@slicedearth/whoisleuth-cli 2.0.1 → 2.2.0

package/packages/contracts/cli-lookup.mjs

@@ -36,6 +36,7 @@ export const CLI_LOOKUP_OPTIONAL_ROOT_KEYS = Object.freeze([
     'whois',
     'availability',
     'registryInsights',
+    'registrarStanding',
     'reverseDns',
     'networkContext',
     'securityTxt',
@@ -59,7 +60,7 @@ export const CLI_LOOKUP_COMPATIBILITY = defineSchemaCompatibility({
     writeSemantics: 'normalized_rewrite',
     byteBudget: MAX_CLI_LOOKUP_BYTES,
     owner: 'packages/contracts/cli-lookup.mts',
-    note: 'Saved Lookup documents preserve version 1 domain, IP and ASN compatibility while version 2 can additionally retain bounded Deep homepage metadata.',
+    note: 'Saved Lookup documents preserve version 1 domain, IP and ASN compatibility while version 2 can additionally retain bounded Deep homepage metadata and optional official registrar-standing context.',
 });
 export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
     id: 'cli-lookup',
@@ -234,7 +235,7 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'cli-lookup.sensitive-collection.v1',
                 classification: 'analyst_authored_sensitive',
                 projection: 'full_manifest',
-                includedCategories: ['target-identifiers', 'query-and-mode', 'raw-rdap-publications', 'raw-whois-responses', 'published-contacts', 'source-endpoints', 'source-timings', 'normalised-evidence', 'collection-context'],
+                includedCategories: ['target-identifiers', 'query-and-mode', 'raw-rdap-publications', 'raw-whois-responses', 'published-contacts', 'source-endpoints', 'source-timings', 'normalised-evidence', 'registrar-standing-official-projection', 'collection-context'],
                 excludedCategories: ['credentials', 'cookies', 'sessions', 'authorisation-material'],
                 notePolicy: 'not_applicable',
                 retention: 'operator_controlled_output',
@@ -245,7 +246,7 @@ export const CLI_LOOKUP_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'cli-lookup.sensitive-file.v1',
                 classification: 'analyst_authored_sensitive',
                 projection: 'full_manifest',
-                includedCategories: ['target-identifiers', 'query-and-mode', 'raw-rdap-publications', 'raw-whois-responses', 'published-contacts', 'source-endpoints', 'source-timings', 'normalised-evidence', 'collection-context'],
+                includedCategories: ['target-identifiers', 'query-and-mode', 'raw-rdap-publications', 'raw-whois-responses', 'published-contacts', 'source-endpoints', 'source-timings', 'normalised-evidence', 'registrar-standing-official-projection', 'collection-context'],
                 excludedCategories: ['credentials', 'cookies', 'sessions', 'authorisation-material'],
                 notePolicy: 'not_applicable',
                 retention: 'deliberate_local_file',

package/packages/contracts/domain-control-manifest.mjs

@@ -428,7 +428,7 @@ export const DOMAIN_CONTROL_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
             { id: 'domain-control.node.build-document', role: 'builder', runtime: 'node', module: 'lib/domain-control-manifest.mts', exportName: 'buildDomainControlManifest' },
             { id: 'domain-control.node.verify-integrity', role: 'integrity_verifier', runtime: 'node', module: 'lib/domain-control-manifest.mts', exportName: 'verifyDomainControlManifest' },
             { id: 'domain-control.node.review', role: 'reviewer', runtime: 'node', module: 'lib/domain-control-manifest.mts', exportName: 'reviewDomainControlManifest' },
-            { id: 'domain-control.cli.offline-structure', role: 'structure_validator', runtime: 'cli', module: 'cli/artifact-structure.mts', exportName: 'validateSignedDigestArtifactStructure' },
+            { id: 'domain-control.cli.offline-structure', role: 'structure_validator', runtime: 'cli', module: 'cli/offline-artifact-validation.mts', exportName: 'validateSignedDigestArtifactStructure' },
             { id: 'domain-control.cli.offline-verify', role: 'integrity_verifier', runtime: 'cli', module: 'cli/artifact-verify.mts', exportName: 'verifyOfflineArtifact' },
             { id: 'domain-control.cli.interchange-report', role: 'interchange_reporter', runtime: 'cli', module: 'cli/interchange-report.mts', exportName: 'buildInterchangeFidelityReport' },
             { id: 'domain-control.cli.sign-package', role: 'signer', runtime: 'cli', module: 'cli/evidence-signing.mts', exportName: 'signEvidencePackage' },

package/packages/contracts/investigation-portability.mjs

@@ -244,7 +244,7 @@ export const INVESTIGATION_PORTABILITY_LIFECYCLE_FAMILY = defineSchemaLifecycleF
                 ] },
         ],
         hooks: [
-            { id: 'investigation.offline.structure', role: 'structure_validator', runtime: 'cli', module: 'cli/artifact-structure.mts', exportName: 'validateOfflineArtifactStructure' },
+            { id: 'investigation.offline.structure', role: 'structure_validator', runtime: 'cli', module: 'cli/offline-artifact-validation.mts', exportName: 'validateOfflineArtifactStructure' },
             { id: 'investigation.offline.verify', role: 'integrity_verifier', runtime: 'cli', module: 'cli/artifact-verify.mts', exportName: 'verifyOfflineArtifact' },
             { id: 'investigation.acquisition.build', role: 'builder', runtime: 'shared', module: 'packages/investigation/acquisition-decision-packet.mts', exportName: 'buildAcquisitionDecisionPacket' },
             { id: 'investigation.passport.build', role: 'builder', runtime: 'shared', module: 'packages/investigation/lookup-claim-passport.mts', exportName: 'buildLookupClaimPassport' },

package/packages/contracts/risk-calibration.mjs

@@ -338,7 +338,7 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
             id: 'risk-calibration-report-v3-detailed',
             path: 'test/fixtures/risk-calibration-report-v3-detailed.json',
             bytes: 7_026,
-            sha256: '0c905036b05da2feb586199781444d5b575982bb5f6ef585d8f7c2e431363e8d',
+            sha256: '5c0c435e81478e90bc0b64aa7c20fd82d131b5261a57d9550df3f03334bc20e1',
             contentDigestSha256: null,
             schema: RISK_CALIBRATION_REPORT_SCHEMA,
             version: RISK_CALIBRATION_REPORT_VERSION,
@@ -352,7 +352,7 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
             id: 'risk-calibration-report-v3-summary',
             path: 'test/fixtures/risk-calibration-report-v3-summary.json',
             bytes: 5_486,
-            sha256: '637e739eac58ec06f3f2c9688fb2c03d5d139536e9629e1e1a811d3c8c7563d0',
+            sha256: 'b06c312eed14680ce30fd58a84a93908d29ea9e71bfee8174b90df286b730549',
             contentDigestSha256: null,
             schema: RISK_CALIBRATION_REPORT_SCHEMA,
             version: RISK_CALIBRATION_REPORT_VERSION,

package/packages/contracts/workspace-portability.mjs

@@ -95,8 +95,8 @@ export const MAX_RELATIONSHIP_OBSERVATION_LIMITATIONS = 8;
 export const MAX_RELATIONSHIP_OBSERVATION_VALUE_LENGTH = 20_000;
 export const MAX_RELATIONSHIP_OBSERVATION_STORE_BYTES = 768 * 1024;
 export const WEBSITE_SNAPSHOT_SCHEMA = 'whoisleuth.website-profile-snapshots';
-export const WEBSITE_SNAPSHOT_SCHEMA_VERSION = 4;
-export const WEBSITE_SNAPSHOT_BROWSER_SUPPORTED_VERSIONS = Object.freeze([WEBSITE_SNAPSHOT_SCHEMA_VERSION]);
+export const WEBSITE_SNAPSHOT_SCHEMA_VERSION = 5;
+export const WEBSITE_SNAPSHOT_BROWSER_SUPPORTED_VERSIONS = Object.freeze([4, WEBSITE_SNAPSHOT_SCHEMA_VERSION]);
 export const SUPPORTED_WEBSITE_SNAPSHOT_SCHEMA_VERSIONS = WEBSITE_SNAPSHOT_BROWSER_SUPPORTED_VERSIONS;
 export const MAX_WEBSITE_SNAPSHOTS = 60;
 export const MAX_WEBSITE_SNAPSHOTS_PER_DOMAIN = 12;
@@ -265,9 +265,9 @@ export const RELATIONSHIP_OBSERVATION_BROWSER_COMPATIBILITY = defineSchemaCompat
 export const WEBSITE_SNAPSHOT_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.website-snapshots', kind: 'browser_store', schema: null,
     currentVersion: WEBSITE_SNAPSHOT_SCHEMA_VERSION, supportedVersions: WEBSITE_SNAPSHOT_BROWSER_SUPPORTED_VERSIONS,
-    acceptsUnversionedLegacy: false, futureVersionBehavior: 'preserve_without_write', migration: 'exact_current_only',
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current',
     writeSemantics: 'normalized_rewrite', byteBudget: MAX_WEBSITE_SNAPSHOT_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'The unchanged public version 4 writer remains the exact browser and export baseline; raw lookup payloads, contact data, certificate bytes, and fetched bodies remain excluded.',
+    note: 'Public version 4 records normalise to version 5 with explicit unknown profile provenance; raw lookup payloads, contact data, certificate bytes, and fetched bodies remain excluded.',
 });
 export const BULK_SESSION_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.bulk-sessions', kind: 'browser_store', schema: null, currentVersion: BULK_SESSION_SCHEMA_VERSION,
@@ -335,9 +335,9 @@ export const RELATIONSHIP_OBSERVATION_EXPORT_COMPATIBILITY = defineSchemaCompati
 export const WEBSITE_SNAPSHOT_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.website-snapshots', kind: 'export', schema: WEBSITE_SNAPSHOT_SCHEMA,
     currentVersion: WEBSITE_SNAPSHOT_SCHEMA_VERSION, supportedVersions: SUPPORTED_WEBSITE_SNAPSHOT_SCHEMA_VERSIONS,
-    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'exact_current_only',
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'normalize_to_current',
     writeSemantics: 'non_destructive_merge', byteBudget: MAX_WEBSITE_SNAPSHOT_IMPORT_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'The unchanged public schema 4 archive section merges non-destructively without retaining fetched bodies.',
+    note: 'Public schema 4 archive sections normalise to version 5 with explicit unknown profile provenance and merge non-destructively without retaining fetched bodies.',
 });
 export const BULK_SESSION_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.bulk-sessions', kind: 'export', schema: BULK_SESSION_SCHEMA, currentVersion: BULK_SESSION_SCHEMA_VERSION,
@@ -800,6 +800,20 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "contentDigestSha256": null,
         "schema": "whoisleuth.browser.website-snapshot-store",
         "version": 4,
+        "role": "historical",
+        "expectation": "normalises_to_current_output",
+        "expectedOutputFixtureId": "workspace.browser.website.v5",
+        "scope": "repository",
+        "shapeId": "workspace.browser.website.shape"
+    },
+    {
+        "id": "workspace.browser.website.v5",
+        "path": "test/fixtures/workspace-lifecycle/browser-website-v5.json",
+        "bytes": 90,
+        "sha256": "16550a8c24d5c7bcfe271086071fee7f3392279990cc6fe91e3b9c95f07d0759",
+        "contentDigestSha256": null,
+        "schema": "whoisleuth.browser.website-snapshot-store",
+        "version": 5,
         "role": "current",
         "expectation": "accepted_exact",
         "expectedOutputFixtureId": null,
@@ -954,6 +968,20 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "contentDigestSha256": null,
         "schema": "whoisleuth.website-profile-snapshots",
         "version": 4,
+        "role": "historical",
+        "expectation": "normalises_to_current_output",
+        "expectedOutputFixtureId": "workspace.portable.website.v5",
+        "scope": "repository",
+        "shapeId": "workspace.portable.website.shape"
+    },
+    {
+        "id": "workspace.portable.website.v5",
+        "path": "test/fixtures/workspace-lifecycle/portable-website-v5.json",
+        "bytes": 135,
+        "sha256": "0cab1675a632793141107fac330a130e7d300a7726e9963f8409199902bf0d23",
+        "contentDigestSha256": null,
+        "schema": "whoisleuth.website-profile-snapshots",
+        "version": 5,
         "role": "current",
         "expectation": "accepted_exact",
         "expectedOutputFixtureId": null,

package/packages/interchange/external-findings-import.mjs

@@ -1,4 +1,5 @@
 import { normalizeDomain, openOrCreateCase, updateCase, } from "../cases/case-model.mjs";
+import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, } from "../contracts/external-observation-interchange.mjs";
 import { hasUnsafeRetainedText } from "./retained-text.mjs";
@@ -311,6 +312,58 @@ function structuredPinFields(finding) {
         certificateObservation,
     };
 }
+function mergeExternalFindingIntoCase(current, caseId, finding, source, now) {
+    const target = current.find((candidate) => candidate.id === caseId) ?? null;
+    if (!target)
+        throw new Error('The selected Case is unavailable for this finding.');
+    if (existingPinKey(target, finding, source.name)) {
+        return { cases: [...current], record: target, added: false };
+    }
+    const sourceLimitations = [
+        finding.evidenceClass === 'deployment_observation'
+            ? `Imported as an observation made by ${source.name}; this browser session did not collect or independently verify it.`
+            : `Reported by ${source.name}; WHOISleuth did not collect or independently verify this provider finding.`,
+        ...(source.reference ? [`Source reference: ${source.reference}`] : []),
+        ...finding.limitations,
+    ];
+    const existingPinIds = new Set(target.evidencePins.map((pin) => pin.id));
+    let updated = updateCase([...current], target.id, {
+        evidencePin: {
+            ...structuredPinFields(finding),
+            label: `External ${finding.category} finding`,
+            value: finding.structuredObservation?.value ?? pinValue(finding),
+            source: importedSourceLabel(finding, source.name),
+            observedAt: finding.observedAt,
+            completeness: finding.completeness,
+            limitations: sourceLimitations,
+        },
+    }, now);
+    const addedPin = updated.record.evidencePins.find((pin) => !existingPinIds.has(pin.id)) ?? null;
+    if (!addedPin)
+        throw new Error('The imported finding could not be retained as Case evidence.');
+    updated = updateCase(updated.cases, target.id, {
+        sighting: {
+            state: finding.evidenceClass === 'deployment_observation'
+                ? 'observed_by_deployment'
+                : 'reported_by_provider',
+            category: finding.category === 'dns'
+                ? 'delegation'
+                : finding.category === 'certificate'
+                    ? 'certificate'
+                    : finding.category === 'registration'
+                        ? 'registration'
+                        : finding.category === 'http' || finding.category === 'page'
+                            ? 'website'
+                            : 'other',
+            source: source.name,
+            observedAt: finding.observedAt,
+            completeness: finding.completeness,
+            evidencePinId: addedPin.id,
+            limitations: sourceLimitations,
+        },
+    }, now);
+    return { cases: updated.cases, record: updated.record, added: true };
+}
 export function mergeExternalFindingsIntoCases(current, document, now = new Date().toISOString()) {
     let cases = [...current];
     const createdDomains = new Set();
@@ -322,54 +375,12 @@ export function mergeExternalFindingsIntoCases(current, document, now = new Date
         const opened = openOrCreateCase(cases, { domain: finding.domain, source: 'import' }, now);
         cases = opened.cases;
         const target = cases.find((candidate) => candidate.id === opened.record.id) ?? opened.record;
-        if (existingPinKey(target, finding, document.source.name)) {
+        const merged = mergeExternalFindingIntoCase(cases, target.id, finding, document.source, now);
+        cases = merged.cases;
+        if (!merged.added) {
             duplicatesSkipped += 1;
             continue;
         }
-        const sourceLimitations = [
-            finding.evidenceClass === 'deployment_observation'
-                ? `Imported as an observation made by ${document.source.name}; this browser session did not collect or independently verify it.`
-                : `Reported by ${document.source.name}; WHOISleuth did not collect or independently verify this provider finding.`,
-            ...(document.source.reference ? [`Source reference: ${document.source.reference}`] : []),
-            ...finding.limitations,
-        ];
-        const existingPinIds = new Set(target.evidencePins.map((pin) => pin.id));
-        const updated = updateCase(cases, target.id, {
-            evidencePin: {
-                ...structuredPinFields(finding),
-                label: `External ${finding.category} finding`,
-                value: finding.structuredObservation?.value ?? pinValue(finding),
-                source: importedSourceLabel(finding, document.source.name),
-                observedAt: finding.observedAt,
-                completeness: finding.completeness,
-                limitations: sourceLimitations,
-            },
-        }, now);
-        cases = updated.cases;
-        const addedPin = updated.record.evidencePins.find((pin) => !existingPinIds.has(pin.id)) ?? null;
-        if (addedPin) {
-            cases = updateCase(cases, updated.record.id, {
-                sighting: {
-                    state: finding.evidenceClass === 'deployment_observation'
-                        ? 'observed_by_deployment'
-                        : 'reported_by_provider',
-                    category: finding.category === 'dns'
-                        ? 'delegation'
-                        : finding.category === 'certificate'
-                            ? 'certificate'
-                            : finding.category === 'registration'
-                                ? 'registration'
-                                : finding.category === 'http' || finding.category === 'page'
-                                    ? 'website'
-                                    : 'other',
-                    source: document.source.name,
-                    observedAt: finding.observedAt,
-                    completeness: finding.completeness,
-                    evidencePinId: addedPin.id,
-                    limitations: sourceLimitations,
-                },
-            }, now).cases;
-        }
         findingsAdded += 1;
         if (existing)
             updatedDomains.add(finding.domain);
@@ -384,3 +395,60 @@ export function mergeExternalFindingsIntoCases(current, document, now = new Date
         duplicatesSkipped,
     };
 }
+function targetedFinding(finding, caseDomain) {
+    if (finding.domain === caseDomain)
+        return finding;
+    const prefix = `Captured hostname ${finding.domain}. `;
+    const maximumSummaryLength = 900;
+    const remaining = maximumSummaryLength - prefix.length;
+    const summary = remaining > 1 && finding.summary.length > remaining
+        ? `${prefix}${finding.summary.slice(0, remaining - 1).trimEnd()}…`
+        : `${prefix}${finding.summary}`;
+    return { ...finding, domain: caseDomain, summary };
+}
+export function externalFindingsCaseTargets(document, caseDomain) {
+    if (canonicalRegistrableDomain(caseDomain) !== caseDomain) {
+        throw new Error('The selected Case does not have a canonical registrable-domain identity.');
+    }
+    const targets = new Set();
+    for (const finding of document.findings) {
+        if (canonicalRegistrableDomain(finding.domain) !== caseDomain) {
+            throw new Error(`The imported finding for ${finding.domain} does not belong to the selected Case for ${caseDomain}.`);
+        }
+        targets.add(finding.domain);
+    }
+    return Object.freeze([...targets]);
+}
+/**
+ * Merges already-validated external findings into one selected Case. A Case is
+ * keyed to its registrable domain, while rendered captures may retain an exact
+ * hostname. Only same-domain findings are accepted, the exact hostname remains
+ * explicit in the retained evidence, and this operation can never open another
+ * Case as a side effect.
+ */
+export function mergeExternalFindingsIntoCase(current, caseId, document, now = new Date().toISOString()) {
+    const selected = current.find((candidate) => candidate.id === caseId) ?? null;
+    if (!selected)
+        throw new Error('Select an existing Case before importing rendered-capture evidence.');
+    externalFindingsCaseTargets(document, selected.domain);
+    let cases = [...current];
+    let record = selected;
+    let findingsAdded = 0;
+    let duplicatesSkipped = 0;
+    for (const original of document.findings) {
+        const finding = targetedFinding(original, selected.domain);
+        const merged = mergeExternalFindingIntoCase(cases, selected.id, finding, document.source, now);
+        cases = merged.cases;
+        record = merged.record;
+        if (merged.added)
+            findingsAdded += 1;
+        else
+            duplicatesSkipped += 1;
+    }
+    return {
+        cases,
+        record,
+        findingsAdded,
+        duplicatesSkipped,
+    };
+}

package/packages/investigation/evidence-coverage-ledger.mjs

@@ -149,6 +149,9 @@ export function buildLookupEvidenceCoverageLedger(input) {
     const rdapDiagnostic = record(diagnostics.rdap);
     const whoisDiagnostic = record(diagnostics.whois);
     const registrarRdap = record(input.registrarRdap);
+    const registrarStanding = record(input.registrarStanding);
+    const registrarStandingAccreditation = record(registrarStanding.accreditation);
+    const registrarStandingCompliance = record(registrarStanding.compliance);
     const reverseDns = record(input.reverseDns);
     const observedNetworkContext = record(input.observedNetworkContext);
     const dnsEvidence = record(input.dnsEvidence);
@@ -199,6 +202,24 @@ export function buildLookupEvidenceCoverageLedger(input) {
             limitations: stringList(registrarRdap.limitations),
         });
     }
+    if (registrarStanding.version === 1) {
+        const health = [registrarStandingAccreditation.sourceHealth, registrarStandingCompliance.sourceHealth];
+        items.push({
+            id: 'registrar-standing',
+            label: 'Registrar standing',
+            category: 'registry',
+            status: health.includes('unavailable')
+                ? 'unavailable'
+                : health.includes('stale')
+                    ? 'partial'
+                    : registrarStandingAccreditation.state === 'unknown'
+                        ? 'unknown'
+                        : 'complete',
+            complete: health.every((state) => state === 'current'),
+            truncated: registrarStandingCompliance.truncated,
+            limitations: stringList(registrarStanding.limitations),
+        });
+    }
     if (reverseDns.source === 'reverse_dns' || record(diagnostics.reverseDns).status) {
         items.push({
             id: 'reverse-dns',

package/packages/investigation/lookup-claim-readiness.mjs

@@ -239,8 +239,8 @@ export function buildLookupClaimReadiness(input) {
                     requirement('http-observation', coverage),
                     requirement('page-identity-observation', coverage),
                     requirement('reviewed-case-recipient', coverage, {
-                        state: input.hasCaseSection === true && (input.responseRecipientCount ?? 0) > 0 ? 'complete' : 'unknown',
-                        ...(input.hasCaseSection === true && (input.responseRecipientCount ?? 0) > 0
+                        state: input.hasReviewedCaseRecipient === true ? 'complete' : 'unknown',
+                        ...(input.hasReviewedCaseRecipient === true
                             ? {}
                             : { limitation: 'A reviewed case and recipient route are not both available.' }),
                     }),

package/packages/workspace/website-snapshot-model.mjs

@@ -7,6 +7,9 @@ const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const DIGEST_RE = /^[a-f0-9]{16,128}$/iu;
 const SHA256_RE = /^[a-f0-9]{64}$/iu;
 const SERIAL_RE = /^[a-f0-9]{1,128}$/iu;
+const SNAPSHOT_TECHNOLOGY_ROLES = new Set([
+    'observed_edge', 'application_platform', 'framework_runtime', 'embedded_dependency',
+]);
 function record(value) {
     return ordinaryWorkspaceRecord(value, 'Website-snapshot input');
 }
@@ -47,7 +50,45 @@ function technology(value) {
     const name = text(item?.name, 120);
     if (!id || !name)
         return null;
-    return { id, name, category: text(item?.category, 80) || 'technology', confidence: text(item?.confidence, 40) || 'unknown' };
+    const roles = values(item?.roles, 4, (role) => {
+        const normalized = text(role, 40);
+        return SNAPSHOT_TECHNOLOGY_ROLES.has(normalized) ? normalized : null;
+    });
+    return {
+        id,
+        name,
+        category: text(item?.category, 80) || 'technology',
+        confidence: text(item?.confidence, 40) || 'unknown',
+        roles,
+    };
+}
+function profileVersion(value) {
+    return Number.isSafeInteger(value) && Number(value) > 0 && Number(value) <= 10_000
+        ? Number(value)
+        : null;
+}
+function profileProvenance(value, legacy = false) {
+    if (legacy) {
+        return {
+            technology: { version: null, state: 'legacy_unknown' },
+            securityPosture: { version: null, state: 'legacy_unknown' },
+        };
+    }
+    const item = record(value);
+    const technologyItem = record(item?.technology);
+    const securityPostureItem = record(item?.securityPosture);
+    const technologyVersion = profileVersion(technologyItem?.version);
+    const securityPostureVersion = profileVersion(securityPostureItem?.version);
+    return {
+        technology: {
+            version: technologyVersion,
+            state: technologyVersion === null ? 'legacy_unknown' : 'known',
+        },
+        securityPosture: {
+            version: securityPostureVersion,
+            state: securityPostureVersion === null ? 'legacy_unknown' : 'known',
+        },
+    };
 }
 function posture(value) {
     const item = record(value);
@@ -154,7 +195,7 @@ function identityValues(value) {
     const formActionOrigins = values(item?.formActionOrigins, 20, origin);
     return { resourceHosts, trackingIdentifiers, formActionOrigins };
 }
-export function normalizeWebsiteProfileSnapshot(raw) {
+export function normalizeWebsiteProfileSnapshot(raw, sourceVersion) {
     const value = record(raw);
     const domain = normalizeDomain(value?.domain);
     const observedAt = timestamp(value?.observedAt);
@@ -169,6 +210,7 @@ export function normalizeWebsiteProfileSnapshot(raw) {
         savedAt,
         complete: value?.complete === true,
         truncated: value?.truncated === true,
+        profileProvenance: profileProvenance(value?.profileProvenance, sourceVersion === 4),
         technologies: values(value?.technologies, 40, technology),
         posture: values(value?.posture, 40, posture),
         identity: identity(value?.identity),
@@ -192,7 +234,10 @@ export function normalizeWebsiteSnapshotStore(raw) {
         throw new Error('This website-snapshot collection uses an unsupported schema and cannot be read safely.');
     }
     const sourceValues = Array.isArray(raw) ? raw : Array.isArray(value?.snapshots) ? value.snapshots : [];
-    const snapshots = values(sourceValues, MAX_WEBSITE_SNAPSHOTS * 2, (candidate) => normalizeWebsiteProfileSnapshot(candidate));
+    const sourceVersion = value?.schema === WEBSITE_SNAPSHOT_SCHEMA && Number.isSafeInteger(value.version)
+        ? Number(value.version)
+        : undefined;
+    const snapshots = values(sourceValues, MAX_WEBSITE_SNAPSHOTS * 2, (candidate) => normalizeWebsiteProfileSnapshot(candidate, sourceVersion));
     const perDomain = new Map();
     const retained = [];
     for (const snapshot of snapshots.sort((left, right) => right.savedAt.localeCompare(left.savedAt))) {
@@ -272,9 +317,29 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
             dependencyTransitions: [],
         };
     }
+    const technologyVersionBefore = before.profileProvenance.technology.version;
+    const technologyVersionAfter = after.profileProvenance.technology.version;
+    const postureVersionBefore = before.profileProvenance.securityPosture.version;
+    const postureVersionAfter = after.profileProvenance.securityPosture.version;
+    const technologyComparability = technologyVersionBefore === null || technologyVersionAfter === null
+        ? 'legacy_unknown'
+        : technologyVersionBefore === technologyVersionAfter ? 'comparable' : 'detector_changed';
+    const postureComparability = postureVersionBefore === null || postureVersionAfter === null
+        ? 'legacy_unknown'
+        : postureVersionBefore === postureVersionAfter ? 'comparable' : 'detector_changed';
     const changes = [
-        ...compareMap('technology', new Map(before.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}`])), new Map(after.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}`]))),
-        ...compareMap('posture', new Map(before.posture.map((item) => [item.id, item.state])), new Map(after.posture.map((item) => [item.id, item.state]))),
+        ...(technologyComparability === 'comparable' ? compareMap('technology', new Map(before.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}|${item.roles.join(',')}`])), new Map(after.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}|${item.roles.join(',')}`]))) : [{
+                field: 'technology.profileVersion',
+                state: technologyComparability === 'detector_changed' ? 'changed' : 'incomparable',
+                before: technologyVersionBefore === null ? null : String(technologyVersionBefore),
+                after: technologyVersionAfter === null ? null : String(technologyVersionAfter),
+            }]),
+        ...(postureComparability === 'comparable' ? compareMap('posture', new Map(before.posture.map((item) => [item.id, item.state])), new Map(after.posture.map((item) => [item.id, item.state]))) : [{
+                field: 'posture.profileVersion',
+                state: postureComparability === 'detector_changed' ? 'changed' : 'incomparable',
+                before: postureVersionBefore === null ? null : String(postureVersionBefore),
+                after: postureVersionAfter === null ? null : String(postureVersionAfter),
+            }]),
         ...compareMap('source', new Map(before.sources.map((item) => [item.source, item.state])), new Map(after.sources.map((item) => [item.source, item.state]))),
         ...compareMap('dependency', new Map(before.dependencies.map((item) => [`${item.recordType}:${item.target}`, `${item.state}|${item.qualification}`])), new Map(after.dependencies.map((item) => [`${item.recordType}:${item.target}`, `${item.state}|${item.qualification}`]))),
     ];
@@ -358,5 +423,13 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
     if (before.complete !== after.complete || before.truncated !== after.truncated) {
         changes.push({ field: 'completeness', state: 'incomparable', before: `${before.complete}/${before.truncated}`, after: `${after.complete}/${after.truncated}` });
     }
-    return { compatible: true, changes, dependencyTransitions };
+    return {
+        compatible: true,
+        profileComparability: {
+            technology: technologyComparability,
+            securityPosture: postureComparability,
+        },
+        changes,
+        dependencyTransitions,
+    };
 }

package/third-party-notices.txt

@@ -713,7 +713,7 @@ MIT License
     OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     SOFTWARE
 ================================================================================
-undici@8.10.0
+undici@8.10.1
 Relationship: direct production dependency
 Declared licence: MIT
 Licence source: LICENSE