@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/cli/evidence-command-runner.mjs

@@ -1,11 +1,10 @@
-import { createReadStream } from 'node:fs';
 import { MAX_OFFLINE_ARTIFACT_BYTES, MAX_OFFLINE_PASSPHRASE_FILE_BYTES, } from "./artifact-verify.mjs";
 import { formatArchiveInspection, inspectWorkspaceArchive, } from "./archive-inspect.mjs";
 import { MAX_SIGNING_KEY_FILE_BYTES, formatEvidenceSignatureVerification, signEvidencePackage, verifyEvidencePackageSignature, } from "./evidence-signing.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 import { formatJsonDocument } from "./formatters/json.mjs";
-import { readSavedLookupInputBounded, } from "./saved-lookup.mjs";
+import { readCliTextInput } from "./input.mjs";
 export function isEvidenceCommand(args) {
     return args.action === 'inspect-archive'
         || args.action === 'sign-artifact'
@@ -22,11 +21,10 @@ async function readArtifact(source, label, dependencies) {
     try {
         return dependencies.readArtifactInput
             ? await dependencies.readArtifactInput(source)
-            : await readSavedLookupInputBounded(source
-                ? createReadStream(source, { highWaterMark: 64 * 1024 })
-                : dependencies.stdin, {
-                limit: MAX_OFFLINE_ARTIFACT_BYTES,
+            : await readCliTextInput(source, dependencies.stdin, {
+                maximumBytes: MAX_OFFLINE_ARTIFACT_BYTES,
                 label,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
             });
     }
     catch (error) {
@@ -35,11 +33,15 @@ async function readArtifact(source, label, dependencies) {
         throw new CliUsageError(`Could not read ${label.toLowerCase()}: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
     }
 }
-async function readKey(source, label, injected) {
+async function readKey(source, label, injected, dependencies) {
     try {
         return injected
             ? await injected(source)
-            : await readSavedLookupInputBounded(createReadStream(source, { highWaterMark: MAX_SIGNING_KEY_FILE_BYTES }), { limit: MAX_SIGNING_KEY_FILE_BYTES, label });
+            : await readCliTextInput(source, dependencies.stdin, {
+                maximumBytes: MAX_SIGNING_KEY_FILE_BYTES,
+                label,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+            });
     }
     catch (error) {
         if (error instanceof CliUsageError)
@@ -50,7 +52,11 @@ async function readKey(source, label, injected) {
 async function readPassphrase(source, dependencies) {
     const passphraseText = dependencies.readPassphraseFile
         ? await dependencies.readPassphraseFile(source)
-        : await readSavedLookupInputBounded(createReadStream(source, { highWaterMark: MAX_OFFLINE_PASSPHRASE_FILE_BYTES }), { limit: MAX_OFFLINE_PASSPHRASE_FILE_BYTES, label: 'Passphrase file' });
+        : await readCliTextInput(source, dependencies.stdin, {
+            maximumBytes: MAX_OFFLINE_PASSPHRASE_FILE_BYTES,
+            label: 'Passphrase file',
+            ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+        });
     const passphrase = passphraseText.replace(/\r?\n$/u, '');
     if (!passphrase || /[\r\n\u0000]/u.test(passphrase)) {
         throw new CliUsageError('Passphrase file must contain exactly one non-empty UTF-8 line.');
@@ -85,7 +91,7 @@ export async function runEvidenceCommand(args, dependencies) {
         if (!input.trim()) {
             throw new CliUsageError('sign-artifact requires one reviewed artefact file or an artefact on stdin.');
         }
-        const privateKey = await readKey(args.privateKeySource, 'Private key file', dependencies.readPrivateKeyFile);
+        const privateKey = await readKey(args.privateKeySource, 'Private key file', dependencies.readPrivateKeyFile, dependencies);
         const signed = await signEvidencePackage(input, privateKey, dependencies.now ? dependencies.now() : new Date().toISOString());
         dependencies.stdout.write(formatJsonDocument(signed));
         return EXIT_CODES.SUCCESS;
@@ -95,7 +101,7 @@ export async function runEvidenceCommand(args, dependencies) {
         throw new CliUsageError('verify-signature requires one signed package file or a package on stdin.');
     }
     const publicKey = args.publicKeySource
-        ? await readKey(args.publicKeySource, 'Public key file', dependencies.readPublicKeyFile)
+        ? await readKey(args.publicKeySource, 'Public key file', dependencies.readPublicKeyFile, dependencies)
         : null;
     const report = await verifyEvidencePackageSignature(input, publicKey);
     if (!args.quiet) {

package/cli/evidence-signing.mjs

@@ -1,11 +1,15 @@
 import { Buffer } from 'node:buffer';
 import { createHash, createPrivateKey, createPublicKey, sign, verify, } from 'node:crypto';
-import { canonicalArtifactJson } from "../frontend/src/lib/analysis/artifact-integrity.js";
-import { MAX_OFFLINE_ARTIFACT_BYTES, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { canonicalArtifactJsonFor, resolveArtifactCanonicalization, SORTED_JSON_V1, SORTED_JSON_V2, } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { hasVerifiedApplicableIntegrity, hasVerifiedArtifactStructure, MAX_OFFLINE_ARTIFACT_BYTES, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { parseBoundedJsonObject } from "./bounded-json.mjs";
 export const SIGNED_EVIDENCE_PACKAGE_SCHEMA = 'whoisleuth.signed-evidence-package';
-export const SIGNED_EVIDENCE_PACKAGE_VERSION = 1;
+export const SIGNED_EVIDENCE_PACKAGE_VERSION = 2;
+export const LEGACY_SIGNED_EVIDENCE_PACKAGE_VERSION = 1;
+export const EVIDENCE_SIGNATURE_VERIFICATION_SCHEMA = 'whoisleuth.evidence-signature-verification';
+export const EVIDENCE_SIGNATURE_VERIFICATION_VERSION = 2;
 export const EVIDENCE_SIGNATURE_ALGORITHM = 'Ed25519';
-export const EVIDENCE_SIGNATURE_CANONICALIZATION = 'sorted-json-v1';
+export const EVIDENCE_SIGNATURE_CANONICALIZATION = SORTED_JSON_V2;
 export const MAX_SIGNING_KEY_FILE_BYTES = 16 * 1024;
 const SHA256_RE = /^[a-f0-9]{64}$/u;
 const BASE64_RE = /^[A-Za-z0-9+/]+={0,2}$/u;
@@ -23,23 +27,7 @@ function record(value) {
         : null;
 }
 function parseObject(raw, label) {
-    if (typeof raw !== 'string')
-        throw new TypeError(`${label} must be UTF-8 JSON text.`);
-    const bytes = Buffer.byteLength(raw, 'utf8');
-    if (bytes === 0 || bytes > MAX_OFFLINE_ARTIFACT_BYTES) {
-        throw new TypeError(`${label} must be between 1 byte and ${MAX_OFFLINE_ARTIFACT_BYTES} bytes.`);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new TypeError(`${label} must be valid JSON.`);
-    }
-    const value = record(parsed);
-    if (!value)
-        throw new TypeError(`${label} must contain one JSON object.`);
-    return value;
+    return parseBoundedJsonObject(raw, { label, maximumBytes: MAX_OFFLINE_ARTIFACT_BYTES });
 }
 function hasExactKeys(value, expected) {
     const keys = Object.keys(value);
@@ -54,6 +42,12 @@ function timestamp(value) {
         throw new TypeError('Signature time must be a valid timestamp.');
     return new Date(parsed).toISOString();
 }
+function canonicalTimestamp(value) {
+    const normalized = timestamp(value);
+    if (value !== normalized)
+        throw new TypeError('Signature time must use canonical UTC timestamp text.');
+    return normalized;
+}
 function importPrivateKey(pem) {
     if (Buffer.byteLength(pem, 'utf8') > MAX_SIGNING_KEY_FILE_BYTES) {
         throw new TypeError(`Private key file exceeds ${MAX_SIGNING_KEY_FILE_BYTES} bytes.`);
@@ -96,8 +90,8 @@ function spkiDer(key) {
 function keyId(publicDer) {
     return createHash('sha256').update(publicDer).digest('hex');
 }
-function payloadBytes(payload) {
-    return Buffer.from(canonicalArtifactJson(payload), 'utf8');
+function payloadBytes(payload, canonicalization) {
+    return Buffer.from(canonicalArtifactJsonFor(payload, canonicalization), 'utf8');
 }
 async function signableArtifact(raw) {
     const artifact = parseObject(raw, 'Evidence artefact');
@@ -105,6 +99,9 @@ async function signableArtifact(raw) {
     if (!['case_response_packet', 'investigation_capsule', 'signed_review_artifact'].includes(verification.artifact.kind)) {
         throw new TypeError('Only reviewed response packets, investigation capsules, and supported review manifests can be signed.');
     }
+    if (!hasVerifiedArtifactStructure(verification) || !hasVerifiedApplicableIntegrity(verification)) {
+        throw new TypeError('Evidence signing requires verified structure and a verified applicable integrity contract.');
+    }
     return { artifact, verification };
 }
 export async function signEvidencePackage(raw, privateKeyPem, signedAt = new Date().toISOString()) {
@@ -124,7 +121,7 @@ export async function signEvidencePackage(raw, privateKeyPem, signedAt = new Dat
             canonicalization: EVIDENCE_SIGNATURE_CANONICALIZATION,
             publicKeySpkiDerBase64: publicDer.toString('base64'),
             keyIdSha256: keyId(publicDer),
-            valueBase64: sign(null, payloadBytes(payload), privateKey).toString('base64'),
+            valueBase64: sign(null, payloadBytes(payload, SORTED_JSON_V2), privateKey).toString('base64'),
         }),
     });
 }
@@ -134,12 +131,11 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
     const artifact = record(value.artifact);
     if (!hasExactKeys(value, PACKAGE_KEYS)
         || value.schema !== SIGNED_EVIDENCE_PACKAGE_SCHEMA
-        || value.version !== SIGNED_EVIDENCE_PACKAGE_VERSION
+        || (value.version !== LEGACY_SIGNED_EVIDENCE_PACKAGE_VERSION && value.version !== SIGNED_EVIDENCE_PACKAGE_VERSION)
         || !artifact
         || !signature
         || !hasExactKeys(signature, SIGNATURE_KEYS)
         || signature.algorithm !== EVIDENCE_SIGNATURE_ALGORITHM
-        || signature.canonicalization !== EVIDENCE_SIGNATURE_CANONICALIZATION
         || typeof signature.publicKeySpkiDerBase64 !== 'string'
         || signature.publicKeySpkiDerBase64.length > 4096
         || !BASE64_RE.test(signature.publicKeySpkiDerBase64)
@@ -150,7 +146,17 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
         || !SHA256_RE.test(signature.keyIdSha256)) {
         throw new TypeError('Signed evidence package has an unsupported or malformed envelope.');
     }
-    const signedAt = timestamp(value.signedAt);
+    let canonicalization;
+    try {
+        canonicalization = resolveArtifactCanonicalization(value.version, signature.canonicalization, [
+            { version: LEGACY_SIGNED_EVIDENCE_PACKAGE_VERSION, canonicalization: SORTED_JSON_V1, explicit: true },
+            { version: SIGNED_EVIDENCE_PACKAGE_VERSION, canonicalization: SORTED_JSON_V2, explicit: true },
+        ], 'Signed evidence package');
+    }
+    catch {
+        throw new TypeError('Signed evidence package has an unsupported or malformed envelope.');
+    }
+    const signedAt = canonicalTimestamp(value.signedAt);
     const publicDer = Buffer.from(signature.publicKeySpkiDerBase64, 'base64');
     if (keyId(publicDer) !== signature.keyIdSha256) {
         throw new TypeError('Signed evidence package public-key identifier does not match its embedded key.');
@@ -158,16 +164,20 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
     const embeddedPublicKey = importPublicKey(publicDer, 'Embedded evidence-signing public key');
     const payload = {
         schema: SIGNED_EVIDENCE_PACKAGE_SCHEMA,
-        version: SIGNED_EVIDENCE_PACKAGE_VERSION,
+        version: value.version,
         signedAt,
         artifact,
     };
     const signatureBytes = Buffer.from(signature.valueBase64, 'base64');
     if (signatureBytes.length !== 64
-        || !verify(null, payloadBytes(payload), embeddedPublicKey, signatureBytes)) {
+        || !verify(null, payloadBytes(payload, canonicalization), embeddedPublicKey, signatureBytes)) {
         throw new TypeError('Signed evidence package failed Ed25519 verification.');
     }
-    const artifactVerification = await verifyOfflineArtifact(JSON.stringify(artifact));
+    let artifactVerification = null;
+    try {
+        artifactVerification = await verifyOfflineArtifact(JSON.stringify(artifact));
+    }
+    catch { /* Signature validity remains independently reportable. */ }
     let publicKeyMatched = null;
     if (trustedPublicKeyPem) {
         const trustedDer = spkiDer(importPublicKey(trustedPublicKeyPem, 'Trusted public key file'));
@@ -176,24 +186,41 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
             throw new TypeError('Signed evidence package does not match the trusted public key.');
     }
     return Object.freeze({
-        schema: 'whoisleuth.evidence-signature-verification',
-        version: 1,
-        valid: true,
+        schema: EVIDENCE_SIGNATURE_VERIFICATION_SCHEMA,
+        version: EVIDENCE_SIGNATURE_VERIFICATION_VERSION,
         state: 'signature_valid',
-        signerTrust: trustedPublicKeyPem ? 'trusted_key' : 'embedded_key_only',
-        signedAt,
-        keyIdSha256: signature.keyIdSha256,
-        publicKeyMatched,
+        signature: Object.freeze({
+            state: 'valid',
+            signerTrust: trustedPublicKeyPem ? 'trusted_key' : 'embedded_key_only',
+            signedAt,
+            keyIdSha256: signature.keyIdSha256,
+            publicKeyMatched,
+        }),
         artifact: Object.freeze({
-            schema: artifactVerification.artifact.schema,
-            version: artifactVerification.artifact.version,
-            kind: artifactVerification.artifact.kind,
+            schema: artifactVerification?.artifact.schema
+                ?? (typeof artifact.schema === 'string' && /^[a-z0-9.-]{1,160}$/u.test(artifact.schema) ? artifact.schema : null),
+            version: artifactVerification?.artifact.version
+                ?? (Number.isSafeInteger(artifact.version ?? artifact.schemaVersion)
+                    && Number(artifact.version ?? artifact.schemaVersion) >= 1
+                    && Number(artifact.version ?? artifact.schemaVersion) <= 1_000
+                    ? Number(artifact.version ?? artifact.schemaVersion)
+                    : null),
+            kind: artifactVerification?.artifact.kind ?? 'unverified_artifact',
+            assurance: Object.freeze({
+                state: artifactVerification?.state ?? 'not_verified',
+                structure: artifactVerification?.checks.structure ?? 'not_checked',
+                contentIntegrity: artifactVerification?.checks.contentIntegrity ?? 'not_checked',
+                contentIntegrityScope: artifactVerification?.checks.contentIntegrityScope ?? 'not_checked',
+            }),
         }),
         limitations: Object.freeze([
             trustedPublicKeyPem
                 ? 'The signature and supplied public key match; recipient trust still depends on obtaining that public key through an authenticated channel.'
                 : 'The signature is internally valid for the embedded public key, but signer identity was not authenticated because no trusted public key was supplied.',
             'The signature authenticates the canonical sorted-JSON content, not the original whitespace, indentation, or object-key order of the serialised file.',
+            ...(artifactVerification
+                ? [`Embedded-artifact assurance is reported separately as ${artifactVerification.state}; it does not change the cryptographic signature result.`]
+                : ['The embedded artefact did not pass a supported local assurance contract. The cryptographic signature remains valid for its bytes, but no structure or inner-integrity claim is made.']),
             'A valid signature proves the canonical package content has not changed since signing; it does not establish that the retained observations or analyst statements are accurate.',
             'WHOISleuth does not generate, store, recover, rotate, or publish signing keys.',
         ]),
@@ -203,11 +230,12 @@ export function formatEvidenceSignatureVerification(report) {
     const lines = [
         'WHOISleuth evidence signature verification',
         `State: ${report.state}`,
-        `Signer trust: ${report.signerTrust}`,
-        `Artifact: ${report.artifact.kind} · ${report.artifact.schema} v${report.artifact.version}`,
-        `Signed: ${report.signedAt}`,
-        `Key ID: sha256:${report.keyIdSha256}`,
-        `Trusted public key: ${report.publicKeyMatched === null ? 'not supplied' : 'matched'}`,
+        `Signer trust: ${report.signature.signerTrust}`,
+        `Artifact: ${report.artifact.kind} · ${report.artifact.schema ?? 'unrecognised'} v${report.artifact.version ?? 'unrecognised'}`,
+        `Artifact assurance: ${report.artifact.assurance.state}`,
+        `Signed: ${report.signature.signedAt}`,
+        `Key ID: sha256:${report.signature.keyIdSha256}`,
+        `Trusted public key: ${report.signature.publicKeyMatched === null ? 'not supplied' : 'matched'}`,
     ];
     for (const limitation of report.limitations)
         lines.push(`Limitation: ${limitation}`);

package/cli/export-evidence.mjs

@@ -1,8 +1,9 @@
-import { createRequire } from 'node:module';
 import { projectCliLookupComparisonInput } from "./compare.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
-const require = createRequire(import.meta.url);
-const { version: APPLICATION_VERSION } = require('../package.json');
+import { validateLookupEvidenceArtifactStructure } from "./artifact-structure.mjs";
+import { WHOISLEUTH_APPLICATION_VERSION } from "../lib/application-version.mjs";
+import { LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES, serializeLookupEvidence, } from "../lib/evidence-export.mjs";
+const APPLICATION_VERSION = WHOISLEUTH_APPLICATION_VERSION;
 function objectOrNull(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
@@ -27,9 +28,15 @@ function buildCliEvidenceExport(text, evidenceModule, generatedAt = new Date().t
         || result.schemaVersion !== dependency.LOOKUP_EVIDENCE_SCHEMA_VERSION) {
         throw new TypeError('Lookup evidence builder returned an unsupported report contract.');
     }
+    validateLookupEvidenceArtifactStructure(result);
+    serializeLookupEvidence(result);
     return result;
 }
 function formatCliEvidenceExport(document, compact = false) {
-    return `${JSON.stringify(document, null, compact ? 0 : 2)}\n`;
+    const output = `${serializeLookupEvidence(document, !compact)}\n`;
+    if (new TextEncoder().encode(output).byteLength > LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES) {
+        throw new TypeError('Lookup evidence exceeds the 5 MiB portable file limit.');
+    }
+    return output;
 }
 export { APPLICATION_VERSION, buildCliEvidenceExport, formatCliEvidenceExport };

package/cli/formatters/html.mjs

@@ -26,8 +26,8 @@ function renderRegistrarComparison(comparison) {
         : '';
     return `<div class="table-scroll"><table><caption>Normalized registry and registrar RDAP publication comparison</caption><thead><tr><th scope="col">Field</th><th scope="col">Result</th><th scope="col">Registry RDAP</th><th scope="col">Registrar RDAP</th></tr></thead><tbody>${rows}</tbody></table></div>${omitted}`;
 }
-function formatLookupEvidenceHtml(document) {
-    const report = buildLookupEvidenceReport(document);
+function formatLookupEvidenceHtml(document, options = {}) {
+    const report = buildLookupEvidenceReport(document, options);
     const title = `Lookup evidence report: ${report.title}`;
     return `<!doctype html>
 <html lang="en">
@@ -60,7 +60,7 @@ function formatLookupEvidenceHtml(document) {
   <section class="block"><h2>Network evidence</h2>${renderGroups(report.networkGroups)}</section>
   <section class="block"><h2>Collection diagnostics</h2>${renderFields(report.diagnostics)}</section>
   <section class="block"><h2>Limitations</h2><ul>${report.limitations.map((item) => `<li>${escapeHtml(item)}</li>`).join('')}</ul></section>
-  <footer>Offline, self-contained report. No scripts, forms, external resources, or active links are included.</footer>
+  <footer>Offline, self-contained report. No scripts, forms, external resources, or active links are included.${report.attribution ? `<br>${escapeHtml(report.attribution)}` : ''}</footer>
 </main>
 </body>
 </html>

package/cli/formatters/terminal.mjs

@@ -271,6 +271,9 @@ function formatTerminalRegistrySupport(document) {
         `WHOIS scope    ${supportLabel(whois.queryScope)}`,
         `WHOIS encoding ${supportLabel(whois.encodingProfile)}`,
         `WHOIS parser   ${supportLabel(whois.parserProfile)}`,
+        ...(typeof profile.officialLookupUrl === 'string' && profile.officialLookupUrl
+            ? [`Official lookup ${safeTerminalValue(profile.officialLookupUrl)}`]
+            : []),
         `Fixture states ${fixtures.length ? fixtures.map((value) => supportLabel(value)).join(', ') : 'None documented'}`,
     ];
     for (const file of files)

package/cli/input.mjs

@@ -0,0 +1,57 @@
+import { Buffer } from 'node:buffer';
+import { readBoundedRegularTextFile } from "../lib/bounded-file.mjs";
+import { CliUsageError } from "./errors.mjs";
+function abortError(signal) {
+    return signal.reason instanceof Error
+        ? signal.reason
+        : new DOMException('The operation was aborted.', 'AbortError');
+}
+export async function readCliTextInput(source, stdin, options) {
+    if (options.signal?.aborted)
+        throw abortError(options.signal);
+    if (source) {
+        try {
+            return await readBoundedRegularTextFile(source, {
+                maximumBytes: options.maximumBytes,
+                label: options.label,
+                allowSymbolicLink: true,
+                ...(options.signal ? { signal: options.signal } : {}),
+            });
+        }
+        catch (error) {
+            if (options.signal?.aborted)
+                throw abortError(options.signal);
+            if (error instanceof CliUsageError)
+                throw error;
+            const message = error instanceof Error ? error.message : `${options.label} could not be read.`;
+            throw new CliUsageError(message);
+        }
+    }
+    if (!stdin || stdin.isTTY)
+        return '';
+    let bytes = 0;
+    const chunks = [];
+    const onAbort = () => {
+        if ('destroy' in stdin && typeof stdin.destroy === 'function')
+            stdin.destroy(abortError(options.signal));
+    };
+    options.signal?.addEventListener('abort', onAbort, { once: true });
+    try {
+        for await (const chunk of stdin) {
+            if (options.signal?.aborted)
+                throw abortError(options.signal);
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            bytes += buffer.length;
+            if (bytes > options.maximumBytes) {
+                throw new CliUsageError(`${options.label} is limited to ${options.maximumBytes} bytes.`);
+            }
+            chunks.push(buffer);
+        }
+        if (options.signal?.aborted)
+            throw abortError(options.signal);
+        return Buffer.concat(chunks, bytes).toString('utf8');
+    }
+    finally {
+        options.signal?.removeEventListener('abort', onAbort);
+    }
+}

package/cli/interchange-report.mjs

@@ -0,0 +1,226 @@
+import { Buffer } from 'node:buffer';
+import { INTERCHANGE_ARTIFACT_CONTRACTS, } from "../lib/interchange-fidelity-registry.mjs";
+import { offlineArtifactSatisfiesAssurance, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { mergeBrandProfiles } from "../frontend/src/lib/analysis/brand-profile-model.js";
+import { parseBoundedJsonObject } from "./bounded-json.mjs";
+export const INTERCHANGE_FIDELITY_REPORT_SCHEMA = 'whoisleuth.interchange-fidelity-report';
+export const INTERCHANGE_FIDELITY_REPORT_VERSION = 2;
+export const MAX_INTERCHANGE_REPORT_BYTES = 15 * 1024 * 1024;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function parseInput(raw) {
+    if (typeof raw !== 'string')
+        throw new TypeError('Interchange input must be UTF-8 JSON text.');
+    const bytes = Buffer.byteLength(raw, 'utf8');
+    if (bytes < 1 || bytes > MAX_INTERCHANGE_REPORT_BYTES) {
+        throw new TypeError(`Interchange input must be between 1 byte and ${MAX_INTERCHANGE_REPORT_BYTES} bytes.`);
+    }
+    return parseBoundedJsonObject(raw.replace(/^\uFEFF/u, ''), {
+        label: 'Interchange input',
+        maximumBytes: MAX_INTERCHANGE_REPORT_BYTES,
+    });
+}
+function nestedRecord(value, path) {
+    let current = value;
+    for (const part of path)
+        current = record(current?.[part]);
+    return current;
+}
+function identify(value) {
+    for (const contract of INTERCHANGE_ARTIFACT_CONTRACTS) {
+        const container = nestedRecord(value, contract.nestedSchemaPath);
+        if (container?.schema !== contract.schema)
+            continue;
+        const declared = container[contract.versionField];
+        return {
+            contract,
+            version: Number.isSafeInteger(declared) && Number(declared) > 0 && Number(declared) <= 1000
+                ? Number(declared)
+                : null,
+        };
+    }
+    return null;
+}
+function timestamp(value) {
+    if (typeof value !== 'string' || value.length > 64 || /[\u0000-\u001f\u007f]/u.test(value)) {
+        throw new TypeError('Interchange report time is invalid.');
+    }
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed))
+        throw new TypeError('Interchange report time is invalid.');
+    return new Date(parsed).toISOString();
+}
+function validateBrandProfileExport(value) {
+    const profiles = value.profiles;
+    if (!Array.isArray(profiles) || profiles.length > 100) {
+        throw new TypeError('Brand Profile export does not contain a bounded profiles collection.');
+    }
+    if (typeof value.exportedAt !== 'string' || value.exportedAt.length > 64 || !Number.isFinite(Date.parse(value.exportedAt))) {
+        throw new TypeError('Brand Profile export time is invalid.');
+    }
+    let nextId = 0;
+    const result = mergeBrandProfiles([], value, {
+        nowIso: new Date(Date.parse(value.exportedAt)).toISOString(),
+        makeId: () => `interchange-profile-${++nextId}`,
+    });
+    return Object.freeze({ accepted: result.profiles.length, skipped: result.skipped });
+}
+export async function buildInterchangeFidelityReport(raw, options = {}) {
+    const inputBytes = Buffer.byteLength(raw, 'utf8');
+    const value = parseInput(raw);
+    const identified = identify(value);
+    const generatedAt = timestamp(options.generatedAt ?? new Date().toISOString());
+    if (!identified)
+        return Object.freeze({
+            schema: INTERCHANGE_FIDELITY_REPORT_SCHEMA,
+            version: INTERCHANGE_FIDELITY_REPORT_VERSION,
+            generatedAt,
+            recognised: false,
+            artifact: Object.freeze({ id: null, schema: null, version: null, versionSupported: false }),
+            verification: Object.freeze({ state: 'not_verified', requiredAssurance: null, assuranceSatisfied: false }),
+            compatibility: Object.freeze({
+                browser: null,
+                cli: null,
+                fidelity: 'not_verified',
+                preservedFieldGroups: Object.freeze([]),
+                excludedFieldGroups: Object.freeze([]),
+                futureVersionBehaviour: null,
+                fullyImportable: null,
+            }),
+            summary: Object.freeze({
+                inputBytes, recordCount: null, sectionCount: null, encryptedContentVerified: null,
+                acceptedRecordCount: null, skippedRecordCount: null, unsupportedSectionCount: null,
+                blockedSectionCount: null, prunedRecordCount: null,
+            }),
+            limitations: Object.freeze([
+                'The file did not match a registered interchange contract. Its supplied schema text and contents are not echoed.',
+                'This report makes no request and does not establish that evidence is accurate, current, complete, or safe to share.',
+            ]),
+        });
+    const { contract, version } = identified;
+    const supported = version !== null && contract.versions.includes(version);
+    let verificationState = supported ? 'not_verified' : 'unsupported_version';
+    let assuranceSatisfied = false;
+    let recordCount = null;
+    let sectionCount = null;
+    let encryptedContentVerified = contract.id === 'encrypted_workspace' ? false : null;
+    let acceptedRecordCount = null;
+    let skippedRecordCount = null;
+    let unsupportedSectionCount = null;
+    let blockedSectionCount = null;
+    let prunedRecordCount = null;
+    let fullyImportable = null;
+    if (supported && contract.fidelity !== 'unsupported') {
+        try {
+            if (contract.id === 'brand_profiles') {
+                const validation = validateBrandProfileExport(value);
+                recordCount = validation.accepted;
+                acceptedRecordCount = validation.accepted;
+                skippedRecordCount = validation.skipped;
+                verificationState = validation.skipped === 0 ? 'structure_valid' : 'not_verified';
+                assuranceSatisfied = validation.skipped === 0 && contract.requiredAssurance === 'structure';
+            }
+            else {
+                const verification = await verifyOfflineArtifact(raw, { passphrase: options.passphrase ?? null });
+                verificationState = verification.state;
+                assuranceSatisfied = contract.requiredAssurance === 'whole_integrity'
+                    ? offlineArtifactSatisfiesAssurance(verification, 'whole_integrity')
+                    : contract.requiredAssurance === 'structure'
+                        ? offlineArtifactSatisfiesAssurance(verification, 'structure')
+                        : contract.requiredAssurance === 'authenticated_whole_integrity'
+                            ? offlineArtifactSatisfiesAssurance(verification, 'whole_integrity')
+                                && verification.checks.authenticatedEncryption === 'verified'
+                            : false;
+                recordCount = verification.summary.recordCount;
+                sectionCount = verification.summary.sectionCount;
+                const unsupportedSections = verification.summary.unsupportedSectionCount ?? 0;
+                unsupportedSectionCount = unsupportedSections;
+                blockedSectionCount = verification.summary.blockedSectionCount ?? null;
+                skippedRecordCount = verification.summary.skippedRecordCount ?? skippedRecordCount;
+                prunedRecordCount = verification.summary.prunedRecordCount ?? null;
+                if (verification.summary.fullyImportable !== undefined
+                    && verification.summary.fullyImportable !== null) {
+                    fullyImportable = assuranceSatisfied && verification.summary.fullyImportable;
+                }
+                if (contract.id === 'encrypted_workspace')
+                    encryptedContentVerified = verification.state === 'verified'
+                        && verification.checks.authenticatedEncryption === 'verified';
+            }
+        }
+        catch {
+            verificationState = 'not_verified';
+            assuranceSatisfied = false;
+        }
+    }
+    const fidelityEligible = assuranceSatisfied && fullyImportable !== false;
+    const fidelity = !supported
+        ? 'unsupported'
+        : fidelityEligible
+            ? contract.fidelity
+            : contract.fidelity === 'unsupported'
+                ? 'unsupported'
+                : 'not_verified';
+    return Object.freeze({
+        schema: INTERCHANGE_FIDELITY_REPORT_SCHEMA,
+        version: INTERCHANGE_FIDELITY_REPORT_VERSION,
+        generatedAt,
+        recognised: true,
+        artifact: Object.freeze({ id: contract.id, schema: contract.schema, version, versionSupported: supported }),
+        verification: Object.freeze({
+            state: verificationState,
+            requiredAssurance: contract.requiredAssurance,
+            assuranceSatisfied,
+        }),
+        compatibility: Object.freeze({
+            browser: contract.browser,
+            cli: contract.cli,
+            fidelity,
+            preservedFieldGroups: contract.preservedFieldGroups,
+            excludedFieldGroups: contract.excludedFieldGroups,
+            futureVersionBehaviour: contract.futureVersionBehaviour,
+            fullyImportable,
+        }),
+        summary: Object.freeze({
+            inputBytes, recordCount, sectionCount, encryptedContentVerified,
+            acceptedRecordCount, skippedRecordCount, unsupportedSectionCount,
+            blockedSectionCount, prunedRecordCount,
+        }),
+        limitations: Object.freeze([
+            'Compatibility describes declared field groups and supported operations, not byte-for-byte equality or evidence truth.',
+            'The report emits only registered metadata, counts, and fixed field-group identifiers. Targets, notes, contacts, passphrases, and evidence values are not included.',
+            'A verified integrity envelope detects file changes but does not establish author identity, source accuracy, currency, completeness, or sharing authority.',
+        ]),
+    });
+}
+export function formatInterchangeFidelityReport(report) {
+    const browser = report.compatibility.browser;
+    const cli = report.compatibility.cli;
+    return [
+        'Interchange fidelity report',
+        `Recognised     ${report.recognised ? 'yes' : 'no'}`,
+        `Artifact       ${report.artifact.id ?? 'unrecognised'}`,
+        `Version        ${report.artifact.version ?? 'unavailable'}${report.artifact.versionSupported ? '' : ' (unsupported)'}`,
+        `Verification   ${report.verification.state}`,
+        `Assurance      ${report.verification.requiredAssurance ?? 'unregistered'} · ${report.verification.assuranceSatisfied ? 'satisfied' : 'withheld'}`,
+        `Fidelity       ${report.compatibility.fidelity}`,
+        ...(report.compatibility.fullyImportable === null ? [] : [`Importability  ${report.compatibility.fullyImportable ? 'complete' : 'partial'}`]),
+        `Browser        import ${browser?.import ?? 'unknown'} · export ${browser?.export ?? 'unknown'}`,
+        `CLI            read ${cli?.read ?? 'unknown'} · write ${cli?.write ?? 'unknown'} · verify ${cli?.verify ?? 'unknown'}`,
+        `Records        ${report.summary.recordCount ?? 'not disclosed'}`,
+        `Sections       ${report.summary.sectionCount ?? 'not disclosed'}`,
+        ...(report.summary.acceptedRecordCount === null ? [] : [`Accepted       ${report.summary.acceptedRecordCount}`]),
+        ...(report.summary.skippedRecordCount === null ? [] : [`Skipped        ${report.summary.skippedRecordCount}`]),
+        ...(report.summary.unsupportedSectionCount === null ? [] : [`Unsupported    ${report.summary.unsupportedSectionCount}`]),
+        ...(report.summary.blockedSectionCount === null ? [] : [`Blocked        ${report.summary.blockedSectionCount}`]),
+        ...(report.summary.prunedRecordCount === null ? [] : [`Pruned         ${report.summary.prunedRecordCount}`]),
+        '',
+        `Preserved      ${report.compatibility.preservedFieldGroups.join(', ') || 'none declared'}`,
+        `Excluded       ${report.compatibility.excludedFieldGroups.join(', ') || 'none declared'}`,
+        '',
+        ...report.limitations.map((item) => `Limitation: ${item}`),
+        '',
+    ].join('\n');
+}