@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/packages/comparison/relationship-evidence.mjs

@@ -3,10 +3,12 @@
 // proof of common ownership, coordination, intent, or maliciousness. This
 // module deliberately produces no aggregate score and is never a persistence
 // boundary.
-import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { canonicalPublicIpAddress } from "../evidence/public-address-policy.mjs";
 import { groupBySimilarFavicon } from "./favicon-similarity.mjs";
-import { RELATIONSHIP_EVIDENCE_SCHEMA, RELATIONSHIP_EVIDENCE_VERSION, SUPPORTED_TLS_RELATIONSHIP_PROFILE_VERSIONS, TLS_RELATIONSHIP_PROFILE_VERSION, } from "../contracts/offline-comparison.mjs";
-export { RELATIONSHIP_EVIDENCE_SCHEMA, RELATIONSHIP_EVIDENCE_VERSION, SUPPORTED_TLS_RELATIONSHIP_PROFILE_VERSIONS, TLS_RELATIONSHIP_PROFILE_VERSION, };
+import { qualifyRelationshipSources, relationshipSourceEvidence, normalizeRelationshipSourceProjection, FAVICON_RELATIONSHIP_DESCRIPTION, unknownRelationshipSource, MAX_RELATIONSHIP_SOURCES_PER_DOMAIN, } from "./relationship-provenance.mjs";
+import { RELATIONSHIP_EVIDENCE_SCHEMA, RELATIONSHIP_EVIDENCE_VERSION, SUPPORTED_RELATIONSHIP_EVIDENCE_VERSIONS, RELATIONSHIP_SOURCE_PROVENANCE_VERSION, SUPPORTED_TLS_RELATIONSHIP_PROFILE_VERSIONS, TLS_RELATIONSHIP_PROFILE_VERSION, } from "../contracts/offline-comparison.mjs";
+export { RELATIONSHIP_EVIDENCE_SCHEMA, RELATIONSHIP_EVIDENCE_VERSION, SUPPORTED_RELATIONSHIP_EVIDENCE_VERSIONS, SUPPORTED_TLS_RELATIONSHIP_PROFILE_VERSIONS, TLS_RELATIONSHIP_PROFILE_VERSION, };
 export const MAX_RELATIONSHIP_ROWS = 2000;
 export const MAX_RELATIONSHIP_GROUPS = 100;
 export const MAX_RELATIONSHIP_DOMAINS = 50;
@@ -16,6 +18,12 @@ export const MAX_TRACKING_IDS_PER_ROW = 30;
 export const MAX_OFFICIAL_ASSET_HOSTS_PER_ROW = 30;
 export const MAX_OFFICIAL_DOMAINS = 200;
 export const MAX_FAVICON_ROWS = 250;
+const ARRAY_RELATIONSHIP_FIELDS = {
+    nameserver_set: { field: 'nameservers', maximum: MAX_NAMESERVERS_PER_ROW },
+    ip_address: { field: 'ipAddresses', maximum: MAX_IPS_PER_ROW },
+    tracking_identifier: { field: 'trackingIdentifiers', maximum: MAX_TRACKING_IDS_PER_ROW },
+    official_asset: { field: 'officialAssetHosts', maximum: MAX_OFFICIAL_ASSET_HOSTS_PER_ROW },
+};
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
 const FAVICON_SHA_RE = /^[a-f0-9]{64}$/i;
 const FAVICON_PHASH_RE = /^[a-f0-9]{16}$/i;
@@ -92,7 +100,7 @@ function tlsCertificateFingerprint(availability) {
     const certificate = record(tls?.certificate);
     const fingerprint = certificate?.fingerprintSha256;
     const status = tls?.status;
-    if (tls?.source !== 'tls' || !SUPPORTED_TLS_RELATIONSHIP_PROFILE_VERSIONS.some((version) => version === Number(tls?.profileVersion))
+    if (tls?.source !== 'tls' || !SUPPORTED_TLS_RELATIONSHIP_PROFILE_VERSIONS.some((version) => version === tls?.profileVersion)
         || typeof status !== 'string' || !['success', 'partial'].includes(status) || typeof fingerprint !== 'string'
         || fingerprint.length !== 64 || !CERTIFICATE_SHA_RE.test(fingerprint))
         return null;
@@ -131,6 +139,36 @@ export function relationshipObservation(rawAvailability, rawOfficialDomains = []
         ? availability.faviconHash.toLowerCase() : null;
     const faviconPHash = typeof availability.faviconPHash === 'string' && FAVICON_PHASH_RE.test(availability.faviconPHash)
         ? availability.faviconPHash.toLowerCase() : null;
+    const certificateFingerprint = tlsCertificateFingerprint(availability);
+    const dnsSource = relationshipSourceEvidence('dns', availability.dns);
+    const httpSource = relationshipSourceEvidence('http', availability.http);
+    const projectedSource = (source, truncated) => truncated
+        ? { ...source, complete: false, truncated: true } : source;
+    const sourceEvidence = {};
+    if (nameservers.values.length)
+        sourceEvidence.nameserver_set = [
+            // The compact availability nameserver list can be registration data or a
+            // DNS fallback. Its source is not distinguishable from this projection.
+            ...(Array.isArray(availability.nameservers) && availability.nameservers.length
+                ? [availability.source === 'dns' ? projectedSource(dnsSource, nameservers.truncated)
+                        : unknownRelationshipSource('registration_or_dns')] : []),
+            ...(Array.isArray(records.ns) && records.ns.length ? [projectedSource(dnsSource, nameservers.truncated)] : []),
+        ];
+    if (ipAddresses.values.length)
+        sourceEvidence.ip_address = [projectedSource(dnsSource, ipAddresses.truncated)];
+    if (certificateFingerprint)
+        sourceEvidence.certificate = [relationshipSourceEvidence('tls', availability.tls)];
+    if (trackingIdentifiers.values.length)
+        sourceEvidence.tracking_identifier = [
+            projectedSource(httpSource, trackingIdentifiers.truncated),
+            relationshipSourceEvidence('page_identity', availability.pageIdentity),
+        ];
+    if (officialAssetHosts.length)
+        sourceEvidence.official_asset = [projectedSource(httpSource, assets.truncated
+                || officialDomainSource.length > MAX_OFFICIAL_DOMAINS)];
+    // A homepage timestamp does not date the independently fetched favicon.
+    if (faviconHash || faviconPHash)
+        sourceEvidence.favicon = [unknownRelationshipSource('favicon')];
     return {
         version: RELATIONSHIP_EVIDENCE_VERSION,
         nameservers: nameservers.values,
@@ -139,7 +177,8 @@ export function relationshipObservation(rawAvailability, rawOfficialDomains = []
         officialAssetHosts,
         faviconHash,
         faviconPHash,
-        certificateFingerprint: tlsCertificateFingerprint(availability),
+        certificateFingerprint,
+        sourceEvidence,
         truncated: nameservers.truncated || ipAddresses.truncated || trackingIdentifiers.truncated || assets.truncated
             || officialDomainSource.length > MAX_OFFICIAL_DOMAINS,
     };
@@ -152,7 +191,22 @@ function addBucket(buckets, value, domain) {
     buckets.get(value)?.add(domain);
 }
 function group(type, label, method, value, domains, description, normalizedValue = value) {
-    return { type, label, method, value, normalizedValue, domains, description };
+    return { type, label, method, value, normalizedValue, domains, description, ...qualifyRelationshipSources([], domains) };
+}
+function contributesToGroup(observation, item, domain) {
+    if (item.type === 'certificate')
+        return typeof observation.certificateFingerprint === 'string'
+            && observation.certificateFingerprint.toLowerCase() === item.normalizedValue;
+    if (item.type === 'nameserver_set')
+        return Array.isArray(observation.nameservers)
+            && [...new Set(observation.nameservers.slice(0, MAX_NAMESERVERS_PER_ROW).map(hostname).filter(Boolean))].sort().join(' · ') === item.normalizedValue;
+    const field = ARRAY_RELATIONSHIP_FIELDS[item.type];
+    if (field)
+        return Array.isArray(observation[field.field]) && observation[field.field].slice(0, field.maximum).some((value) => (item.type === 'ip_address' ? ipAddress(value) : item.type === 'official_asset' ? hostname(value) : value) === item.normalizedValue);
+    return item.type === 'favicon' && item.normalizedValue.split('|').includes(`${domain}=${[
+        typeof observation.faviconHash === 'string' && FAVICON_SHA_RE.test(observation.faviconHash) ? `sha256:${observation.faviconHash.toLowerCase()}` : '',
+        typeof observation.faviconPHash === 'string' && FAVICON_PHASH_RE.test(observation.faviconPHash) ? `dhash:${observation.faviconPHash.toLowerCase()}` : '',
+    ].filter(Boolean).join(',')}`);
 }
 /**
  * @param {Array<{domain?:unknown,trusted?:unknown,relationship?:unknown}>} rawRows
@@ -164,7 +218,7 @@ export function buildScanRelationships(rawRows) {
     for (const raw of input.slice(0, MAX_RELATIONSHIP_ROWS)) {
         const domain = normalizeDomain(raw?.domain);
         const observation = record(raw?.relationship);
-        if (!domain || raw?.trusted || !observation || observation.version !== RELATIONSHIP_EVIDENCE_VERSION)
+        if (!domain || raw?.trusted || !observation || !SUPPORTED_RELATIONSHIP_EVIDENCE_VERSIONS.some((version) => version === observation.version))
             continue;
         rows.push({ domain, observation });
         if (observation.truncated === true)
@@ -175,6 +229,7 @@ export function buildScanRelationships(rawRows) {
     const identifiers = new Map();
     const certificates = new Map();
     const officialAssets = new Map();
+    let excludedNonPublicAddresses = 0;
     for (const { domain, observation } of rows) {
         const nameserverSource = Array.isArray(observation.nameservers) ? observation.nameservers : [];
         const addressSource = Array.isArray(observation.ipAddresses) ? observation.ipAddresses : [];
@@ -186,8 +241,16 @@ export function buildScanRelationships(rawRows) {
         const nameservers = nameserverSource.slice(0, MAX_NAMESERVERS_PER_ROW).map(hostname).filter(Boolean);
         if (nameservers.length)
             addBucket(nameserverSets, [...new Set(nameservers)].sort().join(' · '), domain);
-        for (const value of addressSource.slice(0, MAX_IPS_PER_ROW))
-            addBucket(addresses, ipAddress(value), domain);
+        for (const value of addressSource.slice(0, MAX_IPS_PER_ROW)) {
+            const address = ipAddress(value);
+            if (!address)
+                continue;
+            const publicAddress = canonicalPublicIpAddress(address);
+            if (publicAddress)
+                addBucket(addresses, publicAddress, domain);
+            else
+                excludedNonPublicAddresses += 1;
+        }
         for (const value of identifierSource.slice(0, MAX_TRACKING_IDS_PER_ROW)) {
             if (typeof value === 'string' && /^[a-z-]{1,40}:[A-Z0-9-]{1,64}$/.test(value)) {
                 addBucket(identifiers, value, domain);
@@ -235,7 +298,7 @@ export function buildScanRelationships(rawRows) {
                     evidence?.faviconPHash ? `dhash:${evidence.faviconPHash}` : '',
                 ].filter(Boolean).join(',')}`;
             }).join('|');
-            output.push(group('favicon', 'Similar favicon', 'Exact SHA-256 or perceptual dHash distance ≤ 6', '', distinctDomains, 'These domains used an identical or perceptually similar favicon in this scan.', normalizedValue));
+            output.push(group('favicon', 'Connected favicon matches', 'Exact SHA-256 or perceptual dHash distance ≤ 6', '', distinctDomains, FAVICON_RELATIONSHIP_DESCRIPTION, normalizedValue));
         }
     }
     for (const [value, domains] of officialAssets)
@@ -245,17 +308,43 @@ export function buildScanRelationships(rawRows) {
     output.sort((left, right) => (Number(order.get(left.type)) - Number(order.get(right.type))) || left.value.localeCompare(right.value) || left.domains.join('|').localeCompare(right.domains.join('|')));
     if (output.length > MAX_RELATIONSHIP_GROUPS)
         truncated = true;
+    const rowsByDomain = new Map();
+    for (const row of rows) {
+        const members = rowsByDomain.get(row.domain) ?? [];
+        members.push(row);
+        rowsByDomain.set(row.domain, members);
+    }
     const groups = output.slice(0, MAX_RELATIONSHIP_GROUPS).map((item) => {
-        if (item.domains.length <= MAX_RELATIONSHIP_DOMAINS)
-            return item;
-        truncated = true;
-        return { ...item, domains: item.domains.slice(0, MAX_RELATIONSHIP_DOMAINS) };
+        const domains = item.domains.slice(0, MAX_RELATIONSHIP_DOMAINS);
+        let groupTruncated = item.domains.length > domains.length || input.length > MAX_RELATIONSHIP_ROWS;
+        if (groupTruncated)
+            truncated = true;
+        const contributors = [];
+        for (const domain of domains)
+            for (const { observation } of rowsByDomain.get(domain) ?? []) {
+                if (!contributesToGroup(observation, item, domain))
+                    continue;
+                const field = ARRAY_RELATIONSHIP_FIELDS[item.type];
+                if (field && Array.isArray(observation[field.field]) && observation[field.field].length > field.maximum)
+                    groupTruncated = true;
+                const projection = Number(observation.version) >= RELATIONSHIP_SOURCE_PROVENANCE_VERSION
+                    ? normalizeRelationshipSourceProjection(observation.sourceEvidence) : {};
+                for (const source of projection[item.type] ?? [unknownRelationshipSource()]) {
+                    if (contributors.length >= MAX_RELATIONSHIP_DOMAINS * MAX_RELATIONSHIP_SOURCES_PER_DOMAIN)
+                        groupTruncated = true;
+                    else
+                        contributors.push({ domain, ...source });
+                }
+            }
+        return { ...item, domains, ...qualifyRelationshipSources(contributors, domains, { truncated: groupTruncated, type: item.type }) };
     });
     return {
         version: RELATIONSHIP_EVIDENCE_VERSION,
         groups,
+        excludedNonPublicAddresses,
         truncated,
         limitations: [
+            ...(excludedNonPublicAddresses ? [`${excludedNonPublicAddresses} non-public address observations were excluded from public-infrastructure grouping; their DNS answers remain in the scan evidence.`] : []),
             'Shared observations are investigation pivots, not proof of common ownership, coordination, intent, or maliciousness.',
             'Certificate relationships use exact native TLS leaf-certificate SHA-256 values only. Certificate Transparency counts and hostnames are never treated as certificate reuse.',
             'A shared certificate can reflect a multi-domain certificate, shared hosting, CDN, or managed platform and does not establish common control.',

package/packages/comparison/relationship-provenance.mjs

@@ -0,0 +1,99 @@
+// Only the source metadata needed to qualify an observed relationship crosses
+// this boundary. Collection and retention times are never source-time fallbacks.
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { canonicalPublicIpAddress } from "../evidence/public-address-policy.mjs";
+import { normalizeExplicitIsoTimestamp, readObservationEnvelope } from "../evidence/observation.mjs";
+export const RELATIONSHIP_TYPES = Object.freeze([
+    'nameserver_set', 'ip_address', 'certificate', 'tracking_identifier', 'favicon', 'official_asset',
+]);
+export const NON_PUBLIC_RELATIONSHIP_LIMITATION = 'This is an equal non-public DNS answer, not evidence of shared public hosting. Private, loopback, reserved and sinkhole-style answers can recur independently.';
+export const FAVICON_RELATIONSHIP_DESCRIPTION = 'Each domain is connected by exact or bounded perceptual favicon matches, directly or through another member. Not every pair necessarily matches.';
+export function isNonPublicAddressRelationship(type, value) {
+    return type === 'ip_address' && !canonicalPublicIpAddress(value);
+}
+const SOURCES = ['dns', 'tls', 'http', 'page_identity', 'favicon', 'registration_or_dns', 'unknown'];
+const SOURCES_BY_TYPE = {
+    nameserver_set: ['dns', 'registration_or_dns'], ip_address: ['dns'], certificate: ['tls'],
+    tracking_identifier: ['http', 'page_identity'], favicon: ['favicon'], official_asset: ['http'],
+};
+const STATUSES = ['success', 'partial', 'not_found', 'skipped', 'error', 'unsupported', 'not_applicable', 'unknown'];
+export const MAX_RELATIONSHIP_SOURCES_PER_DOMAIN = 3;
+export const MAX_RELATIONSHIP_SOURCE_DOMAINS = 50;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+export function unknownRelationshipSource(source = 'unknown') {
+    return { source, status: 'unknown', observedAt: null, complete: false, truncated: null };
+}
+export function relationshipSourceEvidence(source, raw) {
+    const result = readObservationEnvelope(raw);
+    if (result.state !== 'supported' || result.observation.source !== source) {
+        return { ...unknownRelationshipSource(source), status: result.state === 'unsupported' ? 'unsupported' : 'unknown' };
+    }
+    return normalizeSource({ ...result.observation, truncated: record(raw).truncated });
+}
+function normalizeSource(raw, type) {
+    const value = record(raw);
+    const source = SOURCES.find((candidate) => candidate === value.source) ?? 'unknown';
+    if (type && source !== 'unknown' && !SOURCES_BY_TYPE[type].includes(source))
+        return unknownRelationshipSource();
+    const status = STATUSES.find((candidate) => candidate === value.status) ?? 'unknown';
+    const observedAt = normalizeExplicitIsoTimestamp(value.observedAt);
+    const truncated = typeof value.truncated === 'boolean' ? value.truncated : null;
+    return {
+        source, status, observedAt, truncated,
+        complete: source !== 'unknown' && source !== 'registration_or_dns' && status === 'success'
+            && value.complete === true && truncated === false && observedAt !== null,
+    };
+}
+export function normalizeRelationshipSourceProjection(raw) {
+    const value = record(raw);
+    const output = {};
+    for (const type of RELATIONSHIP_TYPES) {
+        if (!Array.isArray(value[type]))
+            continue;
+        const candidates = value[type];
+        output[type] = candidates.slice(0, MAX_RELATIONSHIP_SOURCES_PER_DOMAIN).map((candidate) => {
+            const source = normalizeSource(candidate, type);
+            return candidates.length > MAX_RELATIONSHIP_SOURCES_PER_DOMAIN ? { ...source, complete: false, truncated: true } : source;
+        });
+    }
+    return output;
+}
+/** Missing, malformed or omitted contributors cannot make a group complete. */
+export function qualifyRelationshipSources(raw, rawDomains, options = {}) {
+    const domains = [...new Set(rawDomains.slice(0, MAX_RELATIONSHIP_SOURCE_DOMAINS * 2).map(normalizeDomain).filter(Boolean))].slice(0, MAX_RELATIONSHIP_SOURCE_DOMAINS);
+    const allowed = new Set(domains);
+    const candidates = Array.isArray(raw) ? raw : [];
+    const maximum = MAX_RELATIONSHIP_SOURCE_DOMAINS * MAX_RELATIONSHIP_SOURCES_PER_DOMAIN;
+    const byDomain = new Map();
+    let omitted = options.truncated === true || rawDomains.length > MAX_RELATIONSHIP_SOURCE_DOMAINS || candidates.length > maximum;
+    for (const candidate of candidates.slice(0, maximum)) {
+        const value = record(candidate);
+        const domain = normalizeDomain(value.domain);
+        if (!domain || !allowed.has(domain)) {
+            omitted = true;
+            continue;
+        }
+        const contribution = { domain, ...normalizeSource(value, options.type) };
+        const entries = byDomain.get(domain) ?? new Map();
+        const key = JSON.stringify(contribution);
+        if (!entries.has(key) && entries.size >= MAX_RELATIONSHIP_SOURCES_PER_DOMAIN)
+            omitted = true;
+        else
+            entries.set(key, contribution);
+        byDomain.set(domain, entries);
+    }
+    const sourceEvidence = domains.sort().flatMap((domain) => {
+        const entries = byDomain.get(domain);
+        return entries?.size ? [...entries.values()].sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)))
+            : [{ domain, ...unknownRelationshipSource() }];
+    });
+    const observedAt = sourceEvidence.length && sourceEvidence.every((entry) => entry.observedAt !== null)
+        ? sourceEvidence.map((entry) => entry.observedAt).sort().at(-1) ?? null : null;
+    return {
+        sourceEvidence, observedAt,
+        complete: sourceEvidence.length > 0 && !omitted && sourceEvidence.every((entry) => entry.complete),
+        truncated: omitted || sourceEvidence.some((entry) => entry.truncated === true),
+    };
+}

package/packages/contracts/analyst-interchange.mjs

@@ -0,0 +1,234 @@
+import { defineSchemaCompatibility } from "./schema-compatibility.mjs";
+import { buildExtractedLifecycleFamily } from "./extracted-domain-lifecycle.mjs";
+import { defineSchemaLifecycleFamily } from "./schema-lifecycle.mjs";
+export const ANALYST_INTERCHANGE_CONTRACT_OWNER = 'packages/contracts/analyst-interchange.mts';
+export const INVESTIGATION_CACAO_SPEC_VERSION = 'cacao-2.0';
+export const INVESTIGATION_CACAO_PROFILE_VERSION = 3;
+export const INVESTIGATION_CACAO_PROFILE_SEMVER = '3.0.0';
+export const INVESTIGATION_CACAO_SUPPORTED_PROFILE_VERSIONS = [2, INVESTIGATION_CACAO_PROFILE_VERSION];
+export const MAX_INVESTIGATION_CACAO_IMPORT_BYTES = 384 * 1024;
+export const BRAND_PROTECTION_OPERATIONS_REPORT_SCHEMA = 'whoisleuth.brand-protection-operations-report';
+export const BRAND_PROTECTION_OPERATIONS_REPORT_VERSION = 2;
+export const MAX_OPERATIONS_REPORT_BYTES = 64 * 1024;
+export const DEFENSIVE_INDICATOR_LIFECYCLE_SCHEMA = 'whoisleuth.internal.defensive-indicators';
+export const DEFENSIVE_INDICATOR_EXPORT_VERSION = 2;
+export const DEFENSIVE_INDICATOR_MANIFEST_SCHEMA = 'whoisleuth.defensive-indicator-manifest';
+export const DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA = 'whoisleuth.defensive-indicator-rollback';
+export const STIX_INDICATOR_LIFECYCLE_SCHEMA = 'whoisleuth.internal.stix-indicators';
+export const STIX_INDICATOR_EXPORT_VERSION = 2;
+export const MISP_INDICATOR_LIFECYCLE_SCHEMA = 'whoisleuth.internal.misp-indicators';
+export const MISP_INDICATOR_EXPORT_VERSION = 2;
+export const MANAGED_INDICATOR_SET_SCHEMA = 'whoisleuth.managed-indicator-set';
+export const MANAGED_INDICATOR_SET_VERSION = 1;
+export const MAX_MANAGED_INDICATOR_SET_BYTES = 4 * 1024 * 1024;
+export const MAX_MANAGED_INDICATOR_PLAN_BYTES = 16 * 1024 * 1024;
+export const DNS_CHANGE_REHEARSAL_VERSION = 2;
+export const DNS_CHANGE_REHEARSAL_EXPORT_SCHEMA = 'whoisleuth.dns-change-rehearsal';
+export const MAIL_REPORT_SCHEMA = 'whoisleuth.mail-report-review';
+export const MAIL_REPORT_VERSION = 3;
+export const MAIL_REPORT_CANONICALIZATION_ROUTES = Object.freeze([
+    Object.freeze({ version: 2, canonicalization: 'sorted-json-v1', explicit: false }),
+    Object.freeze({ version: MAIL_REPORT_VERSION, canonicalization: 'sorted-json-v2', explicit: true }),
+]);
+export const REGISTRATION_DISCLOSURE_PLAN_SCHEMA = 'whoisleuth.registration-disclosure-plan';
+export const REGISTRATION_DISCLOSURE_PLAN_VERSION = 2;
+export const STATIC_PAGE_PATTERN_PACK_SCHEMA = 'whoisleuth.static-page-pattern-pack';
+export const STATIC_PAGE_PATTERN_PACK_VERSION = 2;
+export const MAX_STATIC_PAGE_PATTERN_PACK_BYTES = 256 * 1024;
+export const WEB_CAPTURE_SUMMARY_SCHEMA = 'whoisleuth.web-capture-summary';
+export const WEB_CAPTURE_SUMMARY_VERSION = 1;
+export const WEB_CAPTURE_MANIFEST_SCHEMA = 'whoisleuth.web-capture-manifest';
+export const WEB_CAPTURE_MANIFEST_VERSION = 3;
+export const WEB_CAPTURE_MANIFEST_SUPPORTED_VERSIONS = [2, WEB_CAPTURE_MANIFEST_VERSION];
+export const MAX_WEB_CAPTURE_MANIFEST_BYTES = 1024 * 1024;
+const CACAO_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.investigation-cacao-profile', kind: 'export', schema: INVESTIGATION_CACAO_SPEC_VERSION,
+    currentVersion: INVESTIGATION_CACAO_PROFILE_VERSION, supportedVersions: INVESTIGATION_CACAO_SUPPORTED_PROFILE_VERSIONS,
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'normalize_to_current',
+    writeSemantics: 'non_destructive_merge', byteBudget: MAX_INVESTIGATION_CACAO_IMPORT_BYTES,
+    owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Restricted CACAO 2.0 manual profile. Version 3 retains optional lesson-revision provenance; public profile 2 remains readable. Executable commands, branches, targets and credentials remain rejected.',
+});
+const OPERATIONS_REPORT_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.brand-protection-operations-report', kind: 'export', schema: BRAND_PROTECTION_OPERATIONS_REPORT_SCHEMA,
+    currentVersion: BRAND_PROTECTION_OPERATIONS_REPORT_VERSION, supportedVersions: [BRAND_PROTECTION_OPERATIONS_REPORT_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: MAX_OPERATIONS_REPORT_BYTES, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Version 2 aggregates typed action and independent-effect events with explicit denominators, omissions, time-window basis, and limitations. It excludes case identities and is not a service level or provider ranking.',
+});
+const DEFENSIVE_INDICATORS_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.defensive-indicators', kind: 'export', schema: null,
+    currentVersion: DEFENSIVE_INDICATOR_EXPORT_VERSION, supportedVersions: [DEFENSIVE_INDICATOR_EXPORT_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Review-only indicator, provenance-manifest, and rollback formats; never submitted or applied automatically.',
+});
+const STIX_INDICATORS_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.stix-indicators', kind: 'export', schema: null,
+    currentVersion: STIX_INDICATOR_EXPORT_VERSION, supportedVersions: [1, STIX_INDICATOR_EXPORT_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'STIX 2.1 bundle with observations separated from heuristic indicators. Version 2 uses a Note when observation time is unknown; Indicator validity starts at creation, not at a substituted sighting time.',
+});
+const MISP_INDICATORS_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.misp-indicators', kind: 'export', schema: null,
+    currentVersion: MISP_INDICATOR_EXPORT_VERSION, supportedVersions: [1, MISP_INDICATOR_EXPORT_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Unpublished, non-IDS, non-correlating event for reviewed import. Version 2 omits optional seen times when the source observation time is unknown.',
+});
+export const MANAGED_INDICATOR_SET_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.managed-indicator-set', kind: 'export', schema: MANAGED_INDICATOR_SET_SCHEMA,
+    currentVersion: MANAGED_INDICATOR_SET_VERSION, supportedVersions: [MANAGED_INDICATOR_SET_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'exact_current_only',
+    writeSemantics: 'read_only', byteBudget: MAX_MANAGED_INDICATOR_SET_BYTES, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'File-backed managed indicator revisions retain original observations, stable identities, explicit renewals and permanent withdrawals. Known predecessors prevent history replacement; content digests do not authenticate authorship or an unavailable earlier chain.',
+});
+const WEB_CAPTURE_SUMMARY_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.web-capture-summary', kind: 'export', schema: WEB_CAPTURE_SUMMARY_SCHEMA,
+    currentVersion: WEB_CAPTURE_SUMMARY_VERSION, supportedVersions: [WEB_CAPTURE_SUMMARY_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'exact_current_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Sanitised metadata-only capture summary accepted through the bounded external-finding preview.',
+});
+const WEB_CAPTURE_MANIFEST_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.web-capture-manifest', kind: 'export', schema: WEB_CAPTURE_MANIFEST_SCHEMA,
+    currentVersion: WEB_CAPTURE_MANIFEST_VERSION, supportedVersions: WEB_CAPTURE_MANIFEST_SUPPORTED_VERSIONS,
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: MAX_WEB_CAPTURE_MANIFEST_BYTES,
+    owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Metadata-only capture manifest. Version 3 adds bounded page and dependency observations; version 2 remains readable with those observations unavailable.',
+});
+const DEFENSIVE_MANIFEST_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.defensive-indicator-manifest', kind: 'export', schema: DEFENSIVE_INDICATOR_MANIFEST_SCHEMA,
+    currentVersion: DEFENSIVE_INDICATOR_EXPORT_VERSION, supportedVersions: [DEFENSIVE_INDICATOR_EXPORT_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Output-only manifest for explicitly selected defensive indicators; historical version 1 is not claimed without a retained reader.',
+});
+const DEFENSIVE_ROLLBACK_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.defensive-indicator-rollback', kind: 'export', schema: DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA,
+    currentVersion: DEFENSIVE_INDICATOR_EXPORT_VERSION, supportedVersions: [DEFENSIVE_INDICATOR_EXPORT_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Output-only rollback companion for the same bounded defensive-indicator selection.',
+});
+const DNS_REHEARSAL_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.dns-change-rehearsal', kind: 'export', schema: DNS_CHANGE_REHEARSAL_EXPORT_SCHEMA,
+    currentVersion: DNS_CHANGE_REHEARSAL_VERSION, supportedVersions: [DNS_CHANGE_REHEARSAL_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Output-only DNS change rehearsal document; version 2 is the only producer contract represented by this tree.',
+});
+const MAIL_REPORT_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.mail-report-review', kind: 'export', schema: MAIL_REPORT_SCHEMA,
+    currentVersion: MAIL_REPORT_VERSION, supportedVersions: [1, 2, MAIL_REPORT_VERSION], acceptsUnversionedLegacy: false,
+    futureVersionBehavior: 'not_applicable', migration: 'read_only', writeSemantics: 'read_only', byteBudget: null,
+    owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Output-only aggregate mail review: v3 declares sorted-json-v2 integrity; v2 retains its undeclared v1 digest. Admission coverage is separate from pagination. Historical v1 has no reader; input and output byte bounds differ.',
+});
+const REGISTRATION_DISCLOSURE_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.registration-disclosure-plan', kind: 'export', schema: REGISTRATION_DISCLOSURE_PLAN_SCHEMA,
+    currentVersion: REGISTRATION_DISCLOSURE_PLAN_VERSION, supportedVersions: [REGISTRATION_DISCLOSURE_PLAN_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'not_applicable', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Output-only bounded registration-disclosure planning document; version 2 is the only current producer contract.',
+});
+const STATIC_PATTERN_PACK_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.static-page-pattern-pack', kind: 'export', schema: STATIC_PAGE_PATTERN_PACK_SCHEMA,
+    currentVersion: STATIC_PAGE_PATTERN_PACK_VERSION, supportedVersions: [STATIC_PAGE_PATTERN_PACK_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'exact_current_only',
+    writeSemantics: 'non_destructive_merge', byteBudget: MAX_STATIC_PAGE_PATTERN_PACK_BYTES,
+    owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    note: 'Exact-current bounded page-pattern pack imported by explicit analyst action and merged without executing code or starting collection.',
+});
+export function serialiseAnalystInterchangeJson(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+const F = 'test/fixtures/extracted-domain-lifecycle/';
+export const ANALYST_INTERCHANGE_LIFECYCLE_FAMILY = defineSchemaLifecycleFamily(buildExtractedLifecycleFamily({
+    id: 'analyst-interchange', owner: ANALYST_INTERCHANGE_CONTRACT_OWNER,
+    serializerExportName: 'serialiseAnalystInterchangeJson', plane: 'shared', projection: 'browser_export',
+    retention: 'operator_controlled_output',
+    includedCategories: ['reviewed-indicators', 'source-identity', 'provenance', 'completeness', 'omitted-counts', 'limitations'],
+    excludedCategories: ['credentials', 'cookies', 'message-content', 'raw-upstream-responses', 'expanded-contacts'],
+    formats: [
+        { descriptor: MANAGED_INDICATOR_SET_COMPATIBILITY, lifecycleSchema: MANAGED_INDICATOR_SET_SCHEMA,
+            requiredKeys: ['schema', 'version', 'id', 'producerId', 'revisionId', 'name', 'revision', 'createdAt', 'modifiedAt', 'previous', 'entries', 'integrity'], optionalKeys: [],
+            hook: { module: 'packages/interchange/managed-indicator-set.mts', exportName: 'validateManagedIndicatorSet', role: 'structure_validator', runtime: 'shared' },
+            fixtures: [{ id: 'managed-indicator-set-v1', path: `${F}managed-indicator-set-v1.json`, bytes: 1_193, sha256: '3a4ffb7256e696d1f1b3bae14743bb8c03ddeb0922186868e935f5a489ba3985', version: MANAGED_INDICATOR_SET_VERSION }] },
+        { descriptor: CACAO_COMPATIBILITY, lifecycleSchema: INVESTIGATION_CACAO_SPEC_VERSION,
+            requiredKeys: ['type', 'spec_version', 'id', 'name', 'created', 'modified', 'workflow_start', 'workflow', 'extension_definitions'],
+            optionalKeys: ['description', 'playbook_types', 'playbook_activities', 'created_by', 'playbook_extensions', 'agent_definitions', 'x_whoisleuth_profile_version'],
+            hook: { module: 'packages/interchange/investigation-playbook-interchange.mts', exportName: 'parseCacaoInvestigationPlaybook', role: 'normaliser', runtime: 'shared' },
+            fixtures: [
+                { id: 'investigation-cacao-profile-v2', path: `${F}investigation-cacao-profile-v2.json`, bytes: 4_091, sha256: '7e9a3de6e12b83477690c0c58e03e6efbbb8b0c11fd98dc8470bdb6784d42358', version: 2 },
+                { id: 'investigation-cacao-profile-v3', path: `${F}investigation-cacao-profile-v3.json`, bytes: 4_067, sha256: '608cbb7875c3448ca11f6f8cb2f96ae098e18316532a8f651bbe540ca7f25a2d', version: INVESTIGATION_CACAO_PROFILE_VERSION },
+            ] },
+        { descriptor: OPERATIONS_REPORT_COMPATIBILITY, lifecycleSchema: BRAND_PROTECTION_OPERATIONS_REPORT_SCHEMA,
+            requiredKeys: ['schema', 'version', 'generatedAt', 'window', 'limitations'], optionalKeys: ['sourceState', 'summary', 'counts', 'states', 'actionTypes', 'durations', 'denominators', 'omissions'],
+            hook: { module: 'packages/interchange/brand-protection-operations-report.mts', exportName: 'serializeBrandProtectionOperationsReport', role: 'builder', runtime: 'shared' },
+            fixtures: [
+                { id: 'brand-protection-operations-report-v2', path: `${F}brand-protection-operations-report-v2.json`, bytes: 187, sha256: 'd38bf9b2c5cfc9c83df267ff2303ea2c3cdb398dd12c6607fbedb265b880a324', version: BRAND_PROTECTION_OPERATIONS_REPORT_VERSION },
+            ] },
+        { descriptor: DEFENSIVE_INDICATORS_COMPATIBILITY, lifecycleSchema: DEFENSIVE_INDICATOR_LIFECYCLE_SCHEMA,
+            requiredKeys: ['version', 'format'], optionalKeys: ['generatedAt', 'expiresAt', 'domains', 'entries', 'indicators', 'exclusions', 'explicitSelection', 'includeWildcards', 'truncated', 'filename', 'manifestFilename', 'rollbackFilename', 'mimeType', 'content', 'manifestContent', 'rollbackContent', 'limitations'],
+            hook: { module: 'packages/interchange/defensive-indicator-export.mts', exportName: 'buildDefensiveIndicatorExport', role: 'builder', runtime: 'shared' },
+            fixtures: [
+                { id: 'defensive-indicators-v2', path: `${F}defensive-indicators-v2.json`, bytes: 66, sha256: '597794782fbb2291acbcd854ced48bb2b8142f175fd9dd8ab99d53dd5532701e', version: DEFENSIVE_INDICATOR_EXPORT_VERSION },
+            ] },
+        { descriptor: STIX_INDICATORS_COMPATIBILITY, lifecycleSchema: STIX_INDICATOR_LIFECYCLE_SCHEMA,
+            requiredKeys: ['type', 'id', 'objects'], optionalKeys: ['x_whoisleuth_export_version'],
+            hook: { module: 'packages/interchange/stix-indicator-export.mts', exportName: 'buildStixIndicatorExport', role: 'builder', runtime: 'shared' },
+            fixtures: [
+                { id: 'stix-indicators-v1', path: `${F}stix-indicators-v1.json`, bytes: 115, sha256: '517fe4aec65bbdb5252945d5f0f0a393c5c72a2eb8f48a1c8147ae5c6e681f8e', version: 1 },
+                { id: 'stix-indicators-v2', path: `${F}stix-indicators-v2.json`, bytes: 5302, sha256: '09b3e53413944efbad81458b0042cc76e4d64f0895d5c1c2dbace3d52af0a6a4', version: STIX_INDICATOR_EXPORT_VERSION },
+            ] },
+        { descriptor: MISP_INDICATORS_COMPATIBILITY, lifecycleSchema: MISP_INDICATOR_LIFECYCLE_SCHEMA,
+            requiredKeys: ['Event'], optionalKeys: [],
+            hook: { module: 'packages/interchange/misp-indicator-export.mts', exportName: 'buildMispIndicatorExport', role: 'builder', runtime: 'shared' },
+            fixtures: [
+                { id: 'misp-indicators-v1', path: `${F}misp-indicators-v1.json`, bytes: 167, sha256: '043102cfb145ead16f6eba9b4ebe723aed12cc02f5899c918a0d172674e74997', version: 1 },
+                { id: 'misp-indicators-v2', path: `${F}misp-indicators-v2.json`, bytes: 1611, sha256: '9bcf624c2bcc6da9e1299ef470b288ca2f2da51c65665f0729f332c513a3d558', version: MISP_INDICATOR_EXPORT_VERSION },
+            ] },
+        { descriptor: WEB_CAPTURE_SUMMARY_COMPATIBILITY, lifecycleSchema: WEB_CAPTURE_SUMMARY_SCHEMA,
+            requiredKeys: ['schema', 'schemaVersion', 'source', 'captures'], optionalKeys: [],
+            hook: { module: 'packages/interchange/web-capture-import.mts', exportName: 'parseWebCaptureSummary', role: 'normaliser', runtime: 'shared' },
+            fixtures: [{ id: 'web-capture-summary-v1', path: `${F}web-capture-summary-v1.json`, bytes: 341, sha256: '70fba8a784f61f473ba6cde71a7d9dd915cfca46fbb3469e3bb57767adf973d9', version: WEB_CAPTURE_SUMMARY_VERSION }] },
+        { descriptor: WEB_CAPTURE_MANIFEST_COMPATIBILITY, lifecycleSchema: WEB_CAPTURE_MANIFEST_SCHEMA,
+            requiredKeys: ['schema', 'schemaVersion', 'source', 'captures'], optionalKeys: [],
+            hook: { module: 'packages/interchange/web-capture-import.mts', exportName: 'parseWebCaptureManifest', role: 'normaliser', runtime: 'shared' },
+            fixtures: [
+                { id: 'web-capture-manifest-v2', path: `${F}web-capture-manifest-v2.json`, bytes: 494, sha256: 'a2208dc956a832d70e37cd9a5929db81d29148856c485e4fd6ce5b123de5b8e6', version: 2 },
+                { id: 'web-capture-manifest-v3', path: `${F}web-capture-manifest-v3.json`, bytes: 868, sha256: 'bca4e8cb539ac6035dd44586fa7e27774766a14dadbc4fc73cad2b71dace2ac8', version: WEB_CAPTURE_MANIFEST_VERSION },
+            ] },
+        { descriptor: DEFENSIVE_MANIFEST_COMPATIBILITY, lifecycleSchema: DEFENSIVE_INDICATOR_MANIFEST_SCHEMA,
+            requiredKeys: ['schema', 'version', 'generatedAt'], optionalKeys: ['expiresAt', 'reviewRequired', 'explicitSelection', 'includeWildcards', 'entries', 'indicators', 'exclusions', 'limitations'],
+            hook: { module: 'packages/interchange/defensive-indicator-export.mts', exportName: 'buildDefensiveIndicatorExport', role: 'builder', runtime: 'shared' },
+            fixtures: [{ id: 'defensive-indicator-manifest-v2', path: `${F}defensive-indicator-manifest-v2.json`, bytes: 139, sha256: '8a2475b1be1810bcc10b6285630e7056986f961320c884fd8cfc72951eb79db7', version: DEFENSIVE_INDICATOR_EXPORT_VERSION }] },
+        { descriptor: DEFENSIVE_ROLLBACK_COMPATIBILITY, lifecycleSchema: DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA,
+            requiredKeys: ['schema', 'version', 'generatedAt'], optionalKeys: ['removes', 'indicators', 'limitations'],
+            hook: { module: 'packages/interchange/defensive-indicator-export.mts', exportName: 'buildDefensiveIndicatorExport', role: 'builder', runtime: 'shared' },
+            fixtures: [{ id: 'defensive-indicator-rollback-v2', path: `${F}defensive-indicator-rollback-v2.json`, bytes: 139, sha256: '1af3d32d3e808327fadc39066256d441abb5957d1ae696b834a61a37658103e6', version: DEFENSIVE_INDICATOR_EXPORT_VERSION }] },
+        { descriptor: DNS_REHEARSAL_COMPATIBILITY, lifecycleSchema: DNS_CHANGE_REHEARSAL_EXPORT_SCHEMA,
+            requiredKeys: ['schema', 'version', 'generatedAt'], optionalKeys: ['domain', 'changes', 'findings', 'limitations'],
+            hook: { module: 'packages/interchange/dns-change-rehearsal.mts', exportName: 'buildDnsChangeRehearsalExport', role: 'builder', runtime: 'shared' },
+            fixtures: [{ id: 'dns-change-rehearsal-v2', path: `${F}dns-change-rehearsal-v2.json`, bytes: 169, sha256: '31b2e5d8d3774356362c4f5fc1741506ce7060953b49bb3cd3588adbd3bb96d3', version: DNS_CHANGE_REHEARSAL_VERSION }] },
+        { descriptor: MAIL_REPORT_COMPATIBILITY, lifecycleSchema: MAIL_REPORT_SCHEMA,
+            requiredKeys: ['schema', 'version', 'generatedAt'], optionalKeys: ['source', 'summary', 'findings', 'limitations', 'reports', 'profileScope', 'integrity'],
+            hook: { module: 'packages/interchange/mail-report-workbench.mts', exportName: 'buildMailReportReview', role: 'builder', runtime: 'shared' },
+            fixtures: [
+                { id: 'mail-report-review-v1', path: `${F}mail-report-review-v1.json`, bytes: 152, sha256: '804ffda72784ee2f0b34985f47f78075238841b4fbcc484b971efcd17f2b0c17', version: 1 },
+                { id: 'mail-report-review-v2', path: `${F}mail-report-review-v2.json`, bytes: 2188, sha256: '42bb3b3a05605b0ffdda3f369a52e0490dcf1541405f2db9cee900ddf0477d97', version: 2 },
+                { id: 'mail-report-review-v3', path: `${F}mail-report-review-v3.json`, bytes: 1627, sha256: '32d71697a08eae70cc070b981953cb18829efee139283f6163edecd126614048', version: MAIL_REPORT_VERSION },
+            ] },
+        { descriptor: REGISTRATION_DISCLOSURE_COMPATIBILITY, lifecycleSchema: REGISTRATION_DISCLOSURE_PLAN_SCHEMA,
+            requiredKeys: ['schema', 'version', 'generatedAt'], optionalKeys: ['domain', 'requests', 'limitations'],
+            hook: { module: 'packages/interchange/registration-disclosure-plan.mts', exportName: 'buildRegistrationDisclosurePlan', role: 'builder', runtime: 'shared' },
+            fixtures: [{ id: 'registration-disclosure-plan-v2', path: `${F}registration-disclosure-plan-v2.json`, bytes: 164, sha256: '74e516dc369a2c62fc5794134512bff8ec251faa85b30e78172f670b58db9037', version: REGISTRATION_DISCLOSURE_PLAN_VERSION }] },
+        { descriptor: STATIC_PATTERN_PACK_COMPATIBILITY, lifecycleSchema: STATIC_PAGE_PATTERN_PACK_SCHEMA,
+            requiredKeys: ['schema', 'version', 'id', 'label', 'description', 'evidenceBoundary', 'relationship', 'confidence', 'rules'], optionalKeys: [],
+            hook: { module: 'packages/interchange/static-page-pattern-packs.mts', exportName: 'validateStaticPagePatternPack', role: 'structure_validator', runtime: 'shared' },
+            fixtures: [{ id: 'static-page-pattern-pack-v2', path: `${F}static-page-pattern-pack-v2.json`, bytes: 1_094, sha256: 'c409e527850bcb924f5be0708a58c5e2c32d98947c42150f6a79765991c0eb6f', version: STATIC_PAGE_PATTERN_PACK_VERSION }] },
+    ],
+}));

package/packages/contracts/analyst-review-state-contract.mjs

@@ -53,6 +53,17 @@ export const ANALYST_REVIEW_EVIDENCE_FAMILIES = Object.freeze([
     'packet',
 ]);
 export const ANALYST_REVIEW_DISPOSITIONS = Object.freeze(['open', 'expected', 'suppressed', 'resolved']);
+export const ANALYST_REVIEW_PRIORITIES = ['urgent', 'high', 'normal'];
+export const ANALYST_REVIEW_AGES = ['current', 'aging', 'stale', 'unknown'];
+export const ANALYST_REVIEW_NEXT_ACTIONS = ['review', 'refresh', 'follow_up', 'resume'];
+export const ANALYST_REVIEW_LIFECYCLE_STATES = ['open', 'expected', 'suppressed', 'resolved', 'expired', 'invalidated', 'recurred', 'orphaned'];
+export const ANALYST_REVIEW_QUEUE_OPTIONS = [
+    { value: 'needs_action', label: 'Needs action' },
+    { value: 'waiting', label: 'Waiting / follow-up' },
+    { value: 'changed', label: 'Changed since review' },
+    { value: 'reviewed', label: 'Reviewed' },
+    { value: 'all', label: 'Everything' },
+];
 export const ANALYST_REVIEW_DISPOSITION_OPTIONS = Object.freeze([
     { value: 'open', label: 'Open' },
     { value: 'expected', label: 'Expected' },

package/packages/contracts/analyst-review-state.mjs

@@ -1,5 +1,5 @@
 import { defineSchemaCompatibility } from "./schema-compatibility.mjs";
-import { buildExtractedLifecycleFamilyV2 } from "./extracted-domain-lifecycle.mjs";
+import { buildExtractedLifecycleFamily } from "./extracted-domain-lifecycle.mjs";
 import { defineSchemaLifecycleFamily } from "./schema-lifecycle.mjs";
 import { ANALYST_REVIEW_STATE_SCHEMA, ANALYST_REVIEW_STATE_SCHEMA_VERSION, ANALYST_REVIEW_STATE_SUPPORTED_VERSIONS, MAX_ANALYST_REVIEW_STATE_BYTES, } from "./analyst-review-state-contract.mjs";
 export * from "./analyst-review-state-contract.mjs";
@@ -18,14 +18,15 @@ export const ANALYST_REVIEW_STATE_COMPATIBILITY = defineSchemaCompatibility({
     owner: ANALYST_REVIEW_STATE_CONTRACT_OWNER,
     note: 'Bounded analyst-authored lifecycle overlay. Material evidence changes, expiry, and incomplete evidence reopen review without rewriting source evidence or losing earlier rationale.',
 });
-export const ANALYST_REVIEW_STATE_LIFECYCLE_FAMILY = defineSchemaLifecycleFamily(buildExtractedLifecycleFamilyV2({
+export const ANALYST_REVIEW_STATE_LIFECYCLE_FAMILY = defineSchemaLifecycleFamily(buildExtractedLifecycleFamily({
     id: 'analyst-review-state',
     owner: ANALYST_REVIEW_STATE_CONTRACT_OWNER,
     serializerModule: 'packages/monitoring/analyst-review-state.mts',
     serializerExportName: 'serialiseAnalystReviewStateJson',
     plane: 'browser',
-    projection: 'browser_export',
-    retention: 'operator_controlled_output',
+    projection: 'browser_import',
+    retention: 'browser_indexeddb',
+    notePolicy: 'allowed_bounded',
     includedCategories: ['subject-identity', 'material-fingerprint', 'analyst-disposition', 'rationale', 'review-times', 'case-and-campaign-references'],
     excludedCategories: ['raw-upstream-responses', 'expanded-contacts', 'complete-query-urls', 'credentials', 'cookies', 'certificate-transparency-history'],
     formats: [{