@slicedearth/whoisleuth-cli 1.39.1 → 1.43.0

package/frontend/src/lib/analysis/detection-rule-model.js

@@ -245,6 +245,42 @@ export function evaluateRuleSet(records, rawRules) {
         return [];
     return records.slice(0, 500).map((record) => evaluateDetectionRules(record, rawRules));
 }
+function ruleSignature(rule) {
+    return JSON.stringify({
+        match: rule.match,
+        conditions: [...rule.conditions]
+            .map((condition) => ({ ...condition }))
+            .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right))),
+    });
+}
+export function previewDetectionRule(records, existingRules, rawCandidate) {
+    const normalized = normalizeDetectionRule({ ...record(rawCandidate), id: 'preview-rule', enabled: true });
+    if (!normalized?.id)
+        return null;
+    const candidate = { ...normalized, id: normalized.id };
+    const sourceRecords = Array.isArray(records) ? records.slice(0, 500) : [];
+    const evaluations = evaluateRuleSet(sourceRecords, [candidate]).filter((item) => item.matchedRules.length > 0);
+    const recordsById = new Map(sourceRecords.map((item) => [String(record(item).id ?? ''), record(item)]));
+    const affectedDispositionCounts = {};
+    for (const evaluation of evaluations) {
+        const disposition = String(recordsById.get(evaluation.caseId)?.disposition ?? 'unreviewed');
+        affectedDispositionCounts[disposition] = (affectedDispositionCounts[disposition] ?? 0) + 1;
+    }
+    const signature = ruleSignature(candidate);
+    const collisionRuleIds = normalizeDetectionRuleStore(existingRules).rules
+        .filter((rule) => rule.name.toLowerCase() === candidate.name.toLowerCase() || ruleSignature(rule) === signature)
+        .map((rule) => rule.id)
+        .slice(0, MAX_DETECTION_RULES);
+    return Object.freeze({
+        candidate: Object.freeze(candidate),
+        matchCount: evaluations.length,
+        affectedCaseIds: Object.freeze(evaluations.map((item) => item.caseId).filter(Boolean)),
+        affectedDispositionCounts: Object.freeze(affectedDispositionCounts),
+        unreviewedMatchCount: affectedDispositionCounts.unreviewed ?? 0,
+        collisionRuleIds: Object.freeze(collisionRuleIds),
+        limitation: 'This preview evaluates the latest bounded evidence already retained in local cases. It does not save the rule, change a score, refresh evidence, or establish whether a match is correct.',
+    });
+}
 export function mergeDetectionRules(localRaw, importedRaw) {
     const importedRecord = record(importedRaw);
     if (typeof importedRecord.schema === 'string' && importedRecord.schema !== DETECTION_RULE_SCHEMA) {

package/frontend/src/lib/analysis/external-findings-import.js

@@ -0,0 +1,320 @@
+import { normalizeDomain, openOrCreateCase, updateCase, } from "./case-model.js";
+export const EXTERNAL_FINDINGS_SCHEMA = 'whoisleuth.external-findings';
+export const EXTERNAL_FINDINGS_VERSION = 3;
+export const MAX_EXTERNAL_FINDINGS_IMPORT_BYTES = 384 * 1024;
+export const MAX_EXTERNAL_FINDINGS = 100;
+export const MAX_EXTERNAL_FINDINGS_PER_DOMAIN = 20;
+export const MAX_EXTERNAL_FINDING_DOMAINS = 25;
+export const EXTERNAL_FINDING_CATEGORIES = [
+    'certificate',
+    'dns',
+    'http',
+    'malware',
+    'other',
+    'page',
+    'registration',
+    'reputation',
+];
+const CATEGORIES = new Set(EXTERNAL_FINDING_CATEGORIES);
+const COMPLETENESS = new Set(['complete', 'inconclusive', 'partial', 'unknown']);
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+const ROOT_KEYS = new Set(['schema', 'schemaVersion', 'source', 'findings']);
+const SOURCE_KEYS = new Set(['name', 'reference', 'collectedAt']);
+const FINDING_KEYS = new Set([
+    'domain',
+    'category',
+    'evidenceClass',
+    'summary',
+    'observedAt',
+    'completeness',
+    'limitations',
+    'reference',
+    'structuredObservation',
+]);
+const STRUCTURED_OBSERVATION_KEYS = new Set([
+    'sourceSchema',
+    'sourceVersion',
+    'field',
+    'value',
+    'issuer',
+    'notAfter',
+]);
+const STRUCTURED_OBSERVATION_SCHEMAS = new Set([
+    'whoisleuth.domain-observation-rows',
+    'whoisleuth.dns-observation-rows',
+    'whoisleuth.certificate-observation-rows',
+]);
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function hasOnlyKeys(value, allowed) {
+    return Object.keys(value).every((key) => allowed.has(key));
+}
+function requiredText(value, maximum, label) {
+    if (typeof value !== 'string'
+        || !value.trim()
+        || value.length > maximum
+        || CONTROL_RE.test(value)) {
+        throw new Error(`${label} must be non-empty, bounded text without control characters.`);
+    }
+    return value.trim();
+}
+function optionalText(value, maximum, label) {
+    if (value === undefined || value === null || value === '')
+        return null;
+    return requiredText(value, maximum, label);
+}
+function iso(value, label, optional = false) {
+    if (optional && (value === undefined || value === null || value === ''))
+        return null;
+    const text = requiredText(value, 64, label);
+    const parsed = Date.parse(text);
+    if (!Number.isFinite(parsed))
+        throw new Error(`${label} must be a valid date and time.`);
+    return new Date(parsed).toISOString();
+}
+function limitations(value, index) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.length > 8) {
+        throw new Error(`Finding ${index + 1} limitations must be an array with no more than 8 entries.`);
+    }
+    const unique = new Set();
+    for (const item of value)
+        unique.add(requiredText(item, 240, `Finding ${index + 1} limitation`));
+    return [...unique];
+}
+function structuredObservation(value, index) {
+    if (value === undefined || value === null)
+        return null;
+    const item = record(value);
+    if (!item || !hasOnlyKeys(item, STRUCTURED_OBSERVATION_KEYS)) {
+        throw new Error(`Finding ${index + 1} structured observation has an invalid shape or additional fields.`);
+    }
+    if (typeof item.sourceSchema !== 'string' || !STRUCTURED_OBSERVATION_SCHEMAS.has(item.sourceSchema)) {
+        throw new Error(`Finding ${index + 1} structured observation source schema is unsupported.`);
+    }
+    if (item.sourceVersion !== 1) {
+        throw new Error(`Finding ${index + 1} structured observation source version is unsupported.`);
+    }
+    const field = requiredText(item.field, 40, `Finding ${index + 1} structured observation field`);
+    const observationValue = requiredText(item.value, 500, `Finding ${index + 1} structured observation value`);
+    const issuer = optionalText(item.issuer, 160, `Finding ${index + 1} certificate issuer`);
+    const notAfter = iso(item.notAfter, `Finding ${index + 1} certificate expiry`, true);
+    const certificateSchema = item.sourceSchema === 'whoisleuth.certificate-observation-rows';
+    if (!certificateSchema && (issuer !== null || notAfter !== null)) {
+        throw new Error(`Finding ${index + 1} non-certificate observation cannot declare certificate metadata.`);
+    }
+    return {
+        sourceSchema: item.sourceSchema,
+        sourceVersion: 1,
+        field,
+        value: observationValue,
+        issuer,
+        notAfter,
+    };
+}
+function findingKey(finding, sourceName) {
+    return [
+        finding.domain,
+        finding.category,
+        finding.evidenceClass,
+        finding.summary,
+        finding.observedAt,
+        finding.completeness,
+        sourceName,
+    ].join('\u0000');
+}
+export function parseExternalFindingsDocument(value) {
+    const root = record(value);
+    if (!root || !hasOnlyKeys(root, ROOT_KEYS)) {
+        throw new Error('External findings must use the documented object shape without additional top-level fields.');
+    }
+    if (root.schema !== EXTERNAL_FINDINGS_SCHEMA
+        || ![1, 2, EXTERNAL_FINDINGS_VERSION].includes(Number(root.schemaVersion))) {
+        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version 1, 2, or ${EXTERNAL_FINDINGS_VERSION}.`);
+    }
+    const sourceValue = record(root.source);
+    if (!sourceValue || !hasOnlyKeys(sourceValue, SOURCE_KEYS)) {
+        throw new Error('External findings require a bounded source object without additional fields.');
+    }
+    const source = {
+        name: requiredText(sourceValue.name, 80, 'Source name'),
+        reference: optionalText(sourceValue.reference, 500, 'Source reference'),
+        collectedAt: iso(sourceValue.collectedAt, 'Source collection time', true),
+    };
+    if (!Array.isArray(root.findings) || !root.findings.length || root.findings.length > MAX_EXTERNAL_FINDINGS) {
+        throw new Error(`External findings must contain between 1 and ${MAX_EXTERNAL_FINDINGS} findings.`);
+    }
+    const normalized = [];
+    const seen = new Set();
+    const domainCounts = new Map();
+    for (const [index, raw] of root.findings.entries()) {
+        const item = record(raw);
+        if (!item || !hasOnlyKeys(item, FINDING_KEYS)) {
+            throw new Error(`Finding ${index + 1} has an invalid shape or additional fields.`);
+        }
+        const domainInput = requiredText(item.domain, 253, `Finding ${index + 1} domain`);
+        const domain = normalizeDomain(domainInput);
+        if (!domain)
+            throw new Error(`Finding ${index + 1} domain is invalid.`);
+        if (typeof item.category !== 'string' || !CATEGORIES.has(item.category)) {
+            throw new Error(`Finding ${index + 1} category is unsupported.`);
+        }
+        if (typeof item.completeness !== 'string' || !COMPLETENESS.has(item.completeness)) {
+            throw new Error(`Finding ${index + 1} completeness is unsupported.`);
+        }
+        const evidenceClass = item.evidenceClass === undefined && root.schemaVersion === 1
+            ? 'provider_report'
+            : item.evidenceClass;
+        if (evidenceClass !== 'deployment_observation' && evidenceClass !== 'provider_report') {
+            throw new Error(`Finding ${index + 1} evidence class is unsupported.`);
+        }
+        const finding = {
+            domain,
+            category: item.category,
+            evidenceClass,
+            summary: requiredText(item.summary, 900, `Finding ${index + 1} summary`),
+            observedAt: iso(item.observedAt, `Finding ${index + 1} observation time`),
+            completeness: item.completeness,
+            limitations: limitations(item.limitations, index),
+            reference: optionalText(item.reference, 500, `Finding ${index + 1} reference`),
+            structuredObservation: structuredObservation(item.structuredObservation, index),
+        };
+        const key = findingKey(finding, source.name);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        const count = (domainCounts.get(domain) ?? 0) + 1;
+        if (count > MAX_EXTERNAL_FINDINGS_PER_DOMAIN) {
+            throw new Error(`External findings exceed the ${MAX_EXTERNAL_FINDINGS_PER_DOMAIN}-finding per-domain limit.`);
+        }
+        domainCounts.set(domain, count);
+        if (domainCounts.size > MAX_EXTERNAL_FINDING_DOMAINS) {
+            throw new Error(`External findings exceed the ${MAX_EXTERNAL_FINDING_DOMAINS}-domain limit.`);
+        }
+        normalized.push(finding);
+    }
+    if (!normalized.length)
+        throw new Error('External findings did not contain a unique valid finding.');
+    return {
+        schema: EXTERNAL_FINDINGS_SCHEMA,
+        schemaVersion: EXTERNAL_FINDINGS_VERSION,
+        source,
+        findings: normalized,
+    };
+}
+function pinValue(finding) {
+    return finding.reference
+        ? `${finding.summary} Reference: ${finding.reference}`
+        : finding.summary;
+}
+function importedSourceLabel(finding, sourceName) {
+    return finding.evidenceClass === 'deployment_observation'
+        ? `Deployment observation: ${sourceName}`
+        : `Provider report: ${sourceName}`;
+}
+function existingPinKey(recordValue, finding, sourceName) {
+    const expectedLabel = `External ${finding.category} finding`;
+    const expectedValue = finding.structuredObservation?.value ?? pinValue(finding);
+    const expectedSource = importedSourceLabel(finding, sourceName);
+    const observation = finding.structuredObservation;
+    return recordValue.evidencePins.some((pin) => (pin.label === expectedLabel
+        && pin.value === expectedValue
+        && pin.source === expectedSource
+        && pin.observedAt === finding.observedAt
+        && pin.completeness === finding.completeness
+        && (!observation || (pin.field === observation.field
+            && pin.sourceSchema?.collection === 'external_observations'
+            && pin.sourceSchema.schema === observation.sourceSchema
+            && pin.sourceSchema.version === observation.sourceVersion)))) ? findingKey(finding, sourceName) : '';
+}
+function structuredPinFields(finding) {
+    const observation = finding.structuredObservation;
+    if (!observation)
+        return {};
+    return {
+        field: observation.field,
+        category: finding.category,
+        sourceSchema: {
+            collection: 'external_observations',
+            schema: observation.sourceSchema,
+            version: observation.sourceVersion,
+        },
+    };
+}
+export function mergeExternalFindingsIntoCases(current, document, now = new Date().toISOString()) {
+    let cases = [...current];
+    const createdDomains = new Set();
+    const updatedDomains = new Set();
+    let findingsAdded = 0;
+    let duplicatesSkipped = 0;
+    for (const finding of document.findings) {
+        const existing = cases.find((candidate) => candidate.domain === finding.domain) ?? null;
+        const opened = openOrCreateCase(cases, { domain: finding.domain, source: 'import' }, now);
+        cases = opened.cases;
+        const target = cases.find((candidate) => candidate.id === opened.record.id) ?? opened.record;
+        if (existingPinKey(target, finding, document.source.name)) {
+            duplicatesSkipped += 1;
+            continue;
+        }
+        const sourceLimitations = [
+            finding.evidenceClass === 'deployment_observation'
+                ? `Imported as an observation made by ${document.source.name}; this browser session did not collect or independently verify it.`
+                : `Reported by ${document.source.name}; WHOISleuth did not collect or independently verify this provider finding.`,
+            ...(document.source.reference ? [`Source reference: ${document.source.reference}`] : []),
+            ...finding.limitations,
+        ];
+        const existingPinIds = new Set(target.evidencePins.map((pin) => pin.id));
+        const updated = updateCase(cases, target.id, {
+            evidencePin: {
+                ...structuredPinFields(finding),
+                label: `External ${finding.category} finding`,
+                value: finding.structuredObservation?.value ?? pinValue(finding),
+                source: importedSourceLabel(finding, document.source.name),
+                observedAt: finding.observedAt,
+                completeness: finding.completeness,
+                limitations: sourceLimitations,
+            },
+        }, now);
+        cases = updated.cases;
+        const addedPin = updated.record.evidencePins.find((pin) => !existingPinIds.has(pin.id)) ?? null;
+        if (addedPin) {
+            cases = updateCase(cases, updated.record.id, {
+                sighting: {
+                    state: finding.evidenceClass === 'deployment_observation'
+                        ? 'observed_by_deployment'
+                        : 'reported_by_provider',
+                    category: finding.category === 'dns'
+                        ? 'delegation'
+                        : finding.category === 'certificate'
+                            ? 'certificate'
+                            : finding.category === 'registration'
+                                ? 'registration'
+                                : finding.category === 'http' || finding.category === 'page'
+                                    ? 'website'
+                                    : 'other',
+                    source: document.source.name,
+                    observedAt: finding.observedAt,
+                    completeness: finding.completeness,
+                    evidencePinId: addedPin.id,
+                    limitations: sourceLimitations,
+                },
+            }, now).cases;
+        }
+        findingsAdded += 1;
+        if (existing)
+            updatedDomains.add(finding.domain);
+        else
+            createdDomains.add(finding.domain);
+    }
+    return {
+        cases,
+        casesCreated: createdDomains.size,
+        casesUpdated: updatedDomains.size,
+        findingsAdded,
+        duplicatesSkipped,
+    };
+}

package/frontend/src/lib/analysis/lookup-decision-support.js

@@ -357,6 +357,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'review-priority-conflict',
             label: 'Review the highest-priority disagreement',
             reason: firstConflict.title,
+            expectedOutcome: 'Establish which separately attributed observation is current, authoritative, or still unresolved.',
             href: firstConflict.href,
             priority: 'high',
         });
@@ -366,6 +367,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'review-refresh-options',
             label: 'Review limited or stale sources',
             reason: `${input.refreshPlan.items.length} deliberate source refresh option${input.refreshPlan.items.length === 1 ? ' is' : 's are'} available.`,
+            expectedOutcome: 'Determine whether the limitation is transient, persistent, or an expected source constraint.',
             href: '#evidence-quality',
             priority: 'medium',
         });
@@ -376,6 +378,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'inspect-limited-source',
             label: `Inspect ${firstLimited.label}`,
             reason: `${firstLimited.statusLabel} evidence may limit downstream conclusions.`,
+            expectedOutcome: `Clarify which conclusions ${firstLimited.label} can and cannot support in its current state.`,
             href: '#evidence-quality',
             priority: 'medium',
         });
@@ -385,6 +388,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'review-page-identity',
             label: 'Review identity and credential evidence',
             reason: 'Compare declared identity, forms, redirects, and external destinations before making a brand assessment.',
+            expectedOutcome: 'Separate observed identity signals from publisher claims, shared services, and unresolved resemblance leads.',
             href: '#web-evidence',
             priority: 'medium',
         });
@@ -394,6 +398,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'review-acquisition-dependencies',
             label: 'Review transfer dependencies',
             reason: 'Registration dates alone do not describe the DNS, mail, certificate, and website services that require transition.',
+            expectedOutcome: 'Identify dependencies that must be retained, transferred, replaced, or deliberately retired.',
             href: '#web-evidence',
             priority: 'medium',
         });
@@ -403,6 +408,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'review-owned-posture',
             label: 'Review delegation and posture evidence',
             reason: 'Confirm registry publication, authoritative responses, mail, and certificate state together.',
+            expectedOutcome: 'Identify whether observed control state aligns with the reviewed owned-domain baseline.',
             href: '#web-evidence',
             priority: 'medium',
         });
@@ -412,6 +418,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'review-case-handoff',
             label: 'Record or hand off reviewed evidence',
             reason: 'Keep observed facts, hypotheses, unknowns, and analyst decisions separate in the case workflow.',
+            expectedOutcome: 'Preserve a reviewable record of what is known, inferred, unresolved, and recommended next.',
             href: '#case-response',
             priority: 'low',
         });

package/frontend/src/lib/analysis/lookup-presentation.js

@@ -1,8 +1,8 @@
 export const LOOKUP_PRESENTATION_STORAGE_KEY = 'whoisleuth:lookup-presentation:v1';
 export const LOOKUP_EVIDENCE_DENSITIES = Object.freeze([
-    Object.freeze({ id: 'summary', label: 'Summary', detail: 'Overview and source-state ledger, with detailed sections reduced to headings.' }),
-    Object.freeze({ id: 'standard', label: 'Standard', detail: 'Evidence sections remain available while the raw response stays collapsed until you choose to inspect it.' }),
-    Object.freeze({ id: 'full', label: 'Full', detail: 'Every settled evidence section, including the bounded raw response view.' }),
+    Object.freeze({ id: 'summary', label: 'Essentials', detail: 'A compact assessment, key observations, unresolved evidence, and one summary for each evidence family.' }),
+    Object.freeze({ id: 'standard', label: 'Evidence', detail: 'Settled evidence is grouped by task while source detail and raw evidence stay collapsed until you inspect them.' }),
+    Object.freeze({ id: 'full', label: 'All evidence', detail: 'Every settled evidence family remains available, including advanced and bounded raw evidence.' }),
 ]);
 export const LOOKUP_TASK_VIEWS = Object.freeze([
     Object.freeze({ id: 'general', label: 'General investigation' }),
@@ -16,7 +16,7 @@ const TASKS = new Set(LOOKUP_TASK_VIEWS.map((option) => option.id));
 export function normalizeLookupEvidenceDensity(value) {
     return typeof value === 'string' && DENSITIES.has(value)
         ? value
-        : 'standard';
+        : 'summary';
 }
 export function normalizeLookupTaskView(value) {
     return typeof value === 'string' && TASKS.has(value)
@@ -36,7 +36,7 @@ export function readLookupPresentation(storage) {
     catch {
         // Invalid or unavailable browser storage falls back to the stable defaults.
     }
-    return { density: 'standard', task: 'general' };
+    return { density: 'summary', task: 'general' };
 }
 export function writeLookupPresentation(storage, state) {
     try {
@@ -51,22 +51,12 @@ export function writeLookupPresentation(storage, state) {
     }
 }
 const PRIORITY = Object.freeze({
-    general: Object.freeze(['overview', 'web-evidence', 'registry', 'external-intelligence', 'case-response', 'raw-data']),
-    acquisition: Object.freeze(['overview', 'registry', 'web-evidence', 'case-response', 'external-intelligence', 'raw-data']),
-    brand: Object.freeze(['overview', 'web-evidence', 'external-intelligence', 'registry', 'case-response', 'raw-data']),
-    incident: Object.freeze(['overview', 'external-intelligence', 'web-evidence', 'registry', 'case-response', 'raw-data']),
-    owned: Object.freeze(['overview', 'registry', 'web-evidence', 'case-response', 'external-intelligence', 'raw-data']),
+    general: Object.freeze(['overview', 'registry', 'web-evidence', 'relationships-history', 'source-quality', 'case-response', 'advanced-evidence']),
+    acquisition: Object.freeze(['overview', 'registry', 'relationships-history', 'web-evidence', 'source-quality', 'case-response', 'advanced-evidence']),
+    brand: Object.freeze(['overview', 'web-evidence', 'relationships-history', 'registry', 'source-quality', 'case-response', 'advanced-evidence']),
+    incident: Object.freeze(['overview', 'web-evidence', 'relationships-history', 'advanced-evidence', 'registry', 'source-quality', 'case-response']),
+    owned: Object.freeze(['overview', 'registry', 'web-evidence', 'relationships-history', 'source-quality', 'case-response', 'advanced-evidence']),
 });
-const INITIAL_PANELS = {
-    general: [],
-    acquisition: ['dns', 'network-context', 'tls'],
-    brand: ['http', 'page-identity', 'credential-surface', 'structured-identity', 'technology'],
-    incident: ['http', 'tls', 'credential-surface', 'security-posture'],
-    owned: ['dns', 'network-context', 'tls', 'security-posture'],
-};
-export function lookupTaskInitiallyExpands(task, panel) {
-    return INITIAL_PANELS[normalizeLookupTaskView(task)].includes(panel);
-}
 export function prioritizeLookupSectionLinks(links, task) {
     const order = PRIORITY[normalizeLookupTaskView(task)];
     const rank = new Map(order.map((id, index) => [`#${id}`, index]));

package/frontend/src/lib/analysis/scoring.js

@@ -1,4 +1,4 @@
-export { RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD, computeRiskScore, explainRiskScore, formatScoreBreakdown, normalizeRiskModelVersion, riskTone, } from "../../../../lib/risk-scoring.mjs";
+export { RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD, buildRiskScoreSensitivity, computeRiskScore, explainRiskScore, formatScoreBreakdown, normalizeRiskModelVersion, riskTone, } from "../../../../lib/risk-scoring.mjs";
 export { OPPORTUNITY_MODEL_VERSION, OPPORTUNITY_REVIEW_THRESHOLD, computeOpportunityScore, explainOpportunityScore, normalizeOpportunityModelVersion, opportunityTone, } from "../../../../lib/opportunity-scoring.mjs";
 export function fmtAge(value) {
     if (typeof value !== 'number' || !Number.isFinite(value) || value < 0)

package/frontend/src/lib/analysis/visualization-models.js

@@ -214,8 +214,7 @@ export function projectScoreFactors(rawFactors) {
         id: `${boundedId(factor?.label) || 'factor'}-${index}`,
         label: boundedText(factor?.label, 56) || `Factor ${index + 1}`,
         delta: boundedNumber(factor?.delta, -100, 100),
-    }))
-        .filter((factor) => factor.delta !== 0);
+    }));
     const factors = candidates.slice(0, MAX_SCORE_FACTORS);
     const maximum = Math.max(1, ...factors.map((factor) => Math.abs(factor.delta)));
     const x = scaleLinear().domain([-maximum, maximum]).range([220, 860]).clamp(true);
@@ -231,7 +230,7 @@ export function projectScoreFactors(rawFactors) {
             return {
                 ...factor,
                 x: Math.min(zeroX, valueX),
-                width: Math.max(2, Math.abs(valueX - zeroX)),
+                width: factor.delta === 0 ? 0 : Math.max(2, Math.abs(valueX - zeroX)),
                 y: 24 + index * rowHeight,
             };
         }),

package/frontend/src/lib/analysis/workspace-archive.js

@@ -340,6 +340,7 @@ export async function readWorkspaceArchive(raw, options = {}) {
         }
         throw new Error(`Expected workspace archive schema 1, 2, 3, 4, or ${WORKSPACE_ARCHIVE_VERSION}.`);
     }
+    const sourceVersion = value.version;
     const { bytes } = ensureArchiveBudget(value);
     const manifest = record(value.manifest);
     const sectionValues = record(value.sections);
@@ -394,6 +395,7 @@ export async function readWorkspaceArchive(raw, options = {}) {
     return {
         schema: WORKSPACE_ARCHIVE_SCHEMA,
         version: WORKSPACE_ARCHIVE_VERSION,
+        sourceVersion,
         generatedAt: timestamp(value.generatedAt),
         bytes,
         sections,

package/lib/abusech-auth.mjs

@@ -16,4 +16,4 @@ function abusechAuthKey(env = process.env) {
     return normalizeAbusechAuthKey(source.ABUSECH_AUTH_KEY)
         || normalizeAbusechAuthKey(source.URLHAUS_AUTH_KEY);
 }
-export { MAX_ABUSECH_AUTH_KEY_LENGTH, normalizeAbusechAuthKey, abusechAuthKey, };
+export { abusechAuthKey, };

package/lib/availability.mjs

@@ -237,7 +237,7 @@ async function fetchHomepage(domain, { fetcher = safeFetchDetailed } = {}) {
                     technologyHeaders: {
                         'cf-ray': res.headers.get('cf-ray') || '',
                         'x-drupal-cache': res.headers.get('x-drupal-cache') || '',
-                        'x-fastly-request-id': res.headers.get('x-fastly-request-id') || '',
+                        'x-served-by': res.headers.get('x-served-by') || '',
                         'x-powered-by': res.headers.get('x-powered-by') || '',
                         'x-shopify-stage': res.headers.get('x-shopify-stage') || '',
                         'x-sorting-hat-podid': res.headers.get('x-sorting-hat-podid') || '',

package/lib/bounded-contract-normalizers.mjs

@@ -1,9 +1,16 @@
 // Shared strict primitives for internal evidence contracts. These helpers do
 // not infer missing values and keep every string, object, enum, and counter
 // bounded before a provider or connector result reaches its public model.
+import { domainToASCII } from 'node:url';
 export function isRecord(value) {
     return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
+export function recordOrNull(value) {
+    return isRecord(value) ? value : null;
+}
+export function recordOrEmpty(value) {
+    return isRecord(value) ? value : {};
+}
 export function boundedString(value, maxLength) {
     if (typeof value !== 'string' || /[\u0000-\u001f\u007f]/u.test(value))
         return null;
@@ -59,3 +66,29 @@ export function boundedInteger(value, minimum, maximum, label) {
     }
     return value;
 }
+export function requireRecord(value, label) {
+    if (!isRecord(value))
+        throw new TypeError(`${label} must be an object.`);
+    return value;
+}
+export function requireBoundedString(value, label, maxLength) {
+    const normalised = strictBoundedString(value, maxLength);
+    if (!normalised) {
+        throw new TypeError(`${label} must contain from 1 to ${maxLength} characters without control characters.`);
+    }
+    return normalised;
+}
+export function requireIsoTimestamp(value, label) {
+    const normalised = isoTimestamp(value);
+    if (!normalised)
+        throw new TypeError(`${label} must be a valid timestamp.`);
+    return normalised;
+}
+export function requireDomainName(value, label, noun = 'domain name') {
+    const supplied = requireBoundedString(value, label, 253).toLowerCase().replace(/\.$/u, '');
+    const ascii = domainToASCII(supplied);
+    if (!ascii || !ascii.includes('.') || ascii.length > 253 || ascii.split('.').some((part) => (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(part)))) {
+        throw new TypeError(`${label} must be a valid ${noun}.`);
+    }
+    return ascii;
+}