@slicedearth/whoisleuth-cli 1.36.1 → 1.43.0

package/frontend/src/lib/analysis/visualization-models.js

@@ -0,0 +1,369 @@
+import { scaleBand, scaleLinear, scalePoint } from 'd3-scale';
+import { boundedVisualizationId as boundedId, boundedVisualizationNumber as boundedNumber, boundedVisualizationText as boundedText, validVisualizationDate as validDate, } from "./visualization-bounds.js";
+export { FORCE_GRAPH_LINK_KINDS, MAX_FORCE_GRAPH_LINKS, MAX_FORCE_GRAPH_NODES, projectBoundedForceGraph, } from "./visualization-force-graph.js";
+export { MAX_VISUAL_MATRIX_COLUMNS, MAX_VISUAL_MATRIX_ROWS, projectEvidenceMatrix, } from "./visualization-matrix.js";
+export { MAX_COLLECTION_TIMING_SOURCES, MAX_LIFECYCLE_EVENTS, MAX_TREND_POINTS, projectCollectionTiming, projectLifecycleEvents, projectTrendPoints, } from "./visualization-time-series.js";
+export const MAX_REDIRECT_NODES = 9;
+export const MAX_TRIAGE_PLOT_POINTS = 300;
+export const WATCHLIST_ACTIVITY_DAYS = 28;
+export const MAX_SCORE_FACTORS = 16;
+export const MAX_COVERAGE_BAR_GROUPS = 18;
+export const MAX_MONITOR_TIMELINE_EVENTS = 12;
+export const MAX_MONITOR_TIMELINE_LANES = 6;
+function boundedScore(value) {
+    if (value === null || value === undefined || value === '')
+        return null;
+    const score = Number(value);
+    return Number.isFinite(score) ? Math.max(0, Math.min(100, score)) : null;
+}
+function redirectLabel(value) {
+    const text = boundedText(value, 320);
+    try {
+        const parsed = new URL(text);
+        const path = parsed.pathname === '/' ? '' : parsed.pathname;
+        return `${parsed.hostname}${path}`.slice(0, 72);
+    }
+    catch {
+        return text.slice(0, 72);
+    }
+}
+export function projectRedirectPath(rawRedirects) {
+    const redirects = (Array.isArray(rawRedirects) ? rawRedirects : [])
+        .slice(0, MAX_REDIRECT_NODES - 1)
+        .map((redirect) => ({
+        status: boundedText(redirect?.status, 12) || '—',
+        from: redirectLabel(redirect?.from),
+        to: redirectLabel(redirect?.to),
+        queryOmitted: Boolean(redirect?.queryOmitted),
+    }))
+        .filter((redirect) => redirect.from && redirect.to);
+    const rawCount = Array.isArray(rawRedirects) ? rawRedirects.length : 0;
+    if (!redirects.length) {
+        return { width: 900, height: 150, nodes: [], edges: [], truncated: rawCount > 0 };
+    }
+    const firstRedirect = redirects[0];
+    if (!firstRedirect) {
+        return { width: 900, height: 150, nodes: [], edges: [], truncated: rawCount > 0 };
+    }
+    const nodes = [
+        { id: 'redirect-start', label: firstRedirect.from, status: 'start', queryOmitted: false },
+        ...redirects.map((redirect, index) => ({
+            id: `redirect-${index + 1}`,
+            label: redirect.to,
+            status: redirect.status,
+            queryOmitted: redirect.queryOmitted,
+        })),
+    ];
+    const x = scalePoint().domain(nodes.map((node) => node.id)).range([62, 838]).padding(0.35);
+    const projected = nodes.map((node) => ({ ...node, x: x(node.id) ?? 450, y: 70 }));
+    const edges = redirects.flatMap((redirect, index) => {
+        const from = projected[index];
+        const to = projected[index + 1];
+        return from && to ? [{
+                id: `redirect-edge-${index}`,
+                fromX: from.x,
+                toX: to.x,
+                y: 70,
+                status: redirect.status,
+            }] : [];
+    });
+    return {
+        width: 900,
+        height: 150,
+        nodes: projected,
+        edges,
+        truncated: rawCount > redirects.length,
+    };
+}
+function deterministicSample(items, limit) {
+    const boundedLimit = Number.isFinite(limit) ? Math.max(0, Math.floor(limit)) : 0;
+    if (boundedLimit === 0)
+        return [];
+    if (items.length <= boundedLimit)
+        return items;
+    if (boundedLimit === 1)
+        return items.slice(0, 1);
+    return Array.from({ length: boundedLimit }, (_, index) => {
+        const sourceIndex = Math.round(index * (items.length - 1) / (boundedLimit - 1));
+        return items[sourceIndex];
+    }).filter((item) => item !== undefined);
+}
+export function projectTriagePoints(rawPoints) {
+    const eligible = (Array.isArray(rawPoints) ? rawPoints : [])
+        .map((point) => ({
+        domain: boundedText(point?.domain, 253).toLowerCase(),
+        risk: boundedScore(point?.risk),
+        opportunity: boundedScore(point?.opportunity),
+        availability: boundedText(point?.availability, 30).toLowerCase() || 'unknown',
+        trusted: Boolean(point?.trusted),
+    }))
+        .filter((point) => point.domain && point.risk !== null && point.opportunity !== null)
+        .sort((a, b) => a.domain.localeCompare(b.domain));
+    const sampled = deterministicSample(eligible, MAX_TRIAGE_PLOT_POINTS);
+    const quadrants = eligible.reduce((counts, point) => {
+        if (point.risk >= 50) {
+            if (point.opportunity >= 50)
+                counts.priorityReview += 1;
+            else
+                counts.riskLedReview += 1;
+        }
+        else if (point.opportunity >= 50) {
+            counts.availableReview += 1;
+        }
+        else {
+            counts.lowerScores += 1;
+        }
+        return counts;
+    }, {
+        availableReview: 0,
+        priorityReview: 0,
+        lowerScores: 0,
+        riskLedReview: 0,
+    });
+    const x = scaleLinear().domain([0, 100]).range([58, 842]).clamp(true);
+    const y = scaleLinear().domain([0, 100]).range([308, 28]).clamp(true);
+    const points = sampled.map((point) => ({
+        ...point,
+        risk: point.risk,
+        opportunity: point.opportunity,
+        x: x(point.risk),
+        y: y(point.opportunity),
+        tone: point.trusted
+            ? 'trusted'
+            : point.availability === 'available'
+                ? 'available'
+                : point.availability === 'error'
+                    ? 'error'
+                    : 'registered',
+    }));
+    return {
+        width: 900,
+        height: 360,
+        points,
+        eligibleCount: eligible.length,
+        omittedCount: Math.max(0, (Array.isArray(rawPoints) ? rawPoints.length : 0) - eligible.length),
+        sampled: eligible.length > sampled.length,
+        quadrants,
+    };
+}
+function utcDayKey(milliseconds) {
+    return new Date(milliseconds).toISOString().slice(0, 10);
+}
+export function projectWatchlistActivity(rawEvents) {
+    const valid = (Array.isArray(rawEvents) ? rawEvents : [])
+        .map((event) => {
+        const date = validDate(event?.checkedAt);
+        if (!date)
+            return null;
+        const changeCount = Math.max(0, Math.min(10_000, Math.trunc(Number(event.changeCount) || 0)));
+        const resultCount = Math.max(0, Math.min(10_000, Math.trunc(Number(event.resultCount) || 0)));
+        const conclusiveCount = Math.max(0, Math.min(resultCount, Math.trunc(Number(event.conclusiveCount) || 0)));
+        return { ...date, changeCount, resultCount, conclusiveCount };
+    })
+        .filter((event) => Boolean(event));
+    if (!valid.length) {
+        return { width: 620, height: 190, days: [], maxChanges: 0, totalChecks: 0, totalChanges: 0 };
+    }
+    const latest = Math.max(...valid.map((event) => event.milliseconds));
+    const latestDay = Date.UTC(new Date(latest).getUTCFullYear(), new Date(latest).getUTCMonth(), new Date(latest).getUTCDate());
+    const start = latestDay - (WATCHLIST_ACTIVITY_DAYS - 1) * 86_400_000;
+    const windowEnd = latestDay + 86_400_000;
+    const windowEvents = valid.filter((event) => event.milliseconds >= start && event.milliseconds < windowEnd);
+    const byDay = new Map();
+    for (const event of windowEvents) {
+        const key = utcDayKey(event.milliseconds);
+        const current = byDay.get(key) ?? { checks: 0, changes: 0, results: 0, conclusive: 0 };
+        current.checks += 1;
+        current.changes += event.changeCount;
+        current.results += event.resultCount;
+        current.conclusive += event.conclusiveCount;
+        byDay.set(key, current);
+    }
+    const weekScale = scaleBand().domain([0, 1, 2, 3]).range([72, 580]).padding(0.12);
+    const dayScale = scaleBand().domain([0, 1, 2, 3, 4, 5, 6]).range([26, 165]).padding(0.12);
+    const dayWidth = weekScale.bandwidth();
+    const dayHeight = dayScale.bandwidth();
+    const days = Array.from({ length: WATCHLIST_ACTIVITY_DAYS }, (_, index) => {
+        const milliseconds = start + index * 86_400_000;
+        const key = utcDayKey(milliseconds);
+        const activity = byDay.get(key) ?? { checks: 0, changes: 0, results: 0, conclusive: 0 };
+        return {
+            date: key,
+            label: new Date(milliseconds).toLocaleDateString('en-AU', { day: 'numeric', month: 'short', timeZone: 'UTC' }),
+            week: Math.floor(index / 7),
+            weekday: index % 7,
+            x: weekScale(Math.floor(index / 7)) ?? 0,
+            y: dayScale(index % 7) ?? 0,
+            width: dayWidth,
+            height: dayHeight,
+            ...activity,
+        };
+    });
+    return {
+        width: 620,
+        height: 190,
+        days,
+        maxChanges: Math.max(0, ...days.map((day) => day.changes)),
+        totalChecks: windowEvents.length,
+        totalChanges: windowEvents.reduce((sum, event) => sum + event.changeCount, 0),
+    };
+}
+export function projectScoreFactors(rawFactors) {
+    const candidates = (Array.isArray(rawFactors) ? rawFactors : [])
+        .map((factor, index) => ({
+        id: `${boundedId(factor?.label) || 'factor'}-${index}`,
+        label: boundedText(factor?.label, 56) || `Factor ${index + 1}`,
+        delta: boundedNumber(factor?.delta, -100, 100),
+    }));
+    const factors = candidates.slice(0, MAX_SCORE_FACTORS);
+    const maximum = Math.max(1, ...factors.map((factor) => Math.abs(factor.delta)));
+    const x = scaleLinear().domain([-maximum, maximum]).range([220, 860]).clamp(true);
+    const zeroX = x(0);
+    const rowHeight = 28;
+    return {
+        width: 900,
+        height: Math.max(74, 42 + factors.length * rowHeight),
+        zeroX,
+        maximum,
+        factors: factors.map((factor, index) => {
+            const valueX = x(factor.delta);
+            return {
+                ...factor,
+                x: Math.min(zeroX, valueX),
+                width: factor.delta === 0 ? 0 : Math.max(2, Math.abs(valueX - zeroX)),
+                y: 24 + index * rowHeight,
+            };
+        }),
+        truncated: candidates.length > factors.length,
+    };
+}
+export function projectCoverageBars(rawGroups) {
+    const candidates = (Array.isArray(rawGroups) ? rawGroups : [])
+        .map((group, index) => {
+        const values = {
+            protected: Math.trunc(boundedNumber(group?.protected, 0, 100_000)),
+            registered: Math.trunc(boundedNumber(group?.registered, 0, 100_000)),
+            available: Math.trunc(boundedNumber(group?.available, 0, 100_000)),
+            unknown: Math.trunc(boundedNumber(group?.unknown, 0, 100_000)),
+        };
+        return {
+            id: boundedId(group?.id) || `group-${index}`,
+            label: boundedText(group?.label, 56) || `Group ${index + 1}`,
+            ...values,
+            total: Object.values(values).reduce((sum, value) => sum + value, 0),
+        };
+    })
+        .filter((group) => group.total > 0)
+        .sort((a, b) => b.total - a.total || a.label.localeCompare(b.label));
+    const groups = candidates.slice(0, MAX_COVERAGE_BAR_GROUPS);
+    const maximum = Math.max(1, ...groups.map((group) => group.total));
+    const x = scaleLinear().domain([0, maximum]).range([210, 860]).clamp(true);
+    const rowHeight = 31;
+    return {
+        width: 900,
+        height: Math.max(76, 40 + groups.length * rowHeight),
+        groups: groups.map((group, index) => {
+            let offset = 0;
+            const segments = ['protected', 'registered', 'available', 'unknown'].map((state) => {
+                const value = group[state];
+                const start = offset;
+                offset += value;
+                return {
+                    state,
+                    value,
+                    x: x(start),
+                    width: Math.max(value ? 1 : 0, x(offset) - x(start)),
+                };
+            });
+            return { ...group, y: 20 + index * rowHeight, segments };
+        }),
+        truncated: candidates.length > groups.length,
+    };
+}
+export function projectMonitorTimeline(rawEvents) {
+    const candidates = (Array.isArray(rawEvents) ? rawEvents : [])
+        .map((event, index) => {
+        const date = validDate(event?.checkedAt);
+        const id = boundedId(event?.id) || `event-${index}`;
+        if (!date)
+            return null;
+        return {
+            id,
+            checkedAt: date.text,
+            milliseconds: date.milliseconds,
+            mode: boundedText(event?.mode, 20).toLowerCase() || 'saved',
+            groups: (Array.isArray(event.groups) ? event.groups : [])
+                .map((group) => ({
+                key: boundedId(group?.key),
+                label: boundedText(group?.label, 40),
+                changeCount: Math.trunc(boundedNumber(group?.changeCount, 0, 10_000)),
+            }))
+                .filter((group) => group.key && group.label),
+        };
+    })
+        .filter((event) => Boolean(event))
+        .sort((a, b) => a.milliseconds - b.milliseconds || a.id.localeCompare(b.id));
+    const events = candidates.slice(-MAX_MONITOR_TIMELINE_EVENTS);
+    const laneMap = new Map();
+    for (const event of events) {
+        for (const group of event.groups) {
+            if (!laneMap.has(group.key) && laneMap.size < MAX_MONITOR_TIMELINE_LANES) {
+                laneMap.set(group.key, group.label);
+            }
+        }
+    }
+    const lanes = [...laneMap].map(([key, label]) => ({ key, label }));
+    const x = scaleBand().domain(events.map((event) => event.id)).range([170, 865]).padding(0.18);
+    const y = scaleBand().domain(lanes.map((lane) => lane.key)).range([42, 42 + lanes.length * 40]).padding(0.18);
+    const maxChanges = Math.max(1, ...events.flatMap((event) => event.groups.map((group) => group.changeCount)));
+    return {
+        width: 900,
+        height: Math.max(110, 64 + lanes.length * 40),
+        maxChanges,
+        events: events.map((event) => ({
+            ...event,
+            x: x(event.id) ?? 170,
+            width: x.bandwidth(),
+            cells: lanes.map((lane) => ({
+                key: lane.key,
+                label: lane.label,
+                count: event.groups.find((group) => group.key === lane.key)?.changeCount ?? 0,
+                y: y(lane.key) ?? 42,
+                height: y.bandwidth(),
+            })),
+        })),
+        lanes: lanes.map((lane) => ({ ...lane, y: y(lane.key) ?? 42, height: y.bandwidth() })),
+        truncated: candidates.length > events.length
+            || events.some((event) => event.groups.some((group) => !laneMap.has(group.key))),
+    };
+}
+export function projectCertificateValidity(input) {
+    const validFrom = validDate(input.validFrom);
+    const validTo = validDate(input.validTo);
+    const observed = validDate(input.observedAt);
+    if (!validFrom || !validTo || validTo.milliseconds <= validFrom.milliseconds) {
+        return { available: false, width: 900, height: 110 };
+    }
+    const observedMilliseconds = observed?.milliseconds ?? validFrom.milliseconds;
+    const span = validTo.milliseconds - validFrom.milliseconds;
+    const padding = Math.max(86_400_000, span * 0.08);
+    const x = scaleLinear()
+        .domain([validFrom.milliseconds - padding, validTo.milliseconds + padding])
+        .range([72, 828])
+        .clamp(true);
+    return {
+        available: true,
+        width: 900,
+        height: 110,
+        validFrom: validFrom.text,
+        validTo: validTo.text,
+        observedAt: observed?.text ?? '',
+        hasObservation: Boolean(observed),
+        fromX: x(validFrom.milliseconds),
+        toX: x(validTo.milliseconds),
+        observedX: x(observedMilliseconds),
+        observedWithinValidity: observedMilliseconds >= validFrom.milliseconds
+            && observedMilliseconds <= validTo.milliseconds,
+        elapsedPercent: Math.max(0, Math.min(100, ((observedMilliseconds - validFrom.milliseconds) / span) * 100)),
+    };
+}

package/frontend/src/lib/analysis/visualization-time-series.js

@@ -0,0 +1,144 @@
+import { scaleLinear, scalePoint } from 'd3-scale';
+import { boundedVisualizationId as boundedId, boundedVisualizationNumber as boundedNumber, boundedVisualizationText as boundedText, validVisualizationDate as validDate, } from "./visualization-bounds.js";
+export const MAX_LIFECYCLE_EVENTS = 8;
+export const MAX_COLLECTION_TIMING_SOURCES = 16;
+export const MAX_TREND_POINTS = 24;
+export function projectLifecycleEvents(rawEvents) {
+    const seen = new Set();
+    const candidates = (Array.isArray(rawEvents) ? rawEvents : [])
+        .map((event) => {
+        const id = boundedId(event?.id);
+        const label = boundedText(event?.label, 40);
+        const date = validDate(event?.date);
+        if (!id || !label || !date)
+            return null;
+        const kind = event.kind === 'certificate' || event.kind === 'observation'
+            ? event.kind
+            : 'registry';
+        return {
+            id,
+            label,
+            date: date.text,
+            milliseconds: date.milliseconds,
+            detail: boundedText(event.detail, 100),
+            kind,
+        };
+    })
+        .filter((event) => Boolean(event))
+        .sort((a, b) => a.milliseconds - b.milliseconds || a.id.localeCompare(b.id))
+        .filter((event) => {
+        if (seen.has(event.id))
+            return false;
+        seen.add(event.id);
+        return true;
+    });
+    const accepted = candidates.slice(0, MAX_LIFECYCLE_EVENTS);
+    const x = scalePoint()
+        .domain(accepted.map((event) => event.id))
+        .range([70, 830])
+        .padding(accepted.length > 1 ? 0.35 : 0.5);
+    const laneY = [48, 158, 27];
+    const events = accepted.map((event, index) => ({
+        ...event,
+        x: x(event.id) ?? 450,
+        labelY: laneY[index % laneY.length] ?? 102,
+        anchor: index === 0 ? 'start' : index === accepted.length - 1 ? 'end' : 'middle',
+    }));
+    return {
+        width: 900,
+        height: 205,
+        axisY: 102,
+        events,
+        truncated: candidates.length > accepted.length,
+    };
+}
+export function projectCollectionTiming(rawSources, rawTotalMs) {
+    const candidates = (Array.isArray(rawSources) ? rawSources : [])
+        .map((source, index) => {
+        const id = boundedId(source?.source) || `source-${index}`;
+        const durationMs = boundedNumber(source?.durationMs, 0, 300_000);
+        const completedAfterMs = boundedNumber(source?.completedAfterMs, 0, 300_000);
+        return {
+            id,
+            label: boundedText(source?.source, 48) || `Source ${index + 1}`,
+            outcome: boundedText(source?.outcome, 24).toLowerCase() || 'unknown',
+            durationMs,
+            completedAfterMs,
+            startedAfterMs: Math.max(0, completedAfterMs - durationMs),
+        };
+    })
+        .sort((a, b) => a.completedAfterMs - b.completedAfterMs || a.id.localeCompare(b.id));
+    const sources = candidates.slice(0, MAX_COLLECTION_TIMING_SOURCES);
+    const longestSource = [...sources]
+        .sort((a, b) => b.durationMs - a.durationMs
+        || b.completedAfterMs - a.completedAfterMs
+        || a.id.localeCompare(b.id))[0] ?? null;
+    const lastSettledSource = sources.at(-1) ?? null;
+    const requestErrorCount = sources.filter((source) => source.outcome === 'rejected').length;
+    const totalMs = Math.max(1, boundedNumber(rawTotalMs, 0, 300_000), ...sources.map((source) => source.completedAfterMs));
+    const x = scaleLinear().domain([0, totalMs]).range([190, 860]).clamp(true);
+    const rowHeight = 30;
+    return {
+        width: 900,
+        height: Math.max(92, 50 + sources.length * rowHeight),
+        totalMs,
+        longestSource,
+        lastSettledSource,
+        requestErrorCount,
+        ticks: x.ticks(5).map((value) => ({ value, x: x(value) })),
+        sources: sources.map((source, index) => ({
+            ...source,
+            x: x(source.startedAfterMs),
+            width: Math.max(3, x(source.completedAfterMs) - x(source.startedAfterMs)),
+            y: 30 + index * rowHeight,
+        })),
+        truncated: candidates.length > sources.length,
+    };
+}
+export function projectTrendPoints(rawPoints) {
+    const seen = new Set();
+    const candidates = (Array.isArray(rawPoints) ? rawPoints : [])
+        .map((point, index) => {
+        const date = validDate(point?.date);
+        const id = boundedId(point?.id) || `point-${index}`;
+        if (!date || seen.has(id))
+            return null;
+        seen.add(id);
+        return {
+            id,
+            date: date.text,
+            milliseconds: date.milliseconds,
+            total: Math.trunc(boundedNumber(point?.total, 0, 100_000)),
+            added: Math.trunc(boundedNumber(point?.added, 0, 100_000)),
+            partial: Boolean(point?.partial),
+        };
+    })
+        .filter((point) => Boolean(point))
+        .sort((a, b) => a.milliseconds - b.milliseconds || a.id.localeCompare(b.id));
+    const points = candidates.slice(-MAX_TREND_POINTS);
+    const x = scalePoint().domain(points.map((point) => point.id)).range([64, 850]).padding(0.45);
+    const maximum = Math.max(1, ...points.map((point) => point.total));
+    const y = scaleLinear().domain([0, maximum]).range([190, 24]).nice().clamp(true);
+    const first = points[0] ?? null;
+    const latest = points.at(-1) ?? null;
+    return {
+        width: 900,
+        height: 225,
+        maximum,
+        ticks: y.ticks(4).map((value) => ({ value, y: y(value) })),
+        points: points.map((point) => ({
+            ...point,
+            x: x(point.id) ?? 450,
+            y: y(point.total),
+            addedY: y(point.added),
+        })),
+        summary: {
+            firstTotal: first?.total ?? 0,
+            latestTotal: latest?.total ?? 0,
+            peakTotal: points.reduce((peak, point) => Math.max(peak, point.total), 0),
+            newlyObserved: points.reduce((total, point) => total + point.added, 0),
+            partialChecks: points.filter((point) => point.partial).length,
+        },
+        truncated: candidates.length > points.length,
+    };
+}

package/frontend/src/lib/analysis/workspace-archive-crypto.js

@@ -137,7 +137,7 @@ function validateEnvelope(raw) {
         throw new Error('The encrypted workspace archive declares an unsupported cipher contract.');
     }
     const salt = decodeBase64url(kdf.salt, SALT_BYTES, 'salt');
-    const iv = decodeBase64url(cipher.iv, IV_BYTES, 'initialization vector');
+    const iv = decodeBase64url(cipher.iv, IV_BYTES, 'initialisation vector');
     if (typeof value.ciphertext !== 'string' || value.ciphertext.length > MAX_CIPHERTEXT_BASE64URL_CHARACTERS) {
         throw new Error('The encrypted workspace archive ciphertext exceeds its byte limit.');
     }

package/frontend/src/lib/analysis/workspace-archive.js

@@ -48,7 +48,7 @@ function record(value) {
 function byteLength(value) {
     return new TextEncoder().encode(value).byteLength;
 }
-function serialize(value, message = 'The workspace archive contains data that cannot be serialized.') {
+function serialize(value, message = 'The workspace archive contains data that cannot be serialised.') {
     try {
         const serialized = JSON.stringify(value);
         if (typeof serialized !== 'string')
@@ -340,6 +340,7 @@ export async function readWorkspaceArchive(raw, options = {}) {
         }
         throw new Error(`Expected workspace archive schema 1, 2, 3, 4, or ${WORKSPACE_ARCHIVE_VERSION}.`);
     }
+    const sourceVersion = value.version;
     const { bytes } = ensureArchiveBudget(value);
     const manifest = record(value.manifest);
     const sectionValues = record(value.sections);
@@ -370,7 +371,7 @@ export async function readWorkspaceArchive(raw, options = {}) {
         let reason = '';
         if (!definition) {
             status = 'unsupported';
-            reason = 'This app does not recognize the archive section.';
+            reason = 'This app does not recognise the archive section.';
         }
         else if (entry.version !== definition.version || entry.schema !== definition.schema) {
             status = 'unsupported';
@@ -394,6 +395,7 @@ export async function readWorkspaceArchive(raw, options = {}) {
     return {
         schema: WORKSPACE_ARCHIVE_SCHEMA,
         version: WORKSPACE_ARCHIVE_VERSION,
+        sourceVersion,
         generatedAt: timestamp(value.generatedAt),
         bytes,
         sections,

package/lib/abusech-auth.mjs

@@ -16,4 +16,4 @@ function abusechAuthKey(env = process.env) {
     return normalizeAbusechAuthKey(source.ABUSECH_AUTH_KEY)
         || normalizeAbusechAuthKey(source.URLHAUS_AUTH_KEY);
 }
-export { MAX_ABUSECH_AUTH_KEY_LENGTH, normalizeAbusechAuthKey, abusechAuthKey, };
+export { abusechAuthKey, };

package/lib/analyst-taxonomy.mjs

@@ -0,0 +1,40 @@
+// Deliberately small interoperability projection over reviewed MISP
+// taxonomies. WHOISleuth retains its own bounded workflow vocabulary and
+// derives machine tags only when an analyst-owned disposition and reason make
+// the mapping unambiguous. These tags never alter collection or scoring.
+const ANALYST_REVIEW_REASONS = Object.freeze([
+    Object.freeze({ value: '', label: 'Not recorded' }),
+    Object.freeze({ value: 'authorized_or_owned', label: 'Authorised or owned domain' }),
+    Object.freeze({ value: 'shared_infrastructure', label: 'Shared infrastructure explained the signal' }),
+    Object.freeze({ value: 'generic_platform_or_template', label: 'Generic platform or template' }),
+    Object.freeze({ value: 'parked_or_reseller', label: 'Parking or reseller page' }),
+    Object.freeze({ value: 'insufficient_evidence', label: 'Insufficient evidence' }),
+    Object.freeze({ value: 'legitimate_third_party', label: 'Legitimate third party' }),
+    Object.freeze({ value: 'confirmed_credential_abuse', label: 'Confirmed credential abuse' }),
+    Object.freeze({ value: 'confirmed_malware', label: 'Confirmed malware' }),
+    Object.freeze({ value: 'other_reviewed', label: 'Other reviewed reason' }),
+]);
+const ANALYST_REVIEW_REASON_VALUES = new Set(ANALYST_REVIEW_REASONS.map(({ value }) => value).filter(Boolean));
+const MISP_TAXONOMY_REFERENCES = Object.freeze([
+    Object.freeze({ namespace: 'domain-abuse', version: 2, sourceSha256: '5fcfb44742daac97061726faaaadd2ce6b7eac55306acaae3d30c3882d18f991', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/domain-abuse/machinetag.json' }),
+    Object.freeze({ namespace: 'estimative-language', version: 5, sourceSha256: '1010927d396f66f7cc58a229ebb8af6ad2cdc0250ad5f8ce3b1bd9aacf5ab4da', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/estimative-language/machinetag.json' }),
+    Object.freeze({ namespace: 'event-assessment', version: 2, sourceSha256: '39291bdd50e1b2975a93e33e396f42b398178015580a84402bc3d8d549dd721e', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/event-assessment/machinetag.json' }),
+    Object.freeze({ namespace: 'false-positive', version: 7, sourceSha256: 'ffc8d35ae36eb1d39f33611d1090793021f2bfe3b4b31ae41631e22cf544a2fb', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/false-positive/machinetag.json' }),
+    Object.freeze({ namespace: 'phishing', version: 5, sourceSha256: '8628ebe4d5935216a7b006a4d975669c4ae1a554ef8ed78ffaadd62f763d7263', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/phishing/machinetag.json' }),
+]);
+function analystInteroperabilityTags(disposition, reviewReasonCode) {
+    const tags = new Set();
+    if (disposition === 'false_positive')
+        tags.add('false-positive:confirmed="true"');
+    if ((disposition === 'false_positive' || disposition === 'expected')
+        && ['authorized_or_owned', 'shared_infrastructure', 'generic_platform_or_template', 'parked_or_reseller', 'legitimate_third_party'].includes(String(reviewReasonCode)))
+        tags.add('false-positive:risk="high"');
+    if (reviewReasonCode === 'insufficient_evidence') {
+        tags.add('estimative-language:confidence-in-analytic-judgment="low"');
+    }
+    if (disposition === 'confirmed_abuse' && reviewReasonCode === 'confirmed_credential_abuse') {
+        tags.add('phishing:techniques="fake-website"');
+    }
+    return [...tags].sort();
+}
+export { ANALYST_REVIEW_REASONS, ANALYST_REVIEW_REASON_VALUES, MISP_TAXONOMY_REFERENCES, analystInteroperabilityTags, };

package/lib/availability.mjs

@@ -237,7 +237,7 @@ async function fetchHomepage(domain, { fetcher = safeFetchDetailed } = {}) {
                     technologyHeaders: {
                         'cf-ray': res.headers.get('cf-ray') || '',
                         'x-drupal-cache': res.headers.get('x-drupal-cache') || '',
-                        'x-fastly-request-id': res.headers.get('x-fastly-request-id') || '',
+                        'x-served-by': res.headers.get('x-served-by') || '',
                         'x-powered-by': res.headers.get('x-powered-by') || '',
                         'x-shopify-stage': res.headers.get('x-shopify-stage') || '',
                         'x-sorting-hat-podid': res.headers.get('x-sorting-hat-podid') || '',
@@ -309,7 +309,7 @@ function registryPolicyDetail(domain, fast) {
     const whoisAdmission = fast ? null : registryServiceAdmissionFor(domain, 'whois');
     if (whoisAdmission && !whoisAdmission.allowed) {
         details.push(whoisAdmission.state === 'permission_required'
-            ? 'WHOIS was not queried because registry permission or source authorization is required.'
+            ? 'WHOIS was not queried because registry permission or source authorisation is required.'
             : 'WHOIS was not queried because IANA publishes no domain WHOIS service for this suffix.');
     }
     return details.length ? ` ${details.join(' ')}` : '';

package/lib/bounded-contract-normalizers.mjs

@@ -1,9 +1,16 @@
 // Shared strict primitives for internal evidence contracts. These helpers do
 // not infer missing values and keep every string, object, enum, and counter
 // bounded before a provider or connector result reaches its public model.
+import { domainToASCII } from 'node:url';
 export function isRecord(value) {
     return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
+export function recordOrNull(value) {
+    return isRecord(value) ? value : null;
+}
+export function recordOrEmpty(value) {
+    return isRecord(value) ? value : {};
+}
 export function boundedString(value, maxLength) {
     if (typeof value !== 'string' || /[\u0000-\u001f\u007f]/u.test(value))
         return null;
@@ -59,3 +66,29 @@ export function boundedInteger(value, minimum, maximum, label) {
     }
     return value;
 }
+export function requireRecord(value, label) {
+    if (!isRecord(value))
+        throw new TypeError(`${label} must be an object.`);
+    return value;
+}
+export function requireBoundedString(value, label, maxLength) {
+    const normalised = strictBoundedString(value, maxLength);
+    if (!normalised) {
+        throw new TypeError(`${label} must contain from 1 to ${maxLength} characters without control characters.`);
+    }
+    return normalised;
+}
+export function requireIsoTimestamp(value, label) {
+    const normalised = isoTimestamp(value);
+    if (!normalised)
+        throw new TypeError(`${label} must be a valid timestamp.`);
+    return normalised;
+}
+export function requireDomainName(value, label, noun = 'domain name') {
+    const supplied = requireBoundedString(value, label, 253).toLowerCase().replace(/\.$/u, '');
+    const ascii = domainToASCII(supplied);
+    if (!ascii || !ascii.includes('.') || ascii.length > 253 || ascii.split('.').some((part) => (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(part)))) {
+        throw new TypeError(`${label} must be a valid ${noun}.`);
+    }
+    return ascii;
+}