@slicedearth/whoisleuth-cli 1.36.1 → 1.43.0

package/frontend/src/lib/analysis/acquisition-decision-packet.js

@@ -72,7 +72,7 @@ export async function buildAcquisitionDecisionPacket(input) {
         },
         evidenceReview: input.review,
         limitations: [
-            'This local artifact records an analyst review of bounded point-in-time evidence and does not submit, reserve, value, purchase, or transfer a domain.',
+            'This local artefact records an analyst review of bounded point-in-time evidence and does not submit, reserve, value, purchase, or transfer a domain.',
             'A reviewed state records completion of the displayed manual checklist, not the accuracy of external statements or a legal, financial, eligibility, or ownership determination.',
             'Refresh authoritative registration and policy evidence immediately before acting.',
             ...(input.synthetic === true

package/frontend/src/lib/analysis/acquisition-due-diligence.js

@@ -102,7 +102,7 @@ function lifecycleItem(availability, lifecycle, publications) {
             label: 'Lifecycle date observed',
             state: expiresInDays !== null && expiresInDays <= 30 ? 'review' : 'observed',
             detail: timing,
-            provenance: 'Normalized RDAP or WHOIS lifecycle',
+            provenance: 'Normalised RDAP or WHOIS lifecycle',
         };
     }
     return {
@@ -110,7 +110,7 @@ function lifecycleItem(availability, lifecycle, publications) {
         label: completePublication ? 'Expiry date not published' : 'Lifecycle timing unavailable',
         state: completePublication ? 'observed' : 'unavailable',
         detail: completePublication
-            ? 'A usable publication was collected without a normalized expiry date. Registry policy and renewal state still require manual confirmation.'
+            ? 'A usable publication was collected without a normalised expiry date. Registry policy and renewal state still require manual confirmation.'
             : 'Incomplete or unavailable registry publications cannot establish an expiry or release window.',
         provenance: 'Registry publication quality',
     };
@@ -135,7 +135,7 @@ function transferItem(lifecycle, publications) {
             id: 'transfer',
             label: 'No interpreted lock status observed',
             state: 'review',
-            detail: 'The collected statuses did not contain a recognized client or server lock. This does not prove transfer eligibility or that other policy restrictions are absent.',
+            detail: 'The collected statuses did not contain a recognised client or server lock. This does not prove transfer eligibility or that other policy restrictions are absent.',
             provenance: 'EPP status interpretation',
         };
     }
@@ -307,7 +307,7 @@ function registryPolicyChecks(availability, lifecycle, publications) {
             detail: statuses.length
                 ? `The collected publication included ${statuses.slice(0, 6).join(', ')}${statuses.length > 6 ? ', …' : ''}. Confirm current registry timing and restoration or deletion rules; WHOISleuth does not predict release.`
                 : publicationAvailable
-                    ? 'No recognized lifecycle status was retained. Confirm renewal, grace, redemption, restoration, and deletion rules with the current registry or registrar.'
+                    ? 'No recognised lifecycle status was retained. Confirm renewal, grace, redemption, restoration, and deletion rules with the current registry or registrar.'
                     : 'No usable registry publication was available for a current lifecycle-policy review.',
             provenance: 'Separately attributed RDAP and WHOIS lifecycle publications',
         },
@@ -316,9 +316,9 @@ function registryPolicyChecks(availability, lifecycle, publications) {
             label: locks.client === true || locks.server === true ? 'Confirm observed transfer constraints' : 'Confirm transfer and change-of-control requirements',
             state: publicationAvailable ? 'review' : 'unavailable',
             detail: locks.client === true || locks.server === true
-                ? 'Recognized client or server lock evidence was observed. Confirm authorization codes, lock removal, waiting periods, identity checks, and any registrar change-of-control process.'
+                ? 'Recognised client or server lock evidence was observed. Confirm authorisation codes, lock removal, waiting periods, identity checks, and any registrar change-of-control process.'
                 : publicationAvailable
-                    ? 'No recognized lock was retained, but that does not establish transfer eligibility. Confirm authorization, waiting periods, identity checks, and registrar requirements.'
+                    ? 'No recognised lock was retained, but that does not establish transfer eligibility. Confirm authorisation, waiting periods, identity checks, and registrar requirements.'
                     : 'No usable status publication was available to describe current transfer constraints.',
             provenance: 'EPP status interpretation and manual policy requirements',
         },
@@ -383,7 +383,7 @@ export function buildAcquisitionDueDiligence(input) {
         policyChecks,
         nextSteps,
         limitations: [
-            'This workspace organizes observed evidence; it does not value a domain or establish that it can be acquired.',
+            'This workspace organises observed evidence; it does not value a domain or establish that it can be acquired.',
             'Expiry dates, EPP statuses, sale signals, and contact routes can change after collection.',
             'WHOISleuth does not assess legal rights, registry eligibility, registrar terms, escrow, tax, or payment risk.',
         ],

package/frontend/src/lib/analysis/brand-profile-model.js

@@ -5,7 +5,7 @@ import { normalizeDomain } from "./case-model.js";
 import { normalizePageBaseline } from "./page-baseline.js";
 import { isInformativeFaviconHash } from "./utils.js";
 export const BRAND_PROFILE_SCHEMA = 'whoisleuth.brand-profiles';
-export const BRAND_PROFILE_SCHEMA_VERSION = 5;
+export const BRAND_PROFILE_SCHEMA_VERSION = 6;
 export const MAX_PROFILES = 100;
 export const MAX_PROFILE_VALUES = 200;
 export const MAX_PROFILE_VALUE_INPUTS = MAX_PROFILE_VALUES * 4;
@@ -22,6 +22,8 @@ export const MAX_PROTECTION_ATTESTATIONS = 6;
 export const MAX_DESIRED_POSTURE_BASELINES = 20;
 export const MAX_DESIRED_POSTURE_RECORDS = 32;
 export const MAX_DESIRED_POSTURE_SUPPRESSIONS = 12;
+export const MAX_DESIRED_POSTURE_OBSERVATIONS = 12;
+export const MAX_DESIRED_POSTURE_CHANGE_WINDOWS = 8;
 const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
 const SHA256_RE = /^[a-f0-9]{64}$/i;
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
@@ -203,6 +205,35 @@ function normalizeDesiredPostureObservation(value) {
     }
     return checks.length ? { observedAt, checks } : null;
 }
+function normalizeDesiredPostureObservationHistory(value, previous) {
+    const candidates = Array.isArray(value) ? value : previous ? [previous] : [];
+    const byTime = new Map();
+    for (const item of candidates.slice(0, MAX_DESIRED_POSTURE_OBSERVATIONS * 4)) {
+        const normalized = normalizeDesiredPostureObservation(item);
+        if (normalized)
+            byTime.set(normalized.observedAt, normalized);
+    }
+    return [...byTime.values()]
+        .sort((left, right) => Date.parse(left.observedAt) - Date.parse(right.observedAt))
+        .slice(-MAX_DESIRED_POSTURE_OBSERVATIONS);
+}
+function normalizeDesiredPostureChangeWindows(value) {
+    if (!Array.isArray(value))
+        return [];
+    const output = [];
+    for (const item of value.slice(0, MAX_DESIRED_POSTURE_CHANGE_WINDOWS * 4)) {
+        const candidate = record(item);
+        const startsAt = timestamp(candidate.startsAt, null);
+        const endsAt = timestamp(candidate.endsAt, null);
+        const summary = boundedText(candidate.summary, 300);
+        if (!startsAt || !endsAt || Date.parse(endsAt) <= Date.parse(startsAt) || !summary)
+            continue;
+        output.push({ startsAt, endsAt, summary });
+        if (output.length >= MAX_DESIRED_POSTURE_CHANGE_WINDOWS)
+            break;
+    }
+    return output.sort((left, right) => Date.parse(left.startsAt) - Date.parse(right.startsAt));
+}
 function normalizeTlsSanPatterns(value) {
     if (!Array.isArray(value))
         return [];
@@ -250,6 +281,8 @@ export function normalizeDesiredPostureBaselines(value, officialDomains, fallbac
                 break;
         }
         seen.add(domain);
+        const previousObservation = normalizeDesiredPostureObservation(candidate.previousObservation);
+        const observationHistory = normalizeDesiredPostureObservationHistory(candidate.observationHistory, previousObservation);
         output.push({
             version: 1,
             domain,
@@ -266,9 +299,18 @@ export function normalizeDesiredPostureBaselines(value, officialDomains, fallbac
                 ? candidate.registrarLock
                 : 'unconfigured',
             renewalReviewAt: timestamp(candidate.renewalReviewAt, null),
+            zoneIntent: ['active_service', 'defensive_registration', 'no_service', 'parked', 'redirect_only'].includes(String(candidate.zoneIntent))
+                ? candidate.zoneIntent
+                : 'unconfigured',
+            lifecycle: ['active', 'change_planned', 'retiring', 'retired'].includes(String(candidate.lifecycle))
+                ? candidate.lifecycle
+                : 'active',
+            recoveryDependency: boundedText(candidate.recoveryDependency, 200),
+            approvedChangeWindows: normalizeDesiredPostureChangeWindows(candidate.approvedChangeWindows),
             suppressions,
             note: boundedText(candidate.note, MAX_PROFILE_TEXT_LENGTH),
-            previousObservation: normalizeDesiredPostureObservation(candidate.previousObservation),
+            previousObservation: observationHistory.at(-1) ?? previousObservation,
+            observationHistory,
             updatedAt: timestamp(candidate.updatedAt, fallback),
         });
         if (output.length >= MAX_DESIRED_POSTURE_BASELINES)
@@ -376,8 +418,8 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
     if (importedVersion !== null && importedVersion > BRAND_PROFILE_SCHEMA_VERSION) {
         throw new Error(`This Brand Profile file uses newer schema ${importedVersion}. Update the app before importing it.`);
     }
-    if (![2, 3, 4, BRAND_PROFILE_SCHEMA_VERSION].includes(importedVersion ?? 0)) {
-        throw new Error(`Expected a WHOISleuth Brand Profile export using schema 2, 3, 4, or ${BRAND_PROFILE_SCHEMA_VERSION}.`);
+    if (![2, 3, 4, 5, BRAND_PROFILE_SCHEMA_VERSION].includes(importedVersion ?? 0)) {
+        throw new Error(`Expected a WHOISleuth Brand Profile export using schema 2, 3, 4, 5, or ${BRAND_PROFILE_SCHEMA_VERSION}.`);
     }
     const local = normalizeBrandProfileStore(localRaw).profiles;
     const byName = new Map(local.map((profile) => [profile.name.toLowerCase(), profile]));

package/frontend/src/lib/analysis/bulk-domain-comparison.js

@@ -168,32 +168,32 @@ export function buildBulkDomainComparison(leftRaw, rightRaw, observedAtRaw = nul
         .some((value) => ['conflict', 'conflicting'].includes(value.toLowerCase()));
     const rows = [
         row('registration', 'registration', 'Registration', left.availability, right.availability, 'Authority-aware compact availability state', registry, [], { conflicting: registrationConflicting }),
-        row('registrar', 'registration', 'Registrar', left.registrar, right.registrar, 'Normalized registrar display identity', registry),
+        row('registrar', 'registration', 'Registrar', left.registrar, right.registrar, 'Normalised registrar display identity', registry),
         row('created', 'lifecycle', 'Created', left.createdDate, right.createdDate, 'Source-reported lifecycle date', registry),
         row('expires', 'lifecycle', 'Expires', left.expiryDate, right.expiryDate, 'Source-reported lifecycle date', registry),
-        row('nameservers', 'infrastructure', 'Nameservers', left.nameservers, right.nameservers, 'Normalized exact set comparison', registry),
-        row('dns-a', 'dns', 'A records', dnsValues(left, 'a'), dnsValues(right, 'a'), 'Normalized exact retained DNS answer set', dns),
-        row('dns-aaaa', 'dns', 'AAAA records', dnsValues(left, 'aaaa'), dnsValues(right, 'aaaa'), 'Normalized exact retained DNS answer set', dns),
-        row('dns-cname', 'dns', 'CNAME records', dnsValues(left, 'cname'), dnsValues(right, 'cname'), 'Normalized exact retained DNS answer set', dns),
-        row('dns-caa', 'dns', 'CAA records', dnsValues(left, 'caa'), dnsValues(right, 'caa'), 'Normalized exact retained DNS answer set', dns),
+        row('nameservers', 'infrastructure', 'Nameservers', left.nameservers, right.nameservers, 'Normalised exact set comparison', registry),
+        row('dns-a', 'dns', 'A records', dnsValues(left, 'a'), dnsValues(right, 'a'), 'Normalised exact retained DNS answer set', dns),
+        row('dns-aaaa', 'dns', 'AAAA records', dnsValues(left, 'aaaa'), dnsValues(right, 'aaaa'), 'Normalised exact retained DNS answer set', dns),
+        row('dns-cname', 'dns', 'CNAME records', dnsValues(left, 'cname'), dnsValues(right, 'cname'), 'Normalised exact retained DNS answer set', dns),
+        row('dns-caa', 'dns', 'CAA records', dnsValues(left, 'caa'), dnsValues(right, 'caa'), 'Normalised exact retained DNS answer set', dns),
         row('dnssec', 'dns', 'DNSSEC state', left.dnssec, right.dnssec, 'Separately attributed compact DNSSEC observation', dns),
-        row('ip-addresses', 'infrastructure', 'Observed IP addresses', left.relationship.ipAddresses, right.relationship.ipAddresses, 'Normalized exact set comparison', dns, ['Shared hosting and CDNs are common and do not prove common control.']),
+        row('ip-addresses', 'infrastructure', 'Observed IP addresses', left.relationship.ipAddresses, right.relationship.ipAddresses, 'Normalised exact set comparison', dns, ['Shared hosting and CDNs are common and do not prove common control.']),
         row('tls-source', 'certificate', 'TLS collection', tls.leftSourceState, tls.rightSourceState, 'Retained compact source-state comparison', tls),
         row('certificate', 'certificate', 'Leaf certificate fingerprint', left.relationship.certificateFingerprint, right.relationship.certificateFingerprint, 'Exact SHA-256 comparison', tls, ['Multi-domain certificates and managed hosting are common.']),
-        row('tls-issuer', 'certificate', 'TLS issuer label', left.comparisonEvidence?.tls.issuerLabel ?? null, right.comparisonEvidence?.tls.issuerLabel ?? null, 'Normalized retained issuer-label comparison', compactTls, ['Issuer labels are certificate metadata and do not establish common ownership or control.']),
+        row('tls-issuer', 'certificate', 'TLS issuer label', left.comparisonEvidence?.tls.issuerLabel ?? null, right.comparisonEvidence?.tls.issuerLabel ?? null, 'Normalised retained issuer-label comparison', compactTls, ['Issuer labels are certificate metadata and do not establish common ownership or control.']),
         row('tls-spki', 'certificate', 'TLS public-key fingerprint', left.comparisonEvidence?.tls.spkiSha256 ?? null, right.comparisonEvidence?.tls.spkiSha256 ?? null, 'Exact SPKI SHA-256 comparison', compactTls, ['Public-key reuse can be an investigative lead but does not establish ownership, intent, safety, or maliciousness.']),
         row('mail', 'mail', 'MX observed', left.hasMx, right.hasMx, 'Compact Deep DNS observation', dns),
         row('null-mx', 'mail', 'Null MX observed', left.hasNullMx, right.hasNullMx, 'Compact Deep DNS observation', dns),
         row('spf', 'mail', 'SPF observed', left.hasSpf, right.hasSpf, 'Compact Deep DNS observation', dns),
         row('dmarc', 'mail', 'DMARC observed', left.hasDmarc, right.hasDmarc, 'Compact Deep DNS observation', dns),
         row('website', 'web', 'Website activity', left.activityStatus, right.activityStatus, 'Bounded homepage observation', http),
-        row('page-title', 'identity', 'Page title', left.pageTitle, right.pageTitle, 'Normalized bounded title equality', http),
+        row('page-title', 'identity', 'Page title', left.pageTitle, right.pageTitle, 'Normalised bounded title equality', http),
         row('favicon', 'identity', 'Favicon fingerprint', left.faviconHash, right.faviconHash, 'Exact SHA-256 comparison', http),
-        row('tracking', 'identity', 'Tracking identifiers', left.relationship.trackingIdentifiers, right.relationship.trackingIdentifiers, 'Normalized exact set comparison', http, ['Shared identifiers are an investigative lead, not proof of ownership.']),
+        row('tracking', 'identity', 'Tracking identifiers', left.relationship.trackingIdentifiers, right.relationship.trackingIdentifiers, 'Normalised exact set comparison', http, ['Shared identifiers are an investigative lead, not proof of ownership.']),
         row('password-field', 'identity', 'Password field', left.hasPasswordField, right.hasPasswordField, 'Bounded static form observation', http),
         row('phishing-language', 'identity', 'Phishing-language indicator', left.phishingLanguageMatch, right.phishingLanguageMatch, 'Bounded explainable page-language signal', http, ['A wording match is a review lead, not proof of malicious intent.']),
         row('official-assets', 'identity', 'Official asset reuse', left.reusesOfficialAssets, right.reusesOfficialAssets, 'Configured Brand Profile comparison', http),
-        row('technology', 'technology', 'Technology identifiers', left.comparisonEvidence?.technology.ids ?? [], right.comparisonEvidence?.technology.ids ?? [], 'Normalized exact set comparison of at most 12 curated identifiers', compactTechnology, ['An unmatched identifier is not evidence that a technology is absent. Shared technologies do not establish common ownership or control.']),
+        row('technology', 'technology', 'Technology identifiers', left.comparisonEvidence?.technology.ids ?? [], right.comparisonEvidence?.technology.ids ?? [], 'Normalised exact set comparison of at most 12 curated identifiers', compactTechnology, ['An unmatched identifier is not evidence that a technology is absent. Shared technologies do not establish common ownership or control.']),
         row('source-health', 'source', 'Recorded source coverage', sourceSummary(left), sourceSummary(right), 'Source-by-source compact state comparison', source, ['A source-state difference can reflect collection conditions rather than a domain change.']),
     ];
     const counts = {
@@ -216,7 +216,7 @@ export function buildBulkDomainComparison(leftRaw, rightRaw, observedAtRaw = nul
         counts,
         limitations: options.allowSameDomain
             ? [
-                'This compares normalized evidence already present in two saved observations for the same domain and makes no new request.',
+                'This compares normalised evidence already present in two saved observations for the same domain and makes no new request.',
                 'Missing, unavailable, and differently collected evidence remain distinct from an observed difference.',
                 'An observed difference can reflect changed collection conditions and does not by itself establish current state, ownership, intent, safety, or maliciousness.',
             ]

package/frontend/src/lib/analysis/bulk-mail-exposure.js

@@ -169,7 +169,7 @@ export function buildBulkMailExposureReport(rowsRaw, options = {}) {
         limitations: [
             'This review uses compact Bulk evidence already collected and makes no additional request.',
             'Null MX, no explicit MX, receiving mail, authentication gaps, and incomplete evidence remain separate states.',
-            'SMTP delivery, mailbox existence, catch-all behavior, and message acceptance were not tested.',
+            'SMTP delivery, mailbox existence, catch-all behaviour, and message acceptance were not tested.',
         ],
     };
 }

package/frontend/src/lib/analysis/bulk-session-model.js

@@ -4,8 +4,8 @@
 import { normalizeDomain } from "./case-model.js";
 import { normalizeCaaCritical } from "./dns-record-normalization.js";
 export const BULK_SESSION_SCHEMA = 'whoisleuth.bulk-sessions';
-export const BULK_SESSION_SCHEMA_VERSION = 2;
-export const SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS = Object.freeze([1, BULK_SESSION_SCHEMA_VERSION]);
+export const BULK_SESSION_SCHEMA_VERSION = 3;
+export const SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS = Object.freeze([1, 2, BULK_SESSION_SCHEMA_VERSION]);
 export const MAX_BULK_SESSIONS = 10;
 export const MAX_BULK_SESSION_ROWS = 2_000;
 export const MAX_BULK_SESSION_STORE_BYTES = 4 * 1024 * 1024;
@@ -231,6 +231,7 @@ export function normalizeBulkSessionResult(value) {
         scanDepth: scanDepth,
         createdDate: boundedText(item.createdDate, 64) || null,
         expiryDate: boundedText(item.expiryDate, 64) || null,
+        privacyProtected: nullableBoolean(item.privacyProtected),
         nameservers: boundedStrings(item.nameservers, 20),
         hasMx: nullableBoolean(item.hasMx),
         hasNullMx: nullableBoolean(item.hasNullMx),
@@ -246,7 +247,11 @@ export function normalizeBulkSessionResult(value) {
         hasPasswordField: item.hasPasswordField === true,
         hasExternalFormAction: nullableBoolean(item.hasExternalFormAction),
         phishingLanguageMatch: boundedText(item.phishingLanguageMatch, 300) || null,
+        idnReferenceMatch: nullableBoolean(item.idnReferenceMatch),
+        pageBaselineMatch: nullableBoolean(item.pageBaselineMatch),
+        hasActiveBrandProfile: nullableBoolean(item.hasActiveBrandProfile),
         riskModelVersion: nullableVersion(item.riskModelVersion),
+        opportunityModelVersion: nullableVersion(item.opportunityModelVersion),
         riskFactors: normalizeRiskFactors(item.riskFactors),
         dns: normalizeDns(item.dns),
         dnssec: boundedText(item.dnssec, 40) || null,

package/frontend/src/lib/analysis/case-evidence-model.js

@@ -1,7 +1,7 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
 import { normalizeHttpSummary } from "./http-summary.js";
-import { normalizeRiskModelVersion } from "./scoring.js";
+import { normalizeOpportunityModelVersion, normalizeRiskModelVersion } from "./scoring.js";
 import { CASE_DISPOSITIONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_CASES, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.js";
 import { CONCLUSIVE_AVAILABILITY, DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_RANK, EVIDENCE_SOURCE_SET, REGISTERED_LIKE, hashString, isoOrNull, objectRecord, safeId, } from "./case-record-core.js";
 function evidenceString(value, max = MAX_EVIDENCE_STRING_LENGTH) {
@@ -97,6 +97,7 @@ const DEEP_SIGNAL_FIELDS = [
     'httpSummaryVersion', 'httpEvidenceStatus', 'httpFinalOrigin', 'httpResponseStatus', 'httpTransportSecurity', 'httpRedirectCount',
     'httpCrossOriginRedirect', 'httpHttpsDowngrade', 'httpContentType', 'httpSecurityHeaders',
     'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets', 'hasPasswordField', 'hasExternalFormAction', 'phishingLanguageMatch',
+    'pageBaselineMatch',
 ];
 // Ordered list of the fields that make up a snapshot's *material* identity -
 // everything except capture timestamps, snapshot id and source. `scanDepth` is
@@ -104,7 +105,7 @@ const DEEP_SIGNAL_FIELDS = [
 // another. Deterministic ordering here is what makes the fingerprint stable.
 const MATERIAL_FIELD_ORDER = [
     'scanDepth',
-    'availability', 'confidence', 'riskModelVersion', 'riskScore', 'opportunityScore',
+    'availability', 'confidence', 'riskModelVersion', 'riskScore', 'opportunityModelVersion', 'opportunityScore',
     'riskFactors', 'opportunityFactors',
     'registrar', 'createdDate', 'expiryDate', 'nameservers',
     'hasMx', 'hasSpf', 'hasDmarc',
@@ -112,6 +113,7 @@ const MATERIAL_FIELD_ORDER = [
     'httpSummaryVersion', 'httpEvidenceStatus', 'httpFinalOrigin', 'httpResponseStatus', 'httpTransportSecurity', 'httpRedirectCount',
     'httpCrossOriginRedirect', 'httpHttpsDowngrade', 'httpContentType', 'httpSecurityHeaders',
     'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets', 'hasPasswordField', 'hasExternalFormAction', 'phishingLanguageMatch',
+    'privacyProtected', 'idnReferenceMatch', 'pageBaselineMatch', 'hasActiveBrandProfile',
     'mutationTypes',
 ];
 // The canonical, comparison-safe value of a material field. Registrar casing,
@@ -203,6 +205,7 @@ function buildSnapshot(raw, options) {
         confidence: evidenceString(record.confidence),
         riskModelVersion: normalizeRiskModelVersion(record.riskModelVersion),
         riskScore: clampScore(record.riskScore),
+        opportunityModelVersion: normalizeOpportunityModelVersion(record.opportunityModelVersion),
         opportunityScore: clampScore(record.opportunityScore),
         riskFactors: normalizeFactors(record.riskFactors),
         opportunityFactors: normalizeFactors(record.opportunityFactors),
@@ -232,12 +235,18 @@ function buildSnapshot(raw, options) {
         hasPasswordField: boolOrNull(record.hasPasswordField),
         hasExternalFormAction: boolOrNull(record.hasExternalFormAction),
         phishingLanguageMatch: evidenceString(record.phishingLanguageMatch),
+        privacyProtected: boolOrNull(record.privacyProtected),
+        idnReferenceMatch: boolOrNull(record.idnReferenceMatch),
+        pageBaselineMatch: boolOrNull(record.pageBaselineMatch),
+        hasActiveBrandProfile: boolOrNull(record.hasActiveBrandProfile),
         mutationTypes: normalizeMutationList(record.mutationTypes),
     };
     // A version without an actual risk assessment is orphaned metadata. Drop it
     // so it cannot make otherwise-identical evidence look materially different.
     if (fields.riskScore === null && fields.riskFactors.length === 0)
         fields.riskModelVersion = null;
+    if (fields.opportunityScore === null && fields.opportunityFactors.length === 0)
+        fields.opportunityModelVersion = null;
     // A fast capture never evaluates the deep signals, so any value supplied for
     // them (e.g. a profile's default `false`) is discarded as unevaluated.
     if (scanDepth === 'fast') {
@@ -264,6 +273,7 @@ function buildSnapshot(raw, options) {
             hasPasswordField: null,
             hasExternalFormAction: null,
             phishingLanguageMatch: null,
+            pageBaselineMatch: null,
         });
     }
     if (!hasMaterialEvidence(fields))
@@ -391,8 +401,8 @@ const COMPARE_FIELDS = [
     { field: 'confidence', label: 'Confidence', type: 'token' },
     { field: 'riskScore', label: 'Risk score', type: 'score', depthGate: 'comparable', modelGate: 'risk', direction: 'risk' },
     { field: 'riskFactors', label: 'Risk factors', type: 'factors', depthGate: 'comparable', modelGate: 'risk' },
-    { field: 'opportunityScore', label: 'Opportunity score', type: 'score' },
-    { field: 'opportunityFactors', label: 'Opportunity factors', type: 'factors' },
+    { field: 'opportunityScore', label: 'Opportunity score', type: 'score', modelGate: 'opportunity' },
+    { field: 'opportunityFactors', label: 'Opportunity factors', type: 'factors', modelGate: 'opportunity' },
     { field: 'registrar', label: 'Registrar', type: 'registrar' },
     { field: 'createdDate', label: 'Creation date', type: 'date' },
     { field: 'expiryDate', label: 'Expiry date', type: 'date' },
@@ -428,6 +438,11 @@ function riskModelComparable(previous, current) {
     const after = normalizeRiskModelVersion(current?.riskModelVersion);
     return before !== null && before === after;
 }
+function opportunityModelComparable(previous, current) {
+    const before = normalizeOpportunityModelVersion(previous?.opportunityModelVersion);
+    const after = normalizeOpportunityModelVersion(current?.opportunityModelVersion);
+    return before !== null && before === after;
+}
 function valuesMateriallyEqual(field, previous, current) {
     return JSON.stringify(materialValue(field, previous)) === JSON.stringify(materialValue(field, current));
 }
@@ -448,6 +463,10 @@ export function caseEvidenceIncomparableReasons(previous, current) {
         || previous.riskFactors.length > 0 || current.riskFactors.length > 0;
     if (hasRiskEvidence && !riskModelComparable(previous, current))
         reasons.push('risk-model');
+    const hasOpportunityEvidence = previous.opportunityScore !== null || current.opportunityScore !== null
+        || previous.opportunityFactors.length > 0 || current.opportunityFactors.length > 0;
+    if (hasOpportunityEvidence && !opportunityModelComparable(previous, current))
+        reasons.push('opportunity-model');
     if (!depthComparable(previous.scanDepth, current.scanDepth)) {
         const deepOnlyChanged = DEEP_SIGNAL_FIELDS.some((field) => !valuesMateriallyEqual(field, previous, current));
         const comparableRiskChanged = riskModelComparable(previous, current)
@@ -623,6 +642,7 @@ export function compareCaseEvidence(previous, current) {
     const bothDeep = previous.scanDepth === 'deep' && current.scanDepth === 'deep';
     const comparableDepth = depthComparable(previous.scanDepth, current.scanDepth);
     const comparableRiskModel = riskModelComparable(previous, current);
+    const comparableOpportunityModel = opportunityModelComparable(previous, current);
     const changes = [];
     for (const spec of COMPARE_FIELDS) {
         if (spec.depthGate === 'both-deep' && !bothDeep)
@@ -631,6 +651,8 @@ export function compareCaseEvidence(previous, current) {
             continue;
         if (spec.modelGate === 'risk' && !comparableRiskModel)
             continue;
+        if (spec.modelGate === 'opportunity' && !comparableOpportunityModel)
+            continue;
         const result = compareField(spec, previous[spec.field], current[spec.field]);
         if (result) {
             changes.push({ field: spec.field, label: spec.label, before: result.before, after: result.after, tone: result.tone });

package/frontend/src/lib/analysis/case-migration-model.js

@@ -1,4 +1,4 @@
-import { CASE_DISPOSITIONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, MAX_CASES, MAX_NOTES_PER_CASE, deterministicId, isoOrNull, normalizeCase, normalizeDomain, normalizeEvidenceHistory, normalizeNotes, normalizeTags, objectRecord, safeId, } from "./case-record-model.js";
+import { CASE_DISPOSITIONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, MAX_CASES, MAX_NOTES_PER_CASE, deterministicId, isoOrNull, normalizeCase, normalizeDomain, normalizeEvidenceHistory, normalizeNotes, normalizeReviewReasonCode, normalizeTags, objectRecord, safeId, } from "./case-record-model.js";
 import { mergeCaseActions, mergeCaseAssertions, mergeCaseDecisions, mergeCaseEvidencePins, mergeCaseManualTrail, mergeCaseSightings, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseSightings, } from "./case-response-model.js";
 const STATUS_VALUES = new Set(CASE_STATUSES.map((item) => item.value));
 const DISPOSITION_VALUES = new Set(CASE_DISPOSITIONS.map((item) => item.value));
@@ -97,6 +97,9 @@ function extractImportPatch(raw) {
         rawId: typeof record.id === 'string' ? record.id : null,
         status: importScalar(record.status, STATUS_VALUES),
         disposition: importScalar(record.disposition, DISPOSITION_VALUES),
+        reviewReasonCode: Object.hasOwn(record, 'reviewReasonCode')
+            ? normalizeReviewReasonCode(record.reviewReasonCode)
+            : undefined,
         source: importScalar(record.source, SOURCE_VALUES),
         evidenceHistory: normalizeEvidenceHistory(rawEvidence, { source: 'import', fallback: importFallback }),
         evidencePins,
@@ -139,6 +142,7 @@ function caseFromPatch(patch, now) {
         domain: patch.domain,
         status: patch.status ?? DEFAULT_STATUS,
         disposition: patch.disposition ?? DEFAULT_DISPOSITION,
+        reviewReasonCode: patch.reviewReasonCode ?? null,
         tags: patch.tags,
         notes: patch.notes,
         source: patch.source ?? DEFAULT_SOURCE,
@@ -171,6 +175,7 @@ function applyImportPatch(local, patch) {
         ...local,
         status: patch.status !== undefined && importNewer ? patch.status : local.status,
         disposition: patch.disposition !== undefined && importNewer ? patch.disposition : local.disposition,
+        reviewReasonCode: patch.reviewReasonCode !== undefined && importNewer ? patch.reviewReasonCode : local.reviewReasonCode ?? null,
         source: patch.source !== undefined && importNewer ? patch.source : local.source,
         evidenceHistory: mergeEvidenceHistories(local.evidenceHistory, patch.evidenceHistory),
         evidencePins,

package/frontend/src/lib/analysis/case-record-contracts.js

@@ -1,5 +1,6 @@
-export const CASE_SCHEMA_VERSION = 9;
-export const CASE_IMPORT_VERSIONS = [3, 4, 5, 6, 7, 8, CASE_SCHEMA_VERSION];
+import { ANALYST_REVIEW_REASONS } from "../../../../lib/analyst-taxonomy.mjs";
+export const CASE_SCHEMA_VERSION = 10;
+export const CASE_IMPORT_VERSIONS = [3, 4, 5, 6, 7, 8, 9, CASE_SCHEMA_VERSION];
 export const MAX_CASES = 500;
 export const MAX_NOTES_PER_CASE = 50;
 export const MAX_NOTE_LENGTH = 2000;
@@ -31,6 +32,7 @@ export const CASE_DISPOSITIONS = [
     { value: 'expected', label: 'Expected' },
     { value: 'closed_no_action', label: 'Closed without action' },
 ];
+export const CASE_REVIEW_REASONS = ANALYST_REVIEW_REASONS.map((item) => ({ ...item }));
 export const CASE_SOURCES = [
     { value: 'lookup', label: 'Lookup' },
     { value: 'bulk', label: 'Bulk' },

package/frontend/src/lib/analysis/case-record-core.js

@@ -1,6 +1,6 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
-import { CASE_DISPOSITIONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_CASES, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.js";
+import { CASE_DISPOSITIONS, CASE_REVIEW_REASONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_CASES, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.js";
 // Forward-version policy (two distinct guarantees):
 //   - A locally-stored envelope that declares a version greater than this is
 //     still read best-effort on load (known fields kept, unknown dropped), but
@@ -26,6 +26,7 @@ export const EVIDENCE_SOURCE_RANK = {
 };
 const STATUS_VALUES = new Set(CASE_STATUSES.map((item) => item.value));
 const DISPOSITION_VALUES = new Set(CASE_DISPOSITIONS.map((item) => item.value));
+const REVIEW_REASON_VALUES = new Set(CASE_REVIEW_REASONS.map((item) => item.value).filter(Boolean));
 const SOURCE_VALUES = new Set(CASE_SOURCES.map((item) => item.value));
 const STATUS_LABELS = Object.fromEntries(CASE_STATUSES.map((item) => [item.value, item.label]));
 const DISPOSITION_LABELS = Object.fromEntries(CASE_DISPOSITIONS.map((item) => [item.value, item.label]));
@@ -135,6 +136,9 @@ export function normalizeStatus(value) {
 export function normalizeDisposition(value) {
     return typeof value === 'string' && DISPOSITION_VALUES.has(value) ? value : DEFAULT_DISPOSITION;
 }
+export function normalizeReviewReasonCode(value) {
+    return typeof value === 'string' && REVIEW_REASON_VALUES.has(value) ? value : null;
+}
 export function normalizeSource(value) {
     return typeof value === 'string' && SOURCE_VALUES.has(value) ? value : DEFAULT_SOURCE;
 }

package/frontend/src/lib/analysis/case-record-operations.js

@@ -2,7 +2,7 @@
 // record normalization, and analyst updates.
 import { appendCaseAction, appendCaseAssertion, appendCaseDecision, appendCaseEvidencePin, appendCaseEvidencePins, appendCaseManualTrailEvent, appendCaseSighting, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseSightings, updateCaseAction, updateCaseAssertion, } from "./case-response-model.js";
 import { CASE_DISPOSITIONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_CASES, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.js";
-import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, deterministicId, isoOrNow, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.js";
+import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, deterministicId, isoOrNow, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeReviewReasonCode, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.js";
 import { normalizeEvidenceHistory, } from "./case-evidence-model.js";
 // ---------------------------------------------------------------------------
 // Case normalization
@@ -49,6 +49,7 @@ export function normalizeCase(raw, existing, nowIso) {
         domain,
         status: normalizeStatus(record.status),
         disposition: normalizeDisposition(record.disposition),
+        reviewReasonCode: normalizeReviewReasonCode(record.reviewReasonCode),
         tags: normalizeTags(record.tags),
         notes: normalizeNotes(record.notes, now),
         source: normalizeSource(record.source),
@@ -86,6 +87,7 @@ export function createCase(input, nowIso) {
         domain,
         status: normalizeStatus(input.status),
         disposition: normalizeDisposition(input.disposition),
+        reviewReasonCode: normalizeReviewReasonCode(input.reviewReasonCode),
         tags: normalizeTags(input.tags),
         notes: noteBody ? [{ id: makeId(), body: noteBody, createdAt: now }] : [],
         source,
@@ -206,6 +208,9 @@ export function updateCase(cases, id, patch, nowIso) {
         ...current,
         status: patch.status !== undefined ? normalizeStatus(patch.status) : current.status,
         disposition: patch.disposition !== undefined ? normalizeDisposition(patch.disposition) : current.disposition,
+        reviewReasonCode: patch.reviewReasonCode !== undefined
+            ? normalizeReviewReasonCode(patch.reviewReasonCode)
+            : current.reviewReasonCode ?? null,
         tags: patch.tags !== undefined ? normalizeTags(patch.tags) : current.tags,
         source,
         evidenceHistory,