@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/packages/workspace/hostile-input.mjs

@@ -0,0 +1,172 @@
+import { MAX_WORKSPACE_INPUT_ARRAY_LENGTH, MAX_WORKSPACE_INPUT_GRAPH_DEPTH, MAX_WORKSPACE_INPUT_GRAPH_NODES, MAX_WORKSPACE_INPUT_OBJECT_KEYS, MAX_WORKSPACE_INPUT_STRING_CODE_UNITS, } from "../contracts/workspace-portability.mjs";
+function inputError(label, detail) {
+    return new TypeError(`${label} must be bounded ordinary JSON data; ${detail}.`);
+}
+function ownDataDescriptors(value, label) {
+    let keys;
+    try {
+        keys = Reflect.ownKeys(value);
+    }
+    catch {
+        throw inputError(label, 'its property keys could not be inspected safely');
+    }
+    if (keys.some((key) => typeof key !== 'string')) {
+        throw inputError(label, 'symbol keys are not supported');
+    }
+    return keys.map((key) => {
+        let descriptor;
+        try {
+            descriptor = Object.getOwnPropertyDescriptor(value, key);
+        }
+        catch {
+            throw inputError(label, 'a property descriptor could not be inspected safely');
+        }
+        if (!descriptor || !('value' in descriptor)) {
+            throw inputError(label, 'accessor properties are not supported');
+        }
+        return [key, descriptor];
+    });
+}
+export function ordinaryWorkspaceRecord(value, label = 'Workspace input') {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    let prototype;
+    try {
+        prototype = Object.getPrototypeOf(value);
+    }
+    catch {
+        throw inputError(label, 'its prototype could not be inspected safely');
+    }
+    if (prototype !== Object.prototype && prototype !== null) {
+        throw inputError(label, 'custom object prototypes are not supported');
+    }
+    const descriptors = ownDataDescriptors(value, label);
+    if (descriptors.length > MAX_WORKSPACE_INPUT_OBJECT_KEYS) {
+        throw inputError(label, 'an object exceeds the key ceiling');
+    }
+    if (descriptors.some(([, descriptor]) => !descriptor.enumerable)) {
+        throw inputError(label, 'non-enumerable object fields are not supported');
+    }
+    return value;
+}
+export function assertWorkspaceInputGraph(value, label = 'Workspace input') {
+    const pending = [{ value, depth: 0, label }];
+    const seen = new WeakSet();
+    let nodes = 0;
+    let stringCodeUnits = 0;
+    while (pending.length) {
+        const current = pending.pop();
+        const candidate = current.value;
+        if (typeof candidate === 'string') {
+            stringCodeUnits += candidate.length;
+            if (stringCodeUnits > MAX_WORKSPACE_INPUT_STRING_CODE_UNITS) {
+                throw inputError(label, 'aggregate text exceeds the string ceiling');
+            }
+            continue;
+        }
+        if (candidate === null
+            || candidate === undefined
+            || typeof candidate === 'boolean'
+            || typeof candidate === 'number')
+            continue;
+        if (typeof candidate !== 'object') {
+            throw inputError(current.label, 'non-JSON values are not supported');
+        }
+        if (current.depth > MAX_WORKSPACE_INPUT_GRAPH_DEPTH) {
+            throw inputError(label, 'the nesting depth exceeds the graph ceiling');
+        }
+        nodes += 1;
+        if (nodes > MAX_WORKSPACE_INPUT_GRAPH_NODES) {
+            throw inputError(label, 'the graph exceeds the node ceiling');
+        }
+        if (seen.has(candidate))
+            continue;
+        seen.add(candidate);
+        if (Array.isArray(candidate)) {
+            let prototype;
+            try {
+                prototype = Object.getPrototypeOf(candidate);
+            }
+            catch {
+                throw inputError(current.label, 'its array prototype could not be inspected safely');
+            }
+            if (prototype !== Array.prototype) {
+                throw inputError(current.label, 'custom array prototypes are not supported');
+            }
+            const descriptors = ownDataDescriptors(candidate, current.label);
+            const lengthDescriptor = descriptors.find(([key]) => key === 'length')?.[1];
+            const length = lengthDescriptor?.value;
+            if (!Number.isSafeInteger(length)
+                || Number(length) < 0
+                || Number(length) > MAX_WORKSPACE_INPUT_ARRAY_LENGTH) {
+                throw inputError(current.label, 'an array exceeds the length ceiling');
+            }
+            if (descriptors.length !== Number(length) + 1) {
+                throw inputError(current.label, 'sparse arrays and custom array fields are not supported');
+            }
+            const byKey = new Map(descriptors);
+            for (let index = 0; index < Number(length); index += 1) {
+                const descriptor = byKey.get(String(index));
+                if (!descriptor?.enumerable) {
+                    throw inputError(current.label, 'sparse or non-enumerable array entries are not supported');
+                }
+                pending.push({
+                    value: descriptor.value,
+                    depth: current.depth + 1,
+                    label: `${current.label}[${index}]`,
+                });
+            }
+            continue;
+        }
+        const record = ordinaryWorkspaceRecord(candidate, current.label);
+        const descriptors = ownDataDescriptors(record, current.label);
+        for (const [key, descriptor] of descriptors) {
+            pending.push({
+                value: descriptor.value,
+                depth: current.depth + 1,
+                label: `${current.label}.${key}`,
+            });
+        }
+    }
+}
+export function assertWorkspacePortableVersion(value, currentVersion, label) {
+    if (!Number.isSafeInteger(currentVersion) || currentVersion < 1) {
+        throw new TypeError(`${label} current version is invalid.`);
+    }
+    if (Array.isArray(value)) {
+        return null;
+    }
+    const record = ordinaryWorkspaceRecord(value, label);
+    if (!record)
+        throw inputError(label, 'the root must be an object');
+    const descriptor = Object.getOwnPropertyDescriptor(record, 'version');
+    if (!descriptor)
+        return null;
+    if (!('value' in descriptor))
+        throw inputError(label, 'the version must be a positive safe integer');
+    if (typeof descriptor.value === 'number'
+        && Number.isFinite(descriptor.value)
+        && descriptor.value > currentVersion) {
+        return descriptor.value;
+    }
+    if (!Number.isSafeInteger(descriptor.value) || Number(descriptor.value) < 1) {
+        throw inputError(label, 'the version must be a positive safe integer');
+    }
+    const version = Number(descriptor.value);
+    return version;
+}
+export function assertWorkspaceDeclaredVersion(value, label) {
+    if (Array.isArray(value) || value === null || value === undefined)
+        return;
+    const record = ordinaryWorkspaceRecord(value, label);
+    if (!record)
+        return;
+    const descriptor = Object.getOwnPropertyDescriptor(record, 'version');
+    if (!descriptor)
+        return;
+    if (!('value' in descriptor)
+        || !Number.isSafeInteger(descriptor.value)
+        || Number(descriptor.value) < 1) {
+        throw inputError(label, 'a declared version must be a positive safe integer');
+    }
+}

package/{frontend/src/lib/analysis/investigation-guide.js → packages/workspace/investigation-guide.mjs}

@@ -1,10 +1,10 @@
-import { normalizeDomain } from "./case-model.js";
+import { normalizeDomain } from "../cases/case-model.mjs";
 import { parse } from 'tldts';
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 export const INVESTIGATION_GUIDE_SCHEMA = 'whoisleuth.investigation-recipe';
-export const INVESTIGATION_GUIDE_VERSION = 4;
-export const INVESTIGATION_GUIDE_LEGACY_VERSION = 1;
-export const INVESTIGATION_GUIDE_EXPORT_VERSION = 3;
-export const INVESTIGATION_GUIDE_SUPPORTED_VERSIONS = [2, 3, INVESTIGATION_GUIDE_VERSION];
+export const INVESTIGATION_GUIDE_VERSION = 5;
+export const INVESTIGATION_GUIDE_EXPORT_VERSION = 4;
+export const INVESTIGATION_GUIDE_SUPPORTED_VERSIONS = [INVESTIGATION_GUIDE_VERSION];
 export const INVESTIGATION_GUIDE_EXPORT_SCHEMA = 'whoisleuth.investigation-recipe-summary';
 export const MAX_INVESTIGATION_GUIDE_DOMAIN_LENGTH = 253;
 export const MAX_INVESTIGATION_GUIDE_REVIEW_DOMAINS = 25;
@@ -91,15 +91,45 @@ export const INVESTIGATION_RECIPES = Object.freeze([
             stage('monitor', 'monitor', 'Record disposition', 'Review the bounded domain set carried from Bulk and create or update only the cases that need an analyst decision or follow-up plan.', 'A bounded review queue plus case records with dispositions, notes, evidence history, and optional monitoring intent.', 'Local case editing makes no request. Rescans and hosted-monitor changes remain separate explicit actions.', 'Review source provenance, limitations, and any scoring explanation before deciding.', 'The analyst records the required dispositions or explicitly skips retention; the recipe never decides automatically.', ['Review the domains carried from Bulk and open only the cases that need retention.', 'Record a disposition and any concise evidence-based follow-up for each retained case.', 'Mark the step reviewed when the retained cases reflect your decision.'], false),
         ]),
     }),
+    Object.freeze({
+        id: 'credential_impersonation_response',
+        label: 'Credential impersonation response',
+        summary: 'Review observed impersonation evidence, confirm the affected brand boundary, and prepare a local response packet from explicitly recorded routes.',
+        targetLabel: 'Domain under review',
+        stages: Object.freeze([
+            stage('lookup', 'lookup', 'Review impersonation evidence', 'Collect separately attributed deep evidence for the domain without treating visual or naming similarity as attribution.', 'Current registry, DNS, certificate, HTTP, page-identity, and source-health observations where supported.', 'Deep Lookup can contact several public services within explicit deadlines and response caps.', 'Confirm the target is in scope and do not enter a credential-bearing URL or secret.', 'Observed facts and missing sources are reviewed without making an ownership, intent, or harm conclusion.', ['Run the pre-filled Lookup in Deep mode.', 'Review exact page, redirect, certificate, and registration observations with their source states.', 'Create or update a Case only when the retained observations need reviewed follow-up.'], true),
+            stage('brands', 'brands', 'Confirm affected brand boundary', 'Review the saved Brand Profile that defines official and allowlisted references; do not infer an association from similarity.', 'An analyst-selected Brand Profile boundary, or an explicit decision to continue without one.', 'Local-only. Opening Brands makes no analysis request.', 'Know which saved profile, if any, is relevant to the affected party.', 'The relevant profile boundary is reviewed, or the stage is marked partial or skipped without creating an association.', ['Open the saved Brand Profiles list.', 'Review the official references and allowlists for the affected party.', 'Return to the guide without adding a profile association unless you deliberately selected one in Monitor.'], false),
+            stage('monitor', 'monitor', 'Prepare reviewed response', 'Open the Case response workspace, record only analyst-selected published recipient routes, and review packet preflight.', 'A Case action with recipient provenance and limitations plus an optional local draft packet that remains unsubmitted.', 'Local Case edits and packet generation make no request. WHOISleuth never sends the packet.', 'Retain supporting facts and reasoning before recording an external route; confirm the route manually.', 'The reviewed action and packet preflight are recorded, or the stage is partial or skipped without implying submission.', ['Open or create the pre-filled Case, then review its evidence and reasoning.', 'Record an analyst-selected published route with its source and limitations; do not claim it is reachable.', 'Open response preflight and prepare a local draft only if its required facts are complete.'], false),
+        ]),
+    }),
+    Object.freeze({
+        id: 'mail_abuse_response',
+        label: 'Mail abuse response',
+        summary: 'Review official mail posture and observed domain evidence before preparing a source-qualified, unsent response packet.',
+        targetLabel: 'Domain under review',
+        stages: Object.freeze([
+            stage('brands', 'brands', 'Review official mail posture', 'Review the affected Brand Profile and retained mail posture without treating a missing control as proof of abuse.', 'Analyst-selected official-domain, mail, and Brand Profile context with explicit availability states.', 'Local-only unless the analyst separately starts a Brand posture refresh.', 'Identify the affected profile and distinguish official infrastructure from the domain under review.', 'Relevant retained posture is reviewed, or unavailable context is marked partial rather than absent.', ['Open the saved Brand Profiles list.', 'Review official MX, SPF, DMARC, and approved-domain context where retained.', 'Do not refresh or change a profile unless that separate action is necessary and approved.'], false),
+            stage('lookup', 'lookup', 'Review domain and mail evidence', 'Collect current deep evidence for the domain and keep DNS, mail, registration, and page observations separately attributed.', 'Authority-aware availability plus bounded DNS, mail, TLS, HTTP, and page observations where supported.', 'Deep Lookup can contact several public services within explicit deadlines and response caps.', 'Confirm the domain is in scope; email content and mailbox data are outside this workflow.', 'Current observations and source failures are reviewed without claiming message origin, sender control, or maliciousness.', ['Run the pre-filled Lookup in Deep mode.', 'Review MX, SPF, DMARC, registration, certificate, HTTP, and page source states.', 'Retain only the evidence needed for a reviewed Case.'], true),
+            stage('monitor', 'monitor', 'Prepare mail-abuse response', 'Record a reviewed recipient route and use Case packet preflight without sending or claiming delivery.', 'A bounded Case action and optional local response draft with exact recipient provenance and limitations.', 'Local Case edits and packet generation make no request. WHOISleuth never sends the packet.', 'Confirm the intended recipient and retain the observed facts and limitations that support review.', 'The current action state and packet preflight are recorded, or the stage remains partial without a delivery conclusion.', ['Open or create the pre-filled Case and review its retained evidence.', 'Record only a deliberately selected published route, its source, and known limitations.', 'Use the response preflight to prepare a local draft; submission remains a separate manual action recorded later.'], false),
+        ]),
+    }),
+    Object.freeze({
+        id: 'domain_control_change_response',
+        label: 'Domain-control change response',
+        summary: 'Review retained control posture and current authority-aware evidence before documenting a bounded internal or provider response.',
+        targetLabel: 'Official domain',
+        stages: Object.freeze([
+            stage('brands', 'brands', 'Review retained control posture', 'Review the saved domain-control passport, posture matrix, and source limitations before interpreting a change.', 'Retained official-domain control observations with separately attributed registry, DNS, certificate, mail, and web states.', 'Local-only unless the analyst separately starts a posture refresh.', 'Confirm the domain belongs to the reviewed Brand Profile; a saved association is analyst-selected, not inferred.', 'The retained baseline and its completeness are understood, or the stage is partial when required context is unavailable.', ['Open the relevant saved Brand Profile.', 'Review the domain-control passport, portfolio matrix, and observation times.', 'Identify which source actually supports the suspected change and preserve unavailable states.'], false),
+            stage('lookup', 'lookup', 'Confirm current domain evidence', 'Collect a deliberate deep Lookup so current authority-aware evidence remains distinct from the retained baseline.', 'Current registry, registrar, DNS, certificate, HTTP, and page observations with explicit source health.', 'Deep Lookup can contact several public services within explicit deadlines and response caps.', 'Confirm a fresh collection is necessary and review its request implications.', 'The current result is reviewed against the retained baseline without converting incomplete evidence into removal or compromise.', ['Run the pre-filled Lookup in Deep mode.', 'Compare current observations with the retained control evidence source by source.', 'Record only facts and limitations that need a Case response.'], true),
+            stage('monitor', 'monitor', 'Document control-change response', 'Record an internal or provider action and review an optional response packet without automatic enforcement or submission.', 'A bounded Case action, due or follow-up dates, recipient provenance when external, and an optional unsubmitted packet.', 'Local Case edits and packet generation make no request. WHOISleuth never changes DNS, registrar, hosting, mail, or defensive systems.', 'Document supporting evidence and confirm any recipient route or internal owner manually.', 'The reviewed action state is recorded, or the stage is partial without a compromise, delivery, or remediation claim.', ['Open or create the pre-filled Case and retain the relevant comparison facts.', 'Record the internal owner or analyst-selected provider route, source, limitations, and follow-up dates.', 'Review packet preflight when a draft is useful; record submission or resolution only after it actually occurs.'], false),
+        ]),
+    }),
 ]);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
 function timestamp(value) {
-    if (typeof value !== 'string' || value.length > MAX_INVESTIGATION_GUIDE_TIMESTAMP_LENGTH || CONTROL_RE.test(value))
-        return '';
-    const parsed = Date.parse(value);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : '';
+    return normalizeExplicitIsoTimestamp(value) ?? '';
 }
 function nullableTimestamp(value) {
     if (value === null || value === undefined || value === '')
@@ -239,10 +269,15 @@ export function investigationGuideHref(stageId, domain, recipeId = 'new_domain_t
         return `/discover?q=${encodeURIComponent(registrableGuideDomain(normalized))}#discovery-seed`;
     if (stageDefinition.workspace === 'bulk')
         return `/bulk?investigation=${encodeURIComponent(normalized)}#domains`;
-    if (stageDefinition.workspace === 'monitor')
-        return `/monitor?view=cases&investigation=1&domain=${encodeURIComponent(workingDomain)}#case-review-queue`;
-    if (stageDefinition.workspace === 'brands')
-        return `/brands?new=1&domain=${encodeURIComponent(normalized)}#official-domains`;
+    if (stageDefinition.workspace === 'monitor') {
+        const response = typeof recipeId === 'string' && recipeId.endsWith('_response') ? '&response=1' : '';
+        return `/monitor?view=cases&investigation=1${response}&domain=${encodeURIComponent(workingDomain)}#case-review-queue`;
+    }
+    if (stageDefinition.workspace === 'brands') {
+        return typeof recipeId === 'string' && recipeId.endsWith('_response')
+            ? '/brands'
+            : `/brands?new=1&domain=${encodeURIComponent(normalized)}#official-domains`;
+    }
     return stageDefinition.path;
 }
 export function investigationGuideApprovedHref(guide, stageId) {
@@ -285,39 +320,10 @@ export function createInvestigationGuide(domain, recipeId = 'new_domain_triage',
         stages: stages.map((stageDefinition) => createStageProgress(stageDefinition, createdAt)),
     };
 }
-function parseLegacyGuide(input) {
-    const domain = normalizeInvestigationGuideDomain(input.domain);
-    const createdAt = timestamp(input.createdAt);
-    const updatedAt = timestamp(input.updatedAt);
-    const recipe = investigationGuideRecipe('new_domain_triage');
-    if (!domain || !createdAt || !updatedAt || !recipe)
-        return null;
-    const opened = new Set((Array.isArray(input.visitedStages) ? input.visitedStages : [])
-        .slice(0, recipe.stages.length * 2)
-        .filter((value) => typeof value === 'string'));
-    return {
-        version: INVESTIGATION_GUIDE_VERSION,
-        recipeId: recipe.id,
-        template: null,
-        domain,
-        focusDomain: null,
-        reviewDomains: [domain],
-        reviewDomainsTruncated: false,
-        status: 'active',
-        createdAt,
-        updatedAt,
-        stages: recipe.stages.map((stageDefinition) => ({
-            ...createStageProgress(stageDefinition, updatedAt),
-            openedAt: opened.has(stageDefinition.id) ? updatedAt : null,
-        })),
-    };
-}
 export function parseInvestigationGuide(value) {
     const input = record(value);
     if (!input)
         return null;
-    if (input.version === INVESTIGATION_GUIDE_LEGACY_VERSION)
-        return parseLegacyGuide(input);
     if (!INVESTIGATION_GUIDE_SUPPORTED_VERSIONS.includes(input.version))
         return null;
     const recipe = investigationGuideRecipe(input.recipeId);
@@ -326,11 +332,10 @@ export function parseInvestigationGuide(value) {
     const updatedAt = timestamp(input.updatedAt);
     if (!recipe || !domain || !createdAt || !updatedAt)
         return null;
-    const supportsTemplate = input.version === 3 || input.version === INVESTIGATION_GUIDE_VERSION;
-    const template = supportsTemplate && input.template !== null && input.template !== undefined
+    const template = input.template !== null && input.template !== undefined
         ? normalizeInvestigationGuideTemplateSnapshot(input.template, recipe.id)
         : null;
-    if (supportsTemplate && input.template !== null && input.template !== undefined && !template)
+    if (input.template !== null && input.template !== undefined && !template)
         return null;
     const stageDefinitions = template?.stages || recipe.stages;
     const normalizedReview = normalizeReviewDomains(input.reviewDomains);
@@ -361,7 +366,7 @@ export function parseInvestigationGuide(value) {
                 outcome: guideOutcome(item?.outcome),
                 approvedAt: nullableTimestamp(item?.approvedAt),
                 openedAt: nullableTimestamp(item?.openedAt),
-                reviewNote: input.version === INVESTIGATION_GUIDE_VERSION ? boundedReviewNote(item?.reviewNote) : null,
+                reviewNote: boundedReviewNote(item?.reviewNote),
                 updatedAt: timestamp(item?.updatedAt) || updatedAt,
             };
         }),

package/{frontend/src/lib/analysis/investigation-template-model.js → packages/workspace/investigation-template-model.mjs}

@@ -1,18 +1,13 @@
-import { INVESTIGATION_RECIPES, normalizeInvestigationGuideTemplateSnapshot, } from "./investigation-guide.js";
-export const INVESTIGATION_TEMPLATE_SCHEMA = 'whoisleuth.investigation-templates';
-export const INVESTIGATION_TEMPLATE_VERSION = 1;
-export const MAX_INVESTIGATION_TEMPLATES = 20;
-export const MAX_INVESTIGATION_TEMPLATE_STORE_BYTES = 256 * 1024;
-export const MAX_INVESTIGATION_TEMPLATE_IMPORT_BYTES = 384 * 1024;
-const CONTROL_RE = /[\x00-\x1f\x7f]/u;
+import { INVESTIGATION_RECIPES, normalizeInvestigationGuideTemplateSnapshot, } from "./investigation-guide.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { INVESTIGATION_TEMPLATE_SCHEMA, INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS, INVESTIGATION_TEMPLATE_VERSION, MAX_INVESTIGATION_TEMPLATES, MAX_INVESTIGATION_TEMPLATE_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
+export { INVESTIGATION_TEMPLATE_SCHEMA, INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS, INVESTIGATION_TEMPLATE_VERSION, MAX_INVESTIGATION_TEMPLATES, MAX_INVESTIGATION_TEMPLATE_IMPORT_BYTES, MAX_INVESTIGATION_TEMPLATE_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
 function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+    return ordinaryWorkspaceRecord(value, 'Investigation-template input');
 }
 function timestamp(value) {
-    if (typeof value !== 'string' || value.length > 64 || CONTROL_RE.test(value))
-        return '';
-    const parsed = Date.parse(value);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : '';
+    return normalizeExplicitIsoTimestamp(value) ?? '';
 }
 function byteLength(value) {
     return new TextEncoder().encode(value).byteLength;
@@ -30,10 +25,12 @@ export function normalizeInvestigationTemplate(raw) {
     return template(raw);
 }
 export function normalizeInvestigationTemplateStore(raw) {
+    assertWorkspaceInputGraph(raw, 'Investigation-template store');
+    assertWorkspaceDeclaredVersion(raw, 'Investigation-template store');
     const value = record(raw);
     if (value?.schema === INVESTIGATION_TEMPLATE_SCHEMA
-        && Number(value.version) > INVESTIGATION_TEMPLATE_VERSION) {
-        throw new Error('This investigation-template collection uses a newer schema and cannot be read safely.');
+        && !INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS.includes(Number(value.version))) {
+        throw new Error(`Investigation-template schema ${String(value.version)} is unsupported; no data was changed.`);
     }
     const source = Array.isArray(raw) ? raw : Array.isArray(value?.templates) ? value.templates : [];
     const templates = [];
@@ -115,12 +112,15 @@ function strictImport(raw) {
     if (Number(value.version) > INVESTIGATION_TEMPLATE_VERSION) {
         throw new Error('This investigation-template export uses a newer schema and cannot be imported safely.');
     }
-    if (value.version !== INVESTIGATION_TEMPLATE_VERSION) {
+    if (!INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS.includes(Number(value.version))) {
         throw new Error(`Expected investigation-template schema ${INVESTIGATION_TEMPLATE_VERSION}.`);
     }
     return normalizeInvestigationTemplateStore(value).templates;
 }
 export function mergeInvestigationTemplates(localRaw, incomingRaw) {
+    assertWorkspaceInputGraph(localRaw, 'Local investigation-template store');
+    assertWorkspaceInputGraph(incomingRaw, 'Imported investigation-template document');
+    assertWorkspacePortableVersion(incomingRaw, INVESTIGATION_TEMPLATE_VERSION, 'Imported investigation-template document');
     const local = normalizeInvestigationTemplateStore(localRaw).templates;
     const incoming = strictImport(incomingRaw);
     const byId = new Map(local.map((item) => [item.id, item]));

package/{frontend/src/lib/analysis/page-baseline.js → packages/workspace/page-baseline.mjs}

@@ -2,18 +2,14 @@
 // deliberately accepts only bounded, normalized page-identity fields. Raw
 // HTML, URLs, headers, redirect inventories, and parser diagnostics never
 // cross this storage boundary.
-import { normalizeDomain } from "./case-model.js";
-import { isInformativeFaviconHash } from "./utils.js";
-export const PAGE_BASELINE_VERSION = 1;
-export const PAGE_IDENTITY_VERSION = 3;
-export const PAGE_FINGERPRINT_VERSION = 1;
-export const MAX_BASELINE_TITLE_LENGTH = 200;
-export const MAX_BASELINE_RESOURCE_HOSTS = 30;
-export const MAX_BASELINE_IDENTIFIERS = 30;
+import { normalizeDomain } from "../cases/case-model.mjs";
+import { isInformativePerceptualHash as isInformativeFaviconHash } from "../../lib/perceptual-hash-comparison.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { MAX_BASELINE_IDENTIFIERS, MAX_BASELINE_RESOURCE_HOSTS, MAX_BASELINE_TITLE_LENGTH, PAGE_BASELINE_VERSION, PAGE_FINGERPRINT_VERSION, PAGE_IDENTITY_VERSION, } from "../contracts/workspace-portability.mjs";
+export { MAX_BASELINE_IDENTIFIERS, MAX_BASELINE_RESOURCE_HOSTS, MAX_BASELINE_TITLE_LENGTH, PAGE_BASELINE_VERSION, PAGE_FINGERPRINT_VERSION, PAGE_IDENTITY_VERSION, } from "../contracts/workspace-portability.mjs";
 const SHA256_RE = /^[a-f0-9]{64}$/i;
 const SIMHASH_RE = /^[a-f0-9]{16}$/i;
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
-const MAX_TIMESTAMP_LENGTH = 64;
 const MAX_HTML_TOKENS = 4096;
 const MAX_TEXT_TOKENS = 8192;
 const MAX_FORMS = 50;
@@ -24,10 +20,7 @@ function record(value) {
         : null;
 }
 function timestamp(value) {
-    if (typeof value !== 'string' || value.length > MAX_TIMESTAMP_LENGTH || CONTROL_RE.test(value))
-        return null;
-    const parsed = new Date(value);
-    return Number.isNaN(parsed.getTime()) ? null : parsed.toISOString();
+    return normalizeExplicitIsoTimestamp(value);
 }
 function count(value, maximum) {
     return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && value <= maximum

package/{frontend/src/lib/analysis/relationship-observation-model.js → packages/workspace/relationship-observation-model.mjs}

@@ -1,12 +1,8 @@
-import { normalizeDomain } from "./case-model.js";
-export const RELATIONSHIP_OBSERVATION_SCHEMA = 'whoisleuth.relationship-observations';
-export const RELATIONSHIP_OBSERVATION_SCHEMA_VERSION = 1;
-export const MAX_RELATIONSHIP_OBSERVATIONS = 300;
-export const MAX_RELATIONSHIP_OBSERVATION_INPUTS = 1_200;
-export const MAX_RELATIONSHIP_OBSERVATION_DOMAINS = 50;
-export const MAX_RELATIONSHIP_OBSERVATION_LIMITATIONS = 8;
-export const MAX_RELATIONSHIP_OBSERVATION_VALUE_LENGTH = 20_000;
-export const MAX_RELATIONSHIP_OBSERVATION_STORE_BYTES = 768 * 1024;
+import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { MAX_RELATIONSHIP_OBSERVATIONS, MAX_RELATIONSHIP_OBSERVATION_DOMAINS, MAX_RELATIONSHIP_OBSERVATION_INPUTS, MAX_RELATIONSHIP_OBSERVATION_LIMITATIONS, MAX_RELATIONSHIP_OBSERVATION_STORE_BYTES, MAX_RELATIONSHIP_OBSERVATION_VALUE_LENGTH, RELATIONSHIP_OBSERVATION_SCHEMA, RELATIONSHIP_OBSERVATION_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
+export { MAX_RELATIONSHIP_OBSERVATIONS, MAX_RELATIONSHIP_OBSERVATION_DOMAINS, MAX_RELATIONSHIP_OBSERVATION_INPUTS, MAX_RELATIONSHIP_OBSERVATION_LIMITATIONS, MAX_RELATIONSHIP_OBSERVATION_STORE_BYTES, MAX_RELATIONSHIP_OBSERVATION_VALUE_LENGTH, RELATIONSHIP_OBSERVATION_SCHEMA, RELATIONSHIP_OBSERVATION_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
 export const RELATIONSHIP_OBSERVATION_TYPES = Object.freeze([
     'nameserver_set',
     'ip_address',
@@ -48,7 +44,7 @@ const TYPE_METADATA = Object.freeze({
         description: 'These domains used an identical or perceptually similar favicon in the retained scan.',
     }),
     official_asset: Object.freeze({
-        label: 'Official asset relationship',
+        label: 'Official asset host match',
         method: 'Configured-domain host match',
         description: 'One or more pages loaded an asset from this configured official domain or its subdomain.',
     }),
@@ -58,9 +54,7 @@ const FIXED_LIMITATIONS = Object.freeze([
     'A shared observation does not prove ownership, coordination, intent, or maliciousness.',
 ]);
 function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : null;
+    return ordinaryWorkspaceRecord(value, 'Relationship-observation input');
 }
 function text(value, maximum) {
     if (typeof value !== 'string' || value.length > maximum * 4 || CONTROL_RE.test(value))
@@ -68,10 +62,7 @@ function text(value, maximum) {
     return value.replace(/\s+/gu, ' ').trim().slice(0, maximum).trim();
 }
 function timestamp(value) {
-    if (typeof value !== 'string' || value.length > 64 || CONTROL_RE.test(value))
-        return '';
-    const parsed = Date.parse(value);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : '';
+    return normalizeExplicitIsoTimestamp(value) ?? '';
 }
 function positiveInteger(value) {
     return typeof value === 'number' && Number.isSafeInteger(value) && value > 0 && value <= 1_000
@@ -262,6 +253,8 @@ export function normalizeRelationshipObservation(raw) {
     };
 }
 export function normalizeRelationshipObservationStore(raw) {
+    assertWorkspaceInputGraph(raw, 'Relationship-observation store');
+    assertWorkspaceDeclaredVersion(raw, 'Relationship-observation store');
     const byId = new Map();
     for (const candidate of observationList(raw).slice(0, MAX_RELATIONSHIP_OBSERVATION_INPUTS)) {
         const observation = normalizeRelationshipObservation(candidate);
@@ -361,6 +354,9 @@ export function deleteRelationshipObservation(rawStore, id) {
     return normalizeRelationshipObservationStore(rawStore).observations.filter((item) => item.id !== safeId);
 }
 export function mergeRelationshipObservations(localRaw, importedRaw) {
+    assertWorkspaceInputGraph(localRaw, 'Local relationship-observation store');
+    assertWorkspaceInputGraph(importedRaw, 'Imported relationship-observation document');
+    assertWorkspacePortableVersion(importedRaw, RELATIONSHIP_OBSERVATION_SCHEMA_VERSION, 'Imported relationship-observation document');
     const importedRecord = record(importedRaw);
     if (importedRecord?.schema !== undefined && importedRecord.schema !== RELATIONSHIP_OBSERVATION_SCHEMA) {
         throw new Error('This JSON section is not a WHOISleuth relationship-observation export.');

package/{frontend/src/lib/analysis/shortlist-model.js → packages/workspace/shortlist-model.mjs}

@@ -1,23 +1,18 @@
 // Pure browser-local shortlist model. The browser wrapper owns persistence
 // and downloads; this module owns schema migration, record normalization,
 // import merging, and exact serialized-byte accounting.
-import { compactWatchlistResults } from "./watchlist-history.js";
-import { normalizeOpportunityModelVersion, normalizeRiskModelVersion } from "./scoring.js";
-export const SHORTLIST_SCHEMA = 'whoisleuth.shortlist';
-export const SHORTLIST_SCHEMA_VERSION = 3;
-export const SUPPORTED_SHORTLIST_SCHEMA_VERSIONS = Object.freeze([2, SHORTLIST_SCHEMA_VERSION]);
-export const MAX_SHORTLIST_ENTRIES = 500;
-export const MAX_SHORTLIST_INPUTS = MAX_SHORTLIST_ENTRIES * 4;
-export const MAX_SHORTLIST_STORE_BYTES = 1024 * 1024;
-export const MAX_SHORTLIST_FACTORS = 20;
+import { compactWatchlistResults } from "./watchlist-history.mjs";
+import { normalizeOpportunityModelVersion } from "../../lib/opportunity-scoring.mjs";
+import { normalizeRiskModelVersion } from "../../lib/risk-scoring.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { MAX_SHORTLIST_ENTRIES, MAX_SHORTLIST_FACTORS, MAX_SHORTLIST_INPUTS, MAX_SHORTLIST_STORE_BYTES, SHORTLIST_SCHEMA, SHORTLIST_SCHEMA_VERSION, SUPPORTED_SHORTLIST_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
+export { MAX_SHORTLIST_ENTRIES, MAX_SHORTLIST_FACTORS, MAX_SHORTLIST_INPUTS, MAX_SHORTLIST_STORE_BYTES, SHORTLIST_SCHEMA, SHORTLIST_SCHEMA_VERSION, SUPPORTED_SHORTLIST_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
 const MAX_FACTOR_LABEL_LENGTH = 200;
-const MAX_TIMESTAMP_LENGTH = 64;
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
 const EPOCH = new Date(0).toISOString();
 function plainRecord(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : null;
+    return ordinaryWorkspaceRecord(value, 'Shortlist input');
 }
 function isEnvelope(value) {
     return Boolean(value && value.schema === SHORTLIST_SCHEMA && Array.isArray(value.entries));
@@ -30,7 +25,7 @@ function entryList(raw) {
 }
 export function shortlistStoreVersion(raw) {
     if (Array.isArray(raw))
-        return 1;
+        return SHORTLIST_SCHEMA_VERSION;
     const value = plainRecord(raw);
     if (!value || !isEnvelope(value))
         return null;
@@ -44,10 +39,7 @@ function score(value) {
         : null;
 }
 function timestamp(value, fallback = EPOCH) {
-    if (typeof value !== 'string' || value.length > MAX_TIMESTAMP_LENGTH || CONTROL_RE.test(value))
-        return fallback;
-    const parsed = Date.parse(value);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : fallback;
+    return normalizeExplicitIsoTimestamp(value) ?? fallback;
 }
 function factors(value) {
     if (!Array.isArray(value))
@@ -93,7 +85,14 @@ export function normalizeShortlistRecord(raw, options = {}) {
 }
 /** Normalize an internal record collection or current stored envelope. */
 export function normalizeShortlistStore(raw) {
+    assertWorkspaceInputGraph(raw, 'Shortlist store');
+    assertWorkspaceDeclaredVersion(raw, 'Shortlist store');
     const source = entryList(raw);
+    const sourceVersion = shortlistStoreVersion(raw);
+    if (!Array.isArray(raw) && sourceVersion !== null
+        && !SUPPORTED_SHORTLIST_SCHEMA_VERSIONS.includes(sourceVersion)) {
+        throw new Error(`Shortlist schema ${sourceVersion} is unsupported; no data was changed.`);
+    }
     const byDomain = new Map();
     if (source) {
         for (const item of source.slice(0, MAX_SHORTLIST_INPUTS)) {
@@ -167,6 +166,9 @@ function validateImport(raw) {
     }
 }
 export function mergeShortlistStores(localRaw, importedRaw) {
+    assertWorkspaceInputGraph(localRaw, 'Local shortlist store');
+    assertWorkspaceInputGraph(importedRaw, 'Imported shortlist document');
+    assertWorkspacePortableVersion(importedRaw, SHORTLIST_SCHEMA_VERSION, 'Imported shortlist document');
     validateImport(importedRaw);
     const importedVersion = shortlistStoreVersion(importedRaw);
     if (importedVersion !== null && importedVersion > SHORTLIST_SCHEMA_VERSION) {

package/{frontend/src/lib/analysis/watchlist-history.js → packages/workspace/watchlist-history.mjs}

@@ -2,16 +2,12 @@
 // the watchlist entry for rescanning, while history stores compact changes
 // against a last-known baseline so browser-local storage does not grow by one complete
 // result set on every check.
-import { explainRiskScore, normalizeRiskModelVersion } from "./scoring.js";
-import { HTTP_SECURITY_HEADER_TOKENS, normalizeHttpSummary } from "./http-summary.js";
-import { normalizeDomain } from "./case-model.js";
-export const MAX_WATCHLIST_HISTORY_EVENTS = 12;
-export const MAX_WATCHLIST_CHANGES_PER_EVENT = 500;
-export const MAX_WATCHLIST_DOMAINS = 2000;
-export const MAX_WATCHLIST_INPUT_RECORDS = MAX_WATCHLIST_DOMAINS * 2;
-export const MAX_WATCHLIST_NAMESERVERS = 12;
-export const MAX_WATCHLIST_MUTATION_TYPES = 30;
-export const MAX_WATCHLIST_HISTORY_DOMAIN_OPTIONS = MAX_WATCHLIST_DOMAINS;
+import { explainRiskScore, normalizeRiskModelVersion } from "../../lib/risk-scoring.mjs";
+import { HTTP_SECURITY_HEADER_TOKENS, normalizeHttpSummary } from "../cases/http-summary.mjs";
+import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { MAX_WATCHLIST_CHANGES_PER_EVENT, MAX_WATCHLIST_DOMAINS, MAX_WATCHLIST_HISTORY_DOMAIN_OPTIONS, MAX_WATCHLIST_HISTORY_EVENTS, MAX_WATCHLIST_INPUT_RECORDS, MAX_WATCHLIST_MUTATION_TYPES, MAX_WATCHLIST_NAMESERVERS, } from "../contracts/workspace-portability.mjs";
+export { MAX_WATCHLIST_CHANGES_PER_EVENT, MAX_WATCHLIST_DOMAINS, MAX_WATCHLIST_HISTORY_DOMAIN_OPTIONS, MAX_WATCHLIST_HISTORY_EVENTS, MAX_WATCHLIST_INPUT_RECORDS, MAX_WATCHLIST_MUTATION_TYPES, MAX_WATCHLIST_NAMESERVERS, } from "../contracts/workspace-portability.mjs";
 const MAX_TEXT_LENGTH = 300;
 const MAX_TITLE_LENGTH = 200;
 const MAX_MUTATION_TYPE_LENGTH = 60;
@@ -149,10 +145,7 @@ function boundedText(value, maximum = MAX_TEXT_LENGTH, allowNull = true) {
     return normalized || (allowNull ? null : '');
 }
 function isoTimestamp(value, fallback = new Date(0).toISOString()) {
-    if (typeof value !== 'string' || value.length > MAX_TIMESTAMP_LENGTH || CONTROL_RE.test(value))
-        return fallback;
-    const parsed = Date.parse(value);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : fallback;
+    return normalizeExplicitIsoTimestamp(value) ?? fallback;
 }
 function boundedInteger(value, maximum, fallback = 0) {
     return Number.isSafeInteger(value) && Number(value) >= 0 && Number(value) <= maximum
@@ -487,7 +480,7 @@ export function normalizeWatchlistEntry(entry) {
                 : [];
             const rawMode = event.mode;
             return {
-                checkedAt: isoTimestamp(event.checkedAt),
+                checkedAt: isoTimestamp(event.checkedAt, new Date(0).toISOString()),
                 mode: typeof rawMode === 'string' && ['fast', 'deep', 'saved'].includes(rawMode)
                     ? rawMode
                     : 'saved',
@@ -500,7 +493,7 @@ export function normalizeWatchlistEntry(entry) {
         }).slice(-MAX_WATCHLIST_HISTORY_EVENTS)
         : [];
     const normalized = {
-        updatedAt: isoTimestamp(input.updatedAt),
+        updatedAt: isoTimestamp(input.updatedAt, new Date(0).toISOString()),
         results,
         baseline,
         history,