@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/cli/retained-artifact-diff.mjs

@@ -0,0 +1,375 @@
+import { Buffer } from 'node:buffer';
+import { createHash } from 'node:crypto';
+import { canonicalArtifactJsonV2 } from "../packages/evidence/artifact-integrity.mjs";
+import { BULK_SESSION_SCHEMA, MAX_BULK_SESSIONS, MAX_BULK_SESSION_ROWS, SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS, mergeBulkSessions, normalizeBulkSession, } from "../packages/workspace/bulk-session-model.mjs";
+import { buildBulkComparisonCandidates } from "../packages/comparison/comparison-ledger-bulk.mjs";
+import { MAX_COMPARISON_LEDGER_DETAIL_ROWS, boundedComparisonLedgerLimitations, comparisonLedgerCollector, comparisonLedgerValuePresent, freshComparisonLedgerCounters, makeComparisonLedgerCandidate, normaliseComparisonLedgerRowWithCounters, stableComparisonLedgerId, stableComparisonLedgerJson, } from "../packages/comparison/comparison-ledger-contract.mjs";
+import { DOMAIN_PORTFOLIO_INPUT_SCHEMA, DOMAIN_PORTFOLIO_REVIEW_SCHEMA, DOMAIN_PORTFOLIO_REVIEW_VERSION, reviewDomainPortfolio, } from "../lib/domain-portfolio-review.mjs";
+import { parseBoundedJsonObject } from "./bounded-json.mjs";
+import { CliUsageError } from "./errors.mjs";
+import { buildCliLookupDiff, formatCliLookupDiff } from "./lookup-diff.mjs";
+import { SAVED_LOOKUP_SCHEMA } from "./saved-lookup.mjs";
+import { CLI_COMPARISON_LEDGER_SCHEMA, CLI_COMPARISON_LEDGER_VERSION, MAX_RETAINED_ARTIFACT_DIFF_BYTES, } from "../packages/contracts/offline-comparison.mjs";
+export { CLI_COMPARISON_LEDGER_SCHEMA, CLI_COMPARISON_LEDGER_VERSION, MAX_RETAINED_ARTIFACT_DIFF_BYTES };
+const BULK_ROOT_KEYS = new Set(['schema', 'version', 'generatedAt', 'sessions', 'limitations']);
+const PORTFOLIO_ROOT_KEYS = new Set(['schema', 'version', 'generatedAt', 'portfolioLabel', 'assets', 'simulations', 'renewalQueue', 'recoveryCycles', 'unknownCounts', 'limitations']);
+const SAFE_SESSION_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+function exactKeys(value, allowed, label) {
+    if (Object.keys(value).some((key) => !allowed.has(key)) || [...allowed].some((key) => !Object.hasOwn(value, key))) {
+        throw new CliUsageError(`${label} does not match its exact retained export contract.`);
+    }
+}
+function timestamp(value, label) {
+    if (typeof value !== 'string' || value.length > 64 || /[\u0000-\u001f\u007f]/u.test(value)) {
+        throw new CliUsageError(`${label} is missing or invalid.`);
+    }
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed))
+        throw new CliUsageError(`${label} is missing or invalid.`);
+    return new Date(parsed).toISOString();
+}
+function digest(value) {
+    return `sha256:${createHash('sha256').update(value, 'utf8').digest('hex')}`;
+}
+function parseDocument(raw, label) {
+    try {
+        return parseBoundedJsonObject(raw, { label, maximumBytes: MAX_RETAINED_ARTIFACT_DIFF_BYTES });
+    }
+    catch (error) {
+        throw new CliUsageError(error instanceof Error ? error.message : `${label} is invalid.`);
+    }
+}
+function assertLimitations(value, label) {
+    if (!Array.isArray(value) || value.length > 8 || value.some((item) => (typeof item !== 'string' || item.length > 600 || /[\u0000-\u001f\u007f]/u.test(item))))
+        throw new CliUsageError(`${label} limitations are invalid.`);
+}
+function parseBulkExport(root) {
+    exactKeys(root, BULK_ROOT_KEYS, 'Bulk session export');
+    const version = Number(root.version);
+    if (root.schema !== BULK_SESSION_SCHEMA || !SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS.includes(version)) {
+        throw new CliUsageError(`Bulk session exports must use a supported ${BULK_SESSION_SCHEMA} version.`);
+    }
+    const generatedAt = timestamp(root.generatedAt, 'Bulk session export generatedAt');
+    assertLimitations(root.limitations, 'Bulk session export');
+    if (!Array.isArray(root.sessions) || root.sessions.length < 1 || root.sessions.length > MAX_BULK_SESSIONS) {
+        throw new CliUsageError(`Bulk session exports used by diff must contain from 1 to ${MAX_BULK_SESSIONS} sessions.`);
+    }
+    const ids = new Set();
+    for (const [index, candidate] of root.sessions.entries()) {
+        const rawSession = record(candidate);
+        const rawResults = Array.isArray(rawSession?.results) ? rawSession.results : null;
+        const rawDomains = Array.isArray(rawSession?.domains) ? rawSession.domains : null;
+        const session = normalizeBulkSession(candidate);
+        if (!session || !rawResults || !rawDomains
+            || rawResults.length > MAX_BULK_SESSION_ROWS
+            || rawResults.length !== session.results.length
+            || rawDomains.length !== session.domains.length
+            || ids.has(session.id)) {
+            throw new CliUsageError(`Bulk session export row ${index + 1} is malformed, duplicated, or would be silently omitted.`);
+        }
+        ids.add(session.id);
+    }
+    const imported = mergeBulkSessions([], root);
+    if (imported.skipped || imported.pruned || imported.sessions.length !== root.sessions.length) {
+        throw new CliUsageError('Bulk session export cannot be compared without omitting or pruning retained sessions.');
+    }
+    return Object.freeze({ version, generatedAt, sessions: Object.freeze(imported.sessions) });
+}
+function selectSession(document, requested, side) {
+    if (requested !== null && requested !== undefined && !SAFE_SESSION_ID_RE.test(requested)) {
+        throw new CliUsageError(`The ${side} saved-session ID is invalid.`);
+    }
+    if (!requested && document.sessions.length !== 1) {
+        throw new CliUsageError(`The ${side} Bulk export contains multiple sessions; select one with --${side}-session.`);
+    }
+    const selected = requested
+        ? document.sessions.find((session) => session.id === requested)
+        : document.sessions[0];
+    if (!selected)
+        throw new CliUsageError(`The selected ${side} saved session was not found.`);
+    return selected;
+}
+function withoutOwnerHref(index) {
+    return Object.freeze({
+        ...index,
+        items: Object.freeze(index.items.map((item) => Object.freeze({ ...item, ownerHref: '' }))),
+    });
+}
+function withoutDetailOwnerHref(details) {
+    return Object.freeze({
+        ...details,
+        selectedItems: Object.freeze(details.selectedItems.map((item) => Object.freeze({ ...item, ownerHref: '' }))),
+    });
+}
+function buildBulkLedger(leftRaw, rightRaw, leftRoot, rightRoot, options, generatedAt) {
+    const leftDocument = parseBulkExport(leftRoot);
+    const rightDocument = parseBulkExport(rightRoot);
+    const left = selectSession(leftDocument, options.leftSessionId, 'left');
+    const right = selectSession(rightDocument, options.rightSessionId, 'right');
+    if (left.updatedAt > right.updatedAt)
+        throw new CliUsageError('Bulk diff requires the left saved session to be no later than the right saved session.');
+    const leftTransientId = stableComparisonLedgerId('cli-bulk-left', [left.id, left.updatedAt, digest(leftRaw)]);
+    const rightTransientId = stableComparisonLedgerId('cli-bulk-right', [right.id, right.updatedAt, digest(rightRaw)]);
+    const transientLeft = { ...left, id: leftTransientId };
+    const transientRight = { ...right, id: rightTransientId };
+    const counters = freshComparisonLedgerCounters();
+    const candidates = buildBulkComparisonCandidates([transientLeft, transientRight], [{ earlierSessionId: leftTransientId, laterSessionId: rightTransientId }], counters);
+    const candidate = candidates[0];
+    if (!candidate || candidates.length !== 1)
+        throw new CliUsageError('The selected Bulk sessions are not a compatible chronological pair.');
+    const projected = projectSingleCandidate(candidate, counters);
+    return Object.freeze({
+        schema: CLI_COMPARISON_LEDGER_SCHEMA,
+        version: CLI_COMPARISON_LEDGER_VERSION,
+        generatedAt: timestamp(generatedAt, 'Comparison ledger generatedAt'),
+        artifactFamily: 'bulk_sessions',
+        left: Object.freeze({ schema: BULK_SESSION_SCHEMA, version: leftDocument.version, id: left.id, label: left.name, retainedAt: left.updatedAt }),
+        right: Object.freeze({ schema: BULK_SESSION_SCHEMA, version: rightDocument.version, id: right.id, label: right.name, retainedAt: right.updatedAt }),
+        index: withoutOwnerHref(projected.index),
+        details: withoutDetailOwnerHref(projected.details),
+        limitations: Object.freeze([
+            'The ledger compares one explicit chronological pair of compact retained Bulk sessions without making a request or reading source file paths.',
+            'Portable session claims are treated as unauthenticated imports: profile-derived trust, matches, and Risk remain quarantined while independent retained source fields can still be reviewed.',
+            'Missing later rows are not domain removals, releases, resolution changes, or availability findings.',
+        ]),
+    });
+}
+function parsePortfolioReview(root) {
+    exactKeys(root, PORTFOLIO_ROOT_KEYS, 'Domain portfolio review');
+    if (root.schema !== DOMAIN_PORTFOLIO_REVIEW_SCHEMA || root.version !== DOMAIN_PORTFOLIO_REVIEW_VERSION) {
+        throw new CliUsageError(`Domain portfolio reviews must use ${DOMAIN_PORTFOLIO_REVIEW_SCHEMA} version ${DOMAIN_PORTFOLIO_REVIEW_VERSION}.`);
+    }
+    const rebuilt = reviewDomainPortfolio({
+        schema: DOMAIN_PORTFOLIO_INPUT_SCHEMA,
+        version: 1,
+        portfolioLabel: root.portfolioLabel,
+        assets: root.assets,
+    }, timestamp(root.generatedAt, 'Domain portfolio review generatedAt'));
+    if (canonicalArtifactJsonV2(rebuilt) !== canonicalArtifactJsonV2(root)) {
+        throw new CliUsageError('Domain portfolio review derived fields do not match its bounded source asset projection.');
+    }
+    return rebuilt;
+}
+const PORTFOLIO_FIELDS = Object.freeze([
+    ['Criticality', 'portfolio', (item) => item.criticality],
+    ['Registrar', 'registration', (item) => item.registrar],
+    ['Registrar account label', 'registration', (item) => item.registrarAccount],
+    ['Expiry', 'registration', (item) => item.expiresAt],
+    ['Auto-renew', 'registration', (item) => item.autoRenew],
+    ['DNS providers', 'dns', (item) => item.dnsProviders],
+    ['Mail providers', 'mail', (item) => item.mailProviders],
+    ['Certificate providers', 'certificate', (item) => item.certificateProviders],
+    ['Recovery domains', 'recovery', (item) => item.recoveryDomains],
+]);
+function portfolioSide(report, value, observedAt = null) {
+    return {
+        source: `Retained domain portfolio · ${report.portfolioLabel}`,
+        sourceState: 'analyst_supplied',
+        value,
+        observedAt,
+        retainedAt: report.generatedAt,
+    };
+}
+function portfolioRows(ownerId, earlier, later) {
+    const output = comparisonLedgerCollector();
+    let incomplete = false;
+    const before = new Map(earlier.assets.map((asset) => [asset.domain, asset]));
+    const after = new Map(later.assets.map((asset) => [asset.domain, asset]));
+    for (const domain of [...new Set([...before.keys(), ...after.keys()])].sort()) {
+        const left = before.get(domain);
+        const right = after.get(domain);
+        if (!left && right) {
+            output.add({ comparisonId: ownerId, ownerId, entityId: domain, mode: 'membership', state: 'added', field: 'Retained portfolio membership', family: 'membership', earlier: portfolioSide(earlier, null), later: portfolioSide(later, 'Included', right.reviewedAt), completeness: 'complete', limitations: ['Membership applies only to the two analyst-supplied retained portfolios; it is not evidence of registration, ownership, control, or activity.'] });
+            continue;
+        }
+        if (left && !right) {
+            incomplete = true;
+            output.add({ comparisonId: ownerId, ownerId, entityId: domain, mode: 'membership', state: 'not_compared', field: 'Retained portfolio membership', family: 'membership', earlier: portfolioSide(earlier, 'Included', left.reviewedAt), later: portfolioSide(later, null), completeness: 'partial', limitations: ['The later retained portfolio omits this asset. That omission is not evidence of registration removal, release, loss of control, or inactivity.'] });
+            continue;
+        }
+        if (!left || !right)
+            continue;
+        const leftRecord = left;
+        const rightRecord = right;
+        for (const [field, family, read] of PORTFOLIO_FIELDS) {
+            const beforeValue = read(leftRecord);
+            const afterValue = read(rightRecord);
+            if (stableComparisonLedgerJson(beforeValue) === stableComparisonLedgerJson(afterValue))
+                continue;
+            const afterPresent = comparisonLedgerValuePresent(afterValue);
+            const beforePresent = comparisonLedgerValuePresent(beforeValue);
+            if (beforePresent && !afterPresent)
+                incomplete = true;
+            output.add({
+                comparisonId: ownerId,
+                ownerId,
+                entityId: domain,
+                mode: 'temporal',
+                state: !beforePresent && afterPresent ? 'added' : beforePresent && !afterPresent ? 'incomplete' : 'different',
+                field,
+                family,
+                earlier: portfolioSide(earlier, beforeValue, left.reviewedAt),
+                later: portfolioSide(later, afterValue, right.reviewedAt),
+                completeness: beforePresent && !afterPresent ? 'partial' : 'complete',
+                limitations: ['Values are bounded analyst-supplied portfolio assertions, not current provider observations or proof of ownership, configuration, or responsibility.'],
+            });
+        }
+        if (left.reviewedAt !== right.reviewedAt) {
+            output.add({ comparisonId: ownerId, ownerId, entityId: domain, mode: 'temporal', state: 'collection_changed', field: 'Analyst review time', family: 'collection', earlier: portfolioSide(earlier, left.reviewedAt, left.reviewedAt), later: portfolioSide(later, right.reviewedAt, right.reviewedAt), completeness: 'complete', limitations: ['Review-time movement records analyst retention context and is not a change to the domain or provider.'] });
+        }
+    }
+    if (!output.totalRows) {
+        output.add({ comparisonId: ownerId, ownerId, entityId: 'portfolio-summary', mode: 'temporal', state: 'equivalent', field: 'Bounded retained portfolio assertions', family: 'summary', earlier: portfolioSide(earlier, 'No bounded material difference'), later: portfolioSide(later, 'No bounded material difference'), completeness: 'complete', limitations: ['Equivalence applies only to the exact bounded analyst-supplied fields retained in both portfolio review documents.'] });
+    }
+    return Object.freeze({
+        projection: Object.freeze({ rows: output.rows, totalRows: output.totalRows, sourceOmittedRows: 0 }),
+        incomplete,
+    });
+}
+function projectSingleCandidate(candidate, counters) {
+    const indexOmissions = Object.freeze({
+        inputRecords: counters.inputRecords,
+        inputScanTruncations: counters.inputScanTruncations,
+        invalidRecords: counters.invalidRecords,
+        duplicateRecords: counters.duplicateRecords,
+        indexItems: 0,
+        limitations: counters.limitations,
+        truncatedStrings: counters.truncatedStrings,
+    });
+    const index = Object.freeze({ items: Object.freeze([candidate.item]), counts: Object.freeze({ candidates: 1, retained: 1 }), omissions: indexOmissions, truncated: candidate.item.truncated || Object.values(indexOmissions).some((count) => count > 0) });
+    const projection = candidate.buildDetails();
+    const rows = [];
+    const ids = new Set();
+    let invalidRows = 0;
+    let duplicateRows = 0;
+    for (const rawRow of projection.rows) {
+        const row = normaliseComparisonLedgerRowWithCounters(rawRow, counters);
+        if (!row) {
+            invalidRows += 1;
+            continue;
+        }
+        if (ids.has(row.id)) {
+            duplicateRows += 1;
+            continue;
+        }
+        ids.add(row.id);
+        if (rows.length < MAX_COMPARISON_LEDGER_DETAIL_ROWS)
+            rows.push(row);
+    }
+    rows.sort((left, right) => left.entityId.localeCompare(right.entityId) || left.family.localeCompare(right.family) || left.field.localeCompare(right.field) || left.id.localeCompare(right.id));
+    const totalRows = Math.max(0, projection.totalRows - duplicateRows);
+    const limitations = boundedComparisonLedgerLimitations(candidate.item.limitations, counters);
+    const omissions = Object.freeze({
+        inputRecords: counters.inputRecords,
+        inputScanTruncations: counters.inputScanTruncations,
+        invalidRecords: counters.invalidRecords + invalidRows,
+        duplicateRecords: counters.duplicateRecords,
+        indexItems: 0,
+        entityRequests: 0,
+        duplicateEntityRequests: 0,
+        invalidEntityRequests: 0,
+        missingEntities: 0,
+        duplicateDetailRows: duplicateRows,
+        detailRows: Math.max(0, totalRows - rows.length),
+        sourceRows: projection.sourceOmittedRows,
+        limitations: counters.limitations,
+        truncatedStrings: counters.truncatedStrings,
+    });
+    const details = Object.freeze({ selectedItems: Object.freeze([candidate.item]), rows: Object.freeze(rows), totalRows, limitations: limitations.values, omissions, truncated: candidate.item.truncated || Object.values(omissions).some((count) => count > 0) });
+    return Object.freeze({ index, details });
+}
+function buildPortfolioLedger(leftRaw, rightRaw, leftRoot, rightRoot, generatedAt) {
+    const left = parsePortfolioReview(leftRoot);
+    const right = parsePortfolioReview(rightRoot);
+    if (left.generatedAt > right.generatedAt)
+        throw new CliUsageError('Domain portfolio diff requires the left review to be no later than the right review.');
+    const counters = freshComparisonLedgerCounters();
+    const ownerId = stableComparisonLedgerId('retained-portfolio-pair', [digest(leftRaw), digest(rightRaw)]);
+    const portfolioProjection = portfolioRows(ownerId, left, right);
+    const { projection } = portfolioProjection;
+    const completeness = portfolioProjection.incomplete ? 'partial' : 'complete';
+    const projectionTruncated = projection.totalRows > projection.rows.length;
+    const candidate = makeComparisonLedgerCandidate({
+        idParts: [digest(leftRaw), digest(rightRaw)],
+        ownerType: 'retained_artifact_pair',
+        ownerId,
+        entityId: 'domain-portfolio-pair',
+        label: `${left.portfolioLabel} → ${right.portfolioLabel} · retained portfolio pair`,
+        mode: 'temporal',
+        earlier: portfolioSide(left, null),
+        later: portfolioSide(right, null),
+        completeness,
+        truncated: projectionTruncated,
+        limitations: [
+            'This offline ledger compares bounded retained analyst-supplied portfolio assertions and makes no provider request.',
+            ...(completeness === 'partial' ? ['At least one later omission is not represented as a real-world removal or resolved dependency.'] : []),
+        ],
+        ownerHref: '',
+        buildDetails: () => projection,
+    }, counters);
+    if (!candidate)
+        throw new CliUsageError('The retained domain portfolio pair could not be projected safely.');
+    const projected = projectSingleCandidate(candidate, counters);
+    return Object.freeze({
+        schema: CLI_COMPARISON_LEDGER_SCHEMA,
+        version: CLI_COMPARISON_LEDGER_VERSION,
+        generatedAt: timestamp(generatedAt, 'Comparison ledger generatedAt'),
+        artifactFamily: 'domain_portfolio',
+        left: Object.freeze({ schema: DOMAIN_PORTFOLIO_REVIEW_SCHEMA, version: DOMAIN_PORTFOLIO_REVIEW_VERSION, id: digest(leftRaw), label: left.portfolioLabel, retainedAt: left.generatedAt }),
+        right: Object.freeze({ schema: DOMAIN_PORTFOLIO_REVIEW_SCHEMA, version: DOMAIN_PORTFOLIO_REVIEW_VERSION, id: digest(rightRaw), label: right.portfolioLabel, retainedAt: right.generatedAt }),
+        ...projected,
+        limitations: Object.freeze([
+            'Only the two explicitly selected retained review documents are compared; source file paths are not retained.',
+            'Portfolio values are analyst-supplied context. They do not prove live configuration, registration, ownership, control, availability, or provider responsibility.',
+        ]),
+    });
+}
+export function buildCliRetainedArtifactDiff(leftRaw, rightRaw, options = {}, generatedAt = new Date().toISOString()) {
+    if (Buffer.byteLength(leftRaw, 'utf8') + Buffer.byteLength(rightRaw, 'utf8') > MAX_RETAINED_ARTIFACT_DIFF_BYTES * 2) {
+        throw new CliUsageError(`Retained diff input is limited to ${MAX_RETAINED_ARTIFACT_DIFF_BYTES * 2} bytes in total.`);
+    }
+    const left = parseDocument(leftRaw, 'Left retained diff input');
+    const right = parseDocument(rightRaw, 'Right retained diff input');
+    if (left.schema !== right.schema)
+        throw new CliUsageError('diff requires two retained documents from the same supported artifact family.');
+    if (left.schema === SAVED_LOOKUP_SCHEMA) {
+        if (options.leftSessionId || options.rightSessionId)
+            throw new CliUsageError('Saved-session selectors apply only to Bulk session exports.');
+        return buildCliLookupDiff(leftRaw, rightRaw, generatedAt);
+    }
+    if (left.schema === BULK_SESSION_SCHEMA)
+        return buildBulkLedger(leftRaw, rightRaw, left, right, options, generatedAt);
+    if (left.schema === DOMAIN_PORTFOLIO_REVIEW_SCHEMA) {
+        if (options.leftSessionId || options.rightSessionId)
+            throw new CliUsageError('Saved-session selectors apply only to Bulk session exports.');
+        return buildPortfolioLedger(leftRaw, rightRaw, left, right, generatedAt);
+    }
+    throw new CliUsageError('diff supports saved Lookups, Bulk session exports, or retained domain portfolio reviews.');
+}
+export function formatCliRetainedArtifactDiff(document) {
+    if (document.schema !== CLI_COMPARISON_LEDGER_SCHEMA)
+        return formatCliLookupDiff(document);
+    const lines = [
+        'Retained artifact comparison ledger',
+        `Family           ${document.artifactFamily.replaceAll('_', ' ')}`,
+        `Left             ${document.left.label} · ${document.left.id}`,
+        `Right            ${document.right.label} · ${document.right.id}`,
+        `Candidates       ${document.index.counts.retained}`,
+        `Exact rows       ${document.details.rows.length} of ${document.details.totalRows}`,
+        '',
+    ];
+    for (const row of document.details.rows) {
+        lines.push(`${row.entityId} · ${row.field} [${row.state.replaceAll('_', ' ')}]`);
+        lines.push(`  Earlier: ${row.earlier.value ?? 'not retained'} · ${row.earlier.sourceState}`);
+        lines.push(`  Later:   ${row.later.value ?? 'not retained'} · ${row.later.sourceState}`);
+    }
+    if (document.details.omissions.detailRows)
+        lines.push(`Omitted exact rows: ${document.details.omissions.detailRows}`);
+    lines.push('', 'Limitations:');
+    for (const limitation of document.limitations)
+        lines.push(`  - ${limitation}`);
+    return `${lines.join('\n')}\n`;
+}

package/cli/risk-calibration.mjs

@@ -1,21 +1,16 @@
 import { Buffer } from 'node:buffer';
+import { decodeBoundedUtf8 } from "../lib/bounded-file.mjs";
 import { isValidAsciiDomainName } from "../lib/hostname.mjs";
+import { scanBoundedJson } from "../lib/bounded-json.mjs";
+import { canonicalRegistrableDomain } from "../lib/registrable-domain.mjs";
 import { ANALYST_REVIEW_REASON_VALUES, analystInteroperabilityTags } from "../lib/analyst-taxonomy.mjs";
+import { buildRiskCalibrationSummaryReport, parseRiskCalibrationSummaryReport, RISK_CALIBRATION_SUMMARY_INTERPRETATION, RISK_CALIBRATION_SUMMARY_THRESHOLDS, } from "../lib/risk-calibration-summary.mjs";
+import { MAX_RISK_CALIBRATION_ACTIVITY_LENGTH, MAX_RISK_CALIBRATION_AVAILABILITY_LENGTH, MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, MAX_RISK_CALIBRATION_DOMAIN_AGE_DAYS, MAX_RISK_CALIBRATION_DOMAIN_LENGTH, MAX_RISK_CALIBRATION_FINDING_CATEGORY_LENGTH, MAX_RISK_CALIBRATION_FINDINGS_PER_PROVIDER, MAX_RISK_CALIBRATION_INPUT_BYTES, MAX_RISK_CALIBRATION_JSON_CONTAINER_ITEMS, MAX_RISK_CALIBRATION_JSON_DEPTH, MAX_RISK_CALIBRATION_JSON_KEYS, MAX_RISK_CALIBRATION_JSON_VALUES, MAX_RISK_CALIBRATION_MUTATIONS, MAX_RISK_CALIBRATION_PROVIDER_ID_LENGTH, MAX_RISK_CALIBRATION_PROVIDER_STATE_LENGTH, MAX_RISK_CALIBRATION_PROVIDERS, MAX_RISK_CALIBRATION_RECORD_ID_LENGTH, MAX_RISK_CALIBRATION_RECORDS, MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH, MAX_RISK_CALIBRATION_SCAN_DEPTH_LENGTH, MAX_RISK_CALIBRATION_STRING_LENGTH, MAX_RISK_CALIBRATION_TIMESTAMP_LENGTH, RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_DATASET_VERSION, RISK_CALIBRATION_REPORT_SCHEMA, RISK_CALIBRATION_REPORT_VERSION, serializeRiskCalibrationSnapshot, snapshotRiskCalibrationReportForSerialization, SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS, } from "../packages/contracts/risk-calibration.mjs";
 import { CliUsageError } from "./arguments.mjs";
-import { RISK_MUTATION_TYPES, RISK_REVIEW_THRESHOLD } from "../lib/risk-scoring.mjs";
-export const RISK_CALIBRATION_DATASET_SCHEMA = 'whoisleuth.risk-calibration-dataset';
-export const RISK_CALIBRATION_DATASET_VERSION = 2;
-export const SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS = Object.freeze([1, RISK_CALIBRATION_DATASET_VERSION]);
-export const RISK_CALIBRATION_REPORT_SCHEMA = 'whoisleuth.cli.risk-calibration';
-export const RISK_CALIBRATION_REPORT_VERSION = 2;
-export const MAX_RISK_CALIBRATION_INPUT_BYTES = 2 * 1024 * 1024;
-export const MAX_RISK_CALIBRATION_RECORDS = 500;
-export const MAX_RISK_CALIBRATION_STRING_LENGTH = 256;
-export const RISK_CALIBRATION_THRESHOLDS = Object.freeze([...new Set([40, 50, 60, RISK_REVIEW_THRESHOLD, 80, 90])].sort((a, b) => a - b));
-const MAX_MUTATIONS = 30;
-const MAX_PROVIDERS = 10;
-const MAX_FINDINGS_PER_PROVIDER = 100;
-const MAX_TIMESTAMP_LENGTH = 64;
+import { RISK_MUTATION_TYPES } from "../lib/risk-scoring.mjs";
+import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_SCHEMA, } from "../lib/threat-intelligence-types.mjs";
+export { MAX_RISK_CALIBRATION_INPUT_BYTES, MAX_RISK_CALIBRATION_RECORDS, MAX_RISK_CALIBRATION_STRING_LENGTH, RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_DATASET_VERSION, RISK_CALIBRATION_REPORT_SCHEMA, RISK_CALIBRATION_REPORT_VERSION, SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS, } from "../packages/contracts/risk-calibration.mjs";
+export const RISK_CALIBRATION_THRESHOLDS = RISK_CALIBRATION_SUMMARY_THRESHOLDS;
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
 const DISPOSITIONS = new Set([
     'unreviewed', 'suspicious', 'confirmed_abuse', 'false_positive', 'expected', 'closed_no_action',
@@ -48,7 +43,7 @@ function boundedString(value, field, maximum = MAX_RISK_CALIBRATION_STRING_LENGT
 function optionalTimestamp(value, field) {
     if (value === null || value === undefined)
         return undefined;
-    return boundedString(value, field, MAX_TIMESTAMP_LENGTH);
+    return boundedString(value, field, MAX_RISK_CALIBRATION_TIMESTAMP_LENGTH);
 }
 function projectThreatIntelligence(value, field) {
     if (value === null || value === undefined)
@@ -56,8 +51,8 @@ function projectThreatIntelligence(value, field) {
     const envelope = object(value, field);
     if (!Array.isArray(envelope.providers))
         throw new CliUsageError(`${field}.providers must be an array.`);
-    if (envelope.providers.length > MAX_PROVIDERS)
-        throw new CliUsageError(`${field}.providers exceeds the ${MAX_PROVIDERS}-provider limit.`);
+    if (envelope.providers.length > MAX_RISK_CALIBRATION_PROVIDERS)
+        throw new CliUsageError(`${field}.providers exceeds the ${MAX_RISK_CALIBRATION_PROVIDERS}-provider limit.`);
     return {
         providers: envelope.providers.map((item, providerIndex) => {
             const prefix = `${field}.providers[${providerIndex}]`;
@@ -68,15 +63,15 @@ function projectThreatIntelligence(value, field) {
                 : object(provider.observation, `${prefix}.observation`);
             if (!Array.isArray(provider.findings))
                 throw new CliUsageError(`${prefix}.findings must be an array.`);
-            if (provider.findings.length > MAX_FINDINGS_PER_PROVIDER) {
-                throw new CliUsageError(`${prefix}.findings exceeds the ${MAX_FINDINGS_PER_PROVIDER}-finding limit.`);
+            if (provider.findings.length > MAX_RISK_CALIBRATION_FINDINGS_PER_PROVIDER) {
+                throw new CliUsageError(`${prefix}.findings exceeds the ${MAX_RISK_CALIBRATION_FINDINGS_PER_PROVIDER}-finding limit.`);
             }
             const observedAt = observation
                 ? optionalTimestamp(observation.observedAt, `${prefix}.observation.observedAt`)
                 : undefined;
             return {
-                provider: { id: boundedString(identity.id, `${prefix}.provider.id`, 64) },
-                state: boundedString(provider.state, `${prefix}.state`, 32),
+                provider: { id: boundedString(identity.id, `${prefix}.provider.id`, MAX_RISK_CALIBRATION_PROVIDER_ID_LENGTH) },
+                state: boundedString(provider.state, `${prefix}.state`, MAX_RISK_CALIBRATION_PROVIDER_STATE_LENGTH),
                 ...(observation ? { observation: observedAt ? { observedAt } : {} } : {}),
                 findings: provider.findings.map((findingValue, findingIndex) => {
                     const findingPrefix = `${prefix}.findings[${findingIndex}]`;
@@ -84,7 +79,7 @@ function projectThreatIntelligence(value, field) {
                     const firstObservedAt = optionalTimestamp(finding.firstObservedAt, `${findingPrefix}.firstObservedAt`);
                     const lastObservedAt = optionalTimestamp(finding.lastObservedAt, `${findingPrefix}.lastObservedAt`);
                     return {
-                        category: boundedString(finding.category, `${findingPrefix}.category`, 64),
+                        category: boundedString(finding.category, `${findingPrefix}.category`, MAX_RISK_CALIBRATION_FINDING_CATEGORY_LENGTH),
                         ...(firstObservedAt ? { firstObservedAt } : {}),
                         ...(lastObservedAt ? { lastObservedAt } : {}),
                     };
@@ -95,10 +90,12 @@ function projectThreatIntelligence(value, field) {
 }
 function projectEvidence(value, field) {
     const source = object(value, field);
-    const availability = boundedString(source.availability ?? source.state, `${field}.availability`, 32);
+    const availability = boundedString(source.availability ?? source.state, `${field}.availability`, MAX_RISK_CALIBRATION_AVAILABILITY_LENGTH);
     if (!AVAILABILITY_STATES.has(availability))
         throw new CliUsageError(`${field}.availability is unsupported.`);
-    const result = { availability };
+    const result = {
+        availability: availability,
+    };
     for (const name of BOOLEAN_FIELDS) {
         const candidate = source[name];
         if (candidate === null || candidate === undefined)
@@ -108,13 +105,13 @@ function projectEvidence(value, field) {
         result[name] = candidate;
     }
     if (source.activityStatus !== null && source.activityStatus !== undefined) {
-        const activity = boundedString(source.activityStatus, `${field}.activityStatus`, 32);
+        const activity = boundedString(source.activityStatus, `${field}.activityStatus`, MAX_RISK_CALIBRATION_ACTIVITY_LENGTH);
         if (!ACTIVITY_STATES.has(activity))
             throw new CliUsageError(`${field}.activityStatus is unsupported.`);
         result.activityStatus = activity;
     }
     if (source.scanDepth !== null && source.scanDepth !== undefined) {
-        const depth = boundedString(source.scanDepth, `${field}.scanDepth`, 16);
+        const depth = boundedString(source.scanDepth, `${field}.scanDepth`, MAX_RISK_CALIBRATION_SCAN_DEPTH_LENGTH);
         if (depth !== 'fast' && depth !== 'deep')
             throw new CliUsageError(`${field}.scanDepth must be fast or deep.`);
         Object.assign(result, { scanDepth: depth });
@@ -129,7 +126,7 @@ function projectEvidence(value, field) {
     }
     if (source.domainAgeDays !== null && source.domainAgeDays !== undefined) {
         if (typeof source.domainAgeDays !== 'number' || !Number.isFinite(source.domainAgeDays)
-            || source.domainAgeDays < 0 || source.domainAgeDays > 100_000) {
+            || source.domainAgeDays < 0 || source.domainAgeDays > MAX_RISK_CALIBRATION_DOMAIN_AGE_DAYS) {
             throw new CliUsageError(`${field}.domainAgeDays must be a finite number from 0 to 100000.`);
         }
         result.domainAgeDays = source.domainAgeDays;
@@ -137,10 +134,10 @@ function projectEvidence(value, field) {
     if (source.mutationTypes !== null && source.mutationTypes !== undefined) {
         if (!Array.isArray(source.mutationTypes))
             throw new CliUsageError(`${field}.mutationTypes must be an array.`);
-        if (source.mutationTypes.length > MAX_MUTATIONS)
-            throw new CliUsageError(`${field}.mutationTypes exceeds the ${MAX_MUTATIONS}-item limit.`);
+        if (source.mutationTypes.length > MAX_RISK_CALIBRATION_MUTATIONS)
+            throw new CliUsageError(`${field}.mutationTypes exceeds the ${MAX_RISK_CALIBRATION_MUTATIONS}-item limit.`);
         result.mutationTypes = [...new Set(source.mutationTypes.map((item, index) => {
-                const mutation = boundedString(item, `${field}.mutationTypes[${index}]`, 64);
+                const mutation = boundedString(item, `${field}.mutationTypes[${index}]`, MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH);
                 if (!MUTATION_TYPES.has(mutation))
                     throw new CliUsageError(`${field}.mutationTypes[${index}] is unsupported.`);
                 return mutation;
@@ -163,7 +160,12 @@ export async function readRiskCalibrationInputBounded(stream, limit = MAX_RISK_C
             throw new CliUsageError(`Risk calibration input is limited to ${limit} bytes.`);
         chunks.push(buffer);
     }
-    return Buffer.concat(chunks).toString('utf8');
+    try {
+        return decodeBoundedUtf8(Buffer.concat(chunks), 'Risk calibration input');
+    }
+    catch (cause) {
+        throw new CliUsageError(cause instanceof Error ? cause.message : 'Risk calibration input must contain valid UTF-8 text.');
+    }
 }
 export function parseRiskCalibrationDataset(text) {
     if (typeof text !== 'string')
@@ -171,12 +173,19 @@ export function parseRiskCalibrationDataset(text) {
     if (Buffer.byteLength(text, 'utf8') > MAX_RISK_CALIBRATION_INPUT_BYTES) {
         throw new CliUsageError(`Risk calibration input is limited to ${MAX_RISK_CALIBRATION_INPUT_BYTES} bytes.`);
     }
+    const normalized = text.replace(/^\uFEFF/u, '');
     let parsed;
     try {
-        parsed = JSON.parse(text.replace(/^\uFEFF/, ''));
+        scanBoundedJson(normalized, {
+            maximumDepth: MAX_RISK_CALIBRATION_JSON_DEPTH,
+            maximumKeys: MAX_RISK_CALIBRATION_JSON_KEYS,
+            maximumValues: MAX_RISK_CALIBRATION_JSON_VALUES,
+            maximumContainerItems: MAX_RISK_CALIBRATION_JSON_CONTAINER_ITEMS,
+        });
+        parsed = JSON.parse(normalized);
     }
     catch {
-        throw new CliUsageError('Risk calibration input must be valid JSON.');
+        throw new CliUsageError('Risk calibration input must be valid bounded JSON without duplicate keys.');
     }
     const document = object(parsed, 'Risk calibration input');
     const documentVersion = typeof document.version === 'number' && Number.isInteger(document.version)
@@ -197,19 +206,19 @@ export function parseRiskCalibrationDataset(text) {
     const records = document.records.map((value, index) => {
         const prefix = `records[${index}]`;
         const record = object(value, prefix);
-        const id = boundedString(record.id, `${prefix}.id`, 128);
+        const id = boundedString(record.id, `${prefix}.id`, MAX_RISK_CALIBRATION_RECORD_ID_LENGTH);
         if (ids.has(id))
             throw new CliUsageError(`${prefix}.id must be unique.`);
         ids.add(id);
-        const domain = boundedString(record.domain, `${prefix}.domain`, 253).toLowerCase().replace(/\.$/, '');
+        const domain = boundedString(record.domain, `${prefix}.domain`, MAX_RISK_CALIBRATION_DOMAIN_LENGTH).toLowerCase().replace(/\.$/, '');
         if (!isValidAsciiDomainName(domain, { requireDot: true }))
             throw new CliUsageError(`${prefix}.domain must be a valid ASCII DNS hostname, not an IP address.`);
-        const analystDisposition = boundedString(record.analystDisposition, `${prefix}.analystDisposition`, 32);
+        const analystDisposition = boundedString(record.analystDisposition, `${prefix}.analystDisposition`, MAX_RISK_CALIBRATION_DISPOSITION_LENGTH);
         if (!DISPOSITIONS.has(analystDisposition))
             throw new CliUsageError(`${prefix}.analystDisposition is unsupported.`);
         let reviewReasonCode;
         if (record.reviewReasonCode !== null && record.reviewReasonCode !== undefined) {
-            reviewReasonCode = boundedString(record.reviewReasonCode, `${prefix}.reviewReasonCode`, 64);
+            reviewReasonCode = boundedString(record.reviewReasonCode, `${prefix}.reviewReasonCode`, MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH);
             if (!REVIEW_REASON_CODES.has(reviewReasonCode))
                 throw new CliUsageError(`${prefix}.reviewReasonCode is unsupported.`);
         }
@@ -296,9 +305,32 @@ function scoreBand(score) {
         return '40_69';
     return '0_39';
 }
+function scoringEvidence(record) {
+    const threatIntelligence = record.evidence.threatIntelligence;
+    const scoringDomain = canonicalRegistrableDomain(record.domain);
+    return {
+        ...record.evidence,
+        domain: scoringDomain ?? record.domain,
+        ...(threatIntelligence && scoringDomain ? {
+            threatIntelligence: {
+                version: THREAT_INTELLIGENCE_ENVELOPE_VERSION,
+                providers: threatIntelligence.providers.map((provider) => ({
+                    ...provider,
+                    schema: THREAT_INTELLIGENCE_SCHEMA,
+                    version: THREAT_INTELLIGENCE_CONTRACT_VERSION,
+                    target: {
+                        type: 'domain',
+                        value: scoringDomain,
+                        exposure: 'registrable_domain',
+                    },
+                })),
+            },
+        } : {}),
+    };
+}
 export function buildRiskCalibrationReport(dataset, explainRiskScore, options) {
     const records = dataset.records.map((record) => {
-        const explained = explainRiskScore(record.evidence);
+        const explained = explainRiskScore(scoringEvidence(record));
         const classification = metricClass(record.analystDisposition);
         const includedInMetrics = classification !== 'excluded' && explained !== null;
         return {
@@ -362,7 +394,7 @@ export function buildRiskCalibrationReport(dataset, explainRiskScore, options) {
             const current = records[index];
             if (!source || !current)
                 continue;
-            const previous = options.explainPreviousRiskScore(source.evidence);
+            const previous = options.explainPreviousRiskScore(scoringEvidence(source));
             if (previous?.score !== current.score)
                 scoresChanged += 1;
             if (scoreBand(previous?.score ?? null) !== current.band)
@@ -375,6 +407,7 @@ export function buildRiskCalibrationReport(dataset, explainRiskScore, options) {
     return {
         schema: RISK_CALIBRATION_REPORT_SCHEMA,
         version: RISK_CALIBRATION_REPORT_VERSION,
+        mode: 'detailed',
         generatedAt: options.generatedAt || new Date().toISOString(),
         dataset: { schema: dataset.schema, version: dataset.version, recordCount: records.length },
         riskModelVersion: options.modelVersion,
@@ -393,10 +426,26 @@ export function buildRiskCalibrationReport(dataset, explainRiskScore, options) {
         records,
         interpretation: {
             authority: 'analyst_context_only',
-            statement: 'This offline replay compares heuristic Risk scores with analyst dispositions. It does not prove maliciousness or safety.',
+            statement: RISK_CALIBRATION_SUMMARY_INTERPRETATION,
             automaticTuning: false,
             networkRequests: false,
             persisted: false,
         },
     };
 }
+export function serializeRiskCalibrationReport(report) {
+    try {
+        const snapshot = snapshotRiskCalibrationReportForSerialization(report);
+        const serialised = serializeRiskCalibrationSnapshot(snapshot);
+        if (snapshot.mode === 'summary')
+            parseRiskCalibrationSummaryReport(serialised);
+        else
+            buildRiskCalibrationSummaryReport(snapshot.document);
+        return serialised;
+    }
+    catch (cause) {
+        throw new CliUsageError(cause instanceof Error
+            ? cause.message
+            : 'Risk calibration output must use the current detailed or summary report contract.');
+    }
+}