@slicedearth/whoisleuth-cli 2.2.0 → 2.3.0

package/packages/workspace/brand-profile-model.mjs

@@ -7,8 +7,8 @@ import { normalizeOpaqueReferenceId } from "../cases/opaque-reference-id.mjs";
 import { normalizePageBaseline } from "./page-baseline.mjs";
 import { isInformativePerceptualHash as isInformativeFaviconHash } from "../../lib/perceptual-hash-comparison.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
-import { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
-export { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
+import { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_OFFICIAL_CHANNELS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_URL_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, MAX_RIGHTS_REFERENCES, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
+export { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_OFFICIAL_CHANNELS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_URL_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, MAX_RIGHTS_REFERENCES, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
 const SHA256_RE = /^[a-f0-9]{64}$/i;
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
 const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -42,6 +42,17 @@ export const DESIRED_POSTURE_SUPPRESSION_FIELDS = Object.freeze([
 ]);
 const DESIRED_POSTURE_FIELDS = new Set(DESIRED_POSTURE_SUPPRESSION_FIELDS);
 const POSTURE_CHECK_STATUSES = new Set(['danger', 'info', 'pass', 'warning']);
+export const OFFICIAL_CHANNEL_PLATFORMS = [
+    'facebook',
+    'instagram',
+    'linkedin',
+    'telegram',
+    'tiktok',
+    'x',
+    'youtube',
+    'other',
+];
+export const RIGHTS_REFERENCE_KINDS = ['trademark', 'copyright', 'design', 'other'];
 function record(value) {
     return ordinaryWorkspaceRecord(value, 'Brand Profile input') ?? {};
 }
@@ -333,6 +344,82 @@ function normalizeFaviconHash(value) {
 function normalizeFaviconPHash(value) {
     return typeof value === 'string' && isInformativeFaviconHash(value) ? value.toLowerCase() : '';
 }
+function normalizePublicUrl(value) {
+    if (typeof value !== 'string' || CONTROL_RE.test(value) || value.length > MAX_PROFILE_URL_LENGTH * 2)
+        return '';
+    try {
+        const parsed = new URL(value.trim());
+        if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password)
+            return '';
+        const normalized = parsed.toString();
+        return normalized.length <= MAX_PROFILE_URL_LENGTH ? normalized : '';
+    }
+    catch {
+        return '';
+    }
+}
+function normalizeOfficialChannels(value) {
+    if (!Array.isArray(value))
+        return [];
+    const output = new Map();
+    for (const candidate of value.slice(0, MAX_OFFICIAL_CHANNELS * 4)) {
+        const item = record(candidate);
+        const platform = typeof item.platform === 'string'
+            && OFFICIAL_CHANNEL_PLATFORMS.includes(item.platform)
+            ? item.platform
+            : null;
+        const url = normalizePublicUrl(item.url);
+        if (!platform || !url)
+            continue;
+        const key = url.toLowerCase();
+        if (output.has(key))
+            continue;
+        output.set(key, {
+            platform,
+            url,
+            handle: boundedText(item.handle),
+            role: boundedText(item.role),
+            reviewedAt: timestamp(item.reviewedAt, null),
+        });
+        if (output.size >= MAX_OFFICIAL_CHANNELS)
+            break;
+    }
+    return [...output.values()];
+}
+function normalizeRightsReferences(value) {
+    if (!Array.isArray(value))
+        return [];
+    const output = new Map();
+    for (const candidate of value.slice(0, MAX_RIGHTS_REFERENCES * 4)) {
+        const item = record(candidate);
+        const kind = typeof item.kind === 'string' && RIGHTS_REFERENCE_KINDS.includes(item.kind)
+            ? item.kind
+            : null;
+        const owner = boundedText(item.owner);
+        const identifier = boundedText(item.identifier);
+        if (!kind || (!owner && !identifier))
+            continue;
+        const jurisdiction = boundedText(item.jurisdiction);
+        const sourceUrl = item.sourceUrl == null || item.sourceUrl === '' ? '' : normalizePublicUrl(item.sourceUrl);
+        if (item.sourceUrl && !sourceUrl)
+            continue;
+        const key = `${kind}\u0000${owner.toLowerCase()}\u0000${identifier.toLowerCase()}\u0000${jurisdiction.toLowerCase()}`;
+        if (output.has(key))
+            continue;
+        output.set(key, {
+            kind,
+            owner,
+            identifier,
+            jurisdiction,
+            sourceUrl,
+            reviewedAt: timestamp(item.reviewedAt, null),
+            note: boundedText(item.note),
+        });
+        if (output.size >= MAX_RIGHTS_REFERENCES)
+            break;
+    }
+    return [...output.values()];
+}
 /** Normalize one profile while retaining only known, bounded fields. */
 export function normalizeBrandProfile(raw, options = {}) {
     const value = record(raw);
@@ -360,6 +447,7 @@ export function normalizeBrandProfile(raw, options = {}) {
         id: profileId,
         name,
         officialDomains,
+        officialChannels: normalizeOfficialChannels(value.officialChannels),
         productNames: normalizeProfileTextValues(value.productNames),
         tlds: normalizeProfileTlds(value.tlds),
         approvedPartnerDomains: normalizeProfileDomains(value.approvedPartnerDomains),
@@ -373,6 +461,7 @@ export function normalizeBrandProfile(raw, options = {}) {
         desiredPostureBaselines: normalizeDesiredPostureBaselines(value.desiredPostureBaselines, officialDomains, now, profileId),
         trademarkOwner: boundedText(value.trademarkOwner),
         trademarkRegistration: boundedText(value.trademarkRegistration),
+        rightsReferences: normalizeRightsReferences(value.rightsReferences),
         officialFaviconHash: baselineDomainMismatch ? '' : normalizeFaviconHash(value.officialFaviconHash),
         officialFaviconPHash: baselineDomainMismatch ? '' : normalizeFaviconPHash(value.officialFaviconPHash),
         pageBaseline,
@@ -380,6 +469,33 @@ export function normalizeBrandProfile(raw, options = {}) {
         updatedAt: options.touch === true ? now : timestamp(value.updatedAt, createdAt),
     };
 }
+const BRAND_PROFILE_FIELD_PATCH_KEYS = Object.freeze([
+    'allowlistedDomains',
+    'allowlistedRegistrars',
+    'desiredPostureBaselines',
+    'protectionAttestations',
+]);
+/**
+ * Applies one field-owned edit to the transaction-current profile. Identity,
+ * timestamps, and every field outside the explicit patch remain owned by that
+ * current record rather than by the caller's potentially stale snapshot.
+ */
+export function applyBrandProfileFieldPatch(existing, patch, options = {}) {
+    const merged = { ...existing };
+    const supplied = patch;
+    for (const key of BRAND_PROFILE_FIELD_PATCH_KEYS) {
+        if (Object.hasOwn(supplied, key))
+            merged[key] = supplied[key];
+    }
+    const normalized = normalizeBrandProfile(merged, {
+        existing,
+        nowIso: options.nowIso,
+        touch: true,
+    });
+    if (!normalized)
+        throw new Error('The Brand Profile field update is invalid.');
+    return normalized;
+}
 function profileList(raw) {
     if (Array.isArray(raw))
         return raw;

package/packages/workspace/bulk-review-model.mjs

@@ -1,21 +1,27 @@
 import { normalizeDomain } from "../cases/case-model.mjs";
+import { CASE_DISPOSITIONS as CASE_DISPOSITION_OPTIONS } from "../cases/case-record-contracts.mjs";
 import { normalizeBulkPresentationSortKey } from "./bulk-sort.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, MAX_BULK_REVIEW_NAME_LENGTH, MAX_BULK_REVIEW_PRESETS, MAX_BULK_REVIEW_ROWS, MAX_BULK_REVIEW_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
 export { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, MAX_BULK_REVIEW_NAME_LENGTH, MAX_BULK_REVIEW_PRESETS, MAX_BULK_REVIEW_ROWS, MAX_BULK_REVIEW_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
 export const BULK_REVIEW_STATES = ['unreviewed', 'reviewing', 'reviewed', 'deferred'];
+export const BULK_SOURCE_FILTERS = ['', 'complete', 'limited', 'unrecorded'];
+export const BULK_LIFECYCLE_FILTERS = ['', 'registered', 'for_sale', 'expiring', 'available', 'unknown', 'error'];
+export const BULK_AGE_FILTERS = ['', 'new_30', 'new_365', 'older_365', 'unknown'];
+export const BULK_MAIL_FILTERS = ['', 'mail', 'no_mail', 'authenticated', 'auth_gap', 'unknown'];
+export const BULK_GROUP_OPTIONS = ['', 'mutation', 'tld', 'registrar', 'nameserver'];
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
 const PRIMARY_FILTERS = new Set(['all', 'available', 'registered', 'high_risk', 'trusted', 'profile_unevaluated', 'errors']);
-const SOURCE_FILTERS = new Set(['', 'complete', 'limited', 'failed']);
-const LIFECYCLE_FILTERS = new Set(['', 'new', 'expiring', 'aged', 'unknown']);
-const AGE_FILTERS = new Set(['', '7d', '30d', '90d', '365d', 'older', 'unknown']);
-const MAIL_FILTERS = new Set(['', 'mx', 'no_mx', 'spf_missing', 'dmarc_missing', 'unknown']);
-const GROUPS = new Set(['', 'registrar', 'nameserver', 'source_state', 'lifecycle', 'mail']);
-const SORT_KEYS = new Set(['domain', 'availability', 'risk', 'opportunity', 'activity', 'registrar', 'mutation']);
+const SOURCE_FILTERS = new Set(BULK_SOURCE_FILTERS);
+const LIFECYCLE_FILTERS = new Set(BULK_LIFECYCLE_FILTERS);
+const AGE_FILTERS = new Set(BULK_AGE_FILTERS);
+const MAIL_FILTERS = new Set(BULK_MAIL_FILTERS);
+const GROUPS = new Set(BULK_GROUP_OPTIONS);
+const SORT_KEYS = new Set(['domain', 'availability', 'confidence', 'risk', 'opportunity', 'activity', 'registrar', 'mutation']);
 const REVIEW_STATES = new Set(BULK_REVIEW_STATES);
-const CASE_DISPOSITIONS = new Set(['', 'untracked', 'unreviewed', 'suspicious', 'confirmed_abuse', 'false_positive', 'expected', 'closed_no_action']);
+const CASE_DISPOSITIONS = new Set(['', 'untracked', ...CASE_DISPOSITION_OPTIONS.map((item) => item.value)]);
 const SIGNAL_FILTERS = new Set(['favicon', 'password', 'phishing', 'asset_reuse', 'idn']);
 function record(value) {
     return ordinaryWorkspaceRecord(value, 'Bulk-review input') ?? {};

package/packages/workspace/bulk-session-model.mjs

@@ -488,10 +488,11 @@ export function deleteBulkSession(raw, idRaw) {
 function sourceStateMap(value) {
     return new Map(value.sourceCoverage.map((item) => [item.source, item.state]));
 }
-function comparableRisk(previous, current) {
+export function areBulkRiskScoresComparable(previous, current) {
     return previous.profileContext.sourceState === 'ready'
         && current.profileContext.sourceState === 'ready'
         && sameProfileContext(previous.profileContext, current.profileContext)
+        && previous.scanDepth === current.scanDepth
         && previous.risk !== null
         && current.risk !== null
         && previous.riskModelVersion !== null
@@ -501,7 +502,7 @@ function resultChanges(previous, current) {
     const changes = [];
     if (previous.availability !== current.availability)
         changes.push(`Registration: ${previous.availability} → ${current.availability}`);
-    if (comparableRisk(previous, current) && previous.risk !== current.risk) {
+    if (areBulkRiskScoresComparable(previous, current) && previous.risk !== current.risk) {
         changes.push(`Risk: ${previous.risk ?? 'unavailable'} → ${current.risk ?? 'unavailable'}`);
     }
     if (previous.registrar !== current.registrar)
@@ -554,7 +555,7 @@ export function compareBulkSessions(baselineRaw, currentRaw) {
             rows.push({ domain, changes: ['Absent from the later settled result set.'] });
         }
         else {
-            if (!comparableRisk(previous, next))
+            if (!areBulkRiskScoresComparable(previous, next))
                 riskIncomparable = true;
             const changes = resultChanges(previous, next);
             if (changes.length)
@@ -576,7 +577,7 @@ export function compareBulkSessions(baselineRaw, currentRaw) {
             'A source-state change may reflect collection availability rather than a change to the domain.',
             'A missing row means it was not completed in that saved session; it does not establish domain removal.',
             ...(riskIncomparable
-                ? ['Risk deltas are omitted unless both rows retain the same ready Brand Profile provenance and the same versioned Risk model.']
+                ? ['Risk deltas are omitted unless both rows retain the same ready Brand Profile provenance, scan depth, and versioned Risk model.']
                 : []),
         ],
     };

package/packages/workspace/detection-rule-model.mjs

@@ -2,6 +2,7 @@
 // small structured language: field names and operators come from allowlists,
 // so imported rules cannot execute code or reach outside bounded case evidence.
 import { latestCaseEvidence } from "../cases/case-model.mjs";
+import { CASE_DISPOSITIONS, CASE_STATUSES } from "../cases/case-record-contracts.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { DETECTION_RULE_SCHEMA, DETECTION_RULE_SCHEMA_VERSION, MAX_CONDITION_VALUE_LENGTH, MAX_CUSTOM_RISK_TOTAL, MAX_DETECTION_RULES, MAX_RULE_CONDITIONS, MAX_RULE_INPUT_RECORDS, MAX_RULE_NAME_LENGTH, MAX_RULE_RISK_DELTA, MAX_RULE_STORE_BYTES, MAX_RULE_TAG_LENGTH, } from "../contracts/workspace-portability.mjs";
 export { DETECTION_RULE_SCHEMA, DETECTION_RULE_SCHEMA_VERSION, MAX_CONDITION_VALUE_LENGTH, MAX_CUSTOM_RISK_TOTAL, MAX_DETECTION_RULES, MAX_RULE_CONDITIONS, MAX_RULE_IMPORT_BYTES, MAX_RULE_INPUT_RECORDS, MAX_RULE_NAME_LENGTH, MAX_RULE_RISK_DELTA, MAX_RULE_STORE_BYTES, MAX_RULE_TAG_LENGTH, } from "../contracts/workspace-portability.mjs";
@@ -26,8 +27,8 @@ export const RULE_FIELD_DEFINITIONS = Object.freeze([
     { value: 'mutationTypes', label: 'Mutation type', kind: 'list' },
     { value: 'nameservers', label: 'Nameserver', kind: 'list' },
     { value: 'httpSecurityHeaders', label: 'HTTP security header', kind: 'list' },
-    { value: 'status', label: 'Case status', kind: 'enum', values: ['new', 'investigating', 'monitoring', 'escalated', 'closed'] },
-    { value: 'disposition', label: 'Case disposition', kind: 'enum', values: ['unreviewed', 'benign', 'suspicious', 'confirmed_abuse', 'false_positive'] },
+    { value: 'status', label: 'Case status', kind: 'enum', values: CASE_STATUSES.map((item) => item.value) },
+    { value: 'disposition', label: 'Case disposition', kind: 'enum', values: CASE_DISPOSITIONS.map((item) => item.value) },
     { value: 'tags', label: 'Case tag', kind: 'list' },
 ]);
 const FIELD_BY_VALUE = new Map(RULE_FIELD_DEFINITIONS.map((field) => [field.value, field]));
@@ -103,13 +104,14 @@ export function normalizeDetectionRule(raw, { generateId = false } = {}) {
         return null;
     const conditions = [];
     const rawConditions = Array.isArray(item.conditions) ? item.conditions : [];
-    for (const item of rawConditions.slice(0, MAX_RULE_CONDITIONS)) {
-        const condition = normalizeRuleCondition(item);
-        if (condition)
-            conditions.push(condition);
-    }
-    if (!conditions.length)
+    if (!rawConditions.length || rawConditions.length > MAX_RULE_CONDITIONS)
         return null;
+    for (const rawCondition of rawConditions) {
+        const condition = normalizeRuleCondition(rawCondition);
+        if (!condition)
+            return null;
+        conditions.push(condition);
+    }
     const riskDelta = normalizeInteger(item.riskDelta, 0, MAX_RULE_RISK_DELTA);
     return {
         id: safeId(item.id) || (generateId ? makeId() : null),
@@ -121,6 +123,30 @@ export function normalizeDetectionRule(raw, { generateId = false } = {}) {
         tag: normalizedText(item.tag, MAX_RULE_TAG_LENGTH).toLowerCase(),
     };
 }
+function validateDetectionRule(raw, { generateId = false } = {}) {
+    const item = record(raw);
+    if (!Array.isArray(item.conditions) || !item.conditions.length) {
+        throw new Error('A custom rule needs at least one condition.');
+    }
+    if (item.conditions.length > MAX_RULE_CONDITIONS) {
+        throw new Error(`Custom rules are limited to ${MAX_RULE_CONDITIONS} conditions.`);
+    }
+    for (const [index, condition] of item.conditions.entries()) {
+        if (!normalizeRuleCondition(condition)) {
+            throw new Error(`Condition ${index + 1} is invalid or outside the allowed bounds.`);
+        }
+    }
+    if (item.match !== undefined && item.match !== 'all' && item.match !== 'any') {
+        throw new Error('Choose whether all or any conditions must match.');
+    }
+    if (item.riskDelta !== undefined && normalizeInteger(item.riskDelta, 0, MAX_RULE_RISK_DELTA) === null) {
+        throw new Error(`Custom contribution must be a whole number from 0 to ${MAX_RULE_RISK_DELTA}.`);
+    }
+    const normalized = normalizeDetectionRule(item, { generateId });
+    if (!normalized)
+        throw new Error('Enter a rule name and valid conditions.');
+    return normalized;
+}
 function ruleList(raw) {
     if (Array.isArray(raw))
         return raw;
@@ -133,23 +159,32 @@ export function detectionRuleStoreVersion(raw) {
     const item = record(raw);
     return typeof item.version === 'number' && Number.isFinite(item.version) ? item.version : null;
 }
-export function normalizeDetectionRuleStore(raw) {
+export function recoverDetectionRuleStore(raw) {
     assertWorkspaceInputGraph(raw, 'Detection-rule store');
     assertWorkspaceDeclaredVersion(raw, 'Detection-rule store');
     const byId = new Map();
-    for (const item of ruleList(raw).slice(0, MAX_RULE_INPUT_RECORDS)) {
+    const source = ruleList(raw);
+    let rejected = Math.max(0, source.length - MAX_RULE_INPUT_RECORDS);
+    for (const item of source.slice(0, MAX_RULE_INPUT_RECORDS)) {
         const rule = normalizeDetectionRule(item);
-        if (!rule?.id || byId.has(rule.id))
+        if (!rule?.id || byId.has(rule.id)) {
+            rejected += 1;
             continue;
+        }
+        if (byId.size >= MAX_DETECTION_RULES) {
+            rejected += 1;
+            continue;
+        }
         byId.set(rule.id, { ...rule, id: rule.id });
-        if (byId.size >= MAX_DETECTION_RULES)
-            break;
     }
-    return { version: DETECTION_RULE_SCHEMA_VERSION, rules: [...byId.values()] };
+    return { store: { version: DETECTION_RULE_SCHEMA_VERSION, rules: [...byId.values()] }, rejected };
+}
+export function normalizeDetectionRuleStore(raw) {
+    return recoverDetectionRuleStore(raw).store;
 }
 export function createDetectionRule(rules, input) {
-    const normalized = normalizeDetectionRule(input, { generateId: true });
-    if (!normalized?.id)
+    const normalized = validateDetectionRule(input, { generateId: true });
+    if (!normalized.id)
         throw new Error('Enter a rule name and one valid condition.');
     const existing = normalizeDetectionRuleStore(rules).rules;
     if (existing.length >= MAX_DETECTION_RULES)
@@ -162,8 +197,8 @@ export function updateDetectionRule(rules, id, patch) {
     const current = normalizedRules.find((rule) => rule.id === id);
     if (!current)
         throw new Error('That custom rule no longer exists.');
-    const updated = normalizeDetectionRule({ ...current, ...record(patch), id });
-    if (!updated?.id)
+    const updated = validateDetectionRule({ ...current, ...record(patch), id });
+    if (!updated.id)
         throw new Error('A custom rule needs a name and at least one valid condition.');
     return normalizeDetectionRuleStore(normalizedRules.map((rule) => rule.id === id ? updated : rule)).rules;
 }
@@ -245,8 +280,14 @@ function ruleSignature(rule) {
     });
 }
 export function previewDetectionRule(records, existingRules, rawCandidate) {
-    const normalized = normalizeDetectionRule({ ...record(rawCandidate), id: 'preview-rule', enabled: true });
-    if (!normalized?.id)
+    let normalized;
+    try {
+        normalized = validateDetectionRule({ ...record(rawCandidate), id: 'preview-rule', enabled: true });
+    }
+    catch {
+        return null;
+    }
+    if (!normalized.id)
         return null;
     const candidate = { ...normalized, id: normalized.id };
     const sourceRecords = Array.isArray(records) ? records.slice(0, 500) : [];
@@ -295,8 +336,15 @@ export function mergeDetectionRules(localRaw, importedRaw) {
     let updated = 0;
     let skipped = Math.max(0, importedList.length - MAX_RULE_INPUT_RECORDS);
     for (const item of importedList.slice(0, MAX_RULE_INPUT_RECORDS)) {
-        const rule = normalizeDetectionRule(item);
-        if (!rule?.id) {
+        let rule;
+        try {
+            rule = validateDetectionRule(item);
+        }
+        catch {
+            skipped++;
+            continue;
+        }
+        if (!rule.id) {
             skipped++;
             continue;
         }

package/packages/workspace/relationship-observation-model.mjs

@@ -283,8 +283,11 @@ export function createRelationshipObservation(raw, options = {}) {
         throw new Error('That relationship does not contain a supported bounded value and at least one valid domain.');
     }
     const now = new Date().toISOString();
-    const observedAt = timestamp(options.observedAt) || now;
+    const observedAt = Object.hasOwn(options, 'observedAt') ? timestamp(options.observedAt) : now;
     const retainedAt = timestamp(options.retainedAt) || now;
+    if (!observedAt) {
+        throw new Error('A relationship observation needs the contributing scan observation time; an unknown time is not replaced with the retention time.');
+    }
     const canonical = canonicalIdentity(type, normalizedValue, domains);
     const metadata = TYPE_METADATA[type];
     return {

package/packages/workspace/website-snapshot-model.mjs

@@ -296,14 +296,89 @@ export function mergeWebsiteSnapshots(localRaw, incomingRaw) {
     const snapshots = normalizeWebsiteSnapshotStore([...byId.values()]).snapshots;
     return { snapshots, added, updated, skipped: Math.max(0, incoming.length - added - updated) };
 }
-function compareMap(field, before, after) {
+const MAX_RECONCILED_WEBSITE_SOURCES = 16;
+const UNAVAILABLE_WEBSITE_SOURCE_STATES = new Set([
+    'blocked', 'error', 'not_found', 'rate_limited', 'unavailable', 'unsupported',
+]);
+export function canonicalWebsiteSourceState(value) {
+    return value.trim().toLowerCase().replace(/[\s-]+/gu, '_');
+}
+function websiteSourceStateSeverity(value) {
+    if (UNAVAILABLE_WEBSITE_SOURCE_STATES.has(value))
+        return 2;
+    return ['complete', 'success'].includes(value) ? 0 : 1;
+}
+export function reconciledWebsiteSources(snapshot) {
+    const selected = new Map();
+    for (const sourceEntry of snapshot.sources.slice(0, MAX_RECONCILED_WEBSITE_SOURCES)) {
+        const sourceId = sourceEntry.source.trim().toLowerCase();
+        if (!sourceId)
+            continue;
+        const state = canonicalWebsiteSourceState(sourceEntry.state);
+        const severity = websiteSourceStateSeverity(state);
+        const current = selected.get(sourceId);
+        if (!current || severity > current.severity || (severity === current.severity && state.localeCompare(current.state) < 0)) {
+            selected.set(sourceId, { state, severity });
+        }
+    }
+    return [...selected.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([sourceName, value]) => ({ source: sourceName, state: value.state }));
+}
+export function websiteWithReconciledSources(snapshot) {
+    return { ...snapshot, sources: reconciledWebsiteSources(snapshot) };
+}
+export function reconciledWebsiteSourceState(snapshot, sourceId) {
+    const canonicalId = sourceId.trim().toLowerCase();
+    return reconciledWebsiteSources(snapshot)
+        .find((sourceEntry) => sourceEntry.source === canonicalId)?.state ?? null;
+}
+function completeWebsiteSourceState(value) {
+    const state = canonicalWebsiteSourceState(value);
+    return state === 'complete' || state === 'success';
+}
+export function websiteSnapshotFieldSource(field) {
+    if (field.startsWith('certificate.'))
+        return 'tls';
+    if (field.startsWith('source.'))
+        return field.slice('source.'.length);
+    if (field.startsWith('dependency.')) {
+        const recordType = field.slice('dependency.'.length).split(':')[0];
+        return recordType === 'HTTP' ? 'http' : 'dns';
+    }
+    if (['technology', 'posture', 'identity'].some((family) => field.startsWith(family)))
+        return 'http';
+    return '';
+}
+export function websiteSnapshotFieldComplete(snapshot, field) {
+    const sourceName = websiteSnapshotFieldSource(field);
+    const retainedSource = sourceName ? reconciledWebsiteSourceState(snapshot, sourceName) : null;
+    const retainedSourceComplete = !retainedSource || completeWebsiteSourceState(retainedSource);
+    if (field.startsWith('certificate.')) {
+        return Boolean(snapshot.certificate?.complete && !snapshot.certificate.truncated && retainedSourceComplete);
+    }
+    return snapshot.complete && !snapshot.truncated && retainedSourceComplete;
+}
+export function websiteSnapshotComparisonEvidenceComplete(snapshot) {
+    return websiteSnapshotFieldComplete(snapshot, 'technology')
+        && websiteSnapshotFieldComplete(snapshot, 'posture')
+        && websiteSnapshotFieldComplete(snapshot, 'identity')
+        && websiteSnapshotFieldComplete(snapshot, 'dependency.CNAME')
+        && (!snapshot.certificate || websiteSnapshotFieldComplete(snapshot, 'certificate.observation'));
+}
+function compareMap(field, before, after, options = {}) {
     const changes = [];
     for (const key of [...new Set([...before.keys(), ...after.keys()])].sort()) {
         const left = before.get(key) ?? null;
         const right = after.get(key) ?? null;
         if (left === right)
             continue;
-        changes.push({ field: `${field}.${key}`, state: left === null ? 'added' : right === null ? 'removed' : 'changed', before: left, after: right });
+        const state = left === null
+            ? options.beforeComplete?.(key) === false ? 'incomparable' : 'added'
+            : right === null
+                ? options.afterComplete?.(key) === false ? 'incomparable' : 'removed'
+                : 'changed';
+        changes.push({ field: `${field}.${key}`, state, before: left, after: right });
     }
     return changes;
 }
@@ -313,6 +388,7 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
     if (!before || !after || before.domain !== after.domain) {
         return {
             compatible: false,
+            complete: false,
             changes: [{ field: 'snapshot', state: 'incomparable', before: before?.domain ?? null, after: after?.domain ?? null }],
             dependencyTransitions: [],
         };
@@ -328,20 +404,29 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
         ? 'legacy_unknown'
         : postureVersionBefore === postureVersionAfter ? 'comparable' : 'detector_changed';
     const changes = [
-        ...(technologyComparability === 'comparable' ? compareMap('technology', new Map(before.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}|${item.roles.join(',')}`])), new Map(after.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}|${item.roles.join(',')}`]))) : [{
+        ...(technologyComparability === 'comparable' ? compareMap('technology', new Map(before.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}|${item.roles.join(',')}`])), new Map(after.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}|${item.roles.join(',')}`])), {
+            beforeComplete: () => websiteSnapshotFieldComplete(before, 'technology'),
+            afterComplete: () => websiteSnapshotFieldComplete(after, 'technology'),
+        }) : [{
                 field: 'technology.profileVersion',
                 state: technologyComparability === 'detector_changed' ? 'changed' : 'incomparable',
                 before: technologyVersionBefore === null ? null : String(technologyVersionBefore),
                 after: technologyVersionAfter === null ? null : String(technologyVersionAfter),
             }]),
-        ...(postureComparability === 'comparable' ? compareMap('posture', new Map(before.posture.map((item) => [item.id, item.state])), new Map(after.posture.map((item) => [item.id, item.state]))) : [{
+        ...(postureComparability === 'comparable' ? compareMap('posture', new Map(before.posture.map((item) => [item.id, item.state])), new Map(after.posture.map((item) => [item.id, item.state])), {
+            beforeComplete: () => websiteSnapshotFieldComplete(before, 'posture'),
+            afterComplete: () => websiteSnapshotFieldComplete(after, 'posture'),
+        }) : [{
                 field: 'posture.profileVersion',
                 state: postureComparability === 'detector_changed' ? 'changed' : 'incomparable',
                 before: postureVersionBefore === null ? null : String(postureVersionBefore),
                 after: postureVersionAfter === null ? null : String(postureVersionAfter),
             }]),
         ...compareMap('source', new Map(before.sources.map((item) => [item.source, item.state])), new Map(after.sources.map((item) => [item.source, item.state]))),
-        ...compareMap('dependency', new Map(before.dependencies.map((item) => [`${item.recordType}:${item.target}`, `${item.state}|${item.qualification}`])), new Map(after.dependencies.map((item) => [`${item.recordType}:${item.target}`, `${item.state}|${item.qualification}`]))),
+        ...compareMap('dependency', new Map(before.dependencies.map((item) => [`${item.recordType}:${item.target}`, `${item.state}|${item.qualification}`])), new Map(after.dependencies.map((item) => [`${item.recordType}:${item.target}`, `${item.state}|${item.qualification}`])), {
+            beforeComplete: (key) => websiteSnapshotFieldComplete(before, `dependency.${key}`),
+            afterComplete: (key) => websiteSnapshotFieldComplete(after, `dependency.${key}`),
+        }),
     ];
     const dependencyTransitions = [];
     const beforeDependencies = new Map(before.dependencies.map((item) => [`${item.recordType}:${item.target}`, item]));
@@ -365,10 +450,10 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
                 detail: 'An earlier active dependency is unresolved in the later retained observation. Resolver or collection failure remains possible.',
             });
         }
-        else if (!left && right) {
+        else if (!left && right && websiteSnapshotFieldComplete(before, `dependency.${key}`)) {
             dependencyTransitions.push({ target: right.target, recordType: right.recordType, state: 'added', detail: 'This dependency first appears in the later retained snapshot.' });
         }
-        else if (left && !right && after.complete) {
+        else if (left && !right && websiteSnapshotFieldComplete(after, `dependency.${key}`)) {
             dependencyTransitions.push({ target: left.target, recordType: left.recordType, state: 'removed', detail: 'This dependency is not represented in the later complete snapshot. It may have been intentionally removed or replaced.' });
         }
         if (dependencyTransitions.length >= 20)
@@ -381,7 +466,16 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
             continue;
         changes.push({ field: `identity.${key}`, state: left === null || right === null ? 'unavailable' : 'changed', before: left, after: right });
     }
-    changes.push(...compareMap('identityValues.resourceHosts', new Map(before.identityValues.resourceHosts.map((item) => [item, item])), new Map(after.identityValues.resourceHosts.map((item) => [item, item]))), ...compareMap('identityValues.trackingIdentifiers', new Map(before.identityValues.trackingIdentifiers.map((item) => [`${item.type}:${item.value}`, item.value])), new Map(after.identityValues.trackingIdentifiers.map((item) => [`${item.type}:${item.value}`, item.value]))), ...compareMap('identityValues.formActionOrigins', new Map(before.identityValues.formActionOrigins.map((item) => [item, item])), new Map(after.identityValues.formActionOrigins.map((item) => [item, item]))));
+    changes.push(...compareMap('identityValues.resourceHosts', new Map(before.identityValues.resourceHosts.map((item) => [item, item])), new Map(after.identityValues.resourceHosts.map((item) => [item, item])), {
+        beforeComplete: () => websiteSnapshotFieldComplete(before, 'identityValues.resourceHosts'),
+        afterComplete: () => websiteSnapshotFieldComplete(after, 'identityValues.resourceHosts'),
+    }), ...compareMap('identityValues.trackingIdentifiers', new Map(before.identityValues.trackingIdentifiers.map((item) => [`${item.type}:${item.value}`, item.value])), new Map(after.identityValues.trackingIdentifiers.map((item) => [`${item.type}:${item.value}`, item.value])), {
+        beforeComplete: () => websiteSnapshotFieldComplete(before, 'identityValues.trackingIdentifiers'),
+        afterComplete: () => websiteSnapshotFieldComplete(after, 'identityValues.trackingIdentifiers'),
+    }), ...compareMap('identityValues.formActionOrigins', new Map(before.identityValues.formActionOrigins.map((item) => [item, item])), new Map(after.identityValues.formActionOrigins.map((item) => [item, item])), {
+        beforeComplete: () => websiteSnapshotFieldComplete(before, 'identityValues.formActionOrigins'),
+        afterComplete: () => websiteSnapshotFieldComplete(after, 'identityValues.formActionOrigins'),
+    }));
     if (before.certificate || after.certificate) {
         if (!before.certificate || !after.certificate) {
             changes.push({
@@ -425,6 +519,10 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
     }
     return {
         compatible: true,
+        complete: websiteSnapshotComparisonEvidenceComplete(before)
+            && websiteSnapshotComparisonEvidenceComplete(after)
+            && technologyComparability === 'comparable'
+            && postureComparability === 'comparable',
         profileComparability: {
             technology: technologyComparability,
             securityPosture: postureComparability,

package/packages/workspace/workspace-archive.mjs

@@ -528,6 +528,7 @@ export async function previewWorkspaceArchive(raw, localInput, options = {}) {
                 skipped: result.skipped ?? 0,
                 pruned: result.pruned ?? 0,
                 brandProfileReferencesOmitted: result.brandProfileReferencesOmitted ?? 0,
+                authoredHistoryOmitted: result.authoredHistoryOmitted ?? 0,
                 selected,
                 normalizedSettings: result.settings || null,
             });
@@ -567,6 +568,7 @@ export async function previewWorkspaceArchive(raw, localInput, options = {}) {
                 skipped: dependentSection.recordCount,
                 pruned: 0,
                 brandProfileReferencesOmitted: 0,
+                authoredHistoryOmitted: 0,
                 selected: false,
                 normalizedSettings: dependentId === 'settings' ? null : dependentSection.normalizedSettings ?? null,
             };