@cyvest/cyvest-js 6.1.2 → 7.1.0

package/dist/index.cjs

@@ -1,2253 +1,2144 @@
-"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
 var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  LEVEL_COLORS: () => LEVEL_COLORS,
-  LEVEL_ORDER: () => LEVEL_ORDER,
-  LEVEL_VALUES: () => LEVEL_VALUES,
-  areConnected: () => areConnected,
-  compareLevels: () => compareLevels,
-  countRelationshipsByType: () => countRelationshipsByType,
-  findExternalObservables: () => findExternalObservables,
-  findFindingByName: () => findFindingByName,
-  findFindingsAtLeast: () => findFindingsAtLeast,
-  findFindingsByLevel: () => findFindingsByLevel,
-  findFindingsForObservable: () => findFindingsForObservable,
-  findFindingsForTag: () => findFindingsForTag,
-  findHighestScoringFindings: () => findHighestScoringFindings,
-  findHighestScoringObservables: () => findHighestScoringObservables,
-  findInternalObservables: () => findInternalObservables,
-  findLeafObservables: () => findLeafObservables,
-  findMaliciousFindings: () => findMaliciousFindings,
-  findMaliciousObservables: () => findMaliciousObservables,
-  findObservablesAtLeast: () => findObservablesAtLeast,
-  findObservablesByLevel: () => findObservablesByLevel,
-  findObservablesByType: () => findObservablesByType,
-  findObservablesByValue: () => findObservablesByValue,
-  findObservablesContaining: () => findObservablesContaining,
-  findObservablesForFinding: () => findObservablesForFinding,
-  findObservablesMatching: () => findObservablesMatching,
-  findObservablesWithThreatIntel: () => findObservablesWithThreatIntel,
-  findOrphanObservables: () => findOrphanObservables,
-  findPath: () => findPath,
-  findSourceObservables: () => findSourceObservables,
-  findSuspiciousFindings: () => findSuspiciousFindings,
-  findSuspiciousObservables: () => findSuspiciousObservables,
-  findTagsAtLeast: () => findTagsAtLeast,
-  findTagsByLevel: () => findTagsByLevel,
-  findTagsByNamePattern: () => findTagsByNamePattern,
-  findThreatIntelAtLeast: () => findThreatIntelAtLeast,
-  findThreatIntelByLevel: () => findThreatIntelByLevel,
-  findThreatIntelBySource: () => findThreatIntelBySource,
-  findThreatIntelsForObservable: () => findThreatIntelsForObservable,
-  findWhitelistedObservables: () => findWhitelistedObservables,
-  generateEnrichmentKey: () => generateEnrichmentKey,
-  generateFindingKey: () => generateFindingKey,
-  generateObservableKey: () => generateObservableKey,
-  generateTagKey: () => generateTagKey,
-  generateThreatIntelKey: () => generateThreatIntelKey,
-  getAllEnrichments: () => getAllEnrichments,
-  getAllEvidences: () => getAllEvidences,
-  getAllFindingKeys: () => getAllFindingKeys,
-  getAllFindings: () => getAllFindings,
-  getAllObservableTypes: () => getAllObservableTypes,
-  getAllObservables: () => getAllObservables,
-  getAllRelationshipTypes: () => getAllRelationshipTypes,
-  getAllTags: () => getAllTags,
-  getAllThreatIntelSources: () => getAllThreatIntelSources,
-  getAllThreatIntels: () => getAllThreatIntels,
-  getColorForLevel: () => getColorForLevel,
-  getColorForScore: () => getColorForScore,
-  getCounts: () => getCounts,
-  getDataExtraction: () => getDataExtraction,
-  getEnrichment: () => getEnrichment,
-  getEnrichmentByName: () => getEnrichmentByName,
-  getEntityLevel: () => getEntityLevel,
-  getEvidence: () => getEvidence,
-  getFinding: () => getFinding,
-  getFindingByName: () => getFindingByName,
-  getLevelFromScore: () => getLevelFromScore,
-  getObservable: () => getObservable,
-  getObservableByTypeValue: () => getObservableByTypeValue,
-  getObservableChildren: () => getObservableChildren,
-  getObservableGraph: () => getObservableGraph,
-  getObservableParents: () => getObservableParents,
-  getReachableObservables: () => getReachableObservables,
-  getRelatedObservables: () => getRelatedObservables,
-  getRelatedObservablesByDirection: () => getRelatedObservablesByDirection,
-  getRelatedObservablesByType: () => getRelatedObservablesByType,
-  getRelationshipsForObservable: () => getRelationshipsForObservable,
-  getRootObservable: () => getRootObservable,
-  getStartedAt: () => getStartedAt,
-  getStats: () => getStats,
-  getTag: () => getTag,
-  getTagAggregatedLevel: () => getTagAggregatedLevel,
-  getTagAggregatedScore: () => getTagAggregatedScore,
-  getTagAncestors: () => getTagAncestors,
-  getTagByName: () => getTagByName,
-  getTagChildren: () => getTagChildren,
-  getTagDescendants: () => getTagDescendants,
-  getThreatIntel: () => getThreatIntel,
-  getThreatIntelBySourceObservable: () => getThreatIntelBySourceObservable,
-  getWhitelists: () => getWhitelists,
-  hasLevel: () => hasLevel,
-  isCyvest: () => isCyvest,
-  isLevelAtLeast: () => isLevelAtLeast,
-  isLevelHigherThan: () => isLevelHigherThan,
-  isLevelLowerThan: () => isLevelLowerThan,
-  isTagChildOf: () => isTagChildOf,
-  isTagDescendantOf: () => isTagDescendantOf,
-  isValidLevel: () => isValidLevel,
-  maxLevel: () => maxLevel,
-  minLevel: () => minLevel,
-  normalizeLevel: () => normalizeLevel,
-  parseCyvest: () => parseCyvest,
-  parseFindingKey: () => parseFindingKey,
-  parseKeyType: () => parseKeyType,
-  parseObservableKey: () => parseObservableKey,
-  parseThreatIntelKey: () => parseThreatIntelKey,
-  sortFindingsByLevel: () => sortFindingsByLevel,
-  sortFindingsByScore: () => sortFindingsByScore,
-  sortObservablesByLevel: () => sortObservablesByLevel,
-  sortObservablesByScore: () => sortObservablesByScore,
-  validateKey: () => validateKey
-});
-module.exports = __toCommonJS(index_exports);
-
-// src/helpers.ts
-var import__ = __toESM(require("ajv/dist/2020.js"), 1);
-var import_ajv_formats = __toESM(require("ajv-formats"), 1);
-
-// ../../../schema/cyvest.schema.json
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+let ajv_dist_2020_js = require("ajv/dist/2020.js");
+ajv_dist_2020_js = __toESM(ajv_dist_2020_js, 1);
+let ajv_formats = require("ajv-formats");
+ajv_formats = __toESM(ajv_formats, 1);
+//#region ../../../schema/cyvest.schema.json
 var cyvest_schema_default = {
-  $defs: {
-    AuditEvent: {
-      additionalProperties: true,
-      description: "Centralized audit event for investigation-level changes.",
-      properties: {
-        event_id: {
-          title: "Event Id",
-          type: "string"
-        },
-        timestamp: {
-          format: "date-time",
-          title: "Timestamp",
-          type: "string"
-        },
-        event_type: {
-          title: "Event Type",
-          type: "string"
-        },
-        actor: {
-          anyOf: [
-            {
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ],
-          default: null,
-          title: "Actor"
-        },
-        reason: {
-          anyOf: [
-            {
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ],
-          default: null,
-          title: "Reason"
-        },
-        tool: {
-          anyOf: [
-            {
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ],
-          default: null,
-          title: "Tool"
-        },
-        object_type: {
-          anyOf: [
-            {
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ],
-          default: null,
-          title: "Object Type"
-        },
-        object_key: {
-          anyOf: [
-            {
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ],
-          default: null,
-          title: "Object Key"
-        },
-        details: {
-          additionalProperties: true,
-          title: "Details",
-          type: "object"
-        }
-      },
-      required: [
-        "event_id",
-        "timestamp",
-        "event_type"
-      ],
-      title: "AuditEvent",
-      type: "object"
-    },
-    DataExtractionSchema: {
-      additionalProperties: false,
-      description: "Schema for data extraction metadata.",
-      properties: {
-        root_type: {
-          anyOf: [
-            {
-              enum: [
-                "file",
-                "artifact"
-              ],
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ],
-          default: null,
-          description: "Root observable type used during data extraction.",
-          title: "Root Type"
-        },
-        score_mode_obs: {
-          $ref: "#/$defs/ScoreMode",
-          description: "Observable score aggregation mode: 'max' takes highest score, 'sum' adds all scores."
-        }
-      },
-      required: [
-        "score_mode_obs"
-      ],
-      title: "DataExtractionSchema",
-      type: "object"
-    },
-    Enrichment: {
-      description: "Represents structured data enrichment for the investigation.\n\nEnrichments store arbitrary structured data that provides additional\ncontext but doesn't directly contribute to scoring.",
-      properties: {
-        name: {
-          title: "Name",
-          type: "string"
-        },
-        data: {
-          title: "Data"
-        },
-        context: {
-          title: "Context",
-          type: "string"
-        },
-        key: {
-          title: "Key",
-          type: "string"
-        }
-      },
-      required: [
-        "name",
-        "data",
-        "context",
-        "key"
-      ],
-      title: "Enrichment",
-      type: "object"
-    },
-    Evidence: {
-      description: "Structured material supporting one or more findings.",
-      properties: {
-        type: {
-          title: "Type",
-          type: "string"
-        },
-        title: {
-          title: "Title",
-          type: "string"
-        },
-        description: {
-          title: "Description",
-          type: "string"
-        },
-        source: {
-          title: "Source",
-          type: "string"
-        },
-        external_id: {
-          anyOf: [
-            {
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ],
-          title: "External Id"
-        },
-        content: {
-          anyOf: [
-            {},
-            {
-              type: "null"
-            }
-          ],
-          title: "Content"
-        },
-        uri: {
-          anyOf: [
-            {
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ],
-          title: "Uri"
-        },
-        captured_at: {
-          format: "date-time",
-          title: "Captured At",
-          type: "string"
-        },
-        extra: {
-          additionalProperties: true,
-          title: "Extra",
-          type: "object"
-        },
-        key: {
-          title: "Key",
-          type: "string"
-        },
-        finding_links: {
-          description: "Findings that currently link to this evidence (navigation-only).",
-          items: {
-            type: "string"
-          },
-          readOnly: true,
-          title: "Finding Links",
-          type: "array"
-        }
-      },
-      required: [
-        "type",
-        "title",
-        "description",
-        "source",
-        "external_id",
-        "content",
-        "uri",
-        "captured_at",
-        "extra",
-        "key",
-        "finding_links"
-      ],
-      title: "Evidence",
-      type: "object"
-    },
-    EvidenceLink: {
-      additionalProperties: false,
-      description: "Edge metadata for a Finding\u2194Evidence association.",
-      properties: {
-        evidence_key: {
-          title: "Evidence Key",
-          type: "string"
-        }
-      },
-      required: [
-        "evidence_key"
-      ],
-      title: "EvidenceLink",
-      type: "object"
-    },
-    Finding: {
-      description: "Represents a verification step in the investigation.\n\nA finding validates a specific aspect of the data under investigation\nand contributes to the overall investigation score.",
-      properties: {
-        finding_name: {
-          title: "Finding Name",
-          type: "string"
-        },
-        description: {
-          title: "Description",
-          type: "string"
-        },
-        comment: {
-          title: "Comment",
-          type: "string"
-        },
-        extra: {
-          additionalProperties: true,
-          title: "Extra",
-          type: "object"
-        },
-        score: {
-          title: "Score",
-          type: "number"
-        },
-        level: {
-          $ref: "#/$defs/Level"
-        },
-        origin_investigation_id: {
-          title: "Origin Investigation Id",
-          type: "string"
-        },
-        observable_links: {
-          items: {
-            $ref: "#/$defs/ObservableLink"
-          },
-          title: "Observable Links",
-          type: "array"
-        },
-        evidence_links: {
-          items: {
-            $ref: "#/$defs/EvidenceLink"
-          },
-          title: "Evidence Links",
-          type: "array"
-        },
-        key: {
-          title: "Key",
-          type: "string"
-        },
-        score_display: {
-          readOnly: true,
-          title: "Score Display",
-          type: "string"
-        }
-      },
-      required: [
-        "finding_name",
-        "description",
-        "comment",
-        "extra",
-        "score",
-        "level",
-        "origin_investigation_id",
-        "observable_links",
-        "evidence_links",
-        "key",
-        "score_display"
-      ],
-      title: "Finding",
-      type: "object"
-    },
-    InvestigationWhitelist: {
-      description: "Represents a whitelist entry on an investigation.",
-      properties: {
-        identifier: {
-          minLength: 1,
-          title: "Identifier",
-          type: "string"
-        },
-        name: {
-          minLength: 1,
-          title: "Name",
-          type: "string"
-        },
-        justification: {
-          anyOf: [
-            {
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ],
-          default: null,
-          title: "Justification"
-        }
-      },
-      required: [
-        "identifier",
-        "name"
-      ],
-      title: "InvestigationWhitelist",
-      type: "object"
-    },
-    Level: {
-      description: "Security level classification for findings, observables, and threat intelligence.\n\nLevels are ordered from lowest (NONE) to highest (MALICIOUS) severity.",
-      enum: [
-        "NONE",
-        "TRUSTED",
-        "INFO",
-        "SAFE",
-        "NOTABLE",
-        "SUSPICIOUS",
-        "MALICIOUS"
-      ],
-      title: "Level",
-      type: "string"
-    },
-    Observable: {
-      description: "Represents a cyber observable (IP, URL, domain, hash, etc.).\n\nObservables can be linked to threat intelligence, findings, and other observables\nthrough relationships.",
-      properties: {
-        type: {
-          title: "Type",
-          type: "string"
-        },
-        subtype: {
-          anyOf: [
-            {
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ],
-          title: "Subtype"
-        },
-        namespace: {
-          anyOf: [
-            {
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ],
-          default: null,
-          title: "Namespace"
-        },
-        value: {
-          title: "Value",
-          type: "string"
-        },
-        internal: {
-          title: "Internal",
-          type: "boolean"
-        },
-        whitelisted: {
-          title: "Whitelisted",
-          type: "boolean"
-        },
-        comment: {
-          title: "Comment",
-          type: "string"
-        },
-        extra: {
-          additionalProperties: true,
-          title: "Extra",
-          type: "object"
-        },
-        score: {
-          title: "Score",
-          type: "number"
-        },
-        level: {
-          $ref: "#/$defs/Level"
-        },
-        aliases: {
-          items: {
-            $ref: "#/$defs/ObservableAlias"
-          },
-          title: "Aliases",
-          type: "array"
-        },
-        occurrence_count: {
-          default: 1,
-          minimum: 1,
-          title: "Occurrence Count",
-          type: "integer"
-        },
-        threat_intels: {
-          items: {
-            type: "string"
-          },
-          title: "Threat Intels",
-          type: "array"
-        },
-        relationships: {
-          items: {
-            $ref: "#/$defs/Relationship"
-          },
-          title: "Relationships",
-          type: "array"
-        },
-        key: {
-          title: "Key",
-          type: "string"
-        },
-        finding_links: {
-          description: "Findings that currently link to this observable (navigation-only).",
-          items: {
-            type: "string"
-          },
-          readOnly: true,
-          title: "Finding Links",
-          type: "array"
-        },
-        score_display: {
-          readOnly: true,
-          title: "Score Display",
-          type: "string"
-        }
-      },
-      required: [
-        "type",
-        "value",
-        "internal",
-        "whitelisted",
-        "comment",
-        "extra",
-        "score",
-        "level",
-        "threat_intels",
-        "relationships",
-        "key",
-        "finding_links",
-        "score_display"
-      ],
-      title: "Observable",
-      type: "object"
-    },
-    ObservableAlias: {
-      description: "Source observable identity attached to a canonical observable.",
-      properties: {
-        type: {
-          title: "Type",
-          type: "string"
-        },
-        subtype: {
-          anyOf: [
-            {
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ],
-          title: "Subtype"
-        },
-        namespace: {
-          anyOf: [
-            {
-              type: "string"
-            },
-            {
-              type: "null"
-            }
-          ],
-          default: null,
-          title: "Namespace"
-        },
-        value: {
-          title: "Value",
-          type: "string"
-        },
-        count: {
-          default: 1,
-          minimum: 1,
-          title: "Count",
-          type: "integer"
-        }
-      },
-      required: [
-        "type",
-        "value"
-      ],
-      title: "ObservableAlias",
-      type: "object"
-    },
-    ObservableLink: {
-      additionalProperties: false,
-      description: "Edge metadata for a Finding\u2194Observable association.",
-      properties: {
-        observable_key: {
-          title: "Observable Key",
-          type: "string"
-        },
-        propagation_mode: {
-          $ref: "#/$defs/PropagationMode",
-          default: "LOCAL_ONLY"
-        }
-      },
-      required: [
-        "observable_key"
-      ],
-      title: "ObservableLink",
-      type: "object"
-    },
-    PropagationMode: {
-      description: "Controls how a Finding\u2194Observable link propagates across merged investigations.",
-      enum: [
-        "LOCAL_ONLY",
-        "GLOBAL"
-      ],
-      title: "PropagationMode",
-      type: "string"
-    },
-    Relationship: {
-      description: "Represents a relationship between observables.",
-      properties: {
-        target_key: {
-          title: "Target Key",
-          type: "string"
-        },
-        relationship_type: {
-          title: "Relationship Type",
-          type: "string"
-        },
-        direction: {
-          $ref: "#/$defs/RelationshipDirection"
-        }
-      },
-      required: [
-        "target_key",
-        "relationship_type",
-        "direction"
-      ],
-      title: "Relationship",
-      type: "object"
-    },
-    RelationshipDirection: {
-      description: "Direction of a relationship between observables.",
-      enum: [
-        "outbound",
-        "inbound",
-        "bidirectional"
-      ],
-      title: "RelationshipDirection",
-      type: "string"
-    },
-    ScoreMode: {
-      description: "Score calculation mode for observables.",
-      enum: [
-        "max",
-        "sum"
-      ],
-      title: "ScoreMode",
-      type: "string"
-    },
-    StatisticsSchema: {
-      additionalProperties: false,
-      description: "Schema for investigation statistics.\n\nMirrors the output of `InvestigationStats.get_summary()`.",
-      properties: {
-        total_observables: {
-          minimum: 0,
-          title: "Total Observables",
-          type: "integer"
-        },
-        internal_observables: {
-          minimum: 0,
-          title: "Internal Observables",
-          type: "integer"
-        },
-        external_observables: {
-          minimum: 0,
-          title: "External Observables",
-          type: "integer"
-        },
-        whitelisted_observables: {
-          minimum: 0,
-          title: "Whitelisted Observables",
-          type: "integer"
-        },
-        observables_by_type: {
-          additionalProperties: {
-            minimum: 0,
-            type: "integer"
-          },
-          title: "Observables By Type",
-          type: "object"
-        },
-        observables_by_level: {
-          additionalProperties: {
-            minimum: 0,
-            type: "integer"
-          },
-          title: "Observables By Level",
-          type: "object"
-        },
-        observables_by_type_and_level: {
-          additionalProperties: {
-            additionalProperties: {
-              minimum: 0,
-              type: "integer"
-            },
-            type: "object"
-          },
-          title: "Observables By Type And Level",
-          type: "object"
-        },
-        total_findings: {
-          minimum: 0,
-          title: "Total Findings",
-          type: "integer"
-        },
-        applied_findings: {
-          minimum: 0,
-          title: "Applied Findings",
-          type: "integer"
-        },
-        findings_by_level: {
-          additionalProperties: {
-            items: {
-              type: "string"
-            },
-            type: "array"
-          },
-          title: "Findings By Level",
-          type: "object"
-        },
-        total_evidences: {
-          minimum: 0,
-          title: "Total Evidences",
-          type: "integer"
-        },
-        evidences_by_type: {
-          additionalProperties: {
-            minimum: 0,
-            type: "integer"
-          },
-          title: "Evidences By Type",
-          type: "object"
-        },
-        evidences_by_source: {
-          additionalProperties: {
-            minimum: 0,
-            type: "integer"
-          },
-          title: "Evidences By Source",
-          type: "object"
-        },
-        total_threat_intel: {
-          minimum: 0,
-          title: "Total Threat Intel",
-          type: "integer"
-        },
-        threat_intel_by_source: {
-          additionalProperties: {
-            minimum: 0,
-            type: "integer"
-          },
-          title: "Threat Intel By Source",
-          type: "object"
-        },
-        threat_intel_by_level: {
-          additionalProperties: {
-            minimum: 0,
-            type: "integer"
-          },
-          title: "Threat Intel By Level",
-          type: "object"
-        },
-        total_tags: {
-          minimum: 0,
-          title: "Total Tags",
-          type: "integer"
-        }
-      },
-      required: [
-        "total_observables",
-        "internal_observables",
-        "external_observables",
-        "whitelisted_observables",
-        "total_findings",
-        "applied_findings",
-        "total_evidences",
-        "total_threat_intel",
-        "total_tags"
-      ],
-      title: "StatisticsSchema",
-      type: "object"
-    },
-    Tag: {
-      additionalProperties: false,
-      description: 'Groups findings for categorical organization.\n\nTags allow structuring the investigation into logical sections\nwith aggregated scores and levels. Hierarchy is automatic based on\nthe ":" delimiter in tag names (e.g., "header:auth:dkim").',
-      properties: {
-        name: {
-          title: "Name",
-          type: "string"
-        },
-        description: {
-          default: "",
-          title: "Description",
-          type: "string"
-        },
-        findings: {
-          items: {
-            type: "string"
-          },
-          title: "Findings",
-          type: "array"
-        },
-        key: {
-          title: "Key",
-          type: "string"
-        },
-        direct_score: {
-          description: "Calculate the score from direct findings only (no hierarchy).\n\nFor hierarchical aggregation (including descendant tags), use\nInvestigation.get_tag_aggregated_score() or TagProxy.get_aggregated_score().\n\nReturns:\n    Total score from direct findings",
-          readOnly: true,
-          title: "Direct Score",
-          type: "number"
-        },
-        direct_level: {
-          $ref: "#/$defs/Level",
-          description: "Calculate the level from direct findings only (no hierarchy).\n\nFor hierarchical aggregation (including descendant tags), use\nInvestigation.get_tag_aggregated_level() or TagProxy.get_aggregated_level().\n\nReturns:\n    Level based on direct score",
-          readOnly: true
-        }
-      },
-      required: [
-        "name",
-        "findings",
-        "key",
-        "direct_score",
-        "direct_level"
-      ],
-      title: "Tag",
-      type: "object"
-    },
-    Taxonomy: {
-      additionalProperties: false,
-      description: "Represents a structured taxonomy entry for threat intelligence.",
-      properties: {
-        level: {
-          $ref: "#/$defs/Level"
-        },
-        name: {
-          title: "Name",
-          type: "string"
-        },
-        value: {
-          title: "Value",
-          type: "string"
-        }
-      },
-      required: [
-        "level",
-        "name",
-        "value"
-      ],
-      title: "Taxonomy",
-      type: "object"
-    },
-    ThreatIntel: {
-      description: "Represents threat intelligence from an external source.\n\nThreat intelligence provides verdicts about observables from sources\nlike VirusTotal, URLScan.io, etc.",
-      properties: {
-        source: {
-          title: "Source",
-          type: "string"
-        },
-        observable_key: {
-          title: "Observable Key",
-          type: "string"
-        },
-        comment: {
-          title: "Comment",
-          type: "string"
-        },
-        extra: {
-          additionalProperties: true,
-          title: "Extra",
-          type: "object"
-        },
-        score: {
-          title: "Score",
-          type: "number"
-        },
-        level: {
-          $ref: "#/$defs/Level"
-        },
-        taxonomies: {
-          items: {
-            $ref: "#/$defs/Taxonomy"
-          },
-          title: "Taxonomies",
-          type: "array"
-        },
-        key: {
-          title: "Key",
-          type: "string"
-        },
-        score_display: {
-          readOnly: true,
-          title: "Score Display",
-          type: "string"
-        }
-      },
-      required: [
-        "source",
-        "observable_key",
-        "comment",
-        "extra",
-        "score",
-        "level",
-        "taxonomies",
-        "key",
-        "score_display"
-      ],
-      title: "ThreatIntel",
-      type: "object"
-    }
-  },
-  $id: "https://cyvest.io/schema/investigation.json",
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  additionalProperties: false,
-  description: "Schema for a complete serialized investigation.\n\nThis model describes the output of `serialize_investigation()` from\n`cyvest.io_serialization`. It is the top-level schema for exported investigations.\n\nEntity types reference the runtime models directly. When generating schemas with\n`mode='serialization'`, Pydantic respects field_serializer decorators and produces\nschemas matching the actual model_dump() output.",
-  properties: {
-    schema_version: {
-      const: "6.0.0",
-      default: "6.0.0",
-      title: "Schema Version",
-      type: "string"
-    },
-    investigation_id: {
-      description: "Stable investigation identity (ULID).",
-      title: "Investigation Id",
-      type: "string"
-    },
-    investigation_name: {
-      anyOf: [
-        {
-          type: "string"
-        },
-        {
-          type: "null"
-        }
-      ],
-      default: null,
-      description: "Optional human-readable investigation name.",
-      title: "Investigation Name"
-    },
-    score: {
-      description: "Global investigation score.",
-      title: "Score",
-      type: "number"
-    },
-    level: {
-      $ref: "#/$defs/Level",
-      description: "Security level classification from NONE (lowest) to MALICIOUS (highest)."
-    },
-    whitelisted: {
-      description: "Whether the investigation is whitelisted.",
-      title: "Whitelisted",
-      type: "boolean"
-    },
-    whitelists: {
-      description: "List of whitelist entries applied to this investigation.",
-      items: {
-        $ref: "#/$defs/InvestigationWhitelist"
-      },
-      title: "Whitelists",
-      type: "array"
-    },
-    audit_log: {
-      anyOf: [
-        {
-          items: {
-            $ref: "#/$defs/AuditEvent"
-          },
-          type: "array"
-        },
-        {
-          type: "null"
-        }
-      ],
-      description: "Append-only investigation audit log. Null when serialization disabled audit.",
-      title: "Audit Log"
-    },
-    observables: {
-      additionalProperties: {
-        $ref: "#/$defs/Observable"
-      },
-      description: "Observables keyed by their unique key.",
-      title: "Observables",
-      type: "object"
-    },
-    findings: {
-      additionalProperties: {
-        $ref: "#/$defs/Finding"
-      },
-      description: "Findings keyed by their unique key.",
-      title: "Findings",
-      type: "object"
-    },
-    evidences: {
-      additionalProperties: {
-        $ref: "#/$defs/Evidence"
-      },
-      description: "Evidence objects keyed by their unique key.",
-      title: "Evidences",
-      type: "object"
-    },
-    threat_intels: {
-      additionalProperties: {
-        $ref: "#/$defs/ThreatIntel"
-      },
-      description: "Threat intelligence entries keyed by their unique key.",
-      title: "Threat Intels",
-      type: "object"
-    },
-    enrichments: {
-      additionalProperties: {
-        $ref: "#/$defs/Enrichment"
-      },
-      description: "Enrichment entries keyed by their unique key.",
-      title: "Enrichments",
-      type: "object"
-    },
-    tags: {
-      additionalProperties: {
-        $ref: "#/$defs/Tag"
-      },
-      description: "Tags keyed by their unique key.",
-      title: "Tags",
-      type: "object"
-    },
-    stats: {
-      $ref: "#/$defs/StatisticsSchema",
-      description: "Investigation statistics summary."
-    },
-    data_extraction: {
-      $ref: "#/$defs/DataExtractionSchema",
-      description: "Data extraction metadata."
-    },
-    score_display: {
-      description: "Global investigation score formatted as fixed-point x.xx.",
-      readOnly: true,
-      title: "Score Display",
-      type: "string"
-    }
-  },
-  required: [
-    "investigation_id",
-    "score",
-    "level",
-    "whitelisted",
-    "whitelists",
-    "observables",
-    "findings",
-    "evidences",
-    "threat_intels",
-    "enrichments",
-    "tags",
-    "stats",
-    "data_extraction",
-    "score_display"
-  ],
-  title: "Cyvest Investigation",
-  type: "object"
+	$defs: {
+		"Contribution": {
+			"description": "One named term that fed a result, kept so the report can explain itself.",
+			"properties": {
+				"source_key": {
+					"title": "Source Key",
+					"type": "string"
+				},
+				"label": {
+					"title": "Label",
+					"type": "string"
+				},
+				"value": {
+					"title": "Value",
+					"type": "number"
+				},
+				"retained": {
+					"default": true,
+					"title": "Retained",
+					"type": "boolean"
+				},
+				"detail": {
+					"default": "",
+					"title": "Detail",
+					"type": "string"
+				}
+			},
+			"required": [
+				"source_key",
+				"label",
+				"value"
+			],
+			"title": "Contribution",
+			"type": "object"
+		},
+		"Decision": {
+			"additionalProperties": false,
+			"description": "A human (or automated) call that overrides the computed result for one target.\n\n``UPHOLD`` forces the target to the policy floor, ``REFUTE`` neutralises it, ``VACATED``\nwithdraws a previous stance and restores the computed value. How each is applied depends on\nthe family of the target — an observable is bounded, a claim is taken out of the count — but\nthat is the engine's dispatch, not a second axis of this model.\n\n``justification`` is required: an override whose reason is optional is an override that\ncannot be audited, which defeats the point of recording it as a fact at all.",
+			"properties": {
+				"key": {
+					"minLength": 1,
+					"title": "Key",
+					"type": "string"
+				},
+				"seq": {
+					"maxLength": 26,
+					"minLength": 26,
+					"title": "Seq",
+					"type": "string"
+				},
+				"asserted_at": {
+					"format": "date-time",
+					"title": "Asserted At",
+					"type": "string"
+				},
+				"occurred_at": {
+					"anyOf": [{
+						"format": "date-time",
+						"type": "string"
+					}, { "type": "null" }],
+					"default": null,
+					"title": "Occurred At"
+				},
+				"source": { "$ref": "#/$defs/SourceRef" },
+				"fragment_id": {
+					"title": "Fragment Id",
+					"type": "string"
+				},
+				"external_id": {
+					"anyOf": [{ "type": "string" }, { "type": "null" }],
+					"default": null,
+					"title": "External Id"
+				},
+				"evidence_keys": {
+					"default": [],
+					"items": { "type": "string" },
+					"title": "Evidence Keys",
+					"type": "array"
+				},
+				"target_key": {
+					"minLength": 1,
+					"title": "Target Key",
+					"type": "string"
+				},
+				"kind": { "$ref": "#/$defs/DecisionKind" },
+				"justification": {
+					"minLength": 1,
+					"title": "Justification",
+					"type": "string"
+				}
+			},
+			"required": [
+				"key",
+				"seq",
+				"asserted_at",
+				"source",
+				"fragment_id",
+				"target_key",
+				"kind",
+				"justification"
+			],
+			"title": "Decision",
+			"type": "object"
+		},
+		"DecisionKind": {
+			"description": "A named override of the computation.\n\nForcing a score has to be a declared act — never the side effect of an inflated weight.\n\nThe kind states the **intent**; the mechanism follows from the family of the target, which\nthe key already carries. An earlier design enumerated one value per ``(intent, family)``\npair — ``ALLOWLISTED``/``BLOCKLISTED``/``CONFIRMED``/``DISMISSED`` — and then needed a\nvalidator to forbid the half of that product which made no sense. An enum requiring a\nvalidator to reject half its combinations encodes one axis too many: the family is the\ntarget's business, not the decision's.\n\nThe domain vocabulary survives untouched on the façade (``allowlist``, ``blocklist``,\n``confirm``, ``dismiss``), where it belongs.",
+			"enum": [
+				"UPHOLD",
+				"REFUTE",
+				"VACATED"
+			],
+			"title": "DecisionKind",
+			"type": "string"
+		},
+		"Effect": {
+			"description": "How a finding enters the investigation total. :class:`Status` says *whether*, this says *how*.\n\n``ADDITIVE`` is every finding v6 ever had: a term of the sum.\n\n``FLOOR`` and ``CEILING`` are the two halves of a **conclusion** — typically an analysis that\nread the other findings. Neither is a term: a floor raises the total just enough to reach the\nverdict it asserts, a ceiling lowers it just enough. Both add nothing once the investigation\nis already there, so conclusions never compound and several analysers may conclude on the\nsame case without inflating — or deflating — each other.\n\nA ceiling is what states a **declared benign context**: an awareness campaign, a sanctioned\npentest window, an authorised scanner. Without it the model could force a case up but never\ndown, and the only way to say \"whatever the evidence, this is benign\" would be to guess a\nlarge negative weight — the v6 mistake.\n\nThe band a verdict maps to is ``basic-v1``'s convention, like every other number here — see\n:mod:`cyvest.evaluation.projection`.",
+			"enum": [
+				"ADDITIVE",
+				"FLOOR",
+				"CEILING"
+			],
+			"title": "Effect",
+			"type": "string"
+		},
+		"Evidence": {
+			"additionalProperties": false,
+			"description": "A captured artefact: an API response, a header dump, an enrichment payload.",
+			"properties": {
+				"key": {
+					"minLength": 1,
+					"title": "Key",
+					"type": "string"
+				},
+				"seq": {
+					"maxLength": 26,
+					"minLength": 26,
+					"title": "Seq",
+					"type": "string"
+				},
+				"asserted_at": {
+					"format": "date-time",
+					"title": "Asserted At",
+					"type": "string"
+				},
+				"occurred_at": {
+					"anyOf": [{
+						"format": "date-time",
+						"type": "string"
+					}, { "type": "null" }],
+					"default": null,
+					"title": "Occurred At"
+				},
+				"source": { "$ref": "#/$defs/SourceRef" },
+				"fragment_id": {
+					"title": "Fragment Id",
+					"type": "string"
+				},
+				"external_id": {
+					"anyOf": [{ "type": "string" }, { "type": "null" }],
+					"default": null,
+					"title": "External Id"
+				},
+				"evidence_keys": {
+					"default": [],
+					"items": { "type": "string" },
+					"title": "Evidence Keys",
+					"type": "array"
+				},
+				"evidence_type": {
+					"minLength": 1,
+					"title": "Evidence Type",
+					"type": "string"
+				},
+				"title": {
+					"default": "",
+					"title": "Title",
+					"type": "string"
+				},
+				"content": {
+					"default": null,
+					"title": "Content"
+				},
+				"uri": {
+					"anyOf": [{ "type": "string" }, { "type": "null" }],
+					"default": null,
+					"title": "Uri"
+				},
+				"captured_at": {
+					"anyOf": [{
+						"format": "date-time",
+						"type": "string"
+					}, { "type": "null" }],
+					"default": null,
+					"title": "Captured At"
+				}
+			},
+			"required": [
+				"key",
+				"seq",
+				"asserted_at",
+				"source",
+				"fragment_id",
+				"evidence_type"
+			],
+			"title": "Evidence",
+			"type": "object"
+		},
+		"FactsSchema": {
+			"additionalProperties": false,
+			"description": "The fact collections, each keyed by its semantic key.",
+			"properties": {
+				"observables": {
+					"additionalProperties": { "$ref": "#/$defs/Observable" },
+					"title": "Observables",
+					"type": "object"
+				},
+				"relations": {
+					"additionalProperties": { "$ref": "#/$defs/Relation" },
+					"title": "Relations",
+					"type": "object"
+				},
+				"signals": {
+					"additionalProperties": { "$ref": "#/$defs/ThreatIntel" },
+					"title": "Signals",
+					"type": "object"
+				},
+				"evidences": {
+					"additionalProperties": { "$ref": "#/$defs/Evidence" },
+					"title": "Evidences",
+					"type": "object"
+				},
+				"findings": {
+					"additionalProperties": { "$ref": "#/$defs/Finding" },
+					"title": "Findings",
+					"type": "object"
+				}
+			},
+			"title": "FactsSchema",
+			"type": "object"
+		},
+		"Finding": {
+			"additionalProperties": false,
+			"description": "A rule outcome. Identity is ``rule_id`` alone, plus ``external_id`` when one is given.\n\nA finding names no subject: what it is about is its ``observable_links``, which are also what\nit scores on. Use ``external_id`` when the same rule must yield several findings — typically\nonce per observable, ``external_id=url.key``.\n\nA finding that describes an activity is **dated** through the envelope's ``occurred_at`` —\nwhen the activity happened, as opposed to when the rule fired — and may name the ATT&CK\n``tactic`` it demonstrates. Both are what the timeline reads; neither enters the score.",
+			"properties": {
+				"verdict": {
+					"$ref": "#/$defs/Verdict",
+					"default": "INFO"
+				},
+				"confidence": {
+					"default": 1,
+					"exclusiveMinimum": 0,
+					"maximum": 1,
+					"title": "Confidence",
+					"type": "number"
+				},
+				"weight": {
+					"anyOf": [{
+						"minimum": 0,
+						"type": "number"
+					}, { "type": "null" }],
+					"default": null,
+					"title": "Weight"
+				},
+				"key": {
+					"minLength": 1,
+					"title": "Key",
+					"type": "string"
+				},
+				"seq": {
+					"maxLength": 26,
+					"minLength": 26,
+					"title": "Seq",
+					"type": "string"
+				},
+				"asserted_at": {
+					"format": "date-time",
+					"title": "Asserted At",
+					"type": "string"
+				},
+				"occurred_at": {
+					"anyOf": [{
+						"format": "date-time",
+						"type": "string"
+					}, { "type": "null" }],
+					"default": null,
+					"title": "Occurred At"
+				},
+				"source": { "$ref": "#/$defs/SourceRef" },
+				"fragment_id": {
+					"title": "Fragment Id",
+					"type": "string"
+				},
+				"external_id": {
+					"anyOf": [{ "type": "string" }, { "type": "null" }],
+					"default": null,
+					"title": "External Id"
+				},
+				"evidence_keys": {
+					"default": [],
+					"items": { "type": "string" },
+					"title": "Evidence Keys",
+					"type": "array"
+				},
+				"rule_id": {
+					"minLength": 1,
+					"title": "Rule Id",
+					"type": "string"
+				},
+				"rule_version": {
+					"default": "1",
+					"title": "Rule Version",
+					"type": "string"
+				},
+				"name": {
+					"default": "",
+					"title": "Name",
+					"type": "string"
+				},
+				"comment": {
+					"default": "",
+					"title": "Comment",
+					"type": "string"
+				},
+				"status": {
+					"$ref": "#/$defs/Status",
+					"default": "EVALUATED"
+				},
+				"effect": {
+					"$ref": "#/$defs/Effect",
+					"default": "ADDITIVE"
+				},
+				"observable_links": {
+					"default": [],
+					"items": { "$ref": "#/$defs/ObservableLink" },
+					"title": "Observable Links",
+					"type": "array"
+				},
+				"labels": {
+					"default": [],
+					"items": { "$ref": "#/$defs/Label" },
+					"title": "Labels",
+					"type": "array"
+				},
+				"tactic": {
+					"anyOf": [{ "$ref": "#/$defs/Tactic" }, { "type": "null" }],
+					"default": null
+				},
+				"extra": {
+					"additionalProperties": true,
+					"title": "Extra",
+					"type": "object"
+				}
+			},
+			"required": [
+				"key",
+				"seq",
+				"asserted_at",
+				"source",
+				"fragment_id",
+				"rule_id"
+			],
+			"title": "Finding",
+			"type": "object"
+		},
+		"FindingResult": {
+			"description": "A finding's verdict.\n\n``own_term_suppressed`` flags that the rule's own claim was overridden by a stronger link —\na contradiction worth surfacing rather than silently dropping.\n\nThree combinations of ``(counted, score)`` are meaningful, and a consumer must not conflate\nthe last two:\n\n- ``(True, float)`` — an additive finding, a term of the total;\n- ``(False, None)`` — dismissed or not evaluated: visible, but out of the evaluation;\n- ``(True, None)`` — a conclusion (``effect`` is ``FLOOR`` or ``CEILING``): it takes part, but\n  it has no magnitude of its own. Its effect is a bound on the investigation total, reported\n  as a contribution of :class:`InvestigationResult`.",
+			"properties": {
+				"key": {
+					"title": "Key",
+					"type": "string"
+				},
+				"verdict": {
+					"$ref": "#/$defs/Verdict",
+					"default": "INFO"
+				},
+				"confidence": {
+					"default": 1,
+					"title": "Confidence",
+					"type": "number"
+				},
+				"score": {
+					"anyOf": [{ "type": "number" }, { "type": "null" }],
+					"default": null,
+					"title": "Score"
+				},
+				"contributions": {
+					"default": [],
+					"items": { "$ref": "#/$defs/Contribution" },
+					"title": "Contributions",
+					"type": "array"
+				},
+				"suppressed_by_decision": {
+					"default": false,
+					"title": "Suppressed By Decision",
+					"type": "boolean"
+				},
+				"raw": {
+					"additionalProperties": true,
+					"title": "Raw",
+					"type": "object"
+				},
+				"status": {
+					"$ref": "#/$defs/Status",
+					"default": "EVALUATED"
+				},
+				"effect": {
+					"$ref": "#/$defs/Effect",
+					"default": "ADDITIVE"
+				},
+				"own_term_suppressed": {
+					"default": false,
+					"title": "Own Term Suppressed",
+					"type": "boolean"
+				},
+				"counted": {
+					"default": true,
+					"title": "Counted",
+					"type": "boolean"
+				}
+			},
+			"required": ["key"],
+			"title": "FindingResult",
+			"type": "object"
+		},
+		"InvestigationHeader": {
+			"description": "What used to be a ``Case`` fact: metadata about the store rather than a fact inside it.\n\n``engine_id`` is denormalized here so an investigation stays replayable identically years\nlater, even after a newer stable engine ships.",
+			"properties": {
+				"investigation_id": {
+					"title": "Investigation Id",
+					"type": "string"
+				},
+				"name": {
+					"default": "",
+					"title": "Name",
+					"type": "string"
+				},
+				"root_key": {
+					"anyOf": [{ "type": "string" }, { "type": "null" }],
+					"default": null,
+					"title": "Root Key"
+				},
+				"opened_at": {
+					"format": "date-time",
+					"title": "Opened At",
+					"type": "string"
+				},
+				"policy_version": {
+					"default": "default-v1",
+					"title": "Policy Version",
+					"type": "string"
+				},
+				"engine_id": {
+					"default": "basic-v1",
+					"title": "Engine Id",
+					"type": "string"
+				},
+				"fragment_ids": {
+					"default": [],
+					"items": { "type": "string" },
+					"title": "Fragment Ids",
+					"type": "array"
+				}
+			},
+			"required": ["investigation_id"],
+			"title": "InvestigationHeader",
+			"type": "object"
+		},
+		"InvestigationResult": {
+			"description": "The investigation-level verdict.",
+			"properties": {
+				"key": {
+					"title": "Key",
+					"type": "string"
+				},
+				"verdict": {
+					"$ref": "#/$defs/Verdict",
+					"default": "INFO"
+				},
+				"confidence": {
+					"default": 1,
+					"title": "Confidence",
+					"type": "number"
+				},
+				"score": {
+					"anyOf": [{ "type": "number" }, { "type": "null" }],
+					"default": null,
+					"title": "Score"
+				},
+				"contributions": {
+					"default": [],
+					"items": { "$ref": "#/$defs/Contribution" },
+					"title": "Contributions",
+					"type": "array"
+				},
+				"suppressed_by_decision": {
+					"default": false,
+					"title": "Suppressed By Decision",
+					"type": "boolean"
+				},
+				"raw": {
+					"additionalProperties": true,
+					"title": "Raw",
+					"type": "object"
+				}
+			},
+			"required": ["key"],
+			"title": "InvestigationResult",
+			"type": "object"
+		},
+		"Label": {
+			"description": "A typed tag on a fact: ``axis`` says what kind of statement ``value`` makes.",
+			"properties": {
+				"axis": {
+					"minLength": 1,
+					"title": "Axis",
+					"type": "string"
+				},
+				"value": {
+					"minLength": 1,
+					"title": "Value",
+					"type": "string"
+				}
+			},
+			"required": ["axis", "value"],
+			"title": "Label",
+			"type": "object"
+		},
+		"LinkBasis": {
+			"description": "What a Finding→Observable link scores on.\n\nOne question, three answers, none of which depends on how the run was threaded:\n\n- ``OBSERVABLE`` — the observable as it stands, whoever contributed to it;\n- ``SIGNALS`` — the signals the link names, and nothing else, which is how a finding that\n  fetched its own threat intel holds that value while the observable keeps accumulating;\n- ``NONE`` — nothing: the edge is kept for the graph and the narrative, but it is inert.\n\nv7.0 briefly carried a fourth, ``FRAGMENT``, gating the observable on the fragment that wrote\neach fact. It was dropped before release: it damped a merged total but never a local one, so\nthe same rules scored differently depending on whether enrichment ran in its own worker.\n``SIGNALS`` states that intent directly, and ``NONE`` covers the inert link it was standing in\nfor when migrating v6 documents.",
+			"enum": [
+				"OBSERVABLE",
+				"SIGNALS",
+				"NONE"
+			],
+			"title": "LinkBasis",
+			"type": "string"
+		},
+		"Observable": {
+			"additionalProperties": false,
+			"description": "A cyber observable. Identity is ``(type, subtype, namespace, value)``, nothing else.",
+			"properties": {
+				"key": {
+					"minLength": 1,
+					"title": "Key",
+					"type": "string"
+				},
+				"seq": {
+					"maxLength": 26,
+					"minLength": 26,
+					"title": "Seq",
+					"type": "string"
+				},
+				"asserted_at": {
+					"format": "date-time",
+					"title": "Asserted At",
+					"type": "string"
+				},
+				"occurred_at": {
+					"anyOf": [{
+						"format": "date-time",
+						"type": "string"
+					}, { "type": "null" }],
+					"default": null,
+					"title": "Occurred At"
+				},
+				"source": { "$ref": "#/$defs/SourceRef" },
+				"fragment_id": {
+					"title": "Fragment Id",
+					"type": "string"
+				},
+				"external_id": {
+					"anyOf": [{ "type": "string" }, { "type": "null" }],
+					"default": null,
+					"title": "External Id"
+				},
+				"evidence_keys": {
+					"default": [],
+					"items": { "type": "string" },
+					"title": "Evidence Keys",
+					"type": "array"
+				},
+				"type": {
+					"title": "Type",
+					"type": "string"
+				},
+				"subtype": {
+					"anyOf": [{ "type": "string" }, { "type": "null" }],
+					"title": "Subtype"
+				},
+				"namespace": {
+					"anyOf": [{ "type": "string" }, { "type": "null" }],
+					"default": null,
+					"title": "Namespace"
+				},
+				"value": {
+					"minLength": 1,
+					"title": "Value",
+					"type": "string"
+				},
+				"internal": {
+					"default": true,
+					"title": "Internal",
+					"type": "boolean"
+				},
+				"comment": {
+					"default": "",
+					"title": "Comment",
+					"type": "string"
+				},
+				"extra": {
+					"additionalProperties": true,
+					"title": "Extra",
+					"type": "object"
+				},
+				"aliases": {
+					"default": [],
+					"items": { "$ref": "#/$defs/ObservableAlias" },
+					"title": "Aliases",
+					"type": "array"
+				},
+				"occurrences": {
+					"additionalProperties": { "type": "integer" },
+					"title": "Occurrences",
+					"type": "object"
+				}
+			},
+			"required": [
+				"key",
+				"seq",
+				"asserted_at",
+				"source",
+				"fragment_id",
+				"type",
+				"value"
+			],
+			"title": "Observable",
+			"type": "object"
+		},
+		"ObservableAlias": {
+			"description": "A source identity that resolved to a canonical observable.",
+			"properties": {
+				"type": {
+					"title": "Type",
+					"type": "string"
+				},
+				"subtype": {
+					"anyOf": [{ "type": "string" }, { "type": "null" }],
+					"title": "Subtype"
+				},
+				"namespace": {
+					"anyOf": [{ "type": "string" }, { "type": "null" }],
+					"default": null,
+					"title": "Namespace"
+				},
+				"value": {
+					"minLength": 1,
+					"title": "Value",
+					"type": "string"
+				},
+				"counts": {
+					"additionalProperties": { "type": "integer" },
+					"title": "Counts",
+					"type": "object"
+				}
+			},
+			"required": ["type", "value"],
+			"title": "ObservableAlias",
+			"type": "object"
+		},
+		"ObservableLink": {
+			"description": "A link from a finding to one of its observables, with the basis it is evaluated on.\n\nBasis is **per link**, exactly like v6's ``propagation_mode``: a finding may mix bases, and\nmay even link the same observable twice under two of them. Deduplication is on the triple\n``(observable_key, basis, signal_keys)``.\n\n``signal_keys`` is sorted and deduplicated so that two links naming the same signals in a\ndifferent order are the same link, and merging stays idempotent.",
+			"properties": {
+				"observable_key": {
+					"minLength": 1,
+					"title": "Observable Key",
+					"type": "string"
+				},
+				"basis": {
+					"$ref": "#/$defs/LinkBasis",
+					"default": "OBSERVABLE"
+				},
+				"signal_keys": {
+					"default": [],
+					"items": { "type": "string" },
+					"title": "Signal Keys",
+					"type": "array"
+				}
+			},
+			"required": ["observable_key"],
+			"title": "ObservableLink",
+			"type": "object"
+		},
+		"ObservableResult": {
+			"description": "An observable's verdict. One per observable: the graph holds every fact anyone contributed.",
+			"properties": {
+				"key": {
+					"title": "Key",
+					"type": "string"
+				},
+				"verdict": {
+					"$ref": "#/$defs/Verdict",
+					"default": "INFO"
+				},
+				"confidence": {
+					"default": 1,
+					"title": "Confidence",
+					"type": "number"
+				},
+				"score": {
+					"anyOf": [{ "type": "number" }, { "type": "null" }],
+					"default": null,
+					"title": "Score"
+				},
+				"contributions": {
+					"default": [],
+					"items": { "$ref": "#/$defs/Contribution" },
+					"title": "Contributions",
+					"type": "array"
+				},
+				"suppressed_by_decision": {
+					"default": false,
+					"title": "Suppressed By Decision",
+					"type": "boolean"
+				},
+				"raw": {
+					"additionalProperties": true,
+					"title": "Raw",
+					"type": "object"
+				}
+			},
+			"required": ["key"],
+			"title": "ObservableResult",
+			"type": "object"
+		},
+		"Relation": {
+			"additionalProperties": false,
+			"description": "A directed edge between two observables, labelled by the analyst pivot that produced it.",
+			"properties": {
+				"key": {
+					"minLength": 1,
+					"title": "Key",
+					"type": "string"
+				},
+				"seq": {
+					"maxLength": 26,
+					"minLength": 26,
+					"title": "Seq",
+					"type": "string"
+				},
+				"asserted_at": {
+					"format": "date-time",
+					"title": "Asserted At",
+					"type": "string"
+				},
+				"occurred_at": {
+					"anyOf": [{
+						"format": "date-time",
+						"type": "string"
+					}, { "type": "null" }],
+					"default": null,
+					"title": "Occurred At"
+				},
+				"source": { "$ref": "#/$defs/SourceRef" },
+				"fragment_id": {
+					"title": "Fragment Id",
+					"type": "string"
+				},
+				"external_id": {
+					"anyOf": [{ "type": "string" }, { "type": "null" }],
+					"default": null,
+					"title": "External Id"
+				},
+				"evidence_keys": {
+					"default": [],
+					"items": { "type": "string" },
+					"title": "Evidence Keys",
+					"type": "array"
+				},
+				"source_key": {
+					"minLength": 1,
+					"title": "Source Key",
+					"type": "string"
+				},
+				"target_key": {
+					"minLength": 1,
+					"title": "Target Key",
+					"type": "string"
+				},
+				"kind": {
+					"$ref": "#/$defs/RelationKind",
+					"default": "related-to"
+				},
+				"observed_at": {
+					"anyOf": [{
+						"format": "date-time",
+						"type": "string"
+					}, { "type": "null" }],
+					"default": null,
+					"title": "Observed At"
+				},
+				"confidence": {
+					"default": 1,
+					"exclusiveMinimum": 0,
+					"maximum": 1,
+					"title": "Confidence",
+					"type": "number"
+				},
+				"comment": {
+					"default": "",
+					"title": "Comment",
+					"type": "string"
+				}
+			},
+			"required": [
+				"key",
+				"seq",
+				"asserted_at",
+				"source",
+				"fragment_id",
+				"source_key",
+				"target_key"
+			],
+			"title": "Relation",
+			"type": "object"
+		},
+		"RelationKind": {
+			"description": "The analyst pivot that produced the target from the source.\n\nDirection is implied: ``source_key`` is the parent, ``target_key`` the child. ``RELATED_TO``\nis symmetric and excluded from propagation, which makes v6's ``EXTRACTION`` +\n``BIDIRECTIONAL`` combination inexpressible.",
+			"enum": [
+				"extraction",
+				"pivot",
+				"related-to"
+			],
+			"title": "RelationKind",
+			"type": "string"
+		},
+		"Report": {
+			"description": "A full evaluation. Derived, never stored on the facts, recomputed from them.",
+			"properties": {
+				"engine_id": {
+					"title": "Engine Id",
+					"type": "string"
+				},
+				"policy_version": {
+					"title": "Policy Version",
+					"type": "string"
+				},
+				"investigation": { "$ref": "#/$defs/InvestigationResult" },
+				"findings": {
+					"additionalProperties": { "$ref": "#/$defs/FindingResult" },
+					"title": "Findings",
+					"type": "object"
+				},
+				"observables": {
+					"additionalProperties": { "$ref": "#/$defs/ObservableResult" },
+					"title": "Observables",
+					"type": "object"
+				}
+			},
+			"required": [
+				"engine_id",
+				"policy_version",
+				"investigation"
+			],
+			"title": "Report",
+			"type": "object"
+		},
+		"SourceClass": {
+			"description": "Family a source belongs to, used by the policy to weigh its reliability.",
+			"enum": [
+				"vendor_feed",
+				"sandbox",
+				"osint",
+				"internal_tool",
+				"org_analyst",
+				"org_policy",
+				"unknown"
+			],
+			"title": "SourceClass",
+			"type": "string"
+		},
+		"SourceRef": {
+			"description": "Who or what asserted a fact.",
+			"properties": {
+				"name": {
+					"minLength": 1,
+					"title": "Name",
+					"type": "string"
+				},
+				"source_class": {
+					"$ref": "#/$defs/SourceClass",
+					"default": "unknown"
+				}
+			},
+			"required": ["name"],
+			"title": "SourceRef",
+			"type": "object"
+		},
+		"Status": {
+			"description": "Whether a finding takes part in the evaluation at all.\n\nAnything other than ``EVALUATED`` is excluded from the score *and* from aggregation\ndenominators, while staying visible in the report.",
+			"enum": [
+				"NOT_APPLICABLE",
+				"PENDING",
+				"EVALUATED"
+			],
+			"title": "Status",
+			"type": "string"
+		},
+		"Tactic": {
+			"description": "A MITRE ATT&CK Enterprise tactic — the phase of the kill chain a finding demonstrates.\n\nKebab-case values, in kill-chain order. A tactic is a classification the timeline displays,\nnever a term the engine scores: whether the activity is malicious is the verdict's job.",
+			"enum": [
+				"reconnaissance",
+				"resource-development",
+				"initial-access",
+				"execution",
+				"persistence",
+				"privilege-escalation",
+				"defense-evasion",
+				"credential-access",
+				"discovery",
+				"lateral-movement",
+				"collection",
+				"command-and-control",
+				"exfiltration",
+				"impact"
+			],
+			"title": "Tactic",
+			"type": "string"
+		},
+		"Tag": {
+			"additionalProperties": false,
+			"description": "A label grouping findings. Merging two tags unions their finding keys.",
+			"properties": {
+				"key": {
+					"minLength": 1,
+					"title": "Key",
+					"type": "string"
+				},
+				"seq": {
+					"maxLength": 26,
+					"minLength": 26,
+					"title": "Seq",
+					"type": "string"
+				},
+				"asserted_at": {
+					"format": "date-time",
+					"title": "Asserted At",
+					"type": "string"
+				},
+				"occurred_at": {
+					"anyOf": [{
+						"format": "date-time",
+						"type": "string"
+					}, { "type": "null" }],
+					"default": null,
+					"title": "Occurred At"
+				},
+				"source": { "$ref": "#/$defs/SourceRef" },
+				"fragment_id": {
+					"title": "Fragment Id",
+					"type": "string"
+				},
+				"external_id": {
+					"anyOf": [{ "type": "string" }, { "type": "null" }],
+					"default": null,
+					"title": "External Id"
+				},
+				"evidence_keys": {
+					"default": [],
+					"items": { "type": "string" },
+					"title": "Evidence Keys",
+					"type": "array"
+				},
+				"name": {
+					"minLength": 1,
+					"title": "Name",
+					"type": "string"
+				},
+				"description": {
+					"default": "",
+					"title": "Description",
+					"type": "string"
+				},
+				"finding_keys": {
+					"default": [],
+					"items": { "type": "string" },
+					"title": "Finding Keys",
+					"type": "array"
+				}
+			},
+			"required": [
+				"key",
+				"seq",
+				"asserted_at",
+				"source",
+				"fragment_id",
+				"name"
+			],
+			"title": "Tag",
+			"type": "object"
+		},
+		"Taxonomy": {
+			"additionalProperties": false,
+			"description": "A named value with a display verdict. No weight, confidence or scoring effect.",
+			"properties": {
+				"name": {
+					"title": "Name",
+					"type": "string"
+				},
+				"value": {
+					"title": "Value",
+					"type": "string"
+				},
+				"verdict": {
+					"$ref": "#/$defs/Verdict",
+					"default": "INFO",
+					"description": "Descriptive only; never affects scoring"
+				}
+			},
+			"required": ["name", "value"],
+			"title": "Taxonomy",
+			"type": "object"
+		},
+		"ThreatIntel": {
+			"additionalProperties": false,
+			"description": "A verdict from a threat-intelligence source.\n\nIdentity is ``(source, subject_key)``, so a source re-asserting the same observable updates\nin place instead of piling up duplicates. Pass ``external_id`` to keep history on purpose.",
+			"properties": {
+				"verdict": {
+					"$ref": "#/$defs/Verdict",
+					"default": "INFO"
+				},
+				"confidence": {
+					"default": 1,
+					"exclusiveMinimum": 0,
+					"maximum": 1,
+					"title": "Confidence",
+					"type": "number"
+				},
+				"weight": {
+					"anyOf": [{
+						"minimum": 0,
+						"type": "number"
+					}, { "type": "null" }],
+					"default": null,
+					"title": "Weight"
+				},
+				"key": {
+					"minLength": 1,
+					"title": "Key",
+					"type": "string"
+				},
+				"seq": {
+					"maxLength": 26,
+					"minLength": 26,
+					"title": "Seq",
+					"type": "string"
+				},
+				"asserted_at": {
+					"format": "date-time",
+					"title": "Asserted At",
+					"type": "string"
+				},
+				"occurred_at": {
+					"anyOf": [{
+						"format": "date-time",
+						"type": "string"
+					}, { "type": "null" }],
+					"default": null,
+					"title": "Occurred At"
+				},
+				"source": { "$ref": "#/$defs/SourceRef" },
+				"fragment_id": {
+					"title": "Fragment Id",
+					"type": "string"
+				},
+				"external_id": {
+					"anyOf": [{ "type": "string" }, { "type": "null" }],
+					"default": null,
+					"title": "External Id"
+				},
+				"evidence_keys": {
+					"default": [],
+					"items": { "type": "string" },
+					"title": "Evidence Keys",
+					"type": "array"
+				},
+				"subject_key": {
+					"minLength": 1,
+					"title": "Subject Key",
+					"type": "string"
+				},
+				"kind": {
+					"const": "threat_intel",
+					"default": "threat_intel",
+					"title": "Kind",
+					"type": "string"
+				},
+				"observed_at": {
+					"anyOf": [{
+						"format": "date-time",
+						"type": "string"
+					}, { "type": "null" }],
+					"default": null,
+					"title": "Observed At"
+				},
+				"labels": {
+					"default": [],
+					"items": { "$ref": "#/$defs/Label" },
+					"title": "Labels",
+					"type": "array"
+				},
+				"payload": {
+					"additionalProperties": true,
+					"title": "Payload",
+					"type": "object"
+				},
+				"source_class": {
+					"$ref": "#/$defs/SourceClass",
+					"default": "vendor_feed"
+				},
+				"taxonomies": {
+					"default": [],
+					"items": { "$ref": "#/$defs/Taxonomy" },
+					"title": "Taxonomies",
+					"type": "array"
+				},
+				"comment": {
+					"default": "",
+					"title": "Comment",
+					"type": "string"
+				}
+			},
+			"required": [
+				"key",
+				"seq",
+				"asserted_at",
+				"source",
+				"fragment_id",
+				"subject_key"
+			],
+			"title": "ThreatIntel",
+			"type": "object"
+		},
+		"Verdict": {
+			"description": "Direction of a judgment, and the displayed level — they are the same thing.\n\nv7 merges the former ``Level`` into ``Verdict``. The five values line up one-for-one with\nthe score bands ``basic-v1`` inherits from v6 (``< 0``, ``= 0``, ``]0,3[``, ``[3,5[``,\n``>= 5``), which makes a verdict/level divergence structurally impossible.\n\nThose bands are ``basic-v1``'s convention, **not** part of the enum's contract: a\nprobabilistic engine maps its own posterior thresholds onto the same labels.\n\nTwo v6 levels deliberately left this axis: ``NONE`` became :class:`Status` and ``TRUSTED``\nbecame a :class:`DecisionKind` (or plain ``SAFE`` when it was merely a negative score).",
+			"enum": [
+				"SAFE",
+				"INFO",
+				"NOTABLE",
+				"SUSPICIOUS",
+				"MALICIOUS"
+			],
+			"title": "Verdict",
+			"type": "string"
+		}
+	},
+	$id: "https://cyvest.io/schema/investigation-7.json",
+	additionalProperties: false,
+	description: "A complete serialized investigation.",
+	properties: {
+		"schema_version": {
+			"default": "7.1.0",
+			"pattern": "^7\\.\\d+\\.\\d+$",
+			"title": "Schema Version",
+			"type": "string"
+		},
+		"header": { "$ref": "#/$defs/InvestigationHeader" },
+		"policy_version": {
+			"default": "default-v1",
+			"title": "Policy Version",
+			"type": "string"
+		},
+		"engine_id": {
+			"default": "basic-v1",
+			"title": "Engine Id",
+			"type": "string"
+		},
+		"facts": { "$ref": "#/$defs/FactsSchema" },
+		"decisions": {
+			"additionalProperties": { "$ref": "#/$defs/Decision" },
+			"title": "Decisions",
+			"type": "object"
+		},
+		"tags": {
+			"additionalProperties": { "$ref": "#/$defs/Tag" },
+			"title": "Tags",
+			"type": "object"
+		},
+		"report": { "$ref": "#/$defs/Report" }
+	},
+	required: ["header", "report"],
+	title: "InvestigationSchema",
+	type: "object"
 };
-
-// src/helpers.ts
-var ajv = new import__.default({ allErrors: true });
-(0, import_ajv_formats.default)(ajv);
-var validateFn = null;
+//#endregion
+//#region src/helpers.ts
+/**
+* Parsing and validation.
+*
+* ajv checks the shape; the version check enforces the rule ajv cannot see — a 7.0 SDK must
+* refuse a 7.1 document rather than silently ignore fields it does not know about. Python
+* applies exactly the same rule.
+*
+* Order matters. The schema constrains `schema_version` to the current major, so the minor
+* window is the SDK's job alone; reading and judging the version first also keeps the error
+* message explicit instead of an opaque ajv shape error.
+*/
+const SCHEMA_VERSION = "7.1.0";
+const SEMVER = /^\d+\.\d+\.\d+$/;
+const ajv = new ajv_dist_2020_js.default({ allErrors: true });
+(0, ajv_formats.default)(ajv);
+let validateFn = null;
 function getValidator() {
-  if (!validateFn) {
-    validateFn = ajv.compile(cyvest_schema_default);
-  }
-  return validateFn;
+	if (!validateFn) validateFn = ajv.compile(cyvest_schema_default);
+	return validateFn;
+}
+function versionTuple(version) {
+	const [major, minor] = version.split(".");
+	return [Number(major), Number(minor)];
+}
+/**
+* Read the declared schema version, falling back to `"5"` for anything unversioned.
+*
+* A document with no `schema_version` is a pre-v7 document, not a current one: `schema_version`
+* is not in the schema's `required` list, so defaulting it to `SCHEMA_VERSION` would wave every
+* legacy payload straight through. Python's `detect_schema_version` makes the same choice.
+*/
+function detectSchemaVersion(json) {
+	const raw = json?.schema_version;
+	const version = typeof raw === "string" ? raw.trim() : "";
+	return SEMVER.test(version) ? version : "5";
+}
+/** Upward compatibility only: read older documents, never newer ones. */
+function assertReadableVersion(version) {
+	const [docMajor, docMinor] = versionTuple(version);
+	const [libMajor, libMinor] = versionTuple(SCHEMA_VERSION);
+	if (docMajor > libMajor || docMajor === libMajor && docMinor > libMinor) throw new Error(`Document schema ${version} is newer than this SDK (${SCHEMA_VERSION}); upgrade @cyvest/cyvest-js.`);
+	if (docMajor < libMajor) throw new Error(`Document schema ${version} predates this SDK (${SCHEMA_VERSION}); run 'cyvest migrate'.`);
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Normalize 7.0 free-text taxonomies once at the input boundary, without mutating the caller. */
+function normalizeTaxonomies(json) {
+	if (!isRecord(json) || !isRecord(json.facts) || !isRecord(json.facts.signals)) return json;
+	const signals = Object.fromEntries(Object.entries(json.facts.signals).map(([key, signal]) => [key, isRecord(signal) && Array.isArray(signal.taxonomies) ? {
+		...signal,
+		taxonomies: signal.taxonomies.map((entry) => typeof entry === "string" ? {
+			name: entry,
+			value: "",
+			verdict: "INFO"
+		} : entry)
+	} : signal]));
+	return {
+		...json,
+		facts: {
+			...json.facts,
+			signals
+		}
+	};
 }
 function parseCyvest(json) {
-  const validate = getValidator();
-  if (!validate(json)) {
-    const msg = ajv.errorsText(validate.errors || []);
-    throw new Error(`Invalid Cyvest payload: ${msg}`);
-  }
-  return json;
+	assertReadableVersion(detectSchemaVersion(json));
+	const normalized = normalizeTaxonomies(json);
+	const validate = getValidator();
+	if (!validate(normalized)) throw new Error(`Invalid Cyvest payload: ${ajv.errorsText(validate.errors || [])}`);
+	return normalized;
 }
+/** A type guard cannot normalize its argument: legacy strings need parseCyvest first. */
 function isCyvest(json) {
-  const validate = getValidator();
-  return !!validate(json);
-}
-
-// src/keys.ts
+	try {
+		assertReadableVersion(detectSchemaVersion(json));
+		return !!getValidator()(json);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/keys.ts
+/** Every prefix a v7 document can carry. `enr:` is gone — enrichments are evidence now. */
+const KEY_PREFIXES = [
+	"obs",
+	"fnd",
+	"evd",
+	"sig",
+	"rel",
+	"dec",
+	"tag"
+];
+/**
+* Normalize a string value for consistent key generation.
+*/
 function normalizeValue(value) {
-  return value.trim().toLowerCase();
+	return value.trim().toLowerCase();
 }
 function normalizeObservableValue(obsType, value, subtype) {
-  const normalizedType = normalizeValue(obsType);
-  const normalizedSubtype = subtype ? normalizeValue(subtype) : void 0;
-  const stripped = value.trim();
-  if (normalizedType === "command_line") return stripped;
-  if (normalizedType === "email" || normalizedType === "host") {
-    return stripped.toLowerCase();
-  }
-  if (normalizedType === "user" && (normalizedSubtype === "email" || normalizedSubtype === "upn")) {
-    return stripped.toLowerCase();
-  }
-  if (normalizedSubtype === "uid" || normalizedSubtype === "pid") {
-    if (!/^[+-]?\d+$/.test(stripped)) {
-      throw new Error(`${normalizedSubtype} observable values must be base-10 integers`);
-    }
-    return BigInt(stripped).toString(10);
-  }
-  return stripped;
+	const normalizedType = normalizeValue(obsType);
+	const normalizedSubtype = subtype ? normalizeValue(subtype) : void 0;
+	const stripped = value.trim();
+	if (normalizedType === "command_line") return stripped;
+	if (normalizedType === "email" || normalizedType === "host") return stripped.toLowerCase();
+	if (normalizedType === "user" && (normalizedSubtype === "email" || normalizedSubtype === "upn")) return stripped.toLowerCase();
+	if (normalizedSubtype === "uid" || normalizedSubtype === "pid") {
+		if (!/^[+-]?\d+$/.test(stripped)) throw new Error(`${normalizedSubtype} observable values must be base-10 integers`);
+		return BigInt(stripped).toString(10);
+	}
+	return stripped;
 }
 function sha256(content) {
-  const bytes = new TextEncoder().encode(content);
-  const words = [];
-  const bitLength = bytes.length * 8;
-  for (const byte of bytes) {
-    words.push(byte);
-  }
-  words.push(128);
-  while (words.length % 64 !== 56) words.push(0);
-  for (let i = 7; i >= 0; i--) {
-    words.push(Math.floor(bitLength / 2 ** (i * 8)) & 255);
-  }
-  const h = [
-    1779033703,
-    3144134277,
-    1013904242,
-    2773480762,
-    1359893119,
-    2600822924,
-    528734635,
-    1541459225
-  ];
-  const k = Array.from({ length: 64 }, (_, index) => {
-    let primeCount = 0;
-    let candidate = 2;
-    while (true) {
-      let prime = true;
-      for (let divisor = 2; divisor * divisor <= candidate; divisor++) {
-        if (candidate % divisor === 0) {
-          prime = false;
-          break;
-        }
-      }
-      if (prime && primeCount++ === index) {
-        return Math.floor(Math.cbrt(candidate) % 1 * 2 ** 32) >>> 0;
-      }
-      candidate++;
-    }
-  });
-  const rotateRight = (value, amount) => value >>> amount | value << 32 - amount;
-  for (let offset = 0; offset < words.length; offset += 64) {
-    const schedule = new Array(64);
-    for (let i = 0; i < 16; i++) {
-      const base = offset + i * 4;
-      schedule[i] = (words[base] << 24 | words[base + 1] << 16 | words[base + 2] << 8 | words[base + 3]) >>> 0;
-    }
-    for (let i = 16; i < 64; i++) {
-      const s0 = rotateRight(schedule[i - 15], 7) ^ rotateRight(schedule[i - 15], 18) ^ schedule[i - 15] >>> 3;
-      const s1 = rotateRight(schedule[i - 2], 17) ^ rotateRight(schedule[i - 2], 19) ^ schedule[i - 2] >>> 10;
-      schedule[i] = schedule[i - 16] + s0 + schedule[i - 7] + s1 >>> 0;
-    }
-    let [a, b, c, d, e, f, g, hh] = h;
-    for (let i = 0; i < 64; i++) {
-      const s1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25);
-      const choice = e & f ^ ~e & g;
-      const temp1 = hh + s1 + choice + k[i] + schedule[i] >>> 0;
-      const s0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22);
-      const majority = a & b ^ a & c ^ b & c;
-      const temp2 = s0 + majority >>> 0;
-      hh = g;
-      g = f;
-      f = e;
-      e = d + temp1 >>> 0;
-      d = c;
-      c = b;
-      b = a;
-      a = temp1 + temp2 >>> 0;
-    }
-    [a, b, c, d, e, f, g, hh].forEach((value, index) => {
-      h[index] = h[index] + value >>> 0;
-    });
-  }
-  return h.map((value) => value.toString(16).padStart(8, "0")).join("");
+	const bytes = new TextEncoder().encode(content);
+	const words = [];
+	const bitLength = bytes.length * 8;
+	for (const byte of bytes) words.push(byte);
+	words.push(128);
+	while (words.length % 64 !== 56) words.push(0);
+	for (let i = 7; i >= 0; i--) words.push(Math.floor(bitLength / 2 ** (i * 8)) & 255);
+	const h = [
+		1779033703,
+		3144134277,
+		1013904242,
+		2773480762,
+		1359893119,
+		2600822924,
+		528734635,
+		1541459225
+	];
+	const k = Array.from({ length: 64 }, (_, index) => {
+		let primeCount = 0;
+		let candidate = 2;
+		while (true) {
+			let prime = true;
+			for (let divisor = 2; divisor * divisor <= candidate; divisor++) if (candidate % divisor === 0) {
+				prime = false;
+				break;
+			}
+			if (prime && primeCount++ === index) return Math.floor(Math.cbrt(candidate) % 1 * 2 ** 32) >>> 0;
+			candidate++;
+		}
+	});
+	const rotateRight = (value, amount) => value >>> amount | value << 32 - amount;
+	for (let offset = 0; offset < words.length; offset += 64) {
+		const schedule = new Array(64);
+		for (let i = 0; i < 16; i++) {
+			const base = offset + i * 4;
+			schedule[i] = (words[base] << 24 | words[base + 1] << 16 | words[base + 2] << 8 | words[base + 3]) >>> 0;
+		}
+		for (let i = 16; i < 64; i++) {
+			const s0 = rotateRight(schedule[i - 15], 7) ^ rotateRight(schedule[i - 15], 18) ^ schedule[i - 15] >>> 3;
+			const s1 = rotateRight(schedule[i - 2], 17) ^ rotateRight(schedule[i - 2], 19) ^ schedule[i - 2] >>> 10;
+			schedule[i] = schedule[i - 16] + s0 + schedule[i - 7] + s1 >>> 0;
+		}
+		let [a, b, c, d, e, f, g, hh] = h;
+		for (let i = 0; i < 64; i++) {
+			const s1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25);
+			const choice = e & f ^ ~e & g;
+			const temp1 = hh + s1 + choice + k[i] + schedule[i] >>> 0;
+			const temp2 = (rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+			hh = g;
+			g = f;
+			f = e;
+			e = d + temp1 >>> 0;
+			d = c;
+			c = b;
+			b = a;
+			a = temp1 + temp2 >>> 0;
+		}
+		[
+			a,
+			b,
+			c,
+			d,
+			e,
+			f,
+			g,
+			hh
+		].forEach((value, index) => {
+			h[index] = h[index] + value >>> 0;
+		});
+	}
+	return h.map((value) => value.toString(16).padStart(8, "0")).join("");
 }
 function encodeKeyPart(value, keepSlash = false) {
-  let encoded = encodeURIComponent(value).replace(
-    /[!'()*]/g,
-    (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`
-  );
-  encoded = encoded.replace(/%40/gi, "@");
-  if (keepSlash) encoded = encoded.replace(/%2F/gi, "/").replace(/%5C/gi, "\\");
-  return encoded;
-}
-function hashString(content, length = 16) {
-  let hash = 0;
-  for (let i = 0; i < content.length; i++) {
-    const char = content.charCodeAt(i);
-    hash = (hash << 5) - hash + char | 0;
-  }
-  const hex = Math.abs(hash).toString(16).padStart(8, "0");
-  return hex.slice(0, length);
-}
+	let encoded = encodeURIComponent(value).replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
+	encoded = encoded.replace(/%40/gi, "@");
+	if (keepSlash) encoded = encoded.replace(/%2F/gi, "/").replace(/%5C/gi, "\\");
+	return encoded;
+}
+/**
+* Generate a unique key for an observable.
+*
+* Format: obs:{type}:{normalized_value}
+*
+* @param obsType - Type of observable (ip, url, domain, hash, etc.)
+* @param value - Value of the observable
+* @returns Unique observable key
+*
+* @example
+* ```ts
+* generateObservableKey("ipv4", "192.168.1.1")
+* // => "obs:ipv4:192.168.1.1"
+* ```
+*/
 function generateObservableKey(obsType, value, subtype, namespace) {
-  const normalizedType = normalizeValue(obsType);
-  const normalizedSubtype = subtype ? normalizeValue(subtype) : void 0;
-  const normalizedNamespace = namespace?.trim().toLowerCase() || void 0;
-  const normalizedValue = normalizeObservableValue(
-    normalizedType,
-    value,
-    normalizedSubtype
-  );
-  const identity = JSON.stringify({
-    namespace: normalizedNamespace ?? null,
-    subtype: normalizedSubtype ?? null,
-    type: normalizedType,
-    value: normalizedValue
-  });
-  if (normalizedType === "command_line" || new TextEncoder().encode(identity).length > 128) {
-    return `obs:${normalizedType}:sha256:${sha256(identity)}`;
-  }
-  if (!normalizedSubtype && !normalizedNamespace) {
-    return `obs:${normalizedType}:${normalizedValue.toLowerCase()}`;
-  }
-  const parts = ["obs", encodeKeyPart(normalizedType), normalizedSubtype ? encodeKeyPart(normalizedSubtype) : "_"];
-  if (normalizedNamespace) parts.push(encodeKeyPart(normalizedNamespace));
-  parts.push(encodeKeyPart(normalizedValue, true));
-  return parts.join(":");
-}
-function generateFindingKey(findingName) {
-  const normalizedName = normalizeValue(findingName);
-  return `fnd:${normalizedName}`;
-}
-function generateThreatIntelKey(source, observableKey) {
-  const normalizedSource = normalizeValue(source);
-  return `ti:${normalizedSource}:${observableKey}`;
-}
-function generateEnrichmentKey(name, context) {
-  const normalizedName = normalizeValue(name);
-  if (context) {
-    const contextHash = hashString(context, 8);
-    return `enr:${normalizedName}:${contextHash}`;
-  }
-  return `enr:${normalizedName}`;
-}
+	const normalizedType = normalizeValue(obsType);
+	const normalizedSubtype = subtype ? normalizeValue(subtype) : void 0;
+	const normalizedNamespace = namespace?.trim().toLowerCase() || void 0;
+	const normalizedValue = normalizeObservableValue(normalizedType, value, normalizedSubtype);
+	const identity = JSON.stringify({
+		namespace: normalizedNamespace ?? null,
+		subtype: normalizedSubtype ?? null,
+		type: normalizedType,
+		value: normalizedValue
+	});
+	if (normalizedType === "command_line" || new TextEncoder().encode(identity).length > 128) return `obs:${normalizedType}:sha256:${sha256(identity)}`;
+	if (!normalizedSubtype && !normalizedNamespace) return `obs:${normalizedType}:${normalizedValue.toLowerCase()}`;
+	const parts = [
+		"obs",
+		encodeKeyPart(normalizedType),
+		normalizedSubtype ? encodeKeyPart(normalizedSubtype) : "_"
+	];
+	if (normalizedNamespace) parts.push(encodeKeyPart(normalizedNamespace));
+	parts.push(encodeKeyPart(normalizedValue, true));
+	return parts.join(":");
+}
+/**
+* Generate a finding key.
+*
+* Format: `fnd:{rule_id}`, or `fnd:{rule_id}:{external_id}`.
+*
+* A finding is identified by the rule that produced it. Running the same rule on several
+* observables means several findings, so pass an `externalId` to keep them apart — usually the
+* observable key.
+*
+* @example
+* ```ts
+* generateFindingKey("url_in_body")
+* // => "fnd:url_in_body"
+* ```
+*/
+function generateFindingKey(ruleId, externalId) {
+	const normalizedRule = normalizeValue(ruleId);
+	if (externalId) return `fnd:${normalizedRule}:${externalId.trim()}`;
+	return `fnd:${normalizedRule}`;
+}
+/**
+* Generate an observable-signal key.
+*
+* Format: `sig:{source}:{subject_key}`. The prefix names the *family*, not its first member:
+* v6's `ti:` would have locked every future signal kind behind a threat-intel name.
+*
+* @example
+* ```ts
+* generateSignalKey("virustotal", "obs:ipv4:192.168.1.1")
+* // => "sig:virustotal:obs:ipv4:192.168.1.1"
+* ```
+*/
+function generateSignalKey(source, subjectKey, externalId) {
+	const normalizedSource = normalizeValue(source);
+	if (externalId) return `sig:${normalizedSource}:${externalId.trim()}:${subjectKey}`;
+	return `sig:${normalizedSource}:${subjectKey}`;
+}
+/** Kept under its v6 name; new code calls {@link generateSignalKey}. */
+const generateThreatIntelKey = generateSignalKey;
+/**
+* Generate a relation key.
+*
+* Format: `rel:{kind}:{source_key}>{target_key}` — direction lives in the key itself, so no
+* `direction` field is needed to disambiguate.
+*/
+function generateRelationKey(sourceKey, targetKey, kind, externalId) {
+	const normalizedKind = normalizeValue(kind);
+	if (externalId) return `rel:${normalizedKind}:${externalId.trim()}:${sourceKey}>${targetKey}`;
+	return `rel:${normalizedKind}:${sourceKey}>${targetKey}`;
+}
+/**
+* Generate a decision key.
+*
+* Format: `dec:{target_key}` — one decision per target, whatever it says. The kind is content,
+* not identity: a target holds a single current stance, and changing one's mind is a
+* re-assertion the merge law settles by freshness.
+*/
+function generateDecisionKey(targetKey) {
+	return `dec:${targetKey}`;
+}
+/**
+* Generate a unique key for a tag.
+*
+* Format: tag:{normalized_name}
+*
+* @param name - Name of the tag (can use : as hierarchy delimiter)
+* @returns Unique tag key
+*
+* @example
+* ```ts
+* generateTagKey("header:auth:dkim")
+* // => "tag:header:auth:dkim"
+* ```
+*/
 function generateTagKey(name) {
-  const normalizedName = normalizeValue(name);
-  return `tag:${normalizedName}`;
-}
+	return `tag:${normalizeValue(name)}`;
+}
+/**
+* Get all ancestor tag names from a hierarchical tag name.
+*
+* @param name - Tag name with : delimiter
+* @returns Array of ancestor tag names
+*
+* @example
+* ```ts
+* getTagAncestors("header:auth:dkim")
+* // => ["header", "header:auth"]
+* ```
+*/
 function getTagAncestors(name) {
-  const parts = name.split(":");
-  const ancestors = [];
-  for (let i = 0; i < parts.length - 1; i++) {
-    ancestors.push(parts.slice(0, i + 1).join(":"));
-  }
-  return ancestors;
-}
+	const parts = name.split(":");
+	const ancestors = [];
+	for (let i = 0; i < parts.length - 1; i++) ancestors.push(parts.slice(0, i + 1).join(":"));
+	return ancestors;
+}
+/**
+* Check if a tag is a direct child of another tag.
+*
+* @param childName - Potential child tag name
+* @param parentName - Potential parent tag name
+* @returns True if childName is a direct child of parentName
+*
+* @example
+* ```ts
+* isTagChildOf("header:auth", "header") // => true
+* isTagChildOf("header:auth:dkim", "header") // => false (grandchild)
+* ```
+*/
 function isTagChildOf(childName, parentName) {
-  if (!childName.startsWith(parentName + ":")) {
-    return false;
-  }
-  const remaining = childName.slice(parentName.length + 1);
-  return !remaining.includes(":");
-}
+	if (!childName.startsWith(parentName + ":")) return false;
+	return !childName.slice(parentName.length + 1).includes(":");
+}
+/**
+* Check if a tag is a descendant of another tag (any depth).
+*
+* @param descendantName - Potential descendant tag name
+* @param ancestorName - Potential ancestor tag name
+* @returns True if descendantName is a descendant of ancestorName
+*
+* @example
+* ```ts
+* isTagDescendantOf("header:auth:dkim", "header") // => true
+* isTagDescendantOf("header", "header") // => false (same)
+* ```
+*/
 function isTagDescendantOf(descendantName, ancestorName) {
-  return descendantName.startsWith(ancestorName + ":");
-}
+	return descendantName.startsWith(ancestorName + ":");
+}
+/**
+* Extract the type prefix from a key.
+*
+* @param key - The key to parse
+* @returns Type prefix (see {@link KEY_PREFIXES}) or null if invalid
+*
+* @example
+* ```ts
+* parseKeyType("obs:ipv4:192.168.1.1") // => "obs"
+* parseKeyType("invalid") // => null
+* ```
+*/
 function parseKeyType(key) {
-  if (key.includes(":")) {
-    const prefix = key.split(":", 1)[0];
-    if (["obs", "fnd", "evd", "ti", "enr", "tag"].includes(prefix)) {
-      return prefix;
-    }
-  }
-  return null;
-}
+	if (key.includes(":")) {
+		const prefix = key.split(":", 1)[0];
+		if (KEY_PREFIXES.includes(prefix)) return prefix;
+	}
+	return null;
+}
+/**
+* Validate a key format and optionally finding its type.
+*
+* @param key - The key to validate
+* @param expectedType - Optional expected type prefix
+* @returns True if valid, false otherwise
+*
+* @example
+* ```ts
+* validateKey("obs:ipv4:192.168.1.1") // => true
+* validateKey("obs:ipv4:192.168.1.1", "obs") // => true
+* validateKey("obs:ipv4:192.168.1.1", "chk") // => false
+* validateKey("invalid") // => false
+* ```
+*/
 function validateKey(key, expectedType) {
-  if (!key || !key.includes(":")) {
-    return false;
-  }
-  const keyType = parseKeyType(key);
-  if (!keyType) {
-    return false;
-  }
-  if (expectedType && keyType !== expectedType) {
-    return false;
-  }
-  return true;
-}
+	if (!key || !key.includes(":")) return false;
+	const keyType = parseKeyType(key);
+	if (!keyType) return false;
+	if (expectedType && keyType !== expectedType) return false;
+	return true;
+}
+/**
+* Extract components from an observable key.
+*
+* Only reliable for the simple form `obs:{type}:{value}`. A key carrying a subtype or a
+* namespace, and a `command_line` or oversized key folded into `obs:{type}:sha256:{digest}`,
+* both return the remaining segments verbatim as `value` — a key is an identity token, not a
+* record. Read the observable from the document instead of parsing its key.
+*
+* @param key - Observable key to parse
+* @returns Object with type and value, or null if invalid
+*
+* @example
+* ```ts
+* parseObservableKey("obs:ipv4:192.168.1.1")
+* // => { type: "ipv4", value: "192.168.1.1" }
+* ```
+*/
 function parseObservableKey(key) {
-  if (!validateKey(key, "obs")) {
-    return null;
-  }
-  const parts = key.split(":");
-  if (parts.length >= 3) {
-    return {
-      type: parts[1],
-      value: parts.slice(2).join(":")
-      // Handle values with colons
-    };
-  }
-  return null;
-}
-function parseFindingKey(key) {
-  if (!validateKey(key, "fnd")) {
-    return null;
-  }
-  const parts = key.split(":");
-  if (parts.length >= 2) {
-    return {
-      findingName: parts.slice(1).join(":")
-    };
-  }
-  return null;
-}
-function parseThreatIntelKey(key) {
-  if (!validateKey(key, "ti")) {
-    return null;
-  }
-  const parts = key.split(":");
-  if (parts.length >= 3) {
-    return {
-      source: parts[1],
-      observableKey: parts.slice(2).join(":")
-    };
-  }
-  return null;
-}
-
-// src/levels.ts
-var LEVEL_ORDER = [
-  "NONE",
-  "TRUSTED",
-  "INFO",
-  "SAFE",
-  "NOTABLE",
-  "SUSPICIOUS",
-  "MALICIOUS"
+	if (!validateKey(key, "obs")) return null;
+	const parts = key.split(":");
+	if (parts.length >= 3) return {
+		type: parts[1],
+		value: parts.slice(2).join(":")
+	};
+	return null;
+}
+//#endregion
+//#region src/verdicts.ts
+/** Ordered from most exculpatory to most inculpatory. */
+const VERDICT_ORDER = [
+	"SAFE",
+	"INFO",
+	"NOTABLE",
+	"SUSPICIOUS",
+	"MALICIOUS"
 ];
-var LEVEL_VALUES = {
-  NONE: 0,
-  TRUSTED: 1,
-  INFO: 2,
-  SAFE: 3,
-  NOTABLE: 4,
-  SUSPICIOUS: 5,
-  MALICIOUS: 6
+const VERDICT_RANK = {
+	SAFE: 0,
+	INFO: 1,
+	NOTABLE: 2,
+	SUSPICIOUS: 3,
+	MALICIOUS: 4
+};
+/**
+* Rich style names, mirroring the Python terminal renderer.
+*
+* These are *not* CSS colours: a browser cannot draw `orange3`. Use {@link VERDICT_HEX_COLORS}
+* for anything rendered on screen.
+*/
+const VERDICT_TERMINAL_STYLES = {
+	SAFE: "bright_green",
+	INFO: "cyan",
+	NOTABLE: "yellow",
+	SUSPICIOUS: "orange3",
+	MALICIOUS: "red"
 };
-var LEVEL_COLORS = {
-  NONE: "#808080",
-  // gray
-  TRUSTED: "#22c55e",
-  // green
-  INFO: "#06b6d4",
-  // cyan
-  SAFE: "#4ade80",
-  // bright green
-  NOTABLE: "#eab308",
-  // yellow
-  SUSPICIOUS: "#f97316",
-  // orange
-  MALICIOUS: "#ef4444"
-  // red
+/** The web palette: muted enough that a wall of NOTABLE nodes stays readable. */
+const VERDICT_HEX_COLORS = {
+	SAFE: "#648b79",
+	INFO: "#94a3b8",
+	NOTABLE: "#aa8958",
+	SUSPICIOUS: "#ad704b",
+	MALICIOUS: "#ad5555"
 };
-function normalizeLevel(level) {
-  const upper = level.toUpperCase();
-  if (LEVEL_ORDER.includes(upper)) {
-    return upper;
-  }
-  throw new Error(`Invalid level name: ${level}`);
-}
-function isValidLevel(level) {
-  return LEVEL_ORDER.includes(level.toUpperCase());
-}
-function getLevelFromScore(score) {
-  if (score < 0) {
-    return "TRUSTED";
-  }
-  if (score === 0) {
-    return "INFO";
-  }
-  if (score < 3) {
-    return "NOTABLE";
-  }
-  if (score < 5) {
-    return "SUSPICIOUS";
-  }
-  return "MALICIOUS";
-}
-function compareLevels(a, b) {
-  const valueA = LEVEL_VALUES[a];
-  const valueB = LEVEL_VALUES[b];
-  if (valueA < valueB) return -1;
-  if (valueA > valueB) return 1;
-  return 0;
-}
-function isLevelHigherThan(a, b) {
-  return LEVEL_VALUES[a] > LEVEL_VALUES[b];
-}
-function isLevelLowerThan(a, b) {
-  return LEVEL_VALUES[a] < LEVEL_VALUES[b];
-}
-function isLevelAtLeast(a, minLevel2) {
-  return LEVEL_VALUES[a] >= LEVEL_VALUES[minLevel2];
-}
-function maxLevel(levels) {
-  if (levels.length === 0) return "NONE";
-  return levels.reduce(
-    (max, level) => isLevelHigherThan(level, max) ? level : max
-  );
-}
-function minLevel(levels) {
-  if (levels.length === 0) return "MALICIOUS";
-  return levels.reduce(
-    (min, level) => isLevelLowerThan(level, min) ? level : min
-  );
-}
-function getColorForLevel(level) {
-  return LEVEL_COLORS[level];
-}
-function getColorForScore(score) {
-  return getColorForLevel(getLevelFromScore(score));
-}
-function hasLevel(obj) {
-  return typeof obj === "object" && obj !== null && "level" in obj && typeof obj.level === "string" && isValidLevel(obj.level);
-}
-function getEntityLevel(entity) {
-  if ("direct_level" in entity) {
-    const directLevel = entity.direct_level;
-    if (typeof directLevel === "string" && isValidLevel(directLevel)) {
-      return directLevel;
-    }
-  }
-  if ("level" in entity && isValidLevel(entity.level)) {
-    return entity.level;
-  }
-  throw new Error("Entity does not have a valid level.");
-}
-
-// src/getters.ts
+/** Direction the judgment pushes: -1 exculpatory, 0 neutral, +1 inculpatory. */
+function verdictPolarity(verdict) {
+	if (verdict === "SAFE") return -1;
+	if (verdict === "INFO") return 0;
+	return 1;
+}
+function isValidVerdict(value) {
+	return typeof value === "string" && value in VERDICT_RANK;
+}
+function normalizeVerdict(value) {
+	const upper = typeof value === "string" ? value.toUpperCase() : "";
+	return isValidVerdict(upper) ? upper : "INFO";
+}
+function compareVerdicts(a, b) {
+	return VERDICT_RANK[a] - VERDICT_RANK[b];
+}
+function isVerdictAtLeast(verdict, floor) {
+	return VERDICT_RANK[verdict] >= VERDICT_RANK[floor];
+}
+function maxVerdict(verdicts) {
+	return verdicts.reduce((best, current) => compareVerdicts(current, best) > 0 ? current : best, "SAFE");
+}
+function minVerdict(verdicts) {
+	return verdicts.reduce((best, current) => compareVerdicts(current, best) < 0 ? current : best, "MALICIOUS");
+}
+function getColorForVerdict(verdict) {
+	return VERDICT_HEX_COLORS[verdict] ?? VERDICT_HEX_COLORS.INFO;
+}
+/** Coarse bands for display; the engine works in floats. */
+function confidenceBand(confidence) {
+	if (confidence < .5) return "low";
+	if (confidence < .85) return "medium";
+	return "high";
+}
+//#endregion
+//#region src/getters.ts
 function getObservable(inv, key) {
-  return inv.observables[key];
+	return inv.facts?.observables?.[key];
 }
-function getObservableByTypeValue(inv, type, value, subtype, namespace) {
-  return inv.observables[generateObservableKey(type, value, subtype, namespace)];
+function getAllObservables(inv) {
+	return inv.facts?.observables ?? {};
 }
 function getRootObservable(inv) {
-  const rootType = inv.data_extraction.root_type;
-  if (!rootType) {
-    return void 0;
-  }
-  const rootKey = generateObservableKey(rootType, "root");
-  return inv.observables[rootKey];
+	const rootKey = inv.header?.root_key;
+	return rootKey ? getObservable(inv, rootKey) : void 0;
 }
-function getFinding(inv, key) {
-  return inv.findings[key];
+function getRelation(inv, key) {
+	return inv.facts?.relations?.[key];
 }
-function getFindingByName(inv, findingName) {
-  const key = generateFindingKey(findingName);
-  return inv.findings[key];
+function getAllRelations(inv) {
+	return inv.facts?.relations ?? {};
+}
+function getThreatIntel(inv, key) {
+	return inv.facts?.signals?.[key];
+}
+function getAllThreatIntels(inv) {
+	return inv.facts?.signals ?? {};
+}
+/** Signals attached to one observable. */
+function getThreatIntelsFor(inv, observableKey) {
+	return Object.values(getAllThreatIntels(inv)).filter((signal) => signal.subject_key === observableKey);
+}
+function getFinding(inv, key) {
+	return inv.facts?.findings?.[key];
 }
 function getAllFindings(inv) {
-  return Object.values(inv.findings);
+	return inv.facts?.findings ?? {};
 }
 function getEvidence(inv, key) {
-  return inv.evidences[key];
+	return inv.facts?.evidences?.[key];
 }
 function getAllEvidences(inv) {
-  return Object.values(inv.evidences);
+	return inv.facts?.evidences ?? {};
 }
-function getThreatIntel(inv, key) {
-  return inv.threat_intels[key];
+/** The v6 `Enrichment` is just an evidence type; filter instead of a dedicated accessor. */
+function getEvidencesByType(inv, evidenceType) {
+	return Object.values(getAllEvidences(inv)).filter((evidence) => evidence.evidence_type === evidenceType);
 }
-function getThreatIntelBySourceObservable(inv, source, observableKey) {
-  const normalizedSource = source.trim().toLowerCase();
-  for (const ti of Object.values(inv.threat_intels)) {
-    if (ti.source.toLowerCase() === normalizedSource && ti.observable_key === observableKey) {
-      return ti;
-    }
-  }
-  return void 0;
+function getDecision(inv, key) {
+	return inv.decisions?.[key];
 }
-function getAllThreatIntels(inv) {
-  return Object.values(inv.threat_intels);
+function getAllDecisions(inv) {
+	return inv.decisions ?? {};
+}
+/** The single stance standing on a target — the key carries the target alone. */
+function getDecisionFor(inv, targetKey) {
+	return getDecision(inv, generateDecisionKey(targetKey));
+}
+function hasKind(inv, targetKey, kind) {
+	return getDecisionFor(inv, targetKey)?.kind === kind;
+}
+function isAllowlisted(inv, observableKey) {
+	return hasKind(inv, observableKey, "REFUTE");
 }
-function getEnrichment(inv, key) {
-  return inv.enrichments[key];
+function isBlocklisted(inv, observableKey) {
+	return hasKind(inv, observableKey, "UPHOLD");
 }
-function getEnrichmentByName(inv, name) {
-  const normalizedName = name.trim().toLowerCase();
-  for (const enr of Object.values(inv.enrichments)) {
-    if (enr.name.toLowerCase() === normalizedName) {
-      return enr;
-    }
-  }
-  return void 0;
+function isConfirmed(inv, findingKey) {
+	return hasKind(inv, findingKey, "UPHOLD");
 }
-function getAllEnrichments(inv) {
-  return Object.values(inv.enrichments);
+function isDismissed(inv, findingKey) {
+	return hasKind(inv, findingKey, "REFUTE");
+}
+/** True when a stance was withdrawn and the computed value applies again. */
+function isVacated(inv, targetKey) {
+	return hasKind(inv, targetKey, "VACATED");
+}
+/**
+* The analyst's word for a stance, rebuilt from the intent and the family of its target.
+*
+* The model carries one axis on purpose; the vocabulary that reads naturally carries two, and
+* the display layer is the right place to pay for that.
+*/
+function decisionLabel(decision) {
+	if (decision.kind === "VACATED") return "VACATED";
+	const observable = decision.target_key.startsWith("obs:");
+	if (decision.kind === "UPHOLD") return observable ? "BLOCKLISTED" : "CONFIRMED";
+	return observable ? "ALLOWLISTED" : "DISMISSED";
 }
 function getTag(inv, key) {
-  return inv.tags[key];
+	return inv.tags?.[key];
 }
 function getTagByName(inv, name) {
-  const key = generateTagKey(name);
-  return inv.tags[key];
+	return getTag(inv, `tag:${name.trim().toLowerCase()}`);
 }
 function getAllTags(inv) {
-  return Object.values(inv.tags);
+	return inv.tags ?? {};
 }
-function getAllObservables(inv) {
-  return Object.values(inv.observables);
+function getInvestigationResult(inv) {
+	return inv.report.investigation;
 }
-function getWhitelists(inv) {
-  return inv.whitelists;
+function getObservableResult(inv, observableKey) {
+	return inv.report.observables?.[observableKey];
 }
-function getStats(inv) {
-  return inv.stats;
+function getFindingResult(inv, findingKey) {
+	return inv.report.findings?.[findingKey];
 }
-function getDataExtraction(inv) {
-  return inv.data_extraction;
+function getObservableScore(inv, observableKey) {
+	return getObservableResult(inv, observableKey)?.score ?? 0;
 }
-function getCounts(inv) {
-  return {
-    observables: Object.keys(inv.observables).length,
-    findings: getAllFindings(inv).length,
-    evidences: getAllEvidences(inv).length,
-    threatIntels: Object.keys(inv.threat_intels).length,
-    enrichments: Object.keys(inv.enrichments).length,
-    tags: getAllTags(inv).length,
-    whitelists: inv.whitelists.length
-  };
-}
-function getStartedAt(inv) {
-  const event = inv.audit_log?.find(
-    (e) => e.event_type === "INVESTIGATION_STARTED"
-  );
-  return event?.timestamp;
-}
-function getTagChildren(inv, tagName) {
-  return Object.values(inv.tags).filter((tag) => isTagChildOf(tag.name, tagName));
-}
-function getTagDescendants(inv, tagName) {
-  const prefix = tagName + ":";
-  return Object.values(inv.tags).filter((tag) => tag.name.startsWith(prefix));
+function getObservableVerdict(inv, observableKey) {
+	return getObservableResult(inv, observableKey)?.verdict ?? "INFO";
 }
+function getFindingScore(inv, findingKey) {
+	return getFindingResult(inv, findingKey)?.score ?? 0;
+}
+function getFindingVerdict(inv, findingKey) {
+	return getFindingResult(inv, findingKey)?.verdict ?? "INFO";
+}
+function getGlobalScore(inv) {
+	return inv.report.investigation.score ?? 0;
+}
+function getGlobalVerdict(inv) {
+	return inv.report.investigation.verdict ?? "INFO";
+}
+/** True when a decision or a stronger link overrode the computed value. */
+function wasSuppressed(inv, key) {
+	const finding = getFindingResult(inv, key);
+	if (finding) return Boolean(finding.suppressed_by_decision || finding.own_term_suppressed);
+	return Boolean(getObservableResult(inv, key)?.suppressed_by_decision);
+}
+/** Findings a tag points at, plus those of every descendant tag. */
+function getTagFindingKeys(inv, tagName) {
+	const prefix = `${tagName}:`;
+	const keys = /* @__PURE__ */ new Set();
+	for (const tag of Object.values(getAllTags(inv))) if (tag.name === tagName || tag.name.startsWith(prefix)) for (const key of tag.finding_keys ?? []) keys.add(key);
+	return [...keys];
+}
+/**
+* A tag's aggregated score.
+*
+* This sums values the engine produced; it does not re-derive them. Uncounted findings — not
+* applicable, pending or dismissed — are absent from the sum *and* from any ratio built on it.
+*/
 function getTagAggregatedScore(inv, tagName) {
-  const tag = getTagByName(inv, tagName);
-  if (!tag) {
-    return 0;
-  }
-  let total = tag.direct_score;
-  const children = getTagChildren(inv, tagName);
-  for (const child of children) {
-    total += getTagAggregatedScore(inv, child.name);
-  }
-  return total;
-}
-function getTagAggregatedLevel(inv, tagName) {
-  return getLevelFromScore(getTagAggregatedScore(inv, tagName));
-}
-
-// src/finders.ts
+	return getTagFindingKeys(inv, tagName).reduce((total, key) => {
+		const result = getFindingResult(inv, key);
+		return result?.counted ? total + (result.score ?? 0) : total;
+	}, 0);
+}
+function getCounts(inv) {
+	return {
+		observables: Object.keys(getAllObservables(inv)).length,
+		relations: Object.keys(getAllRelations(inv)).length,
+		signals: Object.keys(getAllThreatIntels(inv)).length,
+		evidences: Object.keys(getAllEvidences(inv)).length,
+		findings: Object.keys(getAllFindings(inv)).length,
+		evaluatedFindings: Object.values(inv.report.findings ?? {}).filter((result) => result.counted).length,
+		decisions: Object.keys(getAllDecisions(inv)).length,
+		tags: Object.keys(getAllTags(inv)).length
+	};
+}
+//#endregion
+//#region src/finders.ts
+/**
+* Query helpers.
+*
+* Filters on computed values go through the report; filters on stated values go through the
+* facts. Keeping the two apart is what stops a UI from quietly inventing its own scoring.
+*/
 function findObservablesByType(inv, type) {
-  const normalizedType = type.trim().toLowerCase();
-  return Object.values(inv.observables).filter(
-    (obs) => obs.type.toLowerCase() === normalizedType
-  );
-}
-function findObservablesByLevel(inv, level) {
-  return Object.values(inv.observables).filter((obs) => obs.level === level);
-}
-function findObservablesAtLeast(inv, minLevel2) {
-  return Object.values(inv.observables).filter(
-    (obs) => isLevelAtLeast(obs.level, minLevel2)
-  );
-}
-function findObservablesByValue(inv, value, caseSensitive = false) {
-  const searchValue = caseSensitive ? value : value.toLowerCase();
-  return Object.values(inv.observables).filter((obs) => {
-    const obsValue = caseSensitive ? obs.value : obs.value.toLowerCase();
-    return obsValue === searchValue;
-  });
-}
-function findObservablesContaining(inv, substring, caseSensitive = false) {
-  const searchStr = caseSensitive ? substring : substring.toLowerCase();
-  return Object.values(inv.observables).filter((obs) => {
-    const obsValue = caseSensitive ? obs.value : obs.value.toLowerCase();
-    return obsValue.includes(searchStr);
-  });
-}
-function findObservablesMatching(inv, pattern) {
-  return Object.values(inv.observables).filter((obs) => pattern.test(obs.value));
+	return Object.values(getAllObservables(inv)).filter((observable) => observable.type === type);
+}
+function findObservablesByValue(inv, value) {
+	return Object.values(getAllObservables(inv)).filter((observable) => observable.value === value);
+}
+function findObservablesContaining(inv, fragment) {
+	const needle = fragment.toLowerCase();
+	return Object.values(getAllObservables(inv)).filter((observable) => observable.value.toLowerCase().includes(needle));
 }
 function findInternalObservables(inv) {
-  return Object.values(inv.observables).filter((obs) => obs.internal);
+	return Object.values(getAllObservables(inv)).filter((observable) => observable.internal === true);
 }
 function findExternalObservables(inv) {
-  return Object.values(inv.observables).filter((obs) => !obs.internal);
+	return Object.values(getAllObservables(inv)).filter((observable) => observable.internal === false);
 }
-function findWhitelistedObservables(inv) {
-  return Object.values(inv.observables).filter((obs) => obs.whitelisted);
+function findObservablesByVerdict(inv, verdict) {
+	return Object.values(getAllObservables(inv)).filter((observable) => getObservableResult(inv, observable.key)?.verdict === verdict);
+}
+function findObservablesAtLeast(inv, floor) {
+	return Object.values(getAllObservables(inv)).filter((observable) => {
+		const result = getObservableResult(inv, observable.key);
+		return result ? isVerdictAtLeast(result.verdict, floor) : false;
+	});
 }
 function findObservablesWithThreatIntel(inv) {
-  return Object.values(inv.observables).filter(
-    (obs) => obs.threat_intels.length > 0
-  );
+	const subjects = new Set(Object.values(getAllThreatIntels(inv)).map((signal) => signal.subject_key));
+	return Object.values(getAllObservables(inv)).filter((observable) => subjects.has(observable.key));
+}
+function findFindingsByVerdict(inv, verdict) {
+	return Object.values(getAllFindings(inv)).filter((finding) => getFindingResult(inv, finding.key)?.verdict === verdict);
 }
-function findFindingsByLevel(inv, level) {
-  return Object.values(inv.findings).filter((finding) => finding.level === level);
+function findFindingsAtLeast(inv, floor) {
+	return Object.values(getAllFindings(inv)).filter((finding) => {
+		const result = getFindingResult(inv, finding.key);
+		return result?.counted ? isVerdictAtLeast(result.verdict, floor) : false;
+	});
 }
-function findFindingsAtLeast(inv, minLevel2) {
-  return Object.values(inv.findings).filter(
-    (finding) => isLevelAtLeast(finding.level, minLevel2)
-  );
+function findFindingsByRule(inv, ruleId) {
+	return Object.values(getAllFindings(inv)).filter((finding) => finding.rule_id === ruleId);
 }
-function findFindingByName(inv, findingName) {
-  const normalizedName = findingName.trim().toLowerCase();
-  return Object.values(inv.findings).find(
-    (finding) => finding.finding_name.toLowerCase() === normalizedName
-  );
+function findFindingsByConfidence(inv, band) {
+	return Object.values(getAllFindings(inv)).filter((finding) => {
+		const result = getFindingResult(inv, finding.key);
+		return result ? confidenceBand(result.confidence ?? 1) === band : false;
+	});
+}
+/** Findings excluded from the score but still worth showing, with their reason. */
+function findUncountedFindings(inv) {
+	return Object.values(getAllFindings(inv)).filter((finding) => getFindingResult(inv, finding.key)?.counted === false);
+}
+/** Findings whose own claim was outweighed by one of their observables — worth surfacing. */
+function findContradictedFindings(inv) {
+	return Object.values(getAllFindings(inv)).filter((finding) => getFindingResult(inv, finding.key)?.own_term_suppressed === true);
 }
 function findThreatIntelBySource(inv, source) {
-  const normalizedSource = source.trim().toLowerCase();
-  return Object.values(inv.threat_intels).filter(
-    (ti) => ti.source.toLowerCase() === normalizedSource
-  );
-}
-function findThreatIntelByLevel(inv, level) {
-  return Object.values(inv.threat_intels).filter((ti) => ti.level === level);
-}
-function findThreatIntelAtLeast(inv, minLevel2) {
-  return Object.values(inv.threat_intels).filter(
-    (ti) => isLevelAtLeast(ti.level, minLevel2)
-  );
-}
-function findTagsByLevel(inv, level) {
-  return Object.values(inv.tags).filter((tag) => tag.direct_level === level);
-}
-function findTagsAtLeast(inv, minLevel2) {
-  return Object.values(inv.tags).filter(
-    (tag) => isLevelAtLeast(tag.direct_level, minLevel2)
-  );
-}
-function findTagsByNamePattern(inv, pattern) {
-  return Object.values(inv.tags).filter((tag) => pattern.test(tag.name));
-}
-function findFindingsForObservable(inv, observableKey) {
-  const result = [];
-  const seen = /* @__PURE__ */ new Set();
-  const observable = inv.observables[observableKey];
-  if (observable) {
-    for (const findingKey of observable.finding_links) {
-      const finding = inv.findings[findingKey];
-      if (finding && !seen.has(finding.key)) {
-        result.push(finding);
-        seen.add(finding.key);
-      }
-    }
-  }
-  for (const finding of Object.values(inv.findings)) {
-    if (seen.has(finding.key)) {
-      continue;
-    }
-    if (finding.observable_links.some((link) => link.observable_key === observableKey)) {
-      result.push(finding);
-      seen.add(finding.key);
-    }
-  }
-  return result;
-}
-function findThreatIntelsForObservable(inv, observableKey) {
-  const observable = inv.observables[observableKey];
-  if (observable) {
-    return observable.threat_intels.map((tiKey) => inv.threat_intels[tiKey]).filter((ti) => ti !== void 0);
-  }
-  return Object.values(inv.threat_intels).filter(
-    (ti) => ti.observable_key === observableKey
-  );
-}
-function findObservablesForFinding(inv, findingKey) {
-  const finding = inv.findings[findingKey];
-  if (finding) {
-    const keys = /* @__PURE__ */ new Set();
-    for (const link of finding.observable_links) {
-      keys.add(link.observable_key);
-    }
-    return Array.from(keys).map((obsKey) => inv.observables[obsKey]).filter((obs) => obs !== void 0);
-  }
-  return [];
-}
-function findFindingsForTag(inv, tagKey, recursive = false) {
-  const result = [];
-  const tag = inv.tags[tagKey];
-  if (!tag) {
-    return result;
-  }
-  for (const findingKey of tag.findings) {
-    const finding = inv.findings[findingKey];
-    if (finding) {
-      result.push(finding);
-    }
-  }
-  if (recursive) {
-    const prefix = tag.name + ":";
-    for (const otherTag of Object.values(inv.tags)) {
-      if (otherTag.name.startsWith(prefix)) {
-        for (const findingKey of otherTag.findings) {
-          const finding = inv.findings[findingKey];
-          if (finding) {
-            result.push(finding);
-          }
-        }
-      }
-    }
-  }
-  return result;
-}
-function sortObservablesByScore(observables) {
-  return [...observables].sort((a, b) => b.score - a.score);
-}
-function sortFindingsByScore(findings) {
-  return [...findings].sort((a, b) => b.score - a.score);
-}
-function sortObservablesByLevel(observables) {
-  return [...observables].sort(
-    (a, b) => LEVEL_VALUES[b.level] - LEVEL_VALUES[a.level]
-  );
-}
-function sortFindingsByLevel(findings) {
-  return [...findings].sort(
-    (a, b) => LEVEL_VALUES[b.level] - LEVEL_VALUES[a.level]
-  );
-}
-function findHighestScoringObservables(inv, n = 10) {
-  return sortObservablesByScore(Object.values(inv.observables)).slice(0, n);
-}
-function findHighestScoringFindings(inv, n = 10) {
-  return sortFindingsByScore(Object.values(inv.findings)).slice(0, n);
-}
-function findMaliciousObservables(inv) {
-  return findObservablesByLevel(inv, "MALICIOUS");
-}
-function findSuspiciousObservables(inv) {
-  return findObservablesByLevel(inv, "SUSPICIOUS");
-}
-function findMaliciousFindings(inv) {
-  return findFindingsByLevel(inv, "MALICIOUS");
-}
-function findSuspiciousFindings(inv) {
-  return findFindingsByLevel(inv, "SUSPICIOUS");
-}
-function getAllFindingKeys(inv) {
-  return Object.keys(inv.findings);
-}
-function getAllObservableTypes(inv) {
-  const types = /* @__PURE__ */ new Set();
-  for (const obs of Object.values(inv.observables)) {
-    types.add(obs.type);
-  }
-  return Array.from(types);
-}
-function getAllThreatIntelSources(inv) {
-  const sources = /* @__PURE__ */ new Set();
-  for (const ti of Object.values(inv.threat_intels)) {
-    sources.add(ti.source);
-  }
-  return Array.from(sources);
-}
-
-// src/graph.ts
-function getRelatedObservables(inv, observableKey) {
-  const observable = inv.observables[observableKey];
-  if (!observable) {
-    return [];
-  }
-  const relatedKeys = /* @__PURE__ */ new Set();
-  for (const rel of observable.relationships) {
-    relatedKeys.add(rel.target_key);
-  }
-  for (const [key, obs] of Object.entries(inv.observables)) {
-    if (key === observableKey) continue;
-    for (const rel of obs.relationships) {
-      if (rel.target_key === observableKey) {
-        relatedKeys.add(key);
-        break;
-      }
-    }
-  }
-  return Array.from(relatedKeys).map((key) => inv.observables[key]).filter((obs) => obs !== void 0);
+	return Object.values(getAllThreatIntels(inv)).filter((signal) => signal.source.name === source);
+}
+function findThreatIntelByVerdict(inv, verdict) {
+	return Object.values(getAllThreatIntels(inv)).filter((signal) => signal.verdict === verdict);
+}
+function findThreatIntelForObservable(inv, observableKey) {
+	return Object.values(getAllThreatIntels(inv)).filter((signal) => signal.subject_key === observableKey);
+}
+//#endregion
+//#region src/graph.ts
+/**
+* Graph traversal.
+*
+* Relations are standalone facts in v7, each carrying both keys, so there is no per-observable
+* adjacency list to walk and no `direction` field to interpret: `source_key` is the parent,
+* `target_key` the child, and the kind implies the rest.
+*/
+function relationsOf(inv) {
+	return Object.values(getAllRelations(inv));
+}
+/** Keys of relations the report credits with an actual contribution. */
+function scoringRelationKeys(inv) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const result of Object.values(inv.report.observables ?? {})) for (const contribution of result.contributions ?? []) if (contribution.retained !== false && contribution.source_key.startsWith("rel:")) keys.add(contribution.source_key);
+	return keys;
 }
 function getObservableChildren(inv, observableKey) {
-  const observable = inv.observables[observableKey];
-  if (!observable) {
-    return [];
-  }
-  return observable.relationships.filter((rel) => rel.direction === "outbound" || rel.direction === "bidirectional").map((rel) => inv.observables[rel.target_key]).filter((obs) => obs !== void 0);
+	const observables = getAllObservables(inv);
+	return relationsOf(inv).filter((relation) => relation.source_key === observableKey).map((relation) => observables[relation.target_key]).filter((observable) => observable !== void 0);
 }
 function getObservableParents(inv, observableKey) {
-  const parents = [];
-  for (const [key, obs] of Object.entries(inv.observables)) {
-    if (key === observableKey) continue;
-    for (const rel of obs.relationships) {
-      if (rel.target_key === observableKey && (rel.direction === "outbound" || rel.direction === "bidirectional")) {
-        parents.push(obs);
-        break;
-      }
-    }
-  }
-  return parents;
-}
-function getRelatedObservablesByType(inv, observableKey, relationshipType) {
-  const observable = inv.observables[observableKey];
-  if (!observable) {
-    return [];
-  }
-  const normalizedType = relationshipType.toLowerCase();
-  const relatedKeys = /* @__PURE__ */ new Set();
-  for (const rel of observable.relationships) {
-    if (rel.relationship_type.toLowerCase() === normalizedType) {
-      relatedKeys.add(rel.target_key);
-    }
-  }
-  for (const [key, obs] of Object.entries(inv.observables)) {
-    if (key === observableKey) continue;
-    for (const rel of obs.relationships) {
-      if (rel.target_key === observableKey && rel.relationship_type.toLowerCase() === normalizedType) {
-        relatedKeys.add(key);
-        break;
-      }
-    }
-  }
-  return Array.from(relatedKeys).map((key) => inv.observables[key]).filter((obs) => obs !== void 0);
-}
-function getRelatedObservablesByDirection(inv, observableKey, direction) {
-  const observable = inv.observables[observableKey];
-  if (!observable) {
-    return [];
-  }
-  const relatedKeys = /* @__PURE__ */ new Set();
-  if (direction === "outbound" || direction === "bidirectional") {
-    for (const rel of observable.relationships) {
-      if (rel.direction === direction || rel.direction === "bidirectional") {
-        relatedKeys.add(rel.target_key);
-      }
-    }
-  }
-  if (direction === "inbound" || direction === "bidirectional") {
-    for (const [key, obs] of Object.entries(inv.observables)) {
-      if (key === observableKey) continue;
-      for (const rel of obs.relationships) {
-        if (rel.target_key === observableKey && (rel.direction === "outbound" || rel.direction === "bidirectional")) {
-          relatedKeys.add(key);
-          break;
-        }
-      }
-    }
-  }
-  return Array.from(relatedKeys).map((key) => inv.observables[key]).filter((obs) => obs !== void 0);
+	const observables = getAllObservables(inv);
+	return relationsOf(inv).filter((relation) => relation.target_key === observableKey).map((relation) => observables[relation.source_key]).filter((observable) => observable !== void 0);
 }
-function getObservableGraph(inv) {
-  const nodes = [];
-  const edges = [];
-  const seenEdges = /* @__PURE__ */ new Set();
-  for (const [key, obs] of Object.entries(inv.observables)) {
-    nodes.push({
-      id: key,
-      type: obs.type,
-      value: obs.value,
-      level: obs.level,
-      score: obs.score,
-      internal: obs.internal,
-      whitelisted: obs.whitelisted
-    });
-    for (const rel of obs.relationships) {
-      const edgeKey = rel.direction === "bidirectional" ? [key, rel.target_key].sort().join("--") : `${key}--${rel.target_key}`;
-      if (!seenEdges.has(edgeKey)) {
-        seenEdges.add(edgeKey);
-        edges.push({
-          source: key,
-          target: rel.target_key,
-          type: rel.relationship_type,
-          direction: rel.direction
-        });
-      }
-    }
-  }
-  return { nodes, edges };
+function getRelatedObservables(inv, observableKey) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const observable of [...getObservableChildren(inv, observableKey), ...getObservableParents(inv, observableKey)]) seen.set(observable.key, observable);
+	return [...seen.values()];
 }
-function findSourceObservables(inv) {
-  const targetKeys = /* @__PURE__ */ new Set();
-  for (const obs of Object.values(inv.observables)) {
-    for (const rel of obs.relationships) {
-      if (rel.direction === "outbound" || rel.direction === "bidirectional") {
-        targetKeys.add(rel.target_key);
-      }
-    }
-  }
-  return Object.values(inv.observables).filter(
-    (obs) => !targetKeys.has(obs.key)
-  );
+function getRelationsForObservable(inv, observableKey) {
+	return relationsOf(inv).filter((relation) => relation.source_key === observableKey || relation.target_key === observableKey);
+}
+function countRelationsByKind(inv) {
+	const counts = {};
+	for (const relation of relationsOf(inv)) counts[relation.kind ?? "related-to"] = (counts[relation.kind ?? "related-to"] ?? 0) + 1;
+	return counts;
+}
+function getObservableGraph(inv) {
+	const scoring = scoringRelationKeys(inv);
+	return {
+		nodes: Object.values(getAllObservables(inv)).map((observable) => {
+			const result = getObservableResult(inv, observable.key);
+			return {
+				key: observable.key,
+				observable,
+				score: result?.score ?? 0,
+				verdict: result?.verdict ?? "INFO"
+			};
+		}),
+		edges: relationsOf(inv).map((relation) => ({
+			key: relation.key,
+			source: relation.source_key,
+			target: relation.target_key,
+			kind: relation.kind ?? "related-to",
+			confidence: relation.confidence ?? 1,
+			carriedScore: scoring.has(relation.key)
+		}))
+	};
+}
+function areConnected(inv, a, b) {
+	return getReachableObservables(inv, a).has(b);
+}
+/** Undirected reachability — the same walk `finalize_relationships` uses to spot orphans. */
+function getReachableObservables(inv, start) {
+	const relations = relationsOf(inv);
+	const reached = /* @__PURE__ */ new Set([start]);
+	const queue = [start];
+	while (queue.length > 0) {
+		const current = queue.shift();
+		for (const relation of relations) {
+			const neighbour = relation.source_key === current ? relation.target_key : relation.target_key === current ? relation.source_key : void 0;
+			if (neighbour && !reached.has(neighbour)) {
+				reached.add(neighbour);
+				queue.push(neighbour);
+			}
+		}
+	}
+	return reached;
 }
 function findOrphanObservables(inv) {
-  const connectedKeys = /* @__PURE__ */ new Set();
-  for (const obs of Object.values(inv.observables)) {
-    if (obs.relationships.length > 0) {
-      connectedKeys.add(obs.key);
-      for (const rel of obs.relationships) {
-        connectedKeys.add(rel.target_key);
-      }
-    }
-  }
-  return Object.values(inv.observables).filter(
-    (obs) => !connectedKeys.has(obs.key)
-  );
+	const linked = /* @__PURE__ */ new Set();
+	for (const relation of relationsOf(inv)) {
+		linked.add(relation.source_key);
+		linked.add(relation.target_key);
+	}
+	return Object.values(getAllObservables(inv)).filter((observable) => !linked.has(observable.key));
 }
 function findLeafObservables(inv) {
-  const hasOutbound = /* @__PURE__ */ new Set();
-  const isTarget = /* @__PURE__ */ new Set();
-  for (const obs of Object.values(inv.observables)) {
-    for (const rel of obs.relationships) {
-      if (rel.direction === "outbound" || rel.direction === "bidirectional") {
-        hasOutbound.add(obs.key);
-        isTarget.add(rel.target_key);
-      }
-    }
-  }
-  return Object.values(inv.observables).filter(
-    (obs) => isTarget.has(obs.key) && !hasOutbound.has(obs.key)
-  );
-}
-function areConnected(inv, sourceKey, targetKey) {
-  if (sourceKey === targetKey) return true;
-  const visited = /* @__PURE__ */ new Set();
-  const queue = [sourceKey];
-  while (queue.length > 0) {
-    const current = queue.shift();
-    if (visited.has(current)) continue;
-    visited.add(current);
-    const obs = inv.observables[current];
-    if (!obs) continue;
-    for (const rel of obs.relationships) {
-      if (rel.target_key === targetKey) {
-        return true;
-      }
-      if (!visited.has(rel.target_key)) {
-        queue.push(rel.target_key);
-      }
-    }
-  }
-  return false;
-}
-function findPath(inv, sourceKey, targetKey) {
-  if (sourceKey === targetKey) return [sourceKey];
-  const visited = /* @__PURE__ */ new Set();
-  const queue = [
-    { key: sourceKey, path: [sourceKey] }
-  ];
-  while (queue.length > 0) {
-    const { key: current, path } = queue.shift();
-    if (visited.has(current)) continue;
-    visited.add(current);
-    const obs = inv.observables[current];
-    if (!obs) continue;
-    for (const rel of obs.relationships) {
-      if (rel.target_key === targetKey) {
-        return [...path, targetKey];
-      }
-      if (!visited.has(rel.target_key)) {
-        queue.push({ key: rel.target_key, path: [...path, rel.target_key] });
-      }
-    }
-  }
-  return null;
-}
-function getReachableObservables(inv, startKey, maxDepth = Infinity) {
-  const visited = /* @__PURE__ */ new Set();
-  const result = [];
-  function traverse(key, depth) {
-    if (depth > maxDepth || visited.has(key)) return;
-    visited.add(key);
-    const obs = inv.observables[key];
-    if (!obs) return;
-    result.push(obs);
-    for (const rel of obs.relationships) {
-      traverse(rel.target_key, depth + 1);
-    }
-  }
-  traverse(startKey, 0);
-  return result;
-}
-function getAllRelationshipTypes(inv) {
-  const types = /* @__PURE__ */ new Set();
-  for (const obs of Object.values(inv.observables)) {
-    for (const rel of obs.relationships) {
-      types.add(rel.relationship_type);
-    }
-  }
-  return Array.from(types);
-}
-function countRelationshipsByType(inv) {
-  const counts = {};
-  for (const obs of Object.values(inv.observables)) {
-    for (const rel of obs.relationships) {
-      counts[rel.relationship_type] = (counts[rel.relationship_type] || 0) + 1;
-    }
-  }
-  return counts;
-}
-function getRelationshipsForObservable(inv, observableKey) {
-  const observable = inv.observables[observableKey];
-  const outbound = observable?.relationships || [];
-  const inbound = [];
-  for (const [key, obs] of Object.entries(inv.observables)) {
-    if (key === observableKey) continue;
-    for (const rel of obs.relationships) {
-      if (rel.target_key === observableKey) {
-        inbound.push({ ...rel, source_key: key });
-      }
-    }
-  }
-  return {
-    outbound,
-    inbound,
-    all: [
-      ...outbound,
-      ...inbound
-    ]
-  };
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  LEVEL_COLORS,
-  LEVEL_ORDER,
-  LEVEL_VALUES,
-  areConnected,
-  compareLevels,
-  countRelationshipsByType,
-  findExternalObservables,
-  findFindingByName,
-  findFindingsAtLeast,
-  findFindingsByLevel,
-  findFindingsForObservable,
-  findFindingsForTag,
-  findHighestScoringFindings,
-  findHighestScoringObservables,
-  findInternalObservables,
-  findLeafObservables,
-  findMaliciousFindings,
-  findMaliciousObservables,
-  findObservablesAtLeast,
-  findObservablesByLevel,
-  findObservablesByType,
-  findObservablesByValue,
-  findObservablesContaining,
-  findObservablesForFinding,
-  findObservablesMatching,
-  findObservablesWithThreatIntel,
-  findOrphanObservables,
-  findPath,
-  findSourceObservables,
-  findSuspiciousFindings,
-  findSuspiciousObservables,
-  findTagsAtLeast,
-  findTagsByLevel,
-  findTagsByNamePattern,
-  findThreatIntelAtLeast,
-  findThreatIntelByLevel,
-  findThreatIntelBySource,
-  findThreatIntelsForObservable,
-  findWhitelistedObservables,
-  generateEnrichmentKey,
-  generateFindingKey,
-  generateObservableKey,
-  generateTagKey,
-  generateThreatIntelKey,
-  getAllEnrichments,
-  getAllEvidences,
-  getAllFindingKeys,
-  getAllFindings,
-  getAllObservableTypes,
-  getAllObservables,
-  getAllRelationshipTypes,
-  getAllTags,
-  getAllThreatIntelSources,
-  getAllThreatIntels,
-  getColorForLevel,
-  getColorForScore,
-  getCounts,
-  getDataExtraction,
-  getEnrichment,
-  getEnrichmentByName,
-  getEntityLevel,
-  getEvidence,
-  getFinding,
-  getFindingByName,
-  getLevelFromScore,
-  getObservable,
-  getObservableByTypeValue,
-  getObservableChildren,
-  getObservableGraph,
-  getObservableParents,
-  getReachableObservables,
-  getRelatedObservables,
-  getRelatedObservablesByDirection,
-  getRelatedObservablesByType,
-  getRelationshipsForObservable,
-  getRootObservable,
-  getStartedAt,
-  getStats,
-  getTag,
-  getTagAggregatedLevel,
-  getTagAggregatedScore,
-  getTagAncestors,
-  getTagByName,
-  getTagChildren,
-  getTagDescendants,
-  getThreatIntel,
-  getThreatIntelBySourceObservable,
-  getWhitelists,
-  hasLevel,
-  isCyvest,
-  isLevelAtLeast,
-  isLevelHigherThan,
-  isLevelLowerThan,
-  isTagChildOf,
-  isTagDescendantOf,
-  isValidLevel,
-  maxLevel,
-  minLevel,
-  normalizeLevel,
-  parseCyvest,
-  parseFindingKey,
-  parseKeyType,
-  parseObservableKey,
-  parseThreatIntelKey,
-  sortFindingsByLevel,
-  sortFindingsByScore,
-  sortObservablesByLevel,
-  sortObservablesByScore,
-  validateKey
-});
+	const parents = new Set(relationsOf(inv).map((relation) => relation.source_key));
+	return Object.values(getAllObservables(inv)).filter((observable) => !parents.has(observable.key));
+}
+function findSourceObservables(inv) {
+	const children = new Set(relationsOf(inv).map((relation) => relation.target_key));
+	return Object.values(getAllObservables(inv)).filter((observable) => !children.has(observable.key));
+}
+//#endregion
+exports.KEY_PREFIXES = KEY_PREFIXES;
+exports.SCHEMA_VERSION = SCHEMA_VERSION;
+exports.VERDICT_HEX_COLORS = VERDICT_HEX_COLORS;
+exports.VERDICT_ORDER = VERDICT_ORDER;
+exports.VERDICT_TERMINAL_STYLES = VERDICT_TERMINAL_STYLES;
+exports.areConnected = areConnected;
+exports.assertReadableVersion = assertReadableVersion;
+exports.compareVerdicts = compareVerdicts;
+exports.confidenceBand = confidenceBand;
+exports.countRelationsByKind = countRelationsByKind;
+exports.decisionLabel = decisionLabel;
+exports.detectSchemaVersion = detectSchemaVersion;
+exports.findContradictedFindings = findContradictedFindings;
+exports.findExternalObservables = findExternalObservables;
+exports.findFindingsAtLeast = findFindingsAtLeast;
+exports.findFindingsByConfidence = findFindingsByConfidence;
+exports.findFindingsByRule = findFindingsByRule;
+exports.findFindingsByVerdict = findFindingsByVerdict;
+exports.findInternalObservables = findInternalObservables;
+exports.findLeafObservables = findLeafObservables;
+exports.findObservablesAtLeast = findObservablesAtLeast;
+exports.findObservablesByType = findObservablesByType;
+exports.findObservablesByValue = findObservablesByValue;
+exports.findObservablesByVerdict = findObservablesByVerdict;
+exports.findObservablesContaining = findObservablesContaining;
+exports.findObservablesWithThreatIntel = findObservablesWithThreatIntel;
+exports.findOrphanObservables = findOrphanObservables;
+exports.findSourceObservables = findSourceObservables;
+exports.findThreatIntelBySource = findThreatIntelBySource;
+exports.findThreatIntelByVerdict = findThreatIntelByVerdict;
+exports.findThreatIntelForObservable = findThreatIntelForObservable;
+exports.findUncountedFindings = findUncountedFindings;
+exports.generateDecisionKey = generateDecisionKey;
+exports.generateFindingKey = generateFindingKey;
+exports.generateObservableKey = generateObservableKey;
+exports.generateRelationKey = generateRelationKey;
+exports.generateSignalKey = generateSignalKey;
+exports.generateTagKey = generateTagKey;
+exports.generateThreatIntelKey = generateThreatIntelKey;
+exports.getAllDecisions = getAllDecisions;
+exports.getAllEvidences = getAllEvidences;
+exports.getAllFindings = getAllFindings;
+exports.getAllObservables = getAllObservables;
+exports.getAllRelations = getAllRelations;
+exports.getAllTags = getAllTags;
+exports.getAllThreatIntels = getAllThreatIntels;
+exports.getColorForVerdict = getColorForVerdict;
+exports.getCounts = getCounts;
+exports.getDecision = getDecision;
+exports.getDecisionFor = getDecisionFor;
+exports.getEvidence = getEvidence;
+exports.getEvidencesByType = getEvidencesByType;
+exports.getFinding = getFinding;
+exports.getFindingResult = getFindingResult;
+exports.getFindingScore = getFindingScore;
+exports.getFindingVerdict = getFindingVerdict;
+exports.getGlobalScore = getGlobalScore;
+exports.getGlobalVerdict = getGlobalVerdict;
+exports.getInvestigationResult = getInvestigationResult;
+exports.getObservable = getObservable;
+exports.getObservableChildren = getObservableChildren;
+exports.getObservableGraph = getObservableGraph;
+exports.getObservableParents = getObservableParents;
+exports.getObservableResult = getObservableResult;
+exports.getObservableScore = getObservableScore;
+exports.getObservableVerdict = getObservableVerdict;
+exports.getReachableObservables = getReachableObservables;
+exports.getRelatedObservables = getRelatedObservables;
+exports.getRelation = getRelation;
+exports.getRelationsForObservable = getRelationsForObservable;
+exports.getRootObservable = getRootObservable;
+exports.getTag = getTag;
+exports.getTagAggregatedScore = getTagAggregatedScore;
+exports.getTagAncestors = getTagAncestors;
+exports.getTagByName = getTagByName;
+exports.getTagFindingKeys = getTagFindingKeys;
+exports.getThreatIntel = getThreatIntel;
+exports.getThreatIntelsFor = getThreatIntelsFor;
+exports.isAllowlisted = isAllowlisted;
+exports.isBlocklisted = isBlocklisted;
+exports.isConfirmed = isConfirmed;
+exports.isCyvest = isCyvest;
+exports.isDismissed = isDismissed;
+exports.isTagChildOf = isTagChildOf;
+exports.isTagDescendantOf = isTagDescendantOf;
+exports.isVacated = isVacated;
+exports.isValidVerdict = isValidVerdict;
+exports.isVerdictAtLeast = isVerdictAtLeast;
+exports.maxVerdict = maxVerdict;
+exports.minVerdict = minVerdict;
+exports.normalizeVerdict = normalizeVerdict;
+exports.parseCyvest = parseCyvest;
+exports.parseKeyType = parseKeyType;
+exports.parseObservableKey = parseObservableKey;
+exports.validateKey = validateKey;
+exports.verdictPolarity = verdictPolarity;
+exports.wasSuppressed = wasSuppressed;