@slicedearth/whoisleuth-cli 2.0.1 → 2.2.0

package/lib/risk-scoring.mjs

@@ -6,11 +6,21 @@ const STATE_LABELS = Object.freeze({
     expiring: 'expiring/pending delete',
     registered: 'registered',
 });
-// Version 7 caps each independent evidence family, treats generic operational
-// properties as supporting context, and reports collection quality separately
-// from the heuristic score. Missing evidence never contributes points.
-export const RISK_MODEL_VERSION = 7;
+// Version 8 keeps unreviewed whole-page similarity as visible review context
+// without assigning it Risk points. Reviewed favicon and official-asset
+// observations remain bounded within the brand-presentation family, generic
+// operational properties remain supporting context, and missing evidence never
+// contributes points.
+export const RISK_MODEL_VERSION = 8;
 export const RISK_REVIEW_THRESHOLD = 70;
+const CURRENT_RISK_MODEL = Object.freeze({
+    modelVersion: RISK_MODEL_VERSION,
+    includePageBaselineMatch: false,
+});
+const RISK_MODEL_V7 = Object.freeze({
+    modelVersion: 7,
+    includePageBaselineMatch: true,
+});
 const RISK_STATE_BASE = Object.freeze({
     registered: 6,
     for_sale: 4,
@@ -114,7 +124,7 @@ function scoreQuality(input) {
 }
 // Risk prioritizes a registered lookalike/typosquat domain for analyst review.
 // It is a heuristic indicator, never a maliciousness or safety verdict.
-function explainRiskScoreInternal(input, excludedFamily) {
+function explainRiskScoreInternal(input, excludedFamily, model) {
     const state = input.availability ?? input.state;
     if (typeof state !== 'string' || !RISK_STATES.has(state))
         return null;
@@ -143,8 +153,9 @@ function explainRiskScoreInternal(input, excludedFamily) {
         add('brand-presentation', 'Favicon resembles an official Brand Profile site', 14);
     if (input.reusesOfficialAssets === true)
         add('brand-presentation', 'Official asset-host relationship observed', 6);
-    if (input.pageBaselineMatch === true)
+    if (model.includePageBaselineMatch && input.pageBaselineMatch === true) {
         add('brand-presentation', 'Multiple independently compared page-identity components match the official baseline', 14);
+    }
     if (typeof input.phishingLanguageMatch === 'string' && input.phishingLanguageMatch.trim()) {
         add('credential-lure', 'Suspicious urgency language observed', 8);
     }
@@ -193,7 +204,7 @@ function explainRiskScoreInternal(input, excludedFamily) {
         'external-intelligence', 'corroboration', 'operational-support',
     ];
     return {
-        modelVersion: RISK_MODEL_VERSION,
+        modelVersion: model.modelVersion,
         score,
         rawScore,
         capped: score !== rawScore,
@@ -205,16 +216,16 @@ function explainRiskScoreInternal(input, excludedFamily) {
     };
 }
 export function explainRiskScore(input) {
-    return explainRiskScoreInternal(input, null);
+    return explainRiskScoreInternal(input, null, CURRENT_RISK_MODEL);
 }
 export function buildRiskScoreSensitivity(input) {
-    const baseline = explainRiskScoreInternal(input, null);
+    const baseline = explainRiskScoreInternal(input, null, CURRENT_RISK_MODEL);
     if (!baseline)
         return null;
     const removableFamilies = REMOVABLE_RISK_FAMILIES
         .filter((family) => baseline.families.some((item) => item.id === family && item.contribution > 0));
     const scenarios = removableFamilies.map((excludedFamily) => {
-        const result = explainRiskScoreInternal(input, excludedFamily);
+        const result = explainRiskScoreInternal(input, excludedFamily, CURRENT_RISK_MODEL);
         const score = result?.score ?? baseline.score;
         return Object.freeze({ excludedFamily, score, difference: score - baseline.score });
     }).sort((left, right) => left.score - right.score || left.excludedFamily.localeCompare(right.excludedFamily));
@@ -240,6 +251,11 @@ export function computeRiskScore(input) {
 }
 // Retained only for deterministic offline comparison of reviewed calibration
 // datasets. Runtime lookups always use the current model above.
+export function explainRiskScoreV7(input) {
+    return explainRiskScoreInternal(input, null, RISK_MODEL_V7);
+}
+// Retained only for deterministic offline comparison of reviewed calibration
+// datasets. Runtime lookups always use the current model above.
 export function explainRiskScoreV6(input) {
     const state = input.availability ?? input.state;
     if (typeof state !== 'string' || !RISK_STATES.has(state))