@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/{frontend/src/lib/analysis/bulk-session-model.js → packages/workspace/bulk-session-model.mjs}

@@ -1,18 +1,15 @@
 // Pure, bounded persistence model for analyst-saved Bulk investigations.
 // Sessions retain compact derived rows and source states, never raw registry,
 // WHOIS, HTTP, TLS, page, or provider payloads.
-import { normalizeDomain } from "./case-model.js";
-import { normalizeCaaCritical } from "./dns-record-normalization.js";
-export const BULK_SESSION_SCHEMA = 'whoisleuth.bulk-sessions';
-export const BULK_SESSION_SCHEMA_VERSION = 3;
-export const SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS = Object.freeze([1, 2, BULK_SESSION_SCHEMA_VERSION]);
-export const MAX_BULK_SESSIONS = 10;
-export const MAX_BULK_SESSION_ROWS = 2_000;
-export const MAX_BULK_SESSION_STORE_BYTES = 4 * 1024 * 1024;
-export const MAX_BULK_SESSION_NAME_LENGTH = 100;
-export const MAX_BULK_SESSION_TEXT_LENGTH = 500;
-export const MAX_BULK_SESSION_ARRAY_VALUES = 100;
-export const MAX_BULK_SESSION_SOURCES = 12;
+import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeCaaCritical } from "./dns-record-normalization.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { BULK_SESSION_SCHEMA, BULK_SESSION_SCHEMA_VERSION, MAX_BULK_PROFILE_CONTEXT_LIMITATION_LENGTH, MAX_BULK_SESSIONS, MAX_BULK_SESSION_ARRAY_VALUES, MAX_BULK_SESSION_NAME_LENGTH, MAX_BULK_SESSION_ROWS, MAX_BULK_SESSION_SOURCES, MAX_BULK_SESSION_STORE_BYTES, MAX_BULK_SESSION_TEXT_LENGTH, SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
+export { BULK_SESSION_SCHEMA, BULK_SESSION_SCHEMA_VERSION, MAX_BULK_PROFILE_CONTEXT_LIMITATION_LENGTH, MAX_BULK_SESSIONS, MAX_BULK_SESSION_ARRAY_VALUES, MAX_BULK_SESSION_NAME_LENGTH, MAX_BULK_SESSION_ROWS, MAX_BULK_SESSION_SOURCES, MAX_BULK_SESSION_STORE_BYTES, MAX_BULK_SESSION_TEXT_LENGTH, SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
+export const BULK_PROFILE_CONTEXT_UNAVAILABLE_LIMITATION = 'Brand Profile context was unavailable when this row was evaluated. Trust, profile matches, and the profile-dependent Risk assessment remain inconclusive.';
+export const BULK_PROFILE_CONTEXT_MISMATCH_LIMITATION = 'This saved Bulk row was evaluated with a different or unreadable Brand Profile context. Profile-derived conclusions and the Risk assessment are withheld until the domain is rescanned.';
+export const BULK_PROFILE_CONTEXT_IMPORTED_LIMITATION = 'This row came from a portable import whose claimed Brand Profile identity and revision cannot authenticate profile-derived conclusions. Trust, profile matches, and the potentially profile-influenced Risk assessment are withheld until the domain is rescanned locally.';
 const CONTROL_RE = /[\x00-\x1f\x7f]/u;
 const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
 const DIGEST_RE = /^sha256:[a-f0-9]{64}$/u;
@@ -36,9 +33,7 @@ const SOURCE_STATES = new Set([
 const TRUST_STATES = new Set(['official', 'partner', 'allowlisted']);
 const COMPARISON_STATES = new Set(['error', 'not_found', 'partial', 'success', 'unavailable']);
 function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : null;
+    return ordinaryWorkspaceRecord(value, 'Bulk-session input');
 }
 function boundedText(value, maximum = MAX_BULK_SESSION_TEXT_LENGTH) {
     return typeof value === 'string' && value.length <= maximum && !CONTROL_RE.test(value)
@@ -46,8 +41,75 @@ function boundedText(value, maximum = MAX_BULK_SESSION_TEXT_LENGTH) {
         : '';
 }
 function timestamp(value, fallback = null) {
-    const text = boundedText(value, 64);
-    return text && Number.isFinite(Date.parse(text)) ? new Date(text).toISOString() : fallback;
+    return normalizeExplicitIsoTimestamp(value) ?? fallback;
+}
+function profileContextLimitation(value, fallback) {
+    return boundedText(value, MAX_BULK_PROFILE_CONTEXT_LIMITATION_LENGTH) || fallback;
+}
+export function unavailableBulkProfileContext(limitation = BULK_PROFILE_CONTEXT_UNAVAILABLE_LIMITATION) {
+    return {
+        sourceState: 'unavailable',
+        activeProfileId: null,
+        profileUpdatedAt: null,
+        limitation: profileContextLimitation(limitation, BULK_PROFILE_CONTEXT_UNAVAILABLE_LIMITATION),
+    };
+}
+export function bulkProfileContextProvenance(sourceState, profileRaw) {
+    if (sourceState !== 'ready')
+        return unavailableBulkProfileContext();
+    if (profileRaw === null || profileRaw === undefined) {
+        return { sourceState: 'ready', activeProfileId: null, profileUpdatedAt: null, limitation: '' };
+    }
+    const profile = record(profileRaw);
+    const activeProfileId = typeof profile?.id === 'string' && SAFE_ID_RE.test(profile.id) ? profile.id : null;
+    const profileUpdatedAt = timestamp(profile?.updatedAt);
+    return activeProfileId && profileUpdatedAt
+        ? { sourceState: 'ready', activeProfileId, profileUpdatedAt, limitation: '' }
+        : unavailableBulkProfileContext('The active Brand Profile identity or revision was invalid when this row was evaluated. Profile-derived conclusions and the Risk assessment remain inconclusive.');
+}
+export function normalizeBulkProfileContext(value, fallbackLimitation = BULK_PROFILE_CONTEXT_UNAVAILABLE_LIMITATION) {
+    const item = record(value);
+    const sourceState = item?.sourceState;
+    if (sourceState === 'ready') {
+        if (item?.activeProfileId === null && item.profileUpdatedAt === null) {
+            return { sourceState: 'ready', activeProfileId: null, profileUpdatedAt: null, limitation: '' };
+        }
+        const activeProfileId = typeof item?.activeProfileId === 'string' && SAFE_ID_RE.test(item.activeProfileId)
+            ? item.activeProfileId
+            : null;
+        const profileUpdatedAt = timestamp(item?.profileUpdatedAt);
+        if (activeProfileId && profileUpdatedAt) {
+            return { sourceState: 'ready', activeProfileId, profileUpdatedAt, limitation: '' };
+        }
+    }
+    if (sourceState === 'mixed') {
+        return {
+            sourceState: 'mixed',
+            activeProfileId: null,
+            profileUpdatedAt: null,
+            limitation: profileContextLimitation(item?.limitation, 'Rows in this saved Bulk session were evaluated under more than one Brand Profile context. Review each row provenance before comparison.'),
+        };
+    }
+    return unavailableBulkProfileContext(profileContextLimitation(item?.limitation, fallbackLimitation));
+}
+function sameProfileContext(left, right) {
+    return left.sourceState === right.sourceState
+        && left.activeProfileId === right.activeProfileId
+        && left.profileUpdatedAt === right.profileUpdatedAt
+        && left.limitation === right.limitation;
+}
+export function summarizeBulkProfileContexts(rows) {
+    const first = rows[0]?.profileContext;
+    if (!first)
+        return unavailableBulkProfileContext('This saved Bulk session contains no settled row with profile-context provenance.');
+    if (rows.every((row) => sameProfileContext(first, row.profileContext)))
+        return { ...first };
+    return {
+        sourceState: 'mixed',
+        activeProfileId: null,
+        profileUpdatedAt: null,
+        limitation: 'Rows in this saved Bulk session were evaluated under more than one Brand Profile context. Review each row provenance before comparison.',
+    };
 }
 function nullableBoolean(value) {
     return typeof value === 'boolean' ? value : null;
@@ -215,7 +277,27 @@ export function normalizeBulkSessionResult(value) {
     const scanDepth = boundedText(item?.scanDepth, 10);
     if (!item || !domain || !RESULT_STATES.has(status) || !MODES.has(scanDepth))
         return null;
+    const rawProfileContext = record(item.profileContext);
+    if (!rawProfileContext || !['ready', 'unavailable'].includes(String(rawProfileContext.sourceState)))
+        return null;
+    const profileContext = normalizeBulkProfileContext(rawProfileContext);
+    if (rawProfileContext.sourceState === 'ready' && profileContext.sourceState !== 'ready')
+        return null;
+    const profileContextReady = profileContext.sourceState === 'ready';
     const trusted = boundedText(item.trusted, 20);
+    const relationship = normalizeRelationship(item.relationship);
+    const readyWithoutActiveProfile = profileContextReady && profileContext.activeProfileId === null;
+    const impossibleNoProfileClaim = readyWithoutActiveProfile && (TRUST_STATES.has(trusted)
+        || item.faviconMatch === true
+        || item.faviconNearMatch === true
+        || item.reusesOfficialAssets === true
+        || item.idnReferenceMatch === true
+        || item.pageBaselineMatch === true
+        || item.hasActiveBrandProfile === true
+        || relationship.officialAssetHosts.length > 0);
+    const profileClaimsUsable = profileContextReady && !impossibleNoProfileClaim;
+    if (!profileClaimsUsable || readyWithoutActiveProfile)
+        relationship.officialAssetHosts = [];
     return {
         domain,
         status: status,
@@ -223,10 +305,10 @@ export function normalizeBulkSessionResult(value) {
         confidence: boundedText(item.confidence, 40) || 'unknown',
         registrar: boundedText(item.registrar, 300) || '—',
         activity: boundedText(item.activity, 300) || '—',
-        risk: nullableScore(item.risk),
+        risk: profileClaimsUsable ? nullableScore(item.risk) : null,
         opportunity: nullableScore(item.opportunity),
         mutationTypes: boundedStrings(item.mutationTypes, 40),
-        trusted: TRUST_STATES.has(trusted) ? trusted : null,
+        trusted: profileClaimsUsable && !readyWithoutActiveProfile && TRUST_STATES.has(trusted) ? trusted : null,
         error: boundedText(item.error),
         scanDepth: scanDepth,
         createdDate: boundedText(item.createdDate, 64) || null,
@@ -241,23 +323,24 @@ export function normalizeBulkSessionResult(value) {
         pageTitle: boundedText(item.pageTitle, 300) || null,
         faviconHash: nullableHash(item.faviconHash, HASH_64_RE),
         faviconPHash: nullableHash(item.faviconPHash, PHASH_RE),
-        faviconMatch: item.faviconMatch === true,
-        faviconNearMatch: item.faviconNearMatch === true,
-        reusesOfficialAssets: item.reusesOfficialAssets === true,
+        faviconMatch: profileClaimsUsable ? nullableBoolean(item.faviconMatch) : null,
+        faviconNearMatch: profileClaimsUsable ? nullableBoolean(item.faviconNearMatch) : null,
+        reusesOfficialAssets: profileClaimsUsable ? nullableBoolean(item.reusesOfficialAssets) : null,
         hasPasswordField: item.hasPasswordField === true,
         hasExternalFormAction: nullableBoolean(item.hasExternalFormAction),
         phishingLanguageMatch: boundedText(item.phishingLanguageMatch, 300) || null,
-        idnReferenceMatch: nullableBoolean(item.idnReferenceMatch),
-        pageBaselineMatch: nullableBoolean(item.pageBaselineMatch),
-        hasActiveBrandProfile: nullableBoolean(item.hasActiveBrandProfile),
-        riskModelVersion: nullableVersion(item.riskModelVersion),
+        idnReferenceMatch: profileClaimsUsable ? nullableBoolean(item.idnReferenceMatch) : null,
+        pageBaselineMatch: profileClaimsUsable ? nullableBoolean(item.pageBaselineMatch) : null,
+        hasActiveBrandProfile: profileClaimsUsable ? nullableBoolean(item.hasActiveBrandProfile) : null,
+        riskModelVersion: profileClaimsUsable ? nullableVersion(item.riskModelVersion) : null,
         opportunityModelVersion: nullableVersion(item.opportunityModelVersion),
-        riskFactors: normalizeRiskFactors(item.riskFactors),
+        riskFactors: profileClaimsUsable ? normalizeRiskFactors(item.riskFactors) : [],
         dns: normalizeDns(item.dns),
         dnssec: boundedText(item.dnssec, 40) || null,
         comparisonEvidence: normalizeBulkComparisonEvidence(item.comparisonEvidence),
-        relationship: normalizeRelationship(item.relationship),
+        relationship,
         sourceCoverage: normalizeSourceCoverage(item.sourceCoverage),
+        profileContext,
     };
 }
 export function normalizeBulkSession(value) {
@@ -282,18 +365,27 @@ export function normalizeBulkSession(value) {
     const domains = domainList(item.domains);
     if (!domains.length)
         return null;
+    if (!Array.isArray(item.results))
+        return null;
     const allowed = new Set(domains);
     const results = [];
     const seen = new Set();
     for (const candidate of Array.isArray(item.results) ? item.results.slice(0, MAX_BULK_SESSION_ROWS * 2) : []) {
         const result = normalizeBulkSessionResult(candidate);
-        if (!result || !allowed.has(result.domain) || seen.has(result.domain))
-            continue;
+        if (!result || !allowed.has(result.domain) || seen.has(result.domain)) {
+            return null;
+        }
         seen.add(result.domain);
         results.push(result);
-        if (results.length >= MAX_BULK_SESSION_ROWS)
-            break;
     }
+    if ((state === 'complete') !== (results.length === domains.length))
+        return null;
+    const profileContext = summarizeBulkProfileContexts(results);
+    if (!record(item.profileContext))
+        return null;
+    const declaredProfileContext = normalizeBulkProfileContext(item.profileContext);
+    if (!sameProfileContext(declaredProfileContext, profileContext))
+        return null;
     return {
         id,
         name,
@@ -305,6 +397,7 @@ export function normalizeBulkSession(value) {
         startedAt,
         updatedAt,
         completedAt,
+        profileContext,
     };
 }
 export function bulkSessionStoreVersion(raw) {
@@ -314,7 +407,13 @@ export function bulkSessionStoreVersion(raw) {
         : null;
 }
 export function normalizeBulkSessionStore(raw) {
+    assertWorkspaceInputGraph(raw, 'Bulk-session store');
+    assertWorkspaceDeclaredVersion(raw, 'Bulk-session store');
     const value = record(raw);
+    if (value?.schema === BULK_SESSION_SCHEMA
+        && !SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS.includes(Number(value.version))) {
+        throw new Error(`Bulk-session store schema ${String(value.version)} is unsupported; no data was changed.`);
+    }
     const candidates = Array.isArray(raw)
         ? raw
         : value?.schema === BULK_SESSION_SCHEMA
@@ -389,12 +488,22 @@ export function deleteBulkSession(raw, idRaw) {
 function sourceStateMap(value) {
     return new Map(value.sourceCoverage.map((item) => [item.source, item.state]));
 }
+function comparableRisk(previous, current) {
+    return previous.profileContext.sourceState === 'ready'
+        && current.profileContext.sourceState === 'ready'
+        && sameProfileContext(previous.profileContext, current.profileContext)
+        && previous.risk !== null
+        && current.risk !== null
+        && previous.riskModelVersion !== null
+        && previous.riskModelVersion === current.riskModelVersion;
+}
 function resultChanges(previous, current) {
     const changes = [];
     if (previous.availability !== current.availability)
         changes.push(`Registration: ${previous.availability} → ${current.availability}`);
-    if (previous.risk !== current.risk)
+    if (comparableRisk(previous, current) && previous.risk !== current.risk) {
         changes.push(`Risk: ${previous.risk ?? 'unavailable'} → ${current.risk ?? 'unavailable'}`);
+    }
     if (previous.registrar !== current.registrar)
         changes.push(`Registrar: ${previous.registrar} → ${current.registrar}`);
     if (previous.activity !== current.activity)
@@ -429,6 +538,7 @@ export function compareBulkSessions(baselineRaw, currentRaw) {
     const before = new Map(baseline.results.map((result) => [result.domain, result]));
     const after = new Map(current.results.map((result) => [result.domain, result]));
     const rows = [];
+    let riskIncomparable = false;
     let added = 0;
     let removed = 0;
     let unchanged = 0;
@@ -444,6 +554,8 @@ export function compareBulkSessions(baselineRaw, currentRaw) {
             rows.push({ domain, changes: ['Absent from the later settled result set.'] });
         }
         else {
+            if (!comparableRisk(previous, next))
+                riskIncomparable = true;
             const changes = resultChanges(previous, next);
             if (changes.length)
                 rows.push({ domain, changes });
@@ -463,6 +575,9 @@ export function compareBulkSessions(baselineRaw, currentRaw) {
             'This compares compact saved observations, not historical provider data or raw source payloads.',
             'A source-state change may reflect collection availability rather than a change to the domain.',
             'A missing row means it was not completed in that saved session; it does not establish domain removal.',
+            ...(riskIncomparable
+                ? ['Risk deltas are omitted unless both rows retain the same ready Brand Profile provenance and the same versioned Risk model.']
+                : []),
         ],
     };
 }
@@ -480,6 +595,9 @@ export function buildBulkSessionExport(sessions, generatedAt = new Date().toISOS
     };
 }
 export function mergeBulkSessions(localRaw, importedRaw) {
+    assertWorkspaceInputGraph(localRaw, 'Local Bulk-session store');
+    assertWorkspaceInputGraph(importedRaw, 'Imported Bulk-session document');
+    assertWorkspacePortableVersion(importedRaw, BULK_SESSION_SCHEMA_VERSION, 'Imported Bulk-session document');
     const imported = record(importedRaw);
     if (!imported || imported.schema !== BULK_SESSION_SCHEMA || !Array.isArray(imported.sessions)) {
         throw new Error('This file is not a WHOISleuth Bulk session export.');
@@ -495,20 +613,42 @@ export function mergeBulkSessions(localRaw, importedRaw) {
     let updated = 0;
     let skipped = 0;
     for (const candidate of imported.sessions.slice(0, MAX_BULK_SESSIONS * 4)) {
-        const session = normalizeBulkSession(candidate);
+        const normalized = normalizeBulkSession(candidate);
+        if (!normalized) {
+            skipped += 1;
+            continue;
+        }
+        const importedProfileContext = unavailableBulkProfileContext(BULK_PROFILE_CONTEXT_IMPORTED_LIMITATION);
+        const quarantinedResults = normalized.results.map((result) => ({
+            ...result,
+            risk: null,
+            trusted: null,
+            faviconMatch: null,
+            faviconNearMatch: null,
+            reusesOfficialAssets: null,
+            idnReferenceMatch: null,
+            pageBaselineMatch: null,
+            hasActiveBrandProfile: null,
+            riskModelVersion: null,
+            riskFactors: [],
+            relationship: { ...result.relationship, officialAssetHosts: [] },
+            profileContext: importedProfileContext,
+        }));
+        const session = normalizeBulkSession({
+            ...normalized,
+            results: quarantinedResults,
+            profileContext: summarizeBulkProfileContexts(quarantinedResults),
+        });
         if (!session) {
             skipped += 1;
             continue;
         }
         const existing = sessions.find((item) => item.id === session.id);
-        if (!existing)
-            added += 1;
-        else if (existing.updatedAt !== session.updatedAt)
-            updated += 1;
-        else {
+        if (existing) {
             skipped += 1;
             continue;
         }
+        added += 1;
         sessions = upsertBulkSession(sessions, session).sessions;
     }
     const bounded = enforceBulkSessionStoreBudget({

package/{frontend/src/lib/analysis/bulk-sort.js → packages/workspace/bulk-sort.mjs}

@@ -1,3 +1,7 @@
+/** Opportunity remains a retained data/export field, but is no longer a Bulk presentation sort. */
+export function normalizeBulkPresentationSortKey(key) {
+    return key === 'opportunity' ? 'risk' : key;
+}
 const CONFIDENCE_RANK = {
     low: 0,
     medium: 1,
@@ -15,8 +19,11 @@ function compareText(left, right) {
     const rightText = boundedText(right);
     return leftText.localeCompare(rightText, 'en', { numeric: true, sensitivity: 'base' });
 }
-function sortValue(row, key) {
-    if (key === 'risk' || key === 'opportunity') {
+function sortValue(row, key, comparableRisk) {
+    if (key === 'risk') {
+        return { missing: !Number.isFinite(comparableRisk), value: Number(comparableRisk ?? 0) };
+    }
+    if (key === 'opportunity') {
         return { missing: !Number.isFinite(row[key]), value: Number(row[key] ?? 0) };
     }
     if (key === 'confidence') {
@@ -31,10 +38,10 @@ function sortValue(row, key) {
 export function defaultBulkSortDirection(key) {
     return key === 'risk' || key === 'opportunity' || key === 'confidence' ? -1 : 1;
 }
-export function sortBulkResults(rows, key, direction) {
+export function sortBulkResults(rows, key, direction, riskValue = null) {
     return [...rows].sort((left, right) => {
-        const leftValue = sortValue(left, key);
-        const rightValue = sortValue(right, key);
+        const leftValue = sortValue(left, key, key === 'risk' && riskValue ? riskValue(left) : left.risk);
+        const rightValue = sortValue(right, key, key === 'risk' && riskValue ? riskValue(right) : right.risk);
         // Missing values always remain last instead of jumping to the top when
         // the requested direction changes.
         if (leftValue.missing !== rightValue.missing)

package/{frontend/src/lib/analysis/campaign-model.js → packages/workspace/campaign-model.mjs}

@@ -1,23 +1,14 @@
 // Pure, framework-neutral browser-local campaign model. Campaigns deliberately
 // reference normalized case domains rather than copying case evidence, notes,
 // or mutable case ids. The browser wrapper owns persistence and downloads.
-import { normalizeDomain } from "./case-model.js";
-export const CAMPAIGN_SCHEMA = 'whoisleuth.campaigns';
-export const CAMPAIGN_SCHEMA_VERSION = 1;
-export const MAX_CAMPAIGNS = 50;
-export const MAX_CAMPAIGN_DOMAINS = 50;
-export const MAX_CAMPAIGN_NAME_LENGTH = 100;
-export const MAX_CAMPAIGN_DESCRIPTION_LENGTH = 1000;
-export const MAX_CAMPAIGN_IMPORT_BYTES = 2 * 1024 * 1024;
-export const MAX_CAMPAIGN_INPUT_RECORDS = 500;
-// Cases and watchlists share the same per-origin browser quota. Keep this
-// collection smaller than the case store and fail before a browser quota error.
-export const MAX_CAMPAIGN_STORE_BYTES = 512 * 1024;
+import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { CAMPAIGN_SCHEMA, CAMPAIGN_SCHEMA_VERSION, MAX_CAMPAIGNS, MAX_CAMPAIGN_DESCRIPTION_LENGTH, MAX_CAMPAIGN_DOMAINS, MAX_CAMPAIGN_INPUT_RECORDS, MAX_CAMPAIGN_NAME_LENGTH, MAX_CAMPAIGN_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
+export { CAMPAIGN_SCHEMA, CAMPAIGN_SCHEMA_VERSION, MAX_CAMPAIGNS, MAX_CAMPAIGN_DESCRIPTION_LENGTH, MAX_CAMPAIGN_DOMAINS, MAX_CAMPAIGN_IMPORT_BYTES, MAX_CAMPAIGN_INPUT_RECORDS, MAX_CAMPAIGN_NAME_LENGTH, MAX_CAMPAIGN_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
 const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
 function plainRecord(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : null;
+    return ordinaryWorkspaceRecord(value, 'Campaign input');
 }
 function hashString(value) {
     let hash = 2166136261 >>> 0;
@@ -36,10 +27,7 @@ function makeId() {
     return `campaign-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
 }
 function isoOrNull(value) {
-    if (typeof value !== 'string' || value.length > 64 || /[\x00-\x1f\x7f]/.test(value))
-        return null;
-    const parsed = Date.parse(value);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+    return normalizeExplicitIsoTimestamp(value);
 }
 function normalizeName(value) {
     return String(value == null ? '' : value).replace(/\s+/g, ' ').trim().slice(0, MAX_CAMPAIGN_NAME_LENGTH).trim();
@@ -97,10 +85,12 @@ export function campaignStoreVersion(raw) {
 }
 /** Recover a deterministic, bounded store from parsed browser data. */
 export function normalizeCampaignStore(raw) {
-    const now = new Date().toISOString();
+    assertWorkspaceInputGraph(raw, 'Campaign store');
+    assertWorkspaceDeclaredVersion(raw, 'Campaign store');
+    const fallback = new Date(0).toISOString();
     const byId = new Map();
     for (const item of asCampaignList(raw).slice(0, MAX_CAMPAIGN_INPUT_RECORDS)) {
-        const campaign = normalizeCampaign(item, now);
+        const campaign = normalizeCampaign(item, fallback);
         if (!campaign)
             continue;
         const existing = byId.get(campaign.id);
@@ -207,14 +197,22 @@ function mergeCampaign(local, imported) {
 }
 /** Non-destructively merge a portable export into local campaigns by id. */
 export function mergeCampaigns(localRaw, importedRaw) {
+    assertWorkspaceInputGraph(localRaw, 'Local campaign store');
+    assertWorkspaceInputGraph(importedRaw, 'Imported campaign document');
+    assertWorkspacePortableVersion(importedRaw, CAMPAIGN_SCHEMA_VERSION, 'Imported campaign document');
     const importedEnvelope = plainRecord(importedRaw);
-    if (importedEnvelope && typeof importedEnvelope.schema === 'string' && importedEnvelope.schema !== CAMPAIGN_SCHEMA) {
+    if (!importedEnvelope
+        || importedEnvelope.schema !== CAMPAIGN_SCHEMA
+        || !Array.isArray(importedEnvelope.campaigns)) {
         throw new Error('This JSON file is not a WHOISleuth campaign export.');
     }
     const version = campaignStoreVersion(importedRaw);
     if (version !== null && version > CAMPAIGN_SCHEMA_VERSION) {
         throw new Error(`This campaign file uses newer schema ${version}. Update the app before importing it.`);
     }
+    if (version !== CAMPAIGN_SCHEMA_VERSION) {
+        throw new Error(`Expected campaign schema ${CAMPAIGN_SCHEMA_VERSION}.`);
+    }
     const local = normalizeCampaignStore(localRaw).campaigns;
     const byId = new Map(local.map((campaign) => [campaign.id, campaign]));
     let added = 0;

package/{frontend/src/lib/analysis/detection-rule-model.js → packages/workspace/detection-rule-model.mjs}

@@ -1,19 +1,10 @@
 // Pure browser-local custom detection-rule model. Rules are deliberately a
 // small structured language: field names and operators come from allowlists,
 // so imported rules cannot execute code or reach outside bounded case evidence.
-import { latestCaseEvidence } from "./case-model.js";
-export const DETECTION_RULE_SCHEMA = 'whoisleuth.detection-rules';
-export const DETECTION_RULE_SCHEMA_VERSION = 1;
-export const MAX_DETECTION_RULES = 50;
-export const MAX_RULE_CONDITIONS = 8;
-export const MAX_RULE_INPUT_RECORDS = 250;
-export const MAX_RULE_IMPORT_BYTES = 2 * 1024 * 1024;
-export const MAX_RULE_STORE_BYTES = 256 * 1024;
-export const MAX_RULE_NAME_LENGTH = 100;
-export const MAX_RULE_TAG_LENGTH = 40;
-export const MAX_CONDITION_VALUE_LENGTH = 200;
-export const MAX_RULE_RISK_DELTA = 25;
-export const MAX_CUSTOM_RISK_TOTAL = 50;
+import { latestCaseEvidence } from "../cases/case-model.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { DETECTION_RULE_SCHEMA, DETECTION_RULE_SCHEMA_VERSION, MAX_CONDITION_VALUE_LENGTH, MAX_CUSTOM_RISK_TOTAL, MAX_DETECTION_RULES, MAX_RULE_CONDITIONS, MAX_RULE_INPUT_RECORDS, MAX_RULE_NAME_LENGTH, MAX_RULE_RISK_DELTA, MAX_RULE_STORE_BYTES, MAX_RULE_TAG_LENGTH, } from "../contracts/workspace-portability.mjs";
+export { DETECTION_RULE_SCHEMA, DETECTION_RULE_SCHEMA_VERSION, MAX_CONDITION_VALUE_LENGTH, MAX_CUSTOM_RISK_TOTAL, MAX_DETECTION_RULES, MAX_RULE_CONDITIONS, MAX_RULE_IMPORT_BYTES, MAX_RULE_INPUT_RECORDS, MAX_RULE_NAME_LENGTH, MAX_RULE_RISK_DELTA, MAX_RULE_STORE_BYTES, MAX_RULE_TAG_LENGTH, } from "../contracts/workspace-portability.mjs";
 const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
 const TEXT_CONTROL_RE = /[\x00-\x1f\x7f]/;
 export const RULE_FIELD_DEFINITIONS = Object.freeze([
@@ -41,9 +32,7 @@ export const RULE_FIELD_DEFINITIONS = Object.freeze([
 ]);
 const FIELD_BY_VALUE = new Map(RULE_FIELD_DEFINITIONS.map((field) => [field.value, field]));
 function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : {};
+    return ordinaryWorkspaceRecord(value, 'Detection-rule input') ?? {};
 }
 export function operatorsForRuleField(field) {
     const definition = typeof field === 'string' ? FIELD_BY_VALUE.get(field) : undefined;
@@ -145,6 +134,8 @@ export function detectionRuleStoreVersion(raw) {
     return typeof item.version === 'number' && Number.isFinite(item.version) ? item.version : null;
 }
 export function normalizeDetectionRuleStore(raw) {
+    assertWorkspaceInputGraph(raw, 'Detection-rule store');
+    assertWorkspaceDeclaredVersion(raw, 'Detection-rule store');
     const byId = new Map();
     for (const item of ruleList(raw).slice(0, MAX_RULE_INPUT_RECORDS)) {
         const rule = normalizeDetectionRule(item);
@@ -282,14 +273,21 @@ export function previewDetectionRule(records, existingRules, rawCandidate) {
     });
 }
 export function mergeDetectionRules(localRaw, importedRaw) {
+    assertWorkspaceInputGraph(localRaw, 'Local detection-rule store');
+    assertWorkspaceInputGraph(importedRaw, 'Imported detection-rule document');
+    assertWorkspacePortableVersion(importedRaw, DETECTION_RULE_SCHEMA_VERSION, 'Imported detection-rule document');
     const importedRecord = record(importedRaw);
-    if (typeof importedRecord.schema === 'string' && importedRecord.schema !== DETECTION_RULE_SCHEMA) {
+    if (importedRecord.schema !== DETECTION_RULE_SCHEMA
+        || !Array.isArray(importedRecord.rules)) {
         throw new Error('This JSON file is not a WHOISleuth custom-rule export.');
     }
     const version = detectionRuleStoreVersion(importedRaw);
     if (version !== null && version > DETECTION_RULE_SCHEMA_VERSION) {
         throw new Error(`This custom-rule file uses newer schema ${version}. Update the app before importing it.`);
     }
+    if (version !== DETECTION_RULE_SCHEMA_VERSION) {
+        throw new Error(`Expected custom-rule schema ${DETECTION_RULE_SCHEMA_VERSION}.`);
+    }
     const local = normalizeDetectionRuleStore(localRaw).rules;
     const byId = new Map(local.map((rule) => [rule.id, rule]));
     const importedList = ruleList(importedRaw);