@slicedearth/whoisleuth-cli 2.5.1 → 2.7.0

package/packages/workspace/brand-profile-model.mjs

@@ -10,6 +10,8 @@ import { MAX_IDENTITY_DIGEST_BYTES, sha256IdentityHex } from "../evidence/record
 import { DOMAIN_POSTURE_COMPARISON_VERSION, MAX_POSTURE_CHECKS, MAX_POSTURE_CHECK_RECORDS, MAX_POSTURE_RECORD_LENGTH, normalizeDomainPostureSourceContext, normalizeDomainPostureProfileContext } from "../evidence/domain-posture-context.mjs";
 import { normalizeOpaqueReferenceId } from "../cases/opaque-reference-id.mjs";
 import { normalizePageBaseline } from "./page-baseline.mjs";
+import { normalizeCandidateObservations, normalizeCandidateExceptions } from "./brand-candidate-workflow.mjs";
+import { normalizeBrandKeywordCampaigns, mergeBrandKeywordCampaigns } from "./brand-keyword-campaign.mjs";
 import { isInformativePerceptualHash as isInformativeFaviconHash } from "../analysis/perceptual-hash-comparison.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_OFFICIAL_CHANNELS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_URL_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, MAX_RIGHTS_REFERENCES, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
@@ -583,6 +585,9 @@ export function normalizeBrandProfile(raw, options = {}) {
         approvedPartnerDomains: normalizeProfileDomains(value.approvedPartnerDomains),
         allowlistedDomains: normalizeProfileDomains(value.allowlistedDomains),
         allowlistedRegistrars: normalizeProfileTextValues(value.allowlistedRegistrars),
+        candidateObservations: normalizeCandidateObservations(value.candidateObservations),
+        candidateExceptions: normalizeCandidateExceptions(value.candidateExceptions),
+        keywordCampaigns: existing ? mergeBrandKeywordCampaigns(existing.keywordCampaigns, value.keywordCampaigns) : normalizeBrandKeywordCampaigns(value.keywordCampaigns),
         dkimSelectors,
         retiredDkimSelectors: normalizeDkimSelectors(value.retiredDkimSelectors)
             .filter((selector) => !dkimSelectors.includes(selector)),
@@ -602,6 +607,9 @@ export function normalizeBrandProfile(raw, options = {}) {
 const BRAND_PROFILE_FIELD_PATCH_KEYS = Object.freeze([
     'allowlistedDomains',
     'allowlistedRegistrars',
+    'candidateObservations',
+    'candidateExceptions',
+    'keywordCampaigns',
     'desiredPostureBaselines',
     'protectionAttestations',
 ]);
@@ -638,11 +646,24 @@ export function brandProfileStoreVersion(raw) {
     const value = record(raw);
     return typeof value.version === 'number' && Number.isFinite(value.version) && value.version > 0 ? value.version : null;
 }
+function assertHistoricalCandidateFields(raw, version) {
+    if (Array.isArray(raw) || version === null || version >= 11)
+        return;
+    for (const input of profileList(raw).slice(0, MAX_PROFILES * 4)) {
+        const profile = record(input);
+        if (version < 10 && (Object.hasOwn(profile, 'candidateObservations') || Object.hasOwn(profile, 'candidateExceptions'))) {
+            throw new TypeError('Candidate observations and scoped exceptions require Brand Profile schema 10; historical records were not reinterpreted.');
+        }
+        if (Object.hasOwn(profile, 'keywordCampaigns'))
+            throw new TypeError('Keyword campaigns require Brand Profile schema 11; historical records were not reinterpreted.');
+    }
+}
 /** Normalize an internal profile collection or current stored envelope. */
 export function normalizeBrandProfileStore(raw) {
     assertWorkspaceInputGraph(raw, 'Brand Profile store', { maximumBytes: MAX_PROFILE_STORE_BYTES });
     assertWorkspaceDeclaredVersion(raw, 'Brand Profile store');
     const sourceVersion = brandProfileStoreVersion(raw);
+    assertHistoricalCandidateFields(raw, sourceVersion);
     if (!Array.isArray(raw) && sourceVersion !== null
         && !SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS.includes(sourceVersion)) {
         throw new Error(`Brand Profile schema ${sourceVersion} is unsupported; no data was changed.`);
@@ -655,8 +676,8 @@ export function normalizeBrandProfileStore(raw) {
         if (!profile)
             continue;
         const previous = byId.get(profile.id);
-        if (!previous || profile.updatedAt > previous.updatedAt)
-            byId.set(profile.id, profile);
+        const keywordCampaigns = mergeBrandKeywordCampaigns(previous?.keywordCampaigns, profile.keywordCampaigns);
+        byId.set(profile.id, { ...(previous && profile.updatedAt <= previous.updatedAt ? previous : profile), keywordCampaigns });
         if (byId.size >= MAX_PROFILES)
             break;
     }
@@ -691,6 +712,7 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
         throw new Error('Expected a current WHOISleuth Brand Profile export.');
     }
     const importedVersion = brandProfileStoreVersion(importedRaw);
+    assertHistoricalCandidateFields(importedRaw, importedVersion);
     if (importedVersion !== null && importedVersion > BRAND_PROFILE_SCHEMA_VERSION) {
         throw new Error(`This Brand Profile file uses newer schema ${importedVersion}. Update the app before importing it.`);
     }
@@ -727,8 +749,17 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
         if (rawId && rawName)
             retainIdName(rawId, rawName);
         const existing = rawName ? byName.get(rawName.toLowerCase()) : null;
+        if (existing && rawId !== existing.id && ((Array.isArray(value.candidateObservations) && value.candidateObservations.length) || (Array.isArray(value.candidateExceptions) && value.candidateExceptions.length) || (Array.isArray(value.keywordCampaigns) && value.keywordCampaigns.length))) {
+            throw new TypeError('Candidate metadata belongs to another Brand identifier with this name. Rename or review its exact Brand identity before importing; no decisions were reassigned.');
+        }
+        const keywordCampaigns = mergeBrandKeywordCampaigns(existing?.keywordCampaigns, value.keywordCampaigns);
         const incomingUpdatedAt = timestamp(value.updatedAt, null);
         if (existing && (!incomingUpdatedAt || incomingUpdatedAt <= existing.updatedAt)) {
+            if (JSON.stringify(keywordCampaigns) !== JSON.stringify(existing.keywordCampaigns ?? [])) {
+                byName.set(existing.name.toLowerCase(), { ...existing, keywordCampaigns });
+                updated++;
+                continue;
+            }
             skipped++;
             continue;
         }
@@ -742,6 +773,19 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
             skipped++;
             continue;
         }
+        if (existing) {
+            profile.keywordCampaigns = keywordCampaigns;
+            profile.candidateObservations = normalizeCandidateObservations([...existing.candidateObservations, ...profile.candidateObservations]);
+            const exceptions = new Map(existing.candidateExceptions.map(exception => [exception.id, exception]));
+            for (const incoming of profile.candidateExceptions) {
+                const old = exceptions.get(incoming.id);
+                if (old && (old.domain !== incoming.domain || old.ruleKey !== incoming.ruleKey || old.purpose !== incoming.purpose))
+                    throw new Error('An imported exception identifier changes its exact scope or purpose; no profiles were imported.');
+                if (!old || incoming.revision > old.revision)
+                    exceptions.set(incoming.id, incoming);
+            }
+            profile.candidateExceptions = normalizeCandidateExceptions([...exceptions.values()]);
+        }
         retainIdName(profile.id, profile.name);
         if (existing) {
             byName.set(profile.name.toLowerCase(), profile);

package/packages/workspace/bulk-session-model.mjs

@@ -35,6 +35,14 @@ const SOURCE_STATES = new Set([
 ]);
 const TRUST_STATES = new Set(['official', 'partner', 'allowlisted']);
 const COMPARISON_STATES = new Set(['error', 'not_found', 'partial', 'success', 'unavailable']);
+/** Resume an admitted session without implicitly retrying any recorded row. */
+export function planBulkSessionResume(session) {
+    const settled = new Set(session.results.map(row => row.domain));
+    return {
+        retainedRows: session.results.length,
+        pendingDomains: session.domains.filter(domain => !settled.has(domain)),
+    };
+}
 function record(value) {
     return ordinaryWorkspaceRecord(value, 'Bulk-session input');
 }
@@ -338,6 +346,7 @@ export function normalizeBulkSessionResult(value, inheritedProfileContext) {
         reusesOfficialAssets: profileClaimsUsable ? nullableBoolean(item.reusesOfficialAssets) : null,
         hasPasswordField: item.hasPasswordField === true,
         hasExternalFormAction: nullableBoolean(item.hasExternalFormAction),
+        hasExternalPasswordForm: nullableBoolean(item.hasExternalPasswordForm),
         phishingLanguageMatch: boundedText(item.phishingLanguageMatch, 300) || null,
         idnReferenceMatch: profileClaimsUsable ? nullableBoolean(item.idnReferenceMatch) : null,
         pageBaselineMatch: profileClaimsUsable ? nullableBoolean(item.pageBaselineMatch) : null,
@@ -393,6 +402,9 @@ export function normalizeBulkSession(value, sourceStoreVersion) {
     const results = [];
     const seen = new Set();
     for (const candidate of Array.isArray(item.results) ? item.results.slice(0, MAX_BULK_SESSION_ROWS * 2) : []) {
+        if (sourceStoreVersion !== undefined && sourceStoreVersion < 7 && Object.hasOwn(record(candidate) ?? {}, 'hasExternalPasswordForm')) {
+            throw new TypeError('Form attribution requires Bulk schema 7 or later; historical evidence was not reinterpreted.');
+        }
         if (sourceStoreVersion !== undefined && sourceStoreVersion < 6 && record(candidate)?.webCollectionQuality !== undefined) {
             throw new TypeError('Web collection quality requires Bulk schema 6 or later; historical evidence was not reinterpreted.');
         }

package/packages/workspace/candidate-watch-handoff.mjs

@@ -0,0 +1,195 @@
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceInputGraph } from "./hostile-input.mjs";
+import { MAX_WATCHLISTS, normalizeWatchlistName, normalizeWatchlistStore, assertWatchlistStoreBudget, } from "./watchlist-store.mjs";
+import { MAX_WATCHLIST_DOMAINS } from "../contracts/workspace-portability.mjs";
+import { assertWatchlistEditable } from "./watchlist-history.mjs";
+import { MAX_WATCH_CONTEXTS, WATCH_PRIORITIES, mergeWatchDomainMetadata, normalizeCandidateObservation, candidateMaterialFingerprint, } from "./brand-candidate-workflow.mjs";
+function admitInput(input) {
+    assertWorkspaceInputGraph(input, 'Candidate watch handoff');
+    if (!normalizeWatchlistName(input.name))
+        throw new TypeError('Choose a safe watchlist name containing 1–100 characters.');
+    if (!Array.isArray(input.candidates) || input.candidates.length > MAX_WATCHLIST_DOMAINS)
+        throw new RangeError(`Select at most ${MAX_WATCHLIST_DOMAINS} candidate domains.`);
+    if (input.brandProfileId !== null &&
+        (typeof input.brandProfileId !== 'string' ||
+            !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(input.brandProfileId)))
+        throw new TypeError('The Brand context identifier is invalid.');
+    if (!WATCH_PRIORITIES.some((option) => option.value === input.priority))
+        throw new TypeError('Choose an admitted review priority.');
+    if (typeof input.reason !== 'string' ||
+        /[\u0000-\u001f\u007f]/u.test(input.reason) ||
+        input.reason.trim().length > 300 ||
+        !input.reason.trim())
+        throw new TypeError('Enter a watch reason containing 1–300 characters and no control characters.');
+    if (input.reviewDueAt != null && !normalizeExplicitIsoTimestamp(input.reviewDueAt))
+        throw new TypeError('Use a valid explicit review time. A review time is not a scan schedule.');
+    if (input.replaceExistingContext !== undefined &&
+        typeof input.replaceExistingContext !== 'boolean')
+        throw new TypeError('Existing-context replacement must be selected explicitly.');
+    return {
+        ...input,
+        name: normalizeWatchlistName(input.name),
+        reason: input.reason.trim(),
+        reviewDueAt: normalizeExplicitIsoTimestamp(input.reviewDueAt),
+    };
+}
+/** Pure exact-domain preview. It grants no collection authority and makes no requests. */
+export function planCandidateWatchHandoff(localRaw, rawInput) {
+    const input = admitInput(rawInput), local = normalizeWatchlistStore(localRaw).watchlists;
+    const name = Object.keys(local).find((name) => name.toLowerCase() === input.name.toLowerCase()) ??
+        input.name;
+    const entry = local[name], existing = new Map(entry?.domainMetadata.map((record) => [record.domain, record]) ?? []);
+    assertWatchlistEditable(entry);
+    const seen = new Set(), rows = [];
+    let admitted = existing.size;
+    for (const raw of input.candidates) {
+        const candidate = normalizeCandidateObservation(raw), domain = candidate?.domain ?? normalizeDomain(raw?.domain) ?? '';
+        let reason = '';
+        if (!candidate || !domain)
+            reason = 'Invalid candidate domain or provenance.';
+        else if (seen.has(domain))
+            reason = 'Repeated selection; the first exact domain is retained.';
+        else if (!entry && Object.keys(local).length >= MAX_WATCHLISTS)
+            reason = 'Watchlist count capacity is exhausted.';
+        else if (!existing.has(domain) && admitted >= MAX_WATCHLIST_DOMAINS)
+            reason = 'Domain capacity is exhausted.';
+        else if (existing.get(domain)?.contexts.length === MAX_WATCH_CONTEXTS &&
+            !existing
+                .get(domain)
+                ?.contexts.some((context) => context.brandProfileId === input.brandProfileId))
+            reason = 'This domain has reached its separate-context capacity.';
+        seen.add(domain);
+        const previousContext = existing
+            .get(domain)
+            ?.contexts.find((context) => context.brandProfileId === input.brandProfileId) ?? null;
+        const materialFingerprint = candidate
+            ? candidateMaterialFingerprint(candidate, input.brandProfileId ?? '')
+            : null;
+        if (reason)
+            rows.push({ domain, state: 'rejected', reason, previousContext, materialFingerprint });
+        else {
+            const context = existing
+                .get(domain)
+                ?.contexts.find((context) => context.brandProfileId === input.brandProfileId);
+            rows.push({
+                domain,
+                state: existing.has(domain) ? 'existing' : 'add',
+                previousContext,
+                materialFingerprint,
+                reason: context
+                    ? input.replaceExistingContext
+                        ? `Explicitly replace this context (${context.priority}) with ${input.priority}; preserve evidence and other Brand contexts.`
+                        : `Preserve existing deliberate ${context.priority} priority and reason; merge provenance only.`
+                    : existing.has(domain)
+                        ? 'Already tracked; add this separate Brand context, preserving other contexts.'
+                        : 'Add metadata only; no scan or baseline is invented.',
+            });
+            if (!existing.has(domain))
+                admitted++;
+        }
+    }
+    return {
+        destination: name,
+        brandProfileId: input.brandProfileId,
+        priority: input.priority,
+        reason: input.reason,
+        reviewDueAt: input.reviewDueAt ?? null,
+        replaceExistingContext: input.replaceExistingContext ?? false,
+        rows,
+        additionalRequests: 0,
+        collectionAuthorised: false,
+    };
+}
+export function applyCandidateWatchHandoff(localRaw, rawInput, nowRaw) {
+    const input = admitInput(rawInput), now = normalizeExplicitIsoTimestamp(nowRaw);
+    if (!now)
+        throw new TypeError('The watch metadata change time must use an explicit timezone.');
+    if (input.reviewDueAt && input.reviewDueAt <= now)
+        throw new TypeError('The review time must be later than this change time.');
+    const local = normalizeWatchlistStore(localRaw).watchlists, plan = planCandidateWatchHandoff(local, input);
+    const candidates = new Map();
+    for (const raw of input.candidates) {
+        const candidate = normalizeCandidateObservation(raw);
+        if (candidate && !candidates.has(candidate.domain))
+            candidates.set(candidate.domain, candidate);
+    }
+    const context = {
+        brandProfileId: input.brandProfileId,
+        priority: input.priority,
+        reason: input.reason,
+        changedAt: now,
+        reviewDueAt: input.reviewDueAt ?? null,
+    };
+    const entry = local[plan.destination] ?? {
+        updatedAt: null,
+        results: [],
+        baseline: [],
+        history: [],
+        domainMetadata: [],
+    };
+    if (input.replaceExistingContext &&
+        plan.rows.some((row) => row.state !== 'rejected' &&
+            row.previousContext?.changedAt &&
+            now <= row.previousContext.changedAt))
+        throw new Error('The change clock does not follow the retained context. Review the clock before replacing a manual priority.');
+    const metadata = plan.rows
+        .filter((row) => row.state !== 'rejected')
+        .map((row) => ({
+        domain: row.domain,
+        contexts: !input.replaceExistingContext &&
+            entry.domainMetadata.some((record) => record.domain === row.domain &&
+                record.contexts.some((old) => old.brandProfileId === input.brandProfileId))
+            ? []
+            : [context],
+        candidate: candidates.get(row.domain) ?? null,
+    }));
+    if (!metadata.length)
+        return { watchlists: local, plan };
+    Object.defineProperty(local, plan.destination, {
+        value: { ...entry, domainMetadata: mergeWatchDomainMetadata(entry.domainMetadata, metadata) },
+        enumerable: true,
+        configurable: true,
+        writable: true,
+    });
+    return { watchlists: assertWatchlistStoreBudget(local).watchlists, plan };
+}
+/** Field-scoped optimistic edits preserve unrelated domains and contexts. */
+export function setWatchDomainContext(localRaw, name, domainRaw, input, expected) {
+    return setWatchDomainContexts(localRaw, name, [{ domain: domainRaw, input, expected }]);
+}
+export function setWatchDomainContexts(localRaw, name, edits) {
+    if (!Array.isArray(edits) || edits.length > MAX_WATCHLIST_DOMAINS)
+        throw new RangeError('The reviewed metadata edit exceeds its domain bound.');
+    const local = normalizeWatchlistStore(localRaw).watchlists, entry = local[name];
+    if (!entry)
+        throw new Error('The selected watchlist was deleted; nothing was overwritten.');
+    assertWatchlistEditable(entry);
+    const metadata = new Map(entry.domainMetadata.map((record) => [record.domain, record])), seen = new Set();
+    for (const edit of edits) {
+        const domain = normalizeDomain(edit.domain), record = domain ? metadata.get(domain) : null;
+        const key = `${domain}\0${edit.input.brandProfileId ?? ''}`, old = record?.contexts.find((context) => context.brandProfileId === edit.input.brandProfileId) ??
+            null;
+        if (!domain ||
+            !record ||
+            seen.has(key) ||
+            JSON.stringify(old) !== JSON.stringify(edit.expected))
+            throw new Error('A reviewed domain context changed, was repeated or was deleted. Reopen the selection; nothing was overwritten.');
+        const input = admitInput({ name, candidates: [], ...edit.input });
+        const changedAt = normalizeExplicitIsoTimestamp(edit.input.changedAt);
+        if (!changedAt ||
+            (old?.changedAt && changedAt <= old.changedAt) ||
+            (input.reviewDueAt && input.reviewDueAt <= changedAt))
+            throw new TypeError('Use a current change time and a later optional review time.');
+        seen.add(key);
+        metadata.set(domain, {
+            ...record,
+            contexts: [
+                ...record.contexts.filter((context) => context.brandProfileId !== edit.input.brandProfileId),
+                { ...edit.input, reason: input.reason, changedAt, reviewDueAt: input.reviewDueAt ?? null },
+            ],
+        });
+    }
+    local[name] = { ...entry, domainMetadata: [...metadata.values()] };
+    return assertWatchlistStoreBudget(local).watchlists;
+}

package/packages/workspace/detection-rule-model.mjs

@@ -4,7 +4,7 @@
 import { latestCaseEvidence } from "../cases/case-evidence-model.mjs";
 import { CASE_DISPOSITIONS, CASE_STATUSES } from "../cases/case-record-contracts.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
-import { DETECTION_RULE_SCHEMA, DETECTION_RULE_SCHEMA_VERSION, MAX_CONDITION_VALUE_LENGTH, MAX_CUSTOM_RISK_TOTAL, MAX_DETECTION_RULES, MAX_RULE_CONDITIONS, MAX_RULE_INPUT_RECORDS, MAX_RULE_NAME_LENGTH, MAX_RULE_RISK_DELTA, MAX_RULE_STORE_BYTES, MAX_RULE_TAG_LENGTH, } from "../contracts/workspace-portability.mjs";
+import { DETECTION_RULE_SCHEMA, DETECTION_RULE_SCHEMA_VERSION, DETECTION_RULE_EXPORT_SUPPORTED_VERSIONS, MAX_CONDITION_VALUE_LENGTH, MAX_CUSTOM_RISK_TOTAL, MAX_DETECTION_RULES, MAX_RULE_CONDITIONS, MAX_RULE_INPUT_RECORDS, MAX_RULE_NAME_LENGTH, MAX_RULE_RISK_DELTA, MAX_RULE_STORE_BYTES, MAX_RULE_TAG_LENGTH, } from "../contracts/workspace-portability.mjs";
 export { DETECTION_RULE_SCHEMA, DETECTION_RULE_SCHEMA_VERSION, MAX_CONDITION_VALUE_LENGTH, MAX_CUSTOM_RISK_TOTAL, MAX_DETECTION_RULES, MAX_RULE_CONDITIONS, MAX_RULE_IMPORT_BYTES, MAX_RULE_INPUT_RECORDS, MAX_RULE_NAME_LENGTH, MAX_RULE_RISK_DELTA, MAX_RULE_STORE_BYTES, MAX_RULE_TAG_LENGTH, } from "../contracts/workspace-portability.mjs";
 const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
 const TEXT_CONTROL_RE = /[\x00-\x1f\x7f]/;
@@ -24,6 +24,7 @@ export const RULE_FIELD_DEFINITIONS = Object.freeze([
     { value: 'reusesOfficialAssets', label: 'Official assets reused', kind: 'boolean' },
     { value: 'phishingLanguageMatch', label: 'Phishing-language signal', kind: 'text' },
     { value: 'hasExternalFormAction', label: 'External form action observed', kind: 'boolean' },
+    { value: 'hasExternalPasswordForm', label: 'Password form declares external destination', kind: 'boolean' },
     { value: 'mutationTypes', label: 'Mutation type', kind: 'list' },
     { value: 'nameservers', label: 'Nameserver', kind: 'list' },
     { value: 'httpSecurityHeaders', label: 'HTTP security header', kind: 'list' },
@@ -164,8 +165,12 @@ export function recoverDetectionRuleStore(raw) {
     assertWorkspaceDeclaredVersion(raw, 'Detection-rule store');
     const byId = new Map();
     const source = ruleList(raw);
+    const sourceVersion = detectionRuleStoreVersion(raw);
     let rejected = Math.max(0, source.length - MAX_RULE_INPUT_RECORDS);
     for (const item of source.slice(0, MAX_RULE_INPUT_RECORDS)) {
+        if (sourceVersion === 1 && Array.isArray(record(item).conditions) && record(item).conditions.some(condition => record(condition).field === 'hasExternalPasswordForm')) {
+            throw new Error('Form-attribution conditions require custom-rule schema 2; historical rules were not reinterpreted.');
+        }
         const rule = normalizeDetectionRule(item);
         if (!rule?.id || byId.has(rule.id)) {
             rejected += 1;
@@ -326,12 +331,15 @@ export function mergeDetectionRules(localRaw, importedRaw) {
     if (version !== null && version > DETECTION_RULE_SCHEMA_VERSION) {
         throw new Error(`This custom-rule file uses newer schema ${version}. Update the app before importing it.`);
     }
-    if (version !== DETECTION_RULE_SCHEMA_VERSION) {
+    if (version === null || !DETECTION_RULE_EXPORT_SUPPORTED_VERSIONS.includes(version)) {
         throw new Error(`Expected custom-rule schema ${DETECTION_RULE_SCHEMA_VERSION}.`);
     }
     const local = normalizeDetectionRuleStore(localRaw).rules;
     const byId = new Map(local.map((rule) => [rule.id, rule]));
     const importedList = ruleList(importedRaw);
+    if (version === 1 && importedList.some(item => Array.isArray(record(item).conditions) && record(item).conditions.some(condition => record(condition).field === 'hasExternalPasswordForm'))) {
+        throw new Error('Form-attribution conditions require custom-rule schema 2; historical rules were not reinterpreted.');
+    }
     let added = 0;
     let updated = 0;
     let skipped = Math.max(0, importedList.length - MAX_RULE_INPUT_RECORDS);

package/packages/workspace/shortlist-model.mjs

@@ -69,9 +69,11 @@ export function normalizeShortlistRecord(raw, options = {}) {
     const compact = compactWatchlistResults([value])[0];
     if (!compact)
         return null;
+    // Shortlist's published schema does not retain the newer local watch evidence.
+    const { hasExternalPasswordForm: _localWatchEvidence, ...shortlistCompact } = compact;
     const riskScore = score(value.riskScore);
     return {
-        ...compact,
+        ...shortlistCompact,
         availability: typeof compact.availability === 'string' ? compact.availability : 'unknown',
         riskModelVersion: riskScore === null ? null : normalizeRiskModelVersion(value.riskModelVersion),
         riskScore,
@@ -120,12 +122,13 @@ export function serializeShortlistStore(records) {
     return JSON.stringify(assertShortlistStoreBudget(records));
 }
 /** Add, refresh, or remove an explicit bounded selection in one transaction. */
-export function setShortlistSelection(localRaw, selectedRaw, selected, nowIso = new Date().toISOString()) {
+export function setShortlistSelection(localRaw, selectedRaw, selected, nowIso = new Date().toISOString(), existing = 'refresh') {
     const local = normalizeShortlistStore(localRaw).entries;
     const byDomain = new Map(local.map((record) => [record.domain, record]));
     const candidates = Array.isArray(selectedRaw) ? selectedRaw.slice(0, MAX_SHORTLIST_INPUTS) : [];
     let added = 0;
     let updated = 0;
+    let retained = 0;
     let removed = 0;
     let skipped = Math.max(0, (Array.isArray(selectedRaw) ? selectedRaw.length : 0) - MAX_SHORTLIST_INPUTS);
     const seen = new Set();
@@ -137,6 +140,10 @@ export function setShortlistSelection(localRaw, selectedRaw, selected, nowIso =
         }
         seen.add(record.domain);
         if (selected) {
+            if (existing === 'retain' && byDomain.has(record.domain)) {
+                retained += 1;
+                continue;
+            }
             if (!byDomain.has(record.domain) && byDomain.size >= MAX_SHORTLIST_ENTRIES) {
                 skipped += 1;
                 continue;
@@ -155,6 +162,7 @@ export function setShortlistSelection(localRaw, selectedRaw, selected, nowIso =
         entries: assertShortlistStoreBudget([...byDomain.values()]).entries,
         added,
         updated,
+        retained,
         removed,
         skipped,
     };

package/packages/workspace/watchlist-history.mjs

@@ -7,8 +7,9 @@ import { HTTP_SECURITY_HEADER_TOKENS, normalizeHttpSummary } from "../cases/http
 import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { registryDateIso } from "../evidence/registry-dates.mjs";
+import { normalizeWatchDomainMetadata } from "./brand-candidate-workflow.mjs";
 import { mergeWebCollectionQuality, normalizeWebCollectionQuality, webCollectionAllowsComparison } from "../evidence/collection-quality.mjs";
-import { MAX_WATCHLIST_CHANGES_PER_EVENT, MAX_WATCHLIST_DOMAINS, MAX_WATCHLIST_HISTORY_DOMAIN_OPTIONS, MAX_WATCHLIST_HISTORY_EVENTS, MAX_WATCHLIST_INPUT_RECORDS, MAX_WATCHLIST_MUTATION_TYPES, MAX_WATCHLIST_NAMESERVERS, } from "../contracts/workspace-portability.mjs";
+import { MAX_WATCHLIST_CHANGES_PER_EVENT, MAX_WATCHLIST_DOMAINS, MAX_WATCHLIST_HISTORY_DOMAIN_OPTIONS, MAX_WATCHLIST_HISTORY_EVENTS, MAX_WATCHLIST_INPUT_RECORDS, MAX_WATCHLIST_MUTATION_TYPES, MAX_WATCHLIST_NAMESERVERS, WATCHLIST_RECOVERY_METADATA, } from "../contracts/workspace-portability.mjs";
 export { MAX_WATCHLIST_CHANGES_PER_EVENT, MAX_WATCHLIST_DOMAINS, MAX_WATCHLIST_HISTORY_DOMAIN_OPTIONS, MAX_WATCHLIST_HISTORY_EVENTS, MAX_WATCHLIST_INPUT_RECORDS, MAX_WATCHLIST_MUTATION_TYPES, MAX_WATCHLIST_NAMESERVERS, } from "../contracts/workspace-portability.mjs";
 const MAX_TEXT_LENGTH = 300;
 const MAX_TITLE_LENGTH = 200;
@@ -37,6 +38,7 @@ const DEEP_FIELDS = new Set([
     'faviconMatch',
     'faviconNearMatch',
     'hasPasswordField',
+    'hasExternalPasswordForm',
     'phishingLanguageMatch',
     'reusesOfficialAssets',
     'riskModelVersion',
@@ -68,6 +70,7 @@ const FIELD_LABELS = {
     faviconMatch: 'Official favicon match',
     faviconNearMatch: 'Official favicon near-match',
     hasPasswordField: 'Password form',
+    hasExternalPasswordForm: 'External password-form destination',
     phishingLanguageMatch: 'Phishing language',
     reusesOfficialAssets: 'Official asset reuse',
     riskScore: 'Risk score',
@@ -94,6 +97,7 @@ const HISTORY_CATEGORY_FIELDS = {
         'faviconMatch',
         'faviconNearMatch',
         'hasPasswordField',
+        'hasExternalPasswordForm',
         'phishingLanguageMatch',
         'reusesOfficialAssets',
     ]),
@@ -237,6 +241,7 @@ function compactRecord(value) {
         faviconMatch: typeof record.faviconMatch === 'boolean' ? record.faviconMatch : null,
         faviconNearMatch: typeof record.faviconNearMatch === 'boolean' ? record.faviconNearMatch : null,
         hasPasswordField: typeof record.hasPasswordField === 'boolean' ? record.hasPasswordField : null,
+        hasExternalPasswordForm: typeof record.hasExternalPasswordForm === 'boolean' ? record.hasExternalPasswordForm : null,
         phishingLanguageMatch: boundedText(record.phishingLanguageMatch, MAX_TITLE_LENGTH),
         reusesOfficialAssets: typeof record.reusesOfficialAssets === 'boolean' ? record.reusesOfficialAssets : null,
         riskModelVersion,
@@ -301,7 +306,7 @@ function classifyChange(field, before, after) {
         }
         return { kind: 'availability_changed', tone: 'warn' };
     }
-    if (['faviconMatch', 'faviconNearMatch', 'hasPasswordField', 'reusesOfficialAssets'].includes(field) && before === false && after === true) {
+    if (['faviconMatch', 'faviconNearMatch', 'hasPasswordField', 'hasExternalPasswordForm', 'reusesOfficialAssets'].includes(field) && before === false && after === true) {
         return { kind: 'risk_signal_added', tone: 'danger' };
     }
     if (field === 'phishingLanguageMatch' && !before && after)
@@ -469,8 +474,18 @@ function initialHistoryEvent(entry, baseline) {
         changes: [],
     };
 }
+/** Active membership excludes historical baselines and includes unobserved candidates. */
+export function watchlistActiveDomains(entry) {
+    if (entry.membershipRecovery)
+        return [];
+    return normalizeWatchDomainMetadata(entry.domainMetadata, entry.results.map(record => record.domain)).map(record => record.domain);
+}
+export function assertWatchlistEditable(entry) {
+    if (entry?.membershipRecovery)
+        throw new Error('This older watchlist is paused for membership recovery. Export its preserved records and create a separate watchlist with at most 2,000 selected domains.');
+}
 /** @param {object} entry */
-export function normalizeWatchlistEntry(entry) {
+export function normalizeWatchlistEntry(entry, options = {}) {
     const input = plainRecord(entry) || {};
     const rawResults = Array.isArray(input.results) ? input.results : [];
     const results = compactWatchlistResults(rawResults);
@@ -502,13 +517,21 @@ export function normalizeWatchlistEntry(entry) {
             };
         }).slice(-MAX_WATCHLIST_HISTORY_EVENTS)
         : [];
+    const metadata = normalizeWatchDomainMetadata(input.domainMetadata);
+    const membership = new Set([...metadata.map(record => record.domain), ...results.map(record => record.domain)]);
+    const recovery = membership.size > MAX_WATCHLIST_DOMAINS
+        && (options.recoverLegacyMembership || input.membershipRecovery === 'legacy_overflow');
+    if (input.membershipRecovery !== undefined && (!recovery || input.membershipRecovery !== 'legacy_overflow'))
+        throw new TypeError('Watchlist membership recovery state is invalid.');
     const normalized = {
         updatedAt: normalizeExplicitIsoTimestamp(input.updatedAt),
         results,
         baseline,
         history,
+        domainMetadata: recovery ? metadata : normalizeWatchDomainMetadata(metadata, results.map(record => record.domain)),
+        ...(recovery ? WATCHLIST_RECOVERY_METADATA : {}),
     };
-    if (normalized.history.length === 0)
+    if (normalized.history.length === 0 && (results.length || baseline.length))
         normalized.history.push(initialHistoryEvent(normalized, baseline));
     return normalized;
 }
@@ -528,6 +551,7 @@ export function appendWatchlistScan(existingEntry, results, options = {}) {
         ? options.mode
         : 'saved';
     const previous = existingEntry ? normalizeWatchlistEntry(existingEntry) : null;
+    assertWatchlistEditable(previous);
     const current = compactWatchlistResults(results);
     const changes = previous
         ? diffWatchlistBaseline(previous.baseline, current, options.ignoredDomains || new Set())
@@ -550,6 +574,7 @@ export function appendWatchlistScan(existingEntry, results, options = {}) {
             results: current,
             baseline: mergeWatchlistBaseline(previous?.baseline || [], current),
             history,
+            domainMetadata: normalizeWatchDomainMetadata(previous?.domainMetadata, current.map(record => record.domain)),
         },
         changes,
     };
@@ -594,6 +619,8 @@ export function watchlistHistoryDomains(entry) {
         if (record?.domain)
             current.add(record.domain);
     }
+    for (const metadata of normalized.domainMetadata)
+        current.add(metadata.domain);
     for (const event of normalized.history) {
         for (const change of event.changes) {
             if (change.domain && !current.has(change.domain))