@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/packages/workspace/brand-profile-model.mjs

@@ -1,7 +1,7 @@
 // Pure Brand Profile normalization and storage model. The browser wrapper owns
 // persistence and downloads; this module owns schema migration, semantic field
 // bounds, import merging, and exact serialized-byte accounting.
-import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { canonicalDomainControlRecords, normalizeDeclaredDomainControlRecordModes, normalizeDomainControlRecordModes } from "../evidence/domain-control-runtime.mjs";
 import { DOMAIN_CONTROL_RECORD_LIST_FIELDS } from "../contracts/domain-control-manifest.mjs";
@@ -10,7 +10,9 @@ import { MAX_IDENTITY_DIGEST_BYTES, sha256IdentityHex } from "../evidence/record
 import { DOMAIN_POSTURE_COMPARISON_VERSION, MAX_POSTURE_CHECKS, MAX_POSTURE_CHECK_RECORDS, MAX_POSTURE_RECORD_LENGTH, normalizeDomainPostureSourceContext, normalizeDomainPostureProfileContext } from "../evidence/domain-posture-context.mjs";
 import { normalizeOpaqueReferenceId } from "../cases/opaque-reference-id.mjs";
 import { normalizePageBaseline } from "./page-baseline.mjs";
-import { isInformativePerceptualHash as isInformativeFaviconHash } from "../../lib/perceptual-hash-comparison.mjs";
+import { normalizeCandidateObservations, normalizeCandidateExceptions } from "./brand-candidate-workflow.mjs";
+import { normalizeBrandKeywordCampaigns, mergeBrandKeywordCampaigns } from "./brand-keyword-campaign.mjs";
+import { isInformativePerceptualHash as isInformativeFaviconHash } from "../analysis/perceptual-hash-comparison.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_OFFICIAL_CHANNELS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_URL_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, MAX_RIGHTS_REFERENCES, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
 export { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_OFFICIAL_CHANNELS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_URL_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, MAX_RIGHTS_REFERENCES, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
@@ -583,6 +585,9 @@ export function normalizeBrandProfile(raw, options = {}) {
         approvedPartnerDomains: normalizeProfileDomains(value.approvedPartnerDomains),
         allowlistedDomains: normalizeProfileDomains(value.allowlistedDomains),
         allowlistedRegistrars: normalizeProfileTextValues(value.allowlistedRegistrars),
+        candidateObservations: normalizeCandidateObservations(value.candidateObservations),
+        candidateExceptions: normalizeCandidateExceptions(value.candidateExceptions),
+        keywordCampaigns: existing ? mergeBrandKeywordCampaigns(existing.keywordCampaigns, value.keywordCampaigns) : normalizeBrandKeywordCampaigns(value.keywordCampaigns),
         dkimSelectors,
         retiredDkimSelectors: normalizeDkimSelectors(value.retiredDkimSelectors)
             .filter((selector) => !dkimSelectors.includes(selector)),
@@ -602,6 +607,9 @@ export function normalizeBrandProfile(raw, options = {}) {
 const BRAND_PROFILE_FIELD_PATCH_KEYS = Object.freeze([
     'allowlistedDomains',
     'allowlistedRegistrars',
+    'candidateObservations',
+    'candidateExceptions',
+    'keywordCampaigns',
     'desiredPostureBaselines',
     'protectionAttestations',
 ]);
@@ -638,11 +646,24 @@ export function brandProfileStoreVersion(raw) {
     const value = record(raw);
     return typeof value.version === 'number' && Number.isFinite(value.version) && value.version > 0 ? value.version : null;
 }
+function assertHistoricalCandidateFields(raw, version) {
+    if (Array.isArray(raw) || version === null || version >= 11)
+        return;
+    for (const input of profileList(raw).slice(0, MAX_PROFILES * 4)) {
+        const profile = record(input);
+        if (version < 10 && (Object.hasOwn(profile, 'candidateObservations') || Object.hasOwn(profile, 'candidateExceptions'))) {
+            throw new TypeError('Candidate observations and scoped exceptions require Brand Profile schema 10; historical records were not reinterpreted.');
+        }
+        if (Object.hasOwn(profile, 'keywordCampaigns'))
+            throw new TypeError('Keyword campaigns require Brand Profile schema 11; historical records were not reinterpreted.');
+    }
+}
 /** Normalize an internal profile collection or current stored envelope. */
 export function normalizeBrandProfileStore(raw) {
     assertWorkspaceInputGraph(raw, 'Brand Profile store', { maximumBytes: MAX_PROFILE_STORE_BYTES });
     assertWorkspaceDeclaredVersion(raw, 'Brand Profile store');
     const sourceVersion = brandProfileStoreVersion(raw);
+    assertHistoricalCandidateFields(raw, sourceVersion);
     if (!Array.isArray(raw) && sourceVersion !== null
         && !SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS.includes(sourceVersion)) {
         throw new Error(`Brand Profile schema ${sourceVersion} is unsupported; no data was changed.`);
@@ -655,8 +676,8 @@ export function normalizeBrandProfileStore(raw) {
         if (!profile)
             continue;
         const previous = byId.get(profile.id);
-        if (!previous || profile.updatedAt > previous.updatedAt)
-            byId.set(profile.id, profile);
+        const keywordCampaigns = mergeBrandKeywordCampaigns(previous?.keywordCampaigns, profile.keywordCampaigns);
+        byId.set(profile.id, { ...(previous && profile.updatedAt <= previous.updatedAt ? previous : profile), keywordCampaigns });
         if (byId.size >= MAX_PROFILES)
             break;
     }
@@ -691,6 +712,7 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
         throw new Error('Expected a current WHOISleuth Brand Profile export.');
     }
     const importedVersion = brandProfileStoreVersion(importedRaw);
+    assertHistoricalCandidateFields(importedRaw, importedVersion);
     if (importedVersion !== null && importedVersion > BRAND_PROFILE_SCHEMA_VERSION) {
         throw new Error(`This Brand Profile file uses newer schema ${importedVersion}. Update the app before importing it.`);
     }
@@ -727,8 +749,17 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
         if (rawId && rawName)
             retainIdName(rawId, rawName);
         const existing = rawName ? byName.get(rawName.toLowerCase()) : null;
+        if (existing && rawId !== existing.id && ((Array.isArray(value.candidateObservations) && value.candidateObservations.length) || (Array.isArray(value.candidateExceptions) && value.candidateExceptions.length) || (Array.isArray(value.keywordCampaigns) && value.keywordCampaigns.length))) {
+            throw new TypeError('Candidate metadata belongs to another Brand identifier with this name. Rename or review its exact Brand identity before importing; no decisions were reassigned.');
+        }
+        const keywordCampaigns = mergeBrandKeywordCampaigns(existing?.keywordCampaigns, value.keywordCampaigns);
         const incomingUpdatedAt = timestamp(value.updatedAt, null);
         if (existing && (!incomingUpdatedAt || incomingUpdatedAt <= existing.updatedAt)) {
+            if (JSON.stringify(keywordCampaigns) !== JSON.stringify(existing.keywordCampaigns ?? [])) {
+                byName.set(existing.name.toLowerCase(), { ...existing, keywordCampaigns });
+                updated++;
+                continue;
+            }
             skipped++;
             continue;
         }
@@ -742,6 +773,19 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
             skipped++;
             continue;
         }
+        if (existing) {
+            profile.keywordCampaigns = keywordCampaigns;
+            profile.candidateObservations = normalizeCandidateObservations([...existing.candidateObservations, ...profile.candidateObservations]);
+            const exceptions = new Map(existing.candidateExceptions.map(exception => [exception.id, exception]));
+            for (const incoming of profile.candidateExceptions) {
+                const old = exceptions.get(incoming.id);
+                if (old && (old.domain !== incoming.domain || old.ruleKey !== incoming.ruleKey || old.purpose !== incoming.purpose))
+                    throw new Error('An imported exception identifier changes its exact scope or purpose; no profiles were imported.');
+                if (!old || incoming.revision > old.revision)
+                    exceptions.set(incoming.id, incoming);
+            }
+            profile.candidateExceptions = normalizeCandidateExceptions([...exceptions.values()]);
+        }
         retainIdName(profile.id, profile.name);
         if (existing) {
             byName.set(profile.name.toLowerCase(), profile);

package/packages/workspace/bulk-review-model.mjs

@@ -1,4 +1,4 @@
-import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { CASE_DISPOSITIONS as CASE_DISPOSITION_OPTIONS } from "../cases/case-record-contracts.mjs";
 import { BULK_SORT_KEYS, normalizeBulkPresentationSortKey } from "./bulk-sort.mjs";
 import { normalizeBulkResultColumns } from "./bulk-columns.mjs";
@@ -235,37 +235,38 @@ export function mergeBulkReviewStores(localRaw, importedRaw) {
     const rows = new Map(local.rows.map((item) => [item.domain, item]));
     let added = 0;
     let updated = 0;
-    let skipped = 0;
-    for (const candidate of imported.presets) {
-        const existing = presets.get(candidate.id);
-        if (!existing) {
-            presets.set(candidate.id, candidate);
-            added += 1;
-        }
-        else if (candidate.updatedAt > existing.updatedAt) {
-            presets.set(candidate.id, candidate);
-            updated += 1;
-        }
-        else {
+    const supplied = sourceLists(importedRaw);
+    let skipped = supplied.presets.length + supplied.rows.length - imported.presets.length - imported.rows.length;
+    let capacitySkipped = 0;
+    let bytes = byteLength(JSON.stringify(local));
+    if (bytes > MAX_BULK_REVIEW_STORE_BYTES)
+        throw new Error('Existing Bulk review preferences exceed the workspace storage limit; no imported changes were applied.');
+    function admit(target, key, candidate, maximum) {
+        const existing = target.get(key);
+        if (existing && candidate.updatedAt <= existing.updatedAt) {
             skipped += 1;
+            return;
         }
-    }
-    for (const candidate of imported.rows) {
-        const existing = rows.get(candidate.domain);
-        if (!existing) {
-            rows.set(candidate.domain, candidate);
-            added += 1;
-        }
-        else if (candidate.updatedAt > existing.updatedAt) {
-            rows.set(candidate.domain, candidate);
-            updated += 1;
-        }
-        else {
+        const delta = byteLength(JSON.stringify(candidate)) - (existing ? byteLength(JSON.stringify(existing)) : 0)
+            + (!existing && target.size ? 1 : 0);
+        if ((!existing && target.size >= maximum) || bytes + delta > MAX_BULK_REVIEW_STORE_BYTES) {
             skipped += 1;
+            capacitySkipped += 1;
+            return;
         }
+        target.set(key, candidate);
+        bytes += delta;
+        if (existing)
+            updated += 1;
+        else
+            added += 1;
     }
+    for (const candidate of imported.presets)
+        admit(presets, candidate.id, candidate, MAX_BULK_REVIEW_PRESETS);
+    for (const candidate of imported.rows)
+        admit(rows, candidate.domain, candidate, MAX_BULK_REVIEW_ROWS);
     return {
-        store: enforceBulkReviewBudget({
+        store: normalizeBulkReviewStore({
             schema: BULK_REVIEW_SCHEMA,
             version: BULK_REVIEW_SCHEMA_VERSION,
             presets: [...presets.values()],
@@ -274,5 +275,6 @@ export function mergeBulkReviewStores(localRaw, importedRaw) {
         added,
         updated,
         skipped,
+        reason: capacitySkipped ? `${capacitySkipped} imported Bulk review records did not fit the remaining storage capacity. Existing local records are preserved.` : '',
     };
 }

package/packages/workspace/bulk-session-model.mjs

@@ -1,10 +1,11 @@
 // Pure, bounded persistence model for analyst-saved Bulk investigations.
 // Sessions retain compact derived rows and source states, never raw registry,
 // WHOIS, HTTP, TLS, page, or provider payloads.
-import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { normalizeCaaCritical } from "./dns-record-normalization.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
-import { RELATIONSHIP_EVIDENCE_VERSION } from "../contracts/offline-comparison.mjs";
+import { normalizeWebCollectionQuality, webCollectionAllowsComparison } from "../evidence/collection-quality.mjs";
+import { RELATIONSHIP_EVIDENCE_VERSION, RELATIONSHIP_SOURCE_PROVENANCE_VERSION, SUPPORTED_RELATIONSHIP_EVIDENCE_VERSIONS } from "../contracts/offline-comparison.mjs";
 import { normalizeRelationshipSourceProjection } from "../comparison/relationship-provenance.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { BULK_SESSION_SCHEMA, BULK_SESSION_SCHEMA_VERSION, MAX_BULK_PROFILE_CONTEXT_LIMITATION_LENGTH, MAX_BULK_SESSIONS, MAX_BULK_SESSION_ARRAY_VALUES, MAX_BULK_SESSION_NAME_LENGTH, MAX_BULK_SESSION_ROWS, MAX_BULK_SESSION_SOURCES, MAX_BULK_SESSION_STORE_BYTES, MAX_BULK_SESSION_TEXT_LENGTH, SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
@@ -94,7 +95,7 @@ export function normalizeBulkProfileContext(value, fallbackLimitation = BULK_PRO
     }
     return unavailableBulkProfileContext(profileContextLimitation(item?.limitation, fallbackLimitation));
 }
-function sameProfileContext(left, right) {
+export function bulkProfileContextsMatch(left, right) {
     return left.sourceState === right.sourceState
         && left.activeProfileId === right.activeProfileId
         && left.profileUpdatedAt === right.profileUpdatedAt
@@ -104,7 +105,7 @@ export function summarizeBulkProfileContexts(rows) {
     const first = rows[0]?.profileContext;
     if (!first)
         return unavailableBulkProfileContext('This saved Bulk session contains no settled row with profile-context provenance.');
-    if (rows.every((row) => sameProfileContext(first, row.profileContext)))
+    if (rows.every((row) => bulkProfileContextsMatch(first, row.profileContext)))
         return { ...first };
     return {
         sourceState: 'mixed',
@@ -200,7 +201,7 @@ function nullableHash(value, expression) {
 }
 function normalizeRelationship(value) {
     const item = record(value);
-    if (item?.version !== undefined && item.version !== 2 && item.version !== RELATIONSHIP_EVIDENCE_VERSION) {
+    if (item?.version !== undefined && !SUPPORTED_RELATIONSHIP_EVIDENCE_VERSIONS.some(version => version === item.version)) {
         throw new TypeError('This Bulk relationship projection uses an unsupported version. No source evidence was interpreted.');
     }
     return {
@@ -212,7 +213,7 @@ function normalizeRelationship(value) {
         faviconHash: nullableHash(item?.faviconHash, HASH_64_RE),
         faviconPHash: nullableHash(item?.faviconPHash, PHASH_RE),
         certificateFingerprint: nullableHash(item?.certificateFingerprint, HASH_64_RE),
-        sourceEvidence: item?.version === RELATIONSHIP_EVIDENCE_VERSION ? normalizeRelationshipSourceProjection(item.sourceEvidence) : {},
+        sourceEvidence: Number(item?.version) >= RELATIONSHIP_SOURCE_PROVENANCE_VERSION ? normalizeRelationshipSourceProjection(item?.sourceEvidence) : {},
         truncated: item?.truncated === true,
     };
 }
@@ -304,6 +305,7 @@ export function normalizeBulkSessionResult(value, inheritedProfileContext) {
     const profileClaimsUsable = profileContextReady && !impossibleNoProfileClaim;
     if (!profileClaimsUsable || readyWithoutActiveProfile)
         relationship.officialAssetHosts = [];
+    const webCollectionQuality = normalizeWebCollectionQuality(item.webCollectionQuality, scanDepth);
     return {
         domain,
         status: status,
@@ -317,6 +319,7 @@ export function normalizeBulkSessionResult(value, inheritedProfileContext) {
         trusted: profileClaimsUsable && !readyWithoutActiveProfile && TRUST_STATES.has(trusted) ? trusted : null,
         error: boundedText(item.error),
         scanDepth: scanDepth,
+        ...(webCollectionQuality ? { webCollectionQuality } : {}),
         observedAt: normalizeExplicitIsoTimestamp(item.observedAt),
         createdDate: boundedText(item.createdDate, 64) || null,
         expiryDate: boundedText(item.expiryDate, 64) || null,
@@ -335,6 +338,7 @@ export function normalizeBulkSessionResult(value, inheritedProfileContext) {
         reusesOfficialAssets: profileClaimsUsable ? nullableBoolean(item.reusesOfficialAssets) : null,
         hasPasswordField: item.hasPasswordField === true,
         hasExternalFormAction: nullableBoolean(item.hasExternalFormAction),
+        hasExternalPasswordForm: nullableBoolean(item.hasExternalPasswordForm),
         phishingLanguageMatch: boundedText(item.phishingLanguageMatch, 300) || null,
         idnReferenceMatch: profileClaimsUsable ? nullableBoolean(item.idnReferenceMatch) : null,
         pageBaselineMatch: profileClaimsUsable ? nullableBoolean(item.pageBaselineMatch) : null,
@@ -381,7 +385,7 @@ export function normalizeBulkSession(value, sourceStoreVersion) {
     // Only an explicitly versioned current document may omit identical row
     // context. Bare runtime rows and public schema 4 must carry their own context;
     // an explicit invalid/null row value never falls back to the session.
-    const inheritedProfileContext = sourceStoreVersion === 5
+    const inheritedProfileContext = sourceStoreVersion !== undefined && sourceStoreVersion >= 5
         && declaredProfileContext.sourceState !== 'mixed'
         && rawProfileContext.sourceState === declaredProfileContext.sourceState
         ? declaredProfileContext
@@ -390,8 +394,14 @@ export function normalizeBulkSession(value, sourceStoreVersion) {
     const results = [];
     const seen = new Set();
     for (const candidate of Array.isArray(item.results) ? item.results.slice(0, MAX_BULK_SESSION_ROWS * 2) : []) {
+        if (sourceStoreVersion !== undefined && sourceStoreVersion < 7 && Object.hasOwn(record(candidate) ?? {}, 'hasExternalPasswordForm')) {
+            throw new TypeError('Form attribution requires Bulk schema 7 or later; historical evidence was not reinterpreted.');
+        }
+        if (sourceStoreVersion !== undefined && sourceStoreVersion < 6 && record(candidate)?.webCollectionQuality !== undefined) {
+            throw new TypeError('Web collection quality requires Bulk schema 6 or later; historical evidence was not reinterpreted.');
+        }
         const publicLegacyRow = sourceStoreVersion === 4;
-        if (publicLegacyRow && record(record(candidate)?.relationship)?.version === RELATIONSHIP_EVIDENCE_VERSION) {
+        if (publicLegacyRow && Number(record(record(candidate)?.relationship)?.version) >= RELATIONSHIP_SOURCE_PROVENANCE_VERSION) {
             throw new TypeError('Bulk schema 4 cannot contain newer relationship source evidence; no evidence was interpreted.');
         }
         const result = normalizeBulkSessionResult(candidate, inheritedProfileContext);
@@ -411,7 +421,7 @@ export function normalizeBulkSession(value, sourceStoreVersion) {
     if ((state === 'complete') !== (results.length === domains.length))
         return null;
     const profileContext = summarizeBulkProfileContexts(results);
-    if (!sameProfileContext(declaredProfileContext, profileContext))
+    if (!bulkProfileContextsMatch(declaredProfileContext, profileContext))
         return null;
     return {
         id,
@@ -471,7 +481,7 @@ export function normalizeBulkSessionStore(raw) {
 export function bulkSessionStorageValue(session) {
     return {
         ...session,
-        results: session.results.map(({ profileContext, ...row }) => sameProfileContext(profileContext, session.profileContext)
+        results: session.results.map(({ profileContext, ...row }) => bulkProfileContextsMatch(profileContext, session.profileContext)
             ? row
             : { ...row, profileContext }),
     };
@@ -558,8 +568,10 @@ function sourceStateMap(value) {
 export function areBulkRiskScoresComparable(previous, current) {
     return previous.profileContext.sourceState === 'ready'
         && current.profileContext.sourceState === 'ready'
-        && sameProfileContext(previous.profileContext, current.profileContext)
+        && bulkProfileContextsMatch(previous.profileContext, current.profileContext)
         && previous.scanDepth === current.scanDepth
+        && webCollectionAllowsComparison('riskScore', previous.webCollectionQuality, previous.scanDepth)
+        && webCollectionAllowsComparison('riskScore', current.webCollectionQuality, current.scanDepth)
         && previous.risk !== null
         && current.risk !== null
         && previous.riskModelVersion !== null
@@ -574,7 +586,9 @@ function resultChanges(previous, current) {
     }
     if (previous.registrar !== current.registrar)
         changes.push(`Registrar: ${previous.registrar} → ${current.registrar}`);
-    if (previous.activity !== current.activity)
+    if (previous.activity !== current.activity
+        && webCollectionAllowsComparison('activityStatus', previous.webCollectionQuality, previous.scanDepth)
+        && webCollectionAllowsComparison('activityStatus', current.webCollectionQuality, current.scanDepth))
         changes.push(`Website: ${previous.activity} → ${current.activity}`);
     const previousComparison = previous.comparisonEvidence;
     const currentComparison = current.comparisonEvidence;
@@ -644,7 +658,7 @@ export function compareBulkSessions(baselineRaw, currentRaw) {
             'A source-state change may reflect collection availability rather than a change to the domain.',
             'A missing row means it was not completed in that saved session; it does not establish domain removal.',
             ...(riskIncomparable
-                ? ['Risk deltas are omitted unless both rows retain the same ready Brand Profile provenance, scan depth, and versioned Risk model.']
+                ? ['Risk deltas are omitted unless both rows retain the same ready Brand Profile provenance, scan depth, versioned Risk model and complete web collection for Deep observations.']
                 : []),
         ],
     };

package/packages/workspace/campaign-model.mjs

@@ -1,7 +1,7 @@
 // Pure, framework-neutral browser-local campaign model. Campaigns deliberately
 // reference normalized case domains rather than copying case evidence, notes,
 // or mutable case ids. The browser wrapper owns persistence and downloads.
-import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { CAMPAIGN_SCHEMA, CAMPAIGN_SCHEMA_VERSION, MAX_CAMPAIGNS, MAX_CAMPAIGN_DESCRIPTION_LENGTH, MAX_CAMPAIGN_DOMAINS, MAX_CAMPAIGN_INPUT_RECORDS, MAX_CAMPAIGN_NAME_LENGTH, MAX_CAMPAIGN_STORE_BYTES, } from "../contracts/workspace-portability.mjs";

package/packages/workspace/candidate-watch-handoff.mjs

@@ -0,0 +1,195 @@
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceInputGraph } from "./hostile-input.mjs";
+import { MAX_WATCHLISTS, normalizeWatchlistName, normalizeWatchlistStore, assertWatchlistStoreBudget, } from "./watchlist-store.mjs";
+import { MAX_WATCHLIST_DOMAINS } from "../contracts/workspace-portability.mjs";
+import { assertWatchlistEditable } from "./watchlist-history.mjs";
+import { MAX_WATCH_CONTEXTS, WATCH_PRIORITIES, mergeWatchDomainMetadata, normalizeCandidateObservation, candidateMaterialFingerprint, } from "./brand-candidate-workflow.mjs";
+function admitInput(input) {
+    assertWorkspaceInputGraph(input, 'Candidate watch handoff');
+    if (!normalizeWatchlistName(input.name))
+        throw new TypeError('Choose a safe watchlist name containing 1–100 characters.');
+    if (!Array.isArray(input.candidates) || input.candidates.length > MAX_WATCHLIST_DOMAINS)
+        throw new RangeError(`Select at most ${MAX_WATCHLIST_DOMAINS} candidate domains.`);
+    if (input.brandProfileId !== null &&
+        (typeof input.brandProfileId !== 'string' ||
+            !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(input.brandProfileId)))
+        throw new TypeError('The Brand context identifier is invalid.');
+    if (!WATCH_PRIORITIES.some((option) => option.value === input.priority))
+        throw new TypeError('Choose an admitted review priority.');
+    if (typeof input.reason !== 'string' ||
+        /[\u0000-\u001f\u007f]/u.test(input.reason) ||
+        input.reason.trim().length > 300 ||
+        !input.reason.trim())
+        throw new TypeError('Enter a watch reason containing 1–300 characters and no control characters.');
+    if (input.reviewDueAt != null && !normalizeExplicitIsoTimestamp(input.reviewDueAt))
+        throw new TypeError('Use a valid explicit review time. A review time is not a scan schedule.');
+    if (input.replaceExistingContext !== undefined &&
+        typeof input.replaceExistingContext !== 'boolean')
+        throw new TypeError('Existing-context replacement must be selected explicitly.');
+    return {
+        ...input,
+        name: normalizeWatchlistName(input.name),
+        reason: input.reason.trim(),
+        reviewDueAt: normalizeExplicitIsoTimestamp(input.reviewDueAt),
+    };
+}
+/** Pure exact-domain preview. It grants no collection authority and makes no requests. */
+export function planCandidateWatchHandoff(localRaw, rawInput) {
+    const input = admitInput(rawInput), local = normalizeWatchlistStore(localRaw).watchlists;
+    const name = Object.keys(local).find((name) => name.toLowerCase() === input.name.toLowerCase()) ??
+        input.name;
+    const entry = local[name], existing = new Map(entry?.domainMetadata.map((record) => [record.domain, record]) ?? []);
+    assertWatchlistEditable(entry);
+    const seen = new Set(), rows = [];
+    let admitted = existing.size;
+    for (const raw of input.candidates) {
+        const candidate = normalizeCandidateObservation(raw), domain = candidate?.domain ?? normalizeDomain(raw?.domain) ?? '';
+        let reason = '';
+        if (!candidate || !domain)
+            reason = 'Invalid candidate domain or provenance.';
+        else if (seen.has(domain))
+            reason = 'Repeated selection; the first exact domain is retained.';
+        else if (!entry && Object.keys(local).length >= MAX_WATCHLISTS)
+            reason = 'Watchlist count capacity is exhausted.';
+        else if (!existing.has(domain) && admitted >= MAX_WATCHLIST_DOMAINS)
+            reason = 'Domain capacity is exhausted.';
+        else if (existing.get(domain)?.contexts.length === MAX_WATCH_CONTEXTS &&
+            !existing
+                .get(domain)
+                ?.contexts.some((context) => context.brandProfileId === input.brandProfileId))
+            reason = 'This domain has reached its separate-context capacity.';
+        seen.add(domain);
+        const previousContext = existing
+            .get(domain)
+            ?.contexts.find((context) => context.brandProfileId === input.brandProfileId) ?? null;
+        const materialFingerprint = candidate
+            ? candidateMaterialFingerprint(candidate, input.brandProfileId ?? '')
+            : null;
+        if (reason)
+            rows.push({ domain, state: 'rejected', reason, previousContext, materialFingerprint });
+        else {
+            const context = existing
+                .get(domain)
+                ?.contexts.find((context) => context.brandProfileId === input.brandProfileId);
+            rows.push({
+                domain,
+                state: existing.has(domain) ? 'existing' : 'add',
+                previousContext,
+                materialFingerprint,
+                reason: context
+                    ? input.replaceExistingContext
+                        ? `Explicitly replace this context (${context.priority}) with ${input.priority}; preserve evidence and other Brand contexts.`
+                        : `Preserve existing deliberate ${context.priority} priority and reason; merge provenance only.`
+                    : existing.has(domain)
+                        ? 'Already tracked; add this separate Brand context, preserving other contexts.'
+                        : 'Add metadata only; no scan or baseline is invented.',
+            });
+            if (!existing.has(domain))
+                admitted++;
+        }
+    }
+    return {
+        destination: name,
+        brandProfileId: input.brandProfileId,
+        priority: input.priority,
+        reason: input.reason,
+        reviewDueAt: input.reviewDueAt ?? null,
+        replaceExistingContext: input.replaceExistingContext ?? false,
+        rows,
+        additionalRequests: 0,
+        collectionAuthorised: false,
+    };
+}
+export function applyCandidateWatchHandoff(localRaw, rawInput, nowRaw) {
+    const input = admitInput(rawInput), now = normalizeExplicitIsoTimestamp(nowRaw);
+    if (!now)
+        throw new TypeError('The watch metadata change time must use an explicit timezone.');
+    if (input.reviewDueAt && input.reviewDueAt <= now)
+        throw new TypeError('The review time must be later than this change time.');
+    const local = normalizeWatchlistStore(localRaw).watchlists, plan = planCandidateWatchHandoff(local, input);
+    const candidates = new Map();
+    for (const raw of input.candidates) {
+        const candidate = normalizeCandidateObservation(raw);
+        if (candidate && !candidates.has(candidate.domain))
+            candidates.set(candidate.domain, candidate);
+    }
+    const context = {
+        brandProfileId: input.brandProfileId,
+        priority: input.priority,
+        reason: input.reason,
+        changedAt: now,
+        reviewDueAt: input.reviewDueAt ?? null,
+    };
+    const entry = local[plan.destination] ?? {
+        updatedAt: null,
+        results: [],
+        baseline: [],
+        history: [],
+        domainMetadata: [],
+    };
+    if (input.replaceExistingContext &&
+        plan.rows.some((row) => row.state !== 'rejected' &&
+            row.previousContext?.changedAt &&
+            now <= row.previousContext.changedAt))
+        throw new Error('The change clock does not follow the retained context. Review the clock before replacing a manual priority.');
+    const metadata = plan.rows
+        .filter((row) => row.state !== 'rejected')
+        .map((row) => ({
+        domain: row.domain,
+        contexts: !input.replaceExistingContext &&
+            entry.domainMetadata.some((record) => record.domain === row.domain &&
+                record.contexts.some((old) => old.brandProfileId === input.brandProfileId))
+            ? []
+            : [context],
+        candidate: candidates.get(row.domain) ?? null,
+    }));
+    if (!metadata.length)
+        return { watchlists: local, plan };
+    Object.defineProperty(local, plan.destination, {
+        value: { ...entry, domainMetadata: mergeWatchDomainMetadata(entry.domainMetadata, metadata) },
+        enumerable: true,
+        configurable: true,
+        writable: true,
+    });
+    return { watchlists: assertWatchlistStoreBudget(local).watchlists, plan };
+}
+/** Field-scoped optimistic edits preserve unrelated domains and contexts. */
+export function setWatchDomainContext(localRaw, name, domainRaw, input, expected) {
+    return setWatchDomainContexts(localRaw, name, [{ domain: domainRaw, input, expected }]);
+}
+export function setWatchDomainContexts(localRaw, name, edits) {
+    if (!Array.isArray(edits) || edits.length > MAX_WATCHLIST_DOMAINS)
+        throw new RangeError('The reviewed metadata edit exceeds its domain bound.');
+    const local = normalizeWatchlistStore(localRaw).watchlists, entry = local[name];
+    if (!entry)
+        throw new Error('The selected watchlist was deleted; nothing was overwritten.');
+    assertWatchlistEditable(entry);
+    const metadata = new Map(entry.domainMetadata.map((record) => [record.domain, record])), seen = new Set();
+    for (const edit of edits) {
+        const domain = normalizeDomain(edit.domain), record = domain ? metadata.get(domain) : null;
+        const key = `${domain}\0${edit.input.brandProfileId ?? ''}`, old = record?.contexts.find((context) => context.brandProfileId === edit.input.brandProfileId) ??
+            null;
+        if (!domain ||
+            !record ||
+            seen.has(key) ||
+            JSON.stringify(old) !== JSON.stringify(edit.expected))
+            throw new Error('A reviewed domain context changed, was repeated or was deleted. Reopen the selection; nothing was overwritten.');
+        const input = admitInput({ name, candidates: [], ...edit.input });
+        const changedAt = normalizeExplicitIsoTimestamp(edit.input.changedAt);
+        if (!changedAt ||
+            (old?.changedAt && changedAt <= old.changedAt) ||
+            (input.reviewDueAt && input.reviewDueAt <= changedAt))
+            throw new TypeError('Use a current change time and a later optional review time.');
+        seen.add(key);
+        metadata.set(domain, {
+            ...record,
+            contexts: [
+                ...record.contexts.filter((context) => context.brandProfileId !== edit.input.brandProfileId),
+                { ...edit.input, reason: input.reason, changedAt, reviewDueAt: input.reviewDueAt ?? null },
+            ],
+        });
+    }
+    local[name] = { ...entry, domainMetadata: [...metadata.values()] };
+    return assertWatchlistStoreBudget(local).watchlists;
+}

package/packages/workspace/detection-rule-model.mjs

@@ -1,10 +1,10 @@
 // Pure browser-local custom detection-rule model. Rules are deliberately a
 // small structured language: field names and operators come from allowlists,
 // so imported rules cannot execute code or reach outside bounded case evidence.
-import { latestCaseEvidence } from "../cases/case-model.mjs";
+import { latestCaseEvidence } from "../cases/case-evidence-model.mjs";
 import { CASE_DISPOSITIONS, CASE_STATUSES } from "../cases/case-record-contracts.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
-import { DETECTION_RULE_SCHEMA, DETECTION_RULE_SCHEMA_VERSION, MAX_CONDITION_VALUE_LENGTH, MAX_CUSTOM_RISK_TOTAL, MAX_DETECTION_RULES, MAX_RULE_CONDITIONS, MAX_RULE_INPUT_RECORDS, MAX_RULE_NAME_LENGTH, MAX_RULE_RISK_DELTA, MAX_RULE_STORE_BYTES, MAX_RULE_TAG_LENGTH, } from "../contracts/workspace-portability.mjs";
+import { DETECTION_RULE_SCHEMA, DETECTION_RULE_SCHEMA_VERSION, DETECTION_RULE_EXPORT_SUPPORTED_VERSIONS, MAX_CONDITION_VALUE_LENGTH, MAX_CUSTOM_RISK_TOTAL, MAX_DETECTION_RULES, MAX_RULE_CONDITIONS, MAX_RULE_INPUT_RECORDS, MAX_RULE_NAME_LENGTH, MAX_RULE_RISK_DELTA, MAX_RULE_STORE_BYTES, MAX_RULE_TAG_LENGTH, } from "../contracts/workspace-portability.mjs";
 export { DETECTION_RULE_SCHEMA, DETECTION_RULE_SCHEMA_VERSION, MAX_CONDITION_VALUE_LENGTH, MAX_CUSTOM_RISK_TOTAL, MAX_DETECTION_RULES, MAX_RULE_CONDITIONS, MAX_RULE_IMPORT_BYTES, MAX_RULE_INPUT_RECORDS, MAX_RULE_NAME_LENGTH, MAX_RULE_RISK_DELTA, MAX_RULE_STORE_BYTES, MAX_RULE_TAG_LENGTH, } from "../contracts/workspace-portability.mjs";
 const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
 const TEXT_CONTROL_RE = /[\x00-\x1f\x7f]/;
@@ -24,6 +24,7 @@ export const RULE_FIELD_DEFINITIONS = Object.freeze([
     { value: 'reusesOfficialAssets', label: 'Official assets reused', kind: 'boolean' },
     { value: 'phishingLanguageMatch', label: 'Phishing-language signal', kind: 'text' },
     { value: 'hasExternalFormAction', label: 'External form action observed', kind: 'boolean' },
+    { value: 'hasExternalPasswordForm', label: 'Password form declares external destination', kind: 'boolean' },
     { value: 'mutationTypes', label: 'Mutation type', kind: 'list' },
     { value: 'nameservers', label: 'Nameserver', kind: 'list' },
     { value: 'httpSecurityHeaders', label: 'HTTP security header', kind: 'list' },
@@ -164,8 +165,12 @@ export function recoverDetectionRuleStore(raw) {
     assertWorkspaceDeclaredVersion(raw, 'Detection-rule store');
     const byId = new Map();
     const source = ruleList(raw);
+    const sourceVersion = detectionRuleStoreVersion(raw);
     let rejected = Math.max(0, source.length - MAX_RULE_INPUT_RECORDS);
     for (const item of source.slice(0, MAX_RULE_INPUT_RECORDS)) {
+        if (sourceVersion === 1 && Array.isArray(record(item).conditions) && record(item).conditions.some(condition => record(condition).field === 'hasExternalPasswordForm')) {
+            throw new Error('Form-attribution conditions require custom-rule schema 2; historical rules were not reinterpreted.');
+        }
         const rule = normalizeDetectionRule(item);
         if (!rule?.id || byId.has(rule.id)) {
             rejected += 1;
@@ -326,12 +331,15 @@ export function mergeDetectionRules(localRaw, importedRaw) {
     if (version !== null && version > DETECTION_RULE_SCHEMA_VERSION) {
         throw new Error(`This custom-rule file uses newer schema ${version}. Update the app before importing it.`);
     }
-    if (version !== DETECTION_RULE_SCHEMA_VERSION) {
+    if (version === null || !DETECTION_RULE_EXPORT_SUPPORTED_VERSIONS.includes(version)) {
         throw new Error(`Expected custom-rule schema ${DETECTION_RULE_SCHEMA_VERSION}.`);
     }
     const local = normalizeDetectionRuleStore(localRaw).rules;
     const byId = new Map(local.map((rule) => [rule.id, rule]));
     const importedList = ruleList(importedRaw);
+    if (version === 1 && importedList.some(item => Array.isArray(record(item).conditions) && record(item).conditions.some(condition => record(condition).field === 'hasExternalPasswordForm'))) {
+        throw new Error('Form-attribution conditions require custom-rule schema 2; historical rules were not reinterpreted.');
+    }
     let added = 0;
     let updated = 0;
     let skipped = Math.max(0, importedList.length - MAX_RULE_INPUT_RECORDS);

package/packages/workspace/hostile-input.mjs

@@ -1,5 +1,5 @@
 import { MAX_WORKSPACE_INPUT_ARRAY_LENGTH, MAX_WORKSPACE_INPUT_GRAPH_DEPTH, MAX_WORKSPACE_INPUT_GRAPH_NODES, MAX_WORKSPACE_INPUT_OBJECT_KEYS, MAX_WORKSPACE_INPUT_STRING_CODE_UNITS, } from "../contracts/workspace-portability.mjs";
-import { boundedJsonLimitsForBytes } from "../../lib/bounded-json.mjs";
+import { boundedJsonLimitsForBytes } from "../analysis/bounded-json.mjs";
 function inputError(label, detail) {
     return new TypeError(`${label} must be bounded ordinary JSON data; ${detail}.`);
 }

package/packages/workspace/investigation-guide.mjs

@@ -1,4 +1,4 @@
-import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { parse } from 'tldts';
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 export const INVESTIGATION_GUIDE_SCHEMA = 'whoisleuth.investigation-recipe';
@@ -13,7 +13,7 @@ export const MAX_INVESTIGATION_GUIDE_TIMESTAMP_LENGTH = 64;
 export const MAX_INVESTIGATION_GUIDE_SERIALIZED_BYTES = 12_288;
 export const MAX_INVESTIGATION_GUIDE_EXPORT_BYTES = 16_384;
 const CONTROL_RE = /[\x00-\x1f\x7f]/u;
-const SAFE_TEMPLATE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
+export const SAFE_TEMPLATE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
 const GUIDE_STATUSES = new Set(['active', 'paused']);
 const GUIDE_OUTCOMES = new Set(['pending', 'complete', 'partial', 'skipped']);
 function stage(id, workspace, label, detail, expectedEvidence, requestImpact, prerequisite, completionCriteria, instructions, requiresApproval) {