@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/frontend/src/lib/analysis/comparison-ledger-json.js

@@ -0,0 +1,79 @@
+const MAX_COLLECTION_SCAN = 256;
+const MAX_DEPTH = 8;
+const MAX_SCALAR_LENGTH = 2_000;
+const MAX_TRAVERSAL_NODES = 1_024;
+const MAX_SERIALISED_LENGTH = 8_192;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function boundedJsonString(value, state) {
+    if (value.length > MAX_SCALAR_LENGTH)
+        state.truncated = true;
+    return JSON.stringify(value.slice(0, MAX_SCALAR_LENGTH));
+}
+function stableJson(value, depth, state) {
+    if (depth > MAX_DEPTH) {
+        state.truncated = true;
+        return '"[bounded depth]"';
+    }
+    if (state.nodes >= MAX_TRAVERSAL_NODES) {
+        state.truncated = true;
+        return '"[bounded traversal]"';
+    }
+    state.nodes += 1;
+    if (value === null)
+        return 'null';
+    if (typeof value === 'string')
+        return boundedJsonString(value, state);
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? String(value) : 'null';
+    if (typeof value === 'boolean')
+        return value ? 'true' : 'false';
+    if (Array.isArray(value)) {
+        const values = [];
+        const limit = Math.min(value.length, MAX_COLLECTION_SCAN);
+        for (let index = 0; index < limit && state.nodes < MAX_TRAVERSAL_NODES; index += 1) {
+            values.push(stableJson(value[index], depth + 1, state));
+        }
+        if (values.length < value.length)
+            state.truncated = true;
+        return `[${values.join(',')}]`;
+    }
+    const item = record(value);
+    if (!item)
+        return 'null';
+    const keys = [];
+    for (const key in item) {
+        if (!Object.hasOwn(item, key))
+            continue;
+        if (keys.length >= MAX_COLLECTION_SCAN) {
+            state.truncated = true;
+            break;
+        }
+        keys.push(key);
+    }
+    keys.sort();
+    const values = [];
+    for (const key of keys) {
+        if (state.nodes >= MAX_TRAVERSAL_NODES) {
+            state.truncated = true;
+            break;
+        }
+        values.push(`${boundedJsonString(key, state)}:${stableJson(item[key], depth + 1, state)}`);
+    }
+    if (values.length < keys.length)
+        state.truncated = true;
+    return `{${values.join(',')}}`;
+}
+export function projectComparisonLedgerJson(value) {
+    const state = { truncated: false, nodes: 0 };
+    const serialised = stableJson(value, 0, state);
+    if (serialised.length > MAX_SERIALISED_LENGTH)
+        state.truncated = true;
+    return Object.freeze({ value: serialised.slice(0, MAX_SERIALISED_LENGTH), truncated: state.truncated });
+}
+export function stableComparisonLedgerJson(value) {
+    return projectComparisonLedgerJson(value).value;
+}

package/frontend/src/lib/analysis/comparison-ledger-serialization.js

@@ -0,0 +1,51 @@
+const CONTROL_RE = /[\u0000-\u001f\u007f]/gu;
+const MAX_ID_PARTS = 32;
+const MAX_ID_PART_LENGTH = 500;
+function stableHash(value) {
+    let first = 0x811c9dc5;
+    let second = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        first ^= code;
+        first = Math.imul(first, 0x01000193);
+        second = (second + code) | 0;
+        second = (second + (second << 10)) | 0;
+        second ^= second >>> 6;
+    }
+    second = (second + (second << 3)) | 0;
+    second ^= second >>> 11;
+    second = (second + (second << 15)) | 0;
+    return `${(first >>> 0).toString(36).padStart(7, '0')}${(second >>> 0).toString(36).padStart(7, '0')}`;
+}
+export function stableComparisonLedgerId(prefix, parts) {
+    const encoded = parts.slice(0, MAX_ID_PARTS).map((part) => {
+        let value = '';
+        try {
+            value = part === null || part === undefined || ['string', 'number', 'boolean', 'bigint'].includes(typeof part)
+                ? String(part ?? '')
+                : Object.prototype.toString.call(part);
+        }
+        catch {
+            value = '[unreadable]';
+        }
+        const bounded = value.slice(0, MAX_ID_PART_LENGTH);
+        const typed = `${typeof part}:${value.length}:${bounded}`;
+        return `${typed.length}:${typed}`;
+    }).join('');
+    const material = `${parts.length}:${encoded}`;
+    return `${prefix.slice(0, 64)}-${stableHash(material)}`;
+}
+export function safeComparisonLedgerHref(value) {
+    if (typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'boolean')
+        return '';
+    const href = String(value).replace(CONTROL_RE, ' ').replace(/\s+/gu, ' ').trim().slice(0, 500).trim();
+    if (!href.startsWith('/') || href.startsWith('//') || href.includes('\\'))
+        return '';
+    try {
+        const base = new URL('https://comparison-ledger.invalid/');
+        return new URL(href, base).origin === base.origin ? href : '';
+    }
+    catch {
+        return '';
+    }
+}

package/frontend/src/lib/analysis/domain-control-manifest-core.js

@@ -0,0 +1,145 @@
+import { canonicalArtifactJsonFor, resolveArtifactCanonicalization, SORTED_JSON_V1, SORTED_JSON_V2, } from "./artifact-integrity.js";
+import { normalizeDomain } from "./case-record-core.js";
+import { canonicalDomainControlRecordList } from "./domain-control-records.js";
+export const DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA = 'whoisleuth.domain-control-manifest-input';
+export const DOMAIN_CONTROL_PASSPORT_SCHEMA = 'whoisleuth.domain-control-manifest';
+export const DOMAIN_CONTROL_PASSPORT_VERSION = 1;
+export const DOMAIN_CONTROL_MANIFEST_VERSION = 2;
+export const MAX_DOMAIN_CONTROL_PASSPORT_ENTRIES = 100;
+export const DOMAIN_CONTROL_PASSPORT_LIMITATIONS = Object.freeze([
+    'This analyst-authored manifest records intended domain-control state. It does not collect evidence or change registrar, DNS, mail, or certificate configuration.',
+    'Empty desired fields are unconfigured rather than claims that a record should be absent.',
+]);
+const INPUT_KEYS = new Set(['schema', 'version', 'expiresAt', 'entries']);
+const MANIFEST_KEYS = new Set(['schema', 'version', 'generatedAt', 'expiresAt', 'entries', 'limitations', 'integrity']);
+const ENTRY_KEYS = new Set(['domain', 'nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock', 'renewalReviewAt', 'note']);
+const INTEGRITY_KEYS = new Set(['algorithm', 'canonicalization', 'digestSha256']);
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function exactKeys(value, allowed, label) {
+    const unknown = Object.keys(value).find((key) => !allowed.has(key));
+    if (unknown)
+        throw new TypeError(`${label} contains unknown field: ${unknown}.`);
+}
+function text(value, maximum = 300) {
+    if (typeof value !== 'string' || value.length > maximum * 4 || CONTROL_RE.test(value))
+        return null;
+    return value.replace(/\s+/gu, ' ').trim().slice(0, maximum) || null;
+}
+function timestamp(value) {
+    const candidate = text(value, 64);
+    if (!candidate)
+        return null;
+    const parsed = Date.parse(candidate);
+    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+function hostnames(value) {
+    if (!Array.isArray(value))
+        return [];
+    return [...new Set(value.slice(0, 128).flatMap((item) => {
+            const normalized = normalizeDomain(item);
+            return normalized ? [normalized] : [];
+        }))].sort().slice(0, 32);
+}
+function digest(value) {
+    const candidate = text(value, 64)?.toLowerCase() ?? '';
+    return /^[a-f0-9]{64}$/u.test(candidate) ? candidate : null;
+}
+function normalizeEntry(value) {
+    const source = record(value);
+    if (!source)
+        return null;
+    exactKeys(source, ENTRY_KEYS, 'Domain control manifest entry');
+    const domain = normalizeDomain(source.domain);
+    if (!domain)
+        return null;
+    return Object.freeze({
+        domain,
+        nameservers: Object.freeze(hostnames(source.nameservers)),
+        ds: Object.freeze(canonicalDomainControlRecordList(source.ds, 'ds')),
+        mx: Object.freeze(canonicalDomainControlRecordList(source.mx, 'mx')),
+        caa: Object.freeze(canonicalDomainControlRecordList(source.caa, 'caa')),
+        tlsIssuer: text(source.tlsIssuer, 300)?.toLowerCase() ?? null,
+        tlsSpkiSha256: digest(source.tlsSpkiSha256),
+        registrarLock: source.registrarLock === 'required' || source.registrarLock === 'not_required'
+            ? source.registrarLock
+            : null,
+        renewalReviewAt: timestamp(source.renewalReviewAt),
+        note: text(source.note, 500),
+    });
+}
+export function buildUnsignedDomainControlPassport(input, generatedAtValue) {
+    const source = record(input);
+    if (!source || source.schema !== DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA || source.version !== DOMAIN_CONTROL_PASSPORT_VERSION) {
+        throw new TypeError(`Domain control manifest input must use ${DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA} version ${DOMAIN_CONTROL_PASSPORT_VERSION}.`);
+    }
+    exactKeys(source, INPUT_KEYS, 'Domain control manifest input');
+    const generatedAt = timestamp(generatedAtValue);
+    const expiresAt = timestamp(source.expiresAt);
+    if (!generatedAt || !expiresAt || Date.parse(expiresAt) <= Date.parse(generatedAt)) {
+        throw new TypeError('Domain control manifest expiry must be a valid time after generation.');
+    }
+    if (!Array.isArray(source.entries) || source.entries.length < 1 || source.entries.length > MAX_DOMAIN_CONTROL_PASSPORT_ENTRIES) {
+        throw new TypeError(`Domain control manifest input must contain between 1 and ${MAX_DOMAIN_CONTROL_PASSPORT_ENTRIES} entries.`);
+    }
+    const entries = source.entries.map(normalizeEntry);
+    if (entries.some((entry) => entry === null))
+        throw new TypeError('Domain control manifest contains an invalid entry.');
+    const normalizedEntries = entries;
+    if (new Set(normalizedEntries.map((entry) => entry.domain)).size !== normalizedEntries.length) {
+        throw new TypeError('Domain control manifest entries must use unique domains.');
+    }
+    return Object.freeze({
+        schema: DOMAIN_CONTROL_PASSPORT_SCHEMA,
+        version: DOMAIN_CONTROL_MANIFEST_VERSION,
+        generatedAt,
+        expiresAt,
+        entries: Object.freeze([...normalizedEntries].sort((left, right) => left.domain.localeCompare(right.domain))),
+        limitations: DOMAIN_CONTROL_PASSPORT_LIMITATIONS,
+    });
+}
+export function normalizeDomainControlPassportDocument(value) {
+    const source = record(value);
+    const integrity = record(source?.integrity);
+    if (!source
+        || source.schema !== DOMAIN_CONTROL_PASSPORT_SCHEMA
+        || !integrity
+        || integrity.algorithm !== 'SHA-256'
+        || typeof integrity.digestSha256 !== 'string'
+        || !/^sha256:[a-f0-9]{64}$/u.test(integrity.digestSha256)) {
+        throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
+    }
+    exactKeys(source, MANIFEST_KEYS, 'Domain control manifest');
+    exactKeys(integrity, INTEGRITY_KEYS, 'Domain control manifest integrity');
+    const canonicalization = resolveArtifactCanonicalization(source.version, integrity.canonicalization, [
+        { version: DOMAIN_CONTROL_PASSPORT_VERSION, canonicalization: SORTED_JSON_V1, explicit: true },
+        { version: DOMAIN_CONTROL_MANIFEST_VERSION, canonicalization: SORTED_JSON_V2, explicit: true },
+    ], 'Domain control manifest');
+    if (!Array.isArray(source.limitations)
+        || source.limitations.length !== DOMAIN_CONTROL_PASSPORT_LIMITATIONS.length
+        || source.limitations.some((item, index) => item !== DOMAIN_CONTROL_PASSPORT_LIMITATIONS[index])) {
+        throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
+    }
+    const baseUnsigned = buildUnsignedDomainControlPassport({
+        schema: DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA,
+        version: DOMAIN_CONTROL_PASSPORT_VERSION,
+        expiresAt: source.expiresAt,
+        entries: source.entries,
+    }, source.generatedAt);
+    const unsigned = Object.freeze({ ...baseUnsigned, version: source.version });
+    const { integrity: _integrity, ...suppliedUnsigned } = source;
+    const canonicalUnsigned = canonicalArtifactJsonFor(unsigned, canonicalization);
+    if (canonicalArtifactJsonFor(suppliedUnsigned, canonicalization) !== canonicalUnsigned) {
+        throw new TypeError('Domain control manifest must use its canonical normalised content.');
+    }
+    return {
+        manifest: source,
+        unsigned,
+        canonicalUnsigned,
+        canonicalization,
+    };
+}

package/frontend/src/lib/analysis/domain-control-records.js

@@ -0,0 +1,88 @@
+import { normalizeDomain } from "./case-record-core.js";
+export const MAX_CANONICAL_DOMAIN_CONTROL_RECORDS = 32;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function text(value, maximum = 500) {
+    if (typeof value !== 'string' || value.length > maximum * 4 || /[\u0000-\u001f\u007f]/u.test(value))
+        return '';
+    return value.replace(/\s+/gu, ' ').trim().slice(0, maximum).trim();
+}
+function integer(value, maximum) {
+    const candidate = typeof value === 'number' ? value : typeof value === 'string' && /^\d+$/u.test(value.trim()) ? Number(value) : NaN;
+    return Number.isSafeInteger(candidate) && candidate >= 0 && candidate <= maximum ? candidate : null;
+}
+function exchange(value) {
+    const candidate = text(value, 253).toLowerCase();
+    if (candidate === '.')
+        return '.';
+    return normalizeDomain(candidate) ?? '';
+}
+export function canonicalMxRecord(value) {
+    const item = record(value);
+    if (Object.keys(item).length) {
+        const host = exchange(item.exchange ?? item.host ?? item.value);
+        const priority = integer(item.priority ?? item.preference, 65_535);
+        return host && priority !== null ? `${priority} ${host}` : '';
+    }
+    const candidate = text(value, 500).toLowerCase();
+    const match = /^(\d{1,5})\s+(.+)$/u.exec(candidate);
+    if (match) {
+        const priority = integer(match[1], 65_535);
+        const host = exchange(match[2]);
+        return priority !== null && host ? `${priority} ${host}` : '';
+    }
+    return exchange(candidate);
+}
+function caaValue(value) {
+    return text(value, 500).replace(/^(?:"([\s\S]*)"|'([\s\S]*)')$/u, '$1$2').trim().toLowerCase();
+}
+export function canonicalCaaRecord(value) {
+    const item = record(value);
+    if (Object.keys(item).length) {
+        const flags = integer(item.critical ?? item.flags ?? 0, 255);
+        const tag = text(item.tag, 32).toLowerCase();
+        const payload = caaValue(item.value);
+        return flags !== null && /^(?:issue|issuewild|iodef)$/u.test(tag) && payload
+            ? `${flags} ${tag} ${payload}`
+            : '';
+    }
+    const candidate = text(value, 600);
+    const match = /^(\d{1,3})\s+(issue|issuewild|iodef)\s+(.+)$/iu.exec(candidate);
+    if (!match)
+        return '';
+    const flags = integer(match[1], 255);
+    const tag = match[2]?.toLowerCase() ?? '';
+    const payload = caaValue(match[3]);
+    return flags !== null && payload ? `${flags} ${tag} ${payload}` : '';
+}
+export function canonicalDsRecord(value) {
+    const item = record(value);
+    if (Object.keys(item).length) {
+        const keyTag = integer(item.keyTag ?? item.key_tag, 65_535);
+        const algorithm = integer(item.algorithm, 255);
+        const digestType = integer(item.digestType ?? item.digest_type, 255);
+        const digest = text(item.digest, 1024).replace(/\s+/gu, '').toLowerCase();
+        return keyTag !== null && algorithm !== null && digestType !== null && /^[a-f0-9]{2,1024}$/u.test(digest)
+            ? `${keyTag} ${algorithm} ${digestType} ${digest}`
+            : '';
+    }
+    const candidate = text(value, 1200);
+    const match = /^(\d{1,5})\s+(\d{1,3})\s+(\d{1,3})\s+([a-f0-9\s]+)$/iu.exec(candidate);
+    if (!match)
+        return '';
+    return canonicalDsRecord({ keyTag: match[1], algorithm: match[2], digestType: match[3], digest: match[4] });
+}
+export function canonicalDomainControlRecordList(value, kind) {
+    if (!Array.isArray(value))
+        return [];
+    const normalizer = kind === 'mx' ? canonicalMxRecord : kind === 'caa' ? canonicalCaaRecord : canonicalDsRecord;
+    return [...new Set(value
+            .slice(0, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS * 4)
+            .map(normalizer)
+            .filter(Boolean))]
+        .sort()
+        .slice(0, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS);
+}

package/frontend/src/lib/analysis/external-findings-import.js

@@ -1,6 +1,6 @@
 import { normalizeDomain, openOrCreateCase, updateCase, } from "./case-model.js";
 export const EXTERNAL_FINDINGS_SCHEMA = 'whoisleuth.external-findings';
-export const EXTERNAL_FINDINGS_VERSION = 3;
+export const EXTERNAL_FINDINGS_VERSION = 4;
 export const MAX_EXTERNAL_FINDINGS_IMPORT_BYTES = 384 * 1024;
 export const MAX_EXTERNAL_FINDINGS = 100;
 export const MAX_EXTERNAL_FINDINGS_PER_DOMAIN = 20;
@@ -38,12 +38,18 @@ const STRUCTURED_OBSERVATION_KEYS = new Set([
     'value',
     'issuer',
     'notAfter',
+    'eventId',
+    'logId',
+    'certificateSha256',
+    'dnsNameCount',
+    'namesComplete',
 ]);
 const STRUCTURED_OBSERVATION_SCHEMAS = new Set([
     'whoisleuth.domain-observation-rows',
     'whoisleuth.dns-observation-rows',
     'whoisleuth.certificate-observation-rows',
 ]);
+const SHA256_RE = /^[a-f0-9]{64}$/u;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -86,7 +92,7 @@ function limitations(value, index) {
         unique.add(requiredText(item, 240, `Finding ${index + 1} limitation`));
     return [...unique];
 }
-function structuredObservation(value, index) {
+function structuredObservation(value, index, documentVersion) {
     if (value === undefined || value === null)
         return null;
     const item = record(value);
@@ -104,9 +110,44 @@ function structuredObservation(value, index) {
     const issuer = optionalText(item.issuer, 160, `Finding ${index + 1} certificate issuer`);
     const notAfter = iso(item.notAfter, `Finding ${index + 1} certificate expiry`, true);
     const certificateSchema = item.sourceSchema === 'whoisleuth.certificate-observation-rows';
+    if (certificateSchema && (field === 'certificateSha256' || field === 'fingerprintSha256') && !SHA256_RE.test(observationValue.toLowerCase())) {
+        throw new Error(`Finding ${index + 1} certificate observation value must be a SHA-256 hexadecimal digest.`);
+    }
     if (!certificateSchema && (issuer !== null || notAfter !== null)) {
         throw new Error(`Finding ${index + 1} non-certificate observation cannot declare certificate metadata.`);
     }
+    const declaresEventMetadata = ['eventId', 'logId', 'certificateSha256', 'dnsNameCount', 'namesComplete']
+        .some((key) => item[key] !== undefined && item[key] !== null);
+    let eventId = null;
+    let logId = null;
+    let certificateSha256 = null;
+    let dnsNameCount = null;
+    let namesComplete = null;
+    if (declaresEventMetadata) {
+        if (!certificateSchema || documentVersion < 4) {
+            throw new Error(`Finding ${index + 1} certificate-event metadata requires external-findings schema version 4.`);
+        }
+        eventId = requiredText(item.eventId, 64, `Finding ${index + 1} certificate event id`);
+        if (!/^[A-Za-z0-9_-]{1,64}$/u.test(eventId)) {
+            throw new Error(`Finding ${index + 1} certificate event id is invalid.`);
+        }
+        logId = requiredText(item.logId, 200, `Finding ${index + 1} certificate log id`);
+        certificateSha256 = requiredText(item.certificateSha256, 64, `Finding ${index + 1} certificate digest`).toLowerCase();
+        if (!SHA256_RE.test(certificateSha256)) {
+            throw new Error(`Finding ${index + 1} certificate event digest must be a SHA-256 hexadecimal digest.`);
+        }
+        if (certificateSha256 !== observationValue.toLowerCase()) {
+            throw new Error(`Finding ${index + 1} certificate event digest must match the structured observation value.`);
+        }
+        if (!Number.isSafeInteger(item.dnsNameCount) || Number(item.dnsNameCount) < 1 || Number(item.dnsNameCount) > 100) {
+            throw new Error(`Finding ${index + 1} certificate DNS name count is invalid.`);
+        }
+        dnsNameCount = Number(item.dnsNameCount);
+        if (typeof item.namesComplete !== 'boolean') {
+            throw new Error(`Finding ${index + 1} certificate name completeness is invalid.`);
+        }
+        namesComplete = item.namesComplete;
+    }
     return {
         sourceSchema: item.sourceSchema,
         sourceVersion: 1,
@@ -114,6 +155,11 @@ function structuredObservation(value, index) {
         value: observationValue,
         issuer,
         notAfter,
+        eventId,
+        logId,
+        certificateSha256,
+        dnsNameCount,
+        namesComplete,
     };
 }
 function findingKey(finding, sourceName) {
@@ -125,6 +171,7 @@ function findingKey(finding, sourceName) {
         finding.observedAt,
         finding.completeness,
         sourceName,
+        finding.structuredObservation?.eventId ?? '',
     ].join('\u0000');
 }
 export function parseExternalFindingsDocument(value) {
@@ -133,8 +180,8 @@ export function parseExternalFindingsDocument(value) {
         throw new Error('External findings must use the documented object shape without additional top-level fields.');
     }
     if (root.schema !== EXTERNAL_FINDINGS_SCHEMA
-        || ![1, 2, EXTERNAL_FINDINGS_VERSION].includes(Number(root.schemaVersion))) {
-        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version 1, 2, or ${EXTERNAL_FINDINGS_VERSION}.`);
+        || ![1, 2, 3, EXTERNAL_FINDINGS_VERSION].includes(Number(root.schemaVersion))) {
+        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version 1, 2, 3, or ${EXTERNAL_FINDINGS_VERSION}.`);
     }
     const sourceValue = record(root.source);
     if (!sourceValue || !hasOnlyKeys(sourceValue, SOURCE_KEYS)) {
@@ -181,7 +228,7 @@ export function parseExternalFindingsDocument(value) {
             completeness: item.completeness,
             limitations: limitations(item.limitations, index),
             reference: optionalText(item.reference, 500, `Finding ${index + 1} reference`),
-            structuredObservation: structuredObservation(item.structuredObservation, index),
+            structuredObservation: structuredObservation(item.structuredObservation, index, Number(root.schemaVersion)),
         };
         const key = findingKey(finding, source.name);
         if (seen.has(key))
@@ -229,12 +276,28 @@ function existingPinKey(recordValue, finding, sourceName) {
         && (!observation || (pin.field === observation.field
             && pin.sourceSchema?.collection === 'external_observations'
             && pin.sourceSchema.schema === observation.sourceSchema
-            && pin.sourceSchema.version === observation.sourceVersion)))) ? findingKey(finding, sourceName) : '';
+            && pin.sourceSchema.version === observation.sourceVersion
+            && (observation.eventId === null || pin.certificateObservation?.eventId === observation.eventId))))) ? findingKey(finding, sourceName) : '';
 }
 function structuredPinFields(finding) {
     const observation = finding.structuredObservation;
     if (!observation)
         return {};
+    const certificateObservation = observation.eventId
+        && observation.logId
+        && observation.certificateSha256
+        && observation.dnsNameCount !== null
+        && observation.namesComplete !== null
+        ? {
+            eventId: observation.eventId,
+            logId: observation.logId,
+            certificateSha256: observation.certificateSha256,
+            issuer: observation.issuer,
+            notAfter: observation.notAfter,
+            dnsNameCount: observation.dnsNameCount,
+            namesComplete: observation.namesComplete,
+        }
+        : null;
     return {
         field: observation.field,
         category: finding.category,
@@ -243,6 +306,7 @@ function structuredPinFields(finding) {
             schema: observation.sourceSchema,
             version: observation.sourceVersion,
         },
+        certificateObservation,
     };
 }
 export function mergeExternalFindingsIntoCases(current, document, now = new Date().toISOString()) {

package/frontend/src/lib/analysis/investigation-capsule.js

@@ -1,6 +1,7 @@
-import { canonicalArtifactJson, sha256ArtifactDigest } from "./artifact-integrity.js";
+import { canonicalArtifactJson, canonicalArtifactJsonV2, sha256ArtifactDigest, sha256ArtifactDigestV2, SORTED_JSON_V2, } from "./artifact-integrity.js";
 export const INVESTIGATION_CAPSULE_SCHEMA = 'whoisleuth.investigation-capsule';
-export const INVESTIGATION_CAPSULE_VERSION = 1;
+export const INVESTIGATION_CAPSULE_VERSION = 2;
+export const LEGACY_INVESTIGATION_CAPSULE_VERSION = 1;
 function safeVersion(value) {
     return typeof value === 'string' && /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u.test(value)
         ? value
@@ -46,14 +47,14 @@ function analystProjection(record) {
 export async function buildInvestigationCapsule(input) {
     const analystRecords = input.includeAnalystRecords ? analystProjection(input.caseRecord) : null;
     const [evidenceDigest, briefDigest, graphDigest, analystRecordsDigest] = await Promise.all([
-        sha256ArtifactDigest(input.lookupEvidence),
-        sha256ArtifactDigest(input.brief),
-        sha256ArtifactDigest(input.graph),
-        analystRecords ? sha256ArtifactDigest(analystRecords) : Promise.resolve(null),
+        sha256ArtifactDigestV2(input.lookupEvidence),
+        sha256ArtifactDigestV2(input.brief),
+        sha256ArtifactDigestV2(input.graph),
+        analystRecords ? sha256ArtifactDigestV2(analystRecords) : Promise.resolve(null),
     ]);
     const evidenceSchema = safeSchema(input.lookupEvidence.schema);
     const evidenceVersion = safeSchemaVersion(input.lookupEvidence.schemaVersion);
-    return {
+    const unsigned = {
         schema: INVESTIGATION_CAPSULE_SCHEMA,
         schemaVersion: INVESTIGATION_CAPSULE_VERSION,
         generatedAt: iso(input.generatedAt),
@@ -70,7 +71,6 @@ export async function buildInvestigationCapsule(input) {
         investigationBrief: input.brief,
         graphSnapshot: input.graph,
         analystRecords,
-        integrity: { algorithm: 'SHA-256', briefDigest, graphDigest, analystRecordsDigest },
         limitations: [
             'The Lookup evidence file is linked by digest but is not embedded; keep or share that exact file separately when verification is required.',
             'Digest verification can detect changed content but does not establish who created the capsule. No digital signature is applied.',
@@ -80,12 +80,36 @@ export async function buildInvestigationCapsule(input) {
                 : 'Analyst decisions, assertions, notes, contacts, actions, and raw source payloads are excluded.',
         ],
     };
+    return {
+        ...unsigned,
+        integrity: {
+            algorithm: 'SHA-256',
+            canonicalization: SORTED_JSON_V2,
+            scope: 'capsule excluding integrity',
+            briefDigest,
+            graphDigest,
+            analystRecordsDigest,
+            digestSha256: await sha256ArtifactDigestV2(unsigned),
+        },
+    };
 }
 export async function verifyInvestigationCapsule(capsule) {
+    const current = capsule.schemaVersion === INVESTIGATION_CAPSULE_VERSION;
+    const legacy = capsule.schemaVersion === LEGACY_INVESTIGATION_CAPSULE_VERSION;
+    const integrityRecord = capsule.integrity;
+    if ((!current && !legacy)
+        || (current && (integrityRecord.canonicalization !== SORTED_JSON_V2
+            || integrityRecord.scope !== 'capsule excluding integrity'))
+        || (legacy && (Object.hasOwn(integrityRecord, 'canonicalization')
+            || Object.hasOwn(integrityRecord, 'scope')
+            || Object.hasOwn(integrityRecord, 'digestSha256')))) {
+        return { valid: false, brief: false, graph: false, analystRecords: null, whole: current ? false : null };
+    }
+    const projectionDigest = current ? sha256ArtifactDigestV2 : sha256ArtifactDigest;
     const [briefDigest, graphDigest, analystRecordsDigest] = await Promise.all([
-        sha256ArtifactDigest(capsule.investigationBrief),
-        sha256ArtifactDigest(capsule.graphSnapshot),
-        capsule.analystRecords ? sha256ArtifactDigest(capsule.analystRecords) : Promise.resolve(null),
+        projectionDigest(capsule.investigationBrief),
+        projectionDigest(capsule.graphSnapshot),
+        capsule.analystRecords ? projectionDigest(capsule.analystRecords) : Promise.resolve(null),
     ]);
     const brief = briefDigest === capsule.integrity.briefDigest;
     const graph = graphDigest === capsule.integrity.graphDigest;
@@ -94,12 +118,22 @@ export async function verifyInvestigationCapsule(capsule) {
         : capsule.integrity.analystRecordsDigest === null
             ? null
             : false;
-    return { valid: brief && graph && analystRecords !== false, brief, graph, analystRecords };
+    let whole = null;
+    if (current) {
+        const { integrity, ...unsigned } = capsule;
+        whole = integrity.algorithm === 'SHA-256'
+            && integrity.canonicalization === SORTED_JSON_V2
+            && integrity.scope === 'capsule excluding integrity'
+            && integrity.digestSha256 === await sha256ArtifactDigestV2(unsigned);
+    }
+    return { valid: brief && graph && analystRecords !== false && whole !== false, brief, graph, analystRecords, whole };
 }
 export function investigationCapsuleFilename(capsule) {
     const target = capsule.target.value.toLowerCase().replace(/[^a-z0-9.-]+/gu, '-').replace(/^-|-$/gu, '').slice(0, 80) || 'lookup';
     return `whoisleuth-investigation-capsule-${target}-${capsule.generatedAt.slice(0, 10)}.json`;
 }
 export function serializeInvestigationCapsule(capsule) {
-    return `${canonicalArtifactJson(capsule)}\n`;
+    return `${capsule.schemaVersion === INVESTIGATION_CAPSULE_VERSION
+        ? canonicalArtifactJsonV2(capsule)
+        : canonicalArtifactJson(capsule)}\n`;
 }