@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/cli/investigation-manifest.mjs

@@ -1,10 +1,11 @@
 import { Buffer } from 'node:buffer';
 import { createHash } from 'node:crypto';
-import { canonicalArtifactJson, sha256ArtifactDigest, } from "../frontend/src/lib/analysis/artifact-integrity.js";
-import { recordOrNull, requireBoundedString, requireIsoTimestamp, } from "../lib/bounded-contract-normalizers.mjs";
+import { canonicalArtifactJsonV2, SORTED_JSON_V2, sha256ArtifactDigestV2, } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { requireBoundedString, requireIsoTimestamp, } from "../lib/bounded-contract-normalizers.mjs";
 import { normalizeBoundedSemanticVersion } from "../lib/semantic-version.mjs";
+import { parseBoundedJsonObject } from "./bounded-json.mjs";
 export const INVESTIGATION_MANIFEST_SCHEMA = 'whoisleuth.investigation-manifest';
-export const INVESTIGATION_MANIFEST_VERSION = 1;
+export const INVESTIGATION_MANIFEST_VERSION = 2;
 export const MAX_INVESTIGATION_MANIFEST_ARTIFACTS = 16;
 export const MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES = 15 * 1024 * 1024;
 export const MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES = 32 * 1024 * 1024;
@@ -40,20 +41,17 @@ export async function buildInvestigationManifest(input, generatedAtValue, applic
         if (byteLength < 1 || byteLength > MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES) {
             throw new TypeError(`Artifact ${index + 1} must be between 1 byte and ${MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES} bytes.`);
         }
-        let parsed;
-        try {
-            parsed = JSON.parse(artifact.content);
+        if (totalBytes > MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES) {
+            throw new TypeError(`Manifest artefacts exceed the ${MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES}-byte combined limit.`);
         }
-        catch {
-            throw new TypeError(`Artifact ${index + 1} must be valid JSON.`);
-        }
-        const value = recordOrNull(parsed);
-        if (!value)
-            throw new TypeError(`Artifact ${index + 1} must contain one JSON object.`);
+        const value = parseBoundedJsonObject(artifact.content, {
+            label: `Artifact ${index + 1}`,
+            maximumBytes: MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES,
+        });
         const schema = value.schema === undefined
             ? null
             : requireBoundedString(value.schema, `Artifact ${index + 1} schema`, 160);
-        const canonical = canonicalArtifactJson(value);
+        const canonical = canonicalArtifactJsonV2(value);
         const contentDigestSha256 = digest(artifact.content);
         return Object.freeze({
             sequence: index + 1,
@@ -65,9 +63,6 @@ export async function buildInvestigationManifest(input, generatedAtValue, applic
             canonicalDigestSha256: digest(canonical),
         });
     });
-    if (totalBytes > MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES) {
-        throw new TypeError(`Manifest artefacts exceed the ${MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES}-byte combined limit.`);
-    }
     const unsigned = Object.freeze({
         schema: INVESTIGATION_MANIFEST_SCHEMA,
         version: INVESTIGATION_MANIFEST_VERSION,
@@ -90,7 +85,11 @@ export async function buildInvestigationManifest(input, generatedAtValue, applic
     });
     return Object.freeze({
         ...unsigned,
-        integrity: Object.freeze({ algorithm: 'SHA-256', digestSha256: await sha256ArtifactDigest(unsigned) }),
+        integrity: Object.freeze({
+            algorithm: 'SHA-256',
+            canonicalization: SORTED_JSON_V2,
+            digestSha256: await sha256ArtifactDigestV2(unsigned),
+        }),
     });
 }
 export function formatInvestigationManifest(manifest) {

package/cli/investigation-run.mjs

@@ -1,6 +1,7 @@
 import { Buffer } from 'node:buffer';
 import { buildInvestigationPlan, } from "./investigation-plan.mjs";
 import { CliUsageError } from "./errors.mjs";
+import { scanBoundedJson } from "../lib/bounded-json.mjs";
 export const CLI_INVESTIGATION_RUN_SCHEMA = 'whoisleuth.cli.investigation-run';
 export const CLI_INVESTIGATION_RUN_VERSION = 1;
 export const MAX_INVESTIGATION_RUN_BYTES = 24 * 1024 * 1024;
@@ -9,50 +10,93 @@ function boundedResult(value) {
         throw new CliUsageError(`Investigation step output is limited to ${MAX_INVESTIGATION_RUN_BYTES} bytes.`);
     }
     try {
+        scanBoundedJson(value);
         return JSON.parse(value);
     }
-    catch {
+    catch (cause) {
+        if (cause instanceof TypeError && cause.message !== 'Artefact input is not valid JSON.') {
+            throw new CliUsageError(`Investigation step output ${cause.message.replace(/^Artefact JSON /u, '')}`);
+        }
         return value.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/gu, '').slice(0, MAX_INVESTIGATION_RUN_BYTES);
     }
 }
-function parseResumeState(input, recipe, subject) {
+function resultSchema(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) && typeof value.schema === 'string'
+        ? String(value.schema)
+        : null;
+}
+function sameArguments(left, right) {
+    return Array.isArray(left)
+        && left.length === right.length
+        && left.every((value, index) => typeof value === 'string' && value === right[index]);
+}
+function parseResumeState(input, plan) {
     if (!input)
         return [];
     if (Buffer.byteLength(input, 'utf8') > MAX_INVESTIGATION_RUN_BYTES)
         throw new CliUsageError('Investigation resume state exceeds the 24 MiB limit.');
+    const normalizedInput = input.replace(/^\uFEFF/u, '');
+    try {
+        scanBoundedJson(normalizedInput);
+    }
+    catch (cause) {
+        const detail = cause instanceof Error ? cause.message : '';
+        if (detail === 'Artefact input is not valid JSON.')
+            throw new CliUsageError('Investigation resume state must be valid JSON.');
+        throw new CliUsageError(detail ? `Investigation resume state ${detail.replace(/^Artefact JSON /u, '')}` : 'Investigation resume state must be valid JSON.');
+    }
     let parsed;
     try {
-        parsed = JSON.parse(input.replace(/^\uFEFF/u, ''));
+        parsed = JSON.parse(normalizedInput);
     }
     catch {
         throw new CliUsageError('Investigation resume state must be valid JSON.');
     }
     const root = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
-    if (root.schema !== CLI_INVESTIGATION_RUN_SCHEMA || root.version !== CLI_INVESTIGATION_RUN_VERSION || root.recipe !== recipe || root.subject !== subject || !Array.isArray(root.completedSteps)) {
+    if (root.schema !== CLI_INVESTIGATION_RUN_SCHEMA || root.version !== CLI_INVESTIGATION_RUN_VERSION || root.recipe !== plan.recipe.id || root.subject !== plan.subject || !Array.isArray(root.completedSteps)) {
         throw new CliUsageError('Investigation resume state must match this versioned recipe and subject.');
     }
-    return root.completedSteps.slice(0, 16).flatMap((value) => {
-        if (!value || typeof value !== 'object' || Array.isArray(value))
-            return [];
+    if (root.completedSteps.length > plan.steps.length) {
+        throw new CliUsageError('Investigation resume state contains more steps than the installed fixed recipe.');
+    }
+    const completed = [];
+    for (const [index, value] of root.completedSteps.entries()) {
+        const planned = plan.steps[index];
+        if (!planned || !value || typeof value !== 'object' || Array.isArray(value)) {
+            throw new CliUsageError('Investigation resume state contains a malformed or out-of-order step.');
+        }
         const item = value;
-        if (typeof item.id !== 'string' || typeof item.command !== 'string' || !Array.isArray(item.arguments) || !['offline', 'network'].includes(String(item.mode)) || !Number.isSafeInteger(item.exitCode))
-            return [];
-        return [Object.freeze({
-                id: item.id,
-                command: item.command,
-                arguments: Object.freeze(item.arguments.filter((entry) => typeof entry === 'string').slice(0, 32)),
-                mode: item.mode,
-                exitCode: Number(item.exitCode),
-                result: item.result,
-            })];
-    });
+        if (item.id !== planned.id
+            || item.command !== planned.command
+            || item.mode !== planned.mode
+            || !sameArguments(item.arguments, planned.arguments)
+            || !Number.isSafeInteger(item.exitCode)) {
+            throw new CliUsageError('Investigation resume state does not match the installed fixed recipe.');
+        }
+        const exitCode = Number(item.exitCode);
+        if (exitCode !== 0 && exitCode !== 2) {
+            if (index !== root.completedSteps.length - 1) {
+                throw new CliUsageError('A failed investigation step must be the final retained step.');
+            }
+            break;
+        }
+        if (resultSchema(item.result) !== planned.produces) {
+            throw new CliUsageError('Investigation resume state contains output from an unexpected command contract.');
+        }
+        completed.push(Object.freeze({
+            id: planned.id,
+            command: planned.command,
+            arguments: planned.arguments,
+            mode: planned.mode,
+            exitCode,
+            result: item.result,
+        }));
+    }
+    return completed;
 }
 export async function runInvestigationRecipe(recipe, subjectValue, options) {
     const plan = buildInvestigationPlan(recipe, subjectValue, options.generatedAt);
-    const prior = parseResumeState(options.resumeInput, recipe, plan.subject);
-    const allowedStepIds = new Set(plan.steps.map((step) => step.id));
-    if (prior.some((step) => !allowedStepIds.has(step.id)))
-        throw new CliUsageError('Investigation resume state contains a step outside the fixed recipe.');
+    const prior = parseResumeState(options.resumeInput, plan);
     const completed = [...prior];
     let state = 'complete';
     let currentStep = null;
@@ -69,13 +113,17 @@ export async function runInvestigationRecipe(recipe, subjectValue, options) {
             break;
         }
         const result = await options.execute(step.command, step.arguments);
+        const parsedResult = boundedResult(result.stdout);
+        if ((result.exitCode === 0 || result.exitCode === 2) && resultSchema(parsedResult) !== step.produces) {
+            throw new CliUsageError(`Investigation step ${step.id} returned an unexpected command contract.`);
+        }
         completed.push(Object.freeze({
             id: step.id,
             command: step.command,
             arguments: step.arguments,
             mode: step.mode,
             exitCode: result.exitCode,
-            result: boundedResult(result.stdout),
+            result: parsedResult,
         }));
         if (result.exitCode !== 0 && result.exitCode !== 2) {
             state = 'step_failed';

package/cli/local-mmdb-review.mjs

@@ -1,9 +1,11 @@
-import { stat } from 'node:fs/promises';
+import { constants as fsConstants } from 'node:fs';
+import { open, realpath } from 'node:fs/promises';
 import { isIP } from 'node:net';
-import { open } from 'maxmind';
+import { Reader } from 'maxmind';
 import { formatIpPrefix, parseIpPrefix } from "../lib/ip-prefix.mjs";
 import { CliUsageError } from "./errors.mjs";
 export const LOCAL_MMDB_QUERY_SCHEMA = 'whoisleuth.local-mmdb-query';
+export const LOCAL_MMDB_QUERY_VERSION = 1;
 export const MAX_LOCAL_MMDB_BYTES = 512 * 1024 * 1024;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
@@ -17,6 +19,43 @@ function names(value) {
     const source = record(value);
     return boundedText(source.en, 120);
 }
+async function readStableMmdb(databasePath) {
+    let handle = null;
+    try {
+        const resolvedPath = await realpath(databasePath);
+        handle = await open(resolvedPath, fsConstants.O_RDONLY | fsConstants.O_NONBLOCK | fsConstants.O_NOFOLLOW);
+        const before = await handle.stat();
+        if (!before.isFile() || before.size <= 0 || before.size > MAX_LOCAL_MMDB_BYTES) {
+            throw new CliUsageError(`The supplied MMDB must be a file no larger than ${MAX_LOCAL_MMDB_BYTES} bytes.`);
+        }
+        const database = Buffer.allocUnsafe(before.size);
+        let offset = 0;
+        while (offset < database.length) {
+            const { bytesRead } = await handle.read(database, offset, database.length - offset, offset);
+            if (bytesRead === 0)
+                break;
+            offset += bytesRead;
+        }
+        const after = await handle.stat();
+        if (offset !== database.length
+            || before.dev !== after.dev
+            || before.ino !== after.ino
+            || before.size !== after.size
+            || before.mtimeMs !== after.mtimeMs
+            || before.ctimeMs !== after.ctimeMs) {
+            throw new CliUsageError('The supplied MMDB changed while it was being read.');
+        }
+        return database;
+    }
+    catch (cause) {
+        if (cause instanceof CliUsageError)
+            throw cause;
+        throw new CliUsageError('The supplied MMDB file could not be read.');
+    }
+    finally {
+        await handle?.close().catch(() => { });
+    }
+}
 export async function reviewLocalMmdb(input, databasePath) {
     const address = boundedText(input.address, 64)?.toLowerCase() ?? '';
     const sourceLabel = boundedText(input.sourceLabel, 120);
@@ -27,21 +66,13 @@ export async function reviewLocalMmdb(input, databasePath) {
     if (!sourceLabel || !databaseVersion || !license) {
         throw new CliUsageError('Local MMDB review requires bounded sourceLabel, databaseVersion, and licence metadata.');
     }
-    let info;
-    try {
-        info = await stat(databasePath);
-    }
-    catch {
-        throw new CliUsageError('The supplied MMDB file could not be read.');
-    }
-    if (!info.isFile() || info.size <= 0 || info.size > MAX_LOCAL_MMDB_BYTES) {
-        throw new CliUsageError(`The supplied MMDB must be a file no larger than ${MAX_LOCAL_MMDB_BYTES} bytes.`);
-    }
     let reader;
     try {
-        reader = await open(databasePath, { cache: { max: 1_000 } });
+        reader = new Reader(await readStableMmdb(databasePath));
     }
-    catch {
+    catch (cause) {
+        if (cause instanceof CliUsageError)
+            throw cause;
         throw new CliUsageError('The supplied file is not a readable MaxMind DB database.');
     }
     const [rawMatch, prefixLength] = reader.getWithPrefixLength(address);

package/cli/lookup-command-runner.mjs

@@ -84,8 +84,8 @@ async function runLookupCommand(args, dependencies, context) {
             const evidenceModule = await loadEvidence();
             const report = buildCliEvidenceExport(JSON.stringify(document), evidenceModule, now);
             context.writeStdout(args.output === 'markdown'
-                ? formatLookupEvidenceMarkdown(report)
-                : formatLookupEvidenceHtml(report));
+                ? formatLookupEvidenceMarkdown(report, { includeAttribution: args.includeAttribution })
+                : formatLookupEvidenceHtml(report, { includeAttribution: args.includeAttribution }));
         }
         else {
             context.writeStdout(context.terminal(formatTerminalLookup(document, { detail: args.detail }), args.color));

package/cli/lookup-diff.mjs

@@ -95,6 +95,9 @@ function lookupComparisonInput(document) {
         faviconMatch: false,
         faviconNearMatch: false,
         reusesOfficialAssets: false,
+        idnReferenceMatch: false,
+        pageBaselineMatch: false,
+        hasActiveBrandProfile: false,
         hasPasswordField: recordOrEmpty(recordOrEmpty(availability.credentialSurfaceProfile).inputs).categories
             ? Number(recordOrEmpty(recordOrEmpty(recordOrEmpty(availability.credentialSurfaceProfile).inputs).categories).password) > 0
             : false,
@@ -115,6 +118,12 @@ function lookupComparisonInput(document) {
         comparisonEvidence,
         relationship,
         sourceCoverage: sourceCoverage(document, availability),
+        profileContext: {
+            sourceState: 'ready',
+            activeProfileId: null,
+            profileUpdatedAt: null,
+            limitation: '',
+        },
     };
 }
 function buildCliLookupDiff(leftText, rightText, generatedAt = new Date().toISOString(), options = {}) {

package/cli/network-command-runner.mjs

@@ -2,6 +2,8 @@ import { fetchHomepage } from "../lib/availability.mjs";
 import { searchCertificateTransparency } from "../lib/ct-search.mjs";
 import { checkDomainPosture, normalizeAuditDomain, normalizeDkimSelectors } from "../lib/domain-posture.mjs";
 import { collectTlsIntelligence, normalizeTlsHostname } from "../lib/tls-intelligence.mjs";
+import { MAX_DNSSEC_TRUST_ANCHOR_BYTES, formatDnssecChainReport, validateDnssecChain, } from "../lib/dnssec-chain-validation.mjs";
+import { MAX_MAIL_TRANSPORT_INPUT_BYTES, collectMailTransportReview, formatMailTransportReview, } from "../lib/smtp-transport-review.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { buildCliCtSearchDocument, buildCliHttpDocument, buildCliPostureDocument, buildCliTlsDocument, formatJsonDocument, } from "./formatters/json.mjs";
 import { formatTerminalCtSearch, formatTerminalHttp, formatTerminalPosture, formatTerminalTls, } from "./formatters/terminal.mjs";
@@ -71,6 +73,82 @@ async function runNetworkCommand(args, dependencies, context) {
         }
         return EXIT_CODES.SUCCESS;
     }
+    if (args.action === 'dnssec-validate') {
+        let anchorInput;
+        try {
+            anchorInput = dependencies.readTrustAnchorInput
+                ? await dependencies.readTrustAnchorInput(args.trustAnchorSource)
+                : await context.readInput(args.trustAnchorSource, MAX_DNSSEC_TRUST_ANCHOR_BYTES, 'DNSSEC trust anchor');
+        }
+        catch (error) {
+            if (error instanceof CliUsageError)
+                throw error;
+            throw new CliUsageError(`Could not read DNSSEC trust anchor: ${String(error instanceof Error ? error.message : error).slice(0, 240)}`);
+        }
+        const validate = dependencies.validateDnssecChain ?? validateDnssecChain;
+        const report = await context.withProgress('Validating the isolated DNSSEC chain', () => validate({
+            target: args.target,
+            resolver: args.resolver,
+            trustAnchor: anchorInput,
+            observedAt: context.now(),
+            ownedOrAuthorized: args.ownedOrAuthorized,
+        }));
+        if (!args.quiet) {
+            context.writeStdout(args.output === 'json'
+                ? formatJsonDocument(report)
+                : context.terminal(formatDnssecChainReport(report), args.color));
+        }
+        return report.state === 'secure' || report.state === 'insecure'
+            ? EXIT_CODES.SUCCESS
+            : EXIT_CODES.PARTIAL_FAILURE;
+    }
+    if (args.action === 'mail-transport') {
+        let input;
+        let anchorInput;
+        try {
+            input = await (dependencies.readMailTransportInput
+                ? dependencies.readMailTransportInput(args.source)
+                : context.readInput(args.source, MAX_MAIL_TRANSPORT_INPUT_BYTES, 'Mail transport input'));
+        }
+        catch (error) {
+            if (error instanceof CliUsageError)
+                throw error;
+            throw new CliUsageError(`Could not read mail transport input: ${String(error instanceof Error ? error.message : error).slice(0, 240)}`);
+        }
+        try {
+            anchorInput = await (dependencies.readTrustAnchorInput
+                ? dependencies.readTrustAnchorInput(args.trustAnchorSource)
+                : context.readInput(args.trustAnchorSource, MAX_DNSSEC_TRUST_ANCHOR_BYTES, 'DNSSEC trust anchor'));
+        }
+        catch (error) {
+            if (error instanceof CliUsageError)
+                throw error;
+            throw new CliUsageError(`Could not read DNSSEC trust anchor: ${String(error instanceof Error ? error.message : error).slice(0, 240)}`);
+        }
+        if (!input.trim())
+            throw new CliUsageError('mail-transport requires one versioned JSON file or a document on stdin.');
+        const collect = dependencies.collectMailTransportReview ?? collectMailTransportReview;
+        let review;
+        try {
+            review = await context.withProgress('Reviewing selected authorised mail transports', () => collect(input, {
+                resolver: args.resolver,
+                trustAnchor: anchorInput,
+                ownedOrAuthorized: args.ownedOrAuthorized,
+                activeProbeAcknowledged: args.activeProbeAcknowledged,
+            }));
+        }
+        catch (error) {
+            if (error instanceof TypeError)
+                throw new CliUsageError(error.message);
+            throw error;
+        }
+        if (!args.quiet) {
+            context.writeStdout(args.output === 'json'
+                ? formatJsonDocument(review)
+                : context.terminal(formatMailTransportReview(review), args.color));
+        }
+        return review.runState === 'complete' ? EXIT_CODES.SUCCESS : EXIT_CODES.PARTIAL_FAILURE;
+    }
     const requestedHostname = args.hostname || await context.readSingleInput();
     if (!requestedHostname)
         throw new CliUsageError('tls requires one hostname as an argument or on stdin.');

package/cli/offline-evidence-review.mjs

@@ -8,6 +8,7 @@ import { buildLocalGeoIpDatabase, lookupLocalGeoIp, } from "../lib/local-geoip-e
 import { inspectRdapReverseSearchResponse, normalizeRdapSearchHelp, planRdapReverseSearch, } from "../lib/rdap-search-workbench.mjs";
 import { reviewRpkiRoute } from "../lib/rpki-evidence.mjs";
 import { analyzeTlsaEvidence } from "../lib/tlsa-evidence.mjs";
+import { CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA, buildCryptographicAssuranceReview, } from "../lib/cryptographic-assurance.mjs";
 import { reviewZoneIntent } from "../lib/zone-intent-review.mjs";
 import { reviewDnsConvergence } from "../lib/dns-convergence-review.mjs";
 import { compareTrustStoreEvidence } from "../lib/trust-store-comparison.mjs";
@@ -16,6 +17,13 @@ import { LOCAL_MMDB_QUERY_SCHEMA, reviewLocalMmdb } from "./local-mmdb-review.mj
 const OFFLINE_EVIDENCE_REVIEW_SCHEMA = 'whoisleuth.cli.offline-evidence-review';
 const OFFLINE_EVIDENCE_REVIEW_VERSION = 1;
 const MAX_OFFLINE_EVIDENCE_INPUT_BYTES = 16 * 1024 * 1024;
+const RDAP_SEARCH_INPUT_SCHEMA = 'whoisleuth.rdap-search-input';
+const DNSSEC_EVIDENCE_INPUT_SCHEMA = 'whoisleuth.dnssec-evidence-input';
+const TLSA_EVIDENCE_INPUT_SCHEMA = 'whoisleuth.tlsa-evidence-input';
+const RPKI_ROUTE_INPUT_SCHEMA = 'whoisleuth.rpki-route-input';
+const LOCAL_GEOIP_QUERY_SCHEMA = 'whoisleuth.local-geoip-query';
+const ENCRYPTED_DNS_PLAN_INPUT_SCHEMA = 'whoisleuth.encrypted-dns-plan-input';
+const OFFLINE_EVIDENCE_INPUT_VERSION = 1;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -40,7 +48,7 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
     const input = parseInput(value);
     let kind;
     let result;
-    if (input.schema === 'whoisleuth.rdap-search-input') {
+    if (input.schema === RDAP_SEARCH_INPUT_SCHEMA) {
         kind = 'rdap_search';
         const request = record(input.request);
         const help = normalizeRdapSearchHelp(input.help);
@@ -58,7 +66,7 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
                 : inspectRdapReverseSearchResponse(input.response, [request.property]),
         });
     }
-    else if (input.schema === 'whoisleuth.dnssec-evidence-input') {
+    else if (input.schema === DNSSEC_EVIDENCE_INPUT_SCHEMA) {
         kind = 'dnssec';
         result = validateDnssecEvidence({
             ownerName: input.ownerName,
@@ -69,7 +77,7 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
             observedAt: input.observedAt,
         });
     }
-    else if (input.schema === 'whoisleuth.tlsa-evidence-input') {
+    else if (input.schema === TLSA_EVIDENCE_INPUT_SCHEMA) {
         kind = 'tlsa';
         result = analyzeTlsaEvidence({
             serviceName: input.serviceName,
@@ -81,7 +89,7 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
             authorityMaterials: input.authorityMaterials,
         });
     }
-    else if (input.schema === 'whoisleuth.rpki-route-input') {
+    else if (input.schema === RPKI_ROUTE_INPUT_SCHEMA) {
         kind = 'rpki';
         result = reviewRpkiRoute({
             routePrefix: input.routePrefix,
@@ -89,11 +97,15 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
             authorizations: input.authorizations,
         });
     }
-    else if (input.schema === 'whoisleuth.local-geoip-query') {
+    else if (input.schema === CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA) {
+        kind = 'cryptographic_assurance';
+        result = buildCryptographicAssuranceReview(input, generatedAt);
+    }
+    else if (input.schema === LOCAL_GEOIP_QUERY_SCHEMA) {
         kind = 'geoip';
         result = lookupLocalGeoIp(buildLocalGeoIpDatabase(input.database), input.address);
     }
-    else if (input.schema === 'whoisleuth.encrypted-dns-plan-input') {
+    else if (input.schema === ENCRYPTED_DNS_PLAN_INPUT_SCHEMA) {
         kind = 'encrypted_dns';
         const query = record(input.query);
         result = planEncryptedDnsQuery(normalizeEncryptedDnsAdapter(input.adapter), { name: query.name, type: query.type });
@@ -168,7 +180,8 @@ function formatOfflineEvidenceReview(document) {
                 : 'review'
             : typeof gate.pass === 'boolean'
                 ? gate.pass ? 'ready' : 'review'
-                : document.kind === 'domain_portfolio' ? 'inventory' : 'reviewed';
+                : document.kind === 'domain_portfolio' ? 'inventory'
+                    : document.kind === 'cryptographic_assurance' ? 'separate' : 'reviewed';
     const lines = [
         'Offline evidence review',
         `Kind   ${document.kind.replaceAll('_', ' ')}`,
@@ -220,6 +233,13 @@ function formatOfflineEvidenceReview(document) {
         lines.push(`Recovery ${listLength(result.recoveryCycles)}`);
         lines.push(`Unknown ${Object.values(unknownCounts).reduce((total, value) => total + count(value), 0)}`);
     }
+    else if (document.kind === 'cryptographic_assurance') {
+        const cards = Array.isArray(result.cards) ? result.cards : [];
+        for (const value of cards) {
+            const card = record(value);
+            lines.push(`${String(card.label ?? card.family ?? 'Evidence')}  ${String(card.state ?? 'unavailable').replaceAll('_', ' ')} (${String(card.completeness ?? 'unavailable')})`);
+        }
+    }
     else {
         for (const [label, key] of [
             ['Records', 'records'],
@@ -253,4 +273,4 @@ function formatOfflineEvidenceReview(document) {
     }
     return `${lines.join('\n')}\n`;
 }
-export { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, OFFLINE_EVIDENCE_REVIEW_SCHEMA, OFFLINE_EVIDENCE_REVIEW_VERSION, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, };
+export { DNSSEC_EVIDENCE_INPUT_SCHEMA, ENCRYPTED_DNS_PLAN_INPUT_SCHEMA, LOCAL_GEOIP_QUERY_SCHEMA, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, OFFLINE_EVIDENCE_INPUT_VERSION, OFFLINE_EVIDENCE_REVIEW_SCHEMA, OFFLINE_EVIDENCE_REVIEW_VERSION, RDAP_SEARCH_INPUT_SCHEMA, RPKI_ROUTE_INPUT_SCHEMA, TLSA_EVIDENCE_INPUT_SCHEMA, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, };

package/cli/page-compare.mjs

@@ -4,7 +4,7 @@ import { comparePageBaselines } from "../frontend/src/lib/analysis/page-similari
 import { CliUsageError } from "./errors.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
 export const CLI_PAGE_COMPARE_SCHEMA = 'whoisleuth.cli.page-compare';
-export const CLI_PAGE_COMPARE_VERSION = 2;
+export const CLI_PAGE_COMPARE_VERSION = 3;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -56,6 +56,8 @@ function buildCliPageComparison(leftText, rightText, generatedAt = new Date().to
         && ['success', 'partial'].includes(right.compact.technology.state);
     const tlsUsable = ['success', 'partial'].includes(left.compact.tls.state)
         && ['success', 'partial'].includes(right.compact.tls.state);
+    const technologyPartial = left.compact.technology.truncated || right.compact.technology.truncated
+        || left.compact.technology.state === 'partial' || right.compact.technology.state === 'partial';
     return {
         schema: CLI_PAGE_COMPARE_SCHEMA,
         version: CLI_PAGE_COMPARE_VERSION,
@@ -72,14 +74,15 @@ function buildCliPageComparison(leftText, rightText, generatedAt = new Date().to
         },
         page,
         technology: {
-            state: technologyUsable ? setComparison(leftTechnology, rightTechnology) : 'unavailable',
+            state: technologyUsable
+                ? technologyPartial ? 'partial' : setComparison(leftTechnology, rightTechnology)
+                : 'unavailable',
             leftSourceState: left.compact.technology.state,
             rightSourceState: right.compact.technology.state,
             leftIds: leftTechnology,
             rightIds: rightTechnology,
             sharedIds: sharedTechnology,
-            partial: left.compact.technology.truncated || right.compact.technology.truncated
-                || left.compact.technology.state === 'partial' || right.compact.technology.state === 'partial',
+            partial: technologyPartial,
         },
         tls: {
             leftSourceState: left.compact.tls.state,
@@ -115,7 +118,7 @@ function formatCliPageComparison(document) {
     for (const component of document.page.components) {
         lines.push(`${component.label.padEnd(18)} ${component.outcome}`);
     }
-    lines.push('', 'Technology', `Relationship     ${document.technology.state}`, `Shared           ${document.technology.sharedIds.join(', ') || 'None observed'}`, `Left             ${document.technology.leftIds.join(', ') || 'Unavailable'}`, `Right            ${document.technology.rightIds.join(', ') || 'Unavailable'}`, '', 'TLS', `Issuer           ${document.tls.issuer.state}`, `Public key       ${document.tls.publicKey.state}`, '', 'Limitations:');
+    lines.push('', 'Technology', `Relationship     ${document.technology.state}`, `Evidence         ${document.technology.partial ? 'Partial; equality and disjointness withheld' : 'Complete retained sets'}`, `Shared           ${document.technology.sharedIds.join(', ') || 'None observed'}`, `Left             ${document.technology.leftIds.join(', ') || 'Unavailable'}`, `Right            ${document.technology.rightIds.join(', ') || 'Unavailable'}`, '', 'TLS', `Issuer           ${document.tls.issuer.state}`, `Public key       ${document.tls.publicKey.state}`, '', 'Limitations:');
     for (const limitation of document.limitations)
         lines.push(`  - ${limitation}`);
     return `${lines.join('\n')}\n`;