            continue;
         const result = compareField(spec, previous[spec.field], current[spec.field]);
         if (result) {
             changes.push({ field: spec.field, label: spec.label, before: result.before, after: result.after, tone: result.tone });

package/frontend/src/lib/analysis/case-migration-model.js

@@ -1,4 +1,4 @@
-import { CASE_DISPOSITIONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, MAX_CASES, MAX_NOTES_PER_CASE, deterministicId, isoOrNull, normalizeCase, normalizeDomain, normalizeEvidenceHistory, normalizeNotes, normalizeTags, objectRecord, safeId, } from "./case-record-model.js";
+import { CASE_DISPOSITIONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, MAX_CASES, MAX_NOTES_PER_CASE, deterministicId, isoOrNull, normalizeCase, normalizeDomain, normalizeEvidenceHistory, normalizeNotes, normalizeReviewReasonCode, normalizeTags, objectRecord, safeId, } from "./case-record-model.js";
 import { mergeCaseActions, mergeCaseAssertions, mergeCaseDecisions, mergeCaseEvidencePins, mergeCaseManualTrail, mergeCaseSightings, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseSightings, } from "./case-response-model.js";
 const STATUS_VALUES = new Set(CASE_STATUSES.map((item) => item.value));
 const DISPOSITION_VALUES = new Set(CASE_DISPOSITIONS.map((item) => item.value));
@@ -97,6 +97,9 @@ function extractImportPatch(raw) {
         rawId: typeof record.id === 'string' ? record.id : null,
         status: importScalar(record.status, STATUS_VALUES),
         disposition: importScalar(record.disposition, DISPOSITION_VALUES),
+        reviewReasonCode: Object.hasOwn(record, 'reviewReasonCode')
+            ? normalizeReviewReasonCode(record.reviewReasonCode)
+            : undefined,
         source: importScalar(record.source, SOURCE_VALUES),
         evidenceHistory: normalizeEvidenceHistory(rawEvidence, { source: 'import', fallback: importFallback }),
         evidencePins,
@@ -139,6 +142,7 @@ function caseFromPatch(patch, now) {
         domain: patch.domain,
         status: patch.status ?? DEFAULT_STATUS,
         disposition: patch.disposition ?? DEFAULT_DISPOSITION,
+        reviewReasonCode: patch.reviewReasonCode ?? null,
         tags: patch.tags,
         notes: patch.notes,
         source: patch.source ?? DEFAULT_SOURCE,
@@ -171,6 +175,7 @@ function applyImportPatch(local, patch) {
         ...local,
         status: patch.status !== undefined && importNewer ? patch.status : local.status,
         disposition: patch.disposition !== undefined && importNewer ? patch.disposition : local.disposition,
+        reviewReasonCode: patch.reviewReasonCode !== undefined && importNewer ? patch.reviewReasonCode : local.reviewReasonCode ?? null,
         source: patch.source !== undefined && importNewer ? patch.source : local.source,
         evidenceHistory: mergeEvidenceHistories(local.evidenceHistory, patch.evidenceHistory),
         evidencePins,

package/frontend/src/lib/analysis/case-record-contracts.js

@@ -1,5 +1,6 @@
-export const CASE_SCHEMA_VERSION = 9;
-export const CASE_IMPORT_VERSIONS = [3, 4, 5, 6, 7, 8, CASE_SCHEMA_VERSION];
+import { ANALYST_REVIEW_REASONS } from "../../../../lib/analyst-taxonomy.mjs";
+export const CASE_SCHEMA_VERSION = 10;
+export const CASE_IMPORT_VERSIONS = [3, 4, 5, 6, 7, 8, 9, CASE_SCHEMA_VERSION];
 export const MAX_CASES = 500;
 export const MAX_NOTES_PER_CASE = 50;
 export const MAX_NOTE_LENGTH = 2000;
@@ -31,6 +32,7 @@ export const CASE_DISPOSITIONS = [
     { value: 'expected', label: 'Expected' },
     { value: 'closed_no_action', label: 'Closed without action' },
 ];
+export const CASE_REVIEW_REASONS = ANALYST_REVIEW_REASONS.map((item) => ({ ...item }));
 export const CASE_SOURCES = [
     { value: 'lookup', label: 'Lookup' },
     { value: 'bulk', label: 'Bulk' },

package/frontend/src/lib/analysis/case-record-core.js

@@ -1,6 +1,6 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
-import { CASE_DISPOSITIONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_CASES, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.js";
+import { CASE_DISPOSITIONS, CASE_REVIEW_REASONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_CASES, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.js";
 // Forward-version policy (two distinct guarantees):
 //   - A locally-stored envelope that declares a version greater than this is
 //     still read best-effort on load (known fields kept, unknown dropped), but
@@ -26,6 +26,7 @@ export const EVIDENCE_SOURCE_RANK = {
 };
 const STATUS_VALUES = new Set(CASE_STATUSES.map((item) => item.value));
 const DISPOSITION_VALUES = new Set(CASE_DISPOSITIONS.map((item) => item.value));
+const REVIEW_REASON_VALUES = new Set(CASE_REVIEW_REASONS.map((item) => item.value).filter(Boolean));
 const SOURCE_VALUES = new Set(CASE_SOURCES.map((item) => item.value));
 const STATUS_LABELS = Object.fromEntries(CASE_STATUSES.map((item) => [item.value, item.label]));
 const DISPOSITION_LABELS = Object.fromEntries(CASE_DISPOSITIONS.map((item) => [item.value, item.label]));
@@ -135,6 +136,9 @@ export function normalizeStatus(value) {
 export function normalizeDisposition(value) {
     return typeof value === 'string' && DISPOSITION_VALUES.has(value) ? value : DEFAULT_DISPOSITION;
 }
+export function normalizeReviewReasonCode(value) {
+    return typeof value === 'string' && REVIEW_REASON_VALUES.has(value) ? value : null;
+}
 export function normalizeSource(value) {
     return typeof value === 'string' && SOURCE_VALUES.has(value) ? value : DEFAULT_SOURCE;
 }

package/frontend/src/lib/analysis/case-record-operations.js

@@ -2,7 +2,7 @@
 // record normalization, and analyst updates.
 import { appendCaseAction, appendCaseAssertion, appendCaseDecision, appendCaseEvidencePin, appendCaseEvidencePins, appendCaseManualTrailEvent, appendCaseSighting, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseSightings, updateCaseAction, updateCaseAssertion, } from "./case-response-model.js";
 import { CASE_DISPOSITIONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_CASES, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.js";
-import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, deterministicId, isoOrNow, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.js";
+import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, deterministicId, isoOrNow, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeReviewReasonCode, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.js";
 import { normalizeEvidenceHistory, } from "./case-evidence-model.js";
 // ---------------------------------------------------------------------------
 // Case normalization
@@ -49,6 +49,7 @@ export function normalizeCase(raw, existing, nowIso) {
         domain,
         status: normalizeStatus(record.status),
         disposition: normalizeDisposition(record.disposition),
+        reviewReasonCode: normalizeReviewReasonCode(record.reviewReasonCode),
         tags: normalizeTags(record.tags),
         notes: normalizeNotes(record.notes, now),
         source: normalizeSource(record.source),
@@ -86,6 +87,7 @@ export function createCase(input, nowIso) {
         domain,
         status: normalizeStatus(input.status),
         disposition: normalizeDisposition(input.disposition),
+        reviewReasonCode: normalizeReviewReasonCode(input.reviewReasonCode),
         tags: normalizeTags(input.tags),
         notes: noteBody ? [{ id: makeId(), body: noteBody, createdAt: now }] : [],
         source,
@@ -206,6 +208,9 @@ export function updateCase(cases, id, patch, nowIso) {
         ...current,
         status: patch.status !== undefined ? normalizeStatus(patch.status) : current.status,
         disposition: patch.disposition !== undefined ? normalizeDisposition(patch.disposition) : current.disposition,
+        reviewReasonCode: patch.reviewReasonCode !== undefined
+            ? normalizeReviewReasonCode(patch.reviewReasonCode)
+            : current.reviewReasonCode ?? null,
         tags: patch.tags !== undefined ? normalizeTags(patch.tags) : current.tags,
         source,
         evidenceHistory,

package/frontend/src/lib/analysis/case-response-packet.js

@@ -36,7 +36,7 @@ export const RESPONSE_PACKET_PROFILES = Object.freeze([
         includedEvidence: ['Exact URLs', 'Observation time', 'Case disposition', 'Selected evidence pins', 'Registrar contact provenance'],
         excludedEvidence: ['Raw WHOIS or RDAP payloads', 'Unselected contacts', 'Provider secrets', 'Unrelated analyst notes'],
         redactions: ['Remove unnecessary personal registration data', 'Remove credentials, tokens, and URL fragments'],
-        attachments: ['Reviewed response packet', 'Optional normalized case report'],
+        attachments: ['Reviewed response packet', 'Optional normalised case report'],
         followUpFields: ['Registrar reference', 'Acknowledgement time', 'Resolution or transfer outcome'],
     },
     {
@@ -50,7 +50,7 @@ export const RESPONSE_PACKET_PROFILES = Object.freeze([
         includedEvidence: ['Exact URLs', 'Observation time', 'Registry contact provenance', 'Selected evidence pins', 'Prior action references'],
         excludedEvidence: ['Raw registry payloads', 'Unselected contacts', 'Secrets', 'Unsupported ownership claims'],
         redactions: ['Remove unnecessary personal registration data', 'Remove credentials, tokens, and URL fragments'],
-        attachments: ['Reviewed response packet', 'Optional normalized case report', 'Optional registrar reference'],
+        attachments: ['Reviewed response packet', 'Optional normalised case report', 'Optional registrar reference'],
         followUpFields: ['Registry reference', 'Registrar referral', 'Delegation or status outcome'],
     },
     {
@@ -64,7 +64,7 @@ export const RESPONSE_PACKET_PROFILES = Object.freeze([
         includedEvidence: ['Exact URLs', 'Observation time', 'Selected HTTP, TLS, DNS, or page-identity pins', 'Contact provenance'],
         excludedEvidence: ['Raw response bodies', 'Cookies', 'Secrets', 'Unproven origin-host claims'],
         redactions: ['Remove credentials, query secrets, fragments, cookies, and unrelated contacts'],
-        attachments: ['Reviewed response packet', 'Optional normalized case report'],
+        attachments: ['Reviewed response packet', 'Optional normalised case report'],
         followUpFields: ['Provider ticket', 'Content status', 'Infrastructure change outcome'],
     },
     {
@@ -78,7 +78,7 @@ export const RESPONSE_PACKET_PROFILES = Object.freeze([
         includedEvidence: ['Exact URLs', 'Observation time', 'Selected evidence pins', 'Contact source and limitations'],
         excludedEvidence: ['Raw upstream payloads', 'Secrets', 'Unselected case notes', 'Legal conclusions'],
         redactions: ['Remove credentials, tokens, personal data, and unrelated identifiers'],
-        attachments: ['Reviewed response packet', 'Optional normalized case report'],
+        attachments: ['Reviewed response packet', 'Optional normalised case report'],
         followUpFields: ['Security reference', 'Triage acknowledgement', 'Remediation outcome'],
     },
     {
@@ -88,11 +88,11 @@ export const RESPONSE_PACKET_PROFILES = Object.freeze([
         subjectPrefix: 'Reviewed unsafe-site report',
         requiredContactKind: null,
         checklist: ['Use the recipient submission form or documented route manually', 'Include exact URLs and current observation time', 'Disclose source gaps and false-positive context'],
-        evidenceOrder: ['Exact URLs', 'Observed behavior', 'Selected corroborating evidence', 'Limitations'],
+        evidenceOrder: ['Exact URLs', 'Observed behaviour', 'Selected corroborating evidence', 'Limitations'],
         includedEvidence: ['Exact URLs', 'Observation time', 'Observed harm', 'Selected evidence pins', 'Contradictions and cautions'],
         excludedEvidence: ['Raw provider payloads', 'Secrets', 'Unselected personal data', 'Automated maliciousness claims'],
         redactions: ['Remove credentials, tokens, URL fragments, and unrelated contacts'],
-        attachments: ['Reviewed response packet', 'Optional normalized case report'],
+        attachments: ['Reviewed response packet', 'Optional normalised case report'],
         followUpFields: ['Submission reference', 'Review state', 'Listing or delisting outcome'],
     },
     {
@@ -106,7 +106,7 @@ export const RESPONSE_PACKET_PROFILES = Object.freeze([
         includedEvidence: ['Case disposition', 'Selected evidence pins', 'Analyst decisions and assertions', 'Action history', 'Exact URLs when relevant'],
         excludedEvidence: ['Raw upstream payloads', 'Secrets', 'Unselected personal data', 'Unsupported attribution'],
         redactions: ['Remove credentials, tokens, and personal data not required for the internal decision'],
-        attachments: ['Reviewed response packet', 'Normalized case report when required by internal policy'],
+        attachments: ['Reviewed response packet', 'Normalised case report when required by internal policy'],
         followUpFields: ['Internal owner', 'Due date', 'Decision', 'Control or escalation outcome'],
     },
 ]);