@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/packages/contracts/domain-control-review.mjs

@@ -1,14 +1,19 @@
 import { defineSchemaCompatibility } from "./schema-compatibility.mjs";
 import { defineSchemaLifecycleFamily } from "./schema-lifecycle.mjs";
-import { DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS, DOMAIN_CONTROL_MANIFEST_LIMITATIONS, DOMAIN_CONTROL_MANIFEST_ROOT_KEYS, DOMAIN_CONTROL_SPKI_SHA256_HEX_LENGTH, DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_CLI_REVIEW_JSON_DEPTH, MAX_DOMAIN_CONTROL_CLI_REVIEW_JSON_KEYS, MAX_DOMAIN_CONTROL_CLI_REVIEW_JSON_VALUES, MAX_DOMAIN_CONTROL_DOMAIN_LENGTH, MAX_DOMAIN_CONTROL_INPUT_RECORDS, MAX_DOMAIN_CONTROL_JSON_CONTAINER_ITEMS, MAX_DOMAIN_CONTROL_MANIFEST_BYTES, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH, } from "./domain-control-manifest.mjs";
+import { PUBLIC_DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, PUBLIC_DOMAIN_CONTROL_MANIFEST_LIMITATIONS, DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS, DOMAIN_CONTROL_MANIFEST_ROOT_KEYS, DOMAIN_CONTROL_SPKI_SHA256_HEX_LENGTH, DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, MAX_CURRENT_DOMAIN_CONTROL_RECORDS, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_CLI_REVIEW_JSON_DEPTH, MAX_DOMAIN_CONTROL_CLI_REVIEW_JSON_KEYS, MAX_DOMAIN_CONTROL_CLI_REVIEW_JSON_VALUES, MAX_DOMAIN_CONTROL_DOMAIN_LENGTH, MAX_DOMAIN_CONTROL_INPUT_RECORDS, MAX_DOMAIN_CONTROL_JSON_CONTAINER_ITEMS, MAX_DOMAIN_CONTROL_MANIFEST_BYTES, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH, } from "./domain-control-manifest.mjs";
 import { MAX_DOMAIN_CONTROL_MONITOR_CONCURRENCY, MAX_DOMAIN_CONTROL_MONITOR_DOMAINS, MIN_DOMAIN_CONTROL_MONITOR_CONCURRENCY, MIN_DOMAIN_CONTROL_MONITOR_DOMAINS, } from "./domain-control-monitor.mjs";
 import { MAX_CLI_LOOKUP_BYTES } from "./cli-lookup.mjs";
+import { DOMAIN_CONTROL_FLIGHT_RECORDER_OBSERVATION_KEYS, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_OBSERVATION_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_FIELD_KEYS, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_FIELD_KEYS, } from "./domain-control-flight-recorder.mjs";
 export const DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA = 'whoisleuth.domain-control-review-input';
 export const DOMAIN_CONTROL_REVIEW_SCHEMA = 'whoisleuth.domain-control-review';
 export const CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA = 'whoisleuth.cli.domain-control-review-input';
 export const CLI_DOMAIN_CONTROL_REVIEW_SCHEMA = 'whoisleuth.cli.domain-control-review';
-export const DOMAIN_CONTROL_REVIEW_VERSION = 1;
-export const CLI_DOMAIN_CONTROL_REVIEW_VERSION = 1;
+export const PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION = 1;
+export const PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION = 1;
+export const DOMAIN_CONTROL_REVIEW_VERSION = 2;
+export const CLI_DOMAIN_CONTROL_REVIEW_VERSION = 2;
+export const SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS = [PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION, DOMAIN_CONTROL_REVIEW_VERSION];
+export const SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS = [PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION, CLI_DOMAIN_CONTROL_REVIEW_VERSION];
 export const DOMAIN_CONTROL_REVIEW_OBSERVATION_FACTOR = 2;
 export const MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS = MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES
     * DOMAIN_CONTROL_REVIEW_OBSERVATION_FACTOR;
@@ -73,7 +78,7 @@ export const DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS = Object.freeze([
     'digestSha256',
     'expired',
 ]);
-export const DOMAIN_CONTROL_REVIEW_COUNT_KEYS = Object.freeze([
+export const PUBLIC_DOMAIN_CONTROL_REVIEW_COUNT_KEYS = Object.freeze([
     'aligned',
     'drift',
     'partial',
@@ -82,12 +87,13 @@ export const DOMAIN_CONTROL_REVIEW_COUNT_KEYS = Object.freeze([
     'not_configured',
     'due',
 ]);
+export const DOMAIN_CONTROL_REVIEW_COUNT_KEYS = Object.freeze([...PUBLIC_DOMAIN_CONTROL_REVIEW_COUNT_KEYS, 'observed']);
 export const DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS = Object.freeze([
     'domain',
     'state',
     'comparisons',
 ]);
-export const DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS = Object.freeze([
+export const PUBLIC_DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS = Object.freeze([
     'field',
     'state',
     'desired',
@@ -96,11 +102,17 @@ export const DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS = Object.freeze([
     'observedAt',
     'explanation',
 ]);
-export const DOMAIN_CONTROL_REVIEW_LIMITATIONS = Object.freeze([
+export const DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS = Object.freeze([...PUBLIC_DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, 'expectation']);
+export const PUBLIC_DOMAIN_CONTROL_REVIEW_LIMITATIONS = Object.freeze([
     'This local review compares analyst-authored desired state with separately supplied observations and performs no collection or configuration change.',
     'Only complete observations can produce drift. Partial, unavailable, unsupported, or missing evidence remains inconclusive.',
     'A valid manifest digest or signature establishes file integrity, not the correctness of the desired state or supplied observations.',
 ]);
+export const DOMAIN_CONTROL_REVIEW_LIMITATIONS = Object.freeze([
+    PUBLIC_DOMAIN_CONTROL_REVIEW_LIMITATIONS[0],
+    'Only complete observations with valid source times within the current review-age window can establish alignment, drift or expected absence. Observation-only fields do not establish alignment.',
+    PUBLIC_DOMAIN_CONTROL_REVIEW_LIMITATIONS[2],
+]);
 export const CLI_DOMAIN_CONTROL_REVIEW_INPUT_KEYS = Object.freeze([
     'schema',
     'version',
@@ -116,37 +128,34 @@ export const CLI_DOMAIN_CONTROL_REVIEW_ROOT_KEYS = Object.freeze([
     'input',
     'limitations',
 ]);
-export const CLI_DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS = Object.freeze([
-    'domain',
-    'observedAt',
-    'collectionDepth',
-    'fields',
-]);
-export const CLI_DOMAIN_CONTROL_REVIEW_FIELD_KEYS = Object.freeze([
-    'id',
-    'source',
-    'state',
-    'values',
-]);
+export const PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS = PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_OBSERVATION_KEYS;
+export const CLI_DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS = DOMAIN_CONTROL_FLIGHT_RECORDER_OBSERVATION_KEYS;
+export const PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_FIELD_KEYS = PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_FIELD_KEYS;
+export const CLI_DOMAIN_CONTROL_REVIEW_FIELD_KEYS = DOMAIN_CONTROL_FLIGHT_RECORDER_FIELD_KEYS;
 export const CLI_DOMAIN_CONTROL_REVIEW_INPUT_SUMMARY_KEYS = Object.freeze([
     'lookupsReceived',
     'latestDomainObservations',
     'ignoredHistoricalLookups',
 ]);
-export const CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS = Object.freeze([
+export const PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS = Object.freeze([
     'The review uses only supplied saved Lookup documents and performs no request.',
     'The newest supplied observation per domain is used for desired-state comparison; all supplied observations remain available to a separate flight-recorder review.',
     'Raw RDAP, WHOIS, HTTP, TLS, and page payloads are not copied into this output.',
 ]);
+export const CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS = Object.freeze([
+    PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS[0],
+    'The newest supplied capture per domain is reviewed using each field’s retained source time. Missing or conflicting source times remain inconclusive.',
+    PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS[2],
+]);
 export const DOMAIN_CONTROL_REVIEW_INPUT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'cli.domain-control-review-core-input',
     kind: 'cli_document',
     schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA,
     currentVersion: DOMAIN_CONTROL_REVIEW_VERSION,
-    supportedVersions: [DOMAIN_CONTROL_REVIEW_VERSION],
+    supportedVersions: SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS,
     acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'reject',
-    migration: 'exact_current_only',
+    migration: 'read_only',
     writeSemantics: 'read_only',
     byteBudget: null,
     owner: 'packages/contracts/domain-control-review.mts',
@@ -157,10 +166,10 @@ export const DOMAIN_CONTROL_REVIEW_COMPATIBILITY = defineSchemaCompatibility({
     kind: 'cli_document',
     schema: DOMAIN_CONTROL_REVIEW_SCHEMA,
     currentVersion: DOMAIN_CONTROL_REVIEW_VERSION,
-    supportedVersions: [DOMAIN_CONTROL_REVIEW_VERSION],
+    supportedVersions: SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS,
     acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'reject',
-    migration: 'exact_current_only',
+    migration: 'read_only',
     writeSemantics: 'read_only',
     byteBudget: null,
     owner: 'packages/contracts/domain-control-review.mts',
@@ -171,10 +180,10 @@ export const CLI_DOMAIN_CONTROL_REVIEW_INPUT_COMPATIBILITY = defineSchemaCompati
     kind: 'cli_document',
     schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA,
     currentVersion: CLI_DOMAIN_CONTROL_REVIEW_VERSION,
-    supportedVersions: [CLI_DOMAIN_CONTROL_REVIEW_VERSION],
+    supportedVersions: SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS,
     acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'reject',
-    migration: 'exact_current_only',
+    migration: 'read_only',
     writeSemantics: 'read_only',
     byteBudget: MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES,
     owner: 'packages/contracts/domain-control-review.mts',
@@ -185,7 +194,7 @@ export const CLI_DOMAIN_CONTROL_REVIEW_COMPATIBILITY = defineSchemaCompatibility
     kind: 'cli_document',
     schema: CLI_DOMAIN_CONTROL_REVIEW_SCHEMA,
     currentVersion: CLI_DOMAIN_CONTROL_REVIEW_VERSION,
-    supportedVersions: [CLI_DOMAIN_CONTROL_REVIEW_VERSION],
+    supportedVersions: SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS,
     acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'not_applicable',
     migration: 'read_only',
@@ -194,15 +203,15 @@ export const CLI_DOMAIN_CONTROL_REVIEW_COMPATIBILITY = defineSchemaCompatibility
     owner: 'packages/contracts/domain-control-review.mts',
     note: 'Compact source-qualified control observations and desired-state comparison.',
 });
-const CORE_REVIEW_SHAPES = [
+const CORE_REVIEW_SHAPES = SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS.flatMap((version) => [
     {
-        id: 'domain-control-review.input.v1',
+        id: `domain-control-review.input.v${version}`,
         schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA,
-        versions: [DOMAIN_CONTROL_REVIEW_VERSION],
+        versions: [version],
         objects: [
             { path: '$', requiredKeys: DOMAIN_CONTROL_REVIEW_INPUT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
             { path: '$.manifest', requiredKeys: DOMAIN_CONTROL_MANIFEST_ROOT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-            { path: '$.manifest.entries[]', requiredKeys: DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+            { path: '$.manifest.entries[]', requiredKeys: PUBLIC_DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, optionalKeys: version === PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION ? [] : ['recordModes'], unknownKeys: 'reject' },
             { path: '$.manifest.integrity', requiredKeys: DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS, optionalKeys: [], unknownKeys: 'reject' },
             { path: '$.observations[]', requiredKeys: DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS, optionalKeys: [], unknownKeys: 'reject' },
             { path: '$.observations[].fields', requiredKeys: [], optionalKeys: DOMAIN_CONTROL_REVIEW_FIELDS, unknownKeys: 'reject' },
@@ -213,26 +222,54 @@ const CORE_REVIEW_SHAPES = [
                 unknownKeys: 'reject',
             })),
         ],
-        fixedArrays: [{ path: '$.manifest.limitations', values: DOMAIN_CONTROL_MANIFEST_LIMITATIONS }],
+        fixedArrays: version === PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION ? [{ path: '$.manifest.limitations', values: PUBLIC_DOMAIN_CONTROL_MANIFEST_LIMITATIONS }] : [],
         normalisation: 'input_to_current',
         target: { schema: DOMAIN_CONTROL_REVIEW_SCHEMA, version: DOMAIN_CONTROL_REVIEW_VERSION },
     },
     {
-        id: 'domain-control-review.document.v1',
+        id: `domain-control-review.document.v${version}`,
         schema: DOMAIN_CONTROL_REVIEW_SCHEMA,
-        versions: [DOMAIN_CONTROL_REVIEW_VERSION],
+        versions: [version],
         objects: [
             { path: '$', requiredKeys: DOMAIN_CONTROL_REVIEW_ROOT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
             { path: '$.manifest', requiredKeys: DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-            { path: '$.counts', requiredKeys: DOMAIN_CONTROL_REVIEW_COUNT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+            { path: '$.counts', requiredKeys: version === PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION ? PUBLIC_DOMAIN_CONTROL_REVIEW_COUNT_KEYS : DOMAIN_CONTROL_REVIEW_COUNT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
             { path: '$.domains[]', requiredKeys: DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-            { path: '$.domains[].comparisons[]', requiredKeys: DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+            { path: '$.domains[].comparisons[]', requiredKeys: version === PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION ? PUBLIC_DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS : DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, optionalKeys: [], unknownKeys: 'reject' },
         ],
-        fixedArrays: [{ path: '$.limitations', values: DOMAIN_CONTROL_REVIEW_LIMITATIONS }],
+        fixedArrays: [{ path: '$.limitations', values: version === PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION ? PUBLIC_DOMAIN_CONTROL_REVIEW_LIMITATIONS : DOMAIN_CONTROL_REVIEW_LIMITATIONS }],
         normalisation: 'preserve_document',
         target: null,
     },
-];
+]);
+const CORE_BOUND_PROFILE_IDS = SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS.map((version) => `domain-control-review.core.v${version}`);
+const CORE_INPUT_SHAPE_IDS = SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS.map((version) => `domain-control-review.input.v${version}`);
+const CORE_DOCUMENT_SHAPE_IDS = SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS.map((version) => `domain-control-review.document.v${version}`);
+const CURRENT_CORE_DOCUMENT_SHAPE_ID = `domain-control-review.document.v${DOMAIN_CONTROL_REVIEW_VERSION}`;
+const CLI_INPUT_SHAPE_IDS = SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS.map((version) => `domain-control-review.cli-input.v${version}`);
+const CURRENT_CLI_DOCUMENT_SHAPE_ID = `domain-control-review.cli-document.v${CLI_DOMAIN_CONTROL_REVIEW_VERSION}`;
+function reviewFixtureShapeId(schema, version) {
+    const cli = schema.startsWith('whoisleuth.cli.');
+    return `domain-control-review.${cli ? 'cli-' : ''}${schema.endsWith('-input') ? 'input' : 'document'}.v${version}`;
+}
+const CURRENT_REVIEW_FIXTURE_CONTENT = {
+    "domain-control-review-input-v2": {
+        "bytes": 1879,
+        "sha256": "ac3b5913a44c47bd179cd69e4a8bf4268f10e9f01dd7f59c7d722a8c0d241ad1"
+    },
+    "domain-control-review-v2": {
+        "bytes": 4386,
+        "sha256": "e85870d7c978f484a47c807104cab038af2aa30265d05cae1b129ce663e7b9b8"
+    },
+    "cli-domain-control-review-input-v2": {
+        "bytes": 4123,
+        "sha256": "ae360c4bcc2f6c3b48b5e9cef524b51ac25f958a88184d6f7efdf26eadfd815f"
+    },
+    "cli-domain-control-review-v2": {
+        "bytes": 9084,
+        "sha256": "4befd3e6e81873497a0d56b8337a6540516f36cfdb81d35a26c807875488e309"
+    }
+};
 export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
     id: 'domain-control-review',
     owner: 'packages/contracts/domain-control-review.mts',
@@ -283,7 +320,7 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
             role: 'input',
             lifecycle: 'current',
             readable: true,
-            emitted: true,
+            emitted: false,
             exactKeys: true,
             extensionPolicy: 'reject',
             futureVersionBehaviour: 'reject',
@@ -308,7 +345,15 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
             byteBudget: null,
             fixtureIds: ['cli-domain-control-review-v1'],
         },
-    ],
+    ].flatMap((contract) => {
+        const versions = contract.schema.startsWith('whoisleuth.cli.') ? SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS : SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS;
+        return versions.map((version) => ({
+            ...contract, version,
+            lifecycle: version === contract.version ? 'current' : contract.readable ? 'legacy' : 'retired',
+            emitted: contract.emitted && version === contract.version,
+            fixtureIds: contract.fixtureIds.map((id) => id.replace(/v\d+$/u, `v${version}`)),
+        }));
+    }),
     fixtures: [
         {
             id: 'domain-control-review-input-v1',
@@ -317,7 +362,7 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
             sha256: 'ca6e894a67715fa93a872d189fe22a21dc516200f672546de7cc8ffe2df12329',
             contentDigestSha256: null,
             schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA,
-            version: DOMAIN_CONTROL_REVIEW_VERSION,
+            version: PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION,
             role: 'input',
             expectation: 'normalises_to_current_output',
             expectedOutputFixtureId: 'domain-control-review-v1',
@@ -330,7 +375,7 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
             sha256: '1ac47d146aee742dd9e1c2b9755bfd8d59d1104b005bedd21d63f42c68d255ec',
             contentDigestSha256: null,
             schema: DOMAIN_CONTROL_REVIEW_SCHEMA,
-            version: DOMAIN_CONTROL_REVIEW_VERSION,
+            version: PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION,
             role: 'current',
             expectation: 'accepted_exact',
             expectedOutputFixtureId: null,
@@ -343,7 +388,7 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
             sha256: 'b4f2005738bf6d8f12433304f20b503eb3ee47778bef9daa1cf1d4fdddae8621',
             contentDigestSha256: null,
             schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA,
-            version: CLI_DOMAIN_CONTROL_REVIEW_VERSION,
+            version: PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION,
             role: 'input',
             expectation: 'normalises_to_current_output',
             expectedOutputFixtureId: 'cli-domain-control-review-v1',
@@ -356,58 +401,67 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
             sha256: 'd6e24209da9d4e41d2065bab493c035adf117faa5bacc8c8ce30c56c8aef0b93',
             contentDigestSha256: null,
             schema: CLI_DOMAIN_CONTROL_REVIEW_SCHEMA,
-            version: CLI_DOMAIN_CONTROL_REVIEW_VERSION,
+            version: PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION,
             role: 'current',
             expectation: 'accepted_exact',
             expectedOutputFixtureId: null,
             scope: 'repository',
         },
-    ],
+    ].flatMap((fixture) => {
+        const version = fixture.schema.startsWith('whoisleuth.cli.') ? CLI_DOMAIN_CONTROL_REVIEW_VERSION : DOMAIN_CONTROL_REVIEW_VERSION;
+        const id = fixture.id.replace(/v\d+$/u, `v${version}`);
+        const content = CURRENT_REVIEW_FIXTURE_CONTENT[id];
+        return [
+            { ...fixture, shapeId: reviewFixtureShapeId(fixture.schema, fixture.version), role: fixture.role === 'input' ? 'input' : 'historical', expectation: fixture.schema === CLI_DOMAIN_CONTROL_REVIEW_SCHEMA ? 'historical_output_exact' : 'accepted_exact', expectedOutputFixtureId: null },
+            { ...fixture, ...content, id, path: `test/fixtures/${id}.json`, version, shapeId: reviewFixtureShapeId(fixture.schema, version), role: fixture.role, expectation: fixture.expectation, expectedOutputFixtureId: fixture.expectedOutputFixtureId?.replace(/v\d+$/u, `v${version}`) ?? null },
+        ];
+    }),
     metadata: {
-        metadataVersion: 2,
         enforcement: 'declarative_only',
         shapes: [
             ...CORE_REVIEW_SHAPES,
-            {
-                id: 'domain-control-review.cli-input.v1',
-                schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA,
-                versions: [CLI_DOMAIN_CONTROL_REVIEW_VERSION],
-                objects: [
-                    { path: '$', requiredKeys: CLI_DOMAIN_CONTROL_REVIEW_INPUT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-                    { path: '$.manifest', requiredKeys: DOMAIN_CONTROL_MANIFEST_ROOT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-                    { path: '$.manifest.entries[]', requiredKeys: DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-                    { path: '$.manifest.integrity', requiredKeys: DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-                ],
-                fixedArrays: [{ path: '$.manifest.limitations', values: DOMAIN_CONTROL_MANIFEST_LIMITATIONS }],
-                normalisation: 'input_to_current',
-                target: { schema: CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, version: CLI_DOMAIN_CONTROL_REVIEW_VERSION },
-            },
-            {
-                id: 'domain-control-review.cli-document.v1',
-                schema: CLI_DOMAIN_CONTROL_REVIEW_SCHEMA,
-                versions: [CLI_DOMAIN_CONTROL_REVIEW_VERSION],
-                objects: [
-                    { path: '$', requiredKeys: CLI_DOMAIN_CONTROL_REVIEW_ROOT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-                    { path: '$.review', requiredKeys: DOMAIN_CONTROL_REVIEW_ROOT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-                    { path: '$.review.manifest', requiredKeys: DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-                    { path: '$.review.counts', requiredKeys: DOMAIN_CONTROL_REVIEW_COUNT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-                    { path: '$.review.domains[]', requiredKeys: DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-                    { path: '$.review.domains[].comparisons[]', requiredKeys: DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-                    { path: '$.observations[]', requiredKeys: CLI_DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-                    { path: '$.observations[].fields[]', requiredKeys: CLI_DOMAIN_CONTROL_REVIEW_FIELD_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-                    { path: '$.input', requiredKeys: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SUMMARY_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-                ],
-                fixedArrays: [
-                    { path: '$.review.limitations', values: DOMAIN_CONTROL_REVIEW_LIMITATIONS },
-                    { path: '$.limitations', values: CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS },
-                ],
-                normalisation: 'preserve_document',
-                target: null,
-            },
-        ],
+            ...SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS.flatMap((version) => [
+                {
+                    id: `domain-control-review.cli-input.v${version}`,
+                    schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA,
+                    versions: [version],
+                    objects: [
+                        { path: '$', requiredKeys: CLI_DOMAIN_CONTROL_REVIEW_INPUT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+                        { path: '$.manifest', requiredKeys: DOMAIN_CONTROL_MANIFEST_ROOT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+                        { path: '$.manifest.entries[]', requiredKeys: PUBLIC_DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, optionalKeys: version === PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION ? [] : ['recordModes'], unknownKeys: 'reject' },
+                        { path: '$.manifest.integrity', requiredKeys: DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+                    ],
+                    fixedArrays: version === PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION ? [{ path: '$.manifest.limitations', values: PUBLIC_DOMAIN_CONTROL_MANIFEST_LIMITATIONS }] : [],
+                    normalisation: 'input_to_current',
+                    target: { schema: CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, version: CLI_DOMAIN_CONTROL_REVIEW_VERSION },
+                },
+                {
+                    id: `domain-control-review.cli-document.v${version}`,
+                    schema: CLI_DOMAIN_CONTROL_REVIEW_SCHEMA,
+                    versions: [version],
+                    objects: [
+                        { path: '$', requiredKeys: CLI_DOMAIN_CONTROL_REVIEW_ROOT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+                        { path: '$.review', requiredKeys: DOMAIN_CONTROL_REVIEW_ROOT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+                        { path: '$.review.manifest', requiredKeys: DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+                        { path: '$.review.counts', requiredKeys: version === PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION ? PUBLIC_DOMAIN_CONTROL_REVIEW_COUNT_KEYS : DOMAIN_CONTROL_REVIEW_COUNT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+                        { path: '$.review.domains[]', requiredKeys: DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+                        { path: '$.review.domains[].comparisons[]', requiredKeys: version === PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION ? PUBLIC_DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS : DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+                        { path: '$.observations[]', requiredKeys: version === PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION ? PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS : CLI_DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+                        { path: '$.observations[].fields[]', requiredKeys: version === PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION ? PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_FIELD_KEYS : CLI_DOMAIN_CONTROL_REVIEW_FIELD_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+                        { path: '$.input', requiredKeys: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SUMMARY_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+                    ],
+                    fixedArrays: [
+                        { path: '$.review.limitations', values: version === PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION ? PUBLIC_DOMAIN_CONTROL_REVIEW_LIMITATIONS : DOMAIN_CONTROL_REVIEW_LIMITATIONS },
+                        { path: '$.limitations', values: version === PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION ? PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS : CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS },
+                    ],
+                    normalisation: 'preserve_document',
+                    target: null,
+                },
+            ]),
+        ].map((shape) => ({ ...shape, discriminator: null, objects: shape.objects.map((object) => ({ ...object, alternativeRequiredKeys: [] })) })),
         boundProfiles: [
-            {
-                id: 'domain-control-review.core.v1',
+            ...SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS.map((version) => ({
+                id: `domain-control-review.core.v${version}`,
                 bounds: [
                     { id: 'observations', path: '$.observations', phase: 'pre_accumulation', unit: 'items', minimum: 0, maximum: MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS, handling: 'reject' },
                     { id: 'observation-fields', path: '$.observations[].fields', phase: 'pre_accumulation', unit: 'keys', minimum: 0, maximum: MAX_DOMAIN_CONTROL_REVIEW_FIELDS, handling: 'reject' },
@@ -415,7 +469,7 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                         const boundId = field.replace(/([A-Z])/gu, '-$1').toLowerCase();
                         return [
                             { id: `${boundId}-input-values`, path: `$.observations[].fields.${field}.values`, phase: 'pre_accumulation', unit: 'items', minimum: 0, maximum: MAX_DOMAIN_CONTROL_REVIEW_FIELD_INPUT_VALUES, handling: 'reject' },
-                            { id: `${boundId}-values`, path: `$.observations[].fields.${field}.values`, phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, handling: 'truncate' },
+                            { id: `${boundId}-values`, path: `$.observations[].fields.${field}.values`, phase: 'normalised', unit: 'items', minimum: 0, maximum: version === PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION ? MAX_CANONICAL_DOMAIN_CONTROL_RECORDS : MAX_CURRENT_DOMAIN_CONTROL_RECORDS, handling: 'reject' },
                             { id: `${boundId}-source-input`, path: `$.observations[].fields.${field}.source`, phase: 'pre_accumulation', unit: 'characters', minimum: 1, maximum: MAX_DOMAIN_CONTROL_REVIEW_SOURCE_INPUT_LENGTH, handling: 'reject' },
                             { id: `${boundId}-source`, path: `$.observations[].fields.${field}.source`, phase: 'normalised', unit: 'characters', minimum: 1, maximum: MAX_DOMAIN_CONTROL_REVIEW_SOURCE_LENGTH, handling: 'truncate' },
                             { id: `${boundId}-observed-at-input`, path: `$.observations[].fields.${field}.observedAt`, phase: 'pre_accumulation', unit: 'characters', minimum: 0, maximum: MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH * DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, handling: 'reject' },
@@ -430,7 +484,7 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                     { id: 'tls-spki-text', path: '$.observations[].fields.tlsSpkiSha256.values[]', phase: 'normalised', unit: 'characters', minimum: DOMAIN_CONTROL_SPKI_SHA256_HEX_LENGTH, maximum: DOMAIN_CONTROL_SPKI_SHA256_HEX_LENGTH, handling: 'reject' },
                     { id: 'output-domains', path: '$.domains', phase: 'normalised', unit: 'entries', minimum: 1, maximum: MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, handling: 'reject' },
                 ],
-            },
+            })),
             {
                 id: 'domain-control-review.cli-library.v1',
                 bounds: [
@@ -471,7 +525,7 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
             {
                 id: 'domain-control-review.core-json.v1',
                 schema: DOMAIN_CONTROL_REVIEW_SCHEMA,
-                versions: [DOMAIN_CONTROL_REVIEW_VERSION],
+                versions: SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS,
                 mediaType: 'application/json',
                 encoding: 'utf-8',
                 bom: false,
@@ -486,7 +540,7 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
             {
                 id: 'domain-control-review.cli-json.v1',
                 schema: CLI_DOMAIN_CONTROL_REVIEW_SCHEMA,
-                versions: [CLI_DOMAIN_CONTROL_REVIEW_VERSION],
+                versions: SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS,
                 mediaType: 'application/json',
                 encoding: 'utf-8',
                 bom: false,
@@ -583,10 +637,10 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                 id: 'domain-control-review.node-core',
                 plane: 'node',
                 operation: 'review',
-                acceptedContracts: [{ schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: [DOMAIN_CONTROL_REVIEW_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS, mode: 'direct' }],
                 emittedContract: { schema: DOMAIN_CONTROL_REVIEW_SCHEMA, version: DOMAIN_CONTROL_REVIEW_VERSION },
-                shapeIds: ['domain-control-review.input.v1', 'domain-control-review.document.v1'],
-                boundProfileIds: ['domain-control-review.core.v1'],
+                shapeIds: [...CORE_INPUT_SHAPE_IDS, CURRENT_CORE_DOCUMENT_SHAPE_ID],
+                boundProfileIds: [...CORE_BOUND_PROFILE_IDS],
                 hookIds: ['domain-control-review.node.verify-manifest', 'domain-control-review.node.build-core'],
                 serialisationProfileId: null,
                 privacyProfileId: 'domain-control-review.sensitive.v1',
@@ -600,10 +654,10 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                 id: 'domain-control-review.cli-core-json-stdout',
                 plane: 'cli',
                 operation: 'review-json-stdout',
-                acceptedContracts: [{ schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: [DOMAIN_CONTROL_REVIEW_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS, mode: 'direct' }],
                 emittedContract: { schema: DOMAIN_CONTROL_REVIEW_SCHEMA, version: DOMAIN_CONTROL_REVIEW_VERSION },
-                shapeIds: ['domain-control-review.input.v1', 'domain-control-review.document.v1'],
-                boundProfileIds: ['domain-control-review.core.v1', 'domain-control-review.cli-command.v1'],
+                shapeIds: [...CORE_INPUT_SHAPE_IDS, CURRENT_CORE_DOCUMENT_SHAPE_ID],
+                boundProfileIds: [...CORE_BOUND_PROFILE_IDS, 'domain-control-review.cli-command.v1'],
                 hookIds: [
                     'domain-control-review.node.verify-manifest',
                     'domain-control-review.node.build-core',
@@ -621,10 +675,10 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                 id: 'domain-control-review.cli-core-terminal-stdout',
                 plane: 'cli',
                 operation: 'review-terminal-stdout',
-                acceptedContracts: [{ schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: [DOMAIN_CONTROL_REVIEW_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS, mode: 'direct' }],
                 emittedContract: { schema: DOMAIN_CONTROL_REVIEW_SCHEMA, version: DOMAIN_CONTROL_REVIEW_VERSION },
-                shapeIds: ['domain-control-review.input.v1', 'domain-control-review.document.v1'],
-                boundProfileIds: ['domain-control-review.core.v1', 'domain-control-review.cli-command.v1'],
+                shapeIds: [...CORE_INPUT_SHAPE_IDS, CURRENT_CORE_DOCUMENT_SHAPE_ID],
+                boundProfileIds: [...CORE_BOUND_PROFILE_IDS, 'domain-control-review.cli-command.v1'],
                 hookIds: [
                     'domain-control-review.node.verify-manifest',
                     'domain-control-review.node.build-core',
@@ -642,10 +696,10 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                 id: 'domain-control-review.cli-core-json-file',
                 plane: 'cli',
                 operation: 'review-json-file',
-                acceptedContracts: [{ schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: [DOMAIN_CONTROL_REVIEW_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS, mode: 'direct' }],
                 emittedContract: { schema: DOMAIN_CONTROL_REVIEW_SCHEMA, version: DOMAIN_CONTROL_REVIEW_VERSION },
-                shapeIds: ['domain-control-review.input.v1', 'domain-control-review.document.v1'],
-                boundProfileIds: ['domain-control-review.core.v1', 'domain-control-review.cli-command.v1'],
+                shapeIds: [...CORE_INPUT_SHAPE_IDS, CURRENT_CORE_DOCUMENT_SHAPE_ID],
+                boundProfileIds: [...CORE_BOUND_PROFILE_IDS, 'domain-control-review.cli-command.v1'],
                 hookIds: [
                     'domain-control-review.node.verify-manifest',
                     'domain-control-review.node.build-core',
@@ -663,10 +717,10 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                 id: 'domain-control-review.cli-core-terminal-file',
                 plane: 'cli',
                 operation: 'review-terminal-file',
-                acceptedContracts: [{ schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: [DOMAIN_CONTROL_REVIEW_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS, mode: 'direct' }],
                 emittedContract: { schema: DOMAIN_CONTROL_REVIEW_SCHEMA, version: DOMAIN_CONTROL_REVIEW_VERSION },
-                shapeIds: ['domain-control-review.input.v1', 'domain-control-review.document.v1'],
-                boundProfileIds: ['domain-control-review.core.v1', 'domain-control-review.cli-command.v1'],
+                shapeIds: [...CORE_INPUT_SHAPE_IDS, CURRENT_CORE_DOCUMENT_SHAPE_ID],
+                boundProfileIds: [...CORE_BOUND_PROFILE_IDS, 'domain-control-review.cli-command.v1'],
                 hookIds: [
                     'domain-control-review.node.verify-manifest',
                     'domain-control-review.node.build-core',
@@ -684,10 +738,10 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                 id: 'domain-control-review.cli-saved-lookup-library',
                 plane: 'cli',
                 operation: 'review',
-                acceptedContracts: [{ schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: [CLI_DOMAIN_CONTROL_REVIEW_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS, mode: 'direct' }],
                 emittedContract: { schema: CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, version: CLI_DOMAIN_CONTROL_REVIEW_VERSION },
-                shapeIds: ['domain-control-review.cli-input.v1', 'domain-control-review.cli-document.v1'],
-                boundProfileIds: ['domain-control-review.core.v1', 'domain-control-review.cli-library.v1'],
+                shapeIds: [...CLI_INPUT_SHAPE_IDS, CURRENT_CLI_DOCUMENT_SHAPE_ID],
+                boundProfileIds: [...CORE_BOUND_PROFILE_IDS, 'domain-control-review.cli-library.v1'],
                 hookIds: [
                     'domain-control-review.node.verify-manifest',
                     'domain-control-review.node.build-core',
@@ -705,11 +759,11 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                 id: 'domain-control-review.cli-saved-json-stdout',
                 plane: 'cli',
                 operation: 'review-json-stdout',
-                acceptedContracts: [{ schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: [CLI_DOMAIN_CONTROL_REVIEW_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS, mode: 'direct' }],
                 emittedContract: { schema: CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, version: CLI_DOMAIN_CONTROL_REVIEW_VERSION },
-                shapeIds: ['domain-control-review.cli-input.v1', 'domain-control-review.cli-document.v1'],
+                shapeIds: [...CLI_INPUT_SHAPE_IDS, CURRENT_CLI_DOCUMENT_SHAPE_ID],
                 boundProfileIds: [
-                    'domain-control-review.core.v1',
+                    ...CORE_BOUND_PROFILE_IDS,
                     'domain-control-review.cli-library.v1',
                     'domain-control-review.cli-command.v1',
                 ],
@@ -731,11 +785,11 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                 id: 'domain-control-review.cli-saved-terminal-stdout',
                 plane: 'cli',
                 operation: 'review-terminal-stdout',
-                acceptedContracts: [{ schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: [CLI_DOMAIN_CONTROL_REVIEW_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS, mode: 'direct' }],
                 emittedContract: { schema: CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, version: CLI_DOMAIN_CONTROL_REVIEW_VERSION },
-                shapeIds: ['domain-control-review.cli-input.v1', 'domain-control-review.cli-document.v1'],
+                shapeIds: [...CLI_INPUT_SHAPE_IDS, CURRENT_CLI_DOCUMENT_SHAPE_ID],
                 boundProfileIds: [
-                    'domain-control-review.core.v1',
+                    ...CORE_BOUND_PROFILE_IDS,
                     'domain-control-review.cli-library.v1',
                     'domain-control-review.cli-command.v1',
                 ],
@@ -757,11 +811,11 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                 id: 'domain-control-review.cli-saved-json-file',
                 plane: 'cli',
                 operation: 'review-json-file',
-                acceptedContracts: [{ schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: [CLI_DOMAIN_CONTROL_REVIEW_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS, mode: 'direct' }],
                 emittedContract: { schema: CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, version: CLI_DOMAIN_CONTROL_REVIEW_VERSION },
-                shapeIds: ['domain-control-review.cli-input.v1', 'domain-control-review.cli-document.v1'],
+                shapeIds: [...CLI_INPUT_SHAPE_IDS, CURRENT_CLI_DOCUMENT_SHAPE_ID],
                 boundProfileIds: [
-                    'domain-control-review.core.v1',
+                    ...CORE_BOUND_PROFILE_IDS,
                     'domain-control-review.cli-library.v1',
                     'domain-control-review.cli-command.v1',
                 ],
@@ -783,11 +837,11 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                 id: 'domain-control-review.cli-saved-terminal-file',
                 plane: 'cli',
                 operation: 'review-terminal-file',
-                acceptedContracts: [{ schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: [CLI_DOMAIN_CONTROL_REVIEW_VERSION], mode: 'direct' }],
+                acceptedContracts: [{ schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, versions: SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS, mode: 'direct' }],
                 emittedContract: { schema: CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, version: CLI_DOMAIN_CONTROL_REVIEW_VERSION },
-                shapeIds: ['domain-control-review.cli-input.v1', 'domain-control-review.cli-document.v1'],
+                shapeIds: [...CLI_INPUT_SHAPE_IDS, CURRENT_CLI_DOCUMENT_SHAPE_ID],
                 boundProfileIds: [
-                    'domain-control-review.core.v1',
+                    ...CORE_BOUND_PROFILE_IDS,
                     'domain-control-review.cli-library.v1',
                     'domain-control-review.cli-command.v1',
                 ],
@@ -809,9 +863,9 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                 id: 'domain-control-review.cli-monitor-embedding',
                 plane: 'cli',
                 operation: 'embed-review-after-bounded-passive-collection',
-                acceptedContracts: [{ schema: DOMAIN_CONTROL_REVIEW_SCHEMA, versions: [DOMAIN_CONTROL_REVIEW_VERSION], mode: 'embedded' }],
+                acceptedContracts: [{ schema: DOMAIN_CONTROL_REVIEW_SCHEMA, versions: SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS, mode: 'embedded' }],
                 emittedContract: null,
-                shapeIds: ['domain-control-review.document.v1'],
+                shapeIds: CORE_DOCUMENT_SHAPE_IDS,
                 boundProfileIds: ['domain-control-review.monitor-action.v1'],
                 hookIds: ['domain-control-review.node.validate-core', 'domain-control-review.cli.monitor'],
                 serialisationProfileId: null,
@@ -822,7 +876,11 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
                 bindingState: 'declared_unenforced',
                 policyState: 'current',
             },
-        ],
+        ].map((edge) => ({
+            ...edge,
+            acceptedContracts: edge.acceptedContracts.map((contract) => ({ ...contract, discriminator: null })),
+            emittedContract: edge.emittedContract ? { ...edge.emittedContract, discriminator: null } : null,
+        })),
         consumerRelationships: [],
     },
 });

package/packages/contracts/domain-name.mjs

@@ -2,3 +2,24 @@
 // normalisers. These are canonical A-label limits, not raw-input allowances.
 export const MAX_DOMAIN_NAME_LENGTH = 253;
 export const MAX_DOMAIN_LABEL_LENGTH = 63;
+const ASCII_LABEL_RE = /^[A-Za-z0-9-]+$/u;
+// Syntax only: public-suffix policy and network-address safety are separate.
+export function isValidAsciiHostname(value, options = {}) {
+    if (typeof value !== 'string'
+        || value.length < 1
+        || value.length > MAX_DOMAIN_NAME_LENGTH
+        || (options.requireLowercase === true && value !== value.toLowerCase()))
+        return false;
+    const labels = value.split('.');
+    if (options.requireDot !== false && labels.length < 2)
+        return false;
+    return labels.every((label) => label.length > 0 && label.length <= MAX_DOMAIN_LABEL_LENGTH
+        && !label.startsWith('-') && !label.endsWith('-') && ASCII_LABEL_RE.test(label));
+}
+function isIpv4Literal(value) {
+    const parts = value.split('.');
+    return parts.length === 4 && parts.every((part) => /^(?:0|[1-9]\d{0,2})$/u.test(part) && Number(part) <= 255);
+}
+export function isValidAsciiDomainName(value, options = {}) {
+    return isValidAsciiHostname(value, options) && !isIpv4Literal(value);
+}