@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/packages/contracts/lookup-evidence.mjs

@@ -6,11 +6,12 @@ export const REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION = 28;
 export const LATEST_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION = REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION;
 export const HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION = 29;
 export const PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION = PUBLISHED_V2_LOOKUP_EVIDENCE_SCHEMA_VERSION;
-export const LOOKUP_EVIDENCE_SCHEMA_VERSION = HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION;
+export const LOOKUP_EVIDENCE_SCHEMA_VERSION = 30;
 export const SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS = Object.freeze([
     V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION,
     PUBLISHED_V2_LOOKUP_EVIDENCE_SCHEMA_VERSION,
     LATEST_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION,
+    HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION,
     LOOKUP_EVIDENCE_SCHEMA_VERSION,
 ]);
 export const LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES = 5 * 1024 * 1024;
@@ -31,5 +32,5 @@ export const LOOKUP_EVIDENCE_COMPATIBILITY = defineSchemaCompatibility({
     writeSemantics: 'read_only',
     byteBudget: LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES,
     owner: 'packages/contracts/lookup-evidence.mts',
-    note: 'Exact published versions 26, 27 and 28 remain replayable with their original collection scope. Version 29 identifies the hostname used for supporting DNS, TLS and web observations; registration authority remains separate.',
+    note: 'Published versions 26–29 retain their original collection scope. Version 30 adds attributed password-form destinations; older page-wide flags are not form ownership evidence. Registration authority remains separate.',
 });

package/packages/contracts/mail-authentication.mjs

@@ -0,0 +1,5 @@
+export const MAX_AUTHENTICATION_HEADERS = 512;
+export const MAX_AUTHENTICATION_CLAUSES = 64;
+export const MAX_AUTHENTICATION_VALUE_LENGTH = 16 * 1024;
+export const MAIL_AUTHENTICATION_METHODS = Object.freeze(['spf', 'dkim', 'dmarc', 'arc']);
+export const MAIL_AUTHENTICATION_PROPERTIES = ['smtp.mailfrom', 'smtp.helo', 'header.d', 'header.i', 'header.from'];

package/packages/contracts/message-intake.mjs

@@ -0,0 +1,37 @@
+export const MESSAGE_INTAKE_SCHEMA = 'whoisleuth.message-intake';
+export const MESSAGE_INTAKE_VERSION = 2;
+export const MESSAGE_INTAKE_LEGACY_VERSION = 1;
+export const MESSAGE_INTAKE_KINDS = ['text', 'email', 'calendar', 'qr', 'pdf', 'docx', 'har', 'identity'];
+export const MESSAGE_INTAKE_INPUTS = {
+    text: { label: 'Pasted text or links', accept: '.txt,text/plain', binary: false },
+    email: { label: 'Email (.eml, including nested messages)', accept: '.eml,message/rfc822', binary: false },
+    calendar: { label: 'Calendar invitation (.ics)', accept: '.ics,text/calendar', binary: false },
+    qr: { label: 'QR image (still PNG)', accept: '.png,image/png', binary: true },
+    pdf: { label: 'PDF document', accept: '.pdf,application/pdf', binary: true },
+    docx: { label: 'Word document (.docx)', accept: '.docx,application/vnd.openxmlformats-officedocument.wordprocessingml.document', binary: true },
+    har: { label: 'HTTP archive (.har)', accept: '.har,application/json', binary: false },
+    identity: { label: 'Identity events (selected JSON)', accept: '.json,application/json', binary: false },
+};
+export const IDENTITY_ACTIONS = [
+    { id: 'opened_link', label: 'Opened the link' },
+    { id: 'entered_password', label: 'Entered a password' },
+    { id: 'approved_signin', label: 'Approved a sign-in or MFA request' },
+    { id: 'granted_consent', label: 'Granted application consent' },
+    { id: 'entered_device_code', label: 'Entered a device code' },
+    { id: 'executed_command', label: 'Ran a command or installed software' },
+];
+// Byte admission, extraction work and decoded pixels are independent bounds.
+export const MAX_MESSAGE_INTAKE_BYTES = 16 * 1024 * 1024;
+export const MAX_MESSAGE_PARTS = 256;
+export const MAX_MESSAGE_DEPTH = 12;
+export const MAX_MESSAGE_HTML_NODES = 50_000;
+export const MAX_INTAKE_LINKS = 512;
+export const MAX_INTAKE_URL_LENGTH = 8_192;
+export const MAX_EMBEDDED_LINK_DEPTH = 8;
+export const MAX_AUTH_SCOPES = 64;
+export const MAX_INTAKE_INDICATORS = 512;
+export const MAX_INTAKE_INDICATOR_CANDIDATES = 4_096;
+export const INTAKE_DISTRIBUTION_CHANNELS = ['email', 'sms', 'messaging', 'social', 'advertisement', 'website', 'document', 'other', 'unknown'];
+export const INTAKE_TEXT_BASES = ['supplied_text', 'manual_transcription', 'ocr_text', 'unknown'];
+export const INTAKE_PHONE_ROLES = ['advertised_support_contact', 'sender_or_caller_id_claim', 'unknown'];
+export const MESSAGE_ACTION_HINTS = ['clipboard_instruction', 'shell_instruction', 'verification_prompt', 'device_code_instruction', 'consent_instruction'];

package/packages/contracts/offline-comparison.mjs

@@ -10,7 +10,10 @@ export const CLI_COMPARISON_LEDGER_SCHEMA = 'whoisleuth.cli.comparison-ledger';
 export const CLI_COMPARISON_LEDGER_VERSION = 1;
 export const MAX_RETAINED_ARTIFACT_DIFF_BYTES = 8 * 1024 * 1024;
 export const RELATIONSHIP_EVIDENCE_SCHEMA = 'whoisleuth.relationship-evidence';
-export const RELATIONSHIP_EVIDENCE_VERSION = 3;
+export const RELATIONSHIP_EVIDENCE_VERSION = 4;
+export const SUPPORTED_RELATIONSHIP_EVIDENCE_VERSIONS = Object.freeze([2, 3, RELATIONSHIP_EVIDENCE_VERSION]);
+export const RELATIONSHIP_SOURCE_PROVENANCE_VERSION = 3;
+export const RELATIONSHIP_PUBLIC_ADDRESS_VERSION = 4;
 export const TLS_RELATIONSHIP_PROFILE_VERSION = 2;
 export const SUPPORTED_TLS_RELATIONSHIP_PROFILE_VERSIONS = Object.freeze([TLS_RELATIONSHIP_PROFILE_VERSION]);
 export const OFFLINE_COMPARISON_COMPATIBILITY_FACADES = Object.freeze([

package/packages/contracts/passive-mail.mjs

@@ -0,0 +1,10 @@
+/** Stable interchange identities describe DNS publication, not message authentication. */
+export const PASSIVE_MAIL_LABELS = Object.freeze({
+    authenticated_mail: 'MX, SPF and DMARC observed',
+    evidence_incomplete: 'Mail DNS evidence incomplete',
+    mail_auth_gap: 'MX observed; SPF or DMARC absent',
+    mail_auth_incomplete: 'MX observed; policy evidence incomplete',
+    no_explicit_mx: 'No explicit MX observed',
+    null_mx: 'Null MX observed',
+});
+export const PASSIVE_MAIL_INTERPRETATION = 'The retained authenticated_mail state means MX, SPF and DMARC publications were observed; it does not establish policy validity, alignment, message authentication or delivery.';

package/packages/contracts/risk-calibration.mjs

@@ -1,8 +1,8 @@
 import { defineSchemaCompatibility } from "./schema-compatibility.mjs";
 import { defineSchemaLifecycleFamily } from "./schema-lifecycle.mjs";
 export const RISK_CALIBRATION_DATASET_SCHEMA = 'whoisleuth.risk-calibration-dataset';
-export const RISK_CALIBRATION_DATASET_VERSION = 2;
-export const SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS = Object.freeze([RISK_CALIBRATION_DATASET_VERSION]);
+export const RISK_CALIBRATION_DATASET_VERSION = 3;
+export const SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS = Object.freeze([2, RISK_CALIBRATION_DATASET_VERSION]);
 export const RISK_CALIBRATION_REPORT_SCHEMA = 'whoisleuth.cli.risk-calibration';
 export const RISK_CALIBRATION_REPORT_VERSION = 3;
 export const SUPPORTED_RISK_CALIBRATION_REPORT_VERSIONS = Object.freeze([RISK_CALIBRATION_REPORT_VERSION]);
@@ -82,7 +82,7 @@ export const RISK_CALIBRATION_EVIDENCE_OPTIONAL_KEYS = Object.freeze([
     'activityStatus', 'mutationTypes', 'domainAgeDays', 'faviconMatch',
     'faviconNearMatch', 'reusesOfficialAssets', 'hasPasswordField', 'hasMx',
     'hasSpf', 'hasDmarc', 'privacyProtected', 'phishingLanguageMatch',
-    'hasExternalFormAction', 'idnReferenceMatch', 'pageBaselineMatch',
+    'hasExternalFormAction', 'hasExternalPasswordForm', 'idnReferenceMatch', 'pageBaselineMatch',
     'hasActiveBrandProfile', 'scanDepth', 'observedAt', 'threatIntelligence',
 ]);
 export const RISK_CALIBRATION_THREAT_INTELLIGENCE_KEYS = Object.freeze([
@@ -179,7 +179,7 @@ export const RISK_CALIBRATION_DATASET_COMPATIBILITY = defineSchemaCompatibility(
     writeSemantics: 'read_only',
     byteBudget: MAX_RISK_CALIBRATION_INPUT_BYTES,
     owner: 'packages/contracts/risk-calibration.mts',
-    note: 'Offline labelled fixture input; version 2 adds bounded review context without live collection.',
+    note: 'Offline labelled fixture input. Version 2 retains bounded review context; version 3 adds explicit form attribution. Historical records remain readable without manufacturing missing associations.',
 });
 export const RISK_CALIBRATION_REPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'cli.risk-calibration-report',
@@ -292,22 +292,22 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
         RISK_CALIBRATION_REPORT_COMPATIBILITY,
     ],
     contracts: [
-        {
+        ...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS.map((version) => ({
             compatibilityId: RISK_CALIBRATION_DATASET_COMPATIBILITY.id,
             schema: RISK_CALIBRATION_DATASET_SCHEMA,
-            version: RISK_CALIBRATION_DATASET_VERSION,
+            version,
             role: 'document',
-            lifecycle: 'current',
+            lifecycle: version === RISK_CALIBRATION_DATASET_VERSION ? 'current' : 'legacy',
             readable: true,
-            emitted: true,
+            emitted: version === RISK_CALIBRATION_DATASET_VERSION,
             exactKeys: false,
             extensionPolicy: 'discard_bounded',
             futureVersionBehaviour: 'reject',
             migrationTarget: null,
             canonicalisation: null,
             byteBudget: MAX_RISK_CALIBRATION_INPUT_BYTES,
-            fixtureIds: ['risk-calibration-dataset-v2'],
-        },
+            fixtureIds: [`risk-calibration-dataset-v${version}`],
+        })),
         {
             compatibilityId: RISK_CALIBRATION_REPORT_COMPATIBILITY.id,
             schema: RISK_CALIBRATION_REPORT_SCHEMA,
@@ -329,6 +329,20 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
         },
     ],
     fixtures: [
+        {
+            id: 'risk-calibration-dataset-v3',
+            path: 'test/fixtures/risk-calibration-dataset-v3.json',
+            bytes: 1_096,
+            sha256: 'a8e41c1325094aec5ef4731fdf9f487a20999729f6cc704e400c3d83db2a0753',
+            contentDigestSha256: null,
+            schema: RISK_CALIBRATION_DATASET_SCHEMA,
+            version: 3,
+            role: 'current',
+            expectation: 'accepted_exact',
+            expectedOutputFixtureId: null,
+            scope: 'repository',
+            shapeId: 'risk-calibration.dataset.v3',
+        },
         {
             id: 'risk-calibration-dataset-v2',
             path: 'test/fixtures/risk-calibration-dataset-v2.json',
@@ -336,8 +350,8 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
             sha256: 'bd650fe84923c61658d451c25d928bd5ff8e54ff585f4f059e6798c681f9a401',
             contentDigestSha256: null,
             schema: RISK_CALIBRATION_DATASET_SCHEMA,
-            version: RISK_CALIBRATION_DATASET_VERSION,
-            role: 'current',
+            version: 2,
+            role: 'historical',
             expectation: 'accepted_exact',
             expectedOutputFixtureId: null,
             scope: 'repository',
@@ -375,11 +389,11 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
     metadata: {
         enforcement: 'declarative_only',
         shapes: [
-            ...[RISK_CALIBRATION_DATASET_VERSION].map((version) => ({
+            ...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS.map((version) => ({
                 id: `risk-calibration.dataset.v${version}`,
                 schema: RISK_CALIBRATION_DATASET_SCHEMA,
                 versions: [version],
-                objects: DATASET_SHAPE_OBJECTS,
+                objects: version === 2 ? DATASET_SHAPE_OBJECTS.map(object => ({ ...object, optionalKeys: object.optionalKeys.filter(key => key !== 'hasExternalPasswordForm') })) : DATASET_SHAPE_OBJECTS,
                 fixedArrays: [],
                 normalisation: 'project_known_fields',
                 target: null,
@@ -609,7 +623,7 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 operation: 'build-dataset-download',
                 acceptedContracts: [],
                 emittedContract: { schema: RISK_CALIBRATION_DATASET_SCHEMA, version: RISK_CALIBRATION_DATASET_VERSION, discriminator: null },
-                shapeIds: ['risk-calibration.dataset.v2'],
+                shapeIds: [`risk-calibration.dataset.v${RISK_CALIBRATION_DATASET_VERSION}`],
                 boundProfileIds: ['risk-calibration.dataset-bounds.v2'],
                 hookIds: ['risk-calibration.browser.build-dataset', 'risk-calibration.browser.serialise-dataset'],
                 serialisationProfileId: 'risk-calibration.dataset-json.v2',
@@ -624,9 +638,9 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'risk-calibration.cli-detailed-json-stdout',
                 plane: 'cli',
                 operation: 'build-detailed-json-stdout',
-                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [RISK_CALIBRATION_DATASET_VERSION], mode: 'direct', discriminator: null }],
+                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS], mode: 'direct', discriminator: null }],
                 emittedContract: { schema: RISK_CALIBRATION_REPORT_SCHEMA, version: RISK_CALIBRATION_REPORT_VERSION, discriminator: { path: '$.mode', value: 'detailed' } },
-                shapeIds: ['risk-calibration.dataset.v2', 'risk-calibration.report.v3-detailed'],
+                shapeIds: [...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS.map(version => `risk-calibration.dataset.v${version}`), 'risk-calibration.report.v3-detailed'],
                 boundProfileIds: ['risk-calibration.dataset-bounds.v2', 'risk-calibration.report-detailed.v3', 'risk-calibration.report-detailed-json-output.v3'],
                 hookIds: ['risk-calibration.cli.parse-dataset', 'risk-calibration.cli.build-detailed', 'risk-calibration.cli.serialise-report'],
                 serialisationProfileId: 'risk-calibration.report-json.v3',
@@ -641,9 +655,9 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'risk-calibration.cli-dataset-read',
                 plane: 'cli',
                 operation: 'read-dataset',
-                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [RISK_CALIBRATION_DATASET_VERSION], mode: 'direct', discriminator: null }],
+                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS], mode: 'direct', discriminator: null }],
                 emittedContract: null,
-                shapeIds: ['risk-calibration.dataset.v2'],
+                shapeIds: SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS.map(version => `risk-calibration.dataset.v${version}`),
                 boundProfileIds: ['risk-calibration.dataset-bounds.v2'],
                 hookIds: ['risk-calibration.cli.parse-dataset'],
                 serialisationProfileId: null,
@@ -658,9 +672,9 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'risk-calibration.cli-detailed-terminal-stdout',
                 plane: 'cli',
                 operation: 'build-detailed-terminal-stdout',
-                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [RISK_CALIBRATION_DATASET_VERSION], mode: 'direct', discriminator: null }],
+                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS], mode: 'direct', discriminator: null }],
                 emittedContract: { schema: RISK_CALIBRATION_REPORT_SCHEMA, version: RISK_CALIBRATION_REPORT_VERSION, discriminator: { path: '$.mode', value: 'detailed' } },
-                shapeIds: ['risk-calibration.dataset.v2', 'risk-calibration.report.v3-detailed'],
+                shapeIds: [...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS.map(version => `risk-calibration.dataset.v${version}`), 'risk-calibration.report.v3-detailed'],
                 boundProfileIds: ['risk-calibration.dataset-bounds.v2', 'risk-calibration.report-detailed.v3'],
                 hookIds: ['risk-calibration.cli.parse-dataset', 'risk-calibration.cli.build-detailed', 'risk-calibration.cli.format-terminal'],
                 serialisationProfileId: null,
@@ -675,9 +689,9 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'risk-calibration.cli-summary-json-stdout',
                 plane: 'cli',
                 operation: 'build-summary-json-stdout',
-                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [RISK_CALIBRATION_DATASET_VERSION], mode: 'direct', discriminator: null }],
+                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS], mode: 'direct', discriminator: null }],
                 emittedContract: { schema: RISK_CALIBRATION_REPORT_SCHEMA, version: RISK_CALIBRATION_REPORT_VERSION, discriminator: { path: '$.mode', value: 'summary' } },
-                shapeIds: ['risk-calibration.dataset.v2', 'risk-calibration.report.v3-summary'],
+                shapeIds: [...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS.map(version => `risk-calibration.dataset.v${version}`), 'risk-calibration.report.v3-summary'],
                 boundProfileIds: ['risk-calibration.dataset-bounds.v2', 'risk-calibration.report-summary-output.v3'],
                 hookIds: ['risk-calibration.cli.parse-dataset', 'risk-calibration.cli.build-detailed', 'risk-calibration.shared.build-summary', 'risk-calibration.cli.serialise-report'],
                 serialisationProfileId: 'risk-calibration.report-json.v3',
@@ -692,9 +706,9 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'risk-calibration.cli-detailed-json-file',
                 plane: 'cli',
                 operation: 'build-detailed-json-file',
-                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [RISK_CALIBRATION_DATASET_VERSION], mode: 'direct', discriminator: null }],
+                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS], mode: 'direct', discriminator: null }],
                 emittedContract: { schema: RISK_CALIBRATION_REPORT_SCHEMA, version: RISK_CALIBRATION_REPORT_VERSION, discriminator: { path: '$.mode', value: 'detailed' } },
-                shapeIds: ['risk-calibration.dataset.v2', 'risk-calibration.report.v3-detailed'],
+                shapeIds: [...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS.map(version => `risk-calibration.dataset.v${version}`), 'risk-calibration.report.v3-detailed'],
                 boundProfileIds: ['risk-calibration.dataset-bounds.v2', 'risk-calibration.report-detailed.v3', 'risk-calibration.report-detailed-json-output.v3', 'risk-calibration.cli-private-output.v1'],
                 hookIds: ['risk-calibration.cli.parse-dataset', 'risk-calibration.cli.build-detailed', 'risk-calibration.cli.serialise-report', 'risk-calibration.cli.write-private-file'],
                 serialisationProfileId: 'risk-calibration.report-json.v3',
@@ -709,9 +723,9 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'risk-calibration.cli-detailed-terminal-file',
                 plane: 'cli',
                 operation: 'build-detailed-terminal-file',
-                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [RISK_CALIBRATION_DATASET_VERSION], mode: 'direct', discriminator: null }],
+                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS], mode: 'direct', discriminator: null }],
                 emittedContract: { schema: RISK_CALIBRATION_REPORT_SCHEMA, version: RISK_CALIBRATION_REPORT_VERSION, discriminator: { path: '$.mode', value: 'detailed' } },
-                shapeIds: ['risk-calibration.dataset.v2', 'risk-calibration.report.v3-detailed'],
+                shapeIds: [...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS.map(version => `risk-calibration.dataset.v${version}`), 'risk-calibration.report.v3-detailed'],
                 boundProfileIds: ['risk-calibration.dataset-bounds.v2', 'risk-calibration.report-detailed.v3', 'risk-calibration.cli-private-output.v1'],
                 hookIds: ['risk-calibration.cli.parse-dataset', 'risk-calibration.cli.build-detailed', 'risk-calibration.cli.format-terminal', 'risk-calibration.cli.write-private-file'],
                 serialisationProfileId: null,
@@ -726,9 +740,9 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
                 id: 'risk-calibration.cli-summary-json-file',
                 plane: 'cli',
                 operation: 'build-summary-json-file',
-                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [RISK_CALIBRATION_DATASET_VERSION], mode: 'direct', discriminator: null }],
+                acceptedContracts: [{ schema: RISK_CALIBRATION_DATASET_SCHEMA, versions: [...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS], mode: 'direct', discriminator: null }],
                 emittedContract: { schema: RISK_CALIBRATION_REPORT_SCHEMA, version: RISK_CALIBRATION_REPORT_VERSION, discriminator: { path: '$.mode', value: 'summary' } },
-                shapeIds: ['risk-calibration.dataset.v2', 'risk-calibration.report.v3-summary'],
+                shapeIds: [...SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS.map(version => `risk-calibration.dataset.v${version}`), 'risk-calibration.report.v3-summary'],
                 boundProfileIds: ['risk-calibration.dataset-bounds.v2', 'risk-calibration.report-summary-output.v3', 'risk-calibration.cli-private-output.v1'],
                 hookIds: ['risk-calibration.cli.parse-dataset', 'risk-calibration.cli.build-detailed', 'risk-calibration.shared.build-summary', 'risk-calibration.cli.serialise-report', 'risk-calibration.cli.write-private-file'],
                 serialisationProfileId: 'risk-calibration.report-json.v3',
@@ -1176,6 +1190,7 @@ const DATASET_EVIDENCE_SPEC = objectOf([
     { key: 'privacyProtected', value: BOOLEAN_SPEC, optional: true },
     { key: 'phishingLanguageMatch', value: boundedText(MAX_RISK_CALIBRATION_STRING_LENGTH), optional: true },
     { key: 'hasExternalFormAction', value: BOOLEAN_SPEC, optional: true },
+    { key: 'hasExternalPasswordForm', value: BOOLEAN_SPEC, optional: true },
     { key: 'idnReferenceMatch', value: BOOLEAN_SPEC, optional: true },
     { key: 'pageBaselineMatch', value: BOOLEAN_SPEC, optional: true },
     { key: 'hasActiveBrandProfile', value: BOOLEAN_SPEC, optional: true },

package/packages/contracts/schema-lifecycle.mjs

@@ -640,11 +640,12 @@ function copyHook(value, index, budget) {
 }
 function copySerialisationProfile(value, index, budget) {
     const label = `Schema lifecycle serialisation profile ${index + 1}`;
-    const source = ordinaryRecord(value, SERIALISATION_PROFILE_KEYS, label, budget);
+    const source = ordinaryRecord(value, SERIALISATION_PROFILE_KEYS, label, budget, ['compactFallback']);
     if (source.mediaType !== 'application/json'
         || source.encoding !== 'utf-8'
         || source.bom !== false
         || (source.indentSpaces !== 0 && source.indentSpaces !== 2)
+        || (source.compactFallback !== undefined && (source.compactFallback !== true || source.indentSpaces !== 2))
         || typeof source.terminalLf !== 'boolean'
         || (source.propertyOrder !== 'normalised_fixed' && source.propertyOrder !== 'source_insertion')
         || (source.integrity !== 'none'
@@ -664,6 +665,7 @@ function copySerialisationProfile(value, index, budget) {
         encoding: 'utf-8',
         bom: false,
         indentSpaces: source.indentSpaces,
+        ...(source.compactFallback === true ? { compactFallback: true } : {}),
         terminalLf: source.terminalLf,
         propertyOrder: source.propertyOrder,
         canonicalisation: source.canonicalisation === null

package/packages/contracts/web-capture.mjs

@@ -1,8 +1,8 @@
-export { MAX_WEB_CAPTURE_MANIFEST_BYTES, WEB_CAPTURE_MANIFEST_SCHEMA, WEB_CAPTURE_MANIFEST_VERSION, WEB_CAPTURE_SUMMARY_SCHEMA, WEB_CAPTURE_SUMMARY_VERSION, } from "./analyst-interchange.mjs";
+export { MAX_WEB_CAPTURE_MANIFEST_BYTES, WEB_CAPTURE_MANIFEST_SCHEMA, WEB_CAPTURE_MANIFEST_VERSION, WEB_CAPTURE_MANIFEST_SUPPORTED_VERSIONS, WEB_CAPTURE_SUMMARY_SCHEMA, WEB_CAPTURE_SUMMARY_VERSION, } from "./analyst-interchange.mjs";
 export const WEB_CAPTURE_DOM_DIGEST_SCHEMA = 'whoisleuth.dom-digest';
 export const WEB_CAPTURE_DOM_DIGEST_VERSION = 1;
 export const WEB_CAPTURE_COMPARISON_SCHEMA = 'whoisleuth.web-capture-comparison';
-export const WEB_CAPTURE_COMPARISON_VERSION = 3;
+export const WEB_CAPTURE_COMPARISON_VERSION = 5;
 export const MAX_WEB_CAPTURE_DOM_DIGEST_BYTES = 1024 * 1024;
 export const MAX_WEB_CAPTURE_SCREENSHOT_BYTES = 10 * 1024 * 1024;
 export const MAX_WEB_CAPTURE_DOM_ELEMENTS = 20_000;