@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/packages/cases/case-storage-model.mjs

@@ -88,6 +88,31 @@ export function enforceStoreBudget(cases) {
     }
     return { cases: working, pruned };
 }
+/** A read-only, ephemeral preview of the exact existing byte-budget policy. */
+export function prepareCaseStoreSave(current, proposed) {
+    const result = enforceStoreBudget(proposed);
+    const retainedById = new Map(result.cases.map(record => [record.id, record]));
+    const removed = proposed.flatMap(record => {
+        const retained = retainedById.get(record.id);
+        const ids = new Set(retained?.evidenceHistory.map(snapshot => snapshot.id));
+        const snapshots = record.evidenceHistory.filter(snapshot => !ids.has(snapshot.id));
+        return snapshots.length ? [{
+                caseId: record.id, domain: record.domain,
+                snapshotIds: snapshots.map(snapshot => snapshot.id),
+                remainingSnapshots: retained?.evidenceHistory.length ?? 0,
+            }] : [];
+    });
+    return {
+        ...result,
+        current: normalizeCaseStore(current).cases,
+        removed,
+        removedBytes: Math.max(0, byteLength(serializeCaseStore(proposed)) - byteLength(serializeCaseStore(result.cases))),
+    };
+}
+/** Same-clock peer edits invalidate confirmation, including changes to other Cases. */
+export function caseStoreSavePreviewIsCurrent(current, preview) {
+    return serializeCaseStore(current) === serializeCaseStore(preview.current);
+}
 export function buildCaseExport(cases, nowIso) {
     return {
         version: CASE_SCHEMA_VERSION,

package/packages/cases/response-route-freshness.mjs

@@ -0,0 +1,16 @@
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { MAX_RESPONSE_AUTHORISATION_CLOCK_SKEW_MS, RESPONSE_ROUTE_STALE_AFTER_DAYS } from "../contracts/case-portability.mjs";
+/** Source freshness is independent of action deadlines and analyst follow-up. */
+export function responseRouteFreshness(observedAt, reviewAfter, evaluatedAt) {
+    const observation = normalizeExplicitIsoTimestamp(observedAt);
+    const evaluation = normalizeExplicitIsoTimestamp(evaluatedAt);
+    const deadline = normalizeExplicitIsoTimestamp(reviewAfter);
+    if (!observation || !evaluation || (reviewAfter !== null && !deadline))
+        return 'unknown';
+    const age = Date.parse(evaluation) - Date.parse(observation);
+    return age < -MAX_RESPONSE_AUTHORISATION_CLOCK_SKEW_MS
+        || (deadline !== null && Date.parse(evaluation) >= Date.parse(deadline))
+        || (deadline === null && age > RESPONSE_ROUTE_STALE_AFTER_DAYS * 86_400_000)
+        ? 'stale'
+        : 'current';
+}

package/packages/comparison/capture-context.mjs

@@ -0,0 +1,61 @@
+import { exact, text } from "../evidence/artifact-structure.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { readEvidenceImageDimensions } from "../evidence/image-regions.mjs";
+/** Optional declarations remain unknown for existing manifests; no inference from image dimensions. */
+export function readCaptureConditions(raw) {
+    if (raw === undefined || raw === null)
+        return null;
+    const value = exact(raw, ['browser', 'browserVersion', 'viewport', 'deviceScaleFactor', 'locale', 'timezone', 'colourScheme'], 'Capture conditions');
+    const viewport = exact(value.viewport, ['width', 'height'], 'Capture viewport');
+    const dimensions = readEvidenceImageDimensions(viewport.width, viewport.height);
+    if (typeof value.deviceScaleFactor !== 'number' || !Number.isFinite(value.deviceScaleFactor)
+        || value.deviceScaleFactor < 0.25 || value.deviceScaleFactor > 8)
+        throw new TypeError('Capture scale must be between 0.25 and 8.');
+    if (value.colourScheme !== 'light' && value.colourScheme !== 'dark')
+        throw new TypeError('Capture colour scheme is unsupported.');
+    return Object.freeze({ browser: text(value.browser, 'Capture browser', 40), browserVersion: text(value.browserVersion, 'Capture browser version', 80),
+        viewport: dimensions, deviceScaleFactor: value.deviceScaleFactor,
+        locale: text(value.locale, 'Capture locale', 80), timezone: text(value.timezone, 'Capture timezone', 80), colourScheme: value.colourScheme });
+}
+export function readObservationLabel(raw) {
+    if (raw === undefined || raw === null || raw === '')
+        return null;
+    return text(raw, 'Observation label', 80);
+}
+export function compareObservationContexts(input) {
+    if (!Array.isArray(input) || input.length < 2 || input.length > 20)
+        throw new TypeError('Compare between 2 and 20 observation contexts.');
+    const observations = input.map(value => {
+        const observedAt = value.observedAt === null ? null : normalizeExplicitIsoTimestamp(value.observedAt);
+        if (value.observedAt !== null && !observedAt)
+            throw new TypeError('Observation time must include an explicit timezone.');
+        return { observedAt, observerLabel: readObservationLabel(value.observerLabel), vantageLabel: readObservationLabel(value.vantageLabel), conditions: readCaptureConditions(value.conditions) };
+    });
+    const timestamps = observations.map(value => value.observedAt === null ? null : Date.parse(value.observedAt));
+    const knownTimes = timestamps.filter((value) => value !== null);
+    const row = (id, label, values) => ({ id, label, values,
+        state: values.some(value => value === null) ? 'unknown' : new Set(values).size === 1 ? 'same' : 'different' });
+    const conditions = observations.map(value => value.conditions);
+    const rows = [
+        row('observer', 'Declared observer', observations.map(value => value.observerLabel)),
+        row('vantage', 'Declared vantage', observations.map(value => value.vantageLabel)),
+        row('browser', 'Declared browser', conditions.map(value => value ? `${value.browser} ${value.browserVersion}` : null)),
+        row('viewport', 'Declared viewport', conditions.map(value => value ? `${value.viewport.width} × ${value.viewport.height}` : null)),
+        row('scale', 'Declared scale', conditions.map(value => value ? String(value.deviceScaleFactor) : null)),
+        row('locale', 'Declared locale', conditions.map(value => value?.locale ?? null)),
+        row('timezone', 'Declared timezone', conditions.map(value => value?.timezone ?? null)),
+        row('colour', 'Declared colour scheme', conditions.map(value => value?.colourScheme ?? null)),
+    ];
+    const labelPairs = observations.map(value => value.observerLabel && value.vantageLabel ? JSON.stringify([value.observerLabel, value.vantageLabel]) : null);
+    return {
+        observations, rows, time: { state: knownTimes.length !== observations.length ? 'unknown' : new Set(knownTimes).size === 1 ? 'same_instant' : 'different_instants',
+            spanMilliseconds: knownTimes.length === observations.length ? Math.max(...knownTimes) - Math.min(...knownTimes) : null },
+        labels: labelPairs.some(value => value === null) ? 'incomplete' : new Set(labelPairs).size === labelPairs.length ? 'distinct' : 'repeated',
+        independence: 'not_verified',
+        limitations: [
+            'Observer, vantage and capture conditions are declarations, not verified network location or independent collection.',
+            'Different capture times, browser versions, viewports, scale, locale and shared upstream caches can explain differences. Equal declarations do not establish identical environments.',
+            'These selected observations do not establish worldwide availability, removal or takedown.',
+        ],
+    };
+}

package/packages/comparison/comparison-ledger-bulk.mjs

@@ -295,6 +295,10 @@ export function comparisonLedgerBulkPairIndexId(earlierSessionId, laterSessionId
     return stableComparisonLedgerId('ledger-bulk_session_pair', [String(earlierSessionId ?? ''), String(laterSessionId ?? '')]);
 }
 export function buildBulkComparisonCandidates(sessionsRaw, pairsRaw, counters) {
+    const pairs = comparisonLedgerInputArray(pairsRaw);
+    // Saved sessions are comparison inputs only after a pair is requested.
+    if (!pairs.length)
+        return [];
     const input = comparisonLedgerInputArray(sessionsRaw);
     counters.inputRecords += Math.max(0, input.length - MAX_BULK_SESSIONS);
     const sessions = new Map();
@@ -310,7 +314,6 @@ export function buildBulkComparisonCandidates(sessionsRaw, pairsRaw, counters) {
         }
         sessions.set(item.id, item);
     }
-    const pairs = comparisonLedgerInputArray(pairsRaw);
     counters.inputRecords += Math.max(0, pairs.length - MAX_COMPARISON_LEDGER_BULK_PAIRS);
     const candidates = [];
     const seen = new Set();

package/packages/comparison/page-similarity.mjs

@@ -141,6 +141,7 @@ export function comparePageBaselines(rawReference, rawObserved) {
     const observed = normalizePageBaseline(rawObserved);
     if (!reference || !observed)
         return null;
+    const sameFingerprintVersion = reference.fingerprintVersion === observed.fingerprintVersion;
     const components = [
         digestComponent('normalized_html', 'Normalised HTML', 'Normalized-HTML', reference.normalizedHtml, observed.normalizedHtml),
         visibleTextComponent(reference.visibleText, observed.visibleText),
@@ -149,7 +150,7 @@ export function comparePageBaselines(rawReference, rawObserved) {
         faviconComponent(reference, observed),
         setComponent('resource_hosts', 'External resource hosts', 'host', reference.resourceHosts, observed.resourceHosts, (value) => value),
         setComponent('tracking_identifiers', 'Tracking identifiers', 'identifier', reference.trackingIdentifiers, observed.trackingIdentifiers, (value) => `${value.type}:${value.value}`),
-    ];
+    ].map((item) => sameFingerprintVersion || item.id === 'favicon' ? item : component(item.id, item.label, item.method, 'unavailable', 'Different fingerprint versions', 'These captures use different HTML fingerprint algorithms. Retain the older baseline and capture a new baseline to compare current page evidence.', true));
     const counts = { same: 0, overlap: 0, different: 0, notObserved: 0, unavailable: 0 };
     for (const item of components) {
         if (item.status === 'not_observed')

package/packages/comparison/relationship-evidence.mjs

@@ -5,6 +5,7 @@
 // boundary.
 import { normalizeDomain } from "../cases/case-model.mjs";
 import { groupBySimilarFavicon } from "./favicon-similarity.mjs";
+import { qualifyRelationshipSources, relationshipSourceEvidence, normalizeRelationshipSourceProjection, unknownRelationshipSource, MAX_RELATIONSHIP_SOURCES_PER_DOMAIN, } from "./relationship-provenance.mjs";
 import { RELATIONSHIP_EVIDENCE_SCHEMA, RELATIONSHIP_EVIDENCE_VERSION, SUPPORTED_TLS_RELATIONSHIP_PROFILE_VERSIONS, TLS_RELATIONSHIP_PROFILE_VERSION, } from "../contracts/offline-comparison.mjs";
 export { RELATIONSHIP_EVIDENCE_SCHEMA, RELATIONSHIP_EVIDENCE_VERSION, SUPPORTED_TLS_RELATIONSHIP_PROFILE_VERSIONS, TLS_RELATIONSHIP_PROFILE_VERSION, };
 export const MAX_RELATIONSHIP_ROWS = 2000;
@@ -16,6 +17,12 @@ export const MAX_TRACKING_IDS_PER_ROW = 30;
 export const MAX_OFFICIAL_ASSET_HOSTS_PER_ROW = 30;
 export const MAX_OFFICIAL_DOMAINS = 200;
 export const MAX_FAVICON_ROWS = 250;
+const ARRAY_RELATIONSHIP_FIELDS = {
+    nameserver_set: { field: 'nameservers', maximum: MAX_NAMESERVERS_PER_ROW },
+    ip_address: { field: 'ipAddresses', maximum: MAX_IPS_PER_ROW },
+    tracking_identifier: { field: 'trackingIdentifiers', maximum: MAX_TRACKING_IDS_PER_ROW },
+    official_asset: { field: 'officialAssetHosts', maximum: MAX_OFFICIAL_ASSET_HOSTS_PER_ROW },
+};
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
 const FAVICON_SHA_RE = /^[a-f0-9]{64}$/i;
 const FAVICON_PHASH_RE = /^[a-f0-9]{16}$/i;
@@ -92,7 +99,7 @@ function tlsCertificateFingerprint(availability) {
     const certificate = record(tls?.certificate);
     const fingerprint = certificate?.fingerprintSha256;
     const status = tls?.status;
-    if (tls?.source !== 'tls' || !SUPPORTED_TLS_RELATIONSHIP_PROFILE_VERSIONS.some((version) => version === Number(tls?.profileVersion))
+    if (tls?.source !== 'tls' || !SUPPORTED_TLS_RELATIONSHIP_PROFILE_VERSIONS.some((version) => version === tls?.profileVersion)
         || typeof status !== 'string' || !['success', 'partial'].includes(status) || typeof fingerprint !== 'string'
         || fingerprint.length !== 64 || !CERTIFICATE_SHA_RE.test(fingerprint))
         return null;
@@ -131,6 +138,36 @@ export function relationshipObservation(rawAvailability, rawOfficialDomains = []
         ? availability.faviconHash.toLowerCase() : null;
     const faviconPHash = typeof availability.faviconPHash === 'string' && FAVICON_PHASH_RE.test(availability.faviconPHash)
         ? availability.faviconPHash.toLowerCase() : null;
+    const certificateFingerprint = tlsCertificateFingerprint(availability);
+    const dnsSource = relationshipSourceEvidence('dns', availability.dns);
+    const httpSource = relationshipSourceEvidence('http', availability.http);
+    const projectedSource = (source, truncated) => truncated
+        ? { ...source, complete: false, truncated: true } : source;
+    const sourceEvidence = {};
+    if (nameservers.values.length)
+        sourceEvidence.nameserver_set = [
+            // The compact availability nameserver list can be registration data or a
+            // DNS fallback. Its source is not distinguishable from this projection.
+            ...(Array.isArray(availability.nameservers) && availability.nameservers.length
+                ? [availability.source === 'dns' ? projectedSource(dnsSource, nameservers.truncated)
+                        : unknownRelationshipSource('registration_or_dns')] : []),
+            ...(Array.isArray(records.ns) && records.ns.length ? [projectedSource(dnsSource, nameservers.truncated)] : []),
+        ];
+    if (ipAddresses.values.length)
+        sourceEvidence.ip_address = [projectedSource(dnsSource, ipAddresses.truncated)];
+    if (certificateFingerprint)
+        sourceEvidence.certificate = [relationshipSourceEvidence('tls', availability.tls)];
+    if (trackingIdentifiers.values.length)
+        sourceEvidence.tracking_identifier = [
+            projectedSource(httpSource, trackingIdentifiers.truncated),
+            relationshipSourceEvidence('page_identity', availability.pageIdentity),
+        ];
+    if (officialAssetHosts.length)
+        sourceEvidence.official_asset = [projectedSource(httpSource, assets.truncated
+                || officialDomainSource.length > MAX_OFFICIAL_DOMAINS)];
+    // A homepage timestamp does not date the independently fetched favicon.
+    if (faviconHash || faviconPHash)
+        sourceEvidence.favicon = [unknownRelationshipSource('favicon')];
     return {
         version: RELATIONSHIP_EVIDENCE_VERSION,
         nameservers: nameservers.values,
@@ -139,7 +176,8 @@ export function relationshipObservation(rawAvailability, rawOfficialDomains = []
         officialAssetHosts,
         faviconHash,
         faviconPHash,
-        certificateFingerprint: tlsCertificateFingerprint(availability),
+        certificateFingerprint,
+        sourceEvidence,
         truncated: nameservers.truncated || ipAddresses.truncated || trackingIdentifiers.truncated || assets.truncated
             || officialDomainSource.length > MAX_OFFICIAL_DOMAINS,
     };
@@ -152,7 +190,22 @@ function addBucket(buckets, value, domain) {
     buckets.get(value)?.add(domain);
 }
 function group(type, label, method, value, domains, description, normalizedValue = value) {
-    return { type, label, method, value, normalizedValue, domains, description };
+    return { type, label, method, value, normalizedValue, domains, description, ...qualifyRelationshipSources([], domains) };
+}
+function contributesToGroup(observation, item, domain) {
+    if (item.type === 'certificate')
+        return typeof observation.certificateFingerprint === 'string'
+            && observation.certificateFingerprint.toLowerCase() === item.normalizedValue;
+    if (item.type === 'nameserver_set')
+        return Array.isArray(observation.nameservers)
+            && [...new Set(observation.nameservers.slice(0, MAX_NAMESERVERS_PER_ROW).map(hostname).filter(Boolean))].sort().join(' · ') === item.normalizedValue;
+    const field = ARRAY_RELATIONSHIP_FIELDS[item.type];
+    if (field)
+        return Array.isArray(observation[field.field]) && observation[field.field].slice(0, field.maximum).some((value) => (item.type === 'ip_address' ? ipAddress(value) : item.type === 'official_asset' ? hostname(value) : value) === item.normalizedValue);
+    return item.type === 'favicon' && item.normalizedValue.split('|').includes(`${domain}=${[
+        typeof observation.faviconHash === 'string' && FAVICON_SHA_RE.test(observation.faviconHash) ? `sha256:${observation.faviconHash.toLowerCase()}` : '',
+        typeof observation.faviconPHash === 'string' && FAVICON_PHASH_RE.test(observation.faviconPHash) ? `dhash:${observation.faviconPHash.toLowerCase()}` : '',
+    ].filter(Boolean).join(',')}`);
 }
 /**
  * @param {Array<{domain?:unknown,trusted?:unknown,relationship?:unknown}>} rawRows
@@ -164,7 +217,7 @@ export function buildScanRelationships(rawRows) {
     for (const raw of input.slice(0, MAX_RELATIONSHIP_ROWS)) {
         const domain = normalizeDomain(raw?.domain);
         const observation = record(raw?.relationship);
-        if (!domain || raw?.trusted || !observation || observation.version !== RELATIONSHIP_EVIDENCE_VERSION)
+        if (!domain || raw?.trusted || !observation || ![2, RELATIONSHIP_EVIDENCE_VERSION].some((version) => version === observation.version))
             continue;
         rows.push({ domain, observation });
         if (observation.truncated === true)
@@ -245,11 +298,35 @@ export function buildScanRelationships(rawRows) {
     output.sort((left, right) => (Number(order.get(left.type)) - Number(order.get(right.type))) || left.value.localeCompare(right.value) || left.domains.join('|').localeCompare(right.domains.join('|')));
     if (output.length > MAX_RELATIONSHIP_GROUPS)
         truncated = true;
+    const rowsByDomain = new Map();
+    for (const row of rows) {
+        const members = rowsByDomain.get(row.domain) ?? [];
+        members.push(row);
+        rowsByDomain.set(row.domain, members);
+    }
     const groups = output.slice(0, MAX_RELATIONSHIP_GROUPS).map((item) => {
-        if (item.domains.length <= MAX_RELATIONSHIP_DOMAINS)
-            return item;
-        truncated = true;
-        return { ...item, domains: item.domains.slice(0, MAX_RELATIONSHIP_DOMAINS) };
+        const domains = item.domains.slice(0, MAX_RELATIONSHIP_DOMAINS);
+        let groupTruncated = item.domains.length > domains.length || input.length > MAX_RELATIONSHIP_ROWS;
+        if (groupTruncated)
+            truncated = true;
+        const contributors = [];
+        for (const domain of domains)
+            for (const { observation } of rowsByDomain.get(domain) ?? []) {
+                if (!contributesToGroup(observation, item, domain))
+                    continue;
+                const field = ARRAY_RELATIONSHIP_FIELDS[item.type];
+                if (field && Array.isArray(observation[field.field]) && observation[field.field].length > field.maximum)
+                    groupTruncated = true;
+                const projection = observation.version === RELATIONSHIP_EVIDENCE_VERSION
+                    ? normalizeRelationshipSourceProjection(observation.sourceEvidence) : {};
+                for (const source of projection[item.type] ?? [unknownRelationshipSource()]) {
+                    if (contributors.length >= MAX_RELATIONSHIP_DOMAINS * MAX_RELATIONSHIP_SOURCES_PER_DOMAIN)
+                        groupTruncated = true;
+                    else
+                        contributors.push({ domain, ...source });
+                }
+            }
+        return { ...item, domains, ...qualifyRelationshipSources(contributors, domains, { truncated: groupTruncated, type: item.type }) };
     });
     return {
         version: RELATIONSHIP_EVIDENCE_VERSION,

package/packages/comparison/relationship-provenance.mjs

@@ -0,0 +1,93 @@
+// Only the source metadata needed to qualify an observed relationship crosses
+// this boundary. Collection and retention times are never source-time fallbacks.
+import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeExplicitIsoTimestamp, readObservationEnvelope } from "../evidence/observation.mjs";
+export const RELATIONSHIP_TYPES = Object.freeze([
+    'nameserver_set', 'ip_address', 'certificate', 'tracking_identifier', 'favicon', 'official_asset',
+]);
+const SOURCES = ['dns', 'tls', 'http', 'page_identity', 'favicon', 'registration_or_dns', 'unknown'];
+const SOURCES_BY_TYPE = {
+    nameserver_set: ['dns', 'registration_or_dns'], ip_address: ['dns'], certificate: ['tls'],
+    tracking_identifier: ['http', 'page_identity'], favicon: ['favicon'], official_asset: ['http'],
+};
+const STATUSES = ['success', 'partial', 'not_found', 'skipped', 'error', 'unsupported', 'not_applicable', 'unknown'];
+export const MAX_RELATIONSHIP_SOURCES_PER_DOMAIN = 3;
+export const MAX_RELATIONSHIP_SOURCE_DOMAINS = 50;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+export function unknownRelationshipSource(source = 'unknown') {
+    return { source, status: 'unknown', observedAt: null, complete: false, truncated: null };
+}
+export function relationshipSourceEvidence(source, raw) {
+    const result = readObservationEnvelope(raw);
+    if (result.state !== 'supported' || result.observation.source !== source) {
+        return { ...unknownRelationshipSource(source), status: result.state === 'unsupported' ? 'unsupported' : 'unknown' };
+    }
+    return normalizeSource({ ...result.observation, truncated: record(raw).truncated });
+}
+function normalizeSource(raw, type) {
+    const value = record(raw);
+    const source = SOURCES.find((candidate) => candidate === value.source) ?? 'unknown';
+    if (type && source !== 'unknown' && !SOURCES_BY_TYPE[type].includes(source))
+        return unknownRelationshipSource();
+    const status = STATUSES.find((candidate) => candidate === value.status) ?? 'unknown';
+    const observedAt = normalizeExplicitIsoTimestamp(value.observedAt);
+    const truncated = typeof value.truncated === 'boolean' ? value.truncated : null;
+    return {
+        source, status, observedAt, truncated,
+        complete: source !== 'unknown' && source !== 'registration_or_dns' && status === 'success'
+            && value.complete === true && truncated === false && observedAt !== null,
+    };
+}
+export function normalizeRelationshipSourceProjection(raw) {
+    const value = record(raw);
+    const output = {};
+    for (const type of RELATIONSHIP_TYPES) {
+        if (!Array.isArray(value[type]))
+            continue;
+        const candidates = value[type];
+        output[type] = candidates.slice(0, MAX_RELATIONSHIP_SOURCES_PER_DOMAIN).map((candidate) => {
+            const source = normalizeSource(candidate, type);
+            return candidates.length > MAX_RELATIONSHIP_SOURCES_PER_DOMAIN ? { ...source, complete: false, truncated: true } : source;
+        });
+    }
+    return output;
+}
+/** Missing, malformed or omitted contributors cannot make a group complete. */
+export function qualifyRelationshipSources(raw, rawDomains, options = {}) {
+    const domains = [...new Set(rawDomains.slice(0, MAX_RELATIONSHIP_SOURCE_DOMAINS * 2).map(normalizeDomain).filter(Boolean))].slice(0, MAX_RELATIONSHIP_SOURCE_DOMAINS);
+    const allowed = new Set(domains);
+    const candidates = Array.isArray(raw) ? raw : [];
+    const maximum = MAX_RELATIONSHIP_SOURCE_DOMAINS * MAX_RELATIONSHIP_SOURCES_PER_DOMAIN;
+    const byDomain = new Map();
+    let omitted = options.truncated === true || rawDomains.length > MAX_RELATIONSHIP_SOURCE_DOMAINS || candidates.length > maximum;
+    for (const candidate of candidates.slice(0, maximum)) {
+        const value = record(candidate);
+        const domain = normalizeDomain(value.domain);
+        if (!domain || !allowed.has(domain)) {
+            omitted = true;
+            continue;
+        }
+        const contribution = { domain, ...normalizeSource(value, options.type) };
+        const entries = byDomain.get(domain) ?? new Map();
+        const key = JSON.stringify(contribution);
+        if (!entries.has(key) && entries.size >= MAX_RELATIONSHIP_SOURCES_PER_DOMAIN)
+            omitted = true;
+        else
+            entries.set(key, contribution);
+        byDomain.set(domain, entries);
+    }
+    const sourceEvidence = domains.sort().flatMap((domain) => {
+        const entries = byDomain.get(domain);
+        return entries?.size ? [...entries.values()].sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)))
+            : [{ domain, ...unknownRelationshipSource() }];
+    });
+    const observedAt = sourceEvidence.length && sourceEvidence.every((entry) => entry.observedAt !== null)
+        ? sourceEvidence.map((entry) => entry.observedAt).sort().at(-1) ?? null : null;
+    return {
+        sourceEvidence, observedAt,
+        complete: sourceEvidence.length > 0 && !omitted && sourceEvidence.every((entry) => entry.complete),
+        truncated: omitted || sourceEvidence.some((entry) => entry.truncated === true),
+    };
+}

package/packages/contracts/analyst-interchange.mjs

@@ -0,0 +1,216 @@
+import { defineSchemaCompatibility } from "./schema-compatibility.mjs";
+import { buildExtractedLifecycleFamily } from "./extracted-domain-lifecycle.mjs";
+import { defineSchemaLifecycleFamily } from "./schema-lifecycle.mjs";
+export const ANALYST_INTERCHANGE_CONTRACT_OWNER = 'packages/contracts/analyst-interchange.mts';
+export const INVESTIGATION_CACAO_SPEC_VERSION = 'cacao-2.0';
+export const INVESTIGATION_CACAO_PROFILE_VERSION = 2;
+export const INVESTIGATION_CACAO_PROFILE_SEMVER = '2.0.0';
+export const INVESTIGATION_CACAO_SUPPORTED_PROFILE_VERSIONS = [INVESTIGATION_CACAO_PROFILE_VERSION];
+export const MAX_INVESTIGATION_CACAO_IMPORT_BYTES = 384 * 1024;
+export const BRAND_PROTECTION_OPERATIONS_REPORT_SCHEMA = 'whoisleuth.brand-protection-operations-report';
+export const BRAND_PROTECTION_OPERATIONS_REPORT_VERSION = 2;
+export const MAX_OPERATIONS_REPORT_BYTES = 64 * 1024;
+export const DEFENSIVE_INDICATOR_LIFECYCLE_SCHEMA = 'whoisleuth.internal.defensive-indicators';
+export const DEFENSIVE_INDICATOR_EXPORT_VERSION = 2;
+export const DEFENSIVE_INDICATOR_MANIFEST_SCHEMA = 'whoisleuth.defensive-indicator-manifest';
+export const DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA = 'whoisleuth.defensive-indicator-rollback';
+export const STIX_INDICATOR_LIFECYCLE_SCHEMA = 'whoisleuth.internal.stix-indicators';
+export const STIX_INDICATOR_EXPORT_VERSION = 2;
+export const MISP_INDICATOR_LIFECYCLE_SCHEMA = 'whoisleuth.internal.misp-indicators';
+export const MISP_INDICATOR_EXPORT_VERSION = 2;
+export const DNS_CHANGE_REHEARSAL_VERSION = 2;
+export const DNS_CHANGE_REHEARSAL_EXPORT_SCHEMA = 'whoisleuth.dns-change-rehearsal';
+export const MAIL_REPORT_SCHEMA = 'whoisleuth.mail-report-review';
+export const MAIL_REPORT_VERSION = 3;
+export const MAIL_REPORT_CANONICALIZATION_ROUTES = Object.freeze([
+    Object.freeze({ version: 2, canonicalization: 'sorted-json-v1', explicit: false }),
+    Object.freeze({ version: MAIL_REPORT_VERSION, canonicalization: 'sorted-json-v2', explicit: true }),
+]);
+export const REGISTRATION_DISCLOSURE_PLAN_SCHEMA = 'whoisleuth.registration-disclosure-plan';
+export const REGISTRATION_DISCLOSURE_PLAN_VERSION = 2;
+export const STATIC_PAGE_PATTERN_PACK_SCHEMA = 'whoisleuth.static-page-pattern-pack';
+export const STATIC_PAGE_PATTERN_PACK_VERSION = 2;
+export const MAX_STATIC_PAGE_PATTERN_PACK_BYTES = 256 * 1024;
+export const WEB_CAPTURE_SUMMARY_SCHEMA = 'whoisleuth.web-capture-summary';
+export const WEB_CAPTURE_SUMMARY_VERSION = 1;
+export const WEB_CAPTURE_MANIFEST_SCHEMA = 'whoisleuth.web-capture-manifest';
+export const WEB_CAPTURE_MANIFEST_VERSION = 2;
+export const MAX_WEB_CAPTURE_MANIFEST_BYTES = 1024 * 1024;
+const CACAO_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.investigation-cacao-profile', kind: 'export', schema: INVESTIGATION_CACAO_SPEC_VERSION,
+    currentVersion: INVESTIGATION_CACAO_PROFILE_VERSION, supportedVersions: INVESTIGATION_CACAO_SUPPORTED_PROFILE_VERSIONS,
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'exact_current_only',
+    writeSemantics: 'non_destructive_merge', byteBudget: MAX_INVESTIGATION_CACAO_IMPORT_BYTES,
+    owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Restricted CACAO 2.0 profile with a connected linear sequence of manual analyst steps; version 2 adds fixed response recipe identifiers while executable commands, branches, targets, credentials, and arbitrary operations remain rejected.',
+});
+const OPERATIONS_REPORT_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.brand-protection-operations-report', kind: 'export', schema: BRAND_PROTECTION_OPERATIONS_REPORT_SCHEMA,
+    currentVersion: BRAND_PROTECTION_OPERATIONS_REPORT_VERSION, supportedVersions: [BRAND_PROTECTION_OPERATIONS_REPORT_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: MAX_OPERATIONS_REPORT_BYTES, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Version 2 aggregates typed action and independent-effect events with explicit denominators, omissions, time-window basis, and limitations. It excludes case identities and is not a service level or provider ranking.',
+});
+const DEFENSIVE_INDICATORS_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.defensive-indicators', kind: 'export', schema: null,
+    currentVersion: DEFENSIVE_INDICATOR_EXPORT_VERSION, supportedVersions: [DEFENSIVE_INDICATOR_EXPORT_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Review-only indicator, provenance-manifest, and rollback formats; never submitted or applied automatically.',
+});
+const STIX_INDICATORS_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.stix-indicators', kind: 'export', schema: null,
+    currentVersion: STIX_INDICATOR_EXPORT_VERSION, supportedVersions: [1, STIX_INDICATOR_EXPORT_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'STIX 2.1 bundle with observations separated from heuristic indicators. Version 2 uses a Note when observation time is unknown; Indicator validity starts at creation, not at a substituted sighting time.',
+});
+const MISP_INDICATORS_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.misp-indicators', kind: 'export', schema: null,
+    currentVersion: MISP_INDICATOR_EXPORT_VERSION, supportedVersions: [1, MISP_INDICATOR_EXPORT_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Unpublished, non-IDS, non-correlating event for reviewed import. Version 2 omits optional seen times when the source observation time is unknown.',
+});
+const WEB_CAPTURE_SUMMARY_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.web-capture-summary', kind: 'export', schema: WEB_CAPTURE_SUMMARY_SCHEMA,
+    currentVersion: WEB_CAPTURE_SUMMARY_VERSION, supportedVersions: [WEB_CAPTURE_SUMMARY_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'exact_current_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Sanitised metadata-only capture summary accepted through the bounded external-finding preview.',
+});
+const WEB_CAPTURE_MANIFEST_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.web-capture-manifest', kind: 'export', schema: WEB_CAPTURE_MANIFEST_SCHEMA,
+    currentVersion: WEB_CAPTURE_MANIFEST_VERSION, supportedVersions: [WEB_CAPTURE_MANIFEST_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: MAX_WEB_CAPTURE_MANIFEST_BYTES,
+    owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Metadata-only capture manifest; the browser and offline artefact comparison accept the v1.47.4 current-writer version 2.',
+});
+const DEFENSIVE_MANIFEST_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.defensive-indicator-manifest', kind: 'export', schema: DEFENSIVE_INDICATOR_MANIFEST_SCHEMA,
+    currentVersion: DEFENSIVE_INDICATOR_EXPORT_VERSION, supportedVersions: [DEFENSIVE_INDICATOR_EXPORT_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Output-only manifest for explicitly selected defensive indicators; historical version 1 is not claimed without a retained reader.',
+});
+const DEFENSIVE_ROLLBACK_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.defensive-indicator-rollback', kind: 'export', schema: DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA,
+    currentVersion: DEFENSIVE_INDICATOR_EXPORT_VERSION, supportedVersions: [DEFENSIVE_INDICATOR_EXPORT_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Output-only rollback companion for the same bounded defensive-indicator selection.',
+});
+const DNS_REHEARSAL_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.dns-change-rehearsal', kind: 'export', schema: DNS_CHANGE_REHEARSAL_EXPORT_SCHEMA,
+    currentVersion: DNS_CHANGE_REHEARSAL_VERSION, supportedVersions: [DNS_CHANGE_REHEARSAL_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Output-only DNS change rehearsal document; version 2 is the only producer contract represented by this tree.',
+});
+const MAIL_REPORT_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.mail-report-review', kind: 'export', schema: MAIL_REPORT_SCHEMA,
+    currentVersion: MAIL_REPORT_VERSION, supportedVersions: [1, 2, MAIL_REPORT_VERSION], acceptsUnversionedLegacy: false,
+    futureVersionBehavior: 'not_applicable', migration: 'read_only', writeSemantics: 'read_only', byteBudget: null,
+    owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Output-only aggregate mail review: v3 declares sorted-json-v2 integrity; v2 retains its undeclared v1 digest. Admission coverage is separate from pagination. Historical v1 has no reader; input and output byte bounds differ.',
+});
+const REGISTRATION_DISCLOSURE_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.registration-disclosure-plan', kind: 'export', schema: REGISTRATION_DISCLOSURE_PLAN_SCHEMA,
+    currentVersion: REGISTRATION_DISCLOSURE_PLAN_VERSION, supportedVersions: [REGISTRATION_DISCLOSURE_PLAN_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Output-only bounded registration-disclosure planning document; version 2 is the only current producer contract.',
+});
+const STATIC_PATTERN_PACK_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.static-page-pattern-pack', kind: 'export', schema: STATIC_PAGE_PATTERN_PACK_SCHEMA,
+    currentVersion: STATIC_PAGE_PATTERN_PACK_VERSION, supportedVersions: [STATIC_PAGE_PATTERN_PACK_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'exact_current_only',
+    writeSemantics: 'non_destructive_merge', byteBudget: MAX_STATIC_PAGE_PATTERN_PACK_BYTES,
+    owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Exact-current bounded page-pattern pack imported by explicit analyst action and merged without executing code or starting collection.',
+});
+export function serialiseAnalystInterchangeJson(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+const F = 'test/fixtures/extracted-domain-lifecycle/';
+export const ANALYST_INTERCHANGE_LIFECYCLE_FAMILY = defineSchemaLifecycleFamily(buildExtractedLifecycleFamily({
+    id: 'analyst-interchange', owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    serializerExportName: 'serialiseAnalystInterchangeJson', plane: 'shared', projection: 'browser_export',
+    retention: 'operator_controlled_output',
+    includedCategories: ['reviewed-indicators', 'source-identity', 'provenance', 'completeness', 'omitted-counts', 'limitations'],
+    excludedCategories: ['credentials', 'cookies', 'message-content', 'raw-upstream-responses', 'expanded-contacts'],
+    formats: [
+        { descriptor: CACAO_COMPATIBILITY, lifecycleSchema: INVESTIGATION_CACAO_SPEC_VERSION,
+            requiredKeys: ['type', 'spec_version', 'id', 'name', 'created', 'modified', 'workflow_start', 'workflow', 'extension_definitions'],
+            optionalKeys: ['description', 'playbook_types', 'playbook_activities', 'created_by', 'playbook_extensions', 'agent_definitions', 'x_whoisleuth_profile_version'],
+            hook: { module: 'packages/interchange/investigation-playbook-interchange.mts', exportName: 'parseCacaoInvestigationPlaybook', role: 'normaliser', runtime: 'shared' },
+            fixtures: [
+                { id: 'investigation-cacao-profile-v2', path: `${F}investigation-cacao-profile-v2.json`, bytes: 4_091, sha256: '7e9a3de6e12b83477690c0c58e03e6efbbb8b0c11fd98dc8470bdb6784d42358', version: INVESTIGATION_CACAO_PROFILE_VERSION },
+            ] },
+        { descriptor: OPERATIONS_REPORT_COMPATIBILITY, lifecycleSchema: BRAND_PROTECTION_OPERATIONS_REPORT_SCHEMA,
+            requiredKeys: ['schema', 'version', 'generatedAt', 'window', 'limitations'], optionalKeys: ['sourceState', 'summary', 'counts', 'states', 'actionTypes', 'durations', 'denominators', 'omissions'],
+            hook: { module: 'packages/interchange/brand-protection-operations-report.mts', exportName: 'serializeBrandProtectionOperationsReport', role: 'builder', runtime: 'shared' },
+            fixtures: [
+                { id: 'brand-protection-operations-report-v2', path: `${F}brand-protection-operations-report-v2.json`, bytes: 187, sha256: 'd38bf9b2c5cfc9c83df267ff2303ea2c3cdb398dd12c6607fbedb265b880a324', version: BRAND_PROTECTION_OPERATIONS_REPORT_VERSION },
+            ] },
+        { descriptor: DEFENSIVE_INDICATORS_COMPATIBILITY, lifecycleSchema: DEFENSIVE_INDICATOR_LIFECYCLE_SCHEMA,
+            requiredKeys: ['version', 'format'], optionalKeys: ['generatedAt', 'expiresAt', 'domains', 'entries', 'indicators', 'exclusions', 'explicitSelection', 'includeWildcards', 'truncated', 'filename', 'manifestFilename', 'rollbackFilename', 'mimeType', 'content', 'manifestContent', 'rollbackContent', 'limitations'],
+            hook: { module: 'packages/interchange/defensive-indicator-export.mts', exportName: 'buildDefensiveIndicatorExport', role: 'builder', runtime: 'shared' },
+            fixtures: [
+                { id: 'defensive-indicators-v2', path: `${F}defensive-indicators-v2.json`, bytes: 66, sha256: '597794782fbb2291acbcd854ced48bb2b8142f175fd9dd8ab99d53dd5532701e', version: DEFENSIVE_INDICATOR_EXPORT_VERSION },
+            ] },
+        { descriptor: STIX_INDICATORS_COMPATIBILITY, lifecycleSchema: STIX_INDICATOR_LIFECYCLE_SCHEMA,
+            requiredKeys: ['type', 'id', 'objects'], optionalKeys: ['x_whoisleuth_export_version'],
+            hook: { module: 'packages/interchange/stix-indicator-export.mts', exportName: 'buildStixIndicatorExport', role: 'builder', runtime: 'shared' },
+            fixtures: [
+                { id: 'stix-indicators-v1', path: `${F}stix-indicators-v1.json`, bytes: 115, sha256: '517fe4aec65bbdb5252945d5f0f0a393c5c72a2eb8f48a1c8147ae5c6e681f8e', version: 1 },
+                { id: 'stix-indicators-v2', path: `${F}stix-indicators-v2.json`, bytes: 5302, sha256: '09b3e53413944efbad81458b0042cc76e4d64f0895d5c1c2dbace3d52af0a6a4', version: STIX_INDICATOR_EXPORT_VERSION },
+            ] },
+        { descriptor: MISP_INDICATORS_COMPATIBILITY, lifecycleSchema: MISP_INDICATOR_LIFECYCLE_SCHEMA,
+            requiredKeys: ['Event'], optionalKeys: [],
+            hook: { module: 'packages/interchange/misp-indicator-export.mts', exportName: 'buildMispIndicatorExport', role: 'builder', runtime: 'shared' },
+            fixtures: [
+                { id: 'misp-indicators-v1', path: `${F}misp-indicators-v1.json`, bytes: 167, sha256: '043102cfb145ead16f6eba9b4ebe723aed12cc02f5899c918a0d172674e74997', version: 1 },
+                { id: 'misp-indicators-v2', path: `${F}misp-indicators-v2.json`, bytes: 1611, sha256: '9bcf624c2bcc6da9e1299ef470b288ca2f2da51c65665f0729f332c513a3d558', version: MISP_INDICATOR_EXPORT_VERSION },
+            ] },
+        { descriptor: WEB_CAPTURE_SUMMARY_COMPATIBILITY, lifecycleSchema: WEB_CAPTURE_SUMMARY_SCHEMA,
+            requiredKeys: ['schema', 'schemaVersion', 'source', 'captures'], optionalKeys: [],
+            hook: { module: 'packages/interchange/web-capture-import.mts', exportName: 'parseWebCaptureSummary', role: 'normaliser', runtime: 'shared' },
+            fixtures: [{ id: 'web-capture-summary-v1', path: `${F}web-capture-summary-v1.json`, bytes: 341, sha256: '70fba8a784f61f473ba6cde71a7d9dd915cfca46fbb3469e3bb57767adf973d9', version: WEB_CAPTURE_SUMMARY_VERSION }] },
+        { descriptor: WEB_CAPTURE_MANIFEST_COMPATIBILITY, lifecycleSchema: WEB_CAPTURE_MANIFEST_SCHEMA,
+            requiredKeys: ['schema', 'schemaVersion', 'source', 'captures'], optionalKeys: [],
+            hook: { module: 'packages/interchange/web-capture-import.mts', exportName: 'parseWebCaptureManifest', role: 'normaliser', runtime: 'shared' },
+            fixtures: [
+                { id: 'web-capture-manifest-v2', path: `${F}web-capture-manifest-v2.json`, bytes: 494, sha256: 'a2208dc956a832d70e37cd9a5929db81d29148856c485e4fd6ce5b123de5b8e6', version: WEB_CAPTURE_MANIFEST_VERSION },
+            ] },
+        { descriptor: DEFENSIVE_MANIFEST_COMPATIBILITY, lifecycleSchema: DEFENSIVE_INDICATOR_MANIFEST_SCHEMA,
+            requiredKeys: ['schema', 'version', 'generatedAt'], optionalKeys: ['expiresAt', 'reviewRequired', 'explicitSelection', 'includeWildcards', 'entries', 'indicators', 'exclusions', 'limitations'],
+            hook: { module: 'packages/interchange/defensive-indicator-export.mts', exportName: 'buildDefensiveIndicatorExport', role: 'builder', runtime: 'shared' },
+            fixtures: [{ id: 'defensive-indicator-manifest-v2', path: `${F}defensive-indicator-manifest-v2.json`, bytes: 139, sha256: '8a2475b1be1810bcc10b6285630e7056986f961320c884fd8cfc72951eb79db7', version: DEFENSIVE_INDICATOR_EXPORT_VERSION }] },
+        { descriptor: DEFENSIVE_ROLLBACK_COMPATIBILITY, lifecycleSchema: DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA,
+            requiredKeys: ['schema', 'version', 'generatedAt'], optionalKeys: ['removes', 'indicators', 'limitations'],
+            hook: { module: 'packages/interchange/defensive-indicator-export.mts', exportName: 'buildDefensiveIndicatorExport', role: 'builder', runtime: 'shared' },
+            fixtures: [{ id: 'defensive-indicator-rollback-v2', path: `${F}defensive-indicator-rollback-v2.json`, bytes: 139, sha256: '1af3d32d3e808327fadc39066256d441abb5957d1ae696b834a61a37658103e6', version: DEFENSIVE_INDICATOR_EXPORT_VERSION }] },
+        { descriptor: DNS_REHEARSAL_COMPATIBILITY, lifecycleSchema: DNS_CHANGE_REHEARSAL_EXPORT_SCHEMA,
+            requiredKeys: ['schema', 'version', 'generatedAt'], optionalKeys: ['domain', 'changes', 'findings', 'limitations'],
+            hook: { module: 'packages/interchange/dns-change-rehearsal.mts', exportName: 'buildDnsChangeRehearsalExport', role: 'builder', runtime: 'shared' },
+            fixtures: [{ id: 'dns-change-rehearsal-v2', path: `${F}dns-change-rehearsal-v2.json`, bytes: 169, sha256: '31b2e5d8d3774356362c4f5fc1741506ce7060953b49bb3cd3588adbd3bb96d3', version: DNS_CHANGE_REHEARSAL_VERSION }] },
+        { descriptor: MAIL_REPORT_COMPATIBILITY, lifecycleSchema: MAIL_REPORT_SCHEMA,
+            requiredKeys: ['schema', 'version', 'generatedAt'], optionalKeys: ['source', 'summary', 'findings', 'limitations', 'reports', 'profileScope', 'integrity'],
+            hook: { module: 'packages/interchange/mail-report-workbench.mts', exportName: 'buildMailReportReview', role: 'builder', runtime: 'shared' },
+            fixtures: [
+                { id: 'mail-report-review-v1', path: `${F}mail-report-review-v1.json`, bytes: 152, sha256: '804ffda72784ee2f0b34985f47f78075238841b4fbcc484b971efcd17f2b0c17', version: 1 },
+                { id: 'mail-report-review-v2', path: `${F}mail-report-review-v2.json`, bytes: 2188, sha256: '42bb3b3a05605b0ffdda3f369a52e0490dcf1541405f2db9cee900ddf0477d97', version: 2 },
+                { id: 'mail-report-review-v3', path: `${F}mail-report-review-v3.json`, bytes: 1627, sha256: '32d71697a08eae70cc070b981953cb18829efee139283f6163edecd126614048', version: MAIL_REPORT_VERSION },
+            ] },
+        { descriptor: REGISTRATION_DISCLOSURE_COMPATIBILITY, lifecycleSchema: REGISTRATION_DISCLOSURE_PLAN_SCHEMA,
+            requiredKeys: ['schema', 'version', 'generatedAt'], optionalKeys: ['domain', 'requests', 'limitations'],
+            hook: { module: 'packages/interchange/registration-disclosure-plan.mts', exportName: 'buildRegistrationDisclosurePlan', role: 'builder', runtime: 'shared' },
+            fixtures: [{ id: 'registration-disclosure-plan-v2', path: `${F}registration-disclosure-plan-v2.json`, bytes: 164, sha256: '74e516dc369a2c62fc5794134512bff8ec251faa85b30e78172f670b58db9037', version: REGISTRATION_DISCLOSURE_PLAN_VERSION }] },
+        { descriptor: STATIC_PATTERN_PACK_COMPATIBILITY, lifecycleSchema: STATIC_PAGE_PATTERN_PACK_SCHEMA,
+            requiredKeys: ['schema', 'version', 'id', 'label', 'description', 'evidenceBoundary', 'relationship', 'confidence', 'rules'], optionalKeys: [],
+            hook: { module: 'packages/interchange/static-page-pattern-packs.mts', exportName: 'validateStaticPagePatternPack', role: 'structure_validator', runtime: 'shared' },
+            fixtures: [{ id: 'static-page-pattern-pack-v2', path: `${F}static-page-pattern-pack-v2.json`, bytes: 1_094, sha256: 'c409e527850bcb924f5be0708a58c5e2c32d98947c42150f6a79765991c0eb6f', version: STATIC_PAGE_PATTERN_PACK_VERSION }] },
+    ],
+}));