@slicedearth/whoisleuth-cli 1.47.4 → 2.0.0

package/{frontend/src/lib/analysis/workspace-archive.js → packages/workspace/workspace-archive.mjs}

@@ -1,53 +1,27 @@
 // Pure, bounded workspace archive composition. Existing typed store models remain the
 // authority for normalization and merge semantics; this module only packages
 // their portable contracts, verifies integrity, and previews conflicts.
-import { buildCaseExport, CASE_SCHEMA_VERSION, CASE_IMPORT_VERSIONS, enforceStoreBudget, mergeCases, } from "./case-model.js";
-import { assertBrandProfileStoreBudget, BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, buildBrandProfileExport, mergeBrandProfiles, normalizeBrandProfileId, } from "./brand-profile-model.js";
-import { assertCampaignStoreBudget, buildCampaignExport, CAMPAIGN_SCHEMA, CAMPAIGN_SCHEMA_VERSION, mergeCampaigns, } from "./campaign-model.js";
-import { assertWatchlistStoreBudget, buildWatchlistExport, mergeWatchlistStores, WATCHLIST_SCHEMA, WATCHLIST_SCHEMA_VERSION, } from "./watchlist-store.js";
-import { assertShortlistStoreBudget, buildShortlistExport, mergeShortlistStores, SHORTLIST_SCHEMA, SHORTLIST_SCHEMA_VERSION, SUPPORTED_SHORTLIST_SCHEMA_VERSIONS, } from "./shortlist-model.js";
-import { assertDetectionRuleStoreBudget, buildDetectionRuleExport, DETECTION_RULE_SCHEMA, DETECTION_RULE_SCHEMA_VERSION, mergeDetectionRules, } from "./detection-rule-model.js";
-import { buildRelationshipObservationExport, mergeRelationshipObservations, RELATIONSHIP_OBSERVATION_SCHEMA, RELATIONSHIP_OBSERVATION_SCHEMA_VERSION, } from "./relationship-observation-model.js";
-import { BULK_SESSION_SCHEMA, BULK_SESSION_SCHEMA_VERSION, SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS, buildBulkSessionExport, enforceBulkSessionStoreBudget, mergeBulkSessions, } from "./bulk-session-model.js";
-import { WEBSITE_SNAPSHOT_SCHEMA, WEBSITE_SNAPSHOT_SCHEMA_VERSION, SUPPORTED_WEBSITE_SNAPSHOT_SCHEMA_VERSIONS, buildWebsiteSnapshotExport, mergeWebsiteSnapshots, } from "./website-snapshot-model.js";
-import { INVESTIGATION_TEMPLATE_SCHEMA, INVESTIGATION_TEMPLATE_VERSION, buildInvestigationTemplateExport, mergeInvestigationTemplates, } from "./investigation-template-model.js";
-import { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, buildBulkReviewExport, mergeBulkReviewStores, } from "./bulk-review-model.js";
-export const WORKSPACE_ARCHIVE_SCHEMA = 'whoisleuth.workspace-archive';
-export const WORKSPACE_ARCHIVE_VERSION = 5;
-export const SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS = [1, 2, 3, 4, WORKSPACE_ARCHIVE_VERSION];
-export const WORKSPACE_SETTINGS_SCHEMA = 'whoisleuth.workspace-settings';
-export const WORKSPACE_SETTINGS_VERSION = 1;
-export const MAX_WORKSPACE_ARCHIVE_BYTES = 10 * 1024 * 1024;
-export const MAX_WORKSPACE_ARCHIVE_SECTION_BYTES = 5 * 1024 * 1024;
-export const MAX_WORKSPACE_ARCHIVE_SECTIONS = 12;
-export const WORKSPACE_ARCHIVE_SECTION_IDS = [
-    'cases',
-    'campaigns',
-    'brandProfiles',
-    'watchlists',
-    'shortlist',
-    'detectionRules',
-    'relationshipObservations',
-    'bulkSessions',
-    'websiteSnapshots',
-    'investigationTemplates',
-    'bulkReview',
-    'settings',
-];
-export function isSupportedWorkspaceArchiveVersion(value) {
-    return typeof value === 'number'
-        && Number.isSafeInteger(value)
-        && SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS.some((version) => version === value);
-}
+import { buildCaseExport, enforceStoreBudget, mergeCases, } from "../cases/case-model.mjs";
+import { assertBrandProfileStoreBudget, buildBrandProfileExport, mergeBrandProfiles, normalizeBrandProfileId, } from "./brand-profile-model.mjs";
+import { assertCampaignStoreBudget, buildCampaignExport, mergeCampaigns, } from "./campaign-model.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceInputGraph } from "./hostile-input.mjs";
+import { assertWatchlistStoreBudget, buildWatchlistExport, mergeWatchlistStores, } from "./watchlist-store.mjs";
+import { assertShortlistStoreBudget, buildShortlistExport, mergeShortlistStores, } from "./shortlist-model.mjs";
+import { assertDetectionRuleStoreBudget, buildDetectionRuleExport, mergeDetectionRules, } from "./detection-rule-model.mjs";
+import { buildRelationshipObservationExport, mergeRelationshipObservations, } from "./relationship-observation-model.mjs";
+import { buildBulkSessionExport, enforceBulkSessionStoreBudget, mergeBulkSessions, } from "./bulk-session-model.mjs";
+import { buildWebsiteSnapshotExport, mergeWebsiteSnapshots, } from "./website-snapshot-model.mjs";
+import { buildInvestigationTemplateExport, mergeInvestigationTemplates, } from "./investigation-template-model.mjs";
+import { buildBulkReviewExport, mergeBulkReviewStores, } from "./bulk-review-model.mjs";
+import { buildAnalystReviewStateExport, emptyAnalystReviewStateStore, mergeAnalystReviewStateStores, } from "../monitoring/analyst-review-state.mjs";
+import { isSupportedWorkspaceArchiveVersion, MAX_WORKSPACE_ARCHIVE_BYTES, MAX_WORKSPACE_ARCHIVE_SECTION_BYTES, MAX_WORKSPACE_ARCHIVE_SECTIONS, serialiseWorkspaceArchiveSection, SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS, WORKSPACE_ARCHIVE_CASE_SECTION, WORKSPACE_ARCHIVE_SCHEMA, WORKSPACE_ARCHIVE_SECTION_IDS, PUBLIC_WORKSPACE_ARCHIVE_SECTION_IDS, PUBLIC_WORKSPACE_ARCHIVE_VERSION, WORKSPACE_ARCHIVE_VERSION, WORKSPACE_SETTINGS_COMPATIBILITY, WORKSPACE_SETTINGS_SCHEMA, WORKSPACE_SETTINGS_VERSION, } from "../contracts/case-portability.mjs";
+import { ANALYST_REVIEW_STATE_COMPATIBILITY } from "../contracts/analyst-review-state.mjs";
+import { WORKSPACE_PORTABILITY_ARCHIVE_SECTION_REFERENCES } from "../contracts/workspace-portability.mjs";
+export { isSupportedWorkspaceArchiveVersion, MAX_WORKSPACE_ARCHIVE_BYTES, MAX_WORKSPACE_ARCHIVE_SECTION_BYTES, MAX_WORKSPACE_ARCHIVE_SECTIONS, SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS, WORKSPACE_ARCHIVE_CASE_SECTION, WORKSPACE_ARCHIVE_SCHEMA, WORKSPACE_ARCHIVE_SECTION_IDS, PUBLIC_WORKSPACE_ARCHIVE_SECTION_IDS, PUBLIC_WORKSPACE_ARCHIVE_VERSION, WORKSPACE_ARCHIVE_VERSION, WORKSPACE_SETTINGS_SCHEMA, WORKSPACE_SETTINGS_VERSION, };
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
 const CHECKSUM_RE = /^sha256:[a-f0-9]{64}$/;
-const WORKSPACE_ARCHIVE_ROOT_KEYS = Object.freeze({
-    1: Object.freeze(['schema', 'version', 'generatedAt', 'manifest', 'sections', 'limitations']),
-    2: Object.freeze(['schema', 'version', 'generatedAt', 'manifest', 'sections', 'limitations']),
-    3: Object.freeze(['schema', 'version', 'generatedAt', 'manifest', 'sections', 'limitations']),
-    4: Object.freeze(['schema', 'version', 'generatedAt', 'manifest', 'sections', 'limitations']),
-    5: Object.freeze(['schema', 'version', 'generatedAt', 'manifest', 'sections', 'limitations']),
-});
+const WORKSPACE_ARCHIVE_ROOT_KEYS = Object.freeze(['schema', 'version', 'generatedAt', 'manifest', 'sections', 'limitations']);
 const WORKSPACE_ARCHIVE_MANIFEST_KEYS = Object.freeze(['sectionCount', 'totalRecords', 'sections']);
 const WORKSPACE_ARCHIVE_MANIFEST_ENTRY_KEYS = Object.freeze(['id', 'schema', 'version', 'recordCount', 'bytes', 'checksum']);
 function record(value) {
@@ -64,10 +38,7 @@ function byteLength(value) {
 }
 function serialize(value, message = 'The workspace archive contains data that cannot be serialised.') {
     try {
-        const serialized = JSON.stringify(value);
-        if (typeof serialized !== 'string')
-            throw new Error(message);
-        return serialized;
+        return serialiseWorkspaceArchiveSection(value);
     }
     catch {
         throw new Error(message);
@@ -77,10 +48,10 @@ function clone(value) {
     return JSON.parse(serialize(value));
 }
 function timestamp(value, fallback = null) {
-    if (typeof value !== 'string' || value.length > 64 || CONTROL_RE.test(value))
-        return fallback;
-    const parsed = Date.parse(value);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : fallback;
+    const explicit = normalizeExplicitIsoTimestamp(value);
+    if (explicit)
+        return explicit;
+    return fallback;
 }
 function boundedText(value, maximum = 300) {
     if (typeof value !== 'string' || value.length > maximum * 4 || CONTROL_RE.test(value))
@@ -139,6 +110,7 @@ function workspaceArchiveSections(input, now) {
         websiteSnapshots: buildWebsiteSnapshotExport(input.websiteSnapshots, now),
         investigationTemplates: buildInvestigationTemplateExport(input.investigationTemplates, now),
         bulkReview: buildBulkReviewExport(input.bulkReview),
+        analystReviewState: buildAnalystReviewStateExport(input.analystReviewState),
         settings: settingsDocument(input),
     };
 }
@@ -151,10 +123,29 @@ function objectCount(data, key) {
     const nested = value ? record(value[key]) : null;
     return nested ? Object.keys(nested).length : 0;
 }
+function sectionContract(sectionId) {
+    const reference = WORKSPACE_PORTABILITY_ARCHIVE_SECTION_REFERENCES.find((entry) => entry.sectionId === sectionId);
+    if (!reference)
+        throw new TypeError(`Workspace archive section ${sectionId} has no canonical contract reference.`);
+    return Object.freeze({
+        id: reference.sectionId,
+        schema: reference.schema,
+        version: reference.version,
+        supportedVersions: reference.supportedVersions,
+    });
+}
+function compatibilitySchema(descriptor) {
+    if (!descriptor.schema)
+        throw new TypeError(`Workspace compatibility ${descriptor.id} must name a schema.`);
+    return descriptor.schema;
+}
 const SECTION_DEFINITIONS = [
     {
-        id: 'cases', label: 'Cases', schema: null, version: CASE_SCHEMA_VERSION,
-        supportedVersions: CASE_IMPORT_VERSIONS,
+        id: WORKSPACE_ARCHIVE_CASE_SECTION.id,
+        label: 'Cases',
+        schema: WORKSPACE_ARCHIVE_CASE_SECTION.schema,
+        version: WORKSPACE_ARCHIVE_CASE_SECTION.currentVersion,
+        supportedVersions: WORKSPACE_ARCHIVE_CASE_SECTION.supportedVersions,
         count: (data) => arrayCount(data, 'cases'),
         merge: (local, data) => {
             const result = mergeCases(local.cases, data);
@@ -163,7 +154,7 @@ const SECTION_DEFINITIONS = [
         },
     },
     {
-        id: 'campaigns', label: 'Campaigns', schema: CAMPAIGN_SCHEMA, version: CAMPAIGN_SCHEMA_VERSION,
+        ...sectionContract('campaigns'), label: 'Campaigns',
         count: (data) => arrayCount(data, 'campaigns'),
         merge: (local, data) => {
             const result = mergeCampaigns(local.campaigns, data);
@@ -171,8 +162,7 @@ const SECTION_DEFINITIONS = [
         },
     },
     {
-        id: 'brandProfiles', label: 'Brand profiles', schema: BRAND_PROFILE_SCHEMA, version: BRAND_PROFILE_SCHEMA_VERSION,
-        supportedVersions: SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS,
+        ...sectionContract('brandProfiles'), label: 'Brand profiles',
         count: (data) => arrayCount(data, 'profiles'),
         merge: (local, data, now) => {
             const result = mergeBrandProfiles(local.brandProfiles, data, { nowIso: now });
@@ -180,7 +170,7 @@ const SECTION_DEFINITIONS = [
         },
     },
     {
-        id: 'watchlists', label: 'Watchlists', schema: WATCHLIST_SCHEMA, version: WATCHLIST_SCHEMA_VERSION,
+        ...sectionContract('watchlists'), label: 'Watchlists',
         count: (data) => objectCount(data, 'watchlists'),
         merge: (local, data) => {
             const result = mergeWatchlistStores(local.watchlists, data);
@@ -188,8 +178,7 @@ const SECTION_DEFINITIONS = [
         },
     },
     {
-        id: 'shortlist', label: 'Shortlist', schema: SHORTLIST_SCHEMA, version: SHORTLIST_SCHEMA_VERSION,
-        supportedVersions: SUPPORTED_SHORTLIST_SCHEMA_VERSIONS,
+        ...sectionContract('shortlist'), label: 'Shortlist',
         count: (data) => arrayCount(data, 'entries'),
         merge: (local, data) => {
             const result = mergeShortlistStores(local.shortlist, data);
@@ -197,7 +186,7 @@ const SECTION_DEFINITIONS = [
         },
     },
     {
-        id: 'detectionRules', label: 'Detection rules', schema: DETECTION_RULE_SCHEMA, version: DETECTION_RULE_SCHEMA_VERSION,
+        ...sectionContract('detectionRules'), label: 'Detection rules',
         count: (data) => arrayCount(data, 'rules'),
         merge: (local, data) => {
             const result = mergeDetectionRules(local.detectionRules, data);
@@ -205,19 +194,14 @@ const SECTION_DEFINITIONS = [
         },
     },
     {
-        id: 'relationshipObservations',
+        ...sectionContract('relationshipObservations'),
         label: 'Retained relationship observations',
-        schema: RELATIONSHIP_OBSERVATION_SCHEMA,
-        version: RELATIONSHIP_OBSERVATION_SCHEMA_VERSION,
         count: (data) => arrayCount(data, 'observations'),
         merge: (local, data) => mergeRelationshipObservations(local.relationshipObservations, data),
     },
     {
-        id: 'bulkSessions',
+        ...sectionContract('bulkSessions'),
         label: 'Saved Bulk sessions',
-        schema: BULK_SESSION_SCHEMA,
-        version: BULK_SESSION_SCHEMA_VERSION,
-        supportedVersions: SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS,
         count: (data) => arrayCount(data, 'sessions'),
         merge: (local, data) => {
             const result = mergeBulkSessions(local.bulkSessions, data);
@@ -226,32 +210,36 @@ const SECTION_DEFINITIONS = [
         },
     },
     {
-        id: 'websiteSnapshots',
+        ...sectionContract('websiteSnapshots'),
         label: 'Website profile snapshots',
-        schema: WEBSITE_SNAPSHOT_SCHEMA,
-        version: WEBSITE_SNAPSHOT_SCHEMA_VERSION,
-        supportedVersions: SUPPORTED_WEBSITE_SNAPSHOT_SCHEMA_VERSIONS,
         count: (data) => arrayCount(data, 'snapshots'),
         merge: (local, data) => mergeWebsiteSnapshots(local.websiteSnapshots, data),
     },
     {
-        id: 'investigationTemplates',
+        ...sectionContract('investigationTemplates'),
         label: 'Investigation templates',
-        schema: INVESTIGATION_TEMPLATE_SCHEMA,
-        version: INVESTIGATION_TEMPLATE_VERSION,
         count: (data) => arrayCount(data, 'templates'),
         merge: (local, data) => mergeInvestigationTemplates(local.investigationTemplates, data),
     },
     {
-        id: 'bulkReview',
+        ...sectionContract('bulkReview'),
         label: 'Bulk saved views and review queue',
-        schema: BULK_REVIEW_SCHEMA,
-        version: BULK_REVIEW_SCHEMA_VERSION,
         count: (data) => arrayCount(data, 'presets') + arrayCount(data, 'rows'),
         merge: (local, data) => mergeBulkReviewStores(local.bulkReview, data),
     },
     {
-        id: 'settings', label: 'Workspace settings', schema: WORKSPACE_SETTINGS_SCHEMA, version: WORKSPACE_SETTINGS_VERSION,
+        id: 'analystReviewState',
+        label: 'Analyst Review Item lifecycle',
+        schema: compatibilitySchema(ANALYST_REVIEW_STATE_COMPATIBILITY),
+        version: ANALYST_REVIEW_STATE_COMPATIBILITY.currentVersion,
+        supportedVersions: ANALYST_REVIEW_STATE_COMPATIBILITY.supportedVersions,
+        count: (data) => arrayCount(data, 'records'),
+        merge: (local, data) => mergeAnalystReviewStateStores(local.analystReviewState, data),
+    },
+    {
+        id: 'settings', label: 'Workspace settings', schema: compatibilitySchema(WORKSPACE_SETTINGS_COMPATIBILITY),
+        version: WORKSPACE_SETTINGS_COMPATIBILITY.currentVersion,
+        supportedVersions: WORKSPACE_SETTINGS_COMPATIBILITY.supportedVersions,
         count: () => 1,
         merge: null,
     },
@@ -277,6 +265,7 @@ function normalizedInput(input) {
         websiteSnapshots: Array.isArray(value.websiteSnapshots) ? value.websiteSnapshots : [],
         investigationTemplates: Array.isArray(value.investigationTemplates) ? value.investigationTemplates : [],
         bulkReview: record(value.bulkReview) || {},
+        analystReviewState: record(value.analystReviewState) || emptyAnalystReviewStateStore(),
         settings: record(value.settings) || {},
     };
 }
@@ -290,7 +279,9 @@ function ensureArchiveBudget(value) {
 }
 /** Build one deterministic, unencrypted archive from normalized local stores. */
 export async function buildWorkspaceArchive(input, options = {}) {
-    const now = timestamp(options.generatedAt) || new Date().toISOString();
+    const now = timestamp(options.generatedAt ?? new Date().toISOString());
+    if (!now)
+        throw new Error('Workspace archive generation time must use an explicit timezone.');
     const source = normalizedInput(input);
     const sections = workspaceArchiveSections(source, now);
     const manifestSections = [];
@@ -347,19 +338,29 @@ function manifestEntry(raw) {
 }
 /** Validate structure, section byte counts, and checksums without applying data. */
 export async function readWorkspaceArchive(raw, options = {}) {
+    assertWorkspaceInputGraph(raw, 'Workspace archive');
     const value = record(raw);
     if (!value || value.schema !== WORKSPACE_ARCHIVE_SCHEMA) {
         throw new Error('This file is not a WHOISleuth workspace archive.');
     }
     if (!isSupportedWorkspaceArchiveVersion(value.version)) {
+        if (typeof value.version === 'number' && Number.isSafeInteger(value.version) && value.version < WORKSPACE_ARCHIVE_VERSION) {
+            throw new Error(`Workspace archive schema ${value.version} is retired. Export it as schema ${WORKSPACE_ARCHIVE_VERSION} with the last broad-reader release before importing; no data was changed.`);
+        }
         if (typeof value.version === 'number' && Number.isSafeInteger(value.version) && value.version > WORKSPACE_ARCHIVE_VERSION) {
-            throw new Error(`This workspace archive uses newer schema ${value.version}. Update the app before importing it.`);
+            throw new Error(`Workspace archive schema ${value.version} is newer than the supported schema ${WORKSPACE_ARCHIVE_VERSION}; no data was changed.`);
         }
-        throw new Error(`Expected workspace archive schema 1, 2, 3, 4, or ${WORKSPACE_ARCHIVE_VERSION}.`);
+        throw new Error(`Expected a well-formed workspace archive using schema ${WORKSPACE_ARCHIVE_VERSION}; no data was changed.`);
     }
     const sourceVersion = value.version;
+    const expectedSectionIds = sourceVersion === PUBLIC_WORKSPACE_ARCHIVE_VERSION
+        ? PUBLIC_WORKSPACE_ARCHIVE_SECTION_IDS
+        : WORKSPACE_ARCHIVE_SECTION_IDS;
+    const generatedAt = timestamp(value.generatedAt);
+    if (!generatedAt)
+        throw new Error('The workspace archive generation time is invalid.');
     const { bytes } = ensureArchiveBudget(value);
-    assertExactKeys(value, WORKSPACE_ARCHIVE_ROOT_KEYS[sourceVersion] ?? [], `version ${sourceVersion} envelope`);
+    assertExactKeys(value, WORKSPACE_ARCHIVE_ROOT_KEYS, `version ${sourceVersion} envelope`);
     const manifest = record(value.manifest);
     const sectionValues = record(value.sections);
     if (!manifest || !sectionValues || !Array.isArray(manifest.sections)) {
@@ -413,9 +414,11 @@ export async function readWorkspaceArchive(raw, options = {}) {
         }
         else if (!(definition.supportedVersions ?? [definition.version]).includes(entry.version) || entry.schema !== definition.schema) {
             status = 'unsupported';
-            reason = entry.version > definition.version
-                ? `This section uses newer schema ${entry.version}.`
-                : 'This section uses an unsupported schema contract.';
+            reason = entry.schema !== definition.schema
+                ? 'This section uses an unsupported schema contract.'
+                : entry.version > definition.version
+                    ? `This section uses newer schema ${entry.version}.`
+                    : `This section uses retired schema ${entry.version}. Export it with the last broad-reader release before importing; no data was changed.`;
         }
         else if (definition.count(data) !== entry.recordCount) {
             throw new Error(`${entry.id} does not match its manifest record count.`);
@@ -429,12 +432,30 @@ export async function readWorkspaceArchive(raw, options = {}) {
     if (manifest.sectionCount !== sections.length || manifest.totalRecords !== totalRecords) {
         throw new Error('The workspace archive manifest totals do not match its sections.');
     }
+    if (seen.size !== expectedSectionIds.length || expectedSectionIds.some((id) => !seen.has(id))) {
+        throw new Error(`Workspace archive schema ${sourceVersion} does not contain its exact required section set.`);
+    }
+    if (sourceVersion === PUBLIC_WORKSPACE_ARCHIVE_VERSION) {
+        const data = emptyAnalystReviewStateStore();
+        sections.push({
+            id: 'analystReviewState',
+            label: 'Analyst Review Item lifecycle',
+            schema: compatibilitySchema(ANALYST_REVIEW_STATE_COMPATIBILITY),
+            version: ANALYST_REVIEW_STATE_COMPATIBILITY.currentVersion,
+            recordCount: 0,
+            bytes: byteLength(serialize(data)),
+            checksum: await checksum(data, options.cryptoProvider),
+            status: 'ready',
+            reason: `Workspace schema ${PUBLIC_WORKSPACE_ARCHIVE_VERSION} did not contain Review Item lifecycle state. Import supplies an empty section and invents no analyst decisions.`,
+            data,
+        });
+    }
     sections.sort(canonicalSectionOrder);
     return {
         schema: WORKSPACE_ARCHIVE_SCHEMA,
         version: WORKSPACE_ARCHIVE_VERSION,
         sourceVersion,
-        generatedAt: timestamp(value.generatedAt),
+        generatedAt,
         bytes,
         sections,
         limitations: Array.isArray(value.limitations)
@@ -501,7 +522,7 @@ export async function previewWorkspaceArchive(raw, localInput, options = {}) {
                 status: 'ready',
                 reason: definition.id === 'settings' && selected && (result.skipped ?? 0) > 0
                     ? result.reason ?? 'The imported workspace preference was skipped. Existing browser-local context is preserved.'
-                    : '',
+                    : section.reason,
                 added: result.added ?? 0,
                 updated: result.updated ?? 0,
                 skipped: result.skipped ?? 0,

package/third-party-notices.txt

@@ -7,7 +7,7 @@ The inventory is the exact transitive closure of the packaged CLI runtime depend
 Package count: 27
 
 ================================================================================
-@peculiar/asn1-cms@2.8.0
+@peculiar/asn1-cms@2.9.4
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -34,7 +34,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-csr@2.8.0
+@peculiar/asn1-csr@2.9.4
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -61,7 +61,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-ecc@2.8.0
+@peculiar/asn1-ecc@2.9.4
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -88,7 +88,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-pfx@2.8.0
+@peculiar/asn1-pfx@2.9.4
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -115,7 +115,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-pkcs8@2.8.0
+@peculiar/asn1-pkcs8@2.9.4
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -142,7 +142,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-pkcs9@2.8.0
+@peculiar/asn1-pkcs9@2.9.4
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -169,7 +169,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-rsa@2.8.0
+@peculiar/asn1-rsa@2.9.4
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -196,7 +196,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-schema@2.8.0
+@peculiar/asn1-schema@2.9.4
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -223,7 +223,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-x509@2.8.0
+@peculiar/asn1-x509@2.9.4
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -250,7 +250,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-x509-attr@2.8.0
+@peculiar/asn1-x509-attr@2.9.4
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -488,7 +488,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-pvutils@1.1.5
+pvutils@1.2.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -612,7 +612,7 @@ CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ================================================================================
-tldts@7.4.10
+tldts@7.4.11
 Relationship: direct production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -631,7 +631,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
  WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ================================================================================
-tldts-core@7.4.10
+tldts-core@7.4.11
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -713,7 +713,7 @@ MIT License
     OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     SOFTWARE
 ================================================================================
-undici@8.9.0
+undici@8.10.0
 Relationship: direct production dependency
 Declared licence: MIT
 Licence source: LICENSE

package/frontend/src/lib/analysis/bulk-retry-plan.js

@@ -1,79 +0,0 @@
-import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
-import { limitedBulkSources } from "./bulk-source-coverage.js";
-export const MAX_BULK_RETRY_ROWS = 200;
-export const BULK_REVIEW_STALE_AFTER_DAYS = 7;
-function freshness(value, now = Date.now()) {
-    if (typeof value !== 'string' || !Number.isFinite(Date.parse(value))) {
-        return { observedAt: null, ageDays: null, state: 'unknown' };
-    }
-    const observedAt = new Date(value).toISOString();
-    const ageDays = Math.max(0, Math.floor((now - Date.parse(observedAt)) / 86_400_000));
-    return {
-        observedAt,
-        ageDays,
-        state: ageDays >= BULK_REVIEW_STALE_AFTER_DAYS ? 'stale' : 'current',
-    };
-}
-function retryRow(value, isStale) {
-    const limitedSources = limitedBulkSources(value.domain, value.sourceCoverage)
-        .sort()
-        .slice(0, 12);
-    const reasons = [];
-    if (value.status === 'error')
-        reasons.push('error');
-    if (limitedSources.length)
-        reasons.push('limited_source');
-    if (isStale)
-        reasons.push('stale');
-    return reasons.length ? { domain: value.domain, reasons, limitedSources } : null;
-}
-export function buildBulkRetryPlan(values, mode, observedAtRaw = null, now = Date.now()) {
-    const observationFreshness = freshness(observedAtRaw, now);
-    const candidates = values
-        .map((row) => normalizeBulkSessionResult(row))
-        .filter((value) => Boolean(value))
-        .map((value) => retryRow(value, observationFreshness.state === 'stale'))
-        .filter((value) => Boolean(value));
-    const rows = candidates.slice(0, MAX_BULK_RETRY_ROWS);
-    return {
-        mode,
-        lookupRequests: rows.length,
-        rows,
-        destinations: mode === 'deep'
-            ? ['registry RDAP', 'registrar RDAP when advertised', 'WHOIS', 'DNS resolvers', 'target HTTP(S)', 'target TLS']
-            : ['registry RDAP', 'authoritative DNS delegation when registration sources are inconclusive'],
-        capped: candidates.length > rows.length,
-        freshness: observationFreshness,
-        limitations: [
-            'This repeats the selected lookup profile; the current API does not request only one upstream source.',
-            `Evidence is marked stale after ${BULK_REVIEW_STALE_AFTER_DAYS} days for review purposes; this is a local observation age, not an upstream record age.`,
-            'Optional third-party intelligence providers are not contacted by Bulk.',
-            'Sources deliberately skipped by the selected scan profile or deployment policy do not independently trigger a retry.',
-            'A retry can remain partial or fail and does not convert unavailable evidence into absence.',
-        ],
-    };
-}
-export function preservePriorBulkResult(previousRaw, currentRaw) {
-    const previous = normalizeBulkSessionResult(previousRaw);
-    const current = normalizeBulkSessionResult(currentRaw);
-    if (!previous || !current || previous.domain !== current.domain || previous.status !== 'complete') {
-        return { preserve: false, reason: '' };
-    }
-    if (current.status === 'error') {
-        return { preserve: true, reason: 'The retry failed, so the prior settled result was retained.' };
-    }
-    if (previous.scanDepth === 'deep' && current.scanDepth === 'fast') {
-        return { preserve: true, reason: 'The retry returned only Fast evidence, so the prior Deep result was retained.' };
-    }
-    const currentSources = new Map(current.sourceCoverage.map((item) => [item.source, item.state]));
-    const regressed = previous.sourceCoverage
-        .filter((item) => item.state === 'complete')
-        .map((item) => item.source)
-        .filter((source) => currentSources.get(source) !== 'complete');
-    return regressed.length
-        ? {
-            preserve: true,
-            reason: `The retry reduced complete coverage for ${regressed.slice(0, 6).join(', ')}, so the prior settled result was retained.`,
-        }
-        : { preserve: false, reason: '' };
-}

package/frontend/src/lib/analysis/bulk-source-coverage.js

@@ -1,76 +0,0 @@
-// Authority-aware interpretation for compact Bulk source observations. Raw
-// source states remain unchanged; this layer only decides whether an observed
-// limitation was unexpected for the registry's published service paths.
-import { registryCapabilityFor } from "../../../../lib/registry-capabilities.mjs";
-const MAX_SOURCE_OBSERVATIONS = 32;
-const MAX_SOURCE_TEXT_LENGTH = 40;
-const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
-const LIMITED_SOURCE_STATES = new Set([
-    'error',
-    'failed',
-    'inconclusive',
-    'partial',
-    'rate_limited',
-    'unavailable',
-    'unsupported',
-]);
-function text(value) {
-    return typeof value === 'string'
-        && value.length <= MAX_SOURCE_TEXT_LENGTH
-        && !CONTROL_RE.test(value)
-        ? value.trim().toLowerCase()
-        : '';
-}
-function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : null;
-}
-function observations(value) {
-    return Array.isArray(value)
-        ? value.slice(0, MAX_SOURCE_OBSERVATIONS).flatMap((entry) => {
-            const item = record(entry);
-            const source = text(item?.source);
-            const state = text(item?.state);
-            return source && state ? [{ source, state }] : [];
-        })
-        : [];
-}
-function expectedUnsupportedSources(domain) {
-    const capability = registryCapabilityFor(domain);
-    if (!capability)
-        return new Set();
-    const expected = new Set();
-    if (capability.rdapAccessProfile === 'no-iana-service')
-        expected.add('rdap');
-    if (capability.whoisAccessProfile === 'no-iana-service')
-        expected.add('whois');
-    return expected;
-}
-export function isExpectedUnsupportedBulkSource(domain, observation) {
-    const source = text(observation.source);
-    const state = text(observation.state);
-    return state === 'unsupported' && expectedUnsupportedSources(domain).has(source);
-}
-export function limitedBulkSources(domain, coverage) {
-    const expectedUnsupported = expectedUnsupportedSources(domain);
-    return observations(coverage)
-        .filter(({ source, state }) => (LIMITED_SOURCE_STATES.has(state)
-        && !(state === 'unsupported' && expectedUnsupported.has(source))))
-        .map(({ source }) => source);
-}
-export function classifyBulkSourceCoverage(domain, coverage) {
-    const retained = observations(coverage);
-    if (!retained.length)
-        return 'unrecorded';
-    return limitedBulkSources(domain, retained).length ? 'limited' : 'complete';
-}
-export function describeBulkSourceCoverage(domain, observation) {
-    const source = text(observation.source);
-    const state = text(observation.state);
-    if (!source || !state)
-        return 'unrecorded source';
-    return isExpectedUnsupportedBulkSource(domain, observation)
-        ? `${source}: unsupported (no IANA-published service)`
-        : `${source}: ${state}`;
-}