@slicedearth/whoisleuth-cli 2.6.0 → 2.7.0

package/packages/interchange/external-findings-import.mjs

@@ -187,7 +187,7 @@ function structuredObservation(value, index) {
 function findingKey(finding, sourceName) {
     return canonicalArtifactJsonV2({ sourceName, finding });
 }
-export function parseExternalFindingsDocument(value) {
+export function parseExternalFindingsDocument(value, observeOrigin) {
     const root = record(value);
     if (!root || !hasOnlyKeys(root, ROOT_KEYS)) {
         throw new Error('External findings must use the documented object shape without additional top-level fields.');
@@ -210,7 +210,7 @@ export function parseExternalFindingsDocument(value) {
     }
     const normalized = [];
     let retainedBytes = new TextEncoder().encode(JSON.stringify({ schema: root.schema, schemaVersion: root.schemaVersion, source, findings: [] })).byteLength + 1;
-    const seen = new Set();
+    const seen = new Map();
     const domainCounts = new Map();
     for (const [index, raw] of root.findings.entries()) {
         const item = record(raw);
@@ -258,9 +258,12 @@ export function parseExternalFindingsDocument(value) {
                 throw new TypeError('External findings exceed the retained aggregate byte bound.');
         }
         const key = findingKey(finding, source.name);
-        if (seen.has(key))
+        const previous = seen.get(key);
+        if (previous) {
+            observeOrigin?.(previous, index);
             continue;
-        seen.add(key);
+        }
+        seen.set(key, finding);
         const count = (domainCounts.get(domain) ?? 0) + 1;
         if (count > MAX_EXTERNAL_FINDINGS_PER_DOMAIN) {
             throw new Error(`External findings exceed the ${MAX_EXTERNAL_FINDINGS_PER_DOMAIN}-finding per-domain limit.`);
@@ -270,6 +273,7 @@ export function parseExternalFindingsDocument(value) {
             throw new Error(`External findings exceed the ${MAX_EXTERNAL_FINDING_DOMAINS}-domain limit.`);
         }
         normalized.push(finding);
+        observeOrigin?.(finding, index);
     }
     if (!normalized.length)
         throw new Error('External findings did not contain a unique valid finding.');

package/packages/investigation/bulk-mail-exposure.mjs

@@ -99,8 +99,8 @@ function relation(state, profile, profileSourceState, profileContextComparable,
             ? {
                 baselineRelation: state === 'authenticated_mail' ? 'aligned' : 'review',
                 baselineDetail: state === 'authenticated_mail'
-                    ? 'Receiving mail plus SPF and DMARC matches the configured standard-mail baseline.'
-                    : 'Receiving mail was observed with an authentication gap relative to the configured baseline.',
+                    ? 'Published MX, SPF and DMARC records match the configured standard-mail baseline.'
+                    : 'MX publication was observed with a mail-authentication policy gap relative to the configured baseline.',
             }
             : {
                 baselineRelation: 'review',

package/packages/investigation/domain-history-review.mjs

@@ -5,6 +5,11 @@ import { array, domain, enumeration, exact, iso, text } from "../evidence/artifa
 import { CONTEXT_REVIEW_SCHEMA, CONTEXT_REVIEW_VERSION, MAX_CONTEXT_RECORDS } from "../contracts/context-review.mjs";
 export { DOMAIN_HISTORY_INPUT_SCHEMA, DOMAIN_HISTORY_INPUT_VERSION } from "../contracts/context-review.mjs";
 export const DOMAIN_CHANGE_FAMILIES = ['registration', 'dns', 'mail', 'certificate', 'web'];
+export const RETIRED_DEPENDENCY_REVIEW_STEPS = Object.freeze([
+    'DNS aliases: review owned CNAME records and delegated nameservers for references to the retired hostname. Record the configuration source and a deliberate cleanup plan; a remaining reference alone does not establish takeover availability.',
+    'Recovery email: review account-recovery and administrator-contact dependencies on the retired mail domain. Confirm a replacement through the account owner before removing access; record a source label, not email addresses or recovery secrets.',
+    'Integration references: review retained application, sign-in, webhook and third-party service configuration for the retired hostname. Record the responsible service and change reference without credentials or complete URLs; retained configuration does not prove a reference is still active.',
+]);
 export const REGISTRATION_BOUNDARY_KINDS = ['registration_reported', 'deletion_reported', 'reregistration_reported', 'transfer_reported', 'review_boundary'];
 export const MAX_REGISTRATION_BOUNDARIES = 40;
 export function readDomainHistoryDeclarations(raw, version = 1) {
@@ -126,7 +131,8 @@ export function reviewDomainHistory(record, declarations, reviewedAt, declaratio
     const certificateCount = observations.filter(row => row.label.startsWith('Retained certificate')).length;
     return { schema: CONTEXT_REVIEW_SCHEMA, version: CONTEXT_REVIEW_VERSION, kind: 'domain_history', reviewedAt, title: 'Domain history and retired dependencies', state: orderedPairs < 1 || limitedPairs > 0 ? 'partial' : 'reviewed',
         summary: `Retained snapshots: ${snapshots.length}; time-ordered pairs: ${orderedPairs}; limited pairs: ${limitedPairs}; certificate pins: ${certificateCount}; declared retired dependencies: ${declared.retiredDependencies.length}.${declarationVersion === 2 ? ` Analyst-declared registration boundaries: ${declared.registrationBoundaries.length}.` : ''}`, observations,
-        nextSteps: [...prompts, 'Review changed registration, DNS, mail and web evidence against declared maintenance windows.', 'Recheck owned references to retired dependencies before changing configuration; preserve evidence of legitimate transfers or rebrands.'],
+        nextSteps: [...prompts, 'Review changed registration, DNS, mail and web evidence against declared maintenance windows.', 'Recheck owned references to retired dependencies before changing configuration; preserve evidence of legitimate transfers or rebrands.',
+            ...(declared.retiredDependencies.length ? RETIRED_DEPENDENCY_REVIEW_STEPS : [])],
         limitations: ['This review uses retained Case evidence, not fresh collection. Missing or incompatible fields are not compared.', 'Certificate pins retain their own source and completeness; they are not equivalent to live TLS observations.', 'Changes and retired dependencies do not establish ownership transfer, malicious repurposing or takeover availability.',
             ...(declarationVersion === 2 ? ['Registration boundaries are analyst declarations linked to retained records, not independently verified deletion, re-registration or ownership events. Expiry and registrar changes do not establish those events.'] : [])] };
 }

package/packages/workspace/brand-keyword-campaign.mjs

@@ -1,11 +1,21 @@
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { sha256IdentityHex } from "../evidence/record-identity.mjs";
 import { ordinaryWorkspaceRecord, assertWorkspaceInputGraph } from "./hostile-input.mjs";
-import { WATCH_PRIORITIES, normalizeCandidateObservation, } from "./brand-candidate-workflow.mjs";
+import { MAX_CANDIDATE_OBSERVATIONS, WATCH_PRIORITIES, normalizeCandidateObservation, } from "./brand-candidate-workflow.mjs";
 import { MAX_BRAND_KEYWORD_CAMPAIGNS, MAX_BRAND_KEYWORD_CAMPAIGN_HISTORY, MAX_BRAND_KEYWORD_TERMS, MAX_BRAND_KEYWORD_TERM_LENGTH, MAX_PROFILE_NAME_LENGTH, } from "../contracts/workspace-portability.mjs";
 export { MAX_BRAND_KEYWORD_CAMPAIGNS, MAX_BRAND_KEYWORD_CAMPAIGN_HISTORY, MAX_BRAND_KEYWORD_TERMS, MAX_BRAND_KEYWORD_TERM_LENGTH, } from "../contracts/workspace-portability.mjs";
 const CONTROL = /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/u;
 const ID = /^[A-Za-z0-9_-]{1,64}$/u;
+/** Transient comparison identity, checked again against the authoritative write snapshot. */
+export function keywordCampaignCorpusRevision(profile) {
+    if (profile.candidateObservations.length > MAX_CANDIDATE_OBSERVATIONS)
+        throw new RangeError('The retained candidate corpus exceeds its supported bound; no partial comparison was prepared.');
+    return sha256IdentityHex(new TextEncoder().encode(JSON.stringify([
+        profile.id, profile.name, profile.updatedAt, profile.candidateObservations,
+        profile.candidateExceptions, profile.officialDomains, profile.approvedPartnerDomains,
+        profile.allowlistedDomains,
+    ])));
+}
 /** Shared feed and campaign literals are plain substrings, never regular expressions. */
 export function normalizeBrandKeywordTerms(value) {
     if (!Array.isArray(value) || value.length > MAX_BRAND_KEYWORD_TERMS)

package/packages/workspace/bulk-session-model.mjs

@@ -35,6 +35,14 @@ const SOURCE_STATES = new Set([
 ]);
 const TRUST_STATES = new Set(['official', 'partner', 'allowlisted']);
 const COMPARISON_STATES = new Set(['error', 'not_found', 'partial', 'success', 'unavailable']);
+/** Resume an admitted session without implicitly retrying any recorded row. */
+export function planBulkSessionResume(session) {
+    const settled = new Set(session.results.map(row => row.domain));
+    return {
+        retainedRows: session.results.length,
+        pendingDomains: session.domains.filter(domain => !settled.has(domain)),
+    };
+}
 function record(value) {
     return ordinaryWorkspaceRecord(value, 'Bulk-session input');
 }

package/third-party-notices.txt

@@ -7,7 +7,7 @@ The inventory is the exact transitive closure of the packaged runtime dependenci
 Package count: 49
 
 ================================================================================
-@napi-rs/canvas@1.0.10
+@napi-rs/canvas@1.0.11
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -34,77 +34,77 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@napi-rs/canvas-android-arm64@1.0.10
+@napi-rs/canvas-android-arm64@1.0.11
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-darwin-arm64@1.0.10
+@napi-rs/canvas-darwin-arm64@1.0.11
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-darwin-x64@1.0.10
+@napi-rs/canvas-darwin-x64@1.0.11
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-linux-arm-gnueabihf@1.0.10
+@napi-rs/canvas-linux-arm-gnueabihf@1.0.11
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-linux-arm64-gnu@1.0.10
+@napi-rs/canvas-linux-arm64-gnu@1.0.11
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-linux-arm64-musl@1.0.10
+@napi-rs/canvas-linux-arm64-musl@1.0.11
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-linux-riscv64-gnu@1.0.10
+@napi-rs/canvas-linux-riscv64-gnu@1.0.11
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-linux-x64-gnu@1.0.10
+@napi-rs/canvas-linux-x64-gnu@1.0.11
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-linux-x64-musl@1.0.10
+@napi-rs/canvas-linux-x64-musl@1.0.11
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-win32-arm64-msvc@1.0.10
+@napi-rs/canvas-win32-arm64-msvc@1.0.11
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
 
 This optional platform package declares MIT. It is installed separately on supported platforms, not included in this artefact. Its installed package provides its own licence notices.
 ================================================================================
-@napi-rs/canvas-win32-x64-msvc@1.0.10
+@napi-rs/canvas-win32-x64-msvc@1.0.11
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: locked optional platform package metadata
@@ -138,7 +138,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-asym-key@2.10.0
+@peculiar/asn1-asym-key@2.11.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -165,7 +165,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-cms@2.10.0
+@peculiar/asn1-cms@2.11.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -192,7 +192,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-csr@2.10.0
+@peculiar/asn1-csr@2.11.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -219,7 +219,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-ecc@2.10.0
+@peculiar/asn1-ecc@2.11.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -246,7 +246,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-pfx@2.10.0
+@peculiar/asn1-pfx@2.11.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -273,7 +273,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-pkcs8@2.10.0
+@peculiar/asn1-pkcs8@2.11.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -300,7 +300,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-pkcs9@2.10.0
+@peculiar/asn1-pkcs9@2.11.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -327,7 +327,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-rsa@2.10.0
+@peculiar/asn1-rsa@2.11.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -354,7 +354,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-schema@2.10.0
+@peculiar/asn1-schema@2.11.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -381,7 +381,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-x509@2.10.0
+@peculiar/asn1-x509@2.11.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -408,7 +408,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-x509-attr@2.10.0
+@peculiar/asn1-x509-attr@2.11.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -435,7 +435,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/asn1-x509-post-quantum@2.10.0
+@peculiar/asn1-x509-post-quantum@2.11.0
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -489,7 +489,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-@peculiar/x509@2.1.0
+@peculiar/x509@2.2.0
 Relationship: direct production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -909,7 +909,7 @@ Apache License
 
    END OF TERMS AND CONDITIONS
 ================================================================================
-postal-mime@4.0.4
+postal-mime@4.0.7
 Relationship: direct production dependency
 Declared licence: MIT-0
 Licence source: LICENSE.txt
@@ -1148,7 +1148,7 @@ CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ================================================================================
-tldts@7.4.16
+tldts@7.4.18
 Relationship: direct production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -1167,7 +1167,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
  WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ================================================================================
-tldts-core@7.4.16
+tldts-core@7.4.18
 Relationship: transitive production dependency
 Declared licence: MIT
 Licence source: LICENSE
@@ -1249,7 +1249,7 @@ MIT License
     OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     SOFTWARE
 ================================================================================
-undici@8.11.2
+undici@8.12.2
 Relationship: direct production dependency
 Declared licence: MIT
 Licence source: LICENSE