@slicedearth/whoisleuth-cli 1.43.0 → 1.45.0

package/cli/discovery-snapshot.mjs

@@ -1,13 +1,12 @@
 import { createHash } from 'node:crypto';
-import { open } from 'node:fs/promises';
-import { CliUsageError } from "./errors.mjs";
+import { boundedCliInputError, CliUsageError } from "./errors.mjs";
 import { writePrivateFile } from "./output-file.mjs";
 import { isValidAsciiDomainName } from "../lib/hostname.mjs";
+import { readBoundedRegularTextFile } from "../lib/bounded-file.mjs";
 export const CLI_DISCOVERY_SNAPSHOT_SCHEMA = 'whoisleuth.cli.discovery-snapshot';
 export const CLI_DISCOVERY_SNAPSHOT_VERSION = 1;
 export const MAX_DISCOVERY_SNAPSHOT_BYTES = 4 * 1024 * 1024;
 export const MAX_DISCOVERY_SNAPSHOT_DOMAINS = 10_000;
-const SHA256_RE = /^[a-f0-9]{64}$/u;
 function configurationDigest(configuration) {
     return createHash('sha256').update(JSON.stringify({
         seed: configuration.seed,
@@ -69,22 +68,16 @@ function parseDiscoverySnapshot(text, expectedConfigurationDigest) {
 }
 async function readExistingSnapshot(path) {
     try {
-        const handle = await open(path, 'r');
-        try {
-            const metadata = await handle.stat();
-            if (!metadata.isFile() || metadata.size > MAX_DISCOVERY_SNAPSHOT_BYTES) {
-                throw new CliUsageError(`Discovery snapshot input is limited to ${MAX_DISCOVERY_SNAPSHOT_BYTES} bytes.`);
-            }
-            return await handle.readFile({ encoding: 'utf8' });
-        }
-        finally {
-            await handle.close();
-        }
+        return await readBoundedRegularTextFile(path, {
+            maximumBytes: MAX_DISCOVERY_SNAPSHOT_BYTES,
+            label: 'Discovery snapshot input',
+            allowSymbolicLink: true,
+        });
     }
     catch (error) {
         if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT')
             return null;
-        throw error;
+        throw boundedCliInputError(error, 'Discovery snapshot input');
     }
 }
 async function updateDiscoverySnapshot(path, candidatesValue, configuration, generatedAt) {

package/cli/errors.mjs

@@ -18,4 +18,10 @@ function boundedCliErrorMessage(error, fallback = 'Unexpected command failure')
         .trim()
         .slice(0, MAX_CLI_ERROR_MESSAGE_LENGTH) || fallback;
 }
-export { CliUsageError, MAX_CLI_ERROR_MESSAGE_LENGTH, boundedCliErrorMessage };
+function boundedCliInputError(error, label) {
+    if (error instanceof CliUsageError)
+        return error;
+    const safeLabel = label.replace(/[^A-Za-z0-9 ()_-]+/gu, '').trim().slice(0, 80) || 'Input';
+    return new CliUsageError(`${safeLabel} could not be read as a bounded regular file.`);
+}
+export { CliUsageError, MAX_CLI_ERROR_MESSAGE_LENGTH, boundedCliErrorMessage, boundedCliInputError, };

package/cli/formatters/json.mjs

@@ -10,11 +10,11 @@ const CLI_HTTP_SCHEMA = 'whoisleuth.cli.http';
 const CLI_TLS_SCHEMA = 'whoisleuth.cli.tls';
 const CLI_COMPARE_SCHEMA = 'whoisleuth.cli.compare';
 const CLI_LOOKUP_SCHEMA_VERSION = 1;
-const CLI_BULK_SCHEMA_VERSION = 2;
+const CLI_BULK_SCHEMA_VERSION = 3;
 const CLI_CT_SEARCH_SCHEMA_VERSION = 1;
 const CLI_DISCOVER_SCHEMA_VERSION = 2;
 const CLI_POSTURE_SCHEMA_VERSION = 1;
-const CLI_HTTP_SCHEMA_VERSION = 1;
+const CLI_HTTP_SCHEMA_VERSION = 2;
 const CLI_TLS_SCHEMA_VERSION = 1;
 const CLI_COMPARE_SCHEMA_VERSION = 3;
 function buildCliLookupDocument(query, classified, result, generatedAt = new Date().toISOString(), mode = 'fast', collectionContext = {}) {
@@ -25,6 +25,7 @@ function buildCliLookupDocument(query, classified, result, generatedAt = new Dat
         ? collectionContext.vantageLabel
         : null;
     return {
+        ...result,
         schema: CLI_LOOKUP_SCHEMA,
         version: CLI_LOOKUP_SCHEMA_VERSION,
         generatedAt,
@@ -40,7 +41,6 @@ function buildCliLookupDocument(query, classified, result, generatedAt = new Dat
                 ...(vantageLabel ? { vantageLabel } : {}),
             },
         } : {}),
-        ...result,
     };
 }
 function formatJsonDocument(document) {
@@ -105,15 +105,21 @@ function buildCliCompareDocument(result, generatedAt = new Date().toISOString())
     return { ...result, schema: CLI_COMPARE_SCHEMA, version: CLI_COMPARE_SCHEMA_VERSION, generatedAt };
 }
 function bulkJsonItem(item, metadata) {
+    const provenance = {
+        observedAt: item.observedAt ?? null,
+        collectionOrigin: item.collectionOrigin ?? 'current_run',
+    };
     if (!item.ok) {
         return {
             schema: CLI_BULK_ITEM_SCHEMA, version: CLI_BULK_SCHEMA_VERSION, generatedAt: metadata.generatedAt,
+            ...provenance,
             index: item.index, query: item.query, ok: false, error: item.error,
         };
     }
     const result = item.result;
     return {
         schema: CLI_BULK_ITEM_SCHEMA, version: CLI_BULK_SCHEMA_VERSION, generatedAt: metadata.generatedAt,
+        ...provenance,
         index: item.index, query: item.query, ok: true,
         type: item.classified.type,
         inputHostname: item.classified.inputHostname,
@@ -142,6 +148,8 @@ function buildCliBulkDocument(items, metadata) {
     };
 }
 function formatJsonLines(items, metadata) {
-    return `${items.map((item) => JSON.stringify(bulkJsonItem(item, metadata))).join('\n')}\n`;
+    return items.length
+        ? `${items.map((item) => JSON.stringify(bulkJsonItem(item, metadata))).join('\n')}\n`
+        : '';
 }
 export { CLI_BULK_ITEM_SCHEMA, CLI_BULK_SCHEMA, CLI_BULK_SCHEMA_VERSION, CLI_COMPARE_SCHEMA, CLI_COMPARE_SCHEMA_VERSION, CLI_CT_SEARCH_SCHEMA, CLI_CT_SEARCH_SCHEMA_VERSION, CLI_DISCOVER_ITEM_SCHEMA, CLI_DISCOVER_SCHEMA, CLI_DISCOVER_SCHEMA_VERSION, CLI_HTTP_SCHEMA, CLI_HTTP_SCHEMA_VERSION, CLI_POSTURE_SCHEMA, CLI_POSTURE_SCHEMA_VERSION, CLI_TLS_SCHEMA, CLI_TLS_SCHEMA_VERSION, CLI_LOOKUP_SCHEMA, CLI_LOOKUP_SCHEMA_VERSION, buildCliBulkDocument, buildCliCompareDocument, buildCliCtSearchDocument, buildCliDiscoverDocument, buildCliHttpDocument, buildCliLookupDocument, buildCliPostureDocument, buildCliTlsDocument, bulkJsonItem, discoverJsonItem, formatDiscoverDomainList, formatDiscoverJsonLines, formatJsonDocument, formatJsonLines, };

package/cli/formatters/terminal.mjs

@@ -431,7 +431,7 @@ function formatTerminalHttp(document) {
     const lines = [
         `Domain         ${safeTerminalValue(document.domain)}`,
         `Probe          ${titleCase(document.probeStatus)}`,
-        `Activity       ${titleCase(document.activityStatus)}`,
+        `Assessment     ${titleCase(document.assessment ?? document.activityStatus)}`,
         `Evidence       ${titleCase(http.status)}`,
         `Final URL      ${safeTerminalValue(http.finalUrl)}`,
         `HTTP status    ${safeTerminalValue(response.status)}`,

package/cli/http.mjs

@@ -17,7 +17,8 @@ function buildHttpProbeResult(domain, probe) {
     return {
         domain,
         probeStatus: status,
-        activityStatus: status === 'fetched' || status === 'responded' ? 'active' : 'unreachable',
+        assessment: status === 'fetched' || status === 'responded' ? 'active' : 'inconclusive',
+        activityStatus: status === 'fetched' || status === 'responded' ? 'active' : null,
         detail: boundedDetail(input.detail),
         http: input.http && typeof input.http === 'object' && !Array.isArray(input.http)
             ? input.http

package/cli/lookup-reconcile.mjs

@@ -37,7 +37,7 @@ function buildCliLookupReconciliation(inputs, generatedAt = new Date().toISOStri
         label: `Lookup reconciliation observation ${index + 1}`,
     }));
     const domain = documents[0]?.registrableDomain;
-    if (!domain || documents.some((document) => document.registrableDomain !== domain)) {
+    if (!domain || documents.some((candidate) => candidate.registrableDomain !== domain)) {
         throw new CliUsageError('Lookup reconciliation requires observations for one domain.');
     }
     const comparisons = documents.slice(1).map((document, index) => buildCliLookupDiff(inputs[0], inputs[index + 1], generatedAt, { domainMode: 'same' }));

package/cli/mail-review.mjs

@@ -128,14 +128,14 @@ function parseInput(textValue) {
     try {
         const parsed = JSON.parse(textInput);
         const document = record(parsed);
-        if (document.schema === 'whoisleuth.cli.bulk' && document.version === 2 && Array.isArray(document.results)) {
+        if (document.schema === 'whoisleuth.cli.bulk' && [2, 3].includes(Number(document.version)) && Array.isArray(document.results)) {
             values = document.results;
         }
-        else if (document.schema === 'whoisleuth.cli.bulk.item' && document.version === 2) {
+        else if (document.schema === 'whoisleuth.cli.bulk.item' && [2, 3].includes(Number(document.version))) {
             values = [document];
         }
         else {
-            throw new CliUsageError('Mail review requires WHOISleuth Bulk JSON schema version 2.');
+            throw new CliUsageError('Mail review requires WHOISleuth Bulk JSON schema version 2 or 3.');
         }
     }
     catch (error) {
@@ -152,8 +152,8 @@ function parseInput(textValue) {
         throw new CliUsageError(`Mail review supports between 1 and ${MAX_MAIL_REVIEW_ROWS} Bulk rows.`);
     }
     const rows = values.map((value) => record(value));
-    if (rows.some((value) => value.schema !== 'whoisleuth.cli.bulk.item' || value.version !== 2)) {
-        throw new CliUsageError('Every Mail review row must use WHOISleuth Bulk item schema version 2.');
+    if (rows.some((value) => value.schema !== 'whoisleuth.cli.bulk.item' || ![2, 3].includes(Number(value.version)))) {
+        throw new CliUsageError('Every Mail review row must use WHOISleuth Bulk item schema version 2 or 3.');
     }
     return rows;
 }

package/cli/manual.mjs

@@ -23,7 +23,7 @@ ${commands}
 .SH OUTPUT
 Human-readable output is the default. Versioned JSON and JSONL are available where documented. Diagnostics and optional progress events are written to standard error. Use --output with an optional --force flag for atomic private file output.
 .SH EXIT STATUS
-0 indicates command completion, 2 invalid usage, 3 a collection or comparison failure, 4 an explicitly detected partial result, 70 an internal bootstrap failure, and 130 analyst cancellation.
+0 indicates command completion, 2 invalid usage, 3 a collection or comparison failure, 4 an explicitly detected partial result, 70 an internal bootstrap failure, 130 analyst cancellation, and 143 service termination.
 .SH PRIVACY
 Network commands disclose the target to the directly queried upstream services. Offline commands do not make network requests. Output files are created with private permissions and are never uploaded by the CLI.
 .SH LICENSE

package/cli/registry-fixture-scaffold.mjs

@@ -12,10 +12,11 @@ export function buildRegistryFixtureScaffold(profileIdInput, suffixInput, scenar
         throw new TypeError('The suffix is invalid.');
     if (!SCENARIOS.has(scenario))
         throw new TypeError('Scenario must be registered, not_found, or inconclusive.');
-    const profile = registryCompatibilityMatrix().find((item) => item.id === profileId);
-    if (!profile)
+    const matchingProfiles = registryCompatibilityMatrix().filter((item) => item.id === profileId);
+    if (!matchingProfiles.length)
         throw new TypeError('The capability profile is not present in the registry catalogue.');
-    if (!profile.suffixes.includes(suffix))
+    const profile = matchingProfiles.find((item) => item.suffixes.includes(suffix));
+    if (!profile)
         throw new TypeError(`The capability profile does not cover .${suffix}.`);
     const domain = `EXAMPLE.${suffix.toUpperCase()}`;
     const response = scenario === 'registered'

package/cli/runner.mjs

@@ -57,17 +57,28 @@ import { presentTerminalOutput, terminalPresentation, } from "./terminal-present
 const require = createRequire(import.meta.url);
 const { version: VERSION } = require('../package.json');
 const MAX_STDIN_BYTES = 4096;
-async function readStdinBounded(stream, limit = MAX_STDIN_BYTES) {
+async function readStdinBounded(stream, limit = MAX_STDIN_BYTES, signal) {
     if (!stream || stream.isTTY)
         return '';
+    const abort = () => stream.destroy?.(new DOMException('Aborted', 'AbortError'));
+    if (signal?.aborted)
+        throw new DOMException('Aborted', 'AbortError');
+    signal?.addEventListener('abort', abort, { once: true });
     const chunks = [];
     let total = 0;
-    for await (const chunk of stream) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        total += buffer.length;
-        if (total > limit)
-            throw new CliUsageError(`Standard input is limited to ${limit} bytes.`);
-        chunks.push(buffer);
+    try {
+        for await (const chunk of stream) {
+            if (signal?.aborted)
+                throw new DOMException('Aborted', 'AbortError');
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            total += buffer.length;
+            if (total > limit)
+                throw new CliUsageError(`Standard input is limited to ${limit} bytes.`);
+            chunks.push(buffer);
+        }
+    }
+    finally {
+        signal?.removeEventListener('abort', abort);
     }
     const text = Buffer.concat(chunks).toString('utf8').trim();
     const lines = text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
@@ -136,7 +147,7 @@ async function runParsedCli(args, dependencies = {}) {
         };
         const readSingleInput = async () => (dependencies.readStdin
             ? await dependencies.readStdin()
-            : await readStdinBounded(dependencies.stdin || process.stdin));
+            : await readStdinBounded(dependencies.stdin || process.stdin, MAX_STDIN_BYTES, dependencies.signal));
         const commandContext = Object.freeze({
             stdout,
             stderr,
@@ -289,7 +300,7 @@ async function runParsedCli(args, dependencies = {}) {
         }
         if (args.action === 'registry-support') {
             failureLabel = 'Registry support';
-            const readInput = dependencies.readStdin || (() => readStdinBounded(dependencies.stdin || process.stdin));
+            const readInput = dependencies.readStdin || (() => readStdinBounded(dependencies.stdin || process.stdin, MAX_STDIN_BYTES, dependencies.signal));
             const requestedInput = args.target || await readInput();
             if (!requestedInput)
                 throw new CliUsageError('registry-support requires one domain or suffix as an argument or on stdin.');

package/docs/cli-reference.md

@@ -330,7 +330,8 @@ delivery observed by the caller.
 
 Pressing Ctrl-C asks an in-flight Lookup or Bulk run to stop, suppresses any
 partial final result, flushes an enabled Bulk checkpoint, and exits with code
-130. Already started network operations remain subject to their existing hard
+130. SIGTERM follows the same graceful cleanup path and exits with code 143.
+Already started network operations remain subject to their existing hard
 timeouts while the shared in-process API unwinds; the executable terminates
 after CLI cleanup. A second Ctrl-C removes any known unpublished temporary
 output file on a best-effort basis before exiting immediately.
@@ -338,11 +339,23 @@ output file on a best-effort basis before exiting immediately.
 Bulk can persist compact progress with `--checkpoint <file>`. A new checkpoint
 is private, bounded to 16 MiB, versioned, and tied to the exact ordered input
 and scan mode by SHA-256. It stores only compact per-item results, never full
-Lookup responses. Reusing the same path is refused unless `--resume` is also
+Lookup responses. Checkpoint schema 2 records a nullable per-row observation
+time. Schema 1 remains readable, but its resumed rows keep observation time
+unknown rather than inheriting the resume time. Reusing the same path is
+refused unless `--resume` is also
 specified. Resume revalidates the complete untrusted document and skips only
 the exact completed rows; changed input, mode, schema, digest, or malformed
 results fail closed.
 
+Bulk JSON, JSONL, and item documents use schema version 3. Each row includes
+`observedAt` and a `collectionOrigin` of `current_run` or
+`resumed_checkpoint`; the top-level `generatedAt` remains the report creation
+time. HTTP JSON uses schema version 2 and adds the explicit `assessment` field.
+The legacy `activityStatus` field remains for compatibility, but is `null`
+when collection is inconclusive rather than labelling the target unreachable.
+Consumers should use `assessment`; older version-1 `unreachable` values remain
+historical inconclusive labels, not proof that a target cannot be reached.
+
 If checkpoint persistence fails after collection, WHOISleuth still emits the
 completed final result, reports the checkpoint limitation, and exits with code
 4. The last successfully published checkpoint remains available, but it may
@@ -393,6 +406,7 @@ machine access is not evidence that a domain is unregistered or safe.
 | 4 | A bounded operation completed partially, such as Bulk item failures or failed explicit Doctor network checks. |
 | 70 | Unexpected CLI bootstrap failure. |
 | 130 | The analyst cancelled the command. No partial final result was emitted. |
+| 143 | The process received SIGTERM. No partial final result was emitted. |
 
 This release supports `lookup`, `bulk`, `ct-search`, `ct-intake`, `map-observations`, `oam-export`, `discover`, `discover-scan`, `posture`,
 `http`, `tls`, `registry-support`, `registry-doctor`, `registry-cohort`, `registry-scaffold`, `risk-calibrate`,
@@ -1255,12 +1269,17 @@ text, and a version-2 `whoisleuth.web-capture-manifest` compatible with the
 Cases importer. Version-1 manifests remain importable.
 
 Rendered capture executes page JavaScript. It caps HTTP(S) requests and request
-hostnames, blocks downloads, service workers, WebSockets, non-read methods,
-credentials, non-default ports, and private or reserved addresses, and retains
+hostnames, blocks downloads, service workers, WebSockets, WebRTC, WebTransport,
+non-read methods, credentials, non-default ports, and private or reserved
+addresses, and retains
 no request path, query, headers, bodies, cookies, credentials, DOM markup, or
-page text. The browser connection is not pinned to the address checked before
-each hostname's first request, so DNS rebinding remains a residual risk. Use a
-disposable network-restricted environment for untrusted targets.
+page text. Every browser request is intercepted, its hostname is resolved again,
+and the bounded response is fetched through WHOISleuth's public-address-pinned
+transport. Individual responses are capped at 4 MiB and all fetched response
+bodies together are capped at 24 MiB. Redirect destinations pass through the
+same interception and validation before collection continues. Use a disposable
+network-restricted environment for untrusted targets because rendered page code
+still executes inside the isolated browser process.
 
 The separate offline comparison command accepts two selected version-2 local
 capture manifests. It first verifies each referenced screenshot and DOM digest

package/docs/cli.md

@@ -168,6 +168,7 @@ commands do not publish partial files. Output is capped at 32 MiB.
 | 4 | A bounded operation completed partially. |
 | 70 | Unexpected CLI bootstrap failure. |
 | 130 | The analyst cancelled the command; no partial final result was emitted. |
+| 143 | The process received SIGTERM; no partial final result was emitted. |
 
 ## Detailed command reference
 

package/frontend/src/lib/analysis/acquisition-due-diligence.js

@@ -205,7 +205,7 @@ function contactsItem(insights) {
 function sourceComplete(evidence) {
     return evidence.source === 'dns' && evidence.complete === true;
 }
-function transitionDependencies(availability, activation, dnsEvidence, dnsRecords, tlsEvidence) {
+function transitionDependencies(_availability, activation, dnsEvidence, dnsRecords, tlsEvidence) {
     const dnsComplete = sourceComplete(dnsEvidence);
     const nameservers = strings(dnsRecords.ns);
     const addresses = [...strings(dnsRecords.a), ...strings(dnsRecords.aaaa)];

package/frontend/src/lib/analysis/brand-profile-model.js

@@ -67,7 +67,7 @@ function boundedText(value, maximum = MAX_PROFILE_TEXT_LENGTH) {
         return '';
     return value.slice(0, maximum * 4).replace(/\s+/g, ' ').trim().slice(0, maximum).trim();
 }
-function safeId(value) {
+export function normalizeBrandProfileId(value) {
     return typeof value === 'string' && SAFE_ID_RE.test(value) ? value : null;
 }
 function timestamp(value, fallback) {
@@ -337,7 +337,9 @@ export function normalizeBrandProfile(raw, options = {}) {
     const pageBaseline = candidateBaseline && officialDomains.includes(candidateBaseline.domain)
         ? candidateBaseline
         : null;
-    const profileId = safeId(existing?.id) || safeId(value.id) || (typeof options.makeId === 'function' ? safeId(options.makeId()) : null);
+    const profileId = normalizeBrandProfileId(existing?.id)
+        || normalizeBrandProfileId(value.id)
+        || (typeof options.makeId === 'function' ? normalizeBrandProfileId(options.makeId()) : null);
     const name = boundedText(value.name, MAX_PROFILE_NAME_LENGTH);
     if (!profileId || !name)
         return null;

package/frontend/src/lib/analysis/case-evidence-model.js

@@ -2,7 +2,7 @@
 // record normalization, and analyst updates.
 import { normalizeHttpSummary } from "./http-summary.js";
 import { normalizeOpportunityModelVersion, normalizeRiskModelVersion } from "./scoring.js";
-import { CASE_DISPOSITIONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_CASES, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.js";
+import { MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, } from "./case-record-contracts.js";
 import { CONCLUSIVE_AVAILABILITY, DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_RANK, EVIDENCE_SOURCE_SET, REGISTERED_LIKE, hashString, isoOrNull, objectRecord, safeId, } from "./case-record-core.js";
 function evidenceString(value, max = MAX_EVIDENCE_STRING_LENGTH) {
     if (value == null)

package/frontend/src/lib/analysis/case-record-core.js

@@ -1,6 +1,6 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
-import { CASE_DISPOSITIONS, CASE_REVIEW_REASONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_CASES, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.js";
+import { CASE_DISPOSITIONS, CASE_REVIEW_REASONS, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_DOMAIN_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.js";
 // Forward-version policy (two distinct guarantees):
 //   - A locally-stored envelope that declares a version greater than this is
 //     still read best-effort on load (known fields kept, unknown dropped), but

package/frontend/src/lib/analysis/case-record-operations.js

@@ -1,7 +1,7 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
 import { appendCaseAction, appendCaseAssertion, appendCaseDecision, appendCaseEvidencePin, appendCaseEvidencePins, appendCaseManualTrailEvent, appendCaseSighting, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseSightings, updateCaseAction, updateCaseAssertion, } from "./case-response-model.js";
-import { CASE_DISPOSITIONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_CASES, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.js";
+import { MAX_CASES, MAX_NOTES_PER_CASE, } from "./case-record-contracts.js";
 import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, deterministicId, isoOrNow, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeReviewReasonCode, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.js";
 import { normalizeEvidenceHistory, } from "./case-evidence-model.js";
 // ---------------------------------------------------------------------------

package/frontend/src/lib/analysis/lookup-asset-graph.js

@@ -372,7 +372,7 @@ export function buildLookupAssetGraph(input) {
             completeness: sourceCompleteness(networkContext),
             limitations: limitations(networkContext.limitations),
             lenses: ['all'],
-            href: '#evidence-network-context',
+            href: '#evidence-network',
         });
     }
     const networkLabel = text(network.name || network.holder || network.handle, 180);
@@ -390,7 +390,7 @@ export function buildLookupAssetGraph(input) {
             completeness: sourceCompleteness(networkContext),
             limitations: limitations(networkContext.limitations),
             lenses: ['all'],
-            href: '#evidence-network-context',
+            href: '#evidence-network',
         });
     }
     for (const cidr of textList(network.cidrs, 8)) {
@@ -407,7 +407,7 @@ export function buildLookupAssetGraph(input) {
                 completeness: sourceCompleteness(networkContext),
                 limitations: limitations(networkContext.limitations),
                 lenses: ['all'],
-                href: '#evidence-network-context',
+                href: '#evidence-network',
             });
         }
     }
@@ -437,7 +437,7 @@ export function buildLookupAssetGraph(input) {
             completeness: sourceCompleteness(input.pageIdentity),
             limitations: limitations(record(input.pageIdentity).limitations),
             lenses: ['identity'],
-            href: '#evidence-page-identity',
+            href: '#evidence-page',
             boundary: trustBoundary(canonicalHost, finalHost || target),
         }, 'Publisher-declared canonical origin', identitySource);
     }
@@ -451,7 +451,7 @@ export function buildLookupAssetGraph(input) {
             completeness: sourceCompleteness(input.pageIdentity),
             limitations: limitations(record(input.pageIdentity).limitations),
             lenses: ['identity'],
-            href: '#evidence-page-identity',
+            href: '#evidence-page',
             boundary: trustBoundary(openGraphHost, finalHost || target),
         }, 'Publisher-declared Open Graph origin', identitySource);
     }
@@ -466,7 +466,7 @@ export function buildLookupAssetGraph(input) {
                 completeness: sourceCompleteness(input.pageIdentity),
                 limitations: ['A declared form action does not prove that a user submitted data or that the endpoint received it.'],
                 lenses: ['identity'],
-                href: '#evidence-page-identity',
+                href: '#evidence-page',
                 boundary: trustBoundary(host, finalHost || target),
             }, 'External form-action origin', identitySource);
         }
@@ -482,7 +482,7 @@ export function buildLookupAssetGraph(input) {
                 completeness: sourceCompleteness(input.pageIdentity),
                 limitations: ['A static resource reference does not prove that a browser loaded the resource or disclosed data to it.'],
                 lenses: ['identity'],
-                href: '#evidence-page-identity',
+                href: '#evidence-page',
                 boundary: trustBoundary(host, finalHost || target),
             }, 'External resource origin', identitySource);
         }
@@ -498,7 +498,7 @@ export function buildLookupAssetGraph(input) {
                 completeness: sourceCompleteness(input.pageIdentity),
                 limitations: ['A shared identifier is a relationship lead and does not establish common ownership or control.'],
                 lenses: ['identity'],
-                href: '#evidence-page-identity',
+                href: '#evidence-page',
             }, text(identifier.type, 80), identitySource);
         }
     }

package/frontend/src/lib/analysis/lookup-decision-support.js

@@ -275,7 +275,7 @@ function identityEntries(input) {
             title: 'The declared canonical origin differs from the observed final origin',
             detail: `${finalHost} served the page while the document declared ${canonicalHost} as canonical.`,
             sources: ['HTTP', 'HTML'],
-            href: '#evidence-page-identity',
+            href: '#evidence-page',
         });
     }
     if (finalHost && openGraphHost && !sameRegistrableScope(finalHost, openGraphHost, registrableDomain)) {
@@ -286,7 +286,7 @@ function identityEntries(input) {
             title: 'The Open Graph URL points outside the observed final origin',
             detail: `${finalHost} served the page while Open Graph metadata declared ${openGraphHost}. Publisher metadata is a claim, not identity proof.`,
             sources: ['HTTP', 'HTML'],
-            href: '#evidence-page-identity',
+            href: '#evidence-page',
         });
     }
     return output;

package/frontend/src/lib/analysis/lookup-presentation.js

@@ -1,9 +1,5 @@
 export const LOOKUP_PRESENTATION_STORAGE_KEY = 'whoisleuth:lookup-presentation:v1';
-export const LOOKUP_EVIDENCE_DENSITIES = Object.freeze([
-    Object.freeze({ id: 'summary', label: 'Essentials', detail: 'A compact assessment, key observations, unresolved evidence, and one summary for each evidence family.' }),
-    Object.freeze({ id: 'standard', label: 'Evidence', detail: 'Settled evidence is grouped by task while source detail and raw evidence stay collapsed until you inspect them.' }),
-    Object.freeze({ id: 'full', label: 'All evidence', detail: 'Every settled evidence family remains available, including advanced and bounded raw evidence.' }),
-]);
+export const MAX_LOOKUP_PRESENTATION_SERIALIZED_BYTES = 1_024;
 export const LOOKUP_TASK_VIEWS = Object.freeze([
     Object.freeze({ id: 'general', label: 'General investigation' }),
     Object.freeze({ id: 'acquisition', label: 'Acquisition review' }),
@@ -11,13 +7,7 @@ export const LOOKUP_TASK_VIEWS = Object.freeze([
     Object.freeze({ id: 'incident', label: 'Incident response' }),
     Object.freeze({ id: 'owned', label: 'Owned-domain posture' }),
 ]);
-const DENSITIES = new Set(LOOKUP_EVIDENCE_DENSITIES.map((option) => option.id));
 const TASKS = new Set(LOOKUP_TASK_VIEWS.map((option) => option.id));
-export function normalizeLookupEvidenceDensity(value) {
-    return typeof value === 'string' && DENSITIES.has(value)
-        ? value
-        : 'summary';
-}
 export function normalizeLookupTaskView(value) {
     return typeof value === 'string' && TASKS.has(value)
         ? value
@@ -25,10 +15,15 @@ export function normalizeLookupTaskView(value) {
 }
 export function readLookupPresentation(storage) {
     try {
-        const stored = JSON.parse(storage.getItem(LOOKUP_PRESENTATION_STORAGE_KEY) || 'null');
+        const serialized = storage.getItem(LOOKUP_PRESENTATION_STORAGE_KEY);
+        if (serialized === null
+            || serialized.length > MAX_LOOKUP_PRESENTATION_SERIALIZED_BYTES
+            || new TextEncoder().encode(serialized).byteLength > MAX_LOOKUP_PRESENTATION_SERIALIZED_BYTES) {
+            return { task: 'general' };
+        }
+        const stored = JSON.parse(serialized);
         if (stored?.version === 1) {
             return {
-                density: normalizeLookupEvidenceDensity(stored.density),
                 task: normalizeLookupTaskView(stored.task),
             };
         }
@@ -36,13 +31,12 @@ export function readLookupPresentation(storage) {
     catch {
         // Invalid or unavailable browser storage falls back to the stable defaults.
     }
-    return { density: 'summary', task: 'general' };
+    return { task: 'general' };
 }
 export function writeLookupPresentation(storage, state) {
     try {
         storage.setItem(LOOKUP_PRESENTATION_STORAGE_KEY, JSON.stringify({
             version: 1,
-            density: normalizeLookupEvidenceDensity(state.density),
             task: normalizeLookupTaskView(state.task),
         }));
     }