@slicedearth/whoisleuth-cli 1.39.1 → 1.45.0

package/frontend/src/lib/analysis/detection-rule-model.js

@@ -245,6 +245,42 @@ export function evaluateRuleSet(records, rawRules) {
         return [];
     return records.slice(0, 500).map((record) => evaluateDetectionRules(record, rawRules));
 }
+function ruleSignature(rule) {
+    return JSON.stringify({
+        match: rule.match,
+        conditions: [...rule.conditions]
+            .map((condition) => ({ ...condition }))
+            .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right))),
+    });
+}
+export function previewDetectionRule(records, existingRules, rawCandidate) {
+    const normalized = normalizeDetectionRule({ ...record(rawCandidate), id: 'preview-rule', enabled: true });
+    if (!normalized?.id)
+        return null;
+    const candidate = { ...normalized, id: normalized.id };
+    const sourceRecords = Array.isArray(records) ? records.slice(0, 500) : [];
+    const evaluations = evaluateRuleSet(sourceRecords, [candidate]).filter((item) => item.matchedRules.length > 0);
+    const recordsById = new Map(sourceRecords.map((item) => [String(record(item).id ?? ''), record(item)]));
+    const affectedDispositionCounts = {};
+    for (const evaluation of evaluations) {
+        const disposition = String(recordsById.get(evaluation.caseId)?.disposition ?? 'unreviewed');
+        affectedDispositionCounts[disposition] = (affectedDispositionCounts[disposition] ?? 0) + 1;
+    }
+    const signature = ruleSignature(candidate);
+    const collisionRuleIds = normalizeDetectionRuleStore(existingRules).rules
+        .filter((rule) => rule.name.toLowerCase() === candidate.name.toLowerCase() || ruleSignature(rule) === signature)
+        .map((rule) => rule.id)
+        .slice(0, MAX_DETECTION_RULES);
+    return Object.freeze({
+        candidate: Object.freeze(candidate),
+        matchCount: evaluations.length,
+        affectedCaseIds: Object.freeze(evaluations.map((item) => item.caseId).filter(Boolean)),
+        affectedDispositionCounts: Object.freeze(affectedDispositionCounts),
+        unreviewedMatchCount: affectedDispositionCounts.unreviewed ?? 0,
+        collisionRuleIds: Object.freeze(collisionRuleIds),
+        limitation: 'This preview evaluates the latest bounded evidence already retained in local cases. It does not save the rule, change a score, refresh evidence, or establish whether a match is correct.',
+    });
+}
 export function mergeDetectionRules(localRaw, importedRaw) {
     const importedRecord = record(importedRaw);
     if (typeof importedRecord.schema === 'string' && importedRecord.schema !== DETECTION_RULE_SCHEMA) {

package/frontend/src/lib/analysis/external-findings-import.js

@@ -0,0 +1,320 @@
+import { normalizeDomain, openOrCreateCase, updateCase, } from "./case-model.js";
+export const EXTERNAL_FINDINGS_SCHEMA = 'whoisleuth.external-findings';
+export const EXTERNAL_FINDINGS_VERSION = 3;
+export const MAX_EXTERNAL_FINDINGS_IMPORT_BYTES = 384 * 1024;
+export const MAX_EXTERNAL_FINDINGS = 100;
+export const MAX_EXTERNAL_FINDINGS_PER_DOMAIN = 20;
+export const MAX_EXTERNAL_FINDING_DOMAINS = 25;
+export const EXTERNAL_FINDING_CATEGORIES = [
+    'certificate',
+    'dns',
+    'http',
+    'malware',
+    'other',
+    'page',
+    'registration',
+    'reputation',
+];
+const CATEGORIES = new Set(EXTERNAL_FINDING_CATEGORIES);
+const COMPLETENESS = new Set(['complete', 'inconclusive', 'partial', 'unknown']);
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+const ROOT_KEYS = new Set(['schema', 'schemaVersion', 'source', 'findings']);
+const SOURCE_KEYS = new Set(['name', 'reference', 'collectedAt']);
+const FINDING_KEYS = new Set([
+    'domain',
+    'category',
+    'evidenceClass',
+    'summary',
+    'observedAt',
+    'completeness',
+    'limitations',
+    'reference',
+    'structuredObservation',
+]);
+const STRUCTURED_OBSERVATION_KEYS = new Set([
+    'sourceSchema',
+    'sourceVersion',
+    'field',
+    'value',
+    'issuer',
+    'notAfter',
+]);
+const STRUCTURED_OBSERVATION_SCHEMAS = new Set([
+    'whoisleuth.domain-observation-rows',
+    'whoisleuth.dns-observation-rows',
+    'whoisleuth.certificate-observation-rows',
+]);
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function hasOnlyKeys(value, allowed) {
+    return Object.keys(value).every((key) => allowed.has(key));
+}
+function requiredText(value, maximum, label) {
+    if (typeof value !== 'string'
+        || !value.trim()
+        || value.length > maximum
+        || CONTROL_RE.test(value)) {
+        throw new Error(`${label} must be non-empty, bounded text without control characters.`);
+    }
+    return value.trim();
+}
+function optionalText(value, maximum, label) {
+    if (value === undefined || value === null || value === '')
+        return null;
+    return requiredText(value, maximum, label);
+}
+function iso(value, label, optional = false) {
+    if (optional && (value === undefined || value === null || value === ''))
+        return null;
+    const text = requiredText(value, 64, label);
+    const parsed = Date.parse(text);
+    if (!Number.isFinite(parsed))
+        throw new Error(`${label} must be a valid date and time.`);
+    return new Date(parsed).toISOString();
+}
+function limitations(value, index) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.length > 8) {
+        throw new Error(`Finding ${index + 1} limitations must be an array with no more than 8 entries.`);
+    }
+    const unique = new Set();
+    for (const item of value)
+        unique.add(requiredText(item, 240, `Finding ${index + 1} limitation`));
+    return [...unique];
+}
+function structuredObservation(value, index) {
+    if (value === undefined || value === null)
+        return null;
+    const item = record(value);
+    if (!item || !hasOnlyKeys(item, STRUCTURED_OBSERVATION_KEYS)) {
+        throw new Error(`Finding ${index + 1} structured observation has an invalid shape or additional fields.`);
+    }
+    if (typeof item.sourceSchema !== 'string' || !STRUCTURED_OBSERVATION_SCHEMAS.has(item.sourceSchema)) {
+        throw new Error(`Finding ${index + 1} structured observation source schema is unsupported.`);
+    }
+    if (item.sourceVersion !== 1) {
+        throw new Error(`Finding ${index + 1} structured observation source version is unsupported.`);
+    }
+    const field = requiredText(item.field, 40, `Finding ${index + 1} structured observation field`);
+    const observationValue = requiredText(item.value, 500, `Finding ${index + 1} structured observation value`);
+    const issuer = optionalText(item.issuer, 160, `Finding ${index + 1} certificate issuer`);
+    const notAfter = iso(item.notAfter, `Finding ${index + 1} certificate expiry`, true);
+    const certificateSchema = item.sourceSchema === 'whoisleuth.certificate-observation-rows';
+    if (!certificateSchema && (issuer !== null || notAfter !== null)) {
+        throw new Error(`Finding ${index + 1} non-certificate observation cannot declare certificate metadata.`);
+    }
+    return {
+        sourceSchema: item.sourceSchema,
+        sourceVersion: 1,
+        field,
+        value: observationValue,
+        issuer,
+        notAfter,
+    };
+}
+function findingKey(finding, sourceName) {
+    return [
+        finding.domain,
+        finding.category,
+        finding.evidenceClass,
+        finding.summary,
+        finding.observedAt,
+        finding.completeness,
+        sourceName,
+    ].join('\u0000');
+}
+export function parseExternalFindingsDocument(value) {
+    const root = record(value);
+    if (!root || !hasOnlyKeys(root, ROOT_KEYS)) {
+        throw new Error('External findings must use the documented object shape without additional top-level fields.');
+    }
+    if (root.schema !== EXTERNAL_FINDINGS_SCHEMA
+        || ![1, 2, EXTERNAL_FINDINGS_VERSION].includes(Number(root.schemaVersion))) {
+        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version 1, 2, or ${EXTERNAL_FINDINGS_VERSION}.`);
+    }
+    const sourceValue = record(root.source);
+    if (!sourceValue || !hasOnlyKeys(sourceValue, SOURCE_KEYS)) {
+        throw new Error('External findings require a bounded source object without additional fields.');
+    }
+    const source = {
+        name: requiredText(sourceValue.name, 80, 'Source name'),
+        reference: optionalText(sourceValue.reference, 500, 'Source reference'),
+        collectedAt: iso(sourceValue.collectedAt, 'Source collection time', true),
+    };
+    if (!Array.isArray(root.findings) || !root.findings.length || root.findings.length > MAX_EXTERNAL_FINDINGS) {
+        throw new Error(`External findings must contain between 1 and ${MAX_EXTERNAL_FINDINGS} findings.`);
+    }
+    const normalized = [];
+    const seen = new Set();
+    const domainCounts = new Map();
+    for (const [index, raw] of root.findings.entries()) {
+        const item = record(raw);
+        if (!item || !hasOnlyKeys(item, FINDING_KEYS)) {
+            throw new Error(`Finding ${index + 1} has an invalid shape or additional fields.`);
+        }
+        const domainInput = requiredText(item.domain, 253, `Finding ${index + 1} domain`);
+        const domain = normalizeDomain(domainInput);
+        if (!domain)
+            throw new Error(`Finding ${index + 1} domain is invalid.`);
+        if (typeof item.category !== 'string' || !CATEGORIES.has(item.category)) {
+            throw new Error(`Finding ${index + 1} category is unsupported.`);
+        }
+        if (typeof item.completeness !== 'string' || !COMPLETENESS.has(item.completeness)) {
+            throw new Error(`Finding ${index + 1} completeness is unsupported.`);
+        }
+        const evidenceClass = item.evidenceClass === undefined && root.schemaVersion === 1
+            ? 'provider_report'
+            : item.evidenceClass;
+        if (evidenceClass !== 'deployment_observation' && evidenceClass !== 'provider_report') {
+            throw new Error(`Finding ${index + 1} evidence class is unsupported.`);
+        }
+        const finding = {
+            domain,
+            category: item.category,
+            evidenceClass,
+            summary: requiredText(item.summary, 900, `Finding ${index + 1} summary`),
+            observedAt: iso(item.observedAt, `Finding ${index + 1} observation time`),
+            completeness: item.completeness,
+            limitations: limitations(item.limitations, index),
+            reference: optionalText(item.reference, 500, `Finding ${index + 1} reference`),
+            structuredObservation: structuredObservation(item.structuredObservation, index),
+        };
+        const key = findingKey(finding, source.name);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        const count = (domainCounts.get(domain) ?? 0) + 1;
+        if (count > MAX_EXTERNAL_FINDINGS_PER_DOMAIN) {
+            throw new Error(`External findings exceed the ${MAX_EXTERNAL_FINDINGS_PER_DOMAIN}-finding per-domain limit.`);
+        }
+        domainCounts.set(domain, count);
+        if (domainCounts.size > MAX_EXTERNAL_FINDING_DOMAINS) {
+            throw new Error(`External findings exceed the ${MAX_EXTERNAL_FINDING_DOMAINS}-domain limit.`);
+        }
+        normalized.push(finding);
+    }
+    if (!normalized.length)
+        throw new Error('External findings did not contain a unique valid finding.');
+    return {
+        schema: EXTERNAL_FINDINGS_SCHEMA,
+        schemaVersion: EXTERNAL_FINDINGS_VERSION,
+        source,
+        findings: normalized,
+    };
+}
+function pinValue(finding) {
+    return finding.reference
+        ? `${finding.summary} Reference: ${finding.reference}`
+        : finding.summary;
+}
+function importedSourceLabel(finding, sourceName) {
+    return finding.evidenceClass === 'deployment_observation'
+        ? `Deployment observation: ${sourceName}`
+        : `Provider report: ${sourceName}`;
+}
+function existingPinKey(recordValue, finding, sourceName) {
+    const expectedLabel = `External ${finding.category} finding`;
+    const expectedValue = finding.structuredObservation?.value ?? pinValue(finding);
+    const expectedSource = importedSourceLabel(finding, sourceName);
+    const observation = finding.structuredObservation;
+    return recordValue.evidencePins.some((pin) => (pin.label === expectedLabel
+        && pin.value === expectedValue
+        && pin.source === expectedSource
+        && pin.observedAt === finding.observedAt
+        && pin.completeness === finding.completeness
+        && (!observation || (pin.field === observation.field
+            && pin.sourceSchema?.collection === 'external_observations'
+            && pin.sourceSchema.schema === observation.sourceSchema
+            && pin.sourceSchema.version === observation.sourceVersion)))) ? findingKey(finding, sourceName) : '';
+}
+function structuredPinFields(finding) {
+    const observation = finding.structuredObservation;
+    if (!observation)
+        return {};
+    return {
+        field: observation.field,
+        category: finding.category,
+        sourceSchema: {
+            collection: 'external_observations',
+            schema: observation.sourceSchema,
+            version: observation.sourceVersion,
+        },
+    };
+}
+export function mergeExternalFindingsIntoCases(current, document, now = new Date().toISOString()) {
+    let cases = [...current];
+    const createdDomains = new Set();
+    const updatedDomains = new Set();
+    let findingsAdded = 0;
+    let duplicatesSkipped = 0;
+    for (const finding of document.findings) {
+        const existing = cases.find((candidate) => candidate.domain === finding.domain) ?? null;
+        const opened = openOrCreateCase(cases, { domain: finding.domain, source: 'import' }, now);
+        cases = opened.cases;
+        const target = cases.find((candidate) => candidate.id === opened.record.id) ?? opened.record;
+        if (existingPinKey(target, finding, document.source.name)) {
+            duplicatesSkipped += 1;
+            continue;
+        }
+        const sourceLimitations = [
+            finding.evidenceClass === 'deployment_observation'
+                ? `Imported as an observation made by ${document.source.name}; this browser session did not collect or independently verify it.`
+                : `Reported by ${document.source.name}; WHOISleuth did not collect or independently verify this provider finding.`,
+            ...(document.source.reference ? [`Source reference: ${document.source.reference}`] : []),
+            ...finding.limitations,
+        ];
+        const existingPinIds = new Set(target.evidencePins.map((pin) => pin.id));
+        const updated = updateCase(cases, target.id, {
+            evidencePin: {
+                ...structuredPinFields(finding),
+                label: `External ${finding.category} finding`,
+                value: finding.structuredObservation?.value ?? pinValue(finding),
+                source: importedSourceLabel(finding, document.source.name),
+                observedAt: finding.observedAt,
+                completeness: finding.completeness,
+                limitations: sourceLimitations,
+            },
+        }, now);
+        cases = updated.cases;
+        const addedPin = updated.record.evidencePins.find((pin) => !existingPinIds.has(pin.id)) ?? null;
+        if (addedPin) {
+            cases = updateCase(cases, updated.record.id, {
+                sighting: {
+                    state: finding.evidenceClass === 'deployment_observation'
+                        ? 'observed_by_deployment'
+                        : 'reported_by_provider',
+                    category: finding.category === 'dns'
+                        ? 'delegation'
+                        : finding.category === 'certificate'
+                            ? 'certificate'
+                            : finding.category === 'registration'
+                                ? 'registration'
+                                : finding.category === 'http' || finding.category === 'page'
+                                    ? 'website'
+                                    : 'other',
+                    source: document.source.name,
+                    observedAt: finding.observedAt,
+                    completeness: finding.completeness,
+                    evidencePinId: addedPin.id,
+                    limitations: sourceLimitations,
+                },
+            }, now).cases;
+        }
+        findingsAdded += 1;
+        if (existing)
+            updatedDomains.add(finding.domain);
+        else
+            createdDomains.add(finding.domain);
+    }
+    return {
+        cases,
+        casesCreated: createdDomains.size,
+        casesUpdated: updatedDomains.size,
+        findingsAdded,
+        duplicatesSkipped,
+    };
+}

package/frontend/src/lib/analysis/lookup-asset-graph.js

@@ -372,7 +372,7 @@ export function buildLookupAssetGraph(input) {
             completeness: sourceCompleteness(networkContext),
             limitations: limitations(networkContext.limitations),
             lenses: ['all'],
-            href: '#evidence-network-context',
+            href: '#evidence-network',
         });
     }
     const networkLabel = text(network.name || network.holder || network.handle, 180);
@@ -390,7 +390,7 @@ export function buildLookupAssetGraph(input) {
             completeness: sourceCompleteness(networkContext),
             limitations: limitations(networkContext.limitations),
             lenses: ['all'],
-            href: '#evidence-network-context',
+            href: '#evidence-network',
         });
     }
     for (const cidr of textList(network.cidrs, 8)) {
@@ -407,7 +407,7 @@ export function buildLookupAssetGraph(input) {
                 completeness: sourceCompleteness(networkContext),
                 limitations: limitations(networkContext.limitations),
                 lenses: ['all'],
-                href: '#evidence-network-context',
+                href: '#evidence-network',
             });
         }
     }
@@ -437,7 +437,7 @@ export function buildLookupAssetGraph(input) {
             completeness: sourceCompleteness(input.pageIdentity),
             limitations: limitations(record(input.pageIdentity).limitations),
             lenses: ['identity'],
-            href: '#evidence-page-identity',
+            href: '#evidence-page',
             boundary: trustBoundary(canonicalHost, finalHost || target),
         }, 'Publisher-declared canonical origin', identitySource);
     }
@@ -451,7 +451,7 @@ export function buildLookupAssetGraph(input) {
             completeness: sourceCompleteness(input.pageIdentity),
             limitations: limitations(record(input.pageIdentity).limitations),
             lenses: ['identity'],
-            href: '#evidence-page-identity',
+            href: '#evidence-page',
             boundary: trustBoundary(openGraphHost, finalHost || target),
         }, 'Publisher-declared Open Graph origin', identitySource);
     }
@@ -466,7 +466,7 @@ export function buildLookupAssetGraph(input) {
                 completeness: sourceCompleteness(input.pageIdentity),
                 limitations: ['A declared form action does not prove that a user submitted data or that the endpoint received it.'],
                 lenses: ['identity'],
-                href: '#evidence-page-identity',
+                href: '#evidence-page',
                 boundary: trustBoundary(host, finalHost || target),
             }, 'External form-action origin', identitySource);
         }
@@ -482,7 +482,7 @@ export function buildLookupAssetGraph(input) {
                 completeness: sourceCompleteness(input.pageIdentity),
                 limitations: ['A static resource reference does not prove that a browser loaded the resource or disclosed data to it.'],
                 lenses: ['identity'],
-                href: '#evidence-page-identity',
+                href: '#evidence-page',
                 boundary: trustBoundary(host, finalHost || target),
             }, 'External resource origin', identitySource);
         }
@@ -498,7 +498,7 @@ export function buildLookupAssetGraph(input) {
                 completeness: sourceCompleteness(input.pageIdentity),
                 limitations: ['A shared identifier is a relationship lead and does not establish common ownership or control.'],
                 lenses: ['identity'],
-                href: '#evidence-page-identity',
+                href: '#evidence-page',
             }, text(identifier.type, 80), identitySource);
         }
     }

package/frontend/src/lib/analysis/lookup-decision-support.js

@@ -275,7 +275,7 @@ function identityEntries(input) {
             title: 'The declared canonical origin differs from the observed final origin',
             detail: `${finalHost} served the page while the document declared ${canonicalHost} as canonical.`,
             sources: ['HTTP', 'HTML'],
-            href: '#evidence-page-identity',
+            href: '#evidence-page',
         });
     }
     if (finalHost && openGraphHost && !sameRegistrableScope(finalHost, openGraphHost, registrableDomain)) {
@@ -286,7 +286,7 @@ function identityEntries(input) {
             title: 'The Open Graph URL points outside the observed final origin',
             detail: `${finalHost} served the page while Open Graph metadata declared ${openGraphHost}. Publisher metadata is a claim, not identity proof.`,
             sources: ['HTTP', 'HTML'],
-            href: '#evidence-page-identity',
+            href: '#evidence-page',
         });
     }
     return output;
@@ -357,6 +357,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'review-priority-conflict',
             label: 'Review the highest-priority disagreement',
             reason: firstConflict.title,
+            expectedOutcome: 'Establish which separately attributed observation is current, authoritative, or still unresolved.',
             href: firstConflict.href,
             priority: 'high',
         });
@@ -366,6 +367,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'review-refresh-options',
             label: 'Review limited or stale sources',
             reason: `${input.refreshPlan.items.length} deliberate source refresh option${input.refreshPlan.items.length === 1 ? ' is' : 's are'} available.`,
+            expectedOutcome: 'Determine whether the limitation is transient, persistent, or an expected source constraint.',
             href: '#evidence-quality',
             priority: 'medium',
         });
@@ -376,6 +378,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'inspect-limited-source',
             label: `Inspect ${firstLimited.label}`,
             reason: `${firstLimited.statusLabel} evidence may limit downstream conclusions.`,
+            expectedOutcome: `Clarify which conclusions ${firstLimited.label} can and cannot support in its current state.`,
             href: '#evidence-quality',
             priority: 'medium',
         });
@@ -385,6 +388,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'review-page-identity',
             label: 'Review identity and credential evidence',
             reason: 'Compare declared identity, forms, redirects, and external destinations before making a brand assessment.',
+            expectedOutcome: 'Separate observed identity signals from publisher claims, shared services, and unresolved resemblance leads.',
             href: '#web-evidence',
             priority: 'medium',
         });
@@ -394,6 +398,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'review-acquisition-dependencies',
             label: 'Review transfer dependencies',
             reason: 'Registration dates alone do not describe the DNS, mail, certificate, and website services that require transition.',
+            expectedOutcome: 'Identify dependencies that must be retained, transferred, replaced, or deliberately retired.',
             href: '#web-evidence',
             priority: 'medium',
         });
@@ -403,6 +408,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'review-owned-posture',
             label: 'Review delegation and posture evidence',
             reason: 'Confirm registry publication, authoritative responses, mail, and certificate state together.',
+            expectedOutcome: 'Identify whether observed control state aligns with the reviewed owned-domain baseline.',
             href: '#web-evidence',
             priority: 'medium',
         });
@@ -412,6 +418,7 @@ export function buildLookupDecisionSupport(input) {
             id: 'review-case-handoff',
             label: 'Record or hand off reviewed evidence',
             reason: 'Keep observed facts, hypotheses, unknowns, and analyst decisions separate in the case workflow.',
+            expectedOutcome: 'Preserve a reviewable record of what is known, inferred, unresolved, and recommended next.',
             href: '#case-response',
             priority: 'low',
         });

package/frontend/src/lib/analysis/lookup-presentation.js

@@ -1,9 +1,5 @@
 export const LOOKUP_PRESENTATION_STORAGE_KEY = 'whoisleuth:lookup-presentation:v1';
-export const LOOKUP_EVIDENCE_DENSITIES = Object.freeze([
-    Object.freeze({ id: 'summary', label: 'Summary', detail: 'Overview and source-state ledger, with detailed sections reduced to headings.' }),
-    Object.freeze({ id: 'standard', label: 'Standard', detail: 'Evidence sections remain available while the raw response stays collapsed until you choose to inspect it.' }),
-    Object.freeze({ id: 'full', label: 'Full', detail: 'Every settled evidence section, including the bounded raw response view.' }),
-]);
+export const MAX_LOOKUP_PRESENTATION_SERIALIZED_BYTES = 1_024;
 export const LOOKUP_TASK_VIEWS = Object.freeze([
     Object.freeze({ id: 'general', label: 'General investigation' }),
     Object.freeze({ id: 'acquisition', label: 'Acquisition review' }),
@@ -11,13 +7,7 @@ export const LOOKUP_TASK_VIEWS = Object.freeze([
     Object.freeze({ id: 'incident', label: 'Incident response' }),
     Object.freeze({ id: 'owned', label: 'Owned-domain posture' }),
 ]);
-const DENSITIES = new Set(LOOKUP_EVIDENCE_DENSITIES.map((option) => option.id));
 const TASKS = new Set(LOOKUP_TASK_VIEWS.map((option) => option.id));
-export function normalizeLookupEvidenceDensity(value) {
-    return typeof value === 'string' && DENSITIES.has(value)
-        ? value
-        : 'standard';
-}
 export function normalizeLookupTaskView(value) {
     return typeof value === 'string' && TASKS.has(value)
         ? value
@@ -25,10 +15,15 @@ export function normalizeLookupTaskView(value) {
 }
 export function readLookupPresentation(storage) {
     try {
-        const stored = JSON.parse(storage.getItem(LOOKUP_PRESENTATION_STORAGE_KEY) || 'null');
+        const serialized = storage.getItem(LOOKUP_PRESENTATION_STORAGE_KEY);
+        if (serialized === null
+            || serialized.length > MAX_LOOKUP_PRESENTATION_SERIALIZED_BYTES
+            || new TextEncoder().encode(serialized).byteLength > MAX_LOOKUP_PRESENTATION_SERIALIZED_BYTES) {
+            return { task: 'general' };
+        }
+        const stored = JSON.parse(serialized);
         if (stored?.version === 1) {
             return {
-                density: normalizeLookupEvidenceDensity(stored.density),
                 task: normalizeLookupTaskView(stored.task),
             };
         }
@@ -36,13 +31,12 @@ export function readLookupPresentation(storage) {
     catch {
         // Invalid or unavailable browser storage falls back to the stable defaults.
     }
-    return { density: 'standard', task: 'general' };
+    return { task: 'general' };
 }
 export function writeLookupPresentation(storage, state) {
     try {
         storage.setItem(LOOKUP_PRESENTATION_STORAGE_KEY, JSON.stringify({
             version: 1,
-            density: normalizeLookupEvidenceDensity(state.density),
             task: normalizeLookupTaskView(state.task),
         }));
     }
@@ -51,22 +45,12 @@ export function writeLookupPresentation(storage, state) {
     }
 }
 const PRIORITY = Object.freeze({
-    general: Object.freeze(['overview', 'web-evidence', 'registry', 'external-intelligence', 'case-response', 'raw-data']),
-    acquisition: Object.freeze(['overview', 'registry', 'web-evidence', 'case-response', 'external-intelligence', 'raw-data']),
-    brand: Object.freeze(['overview', 'web-evidence', 'external-intelligence', 'registry', 'case-response', 'raw-data']),
-    incident: Object.freeze(['overview', 'external-intelligence', 'web-evidence', 'registry', 'case-response', 'raw-data']),
-    owned: Object.freeze(['overview', 'registry', 'web-evidence', 'case-response', 'external-intelligence', 'raw-data']),
+    general: Object.freeze(['overview', 'registry', 'web-evidence', 'relationships-history', 'source-quality', 'case-response', 'advanced-evidence']),
+    acquisition: Object.freeze(['overview', 'registry', 'relationships-history', 'web-evidence', 'source-quality', 'case-response', 'advanced-evidence']),
+    brand: Object.freeze(['overview', 'web-evidence', 'relationships-history', 'registry', 'source-quality', 'case-response', 'advanced-evidence']),
+    incident: Object.freeze(['overview', 'web-evidence', 'relationships-history', 'advanced-evidence', 'registry', 'source-quality', 'case-response']),
+    owned: Object.freeze(['overview', 'registry', 'web-evidence', 'relationships-history', 'source-quality', 'case-response', 'advanced-evidence']),
 });
-const INITIAL_PANELS = {
-    general: [],
-    acquisition: ['dns', 'network-context', 'tls'],
-    brand: ['http', 'page-identity', 'credential-surface', 'structured-identity', 'technology'],
-    incident: ['http', 'tls', 'credential-surface', 'security-posture'],
-    owned: ['dns', 'network-context', 'tls', 'security-posture'],
-};
-export function lookupTaskInitiallyExpands(task, panel) {
-    return INITIAL_PANELS[normalizeLookupTaskView(task)].includes(panel);
-}
 export function prioritizeLookupSectionLinks(links, task) {
     const order = PRIORITY[normalizeLookupTaskView(task)];
     const rank = new Map(order.map((id, index) => [`#${id}`, index]));