@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/packages/workspace/relationship-observation-model.mjs

@@ -1,16 +1,11 @@
 import { normalizeDomain } from "../cases/case-model.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { RELATIONSHIP_EVIDENCE_VERSION } from "../contracts/offline-comparison.mjs";
+import { RELATIONSHIP_TYPES, qualifyRelationshipSources } from "../comparison/relationship-provenance.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { MAX_RELATIONSHIP_OBSERVATIONS, MAX_RELATIONSHIP_OBSERVATION_DOMAINS, MAX_RELATIONSHIP_OBSERVATION_INPUTS, MAX_RELATIONSHIP_OBSERVATION_LIMITATIONS, MAX_RELATIONSHIP_OBSERVATION_STORE_BYTES, MAX_RELATIONSHIP_OBSERVATION_VALUE_LENGTH, RELATIONSHIP_OBSERVATION_SCHEMA, RELATIONSHIP_OBSERVATION_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
 export { MAX_RELATIONSHIP_OBSERVATIONS, MAX_RELATIONSHIP_OBSERVATION_DOMAINS, MAX_RELATIONSHIP_OBSERVATION_INPUTS, MAX_RELATIONSHIP_OBSERVATION_LIMITATIONS, MAX_RELATIONSHIP_OBSERVATION_STORE_BYTES, MAX_RELATIONSHIP_OBSERVATION_VALUE_LENGTH, RELATIONSHIP_OBSERVATION_SCHEMA, RELATIONSHIP_OBSERVATION_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
-export const RELATIONSHIP_OBSERVATION_TYPES = Object.freeze([
-    'nameserver_set',
-    'ip_address',
-    'certificate',
-    'tracking_identifier',
-    'favicon',
-    'official_asset',
-]);
+export const RELATIONSHIP_OBSERVATION_TYPES = RELATIONSHIP_TYPES;
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const SAFE_ID_RE = /^relationship-[a-z0-9]{1,16}-[a-z0-9]{1,16}$/u;
 const SHA256_RE = /^[a-f0-9]{64}$/iu;
@@ -205,7 +200,7 @@ export function relationshipObservationId(raw) {
 }
 export function relationshipObservationStoreVersion(raw) {
     const value = record(raw);
-    return positiveInteger(value?.version);
+    return typeof value?.version === 'number' && Number.isSafeInteger(value.version) && value.version > 0 ? value.version : null;
 }
 function observationList(raw) {
     if (Array.isArray(raw))
@@ -213,7 +208,7 @@ function observationList(raw) {
     const value = record(raw);
     return Array.isArray(value?.observations) ? value.observations : [];
 }
-export function normalizeRelationshipObservation(raw) {
+export function normalizeRelationshipObservation(raw, sourceStoreVersion = RELATIONSHIP_OBSERVATION_SCHEMA_VERSION) {
     const value = record(raw);
     if (!value || typeof value.type !== 'string' || !TYPES.has(value.type))
         return null;
@@ -230,8 +225,16 @@ export function normalizeRelationshipObservation(raw) {
     const id = observationId(canonical);
     const observedAt = timestamp(value.observedAt);
     const retainedAt = timestamp(value.retainedAt);
-    if (!observedAt || !retainedAt)
+    if (!retainedAt || (value.observedAt !== null && !observedAt))
         return null;
+    const sourceVersion = positiveInteger(value.sourceVersion) || 1;
+    if (value.sourceVersion !== undefined && !positiveInteger(value.sourceVersion))
+        throw new TypeError('This retained relationship uses an unsupported source-evidence version; no evidence was interpreted.');
+    if (sourceVersion > RELATIONSHIP_EVIDENCE_VERSION)
+        throw new TypeError('This retained relationship uses a newer source-evidence version; no evidence was interpreted.');
+    if (sourceStoreVersion === 1 && sourceVersion > 2)
+        throw new TypeError('Relationship schema 1 cannot contain newer source evidence; no evidence was interpreted.');
+    const qualified = qualifyRelationshipSources(sourceVersion === RELATIONSHIP_EVIDENCE_VERSION ? value.sourceEvidence : [], domains, { truncated: value.truncated === true, type });
     return {
         id,
         type,
@@ -243,11 +246,14 @@ export function normalizeRelationshipObservation(raw) {
         description: metadata.description,
         classification: 'derived',
         source: 'bulk_relationship_analysis',
-        sourceVersion: positiveInteger(value.sourceVersion) || 1,
-        observedAt,
+        sourceVersion,
+        // Legacy scan timestamps remain available, but cannot qualify missing
+        // contributing-source timestamps or turn the old complete flag into proof.
+        observedAt: qualified.observedAt ?? (observedAt || null),
+        sourceEvidence: qualified.sourceEvidence,
         retainedAt,
-        complete: value.complete === true,
-        truncated: value.truncated === true
+        complete: value.complete === true && qualified.complete,
+        truncated: qualified.truncated
             || (Array.isArray(value.domains) && value.domains.length > MAX_RELATIONSHIP_OBSERVATION_DOMAINS),
         limitations: observationLimitations(value.limitations),
     };
@@ -255,9 +261,13 @@ export function normalizeRelationshipObservation(raw) {
 export function normalizeRelationshipObservationStore(raw) {
     assertWorkspaceInputGraph(raw, 'Relationship-observation store');
     assertWorkspaceDeclaredVersion(raw, 'Relationship-observation store');
+    const sourceStoreVersion = relationshipObservationStoreVersion(raw) ?? RELATIONSHIP_OBSERVATION_SCHEMA_VERSION;
+    if (sourceStoreVersion > RELATIONSHIP_OBSERVATION_SCHEMA_VERSION) {
+        throw new TypeError(`This relationship-observation store uses newer schema ${sourceStoreVersion}; no evidence was interpreted.`);
+    }
     const byId = new Map();
     for (const candidate of observationList(raw).slice(0, MAX_RELATIONSHIP_OBSERVATION_INPUTS)) {
-        const observation = normalizeRelationshipObservation(candidate);
+        const observation = normalizeRelationshipObservation(candidate, sourceStoreVersion);
         if (!observation)
             continue;
         const existing = byId.get(observation.id);
@@ -283,11 +293,16 @@ export function createRelationshipObservation(raw, options = {}) {
         throw new Error('That relationship does not contain a supported bounded value and at least one valid domain.');
     }
     const now = new Date().toISOString();
-    const observedAt = Object.hasOwn(options, 'observedAt') ? timestamp(options.observedAt) : now;
+    const sourceVersion = Object.hasOwn(options, 'sourceVersion') ? positiveInteger(options.sourceVersion) : RELATIONSHIP_EVIDENCE_VERSION;
+    if (!sourceVersion || sourceVersion > RELATIONSHIP_EVIDENCE_VERSION)
+        throw new TypeError('This relationship needs a supported source-evidence version.');
+    const qualified = qualifyRelationshipSources(sourceVersion === RELATIONSHIP_EVIDENCE_VERSION ? raw.sourceEvidence : [], domains, { truncated: options.truncated === true, type });
+    // Older callers can supply their original scan timestamp. It does not
+    // qualify the missing source metadata, and an explicit current projection
+    // never substitutes that timestamp for unknown contributing-source times.
+    const observedAt = qualified.observedAt
+        ?? (!Object.hasOwn(raw, 'sourceEvidence') ? timestamp(options.observedAt) || null : null);
     const retainedAt = timestamp(options.retainedAt) || now;
-    if (!observedAt) {
-        throw new Error('A relationship observation needs the contributing scan observation time; an unknown time is not replaced with the retention time.');
-    }
     const canonical = canonicalIdentity(type, normalizedValue, domains);
     const metadata = TYPE_METADATA[type];
     return {
@@ -301,11 +316,12 @@ export function createRelationshipObservation(raw, options = {}) {
         description: metadata.description,
         classification: 'derived',
         source: 'bulk_relationship_analysis',
-        sourceVersion: positiveInteger(options.sourceVersion) || 1,
+        sourceVersion,
         observedAt,
+        sourceEvidence: qualified.sourceEvidence,
         retainedAt,
-        complete: options.complete === true,
-        truncated: options.truncated === true
+        complete: options.complete !== false && qualified.complete,
+        truncated: qualified.truncated
             || (Array.isArray(raw.domains) && raw.domains.length > MAX_RELATIONSHIP_OBSERVATION_DOMAINS),
         limitations: observationLimitations(options.limitations),
     };
@@ -359,12 +375,11 @@ export function deleteRelationshipObservation(rawStore, id) {
 export function mergeRelationshipObservations(localRaw, importedRaw) {
     assertWorkspaceInputGraph(localRaw, 'Local relationship-observation store');
     assertWorkspaceInputGraph(importedRaw, 'Imported relationship-observation document');
-    assertWorkspacePortableVersion(importedRaw, RELATIONSHIP_OBSERVATION_SCHEMA_VERSION, 'Imported relationship-observation document');
+    const importedVersion = assertWorkspacePortableVersion(importedRaw, RELATIONSHIP_OBSERVATION_SCHEMA_VERSION, 'Imported relationship-observation document');
     const importedRecord = record(importedRaw);
     if (importedRecord?.schema !== undefined && importedRecord.schema !== RELATIONSHIP_OBSERVATION_SCHEMA) {
         throw new Error('This JSON section is not a WHOISleuth relationship-observation export.');
     }
-    const importedVersion = relationshipObservationStoreVersion(importedRaw);
     if (importedVersion !== null && importedVersion > RELATIONSHIP_OBSERVATION_SCHEMA_VERSION) {
         throw new Error(`This relationship-observation section uses newer schema ${importedVersion}. Update the app before importing it.`);
     }
@@ -375,7 +390,7 @@ export function mergeRelationshipObservations(localRaw, importedRaw) {
     let updated = 0;
     let skipped = Math.max(0, importedInput.length - MAX_RELATIONSHIP_OBSERVATION_INPUTS);
     for (const candidate of importedInput.slice(0, MAX_RELATIONSHIP_OBSERVATION_INPUTS)) {
-        const observation = normalizeRelationshipObservation(candidate);
+        const observation = normalizeRelationshipObservation(candidate, importedVersion ?? RELATIONSHIP_OBSERVATION_SCHEMA_VERSION);
         if (!observation) {
             skipped += 1;
             continue;

package/packages/workspace/watchlist-history.mjs

@@ -6,6 +6,7 @@ import { explainRiskScore, normalizeRiskModelVersion } from "../../lib/risk-scor
 import { HTTP_SECURITY_HEADER_TOKENS, normalizeHttpSummary } from "../cases/http-summary.mjs";
 import { normalizeDomain } from "../cases/case-model.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { registryDateIso } from "../evidence/registry-dates.mjs";
 import { MAX_WATCHLIST_CHANGES_PER_EVENT, MAX_WATCHLIST_DOMAINS, MAX_WATCHLIST_HISTORY_DOMAIN_OPTIONS, MAX_WATCHLIST_HISTORY_EVENTS, MAX_WATCHLIST_INPUT_RECORDS, MAX_WATCHLIST_MUTATION_TYPES, MAX_WATCHLIST_NAMESERVERS, } from "../contracts/workspace-portability.mjs";
 export { MAX_WATCHLIST_CHANGES_PER_EVENT, MAX_WATCHLIST_DOMAINS, MAX_WATCHLIST_HISTORY_DOMAIN_OPTIONS, MAX_WATCHLIST_HISTORY_EVENTS, MAX_WATCHLIST_INPUT_RECORDS, MAX_WATCHLIST_MUTATION_TYPES, MAX_WATCHLIST_NAMESERVERS, } from "../contracts/workspace-portability.mjs";
 const MAX_TEXT_LENGTH = 300;
@@ -155,8 +156,7 @@ function boundedInteger(value, maximum, fallback = 0) {
 function normalizeDateValue(value) {
     if (typeof value !== 'string' || value.length > MAX_TIMESTAMP_LENGTH || CONTROL_RE.test(value))
         return null;
-    const parsed = Date.parse(value);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString().slice(0, 10) : null;
+    return registryDateIso(value)?.slice(0, 10) ?? null;
 }
 function inferredScanDepth(record) {
     if (record.scanDepth === 'deep' || record.scanDepth === 'fast')

package/packages/workspace/watchlist-store.mjs

@@ -109,15 +109,21 @@ export function mergeWatchlistStores(localRaw, importedRaw) {
             skipped++;
             continue;
         }
-        if (Object.prototype.hasOwnProperty.call(local, name))
+        const normalized = normalizeWatchlistEntry(entry);
+        if (Object.prototype.hasOwnProperty.call(local, name)) {
+            if (normalized.updatedAt <= local[name].updatedAt) {
+                skipped++;
+                continue;
+            }
             updated++;
+        }
         else if (Object.keys(local).length >= MAX_WATCHLISTS) {
             skipped++;
             continue;
         }
         else
             added++;
-        defineEntry(local, name, normalizeWatchlistEntry(entry));
+        defineEntry(local, name, normalized);
     }
     return { watchlists: local, added, updated, skipped };
 }

package/packages/workspace/website-snapshot-model.mjs

@@ -1,7 +1,8 @@
 import { normalizeDomain } from "../cases/case-model.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { validWebObservationMode } from "../evidence/lookup-target.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
-import { MAX_WEBSITE_SNAPSHOTS, MAX_WEBSITE_SNAPSHOTS_PER_DOMAIN, MAX_WEBSITE_SNAPSHOT_STORE_BYTES, SUPPORTED_WEBSITE_SNAPSHOT_SCHEMA_VERSIONS, WEBSITE_SNAPSHOT_SCHEMA, WEBSITE_SNAPSHOT_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
+import { MAX_WEBSITE_SNAPSHOTS, MAX_WEBSITE_SNAPSHOTS_PER_DOMAIN, MAX_WEBSITE_SNAPSHOT_STORE_BYTES, PAGE_FINGERPRINT_PARSERS, SUPPORTED_WEBSITE_SNAPSHOT_SCHEMA_VERSIONS, WEBSITE_SNAPSHOT_SCHEMA, WEBSITE_SNAPSHOT_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
 export { MAX_WEBSITE_SNAPSHOTS, MAX_WEBSITE_SNAPSHOTS_PER_DOMAIN, MAX_WEBSITE_SNAPSHOT_IMPORT_BYTES, MAX_WEBSITE_SNAPSHOT_STORE_BYTES, SUPPORTED_WEBSITE_SNAPSHOT_SCHEMA_VERSIONS, WEBSITE_SNAPSHOT_SCHEMA, WEBSITE_SNAPSHOT_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const DIGEST_RE = /^[a-f0-9]{16,128}$/iu;
@@ -10,6 +11,10 @@ const SERIAL_RE = /^[a-f0-9]{1,128}$/iu;
 const SNAPSHOT_TECHNOLOGY_ROLES = new Set([
     'observed_edge', 'application_platform', 'framework_runtime', 'embedded_dependency',
 ]);
+export const WEBSITE_SNAPSHOT_COLLECTION_LIMITS = Object.freeze({
+    technologies: 40, posture: 40, sources: 16, dependencies: 20,
+    resourceHosts: 30, trackingIdentifiers: 30, formActionOrigins: 20,
+});
 function record(value) {
     return ordinaryWorkspaceRecord(value, 'Website-snapshot input');
 }
@@ -67,18 +72,26 @@ function profileVersion(value) {
         ? Number(value)
         : null;
 }
-function profileProvenance(value, legacy = false) {
+function profileProvenance(value, sourceVersion) {
+    const legacy = sourceVersion === 4;
     if (legacy) {
         return {
             technology: { version: null, state: 'legacy_unknown' },
             securityPosture: { version: null, state: 'legacy_unknown' },
+            pageFingerprint: { version: 1, state: 'known' },
         };
     }
     const item = record(value);
     const technologyItem = record(item?.technology);
     const securityPostureItem = record(item?.securityPosture);
+    const pageFingerprintItem = record(item?.pageFingerprint);
     const technologyVersion = profileVersion(technologyItem?.version);
     const securityPostureVersion = profileVersion(securityPostureItem?.version);
+    // Exact published snapshot writers 4 and 5 used fingerprint algorithm 1.
+    // Unversioned records do not receive invented historical provenance.
+    const candidateFingerprintVersion = sourceVersion === 5 ? 1 : profileVersion(pageFingerprintItem?.version);
+    const pageFingerprintVersion = candidateFingerprintVersion !== null && Object.hasOwn(PAGE_FINGERPRINT_PARSERS, candidateFingerprintVersion)
+        ? candidateFingerprintVersion : null;
     return {
         technology: {
             version: technologyVersion,
@@ -88,6 +101,7 @@ function profileProvenance(value, legacy = false) {
             version: securityPostureVersion,
             state: securityPostureVersion === null ? 'legacy_unknown' : 'known',
         },
+        pageFingerprint: { version: pageFingerprintVersion, state: pageFingerprintVersion === null ? 'legacy_unknown' : 'known' },
     };
 }
 function posture(value) {
@@ -183,8 +197,8 @@ function origin(value) {
 }
 function identityValues(value) {
     const item = record(value);
-    const resourceHosts = values(item?.resourceHosts, 30, (candidate) => normalizeDomain(candidate));
-    const trackingIdentifiers = values(item?.trackingIdentifiers, 30, (candidate) => {
+    const resourceHosts = values(item?.resourceHosts, WEBSITE_SNAPSHOT_COLLECTION_LIMITS.resourceHosts, (candidate) => normalizeDomain(candidate));
+    const trackingIdentifiers = values(item?.trackingIdentifiers, WEBSITE_SNAPSHOT_COLLECTION_LIMITS.trackingIdentifiers, (candidate) => {
         const tracker = record(candidate);
         const type = text(tracker?.type, 40).toLowerCase();
         const trackerValue = text(tracker?.value, 64).toUpperCase();
@@ -192,7 +206,7 @@ function identityValues(value) {
             ? { type, value: trackerValue }
             : null;
     });
-    const formActionOrigins = values(item?.formActionOrigins, 20, origin);
+    const formActionOrigins = values(item?.formActionOrigins, WEBSITE_SNAPSHOT_COLLECTION_LIMITS.formActionOrigins, origin);
     return { resourceHosts, trackingIdentifiers, formActionOrigins };
 }
 export function normalizeWebsiteProfileSnapshot(raw, sourceVersion) {
@@ -203,20 +217,24 @@ export function normalizeWebsiteProfileSnapshot(raw, sourceVersion) {
     const id = text(value?.id, 128);
     if (!domain || !observedAt || !savedAt || !id)
         return null;
+    const acceptsWebScope = sourceVersion === undefined || sourceVersion >= 6;
+    if (acceptsWebScope && !validWebObservationMode(value?.webObservationMode))
+        return null;
     return {
         id,
         domain,
+        ...(acceptsWebScope && value?.webObservationMode === 'selected_url' ? { webObservationMode: value.webObservationMode } : {}),
         observedAt,
         savedAt,
         complete: value?.complete === true,
         truncated: value?.truncated === true,
-        profileProvenance: profileProvenance(value?.profileProvenance, sourceVersion === 4),
-        technologies: values(value?.technologies, 40, technology),
-        posture: values(value?.posture, 40, posture),
+        profileProvenance: profileProvenance(value?.profileProvenance, sourceVersion),
+        technologies: values(value?.technologies, WEBSITE_SNAPSHOT_COLLECTION_LIMITS.technologies, technology),
+        posture: values(value?.posture, WEBSITE_SNAPSHOT_COLLECTION_LIMITS.posture, posture),
         identity: identity(value?.identity),
         identityValues: identityValues(value?.identityValues),
-        sources: values(value?.sources, 16, source),
-        dependencies: values(value?.dependencies, 20, dependency),
+        sources: values(value?.sources, WEBSITE_SNAPSHOT_COLLECTION_LIMITS.sources, source),
+        dependencies: values(value?.dependencies, WEBSITE_SNAPSHOT_COLLECTION_LIMITS.dependencies, dependency),
         certificate: certificate(value?.certificate),
     };
 }
@@ -366,6 +384,13 @@ export function websiteSnapshotComparisonEvidenceComplete(snapshot) {
         && websiteSnapshotFieldComplete(snapshot, 'dependency.CNAME')
         && (!snapshot.certificate || websiteSnapshotFieldComplete(snapshot, 'certificate.observation'));
 }
+export function websiteSnapshotProfileComparability(before, after, profile) {
+    const left = before.profileProvenance[profile].version;
+    const right = after.profileProvenance[profile].version;
+    if (left === null || right === null)
+        return 'legacy_unknown';
+    return left === right ? 'comparable' : 'detector_changed';
+}
 function compareMap(field, before, after, options = {}) {
     const changes = [];
     for (const key of [...new Set([...before.keys(), ...after.keys()])].sort()) {
@@ -394,15 +419,13 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
         };
     }
     const technologyVersionBefore = before.profileProvenance.technology.version;
+    const selectedPage = before.webObservationMode === 'selected_url' || after.webObservationMode === 'selected_url';
     const technologyVersionAfter = after.profileProvenance.technology.version;
     const postureVersionBefore = before.profileProvenance.securityPosture.version;
     const postureVersionAfter = after.profileProvenance.securityPosture.version;
-    const technologyComparability = technologyVersionBefore === null || technologyVersionAfter === null
-        ? 'legacy_unknown'
-        : technologyVersionBefore === technologyVersionAfter ? 'comparable' : 'detector_changed';
-    const postureComparability = postureVersionBefore === null || postureVersionAfter === null
-        ? 'legacy_unknown'
-        : postureVersionBefore === postureVersionAfter ? 'comparable' : 'detector_changed';
+    const technologyComparability = websiteSnapshotProfileComparability(before, after, 'technology');
+    const postureComparability = websiteSnapshotProfileComparability(before, after, 'securityPosture');
+    const fingerprintComparability = websiteSnapshotProfileComparability(before, after, 'pageFingerprint');
     const changes = [
         ...(technologyComparability === 'comparable' ? compareMap('technology', new Map(before.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}|${item.roles.join(',')}`])), new Map(after.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}|${item.roles.join(',')}`])), {
             beforeComplete: () => websiteSnapshotFieldComplete(before, 'technology'),
@@ -462,20 +485,30 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
     for (const key of Object.keys(before.identity)) {
         const left = before.identity[key];
         const right = after.identity[key];
+        if (key !== 'faviconHash' && fingerprintComparability !== 'comparable')
+            continue;
         if (left === right)
             continue;
         changes.push({ field: `identity.${key}`, state: left === null || right === null ? 'unavailable' : 'changed', before: left, after: right });
     }
-    changes.push(...compareMap('identityValues.resourceHosts', new Map(before.identityValues.resourceHosts.map((item) => [item, item])), new Map(after.identityValues.resourceHosts.map((item) => [item, item])), {
-        beforeComplete: () => websiteSnapshotFieldComplete(before, 'identityValues.resourceHosts'),
-        afterComplete: () => websiteSnapshotFieldComplete(after, 'identityValues.resourceHosts'),
-    }), ...compareMap('identityValues.trackingIdentifiers', new Map(before.identityValues.trackingIdentifiers.map((item) => [`${item.type}:${item.value}`, item.value])), new Map(after.identityValues.trackingIdentifiers.map((item) => [`${item.type}:${item.value}`, item.value])), {
-        beforeComplete: () => websiteSnapshotFieldComplete(before, 'identityValues.trackingIdentifiers'),
-        afterComplete: () => websiteSnapshotFieldComplete(after, 'identityValues.trackingIdentifiers'),
-    }), ...compareMap('identityValues.formActionOrigins', new Map(before.identityValues.formActionOrigins.map((item) => [item, item])), new Map(after.identityValues.formActionOrigins.map((item) => [item, item])), {
-        beforeComplete: () => websiteSnapshotFieldComplete(before, 'identityValues.formActionOrigins'),
-        afterComplete: () => websiteSnapshotFieldComplete(after, 'identityValues.formActionOrigins'),
-    }));
+    if (fingerprintComparability !== 'comparable') {
+        changes.push({
+            field: 'identity.profileVersion', state: 'incomparable',
+            before: before.profileProvenance.pageFingerprint.version?.toString() ?? null,
+            after: after.profileProvenance.pageFingerprint.version?.toString() ?? null,
+        });
+    }
+    else
+        changes.push(...compareMap('identityValues.resourceHosts', new Map(before.identityValues.resourceHosts.map((item) => [item, item])), new Map(after.identityValues.resourceHosts.map((item) => [item, item])), {
+            beforeComplete: () => websiteSnapshotFieldComplete(before, 'identityValues.resourceHosts'),
+            afterComplete: () => websiteSnapshotFieldComplete(after, 'identityValues.resourceHosts'),
+        }), ...compareMap('identityValues.trackingIdentifiers', new Map(before.identityValues.trackingIdentifiers.map((item) => [`${item.type}:${item.value}`, item.value])), new Map(after.identityValues.trackingIdentifiers.map((item) => [`${item.type}:${item.value}`, item.value])), {
+            beforeComplete: () => websiteSnapshotFieldComplete(before, 'identityValues.trackingIdentifiers'),
+            afterComplete: () => websiteSnapshotFieldComplete(after, 'identityValues.trackingIdentifiers'),
+        }), ...compareMap('identityValues.formActionOrigins', new Map(before.identityValues.formActionOrigins.map((item) => [item, item])), new Map(after.identityValues.formActionOrigins.map((item) => [item, item])), {
+            beforeComplete: () => websiteSnapshotFieldComplete(before, 'identityValues.formActionOrigins'),
+            afterComplete: () => websiteSnapshotFieldComplete(after, 'identityValues.formActionOrigins'),
+        }));
     if (before.certificate || after.certificate) {
         if (!before.certificate || !after.certificate) {
             changes.push({
@@ -519,15 +552,22 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
     }
     return {
         compatible: true,
-        complete: websiteSnapshotComparisonEvidenceComplete(before)
+        complete: !selectedPage && websiteSnapshotComparisonEvidenceComplete(before)
             && websiteSnapshotComparisonEvidenceComplete(after)
             && technologyComparability === 'comparable'
-            && postureComparability === 'comparable',
+            && postureComparability === 'comparable'
+            && fingerprintComparability === 'comparable',
         profileComparability: {
             technology: technologyComparability,
             securityPosture: postureComparability,
+            pageFingerprint: fingerprintComparability,
         },
-        changes,
-        dependencyTransitions,
+        changes: selectedPage ? [
+            { field: 'web.collectionTarget', state: 'incomparable', before: before.webObservationMode ?? 'homepage', after: after.webObservationMode ?? 'homepage' },
+            ...changes.map((change) => change.field.startsWith('certificate.') || change.field.startsWith('source.') || change.field === 'completeness'
+                || /^dependency\.(?:CNAME|HTTPS|NS|MX)(?::|$)/u.test(change.field)
+                ? change : { ...change, state: 'incomparable' }),
+        ] : changes,
+        dependencyTransitions: selectedPage ? dependencyTransitions.filter((transition) => transition.recordType !== 'HTTP') : dependencyTransitions,
     };
 }

package/packages/workspace/workspace-archive-crypto.mjs

@@ -2,13 +2,13 @@
 // This protects a downloaded file while it is locked. It does not encrypt the
 // active IndexedDB workspace or defend an unlocked page from same-origin code.
 import { WORKSPACE_ARCHIVE_SCHEMA, WORKSPACE_ARCHIVE_VERSION, SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS, isSupportedWorkspaceArchiveVersion, readWorkspaceArchive, } from "./workspace-archive.mjs";
-import { parseBoundedJson } from "../../lib/bounded-json.mjs";
+import { boundedJsonLimitsForBytes, parseBoundedJson } from "../../lib/bounded-json.mjs";
 import { ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA, ENCRYPTED_WORKSPACE_ARCHIVE_VERSION, MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES, MAX_WORKSPACE_ARCHIVE_BYTES, MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES, MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS, WORKSPACE_ARCHIVE_PBKDF2_ITERATIONS, } from "../contracts/case-portability.mjs";
 import { assertWorkspaceInputGraph } from "./hostile-input.mjs";
+import { AES_KEY_BITS, arrayBuffer, assertPassphrase, cryptoProvider, deriveArchiveKey } from "../evidence/passphrase-encryption.mjs";
 export { ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA, ENCRYPTED_WORKSPACE_ARCHIVE_VERSION, MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES, MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES, MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS, WORKSPACE_ARCHIVE_PBKDF2_ITERATIONS, };
 const SALT_BYTES = 16;
 const IV_BYTES = 12;
-const AES_KEY_BITS = 256;
 const AES_GCM_TAG_BITS = 128;
 const MAX_CIPHERTEXT_BASE64URL_CHARACTERS = Math.ceil((MAX_WORKSPACE_ARCHIVE_BYTES + AES_GCM_TAG_BITS / 8) * 4 / 3);
 const BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
@@ -25,25 +25,6 @@ function hasExactKeys(value, expected) {
     const keys = Object.keys(value);
     return keys.length === expected.length && keys.every((key) => expected.includes(key));
 }
-function arrayBuffer(bytes) {
-    return bytes.slice().buffer;
-}
-function assertPassphrase(passphrase) {
-    if (typeof passphrase !== 'string') {
-        throw new Error(`Use a backup passphrase with at least ${MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS} characters.`);
-    }
-    if (passphrase.length > MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES) {
-        throw new Error('Backup passphrases are limited to 1024 UTF-8 bytes.');
-    }
-    if (Array.from(passphrase).length < MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS) {
-        throw new Error(`Use a backup passphrase with at least ${MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS} characters.`);
-    }
-    const bytes = encoder.encode(passphrase);
-    if (bytes.byteLength > MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES) {
-        throw new Error('Backup passphrases are limited to 1024 UTF-8 bytes.');
-    }
-    return bytes;
-}
 function base64url(bytes) {
     let encoded = '';
     for (let index = 0; index < bytes.length; index += 3) {
@@ -112,7 +93,7 @@ function validTimestamp(value) {
     return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value;
 }
 function validateEnvelope(raw) {
-    assertWorkspaceInputGraph(raw, 'Encrypted workspace archive');
+    assertWorkspaceInputGraph(raw, 'Encrypted workspace archive', { maximumBytes: MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES });
     const value = record(raw);
     if (!value || value.schema !== ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA) {
         throw new Error('This file is not an encrypted WHOISleuth workspace archive.');
@@ -197,26 +178,6 @@ function validateEnvelope(raw) {
         ciphertext,
     };
 }
-function cryptoProvider(provider = globalThis.crypto) {
-    if (!provider
-        || typeof provider.getRandomValues !== 'function'
-        || typeof provider.subtle?.importKey !== 'function'
-        || typeof provider.subtle?.deriveKey !== 'function'
-        || typeof provider.subtle?.encrypt !== 'function'
-        || typeof provider.subtle?.decrypt !== 'function') {
-        throw new Error('Encrypted workspace archives are unavailable in this browser.');
-    }
-    return provider;
-}
-async function deriveArchiveKey(provider, passphraseBytes, salt, usages) {
-    const material = await provider.subtle.importKey('raw', arrayBuffer(passphraseBytes), 'PBKDF2', false, ['deriveKey']);
-    return provider.subtle.deriveKey({
-        name: 'PBKDF2',
-        hash: 'SHA-256',
-        salt: arrayBuffer(salt),
-        iterations: WORKSPACE_ARCHIVE_PBKDF2_ITERATIONS,
-    }, material, { name: 'AES-GCM', length: AES_KEY_BITS }, false, usages);
-}
 export function isEncryptedWorkspaceArchive(raw) {
     return record(raw)?.schema === ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA;
 }
@@ -227,15 +188,19 @@ export function inspectEncryptedWorkspaceArchive(raw) {
 }
 /** Encrypt one already-built workspace archive using browser-native Web Crypto. */
 export async function encryptWorkspaceArchive(archive, passphrase, provider) {
-    await readWorkspaceArchive(archive);
-    const archiveVersion = record(archive)?.version;
-    if (!isSupportedWorkspaceArchiveVersion(archiveVersion)) {
-        throw new Error('The workspace archive declares an unsupported content contract.');
-    }
+    assertWorkspaceInputGraph(archive, 'Workspace archive', { maximumBytes: MAX_WORKSPACE_ARCHIVE_BYTES });
     const plaintext = JSON.stringify(archive);
     const plaintextBytes = encoder.encode(plaintext);
     if (plaintextBytes.byteLength > MAX_WORKSPACE_ARCHIVE_BYTES) {
-        throw new Error('Workspace archives are limited to 10 MiB. Export smaller collections separately before trying again.');
+        throw new Error(`Workspace archives are limited to ${MAX_WORKSPACE_ARCHIVE_BYTES / 1024 / 1024} MiB. Export smaller collections separately before trying again.`);
+    }
+    // Validation and encryption consume the same snapshot, including when the
+    // caller changes the original object while checksum verification is pending.
+    const snapshot = JSON.parse(plaintext);
+    await readWorkspaceArchive(snapshot);
+    const archiveVersion = record(snapshot)?.version;
+    if (!isSupportedWorkspaceArchiveVersion(archiveVersion)) {
+        throw new Error('The workspace archive declares an unsupported content contract.');
     }
     const crypto = cryptoProvider(provider);
     const passphraseBytes = assertPassphrase(passphrase);
@@ -278,30 +243,45 @@ export async function encryptWorkspaceArchive(archive, passphrase, provider) {
 }
 /** Decrypt and parse one encrypted archive. The ordinary archive reader remains authoritative. */
 export async function decryptWorkspaceArchive(raw, passphrase, provider) {
+    return (await decryptWorkspaceArchiveWithMetadata(raw, passphrase, provider)).archive;
+}
+/** Authenticate one envelope and return its inner JSON with verified byte metadata. */
+export async function decryptWorkspaceArchiveWithMetadata(raw, passphrase, provider) {
     const { envelope, salt, iv, ciphertext } = validateEnvelope(raw);
     const crypto = cryptoProvider(provider);
     const passphraseBytes = assertPassphrase(passphrase);
     const { ciphertext: _ciphertext, ...metadata } = envelope;
     try {
-        const key = await deriveArchiveKey(crypto, passphraseBytes, salt, ['decrypt']);
-        const plaintext = await crypto.subtle.decrypt({
-            name: 'AES-GCM',
-            iv: arrayBuffer(iv),
-            additionalData: arrayBuffer(encoder.encode(canonicalMetadata(metadata))),
-            tagLength: AES_GCM_TAG_BITS,
-        }, key, arrayBuffer(ciphertext));
+        let plaintext;
+        try {
+            const key = await deriveArchiveKey(crypto, passphraseBytes, salt, ['decrypt']);
+            plaintext = await crypto.subtle.decrypt({
+                name: 'AES-GCM',
+                iv: arrayBuffer(iv),
+                additionalData: arrayBuffer(encoder.encode(canonicalMetadata(metadata))),
+                tagLength: AES_GCM_TAG_BITS,
+            }, key, arrayBuffer(ciphertext));
+        }
+        catch {
+            // Authentication failure cannot distinguish a wrong key from tampering.
+            throw new Error('The backup passphrase is incorrect or the encrypted file is corrupted.');
+        }
         if (plaintext.byteLength > MAX_WORKSPACE_ARCHIVE_BYTES) {
             throw new Error('The decrypted workspace archive exceeds its byte limit.');
         }
-        return parseBoundedJson(decoder.decode(plaintext), {
+        let json;
+        try {
+            json = decoder.decode(plaintext);
+        }
+        catch {
+            throw new Error('The backup decrypted, but its contents are not valid UTF-8.');
+        }
+        const archive = parseBoundedJson(json, {
             label: 'Decrypted workspace archive',
             maximumBytes: MAX_WORKSPACE_ARCHIVE_BYTES,
+            limits: boundedJsonLimitsForBytes(MAX_WORKSPACE_ARCHIVE_BYTES),
         });
-    }
-    catch (cause) {
-        if (cause instanceof Error && cause.message === 'The decrypted workspace archive exceeds its byte limit.')
-            throw cause;
-        throw new Error('The backup passphrase is incorrect or the encrypted file is corrupted.');
+        return { archive, ciphertextBytes: ciphertext.byteLength };
     }
     finally {
         passphraseBytes.fill(0);