@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/packages/contracts/workspace-portability.mjs

@@ -7,11 +7,13 @@ export const BRAND_PROFILE_SCHEMA = 'whoisleuth.brand-profiles';
 export const PUBLIC_BRAND_PROFILE_SCHEMA_VERSION = 6;
 // Historical readers retain a fixed published identity when the writer moves.
 export const PUBLISHED_V2_2_BRAND_PROFILE_SCHEMA_VERSION = 7;
-export const BRAND_PROFILE_SCHEMA_VERSION = 9;
+export const BRAND_PROFILE_SCHEMA_VERSION = 11;
 export const BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS = Object.freeze([
     PUBLIC_BRAND_PROFILE_SCHEMA_VERSION,
     PUBLISHED_V2_2_BRAND_PROFILE_SCHEMA_VERSION,
     8,
+    9,
+    10,
     BRAND_PROFILE_SCHEMA_VERSION,
 ]);
 export const SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS = BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS;
@@ -21,6 +23,17 @@ export const MAX_PROFILE_VALUE_INPUTS = MAX_PROFILE_VALUES * 4;
 export const MAX_PROFILE_STORE_BYTES = 4 * 1024 * 1024;
 export const MAX_PROFILE_IMPORT_BYTES = MAX_PROFILE_STORE_BYTES * 8;
 export const MAX_PROFILE_NAME_LENGTH = 100;
+export const MAX_CANDIDATE_OBSERVATIONS = 200;
+export const MAX_CANDIDATE_MATCHES = 20;
+export const MAX_CANDIDATE_SOURCES = 12;
+export const MAX_CANDIDATE_TEXT = 300;
+export const MAX_CANDIDATE_EXCEPTIONS = 200;
+export const MAX_CANDIDATE_EXCEPTION_HISTORY = 8;
+export const MAX_BRAND_KEYWORD_CAMPAIGNS = 20;
+export const MAX_BRAND_KEYWORD_CAMPAIGN_HISTORY = 8;
+export const MAX_BRAND_KEYWORD_TERMS = 20;
+export const MAX_BRAND_KEYWORD_TERM_LENGTH = 80;
+export const MAX_WATCH_CONTEXTS = 20;
 export const MAX_PROFILE_TEXT_LENGTH = 200;
 export const MAX_PROFILE_DOMAIN_LENGTH = 253;
 export const MAX_PROFILE_URL_LENGTH = 2_048;
@@ -47,14 +60,21 @@ export const MAX_CAMPAIGN_IMPORT_BYTES = 2 * 1024 * 1024;
 export const MAX_CAMPAIGN_INPUT_RECORDS = 500;
 export const MAX_CAMPAIGN_STORE_BYTES = 512 * 1024;
 export const WATCHLIST_SCHEMA = 'whoisleuth.watchlists';
-export const WATCHLIST_SCHEMA_VERSION = 2;
-export const WATCHLIST_BROWSER_SUPPORTED_VERSIONS = Object.freeze([WATCHLIST_SCHEMA_VERSION]);
-export const WATCHLIST_EXPORT_SUPPORTED_VERSIONS = Object.freeze([WATCHLIST_SCHEMA_VERSION]);
+export const WATCHLIST_SCHEMA_VERSION = 6;
+export const WATCHLIST_BROWSER_SUPPORTED_VERSIONS = Object.freeze([2, 3, 4, 5, WATCHLIST_SCHEMA_VERSION]);
+export const WATCHLIST_EXPORT_SUPPORTED_VERSIONS = WATCHLIST_BROWSER_SUPPORTED_VERSIONS;
 export const MAX_WATCHLISTS = 100;
 export const MAX_WATCHLIST_INPUTS = MAX_WATCHLISTS * 4;
 export const MAX_WATCHLIST_NAME_LENGTH = 100;
 export const MAX_WATCHLIST_STORE_BYTES = 2 * 1024 * 1024;
 export const MAX_WATCHLIST_IMPORT_BYTES = 2 * 1024 * 1024;
+// Recovery metadata is not new analyst data. Reserve only its exact JSON cost;
+// the store writer still enforces the ordinary budget after subtracting it.
+export const WATCHLIST_RECOVERY_METADATA = Object.freeze({ membershipRecovery: 'legacy_overflow' });
+export const WATCHLIST_RECOVERY_METADATA_BYTES = JSON.stringify(WATCHLIST_RECOVERY_METADATA).length - 1;
+export const MAX_WATCHLIST_READ_BYTES = MAX_WATCHLIST_STORE_BYTES + MAX_WATCHLISTS * WATCHLIST_RECOVERY_METADATA_BYTES;
+// Date.toISOString() produces at most 27 ASCII characters, including extended years.
+export const MAX_WATCHLIST_PORTABLE_BYTES = MAX_WATCHLIST_READ_BYTES + JSON.stringify({ exportedAt: '+999999-12-31T23:59:59.999Z' }).length - 1;
 export const MAX_WATCHLIST_HISTORY_EVENTS = 12;
 export const MAX_WATCHLIST_CHANGES_PER_EVENT = 500;
 export const MAX_WATCHLIST_DOMAINS = 2_000;
@@ -82,9 +102,9 @@ export const MAX_CT_HISTORY_EVER_SEEN_DOMAINS = 1_000;
 export const MAX_CT_HISTORY_QUERY_LENGTH = 200;
 export const MAX_CT_HISTORY_STORE_BYTES = 1024 * 1024;
 export const DETECTION_RULE_SCHEMA = 'whoisleuth.detection-rules';
-export const DETECTION_RULE_SCHEMA_VERSION = 1;
-export const DETECTION_RULE_BROWSER_SUPPORTED_VERSIONS = Object.freeze([DETECTION_RULE_SCHEMA_VERSION]);
-export const DETECTION_RULE_EXPORT_SUPPORTED_VERSIONS = Object.freeze([DETECTION_RULE_SCHEMA_VERSION]);
+export const DETECTION_RULE_SCHEMA_VERSION = 2;
+export const DETECTION_RULE_BROWSER_SUPPORTED_VERSIONS = Object.freeze([1, DETECTION_RULE_SCHEMA_VERSION]);
+export const DETECTION_RULE_EXPORT_SUPPORTED_VERSIONS = DETECTION_RULE_BROWSER_SUPPORTED_VERSIONS;
 export const MAX_DETECTION_RULES = 50;
 export const MAX_RULE_CONDITIONS = 8;
 export const MAX_RULE_INPUT_RECORDS = 250;
@@ -114,8 +134,8 @@ export const MAX_WEBSITE_SNAPSHOTS_PER_DOMAIN = 12;
 export const MAX_WEBSITE_SNAPSHOT_STORE_BYTES = 512 * 1024;
 export const MAX_WEBSITE_SNAPSHOT_IMPORT_BYTES = 768 * 1024;
 export const BULK_SESSION_SCHEMA = 'whoisleuth.bulk-sessions';
-export const BULK_SESSION_SCHEMA_VERSION = 5;
-export const BULK_SESSION_BROWSER_SUPPORTED_VERSIONS = Object.freeze([4, BULK_SESSION_SCHEMA_VERSION]);
+export const BULK_SESSION_SCHEMA_VERSION = 7;
+export const BULK_SESSION_BROWSER_SUPPORTED_VERSIONS = Object.freeze([4, 5, 6, BULK_SESSION_SCHEMA_VERSION]);
 export const SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS = BULK_SESSION_BROWSER_SUPPORTED_VERSIONS;
 export const MAX_BULK_SESSIONS = 10;
 export const MAX_BULK_SESSION_ROWS = 2_000;
@@ -126,8 +146,8 @@ export const MAX_BULK_SESSION_ARRAY_VALUES = 100;
 export const MAX_BULK_SESSION_SOURCES = 12;
 export const MAX_BULK_PROFILE_CONTEXT_LIMITATION_LENGTH = 300;
 export const INVESTIGATION_TEMPLATE_SCHEMA = 'whoisleuth.investigation-templates';
-export const INVESTIGATION_TEMPLATE_VERSION = 2;
-export const INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS = Object.freeze([INVESTIGATION_TEMPLATE_VERSION]);
+export const INVESTIGATION_TEMPLATE_VERSION = 3;
+export const INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS = Object.freeze([2, INVESTIGATION_TEMPLATE_VERSION]);
 export const MAX_INVESTIGATION_TEMPLATES = 20;
 export const MAX_INVESTIGATION_TEMPLATE_STORE_BYTES = 256 * 1024;
 export const MAX_INVESTIGATION_TEMPLATE_IMPORT_BYTES = 384 * 1024;
@@ -180,12 +200,14 @@ export const WORKSPACE_PORTABILITY_IDENTITY_CONSTANTS = Object.freeze([
 export const WORKSPACE_PORTABILITY_BOUND_CONSTANTS = Object.freeze([
     'MAX_PROFILES', 'MAX_PROFILE_VALUES', 'MAX_PROFILE_VALUE_INPUTS', 'MAX_PROFILE_STORE_BYTES', 'MAX_PROFILE_IMPORT_BYTES',
     'MAX_PROFILE_NAME_LENGTH', 'MAX_PROFILE_TEXT_LENGTH', 'MAX_PROFILE_DOMAIN_LENGTH', 'MAX_PROFILE_URL_LENGTH', 'MAX_PROFILE_TLD_LENGTH',
+    'MAX_BRAND_KEYWORD_CAMPAIGNS', 'MAX_BRAND_KEYWORD_CAMPAIGN_HISTORY', 'MAX_BRAND_KEYWORD_TERMS', 'MAX_BRAND_KEYWORD_TERM_LENGTH',
     'MAX_OFFICIAL_CHANNELS', 'MAX_RIGHTS_REFERENCES', 'MAX_DKIM_SELECTOR_LENGTH',
     'MAX_DKIM_SELECTORS', 'MAX_PROTECTION_ATTESTATIONS', 'MAX_DESIRED_POSTURE_BASELINES', 'MAX_DESIRED_POSTURE_RECORDS',
     'MAX_DESIRED_POSTURE_SUPPRESSIONS', 'MAX_DESIRED_POSTURE_OBSERVATIONS', 'MAX_DESIRED_POSTURE_CHANGE_WINDOWS',
     'MAX_CAMPAIGNS', 'MAX_CAMPAIGN_DOMAINS', 'MAX_CAMPAIGN_NAME_LENGTH', 'MAX_CAMPAIGN_DESCRIPTION_LENGTH',
     'MAX_CAMPAIGN_IMPORT_BYTES', 'MAX_CAMPAIGN_INPUT_RECORDS', 'MAX_CAMPAIGN_STORE_BYTES',
     'MAX_WATCHLISTS', 'MAX_WATCHLIST_INPUTS', 'MAX_WATCHLIST_NAME_LENGTH', 'MAX_WATCHLIST_STORE_BYTES', 'MAX_WATCHLIST_IMPORT_BYTES',
+    'MAX_WATCHLIST_READ_BYTES', 'MAX_WATCHLIST_PORTABLE_BYTES',
     'MAX_WATCHLIST_HISTORY_EVENTS', 'MAX_WATCHLIST_CHANGES_PER_EVENT', 'MAX_WATCHLIST_DOMAINS', 'MAX_WATCHLIST_INPUT_RECORDS',
     'MAX_WATCHLIST_NAMESERVERS', 'MAX_WATCHLIST_MUTATION_TYPES', 'MAX_WATCHLIST_HISTORY_DOMAIN_OPTIONS',
     'MAX_SHORTLIST_ENTRIES', 'MAX_SHORTLIST_INPUTS', 'MAX_SHORTLIST_STORE_BYTES', 'MAX_SHORTLIST_IMPORT_BYTES', 'MAX_SHORTLIST_FACTORS',
@@ -229,7 +251,7 @@ export const BRAND_PROFILE_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     supportedVersions: BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current', writeSemantics: 'normalized_rewrite',
     byteBudget: MAX_PROFILE_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Published versions 6, 7 and 8 migrate directly to the current profile envelope. Version 9 preserves earlier page baselines while admitting independently versioned native-tree fingerprints; incompatible fingerprint algorithms are not compared.',
+    note: 'Versions 6–10 remain readable without invented keyword campaigns. Version 11 adds bounded, revisioned, time-limited Brand keyword intent without collection authority; candidate provenance and independent page-fingerprint algorithms remain intact.',
 });
 export const CAMPAIGN_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.campaigns', kind: 'browser_store', schema: null, currentVersion: CAMPAIGN_SCHEMA_VERSION,
@@ -241,9 +263,9 @@ export const CAMPAIGN_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
 export const WATCHLIST_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.watchlists', kind: 'browser_store', schema: null, currentVersion: WATCHLIST_SCHEMA_VERSION,
     supportedVersions: WATCHLIST_BROWSER_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
-    futureVersionBehavior: 'preserve_without_write', migration: 'exact_current_only', writeSemantics: 'normalized_rewrite',
-    byteBudget: MAX_WATCHLIST_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'The unchanged public version 2 envelope is the browser baseline; unversioned maps are outside the compatibility boundary.',
+    futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current', writeSemantics: 'normalized_rewrite',
+    byteBudget: MAX_WATCHLIST_READ_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
+    note: 'Public version 2 remains readable without inferred collection outcomes. Version 3 retains explicit page and favicon collection quality; unversioned maps are outside the compatibility boundary.',
 });
 export const SHORTLIST_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.shortlist', kind: 'browser_store', schema: null, currentVersion: SHORTLIST_SCHEMA_VERSION,
@@ -262,7 +284,7 @@ export const CT_HISTORY_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
 export const DETECTION_RULE_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.detection-rules', kind: 'browser_store', schema: null, currentVersion: DETECTION_RULE_SCHEMA_VERSION,
     supportedVersions: DETECTION_RULE_BROWSER_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
-    futureVersionBehavior: 'preserve_without_write', migration: 'exact_current_only', writeSemantics: 'normalized_rewrite',
+    futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current', writeSemantics: 'normalized_rewrite',
     byteBudget: MAX_RULE_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
     note: 'Only allowlisted structured rule fields and operators survive normalisation; the schema string belongs to portable exports.',
 });
@@ -285,14 +307,14 @@ export const BULK_SESSION_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     supportedVersions: BULK_SESSION_BROWSER_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current', writeSemantics: 'normalized_rewrite',
     byteBudget: MAX_BULK_SESSION_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Public schema 4 sessions migrate with unknown row and per-source observation times and contributing-source provenance. Schema 5 retains those bounded fields without retaining raw lookup payloads; future versions are preserved without rewrite.',
+    note: 'Public schemas 4 and 5 remain readable with their original observation provenance. Schema 6 retains explicit page and favicon collection quality for saved evidence handoffs; future versions are preserved without rewrite.',
 });
 export const INVESTIGATION_TEMPLATE_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.investigation-templates', kind: 'browser_store', schema: null,
     currentVersion: INVESTIGATION_TEMPLATE_VERSION, supportedVersions: INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS,
-    acceptsUnversionedLegacy: false, futureVersionBehavior: 'preserve_without_write', migration: 'exact_current_only',
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current',
     writeSemantics: 'normalized_rewrite', byteBudget: MAX_INVESTIGATION_TEMPLATE_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Version 2 adds the fixed response-playbook recipe identifiers. Analyst-authored guidance remains bound to allowlisted built-in stages and cannot run code, start collection, submit evidence, or remove mandatory request gates.',
+    note: 'Public version 2 remains readable. Version 3 retains optional lesson-revision provenance without Case identities or note text. Guidance remains bound to built-in stages and cannot execute actions or remove mandatory request gates.',
 });
 export const BULK_REVIEW_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.bulk-review', kind: 'browser_store', schema: null, currentVersion: BULK_REVIEW_SCHEMA_VERSION,
@@ -306,7 +328,7 @@ export const BRAND_PROFILE_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     supportedVersions: SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'reject', migration: 'normalize_to_current', writeSemantics: 'non_destructive_merge',
     byteBudget: MAX_PROFILE_IMPORT_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Supported exports merge non-destructively by bounded normalised profile identity.',
+    note: 'Supported exports merge non-destructively by bounded profile identity. Candidate decisions cannot be reassigned to a different Brand identifier with the same name.',
 });
 export const CAMPAIGN_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.campaigns', kind: 'export', schema: CAMPAIGN_SCHEMA, currentVersion: CAMPAIGN_SCHEMA_VERSION,
@@ -318,9 +340,9 @@ export const CAMPAIGN_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
 export const WATCHLIST_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.watchlists', kind: 'export', schema: WATCHLIST_SCHEMA, currentVersion: WATCHLIST_SCHEMA_VERSION,
     supportedVersions: WATCHLIST_EXPORT_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
-    futureVersionBehavior: 'reject', migration: 'exact_current_only', writeSemantics: 'non_destructive_merge',
-    byteBudget: MAX_WATCHLIST_IMPORT_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Non-destructive collection merge with current schema required.',
+    futureVersionBehavior: 'reject', migration: 'normalize_to_current', writeSemantics: 'non_destructive_merge',
+    byteBudget: MAX_WATCHLIST_PORTABLE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
+    note: 'Versions 2–5 remain readable. Version 6 preserves older membership overflow as paused, exportable records without activating or pruning domains. New active membership remains bounded. Brand contexts and incomplete-check baselines remain preserved.',
 });
 export const SHORTLIST_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.shortlist', kind: 'export', schema: SHORTLIST_SCHEMA, currentVersion: SHORTLIST_SCHEMA_VERSION,
@@ -332,7 +354,7 @@ export const SHORTLIST_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
 export const DETECTION_RULE_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.detection-rules', kind: 'export', schema: DETECTION_RULE_SCHEMA, currentVersion: DETECTION_RULE_SCHEMA_VERSION,
     supportedVersions: DETECTION_RULE_EXPORT_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
-    futureVersionBehavior: 'reject', migration: 'exact_current_only', writeSemantics: 'non_destructive_merge',
+    futureVersionBehavior: 'reject', migration: 'normalize_to_current', writeSemantics: 'non_destructive_merge',
     byteBudget: MAX_RULE_IMPORT_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
     note: 'Non-destructive rule merge; imported conditions remain allowlisted and non-executable.',
 });
@@ -355,14 +377,14 @@ export const BULK_SESSION_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     supportedVersions: SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS, acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'reject', migration: 'normalize_to_current', writeSemantics: 'non_destructive_merge',
     byteBudget: MAX_BULK_SESSION_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Public schema 4 sessions migrate directly to schema 5 with unknown historical row and per-source observation times and source provenance. Current exports retain source-qualified relationship evidence and bounded profile context.',
+    note: 'Public schemas 4 and 5 migrate without invented observation times or collection outcomes. Current exports retain source-qualified relationship evidence, bounded profile context and collection quality.',
 });
 export const INVESTIGATION_TEMPLATE_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.investigation-templates', kind: 'export', schema: INVESTIGATION_TEMPLATE_SCHEMA,
     currentVersion: INVESTIGATION_TEMPLATE_VERSION, supportedVersions: INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS,
-    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'exact_current_only',
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'normalize_to_current',
     writeSemantics: 'non_destructive_merge', byteBudget: MAX_INVESTIGATION_TEMPLATE_IMPORT_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'The unchanged public version 2 writer remains the exact bounded analyst-authored guide baseline with allowlisted stage identities and request gates.',
+    note: 'Version 3 exports authored guidance and optional content-hash lesson provenance. Public version 2 remains readable; future versions fail closed.',
 });
 export const BULK_REVIEW_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.bulk-review', kind: 'export', schema: BULK_REVIEW_SCHEMA, currentVersion: BULK_REVIEW_SCHEMA_VERSION,
@@ -421,6 +443,15 @@ const WORKSPACE_LIFECYCLE_DEFINITIONS = Object.freeze([
         itemBounds: [
             { id: 'profiles', path: 'profiles', maximum: MAX_PROFILES, handling: 'truncate' },
             { id: 'profile-values', path: 'profiles[].values', maximum: MAX_PROFILE_VALUES, handling: 'truncate' },
+            { id: 'candidate-observations', path: 'profiles[].candidateObservations', maximum: MAX_CANDIDATE_OBSERVATIONS, handling: 'truncate' },
+            { id: 'candidate-matches', path: 'profiles[].candidateObservations[].matches', maximum: MAX_CANDIDATE_MATCHES, handling: 'reject' },
+            { id: 'candidate-sources', path: 'profiles[].candidateObservations[].sources', maximum: MAX_CANDIDATE_SOURCES, handling: 'reject' },
+            { id: 'candidate-exceptions', path: 'profiles[].candidateExceptions', maximum: MAX_CANDIDATE_EXCEPTIONS, handling: 'truncate' },
+            { id: 'exception-history', path: 'profiles[].candidateExceptions[].history', maximum: MAX_CANDIDATE_EXCEPTION_HISTORY, handling: 'truncate' },
+            { id: 'keyword-campaigns', path: 'profiles[].keywordCampaigns', maximum: MAX_BRAND_KEYWORD_CAMPAIGNS, handling: 'reject' },
+            { id: 'keyword-campaign-history', path: 'profiles[].keywordCampaigns[].history', maximum: MAX_BRAND_KEYWORD_CAMPAIGN_HISTORY, handling: 'reject' },
+            { id: 'keyword-positive-terms', path: 'profiles[].keywordCampaigns[].positiveTerms', maximum: MAX_BRAND_KEYWORD_TERMS, handling: 'reject' },
+            { id: 'keyword-negative-terms', path: 'profiles[].keywordCampaigns[].negativeTerms', maximum: MAX_BRAND_KEYWORD_TERMS, handling: 'reject' },
         ],
         portable: {
             descriptor: BRAND_PROFILE_EXPORT_COMPATIBILITY,
@@ -466,14 +497,17 @@ const WORKSPACE_LIFECYCLE_DEFINITIONS = Object.freeze([
             { id: 'watchlists', path: 'watchlists', maximum: MAX_WATCHLISTS, handling: 'truncate' },
             { id: 'domains', path: 'watchlists[].results', maximum: MAX_WATCHLIST_DOMAINS, handling: 'drop_value' },
             { id: 'history', path: 'watchlists[].history', maximum: MAX_WATCHLIST_HISTORY_EVENTS, handling: 'truncate' },
+            { id: 'domain-contexts', path: 'watchlists[].domainMetadata', maximum: MAX_WATCHLIST_DOMAINS, handling: 'reject' },
+            { id: 'brand-contexts', path: 'watchlists[].domainMetadata[].contexts', maximum: MAX_WATCH_CONTEXTS, handling: 'truncate' },
         ],
         portable: {
             descriptor: WATCHLIST_EXPORT_COMPATIBILITY,
             schema: WATCHLIST_SCHEMA,
             builder: 'buildWatchlistExport',
             merger: 'mergeWatchlistStores',
-            serializerHookId: 'workspace.portable.json',
+            serializerHookId: 'workspace.portable.watchlist-json',
             indentSpaces: 2,
+            compactFallback: true,
             terminalLf: false,
         },
     },
@@ -649,6 +683,64 @@ const WORKSPACE_LIFECYCLE_DEFINITIONS = Object.freeze([
     },
 ]);
 const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
+    { id: 'workspace.browser.brand.v11', path: 'test/fixtures/workspace-lifecycle/browser-brand-v11.json', bytes: 38, sha256: 'c727cd501774f0f89a39f399a01216065b6ed7048bfed97bbcdaf10e651a7133', schema: 'whoisleuth.browser.brand-profile-store', version: 11 },
+    { id: 'workspace.portable.brand.v11', path: 'test/fixtures/workspace-lifecycle/portable-brand-v11.json', bytes: 123, sha256: 'c5023e1eebe187cf355c4fb53b7d8a755dc0ffb01a3deeb9b9dd7032007933d9', schema: 'whoisleuth.brand-profiles', version: 11 },
+    { id: 'workspace.browser.watchlist.v6', path: 'test/fixtures/workspace-lifecycle/browser-watchlist-v6.json', bytes: 76, sha256: '16df0f813b17f1765862f5c2ff41c2db9c7d6d76e75f24746aa6d75b59d3f02e', schema: 'whoisleuth.browser.watchlist-store', version: 6 },
+    { id: 'workspace.portable.watchlist.v6', path: 'test/fixtures/workspace-lifecycle/portable-watchlist-v6.json', bytes: 120, sha256: 'ced22d0d16e839e0b4625f8799eef30a776908abf3af998de6fad5b549898987', schema: 'whoisleuth.watchlists', version: 6 },
+    { id: 'workspace.browser.brand.v10', path: 'test/fixtures/workspace-lifecycle/browser-brand-v10.json', bytes: 38, sha256: 'bebf3a72ba57c06246e6169ebd9a597eb5b867508db85e1db0e3d763bc0839bc', schema: 'whoisleuth.browser.brand-profile-store', version: 10 },
+    { id: 'workspace.portable.brand.v10', path: 'test/fixtures/workspace-lifecycle/portable-brand-v10.json', bytes: 123, sha256: '85cd7c58696f8219484ac88210ad7ab4a0ad1c9798e8cb02ff6ebb3fd2c82d8a', schema: 'whoisleuth.brand-profiles', version: 10 },
+    { id: 'workspace.browser.watchlist.v5', path: 'test/fixtures/workspace-lifecycle/browser-watchlist-v5.json', bytes: 76, sha256: '11eabd20f952611307a5c84291c7892c15d3748f7ada5549813e1d705967c2c0', schema: 'whoisleuth.browser.watchlist-store', version: 5 },
+    { id: 'workspace.portable.watchlist.v5', path: 'test/fixtures/workspace-lifecycle/portable-watchlist-v5.json', bytes: 120, sha256: '732d4bda46e907bdd4d343ce36999a2787a0057029ee4dba0c4ef462f2822fed', schema: 'whoisleuth.watchlists', version: 5 },
+    {
+        id: 'workspace.browser.detection.v2', path: 'test/fixtures/workspace-lifecycle/browser-detection-v2.json',
+        bytes: 34, sha256: '2db6ae8eb9d24cb86924a7020c6f3eebfa41b5fc5848a53e239465db622c2312',
+        schema: 'whoisleuth.browser.detection-rule-store', version: 2,
+    },
+    {
+        id: 'workspace.portable.detection.v2', path: 'test/fixtures/workspace-lifecycle/portable-detection-v2.json',
+        bytes: 293, sha256: 'bf4409e18ef0b721f5a7e2f14a06f2fada88287114ec17775fef42e7ed38072a',
+        schema: 'whoisleuth.detection-rules', version: 2,
+    },
+    {
+        id: 'workspace.browser.bulk.v7', path: 'test/fixtures/workspace-lifecycle/browser-bulk-v7.json',
+        bytes: 77, sha256: '6b02cbd48a939a34d8f292da2b6bc8e8b59f3ed1b9c106a8e9e271ec0e949459',
+        schema: 'whoisleuth.browser.bulk-session-store', version: 7,
+    },
+    {
+        id: 'workspace.portable.bulk.v7', path: 'test/fixtures/workspace-lifecycle/portable-bulk-v7.json',
+        bytes: 338, sha256: 'f7e14d866eeb4e94b5390086e278348bfa0610ace72776fee4fbf24871ab3393',
+        schema: 'whoisleuth.bulk-sessions', version: 7,
+    },
+    {
+        id: 'workspace.browser.watchlist.v4', path: 'test/fixtures/workspace-lifecycle/browser-watchlist-v4.json',
+        bytes: 76, sha256: '059930ee54d1bc65ac68ef6d3a8ac8cd8e53f682fe9a857512e2b6c57e93d5fe',
+        schema: 'whoisleuth.browser.watchlist-store', version: 4,
+    },
+    {
+        id: 'workspace.portable.watchlist.v4', path: 'test/fixtures/workspace-lifecycle/portable-watchlist-v4.json',
+        bytes: 120, sha256: '496f1ec39add1d3fe080ad8f9f991639cfbbe659ddb1c58932ac6ff563ce32aa',
+        schema: 'whoisleuth.watchlists', version: 4,
+    },
+    {
+        id: 'workspace.browser.watchlist.v3', path: 'test/fixtures/workspace-lifecycle/browser-watchlist-v3.json',
+        bytes: 76, sha256: '740246c1666c332ae907a5b40364e03a4f008484fce7b1c6dce8082a6ac7b654',
+        schema: 'whoisleuth.browser.watchlist-store', version: 3,
+    },
+    {
+        id: 'workspace.portable.watchlist.v3', path: 'test/fixtures/workspace-lifecycle/portable-watchlist-v3.json',
+        bytes: 120, sha256: 'ad07c8a530c369b49192bd3d8dde1b17c58b737da4e3d00a834a64be6aa429bf',
+        schema: 'whoisleuth.watchlists', version: 3,
+    },
+    {
+        id: 'workspace.browser.bulk.v6', path: 'test/fixtures/workspace-lifecycle/browser-bulk-v6.json',
+        bytes: 77, sha256: '811ef0b05415f19dc7bd940a4786d53a6398121cbb7cd060fcd6d21ed562487b',
+        schema: 'whoisleuth.browser.bulk-session-store', version: 6,
+    },
+    {
+        id: 'workspace.portable.bulk.v6', path: 'test/fixtures/workspace-lifecycle/portable-bulk-v6.json',
+        bytes: 338, sha256: 'ec7f6445cf42c013163ea835d5f919213b69978124d6883c1f10d62a0868235f',
+        schema: 'whoisleuth.bulk-sessions', version: 6,
+    },
     {
         "id": "workspace.browser.brand.v6",
         "path": "test/fixtures/workspace-lifecycle/browser-brand-v6.json",
@@ -761,6 +853,14 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "schema": "whoisleuth.browser.investigation-template-store",
         "version": 2
     },
+    {
+        "id": "workspace.browser.template.v3",
+        "path": "test/fixtures/workspace-lifecycle/browser-template-v3.json",
+        "bytes": 88,
+        "sha256": "70a6dfe2c27c75d86c74a9dfe05148c3186be68191002cbea8c18816a64792c9",
+        "schema": "whoisleuth.browser.investigation-template-store",
+        "version": 3
+    },
     {
         "id": "workspace.browser.watchlist.v2",
         "path": "test/fixtures/workspace-lifecycle/browser-watchlist-v2.json",
@@ -889,6 +989,14 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "schema": "whoisleuth.investigation-templates",
         "version": 2
     },
+    {
+        "id": "workspace.portable.template.v3",
+        "path": "test/fixtures/workspace-lifecycle/portable-template-v3.json",
+        "bytes": 471,
+        "sha256": "6b211af44661594337731767cd212beae305d81e03e090a783633eebaa62d03e",
+        "schema": "whoisleuth.investigation-templates",
+        "version": 3
+    },
     {
         "id": "workspace.portable.watchlist.v2",
         "path": "test/fixtures/workspace-lifecycle/portable-watchlist-v2.json",
@@ -1100,6 +1208,13 @@ const WORKSPACE_LIFECYCLE_HOOKS = Object.freeze([
         module: WORKSPACE_CONTRACT_OWNER,
         exportName: 'serialiseWorkspacePortableJson',
     },
+    {
+        id: 'workspace.portable.watchlist-json',
+        role: 'serialiser',
+        runtime: 'shared',
+        module: 'packages/workspace/watchlist-store.mts',
+        exportName: 'serializeWatchlistExport',
+    },
     {
         id: 'workspace.portable.json-line',
         role: 'serialiser',
@@ -1208,6 +1323,7 @@ function workspacePortableSerialisation(definition) {
             encoding: 'utf-8',
             bom: false,
             indentSpaces: definition.portable.indentSpaces,
+            ...(definition.portable.compactFallback ? { compactFallback: true } : {}),
             terminalLf: definition.portable.terminalLf,
             propertyOrder: 'normalised_fixed',
             canonicalisation: null,

package/packages/evidence/collection-quality.mjs

@@ -0,0 +1,67 @@
+const STATES = new Set(['complete', 'partial', 'unavailable', 'not_collected', 'unknown']);
+export function isWebCollectionQuality(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return false;
+    const record = value;
+    const keys = Object.keys(record);
+    if (keys.length !== 4 || keys.some(key => !['version', 'page', 'favicon', 'combined'].includes(key)
+        || !Object.hasOwn(Object.getOwnPropertyDescriptor(record, key) ?? {}, 'value')))
+        return false;
+    return record.version === 1
+        && typeof record.page === 'string' && STATES.has(record.page)
+        && typeof record.favicon === 'string' && STATES.has(record.favicon)
+        && typeof record.combined === 'string' && STATES.has(record.combined)
+        && (record.combined !== 'complete' || (record.page === 'complete' && record.favicon === 'complete'));
+}
+export function normalizeWebCollectionQuality(value, depth) {
+    if (value === undefined)
+        return undefined;
+    if (!isWebCollectionQuality(value))
+        throw new TypeError('Unsupported or invalid web collection quality.');
+    if (depth === 'fast')
+        return capturedWebCollectionQuality('not_collected', 'not_collected');
+    return { version: 1, page: value.page, favicon: value.favicon, combined: value.combined };
+}
+export function capturedWebCollectionQuality(page, favicon) {
+    const combined = page === 'complete' && favicon === 'complete' ? 'complete'
+        : page === favicon ? page : 'partial';
+    return { version: 1, page, favicon, combined };
+}
+export function webCollectionQualityForCapture(value, depth) {
+    if (depth !== 'deep')
+        return capturedWebCollectionQuality('not_collected', 'not_collected');
+    return normalizeWebCollectionQuality(value) ?? capturedWebCollectionQuality('unknown', 'unknown');
+}
+const PAGE_FIELDS = new Set(['activityStatus', 'pageTitle', 'hasPasswordField', 'hasExternalFormAction', 'hasExternalPasswordForm', 'phishingLanguageMatch', 'pageBaselineMatch']);
+const FAVICON_FIELDS = new Set(['faviconHash', 'faviconPHash', 'faviconMatch', 'faviconNearMatch']);
+const COMBINED_FIELDS = new Set(['riskScore', 'riskFactors', 'riskModelVersion', 'opportunityScore', 'opportunityFactors', 'reusesOfficialAssets']);
+/** Missing historical quality never proves that a false/null value was observed. */
+export function webCollectionAllowsComparison(field, quality, depth) {
+    if (PAGE_FIELDS.has(field))
+        return quality?.page === 'complete';
+    if (FAVICON_FIELDS.has(field))
+        return quality?.favicon === 'complete';
+    if (COMBINED_FIELDS.has(field) && depth === 'deep')
+        return quality?.combined === 'complete';
+    return true;
+}
+/** Retain the measured score while qualifying incomplete inputs at presentation. */
+export function webCollectionScoreLimitation(quality, depth) {
+    if (depth === 'unknown')
+        return 'Collection depth is unknown; score is not comparable.';
+    return webCollectionAllowsComparison('riskScore', quality, depth)
+        ? null : 'Incomplete or unknown web collection; score is not comparable.';
+}
+/** An incomplete current attempt cannot erase the last comparable baseline. */
+export function mergeWebCollectionQuality(previous, current) {
+    if (!previous && !current)
+        return undefined;
+    return { version: 1,
+        page: current?.page === 'complete' ? 'complete' : previous?.page ?? current?.page ?? 'unknown',
+        favicon: current?.favicon === 'complete' ? 'complete' : previous?.favicon ?? current?.favicon ?? 'unknown',
+        combined: current?.combined === 'complete' ? 'complete' : previous?.combined ?? current?.combined ?? 'unknown',
+    };
+}

package/packages/evidence/credential-form-attribution.mjs

@@ -0,0 +1,60 @@
+export const CREDENTIAL_CATEGORY_NAMES = ['password', 'email', 'username', 'one_time_code', 'payment'];
+export const MAX_CREDENTIAL_FORMS = 50;
+export const MAX_CREDENTIAL_INPUTS = 500;
+export const MAX_FORM_DESTINATIONS = 10;
+function record(value) {
+    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+function keys(value, expected) {
+    return Object.keys(value).length === expected.length && expected.every(key => Object.hasOwn(value, key));
+}
+const count = (value, max) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && value <= max;
+export function validCredentialFormAttribution(value) {
+    if (!record(value) || !keys(value, ['complete', 'unassociatedInputs', 'forms']) || typeof value.complete !== 'boolean'
+        || !count(value.unassociatedInputs, MAX_CREDENTIAL_INPUTS) || !Array.isArray(value.forms) || value.forms.length > MAX_CREDENTIAL_FORMS)
+        return false;
+    let classified = 0;
+    for (const [index, form] of value.forms.entries()) {
+        if (!record(form) || !keys(form, ['index', 'categories', 'destinations']) || form.index !== index + 1
+            || !record(form.categories) || !keys(form.categories, CREDENTIAL_CATEGORY_NAMES)
+            || !CREDENTIAL_CATEGORY_NAMES.every(key => count(form.categories[key], MAX_CREDENTIAL_INPUTS))
+            || !Array.isArray(form.destinations) || !form.destinations.length || form.destinations.length > MAX_FORM_DESTINATIONS)
+            return false;
+        classified += Math.max(...CREDENTIAL_CATEGORY_NAMES.map(key => Number(form.categories[key])));
+        const seen = new Set();
+        for (const destination of form.destinations) {
+            if (!record(destination) || !keys(destination, ['relationship', 'origin']))
+                return false;
+            if (destination.relationship === 'unknown' || destination.relationship === 'no_submission') {
+                if (destination.origin !== null || (destination.relationship === 'unknown' && value.complete))
+                    return false;
+            }
+            else if (destination.relationship === 'external' || destination.relationship === 'same_origin') {
+                if (typeof destination.origin !== 'string' || destination.origin.length > 320)
+                    return false;
+                try {
+                    const url = new URL(destination.origin);
+                    if (!['http:', 'https:'].includes(url.protocol) || url.origin !== destination.origin || url.username || url.password)
+                        return false;
+                }
+                catch {
+                    return false;
+                }
+            }
+            else
+                return false;
+            const identity = `${destination.relationship}:${destination.origin}`;
+            if (seen.has(identity))
+                return false;
+            seen.add(identity);
+        }
+    }
+    return classified + value.unassociatedInputs <= MAX_CREDENTIAL_INPUTS && (!value.complete || value.unassociatedInputs === 0);
+}
+export function externalPasswordFormObservation(value) {
+    if (!validCredentialFormAttribution(value))
+        return null;
+    if (value.forms.some(form => form.categories.password > 0 && form.destinations.some(destination => destination.relationship === 'external')))
+        return true;
+    return value.complete ? false : null;
+}

package/packages/evidence/dns-query-outcome.mjs

@@ -0,0 +1,72 @@
+import { MAX_LOOKUP_DNS_RECORDS_PER_TYPE } from "../analysis/lookup-network-evidence-bounds.mjs";
+import { addressValue, canonicalIpAddress } from "../contracts/ip-address.mjs";
+/** Fixed values retained in Observation v1's existing diagnostic detail slot. */
+export const DNS_QUERY_OUTCOMES = Object.freeze({
+    records: { status: 'success', label: 'Records returned' },
+    empty_answer: { status: 'not_found', label: 'No records returned' },
+    no_data: { status: 'not_found', label: 'No data for this record type (NODATA)' },
+    name_not_found: { status: 'not_found', label: 'Name not found by resolver' },
+    timeout: { status: 'error', label: 'DNS query timed out' },
+    server_failure: { status: 'error', label: 'DNS server failed to answer (SERVFAIL)' },
+    refused: { status: 'error', label: 'DNS query refused' },
+    invalid_response: { status: 'error', label: 'DNS answer could not be read completely' },
+    error: { status: 'error', label: 'DNS query failed' },
+    skipped: { status: 'skipped', label: 'Not queried' },
+});
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value : {};
+}
+/** Legacy not_found diagnostics do not identify which negative answer occurred. */
+export function readDnsQueryOutcome(value) {
+    const diagnostic = record(value);
+    const detail = diagnostic.detail;
+    return typeof detail === 'string' && Object.hasOwn(DNS_QUERY_OUTCOMES, detail)
+        && DNS_QUERY_OUTCOMES[detail].status === diagnostic.status
+        ? detail : null;
+}
+export function dnsQueryFailureOutcome(code) {
+    switch (code) {
+        case 'ENODATA': return 'no_data';
+        case 'ENOTFOUND': return 'name_not_found';
+        case 'ETIMEOUT': return 'timeout';
+        case 'ESERVFAIL': return 'server_failure';
+        case 'EREFUSED': return 'refused';
+        case 'EBADRESP': return 'invalid_response';
+        default: return 'error';
+    }
+}
+/** One family, one source state. Unrelated mail/delegation failures cannot erase it. */
+export function dnsAddressFamilyEvidence(dnsValue, family) {
+    const dns = record(dnsValue);
+    const diagnostic = record(record(dns.diagnostics)[family]);
+    const raw = record(dns.records)[family];
+    const candidates = Array.isArray(raw) ? raw.slice(0, MAX_LOOKUP_DNS_RECORDS_PER_TYPE) : [];
+    const addresses = candidates.flatMap(value => {
+        const address = canonicalIpAddress(value);
+        return address && addressValue(address)?.family === (family === 'a' ? 4 : 6) ? [address] : [];
+    });
+    const malformed = raw !== undefined && !Array.isArray(raw)
+        || candidates.length !== addresses.length;
+    const truncated = diagnostic.truncated === true
+        || typeof diagnostic.discarded === 'number' && diagnostic.discarded > 0
+        || Array.isArray(raw) && raw.length > candidates.length;
+    const outcome = readDnsQueryOutcome(diagnostic);
+    const inconsistent = outcome === 'records' && !addresses.length
+        || outcome !== null && outcome !== 'records' && addresses.length > 0;
+    const complete = !malformed && !truncated && !inconsistent && Array.isArray(raw)
+        && outcome !== null && DNS_QUERY_OUTCOMES[outcome].status !== 'error' && outcome !== 'skipped';
+    const state = malformed || inconsistent ? 'error'
+        : truncated ? 'partial'
+            : outcome ? DNS_QUERY_OUTCOMES[outcome].status
+                : diagnostic.status === 'error' ? 'error'
+                    : diagnostic.status === 'skipped' || dns.status === 'skipped' ? 'skipped' : 'unknown';
+    const value = addresses.length ? [...new Set(addresses)].sort().join(' · ')
+        : malformed || inconsistent ? DNS_QUERY_OUTCOMES.invalid_response.label
+            : truncated ? 'DNS answer incomplete'
+                : outcome ? DNS_QUERY_OUTCOMES[outcome].label
+                    : state === 'error' ? DNS_QUERY_OUTCOMES.error.label
+                        : state === 'skipped' ? DNS_QUERY_OUTCOMES.skipped.label
+                            : diagnostic.status === 'not_found' ? 'Negative DNS outcome not recorded' : null;
+    return { outcome, value, state, complete, truncated };
+}

package/packages/evidence/email-recipient.mjs

@@ -0,0 +1,18 @@
+// Single plain recipient admission for manually opened drafts, not delivery validation.
+const SINGLE_ADDRESS = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$/u;
+export function emailRecipient(value) {
+    if (typeof value !== 'string' || value.length > 320 || /[\u0000-\u001f\u007f]/u.test(value))
+        return null;
+    const address = value.trim();
+    return SINGLE_ADDRESS.test(address) ? address : null;
+}
+/** Encode the recipient independently; upstream text never becomes a header. */
+export function recipientMailto(value, headers) {
+    const address = emailRecipient(value);
+    if (!address)
+        return null;
+    const separator = address.indexOf('@');
+    const recipient = `${encodeURIComponent(address.slice(0, separator))}@${encodeURIComponent(address.slice(separator + 1))}`;
+    const query = headers ? `?subject=${encodeURIComponent(headers.subject)}&body=${encodeURIComponent(headers.body)}` : '';
+    return `mailto:${recipient}${query}`;
+}

package/packages/evidence/image-regions.mjs

@@ -5,6 +5,21 @@ export const MAX_EVIDENCE_IMAGE_PIXELS = 16 * 1024 * 1024;
 export const MAX_EVIDENCE_IMAGE_DIMENSION = 10_000;
 // Each selected region emits at most four solid rectangles; no nested effects.
 export const MAX_EVIDENCE_IMAGE_REGIONS = 64;
+export function readImageDerivationDeclaration(raw) {
+    const value = exact(raw, ['method', 'source', 'operations'], 'Image derivation declaration');
+    if (value.method !== 'png-regions-v1')
+        throw new TypeError('This image derivation method is unsupported.');
+    const operations = Array.from(array(value.operations, 'Image operations', 2, 1), operation => enumeration(operation, ['redact', 'outline'], 'Image operation'));
+    if (new Set(operations).size !== operations.length)
+        throw new TypeError('Image operations must be unique.');
+    return Object.freeze({ method: value.method, source: readRetainedFileReference(value.source), operations: Object.freeze(operations) });
+}
+/** Retain the immediate parent's fingerprint, without identifiers or region coordinates. */
+export function declareImageDerivation(raw) {
+    const derivation = readImageDerivation(raw);
+    const operations = ['redact', 'outline'].filter(kind => derivation.plan.regions.some(region => region.kind === kind));
+    return readImageDerivationDeclaration({ method: derivation.method, source: derivation.source, operations });
+}
 export function readEvidenceImageDimensions(width, height) {
     const result = {
         width: integer(width, 'Image width', 1, MAX_EVIDENCE_IMAGE_DIMENSION),

package/packages/evidence/lookup-target.mjs

@@ -5,6 +5,10 @@ import { MAX_OUTBOUND_HTTP_URL_CHARACTERS } from "../contracts/http-url.mjs";
 export const MAX_LOOKUP_INPUT_CHARACTERS = 2 * 1024 * 1024;
 const URL_SCHEME = /^[a-z][a-z\d+.-]*:\/\//iu;
 const CONTROL = /[\u0000-\u001f\u007f]/u;
+/** Lexical recognition only; protocol, credentials and target admission remain separate. */
+export function hasLookupUrlScheme(value) {
+    return URL_SCHEME.test(value);
+}
 export function validWebObservationMode(value) {
     return value === undefined || value === 'selected_url';
 }
@@ -76,7 +80,7 @@ export function prepareLookupCollectionTarget(value) {
     const raw = value.trim();
     if (!raw)
         throw new TypeError('Enter a domain, IP address or ASN.');
-    const absolute = URL_SCHEME.test(raw);
+    const absolute = hasLookupUrlScheme(raw);
     // An unbracketed IPv6 literal is not a URL with a port. Use the same URL
     // parser to admit its syntax, then leave address safety and ASN bounds to
     // the classifier; malformed colon-separated text must not become a request.