@slicedearth/whoisleuth-cli 1.36.1 → 1.43.0

package/frontend/src/lib/analysis/case-response-packet.js

@@ -36,7 +36,7 @@ export const RESPONSE_PACKET_PROFILES = Object.freeze([
         includedEvidence: ['Exact URLs', 'Observation time', 'Case disposition', 'Selected evidence pins', 'Registrar contact provenance'],
         excludedEvidence: ['Raw WHOIS or RDAP payloads', 'Unselected contacts', 'Provider secrets', 'Unrelated analyst notes'],
         redactions: ['Remove unnecessary personal registration data', 'Remove credentials, tokens, and URL fragments'],
-        attachments: ['Reviewed response packet', 'Optional normalized case report'],
+        attachments: ['Reviewed response packet', 'Optional normalised case report'],
         followUpFields: ['Registrar reference', 'Acknowledgement time', 'Resolution or transfer outcome'],
     },
     {
@@ -50,7 +50,7 @@ export const RESPONSE_PACKET_PROFILES = Object.freeze([
         includedEvidence: ['Exact URLs', 'Observation time', 'Registry contact provenance', 'Selected evidence pins', 'Prior action references'],
         excludedEvidence: ['Raw registry payloads', 'Unselected contacts', 'Secrets', 'Unsupported ownership claims'],
         redactions: ['Remove unnecessary personal registration data', 'Remove credentials, tokens, and URL fragments'],
-        attachments: ['Reviewed response packet', 'Optional normalized case report', 'Optional registrar reference'],
+        attachments: ['Reviewed response packet', 'Optional normalised case report', 'Optional registrar reference'],
         followUpFields: ['Registry reference', 'Registrar referral', 'Delegation or status outcome'],
     },
     {
@@ -64,7 +64,7 @@ export const RESPONSE_PACKET_PROFILES = Object.freeze([
         includedEvidence: ['Exact URLs', 'Observation time', 'Selected HTTP, TLS, DNS, or page-identity pins', 'Contact provenance'],
         excludedEvidence: ['Raw response bodies', 'Cookies', 'Secrets', 'Unproven origin-host claims'],
         redactions: ['Remove credentials, query secrets, fragments, cookies, and unrelated contacts'],
-        attachments: ['Reviewed response packet', 'Optional normalized case report'],
+        attachments: ['Reviewed response packet', 'Optional normalised case report'],
         followUpFields: ['Provider ticket', 'Content status', 'Infrastructure change outcome'],
     },
     {
@@ -78,7 +78,7 @@ export const RESPONSE_PACKET_PROFILES = Object.freeze([
         includedEvidence: ['Exact URLs', 'Observation time', 'Selected evidence pins', 'Contact source and limitations'],
         excludedEvidence: ['Raw upstream payloads', 'Secrets', 'Unselected case notes', 'Legal conclusions'],
         redactions: ['Remove credentials, tokens, personal data, and unrelated identifiers'],
-        attachments: ['Reviewed response packet', 'Optional normalized case report'],
+        attachments: ['Reviewed response packet', 'Optional normalised case report'],
         followUpFields: ['Security reference', 'Triage acknowledgement', 'Remediation outcome'],
     },
     {
@@ -88,11 +88,11 @@ export const RESPONSE_PACKET_PROFILES = Object.freeze([
         subjectPrefix: 'Reviewed unsafe-site report',
         requiredContactKind: null,
         checklist: ['Use the recipient submission form or documented route manually', 'Include exact URLs and current observation time', 'Disclose source gaps and false-positive context'],
-        evidenceOrder: ['Exact URLs', 'Observed behavior', 'Selected corroborating evidence', 'Limitations'],
+        evidenceOrder: ['Exact URLs', 'Observed behaviour', 'Selected corroborating evidence', 'Limitations'],
         includedEvidence: ['Exact URLs', 'Observation time', 'Observed harm', 'Selected evidence pins', 'Contradictions and cautions'],
         excludedEvidence: ['Raw provider payloads', 'Secrets', 'Unselected personal data', 'Automated maliciousness claims'],
         redactions: ['Remove credentials, tokens, URL fragments, and unrelated contacts'],
-        attachments: ['Reviewed response packet', 'Optional normalized case report'],
+        attachments: ['Reviewed response packet', 'Optional normalised case report'],
         followUpFields: ['Submission reference', 'Review state', 'Listing or delisting outcome'],
     },
     {
@@ -106,7 +106,7 @@ export const RESPONSE_PACKET_PROFILES = Object.freeze([
         includedEvidence: ['Case disposition', 'Selected evidence pins', 'Analyst decisions and assertions', 'Action history', 'Exact URLs when relevant'],
         excludedEvidence: ['Raw upstream payloads', 'Secrets', 'Unselected personal data', 'Unsupported attribution'],
         redactions: ['Remove credentials, tokens, and personal data not required for the internal decision'],
-        attachments: ['Reviewed response packet', 'Normalized case report when required by internal policy'],
+        attachments: ['Reviewed response packet', 'Normalised case report when required by internal policy'],
         followUpFields: ['Internal owner', 'Due date', 'Decision', 'Control or escalation outcome'],
     },
 ]);

package/frontend/src/lib/analysis/detection-rule-model.js

@@ -245,6 +245,42 @@ export function evaluateRuleSet(records, rawRules) {
         return [];
     return records.slice(0, 500).map((record) => evaluateDetectionRules(record, rawRules));
 }
+function ruleSignature(rule) {
+    return JSON.stringify({
+        match: rule.match,
+        conditions: [...rule.conditions]
+            .map((condition) => ({ ...condition }))
+            .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right))),
+    });
+}
+export function previewDetectionRule(records, existingRules, rawCandidate) {
+    const normalized = normalizeDetectionRule({ ...record(rawCandidate), id: 'preview-rule', enabled: true });
+    if (!normalized?.id)
+        return null;
+    const candidate = { ...normalized, id: normalized.id };
+    const sourceRecords = Array.isArray(records) ? records.slice(0, 500) : [];
+    const evaluations = evaluateRuleSet(sourceRecords, [candidate]).filter((item) => item.matchedRules.length > 0);
+    const recordsById = new Map(sourceRecords.map((item) => [String(record(item).id ?? ''), record(item)]));
+    const affectedDispositionCounts = {};
+    for (const evaluation of evaluations) {
+        const disposition = String(recordsById.get(evaluation.caseId)?.disposition ?? 'unreviewed');
+        affectedDispositionCounts[disposition] = (affectedDispositionCounts[disposition] ?? 0) + 1;
+    }
+    const signature = ruleSignature(candidate);
+    const collisionRuleIds = normalizeDetectionRuleStore(existingRules).rules
+        .filter((rule) => rule.name.toLowerCase() === candidate.name.toLowerCase() || ruleSignature(rule) === signature)
+        .map((rule) => rule.id)
+        .slice(0, MAX_DETECTION_RULES);
+    return Object.freeze({
+        candidate: Object.freeze(candidate),
+        matchCount: evaluations.length,
+        affectedCaseIds: Object.freeze(evaluations.map((item) => item.caseId).filter(Boolean)),
+        affectedDispositionCounts: Object.freeze(affectedDispositionCounts),
+        unreviewedMatchCount: affectedDispositionCounts.unreviewed ?? 0,
+        collisionRuleIds: Object.freeze(collisionRuleIds),
+        limitation: 'This preview evaluates the latest bounded evidence already retained in local cases. It does not save the rule, change a score, refresh evidence, or establish whether a match is correct.',
+    });
+}
 export function mergeDetectionRules(localRaw, importedRaw) {
     const importedRecord = record(importedRaw);
     if (typeof importedRecord.schema === 'string' && importedRecord.schema !== DETECTION_RULE_SCHEMA) {

package/frontend/src/lib/analysis/evidence-coverage-ledger.js

@@ -0,0 +1,328 @@
+const MAX_ENTRIES = 24;
+const MAX_ID_LENGTH = 64;
+const MAX_LABEL_LENGTH = 120;
+const MAX_LIMITATIONS = 8;
+const MAX_LIMITATION_LENGTH = 280;
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/gu;
+const COMPLETE_STATES = new Set([
+    'available',
+    'complete',
+    'completed',
+    'observed',
+    'success',
+    'supported',
+]);
+const PARTIAL_STATES = new Set(['incomplete', 'limited', 'partial', 'truncated']);
+const SKIPPED_STATES = new Set(['disabled', 'not_applicable', 'skipped']);
+const UNAVAILABLE_STATES = new Set([
+    'blocked',
+    'error',
+    'failed',
+    'rate_limited',
+    'timeout',
+    'unavailable',
+]);
+function boundedText(value, maximum) {
+    return String(value ?? '')
+        .replace(CONTROL_CHARACTERS, ' ')
+        .replace(/\s+/gu, ' ')
+        .trim()
+        .slice(0, maximum);
+}
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function stringList(value) {
+    return Array.isArray(value) ? value.map((item) => String(item)) : [];
+}
+function rdapLimitations(rdapParsed) {
+    if (rdapParsed.serverTruncated !== true)
+        return [];
+    const reasons = stringList(rdapParsed.serverTruncationReasons).slice(0, MAX_LIMITATIONS);
+    return [
+        `The registry reported that some RDAP data was omitted.${reasons.length ? ` ${reasons.join(' · ')}.` : ''}`,
+    ];
+}
+function dnsLimitations(dnsEvidence) {
+    const limitations = stringList(dnsEvidence.limitations);
+    const failures = Object.entries(record(dnsEvidence.diagnostics))
+        .slice(0, 16)
+        .filter(([, value]) => record(value).status === 'error')
+        .map(([name, value]) => `${name.toUpperCase()}: ${record(value).error || 'query failed'}`)
+        .join(' · ');
+    return failures ? [...limitations, failures] : limitations;
+}
+function normalizeStatus(value) {
+    return boundedText(value, 64)
+        .toLowerCase()
+        .replace(/[\s-]+/gu, '_');
+}
+function normalizeLimitations(value) {
+    if (!Array.isArray(value))
+        return [];
+    const output = [];
+    const seen = new Set();
+    for (const item of value) {
+        const text = boundedText(item, MAX_LIMITATION_LENGTH);
+        if (!text || seen.has(text))
+            continue;
+        output.push(text);
+        seen.add(text);
+        if (output.length >= MAX_LIMITATIONS)
+            break;
+    }
+    return output;
+}
+function coverageState(input) {
+    const status = normalizeStatus(input.status);
+    if (status === 'not_found')
+        return 'not_found';
+    if (SKIPPED_STATES.has(status))
+        return 'skipped';
+    if (status === 'unsupported')
+        return 'unsupported';
+    if (UNAVAILABLE_STATES.has(status))
+        return 'unavailable';
+    if (input.truncated === true || input.complete === false || PARTIAL_STATES.has(status))
+        return 'partial';
+    if (COMPLETE_STATES.has(status) || (status === '' && input.complete === true))
+        return 'complete';
+    return 'unknown';
+}
+function statusLabel(state) {
+    return {
+        complete: 'Complete',
+        not_found: 'Not found',
+        partial: 'Partial',
+        skipped: 'Skipped',
+        unavailable: 'Unavailable',
+        unknown: 'Unknown',
+        unsupported: 'Unsupported',
+    }[state];
+}
+export function buildEvidenceCoverageLedger(inputs) {
+    const entries = [];
+    const seen = new Set();
+    for (const input of inputs.slice(0, MAX_ENTRIES)) {
+        const id = boundedText(input.id, MAX_ID_LENGTH).toLowerCase().replace(/[^a-z0-9_-]+/gu, '-');
+        const label = boundedText(input.label, MAX_LABEL_LENGTH);
+        if (!id || !label || seen.has(id))
+            continue;
+        seen.add(id);
+        const state = coverageState(input);
+        entries.push({
+            id,
+            label,
+            category: input.category,
+            state,
+            statusLabel: statusLabel(state),
+            truncated: input.truncated === true,
+            limitations: normalizeLimitations(input.limitations),
+            manualReviewSuggested: state === 'partial' || state === 'unavailable' || state === 'unknown',
+        });
+    }
+    const counts = {
+        complete: 0,
+        not_found: 0,
+        partial: 0,
+        skipped: 0,
+        unavailable: 0,
+        unknown: 0,
+        unsupported: 0,
+    };
+    for (const entry of entries)
+        counts[entry.state] += 1;
+    return {
+        version: 1,
+        entries,
+        counts,
+        completeCount: counts.complete,
+        limitedCount: counts.partial + counts.unavailable + counts.unknown,
+    };
+}
+export function buildLookupEvidenceCoverageLedger(input) {
+    const targetType = boundedText(input.targetType, 20);
+    const availability = record(input.availability);
+    const diagnostics = record(input.diagnostics);
+    const rdapDiagnostic = record(diagnostics.rdap);
+    const whoisDiagnostic = record(diagnostics.whois);
+    const registrarRdap = record(input.registrarRdap);
+    const reverseDns = record(input.reverseDns);
+    const observedNetworkContext = record(input.observedNetworkContext);
+    const dnsEvidence = record(input.dnsEvidence);
+    const httpEvidence = record(input.httpEvidence);
+    const httpResponse = record(input.httpResponse);
+    const tlsEvidence = record(input.tlsEvidence);
+    const pageIdentity = record(input.pageIdentity);
+    const pageRoleProfile = record(input.pageRoleProfile);
+    const clientBehaviorProfile = record(input.clientBehaviorProfile);
+    const technologyProfile = record(input.technologyProfile);
+    const securityPosture = record(input.securityPosture);
+    const securityTxt = record(input.securityTxt);
+    const sslbl = record(input.sslbl);
+    const rdapParsed = record(input.rdapParsed);
+    const whoisParsed = record(input.whoisParsed);
+    const items = [
+        {
+            id: 'rdap',
+            label: targetType === 'domain' ? 'Registry RDAP' : 'RDAP',
+            category: 'registry',
+            status: rdapDiagnostic.status,
+            truncated: rdapParsed.serverTruncated,
+            limitations: rdapLimitations(rdapParsed),
+        },
+        {
+            id: 'whois',
+            label: 'WHOIS',
+            category: 'registry',
+            status: whoisDiagnostic.status,
+            truncated: Array.isArray(whoisParsed.fieldsTruncated) && whoisParsed.fieldsTruncated.length > 0,
+            limitations: stringList(whoisParsed.limitations),
+        },
+        {
+            id: 'availability',
+            label: 'Availability decision',
+            category: 'analysis',
+            status: record(diagnostics.availability).status,
+            complete: availability.complete,
+            limitations: stringList(availability.limitations),
+        },
+    ];
+    if (registrarRdap.status) {
+        items.push({
+            id: 'registrar-rdap',
+            label: 'Registrar RDAP',
+            category: 'registry',
+            status: registrarRdap.status,
+            limitations: stringList(registrarRdap.limitations),
+        });
+    }
+    if (reverseDns.source === 'reverse_dns' || record(diagnostics.reverseDns).status) {
+        items.push({
+            id: 'reverse-dns',
+            label: 'Reverse DNS',
+            category: 'network',
+            status: reverseDns.status || record(diagnostics.reverseDns).status,
+            complete: reverseDns.complete,
+            truncated: reverseDns.truncated,
+            limitations: stringList(reverseDns.limitations),
+        });
+    }
+    if (observedNetworkContext.contextVersion === 1) {
+        items.push({
+            id: 'network-context',
+            label: 'Observed network context',
+            category: 'network',
+            status: observedNetworkContext.status,
+            complete: observedNetworkContext.complete,
+            limitations: stringList(observedNetworkContext.limitations),
+        });
+    }
+    if (targetType === 'domain') {
+        items.push({
+            id: 'dns',
+            label: 'DNS',
+            category: 'network',
+            status: dnsEvidence.status,
+            complete: dnsEvidence.complete,
+            truncated: dnsEvidence.truncated,
+            limitations: dnsLimitations(dnsEvidence),
+        }, {
+            id: 'http',
+            label: 'HTTP',
+            category: 'web',
+            status: httpEvidence.status,
+            complete: httpEvidence.complete,
+            truncated: httpResponse.bodyTruncated,
+            limitations: stringList(httpEvidence.limitations),
+        }, {
+            id: 'tls',
+            label: 'TLS',
+            category: 'web',
+            status: tlsEvidence.status,
+            complete: tlsEvidence.complete,
+            truncated: tlsEvidence.chainTruncated,
+            limitations: stringList(tlsEvidence.limitations),
+        }, {
+            id: 'page-identity',
+            label: 'Page identity',
+            category: 'web',
+            status: pageIdentity.status,
+            complete: pageIdentity.complete,
+            truncated: pageIdentity.truncated,
+            limitations: stringList(pageIdentity.limitations),
+        }, {
+            id: 'technology',
+            label: 'Technology indicators',
+            category: 'analysis',
+            status: technologyProfile.status,
+            complete: technologyProfile.complete,
+            truncated: technologyProfile.truncated,
+            limitations: stringList(technologyProfile.limitations),
+        }, {
+            id: 'page-role',
+            label: 'Page role classification',
+            category: 'analysis',
+            status: pageRoleProfile.status,
+            complete: pageRoleProfile.complete,
+            truncated: pageRoleProfile.truncated,
+            limitations: stringList(pageRoleProfile.limitations),
+        }, {
+            id: 'client-behavior',
+            label: 'Client-side behaviour indicators',
+            category: 'analysis',
+            status: clientBehaviorProfile.status,
+            complete: clientBehaviorProfile.complete,
+            truncated: clientBehaviorProfile.truncated,
+            limitations: stringList(clientBehaviorProfile.limitations),
+        }, {
+            id: 'security-posture',
+            label: 'Security posture',
+            category: 'analysis',
+            status: securityPosture.status,
+            complete: securityPosture.complete,
+            truncated: securityPosture.truncated,
+            limitations: stringList(securityPosture.limitations),
+        });
+    }
+    if (securityTxt.securityTxtVersion === 1) {
+        items.push({
+            id: 'security-txt',
+            label: 'security.txt',
+            category: 'web',
+            status: securityTxt.state,
+            limitations: stringList(securityTxt.limitations),
+        });
+    }
+    if (sslbl.sslblVersion === 1) {
+        items.push({
+            id: 'sslbl-certificate',
+            label: 'SSLBL certificate comparison',
+            category: 'external',
+            status: sslbl.status,
+            complete: sslbl.complete,
+            limitations: stringList(sslbl.limitations),
+        });
+    }
+    const providers = Array.isArray(input.threatIntelligenceProviders)
+        ? input.threatIntelligenceProviders
+        : [];
+    for (const [providerIndex, providerValue] of providers.entries()) {
+        if (items.length >= MAX_ENTRIES)
+            break;
+        const provider = record(providerValue);
+        const identity = record(provider.provider);
+        const fallback = `external-${providerIndex + 1}`;
+        const id = boundedText(identity.id || fallback, MAX_ID_LENGTH);
+        items.push({
+            id: `external-${id}`,
+            label: boundedText(identity.label || `External source ${providerIndex + 1}`, MAX_LABEL_LENGTH),
+            category: 'external',
+            status: provider.state,
+            limitations: [boundedText(provider.detail, MAX_LIMITATION_LENGTH)].filter(Boolean),
+        });
+    }
+    return buildEvidenceCoverageLedger(items);
+}