@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/packages/contracts/domain-control-monitor.mjs

@@ -2,8 +2,13 @@ import { defineSchemaCompatibility } from "./schema-compatibility.mjs";
 import { defineSchemaLifecycleFamily } from "./schema-lifecycle.mjs";
 export const CLI_DOMAIN_CONTROL_MONITOR_SCHEMA = 'whoisleuth.cli.domain-control-monitor';
 export const PUBLIC_CLI_DOMAIN_CONTROL_MONITOR_VERSION = 1;
-export const CLI_DOMAIN_CONTROL_MONITOR_VERSION = 2;
-export const SUPPORTED_CLI_DOMAIN_CONTROL_MONITOR_VERSIONS = [PUBLIC_CLI_DOMAIN_CONTROL_MONITOR_VERSION, CLI_DOMAIN_CONTROL_MONITOR_VERSION];
+export const CLI_DOMAIN_CONTROL_MONITOR_VERSION = 3;
+export const SUPPORTED_CLI_DOMAIN_CONTROL_MONITOR_VERSIONS = [PUBLIC_CLI_DOMAIN_CONTROL_MONITOR_VERSION, 2, CLI_DOMAIN_CONTROL_MONITOR_VERSION];
+export const DOMAIN_CONTROL_MONITOR_EMBEDDED_VERSIONS = Object.freeze({
+    1: Object.freeze({ review: 1, flightRecorder: 1 }),
+    2: Object.freeze({ review: 2, flightRecorder: 2 }),
+    3: Object.freeze({ review: 3, flightRecorder: 3 }),
+});
 export const MAX_DOMAIN_CONTROL_MONITOR_INPUT_BYTES = 16 * 1024 * 1024;
 export const MAX_DOMAIN_CONTROL_MONITOR_JSON_DEPTH = 48;
 export const MAX_DOMAIN_CONTROL_MONITOR_JSON_KEYS = 50_000;
@@ -100,6 +105,12 @@ export const DOMAIN_CONTROL_MONITOR_SCHEMA_LIFECYCLE = defineSchemaLifecycleFami
         {
             id: 'domain-control-monitor-v2', path: 'test/fixtures/domain-control-monitor-v2.json',
             bytes: 18_023, sha256: 'f4017f3dc84b3adb6b6114ea49c37ff05939779daabbbb56c868010145cac55c',
+            contentDigestSha256: null, schema: CLI_DOMAIN_CONTROL_MONITOR_SCHEMA, version: 2,
+            role: 'historical', expectation: 'accepted_exact', expectedOutputFixtureId: null, scope: 'repository',
+        },
+        {
+            id: 'domain-control-monitor-v3', path: 'test/fixtures/domain-control-monitor-v3.json',
+            bytes: 19_215, sha256: 'a7233a0b52b282e3ad8097b9bd71bf15125b743e60a421cfec765cb8b9456563',
             contentDigestSha256: null, schema: CLI_DOMAIN_CONTROL_MONITOR_SCHEMA, version: CLI_DOMAIN_CONTROL_MONITOR_VERSION,
             role: 'current', expectation: 'accepted_exact', expectedOutputFixtureId: null, scope: 'repository',
         },

package/packages/contracts/domain-control-review.mjs

@@ -10,10 +10,10 @@ export const CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA = 'whoisleuth.cli.domain-con
 export const CLI_DOMAIN_CONTROL_REVIEW_SCHEMA = 'whoisleuth.cli.domain-control-review';
 export const PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION = 1;
 export const PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION = 1;
-export const DOMAIN_CONTROL_REVIEW_VERSION = 2;
-export const CLI_DOMAIN_CONTROL_REVIEW_VERSION = 2;
-export const SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS = [PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION, DOMAIN_CONTROL_REVIEW_VERSION];
-export const SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS = [PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION, CLI_DOMAIN_CONTROL_REVIEW_VERSION];
+export const DOMAIN_CONTROL_REVIEW_VERSION = 3;
+export const CLI_DOMAIN_CONTROL_REVIEW_VERSION = 3;
+export const SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS = [PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION, 2, DOMAIN_CONTROL_REVIEW_VERSION];
+export const SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS = [PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION, 2, CLI_DOMAIN_CONTROL_REVIEW_VERSION];
 export const DOMAIN_CONTROL_REVIEW_OBSERVATION_FACTOR = 2;
 export const MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS = MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES
     * DOMAIN_CONTROL_REVIEW_OBSERVATION_FACTOR;
@@ -87,7 +87,8 @@ export const PUBLIC_DOMAIN_CONTROL_REVIEW_COUNT_KEYS = Object.freeze([
     'not_configured',
     'due',
 ]);
-export const DOMAIN_CONTROL_REVIEW_COUNT_KEYS = Object.freeze([...PUBLIC_DOMAIN_CONTROL_REVIEW_COUNT_KEYS, 'observed']);
+export const DOMAIN_CONTROL_REVIEW_V2_COUNT_KEYS = Object.freeze([...PUBLIC_DOMAIN_CONTROL_REVIEW_COUNT_KEYS, 'observed']);
+export const DOMAIN_CONTROL_REVIEW_COUNT_KEYS = Object.freeze([...DOMAIN_CONTROL_REVIEW_V2_COUNT_KEYS, 'not_due']);
 export const DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS = Object.freeze([
     'domain',
     'state',
@@ -108,11 +109,21 @@ export const PUBLIC_DOMAIN_CONTROL_REVIEW_LIMITATIONS = Object.freeze([
     'Only complete observations can produce drift. Partial, unavailable, unsupported, or missing evidence remains inconclusive.',
     'A valid manifest digest or signature establishes file integrity, not the correctness of the desired state or supplied observations.',
 ]);
-export const DOMAIN_CONTROL_REVIEW_LIMITATIONS = Object.freeze([
+export const DOMAIN_CONTROL_REVIEW_V2_LIMITATIONS = Object.freeze([
     PUBLIC_DOMAIN_CONTROL_REVIEW_LIMITATIONS[0],
     'Only complete observations with valid source times within the current review-age window can establish alignment, drift or expected absence. Observation-only fields do not establish alignment.',
     PUBLIC_DOMAIN_CONTROL_REVIEW_LIMITATIONS[2],
 ]);
+export const DOMAIN_CONTROL_REVIEW_LIMITATIONS = Object.freeze([
+    ...DOMAIN_CONTROL_REVIEW_V2_LIMITATIONS,
+    'Renewal dates are analyst-authored reminders, not observations of configuration.',
+]);
+export function domainControlReviewCountKeys(version) {
+    return version === 1 ? PUBLIC_DOMAIN_CONTROL_REVIEW_COUNT_KEYS : version === 2 ? DOMAIN_CONTROL_REVIEW_V2_COUNT_KEYS : DOMAIN_CONTROL_REVIEW_COUNT_KEYS;
+}
+export function domainControlReviewLimitations(version) {
+    return version === 1 ? PUBLIC_DOMAIN_CONTROL_REVIEW_LIMITATIONS : version === 2 ? DOMAIN_CONTROL_REVIEW_V2_LIMITATIONS : DOMAIN_CONTROL_REVIEW_LIMITATIONS;
+}
 export const CLI_DOMAIN_CONTROL_REVIEW_INPUT_KEYS = Object.freeze([
     'schema',
     'version',
@@ -233,11 +244,11 @@ const CORE_REVIEW_SHAPES = SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS.flatMap((ver
         objects: [
             { path: '$', requiredKeys: DOMAIN_CONTROL_REVIEW_ROOT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
             { path: '$.manifest', requiredKeys: DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS, optionalKeys: [], unknownKeys: 'reject' },
-            { path: '$.counts', requiredKeys: version === PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION ? PUBLIC_DOMAIN_CONTROL_REVIEW_COUNT_KEYS : DOMAIN_CONTROL_REVIEW_COUNT_KEYS, optionalKeys: [], unknownKeys: 'reject' },
+            { path: '$.counts', requiredKeys: domainControlReviewCountKeys(version), optionalKeys: [], unknownKeys: 'reject' },
             { path: '$.domains[]', requiredKeys: DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS, optionalKeys: [], unknownKeys: 'reject' },
             { path: '$.domains[].comparisons[]', requiredKeys: version === PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION ? PUBLIC_DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS : DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, optionalKeys: [], unknownKeys: 'reject' },
         ],
-        fixedArrays: [{ path: '$.limitations', values: version === PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION ? PUBLIC_DOMAIN_CONTROL_REVIEW_LIMITATIONS : DOMAIN_CONTROL_REVIEW_LIMITATIONS }],
+        fixedArrays: [{ path: '$.limitations', values: domainControlReviewLimitations(version) }],
         normalisation: 'preserve_document',
         target: null,
     },
@@ -253,6 +264,10 @@ function reviewFixtureShapeId(schema, version) {
     return `domain-control-review.${cli ? 'cli-' : ''}${schema.endsWith('-input') ? 'input' : 'document'}.v${version}`;
 }
 const CURRENT_REVIEW_FIXTURE_CONTENT = {
+    "domain-control-review-input-v3": { "bytes": 1879, "sha256": "747cccb9a0610dd5b77ebd2a01f44dc7bd6a929b09b6e52037596427d0c2275b" },
+    "domain-control-review-v3": { "bytes": 4496, "sha256": "736926cf402ca868ddc832c229b88d3c91b44a4c73563c356633a69c1ec8d06c" },
+    "cli-domain-control-review-input-v3": { "bytes": 4123, "sha256": "0283efe6f78551a8aa5a9449a608fb4f3b46b39a9f11f6ffe93244979b16d30b" },
+    "cli-domain-control-review-v3": { "bytes": 9194, "sha256": "31c263f17cd663be74ab9801970a8800894da4023842137e41f602fde633452e" },
     "domain-control-review-input-v2": {
         "bytes": 1879,
         "sha256": "ac3b5913a44c47bd179cd69e4a8bf4268f10e9f01dd7f59c7d722a8c0d241ad1"
@@ -408,13 +423,19 @@ export const DOMAIN_CONTROL_REVIEW_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamil
             scope: 'repository',
         },
     ].flatMap((fixture) => {
-        const version = fixture.schema.startsWith('whoisleuth.cli.') ? CLI_DOMAIN_CONTROL_REVIEW_VERSION : DOMAIN_CONTROL_REVIEW_VERSION;
-        const id = fixture.id.replace(/v\d+$/u, `v${version}`);
-        const content = CURRENT_REVIEW_FIXTURE_CONTENT[id];
-        return [
-            { ...fixture, shapeId: reviewFixtureShapeId(fixture.schema, fixture.version), role: fixture.role === 'input' ? 'input' : 'historical', expectation: fixture.schema === CLI_DOMAIN_CONTROL_REVIEW_SCHEMA ? 'historical_output_exact' : 'accepted_exact', expectedOutputFixtureId: null },
-            { ...fixture, ...content, id, path: `test/fixtures/${id}.json`, version, shapeId: reviewFixtureShapeId(fixture.schema, version), role: fixture.role, expectation: fixture.expectation, expectedOutputFixtureId: fixture.expectedOutputFixtureId?.replace(/v\d+$/u, `v${version}`) ?? null },
-        ];
+        const currentVersion = fixture.schema.startsWith('whoisleuth.cli.') ? CLI_DOMAIN_CONTROL_REVIEW_VERSION : DOMAIN_CONTROL_REVIEW_VERSION;
+        const versions = fixture.schema.startsWith('whoisleuth.cli.') ? SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS : SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS;
+        return versions.map((version) => {
+            const id = fixture.id.replace(/v\d+$/u, `v${version}`);
+            const current = version === currentVersion;
+            return {
+                ...fixture, ...(version === 1 ? {} : CURRENT_REVIEW_FIXTURE_CONTENT[id]), id,
+                path: `test/fixtures/${id}.json`, version, shapeId: reviewFixtureShapeId(fixture.schema, version),
+                role: fixture.role === 'input' ? 'input' : current ? 'current' : 'historical',
+                expectation: current ? fixture.expectation : fixture.schema === CLI_DOMAIN_CONTROL_REVIEW_SCHEMA ? 'historical_output_exact' : 'accepted_exact',
+                expectedOutputFixtureId: current ? fixture.expectedOutputFixtureId?.replace(/v\d+$/u, `v${version}`) ?? null : null,
+            };
+        });
     }),
     metadata: {
         enforcement: 'declarative_only',

package/packages/contracts/har-review.mjs

@@ -0,0 +1,2 @@
+export const MAX_HAR_ENTRIES = 10_000;
+export const HAR_TIMING_PHASES = ['blocked', 'dns', 'connect', 'ssl', 'send', 'wait', 'receive'];

package/packages/contracts/identity-events.mjs

@@ -0,0 +1,4 @@
+/** Selected account telemetry, never a provider connection or an identity verdict. */
+export const IDENTITY_EVENTS_INPUT_SCHEMA = 'whoisleuth.identity-events.input';
+export const IDENTITY_EVENTS_INPUT_VERSION = 1;
+export const MAX_IDENTITY_EVENTS = 10_000;

package/packages/contracts/investigation-run.mjs

@@ -1,5 +1,7 @@
 export const CLI_INVESTIGATION_RUN_SCHEMA = 'whoisleuth.cli.investigation-run';
 export const CLI_INVESTIGATION_RUN_VERSION = 3;
+export const CLI_INVESTIGATION_PREVIEW_SCHEMA = 'whoisleuth.cli.investigation-preview';
+export const CLI_INVESTIGATION_PREVIEW_VERSION = 1;
 export const SUPPORTED_CLI_INVESTIGATION_RUN_VERSIONS = Object.freeze([1, 2, 3]);
 export const MAX_INVESTIGATION_RUN_BYTES = 24 * 1024 * 1024;
 export const MAX_INVESTIGATION_RUN_SELECTIONS = 16;

package/packages/contracts/ip-address.mjs

@@ -1,3 +1,13 @@
+/** Syntactic identity only: private and reserved addresses remain valid evidence. */
+export function canonicalIpAddress(value) {
+    const candidate = typeof value === 'string' ? value.trim() : value;
+    const parsed = addressValue(candidate);
+    if (!parsed)
+        return null;
+    if (parsed.family === 4)
+        return [24, 16, 8, 0].map(shift => (parsed.value >>> shift) & 255).join('.');
+    return new URL(`https://[${candidate}]/`).hostname.slice(1, -1);
+}
 export function ipv6Groups(value) {
     const address = addressValue(value);
     if (address?.family !== 6)

package/packages/contracts/mail-authentication.mjs

@@ -0,0 +1,5 @@
+export const MAX_AUTHENTICATION_HEADERS = 512;
+export const MAX_AUTHENTICATION_CLAUSES = 64;
+export const MAX_AUTHENTICATION_VALUE_LENGTH = 16 * 1024;
+export const MAIL_AUTHENTICATION_METHODS = Object.freeze(['spf', 'dkim', 'dmarc', 'arc']);
+export const MAIL_AUTHENTICATION_PROPERTIES = ['smtp.mailfrom', 'smtp.helo', 'header.d', 'header.i', 'header.from'];

package/packages/contracts/message-intake.mjs

@@ -0,0 +1,31 @@
+export const MESSAGE_INTAKE_SCHEMA = 'whoisleuth.message-intake';
+export const MESSAGE_INTAKE_VERSION = 1;
+export const MESSAGE_INTAKE_KINDS = ['text', 'email', 'calendar', 'qr', 'pdf', 'docx', 'har', 'identity'];
+export const MESSAGE_INTAKE_INPUTS = {
+    text: { label: 'Pasted text or links', accept: '.txt,text/plain', binary: false },
+    email: { label: 'Email (.eml, including nested messages)', accept: '.eml,message/rfc822', binary: false },
+    calendar: { label: 'Calendar invitation (.ics)', accept: '.ics,text/calendar', binary: false },
+    qr: { label: 'QR image (still PNG)', accept: '.png,image/png', binary: true },
+    pdf: { label: 'PDF document', accept: '.pdf,application/pdf', binary: true },
+    docx: { label: 'Word document (.docx)', accept: '.docx,application/vnd.openxmlformats-officedocument.wordprocessingml.document', binary: true },
+    har: { label: 'HTTP archive (.har)', accept: '.har,application/json', binary: false },
+    identity: { label: 'Identity events (selected JSON)', accept: '.json,application/json', binary: false },
+};
+export const IDENTITY_ACTIONS = [
+    { id: 'opened_link', label: 'Opened the link' },
+    { id: 'entered_password', label: 'Entered a password' },
+    { id: 'approved_signin', label: 'Approved a sign-in or MFA request' },
+    { id: 'granted_consent', label: 'Granted application consent' },
+    { id: 'entered_device_code', label: 'Entered a device code' },
+    { id: 'executed_command', label: 'Ran a command or installed software' },
+];
+// Byte admission, extraction work and decoded pixels are independent bounds.
+export const MAX_MESSAGE_INTAKE_BYTES = 16 * 1024 * 1024;
+export const MAX_MESSAGE_PARTS = 256;
+export const MAX_MESSAGE_DEPTH = 12;
+export const MAX_MESSAGE_HTML_NODES = 50_000;
+export const MAX_INTAKE_LINKS = 512;
+export const MAX_INTAKE_URL_LENGTH = 8_192;
+export const MAX_EMBEDDED_LINK_DEPTH = 8;
+export const MAX_AUTH_SCOPES = 64;
+export const MESSAGE_ACTION_HINTS = ['clipboard_instruction', 'shell_instruction', 'verification_prompt', 'device_code_instruction', 'consent_instruction'];

package/packages/contracts/offline-comparison.mjs

@@ -10,7 +10,10 @@ export const CLI_COMPARISON_LEDGER_SCHEMA = 'whoisleuth.cli.comparison-ledger';
 export const CLI_COMPARISON_LEDGER_VERSION = 1;
 export const MAX_RETAINED_ARTIFACT_DIFF_BYTES = 8 * 1024 * 1024;
 export const RELATIONSHIP_EVIDENCE_SCHEMA = 'whoisleuth.relationship-evidence';
-export const RELATIONSHIP_EVIDENCE_VERSION = 3;
+export const RELATIONSHIP_EVIDENCE_VERSION = 4;
+export const SUPPORTED_RELATIONSHIP_EVIDENCE_VERSIONS = Object.freeze([2, 3, RELATIONSHIP_EVIDENCE_VERSION]);
+export const RELATIONSHIP_SOURCE_PROVENANCE_VERSION = 3;
+export const RELATIONSHIP_PUBLIC_ADDRESS_VERSION = 4;
 export const TLS_RELATIONSHIP_PROFILE_VERSION = 2;
 export const SUPPORTED_TLS_RELATIONSHIP_PROFILE_VERSIONS = Object.freeze([TLS_RELATIONSHIP_PROFILE_VERSION]);
 export const OFFLINE_COMPARISON_COMPATIBILITY_FACADES = Object.freeze([

package/packages/contracts/passive-mail.mjs

@@ -0,0 +1,10 @@
+/** Stable interchange identities describe DNS publication, not message authentication. */
+export const PASSIVE_MAIL_LABELS = Object.freeze({
+    authenticated_mail: 'MX, SPF and DMARC observed',
+    evidence_incomplete: 'Mail DNS evidence incomplete',
+    mail_auth_gap: 'MX observed; SPF or DMARC absent',
+    mail_auth_incomplete: 'MX observed; policy evidence incomplete',
+    no_explicit_mx: 'No explicit MX observed',
+    null_mx: 'Null MX observed',
+});
+export const PASSIVE_MAIL_INTERPRETATION = 'The retained authenticated_mail state means MX, SPF and DMARC publications were observed; it does not establish policy validity, alignment, message authentication or delivery.';

package/packages/contracts/web-capture.mjs

@@ -1,8 +1,8 @@
-export { MAX_WEB_CAPTURE_MANIFEST_BYTES, WEB_CAPTURE_MANIFEST_SCHEMA, WEB_CAPTURE_MANIFEST_VERSION, WEB_CAPTURE_SUMMARY_SCHEMA, WEB_CAPTURE_SUMMARY_VERSION, } from "./analyst-interchange.mjs";
+export { MAX_WEB_CAPTURE_MANIFEST_BYTES, WEB_CAPTURE_MANIFEST_SCHEMA, WEB_CAPTURE_MANIFEST_VERSION, WEB_CAPTURE_MANIFEST_SUPPORTED_VERSIONS, WEB_CAPTURE_SUMMARY_SCHEMA, WEB_CAPTURE_SUMMARY_VERSION, } from "./analyst-interchange.mjs";
 export const WEB_CAPTURE_DOM_DIGEST_SCHEMA = 'whoisleuth.dom-digest';
 export const WEB_CAPTURE_DOM_DIGEST_VERSION = 1;
 export const WEB_CAPTURE_COMPARISON_SCHEMA = 'whoisleuth.web-capture-comparison';
-export const WEB_CAPTURE_COMPARISON_VERSION = 3;
+export const WEB_CAPTURE_COMPARISON_VERSION = 4;
 export const MAX_WEB_CAPTURE_DOM_DIGEST_BYTES = 1024 * 1024;
 export const MAX_WEB_CAPTURE_SCREENSHOT_BYTES = 10 * 1024 * 1024;
 export const MAX_WEB_CAPTURE_DOM_ELEMENTS = 20_000;

package/packages/contracts/workspace-portability.mjs

@@ -47,9 +47,9 @@ export const MAX_CAMPAIGN_IMPORT_BYTES = 2 * 1024 * 1024;
 export const MAX_CAMPAIGN_INPUT_RECORDS = 500;
 export const MAX_CAMPAIGN_STORE_BYTES = 512 * 1024;
 export const WATCHLIST_SCHEMA = 'whoisleuth.watchlists';
-export const WATCHLIST_SCHEMA_VERSION = 2;
-export const WATCHLIST_BROWSER_SUPPORTED_VERSIONS = Object.freeze([WATCHLIST_SCHEMA_VERSION]);
-export const WATCHLIST_EXPORT_SUPPORTED_VERSIONS = Object.freeze([WATCHLIST_SCHEMA_VERSION]);
+export const WATCHLIST_SCHEMA_VERSION = 4;
+export const WATCHLIST_BROWSER_SUPPORTED_VERSIONS = Object.freeze([2, 3, WATCHLIST_SCHEMA_VERSION]);
+export const WATCHLIST_EXPORT_SUPPORTED_VERSIONS = WATCHLIST_BROWSER_SUPPORTED_VERSIONS;
 export const MAX_WATCHLISTS = 100;
 export const MAX_WATCHLIST_INPUTS = MAX_WATCHLISTS * 4;
 export const MAX_WATCHLIST_NAME_LENGTH = 100;
@@ -114,8 +114,8 @@ export const MAX_WEBSITE_SNAPSHOTS_PER_DOMAIN = 12;
 export const MAX_WEBSITE_SNAPSHOT_STORE_BYTES = 512 * 1024;
 export const MAX_WEBSITE_SNAPSHOT_IMPORT_BYTES = 768 * 1024;
 export const BULK_SESSION_SCHEMA = 'whoisleuth.bulk-sessions';
-export const BULK_SESSION_SCHEMA_VERSION = 5;
-export const BULK_SESSION_BROWSER_SUPPORTED_VERSIONS = Object.freeze([4, BULK_SESSION_SCHEMA_VERSION]);
+export const BULK_SESSION_SCHEMA_VERSION = 6;
+export const BULK_SESSION_BROWSER_SUPPORTED_VERSIONS = Object.freeze([4, 5, BULK_SESSION_SCHEMA_VERSION]);
 export const SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS = BULK_SESSION_BROWSER_SUPPORTED_VERSIONS;
 export const MAX_BULK_SESSIONS = 10;
 export const MAX_BULK_SESSION_ROWS = 2_000;
@@ -126,8 +126,8 @@ export const MAX_BULK_SESSION_ARRAY_VALUES = 100;
 export const MAX_BULK_SESSION_SOURCES = 12;
 export const MAX_BULK_PROFILE_CONTEXT_LIMITATION_LENGTH = 300;
 export const INVESTIGATION_TEMPLATE_SCHEMA = 'whoisleuth.investigation-templates';
-export const INVESTIGATION_TEMPLATE_VERSION = 2;
-export const INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS = Object.freeze([INVESTIGATION_TEMPLATE_VERSION]);
+export const INVESTIGATION_TEMPLATE_VERSION = 3;
+export const INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS = Object.freeze([2, INVESTIGATION_TEMPLATE_VERSION]);
 export const MAX_INVESTIGATION_TEMPLATES = 20;
 export const MAX_INVESTIGATION_TEMPLATE_STORE_BYTES = 256 * 1024;
 export const MAX_INVESTIGATION_TEMPLATE_IMPORT_BYTES = 384 * 1024;
@@ -241,9 +241,9 @@ export const CAMPAIGN_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
 export const WATCHLIST_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.watchlists', kind: 'browser_store', schema: null, currentVersion: WATCHLIST_SCHEMA_VERSION,
     supportedVersions: WATCHLIST_BROWSER_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
-    futureVersionBehavior: 'preserve_without_write', migration: 'exact_current_only', writeSemantics: 'normalized_rewrite',
+    futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current', writeSemantics: 'normalized_rewrite',
     byteBudget: MAX_WATCHLIST_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'The unchanged public version 2 envelope is the browser baseline; unversioned maps are outside the compatibility boundary.',
+    note: 'Public version 2 remains readable without inferred collection outcomes. Version 3 retains explicit page and favicon collection quality; unversioned maps are outside the compatibility boundary.',
 });
 export const SHORTLIST_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.shortlist', kind: 'browser_store', schema: null, currentVersion: SHORTLIST_SCHEMA_VERSION,
@@ -285,14 +285,14 @@ export const BULK_SESSION_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     supportedVersions: BULK_SESSION_BROWSER_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current', writeSemantics: 'normalized_rewrite',
     byteBudget: MAX_BULK_SESSION_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Public schema 4 sessions migrate with unknown row and per-source observation times and contributing-source provenance. Schema 5 retains those bounded fields without retaining raw lookup payloads; future versions are preserved without rewrite.',
+    note: 'Public schemas 4 and 5 remain readable with their original observation provenance. Schema 6 retains explicit page and favicon collection quality for saved evidence handoffs; future versions are preserved without rewrite.',
 });
 export const INVESTIGATION_TEMPLATE_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.investigation-templates', kind: 'browser_store', schema: null,
     currentVersion: INVESTIGATION_TEMPLATE_VERSION, supportedVersions: INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS,
-    acceptsUnversionedLegacy: false, futureVersionBehavior: 'preserve_without_write', migration: 'exact_current_only',
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current',
     writeSemantics: 'normalized_rewrite', byteBudget: MAX_INVESTIGATION_TEMPLATE_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Version 2 adds the fixed response-playbook recipe identifiers. Analyst-authored guidance remains bound to allowlisted built-in stages and cannot run code, start collection, submit evidence, or remove mandatory request gates.',
+    note: 'Public version 2 remains readable. Version 3 retains optional lesson-revision provenance without Case identities or note text. Guidance remains bound to built-in stages and cannot execute actions or remove mandatory request gates.',
 });
 export const BULK_REVIEW_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.bulk-review', kind: 'browser_store', schema: null, currentVersion: BULK_REVIEW_SCHEMA_VERSION,
@@ -318,9 +318,9 @@ export const CAMPAIGN_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
 export const WATCHLIST_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.watchlists', kind: 'export', schema: WATCHLIST_SCHEMA, currentVersion: WATCHLIST_SCHEMA_VERSION,
     supportedVersions: WATCHLIST_EXPORT_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
-    futureVersionBehavior: 'reject', migration: 'exact_current_only', writeSemantics: 'non_destructive_merge',
+    futureVersionBehavior: 'reject', migration: 'normalize_to_current', writeSemantics: 'non_destructive_merge',
     byteBudget: MAX_WATCHLIST_IMPORT_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Non-destructive collection merge with current schema required.',
+    note: 'Public version 2 and current version 3 merge non-destructively. Historical records have unknown collection quality; incomplete current checks cannot erase a usable baseline.',
 });
 export const SHORTLIST_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.shortlist', kind: 'export', schema: SHORTLIST_SCHEMA, currentVersion: SHORTLIST_SCHEMA_VERSION,
@@ -355,14 +355,14 @@ export const BULK_SESSION_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     supportedVersions: SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS, acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'reject', migration: 'normalize_to_current', writeSemantics: 'non_destructive_merge',
     byteBudget: MAX_BULK_SESSION_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Public schema 4 sessions migrate directly to schema 5 with unknown historical row and per-source observation times and source provenance. Current exports retain source-qualified relationship evidence and bounded profile context.',
+    note: 'Public schemas 4 and 5 migrate without invented observation times or collection outcomes. Current exports retain source-qualified relationship evidence, bounded profile context and collection quality.',
 });
 export const INVESTIGATION_TEMPLATE_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.investigation-templates', kind: 'export', schema: INVESTIGATION_TEMPLATE_SCHEMA,
     currentVersion: INVESTIGATION_TEMPLATE_VERSION, supportedVersions: INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS,
-    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'exact_current_only',
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'normalize_to_current',
     writeSemantics: 'non_destructive_merge', byteBudget: MAX_INVESTIGATION_TEMPLATE_IMPORT_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'The unchanged public version 2 writer remains the exact bounded analyst-authored guide baseline with allowlisted stage identities and request gates.',
+    note: 'Version 3 exports authored guidance and optional content-hash lesson provenance. Public version 2 remains readable; future versions fail closed.',
 });
 export const BULK_REVIEW_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.bulk-review', kind: 'export', schema: BULK_REVIEW_SCHEMA, currentVersion: BULK_REVIEW_SCHEMA_VERSION,
@@ -649,6 +649,36 @@ const WORKSPACE_LIFECYCLE_DEFINITIONS = Object.freeze([
     },
 ]);
 const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
+    {
+        id: 'workspace.browser.watchlist.v4', path: 'test/fixtures/workspace-lifecycle/browser-watchlist-v4.json',
+        bytes: 76, sha256: '059930ee54d1bc65ac68ef6d3a8ac8cd8e53f682fe9a857512e2b6c57e93d5fe',
+        schema: 'whoisleuth.browser.watchlist-store', version: 4,
+    },
+    {
+        id: 'workspace.portable.watchlist.v4', path: 'test/fixtures/workspace-lifecycle/portable-watchlist-v4.json',
+        bytes: 120, sha256: '496f1ec39add1d3fe080ad8f9f991639cfbbe659ddb1c58932ac6ff563ce32aa',
+        schema: 'whoisleuth.watchlists', version: 4,
+    },
+    {
+        id: 'workspace.browser.watchlist.v3', path: 'test/fixtures/workspace-lifecycle/browser-watchlist-v3.json',
+        bytes: 76, sha256: '740246c1666c332ae907a5b40364e03a4f008484fce7b1c6dce8082a6ac7b654',
+        schema: 'whoisleuth.browser.watchlist-store', version: 3,
+    },
+    {
+        id: 'workspace.portable.watchlist.v3', path: 'test/fixtures/workspace-lifecycle/portable-watchlist-v3.json',
+        bytes: 120, sha256: 'ad07c8a530c369b49192bd3d8dde1b17c58b737da4e3d00a834a64be6aa429bf',
+        schema: 'whoisleuth.watchlists', version: 3,
+    },
+    {
+        id: 'workspace.browser.bulk.v6', path: 'test/fixtures/workspace-lifecycle/browser-bulk-v6.json',
+        bytes: 77, sha256: '811ef0b05415f19dc7bd940a4786d53a6398121cbb7cd060fcd6d21ed562487b',
+        schema: 'whoisleuth.browser.bulk-session-store', version: 6,
+    },
+    {
+        id: 'workspace.portable.bulk.v6', path: 'test/fixtures/workspace-lifecycle/portable-bulk-v6.json',
+        bytes: 338, sha256: 'ec7f6445cf42c013163ea835d5f919213b69978124d6883c1f10d62a0868235f',
+        schema: 'whoisleuth.bulk-sessions', version: 6,
+    },
     {
         "id": "workspace.browser.brand.v6",
         "path": "test/fixtures/workspace-lifecycle/browser-brand-v6.json",
@@ -761,6 +791,14 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "schema": "whoisleuth.browser.investigation-template-store",
         "version": 2
     },
+    {
+        "id": "workspace.browser.template.v3",
+        "path": "test/fixtures/workspace-lifecycle/browser-template-v3.json",
+        "bytes": 88,
+        "sha256": "70a6dfe2c27c75d86c74a9dfe05148c3186be68191002cbea8c18816a64792c9",
+        "schema": "whoisleuth.browser.investigation-template-store",
+        "version": 3
+    },
     {
         "id": "workspace.browser.watchlist.v2",
         "path": "test/fixtures/workspace-lifecycle/browser-watchlist-v2.json",
@@ -889,6 +927,14 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "schema": "whoisleuth.investigation-templates",
         "version": 2
     },
+    {
+        "id": "workspace.portable.template.v3",
+        "path": "test/fixtures/workspace-lifecycle/portable-template-v3.json",
+        "bytes": 471,
+        "sha256": "6b211af44661594337731767cd212beae305d81e03e090a783633eebaa62d03e",
+        "schema": "whoisleuth.investigation-templates",
+        "version": 3
+    },
     {
         "id": "workspace.portable.watchlist.v2",
         "path": "test/fixtures/workspace-lifecycle/portable-watchlist-v2.json",

package/packages/evidence/collection-quality.mjs

@@ -0,0 +1,67 @@
+const STATES = new Set(['complete', 'partial', 'unavailable', 'not_collected', 'unknown']);
+export function isWebCollectionQuality(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return false;
+    const record = value;
+    const keys = Object.keys(record);
+    if (keys.length !== 4 || keys.some(key => !['version', 'page', 'favicon', 'combined'].includes(key)
+        || !Object.hasOwn(Object.getOwnPropertyDescriptor(record, key) ?? {}, 'value')))
+        return false;
+    return record.version === 1
+        && typeof record.page === 'string' && STATES.has(record.page)
+        && typeof record.favicon === 'string' && STATES.has(record.favicon)
+        && typeof record.combined === 'string' && STATES.has(record.combined)
+        && (record.combined !== 'complete' || (record.page === 'complete' && record.favicon === 'complete'));
+}
+export function normalizeWebCollectionQuality(value, depth) {
+    if (value === undefined)
+        return undefined;
+    if (!isWebCollectionQuality(value))
+        throw new TypeError('Unsupported or invalid web collection quality.');
+    if (depth === 'fast')
+        return capturedWebCollectionQuality('not_collected', 'not_collected');
+    return { version: 1, page: value.page, favicon: value.favicon, combined: value.combined };
+}
+export function capturedWebCollectionQuality(page, favicon) {
+    const combined = page === 'complete' && favicon === 'complete' ? 'complete'
+        : page === favicon ? page : 'partial';
+    return { version: 1, page, favicon, combined };
+}
+export function webCollectionQualityForCapture(value, depth) {
+    if (depth !== 'deep')
+        return capturedWebCollectionQuality('not_collected', 'not_collected');
+    return normalizeWebCollectionQuality(value) ?? capturedWebCollectionQuality('unknown', 'unknown');
+}
+const PAGE_FIELDS = new Set(['activityStatus', 'pageTitle', 'hasPasswordField', 'hasExternalFormAction', 'phishingLanguageMatch', 'pageBaselineMatch']);
+const FAVICON_FIELDS = new Set(['faviconHash', 'faviconPHash', 'faviconMatch', 'faviconNearMatch']);
+const COMBINED_FIELDS = new Set(['riskScore', 'riskFactors', 'riskModelVersion', 'opportunityScore', 'opportunityFactors', 'reusesOfficialAssets']);
+/** Missing historical quality never proves that a false/null value was observed. */
+export function webCollectionAllowsComparison(field, quality, depth) {
+    if (PAGE_FIELDS.has(field))
+        return quality?.page === 'complete';
+    if (FAVICON_FIELDS.has(field))
+        return quality?.favicon === 'complete';
+    if (COMBINED_FIELDS.has(field) && depth === 'deep')
+        return quality?.combined === 'complete';
+    return true;
+}
+/** Retain the measured score while qualifying incomplete inputs at presentation. */
+export function webCollectionScoreLimitation(quality, depth) {
+    if (depth === 'unknown')
+        return 'Collection depth is unknown; score is not comparable.';
+    return webCollectionAllowsComparison('riskScore', quality, depth)
+        ? null : 'Incomplete or unknown web collection; score is not comparable.';
+}
+/** An incomplete current attempt cannot erase the last comparable baseline. */
+export function mergeWebCollectionQuality(previous, current) {
+    if (!previous && !current)
+        return undefined;
+    return { version: 1,
+        page: current?.page === 'complete' ? 'complete' : previous?.page ?? current?.page ?? 'unknown',
+        favicon: current?.favicon === 'complete' ? 'complete' : previous?.favicon ?? current?.favicon ?? 'unknown',
+        combined: current?.combined === 'complete' ? 'complete' : previous?.combined ?? current?.combined ?? 'unknown',
+    };
+}

package/packages/evidence/dns-query-outcome.mjs

@@ -0,0 +1,72 @@
+import { MAX_LOOKUP_DNS_RECORDS_PER_TYPE } from "../analysis/lookup-network-evidence-bounds.mjs";
+import { addressValue, canonicalIpAddress } from "../contracts/ip-address.mjs";
+/** Fixed values retained in Observation v1's existing diagnostic detail slot. */
+export const DNS_QUERY_OUTCOMES = Object.freeze({
+    records: { status: 'success', label: 'Records returned' },
+    empty_answer: { status: 'not_found', label: 'No records returned' },
+    no_data: { status: 'not_found', label: 'No data for this record type (NODATA)' },
+    name_not_found: { status: 'not_found', label: 'Name not found by resolver' },
+    timeout: { status: 'error', label: 'DNS query timed out' },
+    server_failure: { status: 'error', label: 'DNS server failed to answer (SERVFAIL)' },
+    refused: { status: 'error', label: 'DNS query refused' },
+    invalid_response: { status: 'error', label: 'DNS answer could not be read completely' },
+    error: { status: 'error', label: 'DNS query failed' },
+    skipped: { status: 'skipped', label: 'Not queried' },
+});
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value : {};
+}
+/** Legacy not_found diagnostics do not identify which negative answer occurred. */
+export function readDnsQueryOutcome(value) {
+    const diagnostic = record(value);
+    const detail = diagnostic.detail;
+    return typeof detail === 'string' && Object.hasOwn(DNS_QUERY_OUTCOMES, detail)
+        && DNS_QUERY_OUTCOMES[detail].status === diagnostic.status
+        ? detail : null;
+}
+export function dnsQueryFailureOutcome(code) {
+    switch (code) {
+        case 'ENODATA': return 'no_data';
+        case 'ENOTFOUND': return 'name_not_found';
+        case 'ETIMEOUT': return 'timeout';
+        case 'ESERVFAIL': return 'server_failure';
+        case 'EREFUSED': return 'refused';
+        case 'EBADRESP': return 'invalid_response';
+        default: return 'error';
+    }
+}
+/** One family, one source state. Unrelated mail/delegation failures cannot erase it. */
+export function dnsAddressFamilyEvidence(dnsValue, family) {
+    const dns = record(dnsValue);
+    const diagnostic = record(record(dns.diagnostics)[family]);
+    const raw = record(dns.records)[family];
+    const candidates = Array.isArray(raw) ? raw.slice(0, MAX_LOOKUP_DNS_RECORDS_PER_TYPE) : [];
+    const addresses = candidates.flatMap(value => {
+        const address = canonicalIpAddress(value);
+        return address && addressValue(address)?.family === (family === 'a' ? 4 : 6) ? [address] : [];
+    });
+    const malformed = raw !== undefined && !Array.isArray(raw)
+        || candidates.length !== addresses.length;
+    const truncated = diagnostic.truncated === true
+        || typeof diagnostic.discarded === 'number' && diagnostic.discarded > 0
+        || Array.isArray(raw) && raw.length > candidates.length;
+    const outcome = readDnsQueryOutcome(diagnostic);
+    const inconsistent = outcome === 'records' && !addresses.length
+        || outcome !== null && outcome !== 'records' && addresses.length > 0;
+    const complete = !malformed && !truncated && !inconsistent && Array.isArray(raw)
+        && outcome !== null && DNS_QUERY_OUTCOMES[outcome].status !== 'error' && outcome !== 'skipped';
+    const state = malformed || inconsistent ? 'error'
+        : truncated ? 'partial'
+            : outcome ? DNS_QUERY_OUTCOMES[outcome].status
+                : diagnostic.status === 'error' ? 'error'
+                    : diagnostic.status === 'skipped' || dns.status === 'skipped' ? 'skipped' : 'unknown';
+    const value = addresses.length ? [...new Set(addresses)].sort().join(' · ')
+        : malformed || inconsistent ? DNS_QUERY_OUTCOMES.invalid_response.label
+            : truncated ? 'DNS answer incomplete'
+                : outcome ? DNS_QUERY_OUTCOMES[outcome].label
+                    : state === 'error' ? DNS_QUERY_OUTCOMES.error.label
+                        : state === 'skipped' ? DNS_QUERY_OUTCOMES.skipped.label
+                            : diagnostic.status === 'not_found' ? 'Negative DNS outcome not recorded' : null;
+    return { outcome, value, state, complete, truncated };
+}

package/packages/evidence/email-recipient.mjs

@@ -0,0 +1,18 @@
+// Single plain recipient admission for manually opened drafts, not delivery validation.
+const SINGLE_ADDRESS = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$/u;
+export function emailRecipient(value) {
+    if (typeof value !== 'string' || value.length > 320 || /[\u0000-\u001f\u007f]/u.test(value))
+        return null;
+    const address = value.trim();
+    return SINGLE_ADDRESS.test(address) ? address : null;
+}
+/** Encode the recipient independently; upstream text never becomes a header. */
+export function recipientMailto(value, headers) {
+    const address = emailRecipient(value);
+    if (!address)
+        return null;
+    const separator = address.indexOf('@');
+    const recipient = `${encodeURIComponent(address.slice(0, separator))}@${encodeURIComponent(address.slice(separator + 1))}`;
+    const query = headers ? `?subject=${encodeURIComponent(headers.subject)}&body=${encodeURIComponent(headers.body)}` : '';
+    return `mailto:${recipient}${query}`;
+}

package/packages/evidence/lookup-target.mjs

@@ -5,6 +5,10 @@ import { MAX_OUTBOUND_HTTP_URL_CHARACTERS } from "../contracts/http-url.mjs";
 export const MAX_LOOKUP_INPUT_CHARACTERS = 2 * 1024 * 1024;
 const URL_SCHEME = /^[a-z][a-z\d+.-]*:\/\//iu;
 const CONTROL = /[\u0000-\u001f\u007f]/u;
+/** Lexical recognition only; protocol, credentials and target admission remain separate. */
+export function hasLookupUrlScheme(value) {
+    return URL_SCHEME.test(value);
+}
 export function validWebObservationMode(value) {
     return value === undefined || value === 'selected_url';
 }
@@ -76,7 +80,7 @@ export function prepareLookupCollectionTarget(value) {
     const raw = value.trim();
     if (!raw)
         throw new TypeError('Enter a domain, IP address or ASN.');
-    const absolute = URL_SCHEME.test(raw);
+    const absolute = hasLookupUrlScheme(raw);
     // An unbracketed IPv6 literal is not a URL with a port. Use the same URL
     // parser to admit its syntax, then leave address safety and ASN bounds to
     // the classifier; malformed colon-separated text must not become a request.

package/packages/evidence/observation.mjs

@@ -106,6 +106,8 @@ const REGISTERED_DIAGNOSTIC_KEYS = [
     'queriedAuthorityCount',
     'redirectCount',
     'referencesExamined',
+    'referenceSignatureTimedOut',
+    'referenceSignatureUnavailable',
     'rejectedRows',
     'relationshipTagsExamined',
     'relationshipUrlsDiscarded',