@slicedearth/whoisleuth-cli 2.5.1 → 2.6.0

package/packages/contracts/workspace-portability.mjs

@@ -7,11 +7,13 @@ export const BRAND_PROFILE_SCHEMA = 'whoisleuth.brand-profiles';
 export const PUBLIC_BRAND_PROFILE_SCHEMA_VERSION = 6;
 // Historical readers retain a fixed published identity when the writer moves.
 export const PUBLISHED_V2_2_BRAND_PROFILE_SCHEMA_VERSION = 7;
-export const BRAND_PROFILE_SCHEMA_VERSION = 9;
+export const BRAND_PROFILE_SCHEMA_VERSION = 11;
 export const BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS = Object.freeze([
     PUBLIC_BRAND_PROFILE_SCHEMA_VERSION,
     PUBLISHED_V2_2_BRAND_PROFILE_SCHEMA_VERSION,
     8,
+    9,
+    10,
     BRAND_PROFILE_SCHEMA_VERSION,
 ]);
 export const SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS = BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS;
@@ -21,6 +23,17 @@ export const MAX_PROFILE_VALUE_INPUTS = MAX_PROFILE_VALUES * 4;
 export const MAX_PROFILE_STORE_BYTES = 4 * 1024 * 1024;
 export const MAX_PROFILE_IMPORT_BYTES = MAX_PROFILE_STORE_BYTES * 8;
 export const MAX_PROFILE_NAME_LENGTH = 100;
+export const MAX_CANDIDATE_OBSERVATIONS = 200;
+export const MAX_CANDIDATE_MATCHES = 20;
+export const MAX_CANDIDATE_SOURCES = 12;
+export const MAX_CANDIDATE_TEXT = 300;
+export const MAX_CANDIDATE_EXCEPTIONS = 200;
+export const MAX_CANDIDATE_EXCEPTION_HISTORY = 8;
+export const MAX_BRAND_KEYWORD_CAMPAIGNS = 20;
+export const MAX_BRAND_KEYWORD_CAMPAIGN_HISTORY = 8;
+export const MAX_BRAND_KEYWORD_TERMS = 20;
+export const MAX_BRAND_KEYWORD_TERM_LENGTH = 80;
+export const MAX_WATCH_CONTEXTS = 20;
 export const MAX_PROFILE_TEXT_LENGTH = 200;
 export const MAX_PROFILE_DOMAIN_LENGTH = 253;
 export const MAX_PROFILE_URL_LENGTH = 2_048;
@@ -47,14 +60,21 @@ export const MAX_CAMPAIGN_IMPORT_BYTES = 2 * 1024 * 1024;
 export const MAX_CAMPAIGN_INPUT_RECORDS = 500;
 export const MAX_CAMPAIGN_STORE_BYTES = 512 * 1024;
 export const WATCHLIST_SCHEMA = 'whoisleuth.watchlists';
-export const WATCHLIST_SCHEMA_VERSION = 4;
-export const WATCHLIST_BROWSER_SUPPORTED_VERSIONS = Object.freeze([2, 3, WATCHLIST_SCHEMA_VERSION]);
+export const WATCHLIST_SCHEMA_VERSION = 6;
+export const WATCHLIST_BROWSER_SUPPORTED_VERSIONS = Object.freeze([2, 3, 4, 5, WATCHLIST_SCHEMA_VERSION]);
 export const WATCHLIST_EXPORT_SUPPORTED_VERSIONS = WATCHLIST_BROWSER_SUPPORTED_VERSIONS;
 export const MAX_WATCHLISTS = 100;
 export const MAX_WATCHLIST_INPUTS = MAX_WATCHLISTS * 4;
 export const MAX_WATCHLIST_NAME_LENGTH = 100;
 export const MAX_WATCHLIST_STORE_BYTES = 2 * 1024 * 1024;
 export const MAX_WATCHLIST_IMPORT_BYTES = 2 * 1024 * 1024;
+// Recovery metadata is not new analyst data. Reserve only its exact JSON cost;
+// the store writer still enforces the ordinary budget after subtracting it.
+export const WATCHLIST_RECOVERY_METADATA = Object.freeze({ membershipRecovery: 'legacy_overflow' });
+export const WATCHLIST_RECOVERY_METADATA_BYTES = JSON.stringify(WATCHLIST_RECOVERY_METADATA).length - 1;
+export const MAX_WATCHLIST_READ_BYTES = MAX_WATCHLIST_STORE_BYTES + MAX_WATCHLISTS * WATCHLIST_RECOVERY_METADATA_BYTES;
+// Date.toISOString() produces at most 27 ASCII characters, including extended years.
+export const MAX_WATCHLIST_PORTABLE_BYTES = MAX_WATCHLIST_READ_BYTES + JSON.stringify({ exportedAt: '+999999-12-31T23:59:59.999Z' }).length - 1;
 export const MAX_WATCHLIST_HISTORY_EVENTS = 12;
 export const MAX_WATCHLIST_CHANGES_PER_EVENT = 500;
 export const MAX_WATCHLIST_DOMAINS = 2_000;
@@ -82,9 +102,9 @@ export const MAX_CT_HISTORY_EVER_SEEN_DOMAINS = 1_000;
 export const MAX_CT_HISTORY_QUERY_LENGTH = 200;
 export const MAX_CT_HISTORY_STORE_BYTES = 1024 * 1024;
 export const DETECTION_RULE_SCHEMA = 'whoisleuth.detection-rules';
-export const DETECTION_RULE_SCHEMA_VERSION = 1;
-export const DETECTION_RULE_BROWSER_SUPPORTED_VERSIONS = Object.freeze([DETECTION_RULE_SCHEMA_VERSION]);
-export const DETECTION_RULE_EXPORT_SUPPORTED_VERSIONS = Object.freeze([DETECTION_RULE_SCHEMA_VERSION]);
+export const DETECTION_RULE_SCHEMA_VERSION = 2;
+export const DETECTION_RULE_BROWSER_SUPPORTED_VERSIONS = Object.freeze([1, DETECTION_RULE_SCHEMA_VERSION]);
+export const DETECTION_RULE_EXPORT_SUPPORTED_VERSIONS = DETECTION_RULE_BROWSER_SUPPORTED_VERSIONS;
 export const MAX_DETECTION_RULES = 50;
 export const MAX_RULE_CONDITIONS = 8;
 export const MAX_RULE_INPUT_RECORDS = 250;
@@ -114,8 +134,8 @@ export const MAX_WEBSITE_SNAPSHOTS_PER_DOMAIN = 12;
 export const MAX_WEBSITE_SNAPSHOT_STORE_BYTES = 512 * 1024;
 export const MAX_WEBSITE_SNAPSHOT_IMPORT_BYTES = 768 * 1024;
 export const BULK_SESSION_SCHEMA = 'whoisleuth.bulk-sessions';
-export const BULK_SESSION_SCHEMA_VERSION = 6;
-export const BULK_SESSION_BROWSER_SUPPORTED_VERSIONS = Object.freeze([4, 5, BULK_SESSION_SCHEMA_VERSION]);
+export const BULK_SESSION_SCHEMA_VERSION = 7;
+export const BULK_SESSION_BROWSER_SUPPORTED_VERSIONS = Object.freeze([4, 5, 6, BULK_SESSION_SCHEMA_VERSION]);
 export const SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS = BULK_SESSION_BROWSER_SUPPORTED_VERSIONS;
 export const MAX_BULK_SESSIONS = 10;
 export const MAX_BULK_SESSION_ROWS = 2_000;
@@ -180,12 +200,14 @@ export const WORKSPACE_PORTABILITY_IDENTITY_CONSTANTS = Object.freeze([
 export const WORKSPACE_PORTABILITY_BOUND_CONSTANTS = Object.freeze([
     'MAX_PROFILES', 'MAX_PROFILE_VALUES', 'MAX_PROFILE_VALUE_INPUTS', 'MAX_PROFILE_STORE_BYTES', 'MAX_PROFILE_IMPORT_BYTES',
     'MAX_PROFILE_NAME_LENGTH', 'MAX_PROFILE_TEXT_LENGTH', 'MAX_PROFILE_DOMAIN_LENGTH', 'MAX_PROFILE_URL_LENGTH', 'MAX_PROFILE_TLD_LENGTH',
+    'MAX_BRAND_KEYWORD_CAMPAIGNS', 'MAX_BRAND_KEYWORD_CAMPAIGN_HISTORY', 'MAX_BRAND_KEYWORD_TERMS', 'MAX_BRAND_KEYWORD_TERM_LENGTH',
     'MAX_OFFICIAL_CHANNELS', 'MAX_RIGHTS_REFERENCES', 'MAX_DKIM_SELECTOR_LENGTH',
     'MAX_DKIM_SELECTORS', 'MAX_PROTECTION_ATTESTATIONS', 'MAX_DESIRED_POSTURE_BASELINES', 'MAX_DESIRED_POSTURE_RECORDS',
     'MAX_DESIRED_POSTURE_SUPPRESSIONS', 'MAX_DESIRED_POSTURE_OBSERVATIONS', 'MAX_DESIRED_POSTURE_CHANGE_WINDOWS',
     'MAX_CAMPAIGNS', 'MAX_CAMPAIGN_DOMAINS', 'MAX_CAMPAIGN_NAME_LENGTH', 'MAX_CAMPAIGN_DESCRIPTION_LENGTH',
     'MAX_CAMPAIGN_IMPORT_BYTES', 'MAX_CAMPAIGN_INPUT_RECORDS', 'MAX_CAMPAIGN_STORE_BYTES',
     'MAX_WATCHLISTS', 'MAX_WATCHLIST_INPUTS', 'MAX_WATCHLIST_NAME_LENGTH', 'MAX_WATCHLIST_STORE_BYTES', 'MAX_WATCHLIST_IMPORT_BYTES',
+    'MAX_WATCHLIST_READ_BYTES', 'MAX_WATCHLIST_PORTABLE_BYTES',
     'MAX_WATCHLIST_HISTORY_EVENTS', 'MAX_WATCHLIST_CHANGES_PER_EVENT', 'MAX_WATCHLIST_DOMAINS', 'MAX_WATCHLIST_INPUT_RECORDS',
     'MAX_WATCHLIST_NAMESERVERS', 'MAX_WATCHLIST_MUTATION_TYPES', 'MAX_WATCHLIST_HISTORY_DOMAIN_OPTIONS',
     'MAX_SHORTLIST_ENTRIES', 'MAX_SHORTLIST_INPUTS', 'MAX_SHORTLIST_STORE_BYTES', 'MAX_SHORTLIST_IMPORT_BYTES', 'MAX_SHORTLIST_FACTORS',
@@ -229,7 +251,7 @@ export const BRAND_PROFILE_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     supportedVersions: BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current', writeSemantics: 'normalized_rewrite',
     byteBudget: MAX_PROFILE_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Published versions 6, 7 and 8 migrate directly to the current profile envelope. Version 9 preserves earlier page baselines while admitting independently versioned native-tree fingerprints; incompatible fingerprint algorithms are not compared.',
+    note: 'Versions 6–10 remain readable without invented keyword campaigns. Version 11 adds bounded, revisioned, time-limited Brand keyword intent without collection authority; candidate provenance and independent page-fingerprint algorithms remain intact.',
 });
 export const CAMPAIGN_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.campaigns', kind: 'browser_store', schema: null, currentVersion: CAMPAIGN_SCHEMA_VERSION,
@@ -242,7 +264,7 @@ export const WATCHLIST_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.watchlists', kind: 'browser_store', schema: null, currentVersion: WATCHLIST_SCHEMA_VERSION,
     supportedVersions: WATCHLIST_BROWSER_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current', writeSemantics: 'normalized_rewrite',
-    byteBudget: MAX_WATCHLIST_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
+    byteBudget: MAX_WATCHLIST_READ_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
     note: 'Public version 2 remains readable without inferred collection outcomes. Version 3 retains explicit page and favicon collection quality; unversioned maps are outside the compatibility boundary.',
 });
 export const SHORTLIST_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
@@ -262,7 +284,7 @@ export const CT_HISTORY_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
 export const DETECTION_RULE_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.detection-rules', kind: 'browser_store', schema: null, currentVersion: DETECTION_RULE_SCHEMA_VERSION,
     supportedVersions: DETECTION_RULE_BROWSER_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
-    futureVersionBehavior: 'preserve_without_write', migration: 'exact_current_only', writeSemantics: 'normalized_rewrite',
+    futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current', writeSemantics: 'normalized_rewrite',
     byteBudget: MAX_RULE_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
     note: 'Only allowlisted structured rule fields and operators survive normalisation; the schema string belongs to portable exports.',
 });
@@ -306,7 +328,7 @@ export const BRAND_PROFILE_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     supportedVersions: SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'reject', migration: 'normalize_to_current', writeSemantics: 'non_destructive_merge',
     byteBudget: MAX_PROFILE_IMPORT_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Supported exports merge non-destructively by bounded normalised profile identity.',
+    note: 'Supported exports merge non-destructively by bounded profile identity. Candidate decisions cannot be reassigned to a different Brand identifier with the same name.',
 });
 export const CAMPAIGN_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.campaigns', kind: 'export', schema: CAMPAIGN_SCHEMA, currentVersion: CAMPAIGN_SCHEMA_VERSION,
@@ -319,8 +341,8 @@ export const WATCHLIST_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.watchlists', kind: 'export', schema: WATCHLIST_SCHEMA, currentVersion: WATCHLIST_SCHEMA_VERSION,
     supportedVersions: WATCHLIST_EXPORT_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'reject', migration: 'normalize_to_current', writeSemantics: 'non_destructive_merge',
-    byteBudget: MAX_WATCHLIST_IMPORT_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Public version 2 and current version 3 merge non-destructively. Historical records have unknown collection quality; incomplete current checks cannot erase a usable baseline.',
+    byteBudget: MAX_WATCHLIST_PORTABLE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
+    note: 'Versions 2–5 remain readable. Version 6 preserves older membership overflow as paused, exportable records without activating or pruning domains. New active membership remains bounded. Brand contexts and incomplete-check baselines remain preserved.',
 });
 export const SHORTLIST_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.shortlist', kind: 'export', schema: SHORTLIST_SCHEMA, currentVersion: SHORTLIST_SCHEMA_VERSION,
@@ -332,7 +354,7 @@ export const SHORTLIST_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
 export const DETECTION_RULE_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.detection-rules', kind: 'export', schema: DETECTION_RULE_SCHEMA, currentVersion: DETECTION_RULE_SCHEMA_VERSION,
     supportedVersions: DETECTION_RULE_EXPORT_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
-    futureVersionBehavior: 'reject', migration: 'exact_current_only', writeSemantics: 'non_destructive_merge',
+    futureVersionBehavior: 'reject', migration: 'normalize_to_current', writeSemantics: 'non_destructive_merge',
     byteBudget: MAX_RULE_IMPORT_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
     note: 'Non-destructive rule merge; imported conditions remain allowlisted and non-executable.',
 });
@@ -421,6 +443,15 @@ const WORKSPACE_LIFECYCLE_DEFINITIONS = Object.freeze([
         itemBounds: [
             { id: 'profiles', path: 'profiles', maximum: MAX_PROFILES, handling: 'truncate' },
             { id: 'profile-values', path: 'profiles[].values', maximum: MAX_PROFILE_VALUES, handling: 'truncate' },
+            { id: 'candidate-observations', path: 'profiles[].candidateObservations', maximum: MAX_CANDIDATE_OBSERVATIONS, handling: 'truncate' },
+            { id: 'candidate-matches', path: 'profiles[].candidateObservations[].matches', maximum: MAX_CANDIDATE_MATCHES, handling: 'reject' },
+            { id: 'candidate-sources', path: 'profiles[].candidateObservations[].sources', maximum: MAX_CANDIDATE_SOURCES, handling: 'reject' },
+            { id: 'candidate-exceptions', path: 'profiles[].candidateExceptions', maximum: MAX_CANDIDATE_EXCEPTIONS, handling: 'truncate' },
+            { id: 'exception-history', path: 'profiles[].candidateExceptions[].history', maximum: MAX_CANDIDATE_EXCEPTION_HISTORY, handling: 'truncate' },
+            { id: 'keyword-campaigns', path: 'profiles[].keywordCampaigns', maximum: MAX_BRAND_KEYWORD_CAMPAIGNS, handling: 'reject' },
+            { id: 'keyword-campaign-history', path: 'profiles[].keywordCampaigns[].history', maximum: MAX_BRAND_KEYWORD_CAMPAIGN_HISTORY, handling: 'reject' },
+            { id: 'keyword-positive-terms', path: 'profiles[].keywordCampaigns[].positiveTerms', maximum: MAX_BRAND_KEYWORD_TERMS, handling: 'reject' },
+            { id: 'keyword-negative-terms', path: 'profiles[].keywordCampaigns[].negativeTerms', maximum: MAX_BRAND_KEYWORD_TERMS, handling: 'reject' },
         ],
         portable: {
             descriptor: BRAND_PROFILE_EXPORT_COMPATIBILITY,
@@ -466,14 +497,17 @@ const WORKSPACE_LIFECYCLE_DEFINITIONS = Object.freeze([
             { id: 'watchlists', path: 'watchlists', maximum: MAX_WATCHLISTS, handling: 'truncate' },
             { id: 'domains', path: 'watchlists[].results', maximum: MAX_WATCHLIST_DOMAINS, handling: 'drop_value' },
             { id: 'history', path: 'watchlists[].history', maximum: MAX_WATCHLIST_HISTORY_EVENTS, handling: 'truncate' },
+            { id: 'domain-contexts', path: 'watchlists[].domainMetadata', maximum: MAX_WATCHLIST_DOMAINS, handling: 'reject' },
+            { id: 'brand-contexts', path: 'watchlists[].domainMetadata[].contexts', maximum: MAX_WATCH_CONTEXTS, handling: 'truncate' },
         ],
         portable: {
             descriptor: WATCHLIST_EXPORT_COMPATIBILITY,
             schema: WATCHLIST_SCHEMA,
             builder: 'buildWatchlistExport',
             merger: 'mergeWatchlistStores',
-            serializerHookId: 'workspace.portable.json',
+            serializerHookId: 'workspace.portable.watchlist-json',
             indentSpaces: 2,
+            compactFallback: true,
             terminalLf: false,
         },
     },
@@ -649,6 +683,34 @@ const WORKSPACE_LIFECYCLE_DEFINITIONS = Object.freeze([
     },
 ]);
 const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
+    { id: 'workspace.browser.brand.v11', path: 'test/fixtures/workspace-lifecycle/browser-brand-v11.json', bytes: 38, sha256: 'c727cd501774f0f89a39f399a01216065b6ed7048bfed97bbcdaf10e651a7133', schema: 'whoisleuth.browser.brand-profile-store', version: 11 },
+    { id: 'workspace.portable.brand.v11', path: 'test/fixtures/workspace-lifecycle/portable-brand-v11.json', bytes: 123, sha256: 'c5023e1eebe187cf355c4fb53b7d8a755dc0ffb01a3deeb9b9dd7032007933d9', schema: 'whoisleuth.brand-profiles', version: 11 },
+    { id: 'workspace.browser.watchlist.v6', path: 'test/fixtures/workspace-lifecycle/browser-watchlist-v6.json', bytes: 76, sha256: '16df0f813b17f1765862f5c2ff41c2db9c7d6d76e75f24746aa6d75b59d3f02e', schema: 'whoisleuth.browser.watchlist-store', version: 6 },
+    { id: 'workspace.portable.watchlist.v6', path: 'test/fixtures/workspace-lifecycle/portable-watchlist-v6.json', bytes: 120, sha256: 'ced22d0d16e839e0b4625f8799eef30a776908abf3af998de6fad5b549898987', schema: 'whoisleuth.watchlists', version: 6 },
+    { id: 'workspace.browser.brand.v10', path: 'test/fixtures/workspace-lifecycle/browser-brand-v10.json', bytes: 38, sha256: 'bebf3a72ba57c06246e6169ebd9a597eb5b867508db85e1db0e3d763bc0839bc', schema: 'whoisleuth.browser.brand-profile-store', version: 10 },
+    { id: 'workspace.portable.brand.v10', path: 'test/fixtures/workspace-lifecycle/portable-brand-v10.json', bytes: 123, sha256: '85cd7c58696f8219484ac88210ad7ab4a0ad1c9798e8cb02ff6ebb3fd2c82d8a', schema: 'whoisleuth.brand-profiles', version: 10 },
+    { id: 'workspace.browser.watchlist.v5', path: 'test/fixtures/workspace-lifecycle/browser-watchlist-v5.json', bytes: 76, sha256: '11eabd20f952611307a5c84291c7892c15d3748f7ada5549813e1d705967c2c0', schema: 'whoisleuth.browser.watchlist-store', version: 5 },
+    { id: 'workspace.portable.watchlist.v5', path: 'test/fixtures/workspace-lifecycle/portable-watchlist-v5.json', bytes: 120, sha256: '732d4bda46e907bdd4d343ce36999a2787a0057029ee4dba0c4ef462f2822fed', schema: 'whoisleuth.watchlists', version: 5 },
+    {
+        id: 'workspace.browser.detection.v2', path: 'test/fixtures/workspace-lifecycle/browser-detection-v2.json',
+        bytes: 34, sha256: '2db6ae8eb9d24cb86924a7020c6f3eebfa41b5fc5848a53e239465db622c2312',
+        schema: 'whoisleuth.browser.detection-rule-store', version: 2,
+    },
+    {
+        id: 'workspace.portable.detection.v2', path: 'test/fixtures/workspace-lifecycle/portable-detection-v2.json',
+        bytes: 293, sha256: 'bf4409e18ef0b721f5a7e2f14a06f2fada88287114ec17775fef42e7ed38072a',
+        schema: 'whoisleuth.detection-rules', version: 2,
+    },
+    {
+        id: 'workspace.browser.bulk.v7', path: 'test/fixtures/workspace-lifecycle/browser-bulk-v7.json',
+        bytes: 77, sha256: '6b02cbd48a939a34d8f292da2b6bc8e8b59f3ed1b9c106a8e9e271ec0e949459',
+        schema: 'whoisleuth.browser.bulk-session-store', version: 7,
+    },
+    {
+        id: 'workspace.portable.bulk.v7', path: 'test/fixtures/workspace-lifecycle/portable-bulk-v7.json',
+        bytes: 338, sha256: 'f7e14d866eeb4e94b5390086e278348bfa0610ace72776fee4fbf24871ab3393',
+        schema: 'whoisleuth.bulk-sessions', version: 7,
+    },
     {
         id: 'workspace.browser.watchlist.v4', path: 'test/fixtures/workspace-lifecycle/browser-watchlist-v4.json',
         bytes: 76, sha256: '059930ee54d1bc65ac68ef6d3a8ac8cd8e53f682fe9a857512e2b6c57e93d5fe',
@@ -1146,6 +1208,13 @@ const WORKSPACE_LIFECYCLE_HOOKS = Object.freeze([
         module: WORKSPACE_CONTRACT_OWNER,
         exportName: 'serialiseWorkspacePortableJson',
     },
+    {
+        id: 'workspace.portable.watchlist-json',
+        role: 'serialiser',
+        runtime: 'shared',
+        module: 'packages/workspace/watchlist-store.mts',
+        exportName: 'serializeWatchlistExport',
+    },
     {
         id: 'workspace.portable.json-line',
         role: 'serialiser',
@@ -1254,6 +1323,7 @@ function workspacePortableSerialisation(definition) {
             encoding: 'utf-8',
             bom: false,
             indentSpaces: definition.portable.indentSpaces,
+            ...(definition.portable.compactFallback ? { compactFallback: true } : {}),
             terminalLf: definition.portable.terminalLf,
             propertyOrder: 'normalised_fixed',
             canonicalisation: null,

package/packages/evidence/collection-quality.mjs

@@ -35,7 +35,7 @@ export function webCollectionQualityForCapture(value, depth) {
         return capturedWebCollectionQuality('not_collected', 'not_collected');
     return normalizeWebCollectionQuality(value) ?? capturedWebCollectionQuality('unknown', 'unknown');
 }
-const PAGE_FIELDS = new Set(['activityStatus', 'pageTitle', 'hasPasswordField', 'hasExternalFormAction', 'phishingLanguageMatch', 'pageBaselineMatch']);
+const PAGE_FIELDS = new Set(['activityStatus', 'pageTitle', 'hasPasswordField', 'hasExternalFormAction', 'hasExternalPasswordForm', 'phishingLanguageMatch', 'pageBaselineMatch']);
 const FAVICON_FIELDS = new Set(['faviconHash', 'faviconPHash', 'faviconMatch', 'faviconNearMatch']);
 const COMBINED_FIELDS = new Set(['riskScore', 'riskFactors', 'riskModelVersion', 'opportunityScore', 'opportunityFactors', 'reusesOfficialAssets']);
 /** Missing historical quality never proves that a false/null value was observed. */

package/packages/evidence/credential-form-attribution.mjs

@@ -0,0 +1,60 @@
+export const CREDENTIAL_CATEGORY_NAMES = ['password', 'email', 'username', 'one_time_code', 'payment'];
+export const MAX_CREDENTIAL_FORMS = 50;
+export const MAX_CREDENTIAL_INPUTS = 500;
+export const MAX_FORM_DESTINATIONS = 10;
+function record(value) {
+    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+function keys(value, expected) {
+    return Object.keys(value).length === expected.length && expected.every(key => Object.hasOwn(value, key));
+}
+const count = (value, max) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && value <= max;
+export function validCredentialFormAttribution(value) {
+    if (!record(value) || !keys(value, ['complete', 'unassociatedInputs', 'forms']) || typeof value.complete !== 'boolean'
+        || !count(value.unassociatedInputs, MAX_CREDENTIAL_INPUTS) || !Array.isArray(value.forms) || value.forms.length > MAX_CREDENTIAL_FORMS)
+        return false;
+    let classified = 0;
+    for (const [index, form] of value.forms.entries()) {
+        if (!record(form) || !keys(form, ['index', 'categories', 'destinations']) || form.index !== index + 1
+            || !record(form.categories) || !keys(form.categories, CREDENTIAL_CATEGORY_NAMES)
+            || !CREDENTIAL_CATEGORY_NAMES.every(key => count(form.categories[key], MAX_CREDENTIAL_INPUTS))
+            || !Array.isArray(form.destinations) || !form.destinations.length || form.destinations.length > MAX_FORM_DESTINATIONS)
+            return false;
+        classified += Math.max(...CREDENTIAL_CATEGORY_NAMES.map(key => Number(form.categories[key])));
+        const seen = new Set();
+        for (const destination of form.destinations) {
+            if (!record(destination) || !keys(destination, ['relationship', 'origin']))
+                return false;
+            if (destination.relationship === 'unknown' || destination.relationship === 'no_submission') {
+                if (destination.origin !== null || (destination.relationship === 'unknown' && value.complete))
+                    return false;
+            }
+            else if (destination.relationship === 'external' || destination.relationship === 'same_origin') {
+                if (typeof destination.origin !== 'string' || destination.origin.length > 320)
+                    return false;
+                try {
+                    const url = new URL(destination.origin);
+                    if (!['http:', 'https:'].includes(url.protocol) || url.origin !== destination.origin || url.username || url.password)
+                        return false;
+                }
+                catch {
+                    return false;
+                }
+            }
+            else
+                return false;
+            const identity = `${destination.relationship}:${destination.origin}`;
+            if (seen.has(identity))
+                return false;
+            seen.add(identity);
+        }
+    }
+    return classified + value.unassociatedInputs <= MAX_CREDENTIAL_INPUTS && (!value.complete || value.unassociatedInputs === 0);
+}
+export function externalPasswordFormObservation(value) {
+    if (!validCredentialFormAttribution(value))
+        return null;
+    if (value.forms.some(form => form.categories.password > 0 && form.destinations.some(destination => destination.relationship === 'external')))
+        return true;
+    return value.complete ? false : null;
+}

package/packages/evidence/image-regions.mjs

@@ -5,6 +5,21 @@ export const MAX_EVIDENCE_IMAGE_PIXELS = 16 * 1024 * 1024;
 export const MAX_EVIDENCE_IMAGE_DIMENSION = 10_000;
 // Each selected region emits at most four solid rectangles; no nested effects.
 export const MAX_EVIDENCE_IMAGE_REGIONS = 64;
+export function readImageDerivationDeclaration(raw) {
+    const value = exact(raw, ['method', 'source', 'operations'], 'Image derivation declaration');
+    if (value.method !== 'png-regions-v1')
+        throw new TypeError('This image derivation method is unsupported.');
+    const operations = Array.from(array(value.operations, 'Image operations', 2, 1), operation => enumeration(operation, ['redact', 'outline'], 'Image operation'));
+    if (new Set(operations).size !== operations.length)
+        throw new TypeError('Image operations must be unique.');
+    return Object.freeze({ method: value.method, source: readRetainedFileReference(value.source), operations: Object.freeze(operations) });
+}
+/** Retain the immediate parent's fingerprint, without identifiers or region coordinates. */
+export function declareImageDerivation(raw) {
+    const derivation = readImageDerivation(raw);
+    const operations = ['redact', 'outline'].filter(kind => derivation.plan.regions.some(region => region.kind === kind));
+    return readImageDerivationDeclaration({ method: derivation.method, source: derivation.source, operations });
+}
 export function readEvidenceImageDimensions(width, height) {
     const result = {
         width: integer(width, 'Image width', 1, MAX_EVIDENCE_IMAGE_DIMENSION),

package/packages/evidence/record-identity.mjs

@@ -1,6 +1,7 @@
 // Shared collision-resistant identities for bounded, already normalised records.
 // Platform cryptography remains the owner of signatures and authentication.
 export const MAX_IDENTITY_DIGEST_BYTES = 1024 * 1024;
+export const MAX_INCREMENTAL_DIGEST_BYTES = 256 * 1024 * 1024;
 const SHA256_CONSTANTS = Object.freeze([
     0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
     0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
@@ -14,27 +15,21 @@ const SHA256_CONSTANTS = Object.freeze([
 function rotateRight(value, bits) {
     return (value >>> bits) | (value << (32 - bits));
 }
-export function sha256IdentityHex(bytes) {
-    if (bytes.byteLength > MAX_IDENTITY_DIGEST_BYTES)
-        throw new RangeError('Record identity exceeds its byte limit.');
-    // This digest is a collision-resistant record identity, not a password,
-    // signature, MAC, or substitute for the platform cryptography used there.
-    const paddedLength = Math.ceil((bytes.byteLength + 9) / 64) * 64;
-    const padded = new Uint8Array(paddedLength);
-    padded.set(bytes);
-    padded[bytes.byteLength] = 0x80;
-    const view = new DataView(padded.buffer);
-    const bitLength = bytes.byteLength * 8;
-    view.setUint32(paddedLength - 8, Math.floor(bitLength / 0x1_0000_0000), false);
-    view.setUint32(paddedLength - 4, bitLength >>> 0, false);
+/** Incremental content identity only; never authentication or publisher proof. */
+export function createIncrementalSha256(maximumBytes = MAX_IDENTITY_DIGEST_BYTES) {
+    if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 0 || maximumBytes > MAX_INCREMENTAL_DIGEST_BYTES)
+        throw new RangeError('Content identity has an invalid byte limit.');
     const state = new Uint32Array([
         0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
         0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
     ]);
     const words = new Uint32Array(64);
-    for (let offset = 0; offset < paddedLength; offset += 64) {
+    const pending = new Uint8Array(64);
+    let pendingBytes = 0, totalBytes = 0, finished = false;
+    function block(bytes, offset) {
+        const view = new DataView(bytes.buffer, bytes.byteOffset + offset, 64);
         for (let index = 0; index < 16; index += 1)
-            words[index] = view.getUint32(offset + index * 4, false);
+            words[index] = view.getUint32(index * 4, false);
         for (let index = 16; index < 64; index += 1) {
             const left = words[index - 15];
             const right = words[index - 2];
@@ -68,5 +63,54 @@ export function sha256IdentityHex(bytes) {
         state[6] = (state[6] + g) >>> 0;
         state[7] = (state[7] + h) >>> 0;
     }
-    return [...state].map((value) => value.toString(16).padStart(8, '0')).join('');
+    return Object.freeze({
+        update(bytes) {
+            if (finished)
+                throw new Error('Content identity is already finalised.');
+            if (!(bytes instanceof Uint8Array) || bytes.byteLength > maximumBytes - totalBytes)
+                throw new RangeError('Content identity exceeds its byte limit.');
+            totalBytes += bytes.byteLength;
+            let offset = 0;
+            if (pendingBytes) {
+                const length = Math.min(64 - pendingBytes, bytes.byteLength);
+                pending.set(bytes.subarray(0, length), pendingBytes);
+                pendingBytes += length;
+                offset += length;
+                if (pendingBytes === 64) {
+                    block(pending, 0);
+                    pendingBytes = 0;
+                }
+            }
+            while (offset + 64 <= bytes.byteLength) {
+                block(bytes, offset);
+                offset += 64;
+            }
+            if (offset < bytes.byteLength) {
+                pending.set(bytes.subarray(offset), 0);
+                pendingBytes = bytes.byteLength - offset;
+            }
+        },
+        digestHex() {
+            if (finished)
+                throw new Error('Content identity is already finalised.');
+            finished = true;
+            const padding = new Uint8Array(pendingBytes < 56 ? 64 : 128);
+            padding.set(pending.subarray(0, pendingBytes));
+            padding[pendingBytes] = 0x80;
+            const view = new DataView(padding.buffer), bits = totalBytes * 8;
+            view.setUint32(padding.length - 8, Math.floor(bits / 0x1_0000_0000), false);
+            view.setUint32(padding.length - 4, bits >>> 0, false);
+            block(padding, 0);
+            if (padding.length === 128)
+                block(padding, 64);
+            return [...state].map(value => value.toString(16).padStart(8, '0')).join('');
+        },
+    });
+}
+export function sha256IdentityHex(bytes) {
+    if (bytes.byteLength > MAX_IDENTITY_DIGEST_BYTES)
+        throw new RangeError('Record identity exceeds its byte limit.');
+    const digest = createIncrementalSha256();
+    digest.update(bytes);
+    return digest.digestHex();
 }

package/packages/evidence/technology-evidence-role.mjs

@@ -0,0 +1,51 @@
+const TECHNOLOGY_EVIDENCE_ROLE_ORDER = Object.freeze([
+    'observed_edge',
+    'application_platform',
+    'framework_runtime',
+    'embedded_dependency',
+]);
+const TECHNOLOGY_EVIDENCE_ROLE_SET = new Set(TECHNOLOGY_EVIDENCE_ROLE_ORDER);
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function technologyEvidenceRoles(value) {
+    const finding = record(value);
+    const roles = new Set();
+    let hasExplicitRole = false;
+    for (const role of Array.isArray(finding.roles) ? finding.roles.slice(0, 4) : []) {
+        if (typeof role === 'string' && TECHNOLOGY_EVIDENCE_ROLE_SET.has(role)) {
+            roles.add(role);
+            hasExplicitRole = true;
+        }
+    }
+    const evidenceValues = Array.isArray(finding.evidence) ? finding.evidence.slice(0, 4) : [];
+    for (const evidenceValue of evidenceValues) {
+        const evidence = record(evidenceValue);
+        if (typeof evidence.role === 'string'
+            && TECHNOLOGY_EVIDENCE_ROLE_SET.has(evidence.role)) {
+            roles.add(evidence.role);
+            hasExplicitRole = true;
+        }
+    }
+    if (!hasExplicitRole) {
+        const resourceOriginOnly = evidenceValues.length > 0
+            && evidenceValues.every((evidence) => (String(record(evidence).source).toLowerCase() === 'resource origin'));
+        if (evidenceValues.some((evidence) => String(record(evidence).source).toLowerCase() === 'resource origin')) {
+            roles.add('embedded_dependency');
+        }
+        if (!resourceOriginOnly) {
+            const category = String(finding.category).toLowerCase();
+            if (category === 'delivery platform')
+                roles.add('observed_edge');
+            else if (['application runtime', 'web framework', 'static site generator', 'web server'].includes(category)) {
+                roles.add('framework_runtime');
+            }
+            else
+                roles.add('application_platform');
+        }
+    }
+    return TECHNOLOGY_EVIDENCE_ROLE_ORDER.filter((role) => roles.has(role));
+}
+export { TECHNOLOGY_EVIDENCE_ROLE_ORDER, technologyEvidenceRoles, };

package/packages/interchange/external-findings-import.mjs

@@ -7,6 +7,7 @@ import { sha256IdentityHex } from "../evidence/record-identity.mjs";
 import { MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_VALUE_LENGTH, MAX_RESPONSE_LIMITATION_LENGTH, normalizeCaseEvidencePins, normalizeCaseSightings, } from "../cases/case-response-model.mjs";
 import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDING_LIMITATIONS, MAX_EXTERNAL_FINDING_LIMITATION_LENGTH, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, } from "../contracts/external-observation-interchange.mjs";
 import { hasUnsafeRetainedText } from "./retained-text.mjs";
+import { readInfrastructureObservation } from "../investigation/infrastructure-observation.mjs";
 export { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDING_LIMITATIONS, MAX_EXTERNAL_FINDING_LIMITATION_LENGTH, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, };
 export const EXTERNAL_FINDING_CATEGORIES = [
     'certificate',
@@ -33,6 +34,7 @@ const FINDING_KEYS = new Set([
     'limitations',
     'reference',
     'structuredObservation',
+    'infrastructureObservation',
 ]);
 const STRUCTURED_OBSERVATION_KEYS = new Set([
     'sourceSchema',
@@ -191,8 +193,8 @@ export function parseExternalFindingsDocument(value) {
         throw new Error('External findings must use the documented object shape without additional top-level fields.');
     }
     if (root.schema !== EXTERNAL_FINDINGS_SCHEMA
-        || root.schemaVersion !== EXTERNAL_FINDINGS_VERSION) {
-        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version ${EXTERNAL_FINDINGS_VERSION}.`);
+        || (root.schemaVersion !== 4 && root.schemaVersion !== 5)) {
+        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version 4 or 5.`);
     }
     const sourceValue = record(root.source);
     if (!sourceValue || !hasOnlyKeys(sourceValue, SOURCE_KEYS)) {
@@ -207,6 +209,7 @@ export function parseExternalFindingsDocument(value) {
         throw new Error(`External findings must contain between 1 and ${MAX_EXTERNAL_FINDINGS} findings.`);
     }
     const normalized = [];
+    let retainedBytes = new TextEncoder().encode(JSON.stringify({ schema: root.schema, schemaVersion: root.schemaVersion, source, findings: [] })).byteLength + 1;
     const seen = new Set();
     const domainCounts = new Map();
     for (const [index, raw] of root.findings.entries()) {
@@ -228,7 +231,7 @@ export function parseExternalFindingsDocument(value) {
         if (evidenceClass !== 'deployment_observation' && evidenceClass !== 'provider_report') {
             throw new Error(`Finding ${index + 1} evidence class is unsupported.`);
         }
-        const finding = {
+        let finding = {
             domain,
             category: item.category,
             evidenceClass,
@@ -239,6 +242,21 @@ export function parseExternalFindingsDocument(value) {
             reference: optionalText(item.reference, 500, `Finding ${index + 1} reference`),
             structuredObservation: structuredObservation(item.structuredObservation, index),
         };
+        if (Object.hasOwn(item, 'infrastructureObservation')) {
+            if (root.schemaVersion !== 5)
+                throw new TypeError('Infrastructure observations require external-findings version 5.');
+            const infrastructureObservation = readInfrastructureObservation(item.infrastructureObservation);
+            if (infrastructureObservation.target !== domain || infrastructureObservation.observedAt !== finding.observedAt)
+                throw new TypeError('Infrastructure snapshot must match its finding target and observation time.');
+            if (finding.structuredObservation)
+                throw new TypeError('Infrastructure snapshots cannot also declare a single structured observation.');
+            finding = { ...finding, infrastructureObservation };
+        }
+        if (root.schemaVersion === 5) {
+            retainedBytes += new TextEncoder().encode(JSON.stringify(finding)).byteLength + 1;
+            if (retainedBytes > MAX_EXTERNAL_FINDINGS_IMPORT_BYTES)
+                throw new TypeError('External findings exceed the retained aggregate byte bound.');
+        }
         const key = findingKey(finding, source.name);
         if (seen.has(key))
             continue;
@@ -257,12 +275,14 @@ export function parseExternalFindingsDocument(value) {
         throw new Error('External findings did not contain a unique valid finding.');
     return {
         schema: EXTERNAL_FINDINGS_SCHEMA,
-        schemaVersion: EXTERNAL_FINDINGS_VERSION,
+        schemaVersion: root.schemaVersion,
         source,
         findings: normalized,
     };
 }
 export function serializeExternalFindingsDocument(value) {
+    if (record(value)?.schemaVersion === 5)
+        return `${JSON.stringify(parseExternalFindingsDocument(value))}\n`;
     const serialised = JSON.stringify(value, null, 2);
     if (typeof serialised !== 'string') {
         throw new TypeError('External findings must be JSON-serialisable.');
@@ -294,6 +314,12 @@ function alreadyRetained(recordValue, projection) {
     });
 }
 function structuredPinFields(finding) {
+    if (finding.infrastructureObservation)
+        return {
+            field: 'infrastructure.snapshot', category: 'infrastructure',
+            sourceSchema: { collection: 'external_observations', schema: finding.infrastructureObservation.schema, version: finding.infrastructureObservation.version },
+            infrastructureObservation: finding.infrastructureObservation,
+        };
     const observation = finding.structuredObservation;
     if (!observation)
         return {};
@@ -348,6 +374,7 @@ export function externalFindingCaseProjection(finding, source) {
     const omittedLimitations = finding.limitations.filter((item) => !sourceLimitations.includes(item)).length;
     const pin = normalizeCaseEvidencePins([{
             ...structuredPinFields(finding),
+            observationHostname: finding.domain,
             importContentSha256: identitySha256,
             label: `External ${finding.category} finding`,
             value,
@@ -428,17 +455,6 @@ export function mergeExternalFindingsIntoCases(current, document, now = new Date
         duplicatesSkipped,
     };
 }
-function targetedFinding(finding, caseDomain) {
-    if (finding.domain === caseDomain)
-        return finding;
-    const prefix = `Captured hostname ${finding.domain}. `;
-    const maximumSummaryLength = MAX_EXTERNAL_FINDING_SUMMARY_LENGTH;
-    const remaining = maximumSummaryLength - prefix.length;
-    const summary = remaining > 1 && finding.summary.length > remaining
-        ? `${prefix}${finding.summary.slice(0, remaining - 1).trimEnd()}…`
-        : `${prefix}${finding.summary}`;
-    return { ...finding, domain: caseDomain, summary };
-}
 export function externalFindingsCaseTargets(document, caseDomain) {
     if (canonicalRegistrableDomain(caseDomain) !== caseDomain) {
         throw new Error('The selected Case does not have a canonical registrable-domain identity.');
@@ -468,8 +484,7 @@ export function mergeExternalFindingsIntoCase(current, caseId, document, now = n
     let record = selected;
     let findingsAdded = 0;
     let duplicatesSkipped = 0;
-    for (const original of document.findings) {
-        const finding = targetedFinding(original, selected.domain);
+    for (const finding of document.findings) {
         const merged = mergeExternalFindingIntoCase(cases, selected.id, finding, document.source, now);
         cases = merged.cases;
         record = merged.record;

package/packages/interchange/json-output.mjs

@@ -0,0 +1,14 @@
+const TERMINAL_UNSAFE_JSON_RE = /[\u007f-\u009f\u2028\u2029]|\p{Default_Ignorable_Code_Point}/gu;
+function jsonUnicodeEscape(value) {
+    const codePoint = value.codePointAt(0);
+    if (codePoint <= 0xffff)
+        return `\\u${codePoint.toString(16).padStart(4, '0')}`;
+    const offset = codePoint - 0x10000;
+    const high = 0xd800 + (offset >> 10);
+    const low = 0xdc00 + (offset & 0x3ff);
+    return `\\u${high.toString(16).padStart(4, '0')}\\u${low.toString(16).padStart(4, '0')}`;
+}
+/** Escape display controls without changing the parsed JSON values. */
+export function terminalSafeJson(value, space) {
+    return JSON.stringify(value, null, space).replace(TERMINAL_UNSAFE_JSON_RE, jsonUnicodeEscape);
+}