@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/packages/workspace/bulk-session-model.mjs

@@ -1,10 +1,11 @@
 // Pure, bounded persistence model for analyst-saved Bulk investigations.
 // Sessions retain compact derived rows and source states, never raw registry,
 // WHOIS, HTTP, TLS, page, or provider payloads.
-import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { normalizeCaaCritical } from "./dns-record-normalization.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
-import { RELATIONSHIP_EVIDENCE_VERSION } from "../contracts/offline-comparison.mjs";
+import { normalizeWebCollectionQuality, webCollectionAllowsComparison } from "../evidence/collection-quality.mjs";
+import { RELATIONSHIP_EVIDENCE_VERSION, RELATIONSHIP_SOURCE_PROVENANCE_VERSION, SUPPORTED_RELATIONSHIP_EVIDENCE_VERSIONS } from "../contracts/offline-comparison.mjs";
 import { normalizeRelationshipSourceProjection } from "../comparison/relationship-provenance.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { BULK_SESSION_SCHEMA, BULK_SESSION_SCHEMA_VERSION, MAX_BULK_PROFILE_CONTEXT_LIMITATION_LENGTH, MAX_BULK_SESSIONS, MAX_BULK_SESSION_ARRAY_VALUES, MAX_BULK_SESSION_NAME_LENGTH, MAX_BULK_SESSION_ROWS, MAX_BULK_SESSION_SOURCES, MAX_BULK_SESSION_STORE_BYTES, MAX_BULK_SESSION_TEXT_LENGTH, SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
@@ -94,7 +95,7 @@ export function normalizeBulkProfileContext(value, fallbackLimitation = BULK_PRO
     }
     return unavailableBulkProfileContext(profileContextLimitation(item?.limitation, fallbackLimitation));
 }
-function sameProfileContext(left, right) {
+export function bulkProfileContextsMatch(left, right) {
     return left.sourceState === right.sourceState
         && left.activeProfileId === right.activeProfileId
         && left.profileUpdatedAt === right.profileUpdatedAt
@@ -104,7 +105,7 @@ export function summarizeBulkProfileContexts(rows) {
     const first = rows[0]?.profileContext;
     if (!first)
         return unavailableBulkProfileContext('This saved Bulk session contains no settled row with profile-context provenance.');
-    if (rows.every((row) => sameProfileContext(first, row.profileContext)))
+    if (rows.every((row) => bulkProfileContextsMatch(first, row.profileContext)))
         return { ...first };
     return {
         sourceState: 'mixed',
@@ -200,7 +201,7 @@ function nullableHash(value, expression) {
 }
 function normalizeRelationship(value) {
     const item = record(value);
-    if (item?.version !== undefined && item.version !== 2 && item.version !== RELATIONSHIP_EVIDENCE_VERSION) {
+    if (item?.version !== undefined && !SUPPORTED_RELATIONSHIP_EVIDENCE_VERSIONS.some(version => version === item.version)) {
         throw new TypeError('This Bulk relationship projection uses an unsupported version. No source evidence was interpreted.');
     }
     return {
@@ -212,7 +213,7 @@ function normalizeRelationship(value) {
         faviconHash: nullableHash(item?.faviconHash, HASH_64_RE),
         faviconPHash: nullableHash(item?.faviconPHash, PHASH_RE),
         certificateFingerprint: nullableHash(item?.certificateFingerprint, HASH_64_RE),
-        sourceEvidence: item?.version === RELATIONSHIP_EVIDENCE_VERSION ? normalizeRelationshipSourceProjection(item.sourceEvidence) : {},
+        sourceEvidence: Number(item?.version) >= RELATIONSHIP_SOURCE_PROVENANCE_VERSION ? normalizeRelationshipSourceProjection(item?.sourceEvidence) : {},
         truncated: item?.truncated === true,
     };
 }
@@ -304,6 +305,7 @@ export function normalizeBulkSessionResult(value, inheritedProfileContext) {
     const profileClaimsUsable = profileContextReady && !impossibleNoProfileClaim;
     if (!profileClaimsUsable || readyWithoutActiveProfile)
         relationship.officialAssetHosts = [];
+    const webCollectionQuality = normalizeWebCollectionQuality(item.webCollectionQuality, scanDepth);
     return {
         domain,
         status: status,
@@ -317,6 +319,7 @@ export function normalizeBulkSessionResult(value, inheritedProfileContext) {
         trusted: profileClaimsUsable && !readyWithoutActiveProfile && TRUST_STATES.has(trusted) ? trusted : null,
         error: boundedText(item.error),
         scanDepth: scanDepth,
+        ...(webCollectionQuality ? { webCollectionQuality } : {}),
         observedAt: normalizeExplicitIsoTimestamp(item.observedAt),
         createdDate: boundedText(item.createdDate, 64) || null,
         expiryDate: boundedText(item.expiryDate, 64) || null,
@@ -381,7 +384,7 @@ export function normalizeBulkSession(value, sourceStoreVersion) {
     // Only an explicitly versioned current document may omit identical row
     // context. Bare runtime rows and public schema 4 must carry their own context;
     // an explicit invalid/null row value never falls back to the session.
-    const inheritedProfileContext = sourceStoreVersion === 5
+    const inheritedProfileContext = sourceStoreVersion !== undefined && sourceStoreVersion >= 5
         && declaredProfileContext.sourceState !== 'mixed'
         && rawProfileContext.sourceState === declaredProfileContext.sourceState
         ? declaredProfileContext
@@ -390,8 +393,11 @@ export function normalizeBulkSession(value, sourceStoreVersion) {
     const results = [];
     const seen = new Set();
     for (const candidate of Array.isArray(item.results) ? item.results.slice(0, MAX_BULK_SESSION_ROWS * 2) : []) {
+        if (sourceStoreVersion !== undefined && sourceStoreVersion < 6 && record(candidate)?.webCollectionQuality !== undefined) {
+            throw new TypeError('Web collection quality requires Bulk schema 6 or later; historical evidence was not reinterpreted.');
+        }
         const publicLegacyRow = sourceStoreVersion === 4;
-        if (publicLegacyRow && record(record(candidate)?.relationship)?.version === RELATIONSHIP_EVIDENCE_VERSION) {
+        if (publicLegacyRow && Number(record(record(candidate)?.relationship)?.version) >= RELATIONSHIP_SOURCE_PROVENANCE_VERSION) {
             throw new TypeError('Bulk schema 4 cannot contain newer relationship source evidence; no evidence was interpreted.');
         }
         const result = normalizeBulkSessionResult(candidate, inheritedProfileContext);
@@ -411,7 +417,7 @@ export function normalizeBulkSession(value, sourceStoreVersion) {
     if ((state === 'complete') !== (results.length === domains.length))
         return null;
     const profileContext = summarizeBulkProfileContexts(results);
-    if (!sameProfileContext(declaredProfileContext, profileContext))
+    if (!bulkProfileContextsMatch(declaredProfileContext, profileContext))
         return null;
     return {
         id,
@@ -471,7 +477,7 @@ export function normalizeBulkSessionStore(raw) {
 export function bulkSessionStorageValue(session) {
     return {
         ...session,
-        results: session.results.map(({ profileContext, ...row }) => sameProfileContext(profileContext, session.profileContext)
+        results: session.results.map(({ profileContext, ...row }) => bulkProfileContextsMatch(profileContext, session.profileContext)
             ? row
             : { ...row, profileContext }),
     };
@@ -558,8 +564,10 @@ function sourceStateMap(value) {
 export function areBulkRiskScoresComparable(previous, current) {
     return previous.profileContext.sourceState === 'ready'
         && current.profileContext.sourceState === 'ready'
-        && sameProfileContext(previous.profileContext, current.profileContext)
+        && bulkProfileContextsMatch(previous.profileContext, current.profileContext)
         && previous.scanDepth === current.scanDepth
+        && webCollectionAllowsComparison('riskScore', previous.webCollectionQuality, previous.scanDepth)
+        && webCollectionAllowsComparison('riskScore', current.webCollectionQuality, current.scanDepth)
         && previous.risk !== null
         && current.risk !== null
         && previous.riskModelVersion !== null
@@ -574,7 +582,9 @@ function resultChanges(previous, current) {
     }
     if (previous.registrar !== current.registrar)
         changes.push(`Registrar: ${previous.registrar} → ${current.registrar}`);
-    if (previous.activity !== current.activity)
+    if (previous.activity !== current.activity
+        && webCollectionAllowsComparison('activityStatus', previous.webCollectionQuality, previous.scanDepth)
+        && webCollectionAllowsComparison('activityStatus', current.webCollectionQuality, current.scanDepth))
         changes.push(`Website: ${previous.activity} → ${current.activity}`);
     const previousComparison = previous.comparisonEvidence;
     const currentComparison = current.comparisonEvidence;
@@ -644,7 +654,7 @@ export function compareBulkSessions(baselineRaw, currentRaw) {
             'A source-state change may reflect collection availability rather than a change to the domain.',
             'A missing row means it was not completed in that saved session; it does not establish domain removal.',
             ...(riskIncomparable
-                ? ['Risk deltas are omitted unless both rows retain the same ready Brand Profile provenance, scan depth, and versioned Risk model.']
+                ? ['Risk deltas are omitted unless both rows retain the same ready Brand Profile provenance, scan depth, versioned Risk model and complete web collection for Deep observations.']
                 : []),
         ],
     };

package/packages/workspace/campaign-model.mjs

@@ -1,7 +1,7 @@
 // Pure, framework-neutral browser-local campaign model. Campaigns deliberately
 // reference normalized case domains rather than copying case evidence, notes,
 // or mutable case ids. The browser wrapper owns persistence and downloads.
-import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { CAMPAIGN_SCHEMA, CAMPAIGN_SCHEMA_VERSION, MAX_CAMPAIGNS, MAX_CAMPAIGN_DESCRIPTION_LENGTH, MAX_CAMPAIGN_DOMAINS, MAX_CAMPAIGN_INPUT_RECORDS, MAX_CAMPAIGN_NAME_LENGTH, MAX_CAMPAIGN_STORE_BYTES, } from "../contracts/workspace-portability.mjs";

package/packages/workspace/detection-rule-model.mjs

@@ -1,7 +1,7 @@
 // Pure browser-local custom detection-rule model. Rules are deliberately a
 // small structured language: field names and operators come from allowlists,
 // so imported rules cannot execute code or reach outside bounded case evidence.
-import { latestCaseEvidence } from "../cases/case-model.mjs";
+import { latestCaseEvidence } from "../cases/case-evidence-model.mjs";
 import { CASE_DISPOSITIONS, CASE_STATUSES } from "../cases/case-record-contracts.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { DETECTION_RULE_SCHEMA, DETECTION_RULE_SCHEMA_VERSION, MAX_CONDITION_VALUE_LENGTH, MAX_CUSTOM_RISK_TOTAL, MAX_DETECTION_RULES, MAX_RULE_CONDITIONS, MAX_RULE_INPUT_RECORDS, MAX_RULE_NAME_LENGTH, MAX_RULE_RISK_DELTA, MAX_RULE_STORE_BYTES, MAX_RULE_TAG_LENGTH, } from "../contracts/workspace-portability.mjs";

package/packages/workspace/hostile-input.mjs

@@ -1,5 +1,5 @@
 import { MAX_WORKSPACE_INPUT_ARRAY_LENGTH, MAX_WORKSPACE_INPUT_GRAPH_DEPTH, MAX_WORKSPACE_INPUT_GRAPH_NODES, MAX_WORKSPACE_INPUT_OBJECT_KEYS, MAX_WORKSPACE_INPUT_STRING_CODE_UNITS, } from "../contracts/workspace-portability.mjs";
-import { boundedJsonLimitsForBytes } from "../../lib/bounded-json.mjs";
+import { boundedJsonLimitsForBytes } from "../analysis/bounded-json.mjs";
 function inputError(label, detail) {
     return new TypeError(`${label} must be bounded ordinary JSON data; ${detail}.`);
 }

package/packages/workspace/investigation-guide.mjs

@@ -1,4 +1,4 @@
-import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { parse } from 'tldts';
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 export const INVESTIGATION_GUIDE_SCHEMA = 'whoisleuth.investigation-recipe';
@@ -13,7 +13,7 @@ export const MAX_INVESTIGATION_GUIDE_TIMESTAMP_LENGTH = 64;
 export const MAX_INVESTIGATION_GUIDE_SERIALIZED_BYTES = 12_288;
 export const MAX_INVESTIGATION_GUIDE_EXPORT_BYTES = 16_384;
 const CONTROL_RE = /[\x00-\x1f\x7f]/u;
-const SAFE_TEMPLATE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
+export const SAFE_TEMPLATE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
 const GUIDE_STATUSES = new Set(['active', 'paused']);
 const GUIDE_OUTCOMES = new Set(['pending', 'complete', 'partial', 'skipped']);
 function stage(id, workspace, label, detail, expectedEvidence, requestImpact, prerequisite, completionCriteria, instructions, requiresApproval) {

package/packages/workspace/investigation-template-model.mjs

@@ -1,8 +1,27 @@
-import { INVESTIGATION_RECIPES, normalizeInvestigationGuideTemplateSnapshot, } from "./investigation-guide.mjs";
+import { INVESTIGATION_RECIPES, normalizeInvestigationGuideTemplateSnapshot, SAFE_TEMPLATE_ID_RE, } from "./investigation-guide.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { exact, HEX_DIGEST_RE, text } from "../evidence/artifact-structure.mjs";
+import { SORTED_JSON_V2 } from "../evidence/artifact-integrity.mjs";
 import { INVESTIGATION_TEMPLATE_SCHEMA, INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS, INVESTIGATION_TEMPLATE_VERSION, MAX_INVESTIGATION_TEMPLATES, MAX_INVESTIGATION_TEMPLATE_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
 export { INVESTIGATION_TEMPLATE_SCHEMA, INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS, INVESTIGATION_TEMPLATE_VERSION, MAX_INVESTIGATION_TEMPLATES, MAX_INVESTIGATION_TEMPLATE_IMPORT_BYTES, MAX_INVESTIGATION_TEMPLATE_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
+export function readTemplateLessonRevision(raw) {
+    if (raw === undefined)
+        return undefined;
+    assertWorkspaceInputGraph(raw, 'Template revision provenance');
+    const value = exact(raw, ['parentTemplateId', 'parentContentSha256', 'lessonContentSha256', 'canonicalization', 'applicability', 'rationale'], 'Template revision provenance');
+    if (typeof value.parentTemplateId !== 'string' || !SAFE_TEMPLATE_ID_RE.test(value.parentTemplateId)
+        || value.canonicalization !== SORTED_JSON_V2
+        || typeof value.parentContentSha256 !== 'string' || !HEX_DIGEST_RE.test(value.parentContentSha256)
+        || typeof value.lessonContentSha256 !== 'string' || !HEX_DIGEST_RE.test(value.lessonContentSha256))
+        throw new TypeError('Template revision provenance is invalid.');
+    const applicability = text(value.applicability, 'Template applicability', 400).trim();
+    const rationale = text(value.rationale, 'Template revision reason', 400).trim();
+    if (!applicability || !rationale)
+        throw new TypeError('Template applicability and revision reason must not be empty.');
+    return { parentTemplateId: value.parentTemplateId, parentContentSha256: value.parentContentSha256, lessonContentSha256: value.lessonContentSha256,
+        canonicalization: SORTED_JSON_V2, applicability, rationale };
+}
 function record(value) {
     return ordinaryWorkspaceRecord(value, 'Investigation-template input');
 }
@@ -17,11 +36,13 @@ function template(raw) {
     const snapshot = normalizeInvestigationGuideTemplateSnapshot(value);
     const createdAt = timestamp(value?.createdAt);
     const updatedAt = timestamp(value?.updatedAt);
+    const lessonRevision = readTemplateLessonRevision(value?.lessonRevision);
     return snapshot && createdAt && updatedAt
-        ? { ...snapshot, createdAt, updatedAt }
+        ? { ...snapshot, createdAt, updatedAt, ...(lessonRevision ? { lessonRevision } : {}) }
         : null;
 }
 export function normalizeInvestigationTemplate(raw) {
+    assertWorkspaceInputGraph(raw, 'Investigation template');
     return template(raw);
 }
 export function normalizeInvestigationTemplateStore(raw) {
@@ -33,6 +54,9 @@ export function normalizeInvestigationTemplateStore(raw) {
         throw new Error(`Investigation-template schema ${String(value.version)} is unsupported; no data was changed.`);
     }
     const source = Array.isArray(raw) ? raw : Array.isArray(value?.templates) ? value.templates : [];
+    if (value?.version === 2 && source.some(candidate => record(candidate)?.lessonRevision !== undefined)) {
+        throw new Error('Template revision provenance requires schema 3; no data was changed.');
+    }
     const templates = [];
     const seen = new Set();
     for (const candidate of source.slice(0, MAX_INVESTIGATION_TEMPLATES * 2)) {

package/packages/workspace/page-baseline.mjs

@@ -2,8 +2,8 @@
 // deliberately accepts only bounded, normalized page-identity fields. Raw
 // HTML, URLs, headers, redirect inventories, and parser diagnostics never
 // cross this storage boundary.
-import { normalizeDomain } from "../cases/case-model.mjs";
-import { isInformativePerceptualHash as isInformativeFaviconHash } from "../../lib/perceptual-hash-comparison.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { isInformativePerceptualHash as isInformativeFaviconHash } from "../analysis/perceptual-hash-comparison.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { PAGE_FINGERPRINT_TOKEN_LIMITS } from "../contracts/page-fingerprints.mjs";
 import { MAX_BASELINE_IDENTIFIERS, MAX_BASELINE_RESOURCE_HOSTS, MAX_BASELINE_TITLE_LENGTH, PAGE_BASELINE_VERSION, PAGE_FINGERPRINT_PARSERS, PAGE_IDENTITY_VERSION, } from "../contracts/workspace-portability.mjs";

package/packages/workspace/relationship-observation-model.mjs

@@ -1,7 +1,7 @@
-import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
-import { RELATIONSHIP_EVIDENCE_VERSION } from "../contracts/offline-comparison.mjs";
-import { RELATIONSHIP_TYPES, qualifyRelationshipSources } from "../comparison/relationship-provenance.mjs";
+import { RELATIONSHIP_EVIDENCE_VERSION, RELATIONSHIP_SOURCE_PROVENANCE_VERSION, RELATIONSHIP_PUBLIC_ADDRESS_VERSION } from "../contracts/offline-comparison.mjs";
+import { RELATIONSHIP_TYPES, qualifyRelationshipSources, isNonPublicAddressRelationship, NON_PUBLIC_RELATIONSHIP_LIMITATION, FAVICON_RELATIONSHIP_DESCRIPTION } from "../comparison/relationship-provenance.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { MAX_RELATIONSHIP_OBSERVATIONS, MAX_RELATIONSHIP_OBSERVATION_DOMAINS, MAX_RELATIONSHIP_OBSERVATION_INPUTS, MAX_RELATIONSHIP_OBSERVATION_LIMITATIONS, MAX_RELATIONSHIP_OBSERVATION_STORE_BYTES, MAX_RELATIONSHIP_OBSERVATION_VALUE_LENGTH, RELATIONSHIP_OBSERVATION_SCHEMA, RELATIONSHIP_OBSERVATION_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
 export { MAX_RELATIONSHIP_OBSERVATIONS, MAX_RELATIONSHIP_OBSERVATION_DOMAINS, MAX_RELATIONSHIP_OBSERVATION_INPUTS, MAX_RELATIONSHIP_OBSERVATION_LIMITATIONS, MAX_RELATIONSHIP_OBSERVATION_STORE_BYTES, MAX_RELATIONSHIP_OBSERVATION_VALUE_LENGTH, RELATIONSHIP_OBSERVATION_SCHEMA, RELATIONSHIP_OBSERVATION_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
@@ -34,9 +34,9 @@ const TYPE_METADATA = Object.freeze({
         description: 'These pages exposed the same recognised public tracking identifier in bounded static HTML.',
     }),
     favicon: Object.freeze({
-        label: 'Similar favicon',
+        label: 'Connected favicon matches',
         method: 'Exact SHA-256 or perceptual dHash distance ≤ 6',
-        description: 'These domains used an identical or perceptually similar favicon in the retained scan.',
+        description: FAVICON_RELATIONSHIP_DESCRIPTION,
     }),
     official_asset: Object.freeze({
         label: 'Official asset host match',
@@ -234,16 +234,17 @@ export function normalizeRelationshipObservation(raw, sourceStoreVersion = RELAT
         throw new TypeError('This retained relationship uses a newer source-evidence version; no evidence was interpreted.');
     if (sourceStoreVersion === 1 && sourceVersion > 2)
         throw new TypeError('Relationship schema 1 cannot contain newer source evidence; no evidence was interpreted.');
-    const qualified = qualifyRelationshipSources(sourceVersion === RELATIONSHIP_EVIDENCE_VERSION ? value.sourceEvidence : [], domains, { truncated: value.truncated === true, type });
+    const qualified = qualifyRelationshipSources(sourceVersion >= RELATIONSHIP_SOURCE_PROVENANCE_VERSION ? value.sourceEvidence : [], domains, { truncated: value.truncated === true, type });
+    const nonPublicAddress = isNonPublicAddressRelationship(type, normalizedValue);
     return {
         id,
         type,
-        label: metadata.label,
+        label: nonPublicAddress ? 'Shared non-public DNS answer' : metadata.label,
         method: metadata.method,
         normalizedValue,
         displayValue: type === 'favicon' ? '' : normalizedValue,
         domains,
-        description: metadata.description,
+        description: nonPublicAddress ? NON_PUBLIC_RELATIONSHIP_LIMITATION : metadata.description,
         classification: 'derived',
         source: 'bulk_relationship_analysis',
         sourceVersion,
@@ -255,7 +256,7 @@ export function normalizeRelationshipObservation(raw, sourceStoreVersion = RELAT
         complete: value.complete === true && qualified.complete,
         truncated: qualified.truncated
             || (Array.isArray(value.domains) && value.domains.length > MAX_RELATIONSHIP_OBSERVATION_DOMAINS),
-        limitations: observationLimitations(value.limitations),
+        limitations: observationLimitations([...(nonPublicAddress ? [NON_PUBLIC_RELATIONSHIP_LIMITATION] : []), ...(Array.isArray(value.limitations) ? value.limitations : [])]),
     };
 }
 export function normalizeRelationshipObservationStore(raw) {
@@ -296,7 +297,10 @@ export function createRelationshipObservation(raw, options = {}) {
     const sourceVersion = Object.hasOwn(options, 'sourceVersion') ? positiveInteger(options.sourceVersion) : RELATIONSHIP_EVIDENCE_VERSION;
     if (!sourceVersion || sourceVersion > RELATIONSHIP_EVIDENCE_VERSION)
         throw new TypeError('This relationship needs a supported source-evidence version.');
-    const qualified = qualifyRelationshipSources(sourceVersion === RELATIONSHIP_EVIDENCE_VERSION ? raw.sourceEvidence : [], domains, { truncated: options.truncated === true, type });
+    const nonPublicAddress = isNonPublicAddressRelationship(type, normalizedValue);
+    if (nonPublicAddress && sourceVersion >= RELATIONSHIP_PUBLIC_ADDRESS_VERSION)
+        throw new TypeError('Non-public DNS answers cannot be retained as new public-infrastructure relationships.');
+    const qualified = qualifyRelationshipSources(sourceVersion >= RELATIONSHIP_SOURCE_PROVENANCE_VERSION ? raw.sourceEvidence : [], domains, { truncated: options.truncated === true, type });
     // Older callers can supply their original scan timestamp. It does not
     // qualify the missing source metadata, and an explicit current projection
     // never substitutes that timestamp for unknown contributing-source times.
@@ -308,12 +312,12 @@ export function createRelationshipObservation(raw, options = {}) {
     return {
         id: observationId(canonical),
         type,
-        label: metadata.label,
+        label: nonPublicAddress ? 'Shared non-public DNS answer' : metadata.label,
         method: metadata.method,
         normalizedValue,
         displayValue: type === 'favicon' ? '' : normalizedValue,
         domains,
-        description: metadata.description,
+        description: nonPublicAddress ? NON_PUBLIC_RELATIONSHIP_LIMITATION : metadata.description,
         classification: 'derived',
         source: 'bulk_relationship_analysis',
         sourceVersion,
@@ -323,7 +327,7 @@ export function createRelationshipObservation(raw, options = {}) {
         complete: options.complete !== false && qualified.complete,
         truncated: qualified.truncated
             || (Array.isArray(raw.domains) && raw.domains.length > MAX_RELATIONSHIP_OBSERVATION_DOMAINS),
-        limitations: observationLimitations(options.limitations),
+        limitations: observationLimitations([...(nonPublicAddress ? [NON_PUBLIC_RELATIONSHIP_LIMITATION] : []), ...(Array.isArray(options.limitations) ? options.limitations : [])]),
     };
 }
 function byteLength(value) {

package/packages/workspace/shortlist-model.mjs

@@ -2,8 +2,8 @@
 // and downloads; this module owns schema migration, record normalization,
 // import merging, and exact serialized-byte accounting.
 import { compactWatchlistResults } from "./watchlist-history.mjs";
-import { normalizeOpportunityModelVersion } from "../../lib/opportunity-scoring.mjs";
-import { normalizeRiskModelVersion } from "../../lib/risk-scoring.mjs";
+import { normalizeOpportunityModelVersion } from "../analysis/opportunity-scoring.mjs";
+import { normalizeRiskModelVersion } from "../analysis/risk-scoring.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { MAX_SHORTLIST_ENTRIES, MAX_SHORTLIST_FACTORS, MAX_SHORTLIST_INPUTS, MAX_SHORTLIST_STORE_BYTES, SHORTLIST_SCHEMA, SHORTLIST_SCHEMA_VERSION, SUPPORTED_SHORTLIST_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
@@ -188,14 +188,23 @@ export function mergeShortlistStores(localRaw, importedRaw) {
             skipped++;
             continue;
         }
-        if (imported.has(record.domain))
+        const prior = imported.get(record.domain);
+        if (prior)
             skipped++;
-        imported.set(record.domain, record);
+        if (!prior || Date.parse(record.savedAt) > Date.parse(prior.savedAt))
+            imported.set(record.domain, record);
     }
     let added = 0;
     let updated = 0;
     for (const record of imported.values()) {
-        if (byDomain.has(record.domain))
+        const existing = byDomain.get(record.domain);
+        // A backup must not roll back an observation. Equal-time conflicts retain
+        // the local record rather than choosing whichever file was imported last.
+        if (existing && Date.parse(record.savedAt) <= Date.parse(existing.savedAt)) {
+            skipped++;
+            continue;
+        }
+        if (existing)
             updated++;
         else if (byDomain.size >= MAX_SHORTLIST_ENTRIES) {
             skipped++;

package/packages/workspace/watchlist-history.mjs

@@ -2,11 +2,12 @@
 // the watchlist entry for rescanning, while history stores compact changes
 // against a last-known baseline so browser-local storage does not grow by one complete
 // result set on every check.
-import { explainRiskScore, normalizeRiskModelVersion } from "../../lib/risk-scoring.mjs";
+import { explainRiskScore, normalizeRiskModelVersion } from "../analysis/risk-scoring.mjs";
 import { HTTP_SECURITY_HEADER_TOKENS, normalizeHttpSummary } from "../cases/http-summary.mjs";
-import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { registryDateIso } from "../evidence/registry-dates.mjs";
+import { mergeWebCollectionQuality, normalizeWebCollectionQuality, webCollectionAllowsComparison } from "../evidence/collection-quality.mjs";
 import { MAX_WATCHLIST_CHANGES_PER_EVENT, MAX_WATCHLIST_DOMAINS, MAX_WATCHLIST_HISTORY_DOMAIN_OPTIONS, MAX_WATCHLIST_HISTORY_EVENTS, MAX_WATCHLIST_INPUT_RECORDS, MAX_WATCHLIST_MUTATION_TYPES, MAX_WATCHLIST_NAMESERVERS, } from "../contracts/workspace-portability.mjs";
 export { MAX_WATCHLIST_CHANGES_PER_EVENT, MAX_WATCHLIST_DOMAINS, MAX_WATCHLIST_HISTORY_DOMAIN_OPTIONS, MAX_WATCHLIST_HISTORY_EVENTS, MAX_WATCHLIST_INPUT_RECORDS, MAX_WATCHLIST_MUTATION_TYPES, MAX_WATCHLIST_NAMESERVERS, } from "../contracts/workspace-portability.mjs";
 const MAX_TEXT_LENGTH = 300;
@@ -145,9 +146,6 @@ function boundedText(value, maximum = MAX_TEXT_LENGTH, allowNull = true) {
     const normalized = value.slice(0, maximum * 4).replace(/\s+/g, ' ').trim().slice(0, maximum).trim();
     return normalized || (allowNull ? null : '');
 }
-function isoTimestamp(value, fallback = new Date(0).toISOString()) {
-    return normalizeExplicitIsoTimestamp(value) ?? fallback;
-}
 function boundedInteger(value, maximum, fallback = 0) {
     return Number.isSafeInteger(value) && Number(value) >= 0 && Number(value) <= maximum
         ? Number(value)
@@ -205,11 +203,14 @@ function compactRecord(value) {
     if (!domain)
         return null;
     const scanDepth = inferredScanDepth(record);
+    const webCollectionQuality = normalizeWebCollectionQuality(record.webCollectionQuality, scanDepth);
     const httpSummary = normalizeHttpSummary(record) || {};
     const providedRiskScore = typeof record.riskScore === 'number' && Number.isFinite(record.riskScore)
         ? Math.max(0, Math.min(100, Math.round(record.riskScore)))
         : null;
-    const computedRisk = scanDepth === 'deep' && providedRiskScore === null ? explainRiskScore(record) : null;
+    const computedRisk = scanDepth === 'deep' && providedRiskScore === null
+        && (!webCollectionQuality || (record.riskScore === undefined
+            && webCollectionAllowsComparison('riskScore', webCollectionQuality, scanDepth))) ? explainRiskScore(record) : null;
     const riskScore = scanDepth === 'deep' ? (providedRiskScore ?? computedRisk?.score ?? null) : null;
     const riskModelVersion = riskScore === null
         ? null
@@ -219,6 +220,7 @@ function compactRecord(value) {
     return {
         domain,
         scanDepth,
+        ...(webCollectionQuality ? { webCollectionQuality } : {}),
         availability: hasString(AVAILABILITY_VALUES, record.availability) ? record.availability : null,
         registrarName: boundedText(record.registrarName),
         nameservers: normalizeNameservers(record.nameservers),
@@ -260,6 +262,8 @@ export function compactWatchlistResults(results) {
 function isComparable(field, value, record) {
     if (DEEP_FIELDS.has(field) && record.scanDepth !== 'deep')
         return false;
+    if (!webCollectionAllowsComparison(field, record.webCollectionQuality, record.scanDepth))
+        return false;
     if (field === 'availability')
         return hasString(CONCLUSIVE_AVAILABILITY, value);
     if (field === 'nameservers')
@@ -358,7 +362,7 @@ export function mergeWatchlistBaseline(baseline, current) {
     return current.map((next) => {
         const previous = previousByDomain.get(next.domain);
         const updated = {
-            ...(previous || {}),
+            ...(previous || next),
             domain: next.domain,
             scanDepth: previous?.scanDepth === 'deep' || next.scanDepth === 'deep' ? 'deep' : 'fast',
         };
@@ -370,9 +374,12 @@ export function mergeWatchlistBaseline(baseline, current) {
         // mean "unversioned" to the comparator, but retaining the key makes the
         // stored/exported contract unambiguous and prevents consumers from having
         // to infer why a score was deliberately excluded from comparison.
-        if (next.scanDepth === 'deep' && typeof next.riskScore === 'number') {
+        if (next.scanDepth === 'deep' && typeof next.riskScore === 'number' && isComparable('riskScore', next.riskScore, next)) {
             updated.riskModelVersion = normalizeRiskModelVersion(next.riskModelVersion);
         }
+        const quality = mergeWebCollectionQuality(previous?.webCollectionQuality, next.webCollectionQuality);
+        if (quality)
+            updated.webCollectionQuality = quality;
         return updated;
     });
 }
@@ -452,12 +459,13 @@ function normalizeStoredFieldValue(field, value) {
 }
 function initialHistoryEvent(entry, baseline) {
     return {
-        checkedAt: entry.updatedAt || new Date(0).toISOString(),
+        checkedAt: entry.updatedAt,
         mode: 'saved',
         resultCount: Array.isArray(entry.results) ? entry.results.length : baseline.length,
         conclusiveCount: baseline.filter((record) => hasString(CONCLUSIVE_AVAILABILITY, record.availability)).length,
         changeCount: 0,
         omittedChanges: 0,
+        webComparisonLimitedCount: limitedWebComparisonCount(baseline),
         changes: [],
     };
 }
@@ -480,7 +488,7 @@ export function normalizeWatchlistEntry(entry) {
                 : [];
             const rawMode = event.mode;
             return {
-                checkedAt: isoTimestamp(event.checkedAt, new Date(0).toISOString()),
+                checkedAt: normalizeExplicitIsoTimestamp(event.checkedAt),
                 mode: typeof rawMode === 'string' && ['fast', 'deep', 'saved'].includes(rawMode)
                     ? rawMode
                     : 'saved',
@@ -488,12 +496,14 @@ export function normalizeWatchlistEntry(entry) {
                 conclusiveCount: boundedInteger(event.conclusiveCount, MAX_WATCHLIST_DOMAINS),
                 changeCount: boundedInteger(event.changeCount, MAX_CHANGE_COUNT, changes.length),
                 omittedChanges: boundedInteger(event.omittedChanges, MAX_CHANGE_COUNT),
+                ...(event.webComparisonLimitedCount !== undefined
+                    ? { webComparisonLimitedCount: boundedInteger(event.webComparisonLimitedCount, MAX_WATCHLIST_DOMAINS) } : {}),
                 changes,
             };
         }).slice(-MAX_WATCHLIST_HISTORY_EVENTS)
         : [];
     const normalized = {
-        updatedAt: isoTimestamp(input.updatedAt, new Date(0).toISOString()),
+        updatedAt: normalizeExplicitIsoTimestamp(input.updatedAt),
         results,
         baseline,
         history,
@@ -502,13 +512,18 @@ export function normalizeWatchlistEntry(entry) {
         normalized.history.push(initialHistoryEvent(normalized, baseline));
     return normalized;
 }
+function limitedWebComparisonCount(current, baseline = []) {
+    const previous = new Map(baseline.map(record => [record.domain, record]));
+    return current.filter(record => record.scanDepth === 'deep' && (!webCollectionAllowsComparison('riskScore', record.webCollectionQuality, record.scanDepth)
+        || (previous.has(record.domain) && !webCollectionAllowsComparison('riskScore', previous.get(record.domain).webCollectionQuality, previous.get(record.domain).scanDepth)))).length;
+}
 /**
  * @param {object | null} existingEntry
  * @param {object[]} results
  * @param {{ checkedAt?: string, mode?: string, ignoredDomains?: Set<string> }} [options]
  */
 export function appendWatchlistScan(existingEntry, results, options = {}) {
-    const checkedAt = isoTimestamp(options.checkedAt, new Date().toISOString());
+    const checkedAt = options.checkedAt === undefined ? new Date().toISOString() : normalizeExplicitIsoTimestamp(options.checkedAt);
     const mode = typeof options.mode === 'string' && ['fast', 'deep', 'saved'].includes(options.mode)
         ? options.mode
         : 'saved';
@@ -525,6 +540,7 @@ export function appendWatchlistScan(existingEntry, results, options = {}) {
         conclusiveCount: current.filter((record) => hasString(CONCLUSIVE_AVAILABILITY, record.availability)).length,
         changeCount: changes.length,
         omittedChanges: Math.max(0, changes.length - storedChanges.length),
+        webComparisonLimitedCount: limitedWebComparisonCount(current, previous?.baseline),
         changes: storedChanges,
     };
     const history = [...(previous?.history || []), event].slice(-MAX_WATCHLIST_HISTORY_EVENTS);

package/packages/workspace/watchlist-store.mjs

@@ -4,7 +4,7 @@
 import { MAX_WATCHLIST_DOMAINS, normalizeWatchlistEntry } from "./watchlist-history.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
-import { MAX_WATCHLIST_INPUTS, MAX_WATCHLIST_NAME_LENGTH, MAX_WATCHLISTS, MAX_WATCHLIST_STORE_BYTES, WATCHLIST_SCHEMA, WATCHLIST_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
+import { MAX_WATCHLIST_INPUTS, MAX_WATCHLIST_NAME_LENGTH, MAX_WATCHLISTS, MAX_WATCHLIST_STORE_BYTES, WATCHLIST_SCHEMA, WATCHLIST_SCHEMA_VERSION, WATCHLIST_BROWSER_SUPPORTED_VERSIONS, WATCHLIST_EXPORT_SUPPORTED_VERSIONS, } from "../contracts/workspace-portability.mjs";
 export { MAX_WATCHLIST_INPUTS, MAX_WATCHLIST_NAME_LENGTH, MAX_WATCHLISTS, MAX_WATCHLIST_STORE_BYTES, WATCHLIST_SCHEMA, WATCHLIST_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
 const BLOCKED_NAMES = new Set(['__proto__', 'prototype', 'constructor']);
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
@@ -39,12 +39,21 @@ export function watchlistStoreVersion(raw) {
 function defineEntry(target, name, entry) {
     Object.defineProperty(target, name, { value: entry, writable: true, enumerable: true, configurable: true });
 }
+function assertHistoricalQuality(entry, version) {
+    if (version !== 2)
+        return;
+    for (const values of [entry.results, entry.baseline]) {
+        if (Array.isArray(values) && values.some(value => plainRecord(value)?.webCollectionQuality !== undefined)) {
+            throw new TypeError('Web collection quality requires Watchlist schema 3 or later; historical evidence was not reinterpreted.');
+        }
+    }
+}
 export function normalizeWatchlistStore(raw) {
     assertWorkspaceInputGraph(raw, 'Watchlist store');
     const root = plainRecord(raw);
     if (root?.schema === WATCHLIST_SCHEMA)
         assertWorkspaceDeclaredVersion(raw, 'Watchlist store');
-    if (root?.schema === WATCHLIST_SCHEMA && watchlistStoreVersion(root) !== WATCHLIST_SCHEMA_VERSION) {
+    if (root?.schema === WATCHLIST_SCHEMA && !WATCHLIST_BROWSER_SUPPORTED_VERSIONS.includes(Number(watchlistStoreVersion(root)))) {
         throw new Error(`Watchlist schema ${String(root.version)} is unsupported; no data was changed.`);
     }
     const source = watchlistMap(raw);
@@ -56,6 +65,7 @@ export function normalizeWatchlistStore(raw) {
         const entry = plainRecord(rawEntry);
         if (!name || !entry || !Array.isArray(entry.results) || entry.results.length > MAX_WATCHLIST_DOMAINS)
             continue;
+        assertHistoricalQuality(entry, root?.schema === WATCHLIST_SCHEMA ? watchlistStoreVersion(root) : null);
         defineEntry(watchlists, name, normalizeWatchlistEntry(entry));
         if (Object.keys(watchlists).length >= MAX_WATCHLISTS)
             break;
@@ -93,8 +103,8 @@ export function mergeWatchlistStores(localRaw, importedRaw) {
     if (importedVersion !== null && importedVersion > WATCHLIST_SCHEMA_VERSION) {
         throw new Error(`This watchlist file uses newer schema ${importedVersion}. Update the app before importing it.`);
     }
-    if (importedVersion !== WATCHLIST_SCHEMA_VERSION) {
-        throw new Error(`Expected a WHOISleuth watchlist export using schema ${WATCHLIST_SCHEMA_VERSION}.`);
+    if (!WATCHLIST_EXPORT_SUPPORTED_VERSIONS.includes(Number(importedVersion))) {
+        throw new Error('Expected a supported WHOISleuth watchlist export.');
     }
     const local = normalizeWatchlistStore(localRaw).watchlists;
     const source = watchlistMap(importedRaw) || {};
@@ -109,9 +119,11 @@ export function mergeWatchlistStores(localRaw, importedRaw) {
             skipped++;
             continue;
         }
+        assertHistoricalQuality(entry, importedVersion);
         const normalized = normalizeWatchlistEntry(entry);
         if (Object.prototype.hasOwnProperty.call(local, name)) {
-            if (normalized.updatedAt <= local[name].updatedAt) {
+            const localTime = local[name].updatedAt;
+            if (!normalized.updatedAt || !localTime || normalized.updatedAt <= localTime) {
                 skipped++;
                 continue;
             }