@slicedearth/whoisleuth-cli 2.7.0 → 2.8.0

package/package.json

@@ -33,7 +33,7 @@
   "bugs": {
     "url": "https://github.com/slicedearth/whoisleuth/issues"
   },
-  "version": "2.7.0",
+  "version": "2.8.0",
   "dependencies": {
     "@nuintun/qrcode": "5.0.3",
     "@peculiar/x509": "2.2.0",

package/packages/analysis/brand-profile-signals.mjs

@@ -0,0 +1,42 @@
+import { hammingDistanceHex, isInformativePerceptualHash } from "./perceptual-hash-comparison.mjs";
+function normalizedDomain(value) {
+    return value.trim().toLowerCase().replace(/\.$/u, '');
+}
+/** Shared exact comparison and role precedence for browser and CLI consumers. */
+export function profileDomainMatch(domain, profile = null) {
+    if (!profile || !domain)
+        return null;
+    const target = normalizedDomain(domain);
+    const lists = [
+        ['official', profile.officialDomains, 'Exact official-domain declaration'],
+        ['partner', profile.approvedPartnerDomains, 'Exact approved-partner declaration'],
+        ['allowlisted', profile.allowlistedDomains, 'Exact domain allowlist entry'],
+    ];
+    for (const [kind, values, reason] of lists) {
+        const matched = values.find(value => normalizedDomain(value) === target);
+        if (matched !== undefined)
+            return { kind, matchedDomain: normalizedDomain(matched), reason };
+    }
+    return null;
+}
+export function profileDomainKind(domain, profile = null) {
+    return profileDomainMatch(domain, profile)?.kind ?? null;
+}
+export function profileSignals(domain, evidence, profile = null) {
+    const trusted = profileDomainKind(domain, profile);
+    if (!profile || trusted)
+        return { trusted, faviconMatch: false, faviconNearMatch: false, reusesOfficialAssets: false };
+    const exact = Boolean(evidence.faviconHash && profile.officialFaviconHash && evidence.faviconHash === profile.officialFaviconHash);
+    const distance = isInformativePerceptualHash(evidence.faviconPHash) && isInformativePerceptualHash(profile.officialFaviconPHash)
+        ? hammingDistanceHex(evidence.faviconPHash, profile.officialFaviconPHash)
+        : null;
+    const official = new Set(profile.officialDomains.map(normalizedDomain));
+    const reused = Array.isArray(evidence.externalAssetHosts)
+        && evidence.externalAssetHosts.some((host) => typeof host === 'string' && official.has(normalizedDomain(host)));
+    return {
+        trusted: null,
+        faviconMatch: exact,
+        faviconNearMatch: !exact && distance !== null && distance <= 8,
+        reusesOfficialAssets: reused,
+    };
+}

package/packages/investigation/bulk-domain-comparison.mjs

@@ -1,5 +1,6 @@
 import { normalizeBulkSessionResult, } from "../workspace/bulk-session-model.mjs";
 import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../evidence/artifact-integrity.mjs";
+import { webCollectionAllowsComparison } from "../evidence/collection-quality.mjs";
 import { BULK_REVIEW_STALE_AFTER_DAYS } from "./bulk-review-policy.mjs";
 import { BULK_DOMAIN_COMPARISON_EXPORT_VERSION, BULK_DOMAIN_COMPARISON_SCHEMA, BULK_DOMAIN_COMPARISON_VERSION, } from "../contracts/investigation-portability.mjs";
 export { BULK_DOMAIN_COMPARISON_EXPORT_VERSION, BULK_DOMAIN_COMPARISON_SCHEMA, BULK_DOMAIN_COMPARISON_VERSION };
@@ -90,7 +91,7 @@ function row(id, category, label, left, right, method, context, limitations = []
         label,
         left: options.retained === false ? 'Not recorded in compact Bulk evidence' : display(left),
         right: options.retained === false ? 'Not recorded in compact Bulk evidence' : display(right),
-        state: state(left, right, context.leftSourceState, context.rightSourceState, options),
+        state: context.webComparable === false ? 'unavailable' : state(left, right, context.leftSourceState, context.rightSourceState, options),
         method: text(method, 320),
         source: text(context.source, 80),
         leftSourceState: context.leftSourceState,
@@ -98,7 +99,10 @@ function row(id, category, label, left, right, method, context, limitations = []
         observedAt: context.observedAt,
         leftEvidenceHref: context.leftEvidenceHref,
         rightEvidenceHref: context.rightEvidenceHref,
-        limitations: limitations.map((item) => text(item, 320)).filter(Boolean).slice(0, 6),
+        limitations: [
+            ...(context.webComparable === false ? ['Incomplete or unknown web collection; retained values are not comparable.'] : []),
+            ...limitations,
+        ].map((item) => text(item, 320)).filter(Boolean).slice(0, 6),
     };
 }
 function sourceSummary(value) {
@@ -157,6 +161,11 @@ export function buildBulkDomainComparison(leftRaw, rightRaw, observedAtRaw = nul
     const registry = context(left, right, 'Registry and registrar evidence', ['rdap', 'availability'], observedAt, options);
     const dns = context(left, right, 'DNS evidence', ['dns'], observedAt, options);
     const http = context(left, right, 'HTTP and static page evidence', ['http'], observedAt, options);
+    const webContext = (field, base = http) => ({
+        ...base,
+        webComparable: webCollectionAllowsComparison(field, left.webCollectionQuality, left.scanDepth)
+            && webCollectionAllowsComparison(field, right.webCollectionQuality, right.scanDepth),
+    });
     const tls = context(left, right, 'TLS evidence', ['tls'], observedAt, options);
     const compactTechnology = comparisonEvidenceContext(left, right, 'technology', {
         ...http,
@@ -203,13 +212,13 @@ export function buildBulkDomainComparison(leftRaw, rightRaw, observedAtRaw = nul
         row('null-mx', 'mail', 'Null MX observed', left.hasNullMx, right.hasNullMx, 'Compact Deep DNS observation', dns),
         row('spf', 'mail', 'SPF observed', left.hasSpf, right.hasSpf, 'Compact Deep DNS observation', dns),
         row('dmarc', 'mail', 'DMARC observed', left.hasDmarc, right.hasDmarc, 'Compact Deep DNS observation', dns),
-        row('website', 'web', 'Website activity', left.activityStatus, right.activityStatus, 'Bounded homepage observation', http),
-        row('page-title', 'identity', 'Page title', left.pageTitle, right.pageTitle, 'Normalised bounded title equality', http),
-        row('favicon', 'identity', 'Favicon fingerprint', left.faviconHash, right.faviconHash, 'Exact SHA-256 comparison', http),
+        row('website', 'web', 'Website activity', left.activityStatus, right.activityStatus, 'Bounded homepage observation', webContext('activityStatus')),
+        row('page-title', 'identity', 'Page title', left.pageTitle, right.pageTitle, 'Normalised bounded title equality', webContext('pageTitle')),
+        row('favicon', 'identity', 'Favicon fingerprint', left.faviconHash, right.faviconHash, 'Exact SHA-256 comparison', webContext('faviconHash')),
         row('tracking', 'identity', 'Tracking identifiers', left.relationship.trackingIdentifiers, right.relationship.trackingIdentifiers, 'Normalised exact set comparison', http, ['Shared identifiers are an investigative lead, not proof of ownership.']),
-        row('password-field', 'identity', 'Password field', left.hasPasswordField, right.hasPasswordField, 'Bounded static form observation', http),
-        row('phishing-language', 'identity', 'Phishing-language indicator', left.phishingLanguageMatch, right.phishingLanguageMatch, 'Bounded explainable page-language signal', http, ['A wording match is a review lead, not proof of malicious intent.']),
-        row('official-assets', 'identity', 'Official asset reuse', profileContextsComparable ? left.reusesOfficialAssets : null, profileContextsComparable ? right.reusesOfficialAssets : null, 'Configured Brand Profile comparison', profileContext, profileLimitations),
+        row('password-field', 'identity', 'Password field', left.hasPasswordField, right.hasPasswordField, 'Bounded static form observation', webContext('hasPasswordField')),
+        row('phishing-language', 'identity', 'Phishing-language indicator', left.phishingLanguageMatch, right.phishingLanguageMatch, 'Bounded explainable page-language signal', webContext('phishingLanguageMatch'), ['A wording match is a review lead, not proof of malicious intent.']),
+        row('official-assets', 'identity', 'Official asset reuse', profileContextsComparable ? left.reusesOfficialAssets : null, profileContextsComparable ? right.reusesOfficialAssets : null, 'Configured Brand Profile comparison', webContext('reusesOfficialAssets', profileContext), profileLimitations),
         row('technology', 'technology', 'Technology identifiers', left.comparisonEvidence?.technology.ids ?? [], right.comparisonEvidence?.technology.ids ?? [], 'Normalised exact set comparison of at most 12 curated identifiers', compactTechnology, ['An unmatched identifier is not evidence that a technology is absent. Shared technologies do not establish common ownership or control.']),
         row('source-health', 'source', 'Recorded source coverage', sourceSummary(left), sourceSummary(right), 'Source-by-source compact state comparison', source, ['A source-state difference can reflect collection conditions rather than a domain change.']),
     ];

package/third-party-notices.txt

@@ -516,7 +516,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ================================================================================
-asn1js@3.0.10
+asn1js@3.1.0
 Relationship: transitive production dependency
 Declared licence: BSD-3-Clause
 Licence source: LICENSE