@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/packages/evidence/observation.mjs

@@ -0,0 +1,384 @@
+// Compact provenance envelope for network-derived evidence. Type-specific
+// payloads remain beside this object; the envelope only standardises source
+// health, timing, completeness, truncation, and bounded limitations.
+const OBSERVATION_VERSION = 1;
+const STATUSES = new Set([
+    'success',
+    'partial',
+    'not_found',
+    'skipped',
+    'error',
+    'unsupported',
+    'not_applicable',
+]);
+const SCAN_MODES = new Set(['fast', 'deep']);
+const MAX_OBSERVATION_LIMITATIONS = 10;
+const MAX_OBSERVATION_LIMITATION_LENGTH = 300;
+const MAX_OBSERVATION_DIAGNOSTICS = 20;
+const MAX_DIAGNOSTICS = MAX_OBSERVATION_DIAGNOSTICS;
+const MAX_DIAGNOSTIC_KEY = 40;
+const MAX_DIAGNOSTIC_STRING = 240;
+const MAX_DURATION_MS = 120_000;
+const MAX_OBSERVATION_INPUT_LIMITATIONS = MAX_OBSERVATION_LIMITATIONS * 4;
+const MAX_DIAGNOSTIC_DEPTH = 4;
+const MAX_DIAGNOSTIC_VALUES_PER_ENTRY = 32;
+const OBSERVATION_INPUT_FIELDS = [
+    'version',
+    'status',
+    'observedAt',
+    'scanMode',
+    'source',
+    'durationMs',
+    'complete',
+    'truncated',
+    'limitations',
+    'diagnostics',
+];
+// Observation v1 diagnostics use a closed, source-owned vocabulary. Reading
+// only these descriptors keeps normalisation independent of an untrusted
+// object's total key count and preserves the deployed producer fields.
+const REGISTERED_DIAGNOSTIC_KEYS = [
+    'a',
+    'aaaa',
+    'addressSource',
+    'advisoryMatches',
+    'arrayItemsExamined',
+    'attemptCount',
+    'authorityCount',
+    'caa',
+    'caa_policy',
+    'catalogComponents',
+    'certificateGroups',
+    'certificateGroupsTruncated',
+    'certificateRows',
+    'charactersExamined',
+    'cidrCount',
+    'classifiedInputs',
+    'cname',
+    'connectionAttempts',
+    'delegation',
+    'discarded',
+    'discardedAuthorityRecordValueCount',
+    'discardedFields',
+    'discardedProperties',
+    'discardedUrls',
+    'discarded_attributes',
+    'discarded_entities',
+    'discarded_metadata',
+    'discarded_relationships',
+    'dmarc',
+    'documentsParsed',
+    'entities',
+    'error',
+    'externalScriptsSkipped',
+    'findings',
+    'formsObserved',
+    'generatorEvaluated',
+    'htmlEvaluated',
+    'httpStatus',
+    'https',
+    'ignoredCount',
+    'indicatorsObserved',
+    'inlineCharactersExamined',
+    'inlineScriptsExamined',
+    'inlineSignatureCharactersExamined',
+    'inlineSignatureTimedOut',
+    'inlineSignatureUnavailable',
+    'inputsObserved',
+    'knownExploitedMatches',
+    'lameAuthorityCount',
+    'malformedCount',
+    'malformedScripts',
+    'matches',
+    'mx',
+    'namesExamined',
+    'ns',
+    'objectsExamined',
+    'observed',
+    'observedAbsence',
+    'partialAuthorityCount',
+    'passiveHeadersEvaluated',
+    'potentialExposure',
+    'ptr',
+    'queriedAddressCount',
+    'redirectCount',
+    'referencesExamined',
+    'rejectedRows',
+    'relationshipTagsExamined',
+    'relationshipUrlsDiscarded',
+    'relationships',
+    'requestCount',
+    'resolvedAddressCount',
+    'resourceOriginsEvaluated',
+    'rolesObserved',
+    'scriptElementsExamined',
+    'scriptsExamined',
+    'scriptsObserved',
+    'serverEvaluated',
+    'soa',
+    'spf',
+    'successfulAuthorityCount',
+    'tagLimitReached',
+    'tagsExamined',
+    'trackingIdentifiersTruncated',
+    'tree',
+    'truncatedAuthorityRecordSetCount',
+    'truncatedNames',
+    'truncatedSameAsLists',
+    'truncatedTypeLists',
+    'unavailable',
+    'unclassifiedActions',
+    'unreachableAuthorityCount',
+    'workTruncated',
+];
+const ISO_DATE_TIME_RE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(\.\d{1,43})?(Z|[+-]\d{2}:\d{2})$/iu;
+const LEGACY_ISO_DATE_TIME_RE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(\.\d{1,43})?(Z|[+-]\d{2}:\d{2})?$/iu;
+const CT_DATE_TIME_RE = /^(\d{4})-(\d{2})-(\d{2})[ T](\d{2}):(\d{2}):(\d{2})(\.\d{1,43})?(Z|[+-]\d{2}:\d{2})?$/iu;
+function isObservationStatus(value) {
+    return typeof value === 'string' && STATUSES.has(value);
+}
+function isScanMode(value) {
+    return typeof value === 'string' && SCAN_MODES.has(value);
+}
+function safeString(value, maxLength) {
+    if (typeof value !== 'string' || value.length > maxLength * 4)
+        return null;
+    const normalised = value.trim().replace(/[\u0000-\u001f\u007f]/g, ' ');
+    return normalised ? normalised.slice(0, maxLength) : null;
+}
+function ownDataValue(value, key) {
+    try {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        return descriptor && 'value' in descriptor ? descriptor.value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function snapshotObservationInput(value) {
+    const snapshot = {};
+    for (const field of OBSERVATION_INPUT_FIELDS) {
+        const fieldValue = ownDataValue(value, field);
+        if (fieldValue === undefined)
+            continue;
+        Object.defineProperty(snapshot, field, {
+            configurable: true,
+            enumerable: true,
+            value: fieldValue,
+            writable: true,
+        });
+    }
+    return snapshot;
+}
+function safelyIsArray(value) {
+    try {
+        return Array.isArray(value);
+    }
+    catch {
+        return true;
+    }
+}
+function boundedArrayDataValues(value, maximum) {
+    if (!safelyIsArray(value))
+        return [];
+    const output = [];
+    const rawLength = ownDataValue(value, 'length');
+    const length = typeof rawLength === 'number' && Number.isSafeInteger(rawLength) && rawLength >= 0
+        ? Math.min(rawLength, maximum)
+        : 0;
+    for (let index = 0; index < length; index += 1) {
+        const item = ownDataValue(value, String(index));
+        if (item !== undefined)
+            output.push(item);
+    }
+    return output;
+}
+function validCalendarParts(parts) {
+    const year = Number(parts[1]);
+    const month = Number(parts[2]);
+    const day = Number(parts[3]);
+    const hour = Number(parts[4]);
+    const minute = Number(parts[5]);
+    const second = Number(parts[6]);
+    if (year < 1 || month < 1 || month > 12 || day < 1 || hour > 23 || minute > 59 || second > 59)
+        return false;
+    const date = new Date(0);
+    date.setUTCFullYear(year, month - 1, day);
+    date.setUTCHours(hour, minute, second, 0);
+    return date.getUTCFullYear() === year
+        && date.getUTCMonth() === month - 1
+        && date.getUTCDate() === day
+        && date.getUTCHours() === hour
+        && date.getUTCMinutes() === minute
+        && date.getUTCSeconds() === second;
+}
+function canonicalTimestamp(value, expression, assignUtcWhenMissing) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 64 || /[\u0000-\u001f\u007f]/u.test(value))
+        return null;
+    const match = expression.exec(value);
+    if (!match || !validCalendarParts(match))
+        return null;
+    const zone = match[8] || (assignUtcWhenMissing ? 'Z' : '');
+    if (!zone)
+        return null;
+    if (zone !== 'Z' && zone.toUpperCase() !== 'Z') {
+        const hours = Number(zone.slice(1, 3));
+        const minutes = Number(zone.slice(4, 6));
+        if (hours > 23 || minutes > 59)
+            return null;
+    }
+    const normalised = `${match[1]}-${match[2]}-${match[3]}T${match[4]}:${match[5]}:${match[6]}${match[7] || ''}${zone.toUpperCase() === 'Z' ? 'Z' : zone}`;
+    const timestamp = Date.parse(normalised);
+    if (!Number.isFinite(timestamp))
+        return null;
+    const date = new Date(timestamp);
+    const utcYear = date.getUTCFullYear();
+    return utcYear >= 1 && utcYear <= 9_999 ? date.toISOString() : null;
+}
+function normalizeExplicitIsoTimestamp(value) {
+    return canonicalTimestamp(value, ISO_DATE_TIME_RE, false);
+}
+// Frozen legacy schemas accepted zone-less ISO date-times. Preserve that
+// migration path deterministically by assigning UTC instead of consulting the
+// host timezone. Current schemas must use normalizeExplicitIsoTimestamp.
+function normalizeLegacyIsoTimestamp(value) {
+    return canonicalTimestamp(value, LEGACY_ISO_DATE_TIME_RE, true);
+}
+function normalizeCtTimestamp(value) {
+    return canonicalTimestamp(value, CT_DATE_TIME_RE, true);
+}
+function isoTimestamp(value) {
+    return normalizeExplicitIsoTimestamp(value);
+}
+function normalizeDiagnosticValue(value, budget, depth = 0) {
+    budget.remaining -= 1;
+    if (budget.remaining < 0) {
+        budget.exhausted = true;
+        return null;
+    }
+    if (depth > MAX_DIAGNOSTIC_DEPTH)
+        return null;
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? value : null;
+    if (typeof value === 'string')
+        return safeString(value, MAX_DIAGNOSTIC_STRING);
+    if (!value || typeof value !== 'object' || safelyIsArray(value))
+        return null;
+    const objectValue = value;
+    if (budget.active.has(objectValue))
+        return null;
+    const record = value;
+    const output = {};
+    budget.active.add(objectValue);
+    try {
+        for (const field of ['status', 'error', 'detail', 'truncated', 'discarded', 'count']) {
+            const fieldValue = ownDataValue(record, field);
+            if (fieldValue === undefined)
+                continue;
+            const normalised = normalizeDiagnosticValue(fieldValue, budget, depth + 1);
+            if (normalised !== null) {
+                Object.defineProperty(output, field, {
+                    configurable: true,
+                    enumerable: true,
+                    value: normalised,
+                    writable: true,
+                });
+            }
+        }
+    }
+    finally {
+        budget.active.delete(objectValue);
+    }
+    return Object.keys(output).length ? output : null;
+}
+function normalizeDiagnostics(value) {
+    if (!value || typeof value !== 'object' || safelyIsArray(value))
+        return {};
+    const record = value;
+    const output = {};
+    let retained = 0;
+    for (const key of REGISTERED_DIAGNOSTIC_KEYS) {
+        if (retained >= MAX_DIAGNOSTICS)
+            break;
+        if (key.length > MAX_DIAGNOSTIC_KEY)
+            continue;
+        const entryValue = ownDataValue(record, key);
+        if (entryValue === undefined)
+            continue;
+        const budget = {
+            remaining: MAX_DIAGNOSTIC_VALUES_PER_ENTRY,
+            active: new Set(),
+            exhausted: false,
+        };
+        const normalised = normalizeDiagnosticValue(entryValue, budget);
+        if (normalised !== null && !budget.exhausted) {
+            Object.defineProperty(output, key, {
+                configurable: true,
+                enumerable: true,
+                value: normalised,
+                writable: true,
+            });
+            retained += 1;
+        }
+    }
+    return output;
+}
+function createObservationFromSnapshot(record) {
+    const rawStatus = record.status;
+    const rawSource = record.source;
+    const rawObservedAt = record.observedAt;
+    const rawDuration = record.durationMs;
+    const rawScanMode = record.scanMode;
+    const status = isObservationStatus(rawStatus) ? rawStatus : 'error';
+    const source = safeString(rawSource, 40) || 'unknown';
+    const observedAt = isoTimestamp(rawObservedAt) || new Date().toISOString();
+    const duration = typeof rawDuration === 'number' ? rawDuration : Number.NaN;
+    const limitations = [...new Set(boundedArrayDataValues(record.limitations, MAX_OBSERVATION_INPUT_LIMITATIONS)
+            .map((item) => safeString(item, MAX_OBSERVATION_LIMITATION_LENGTH))
+            .filter((item) => item !== null))]
+        .slice(0, MAX_OBSERVATION_LIMITATIONS);
+    return {
+        version: OBSERVATION_VERSION,
+        status,
+        observedAt,
+        scanMode: isScanMode(rawScanMode) ? rawScanMode : null,
+        source,
+        durationMs: Number.isFinite(duration) ? Math.max(0, Math.min(MAX_DURATION_MS, Math.round(duration))) : null,
+        complete: record.complete === true,
+        truncated: record.truncated === true,
+        limitations,
+        diagnostics: normalizeDiagnostics(record.diagnostics),
+    };
+}
+function createObservation(input = {}) {
+    const record = input && typeof input === 'object' && !safelyIsArray(input)
+        ? snapshotObservationInput(input)
+        : {};
+    return createObservationFromSnapshot(record);
+}
+function readObservationEnvelope(value) {
+    if (value === undefined || value === null)
+        return { state: 'absent', observation: null };
+    if (!value || typeof value !== 'object' || safelyIsArray(value))
+        return { state: 'invalid', observation: null };
+    const record = snapshotObservationInput(value);
+    const version = record.version;
+    const status = record.status;
+    const source = record.source;
+    const observedAt = record.observedAt;
+    if (typeof version === 'number'
+        && Number.isInteger(version)
+        && version > OBSERVATION_VERSION) {
+        return { state: 'unsupported', observation: null };
+    }
+    if (version !== OBSERVATION_VERSION
+        || !isObservationStatus(status)
+        || !safeString(source, 40)
+        || !isoTimestamp(observedAt)) {
+        return { state: 'invalid', observation: null };
+    }
+    return { state: 'supported', observation: createObservationFromSnapshot(record) };
+}
+export { MAX_OBSERVATION_DIAGNOSTICS, MAX_OBSERVATION_LIMITATIONS, MAX_OBSERVATION_LIMITATION_LENGTH, OBSERVATION_VERSION, createObservation, normalizeCtTimestamp, normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp, readObservationEnvelope, };

package/{frontend/src/lib/analysis/external-findings-import.js → packages/interchange/external-findings-import.mjs}

@@ -1,10 +1,8 @@
-import { normalizeDomain, openOrCreateCase, updateCase, } from "./case-model.js";
-export const EXTERNAL_FINDINGS_SCHEMA = 'whoisleuth.external-findings';
-export const EXTERNAL_FINDINGS_VERSION = 3;
-export const MAX_EXTERNAL_FINDINGS_IMPORT_BYTES = 384 * 1024;
-export const MAX_EXTERNAL_FINDINGS = 100;
-export const MAX_EXTERNAL_FINDINGS_PER_DOMAIN = 20;
-export const MAX_EXTERNAL_FINDING_DOMAINS = 25;
+import { normalizeDomain, openOrCreateCase, updateCase, } from "../cases/case-model.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, } from "../contracts/external-observation-interchange.mjs";
+import { hasUnsafeRetainedText } from "./retained-text.mjs";
+export { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, };
 export const EXTERNAL_FINDING_CATEGORIES = [
     'certificate',
     'dns',
@@ -17,7 +15,6 @@ export const EXTERNAL_FINDING_CATEGORIES = [
 ];
 const CATEGORIES = new Set(EXTERNAL_FINDING_CATEGORIES);
 const COMPLETENESS = new Set(['complete', 'inconclusive', 'partial', 'unknown']);
-const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const ROOT_KEYS = new Set(['schema', 'schemaVersion', 'source', 'findings']);
 const SOURCE_KEYS = new Set(['name', 'reference', 'collectedAt']);
 const FINDING_KEYS = new Set([
@@ -38,12 +35,18 @@ const STRUCTURED_OBSERVATION_KEYS = new Set([
     'value',
     'issuer',
     'notAfter',
+    'eventId',
+    'logId',
+    'certificateSha256',
+    'dnsNameCount',
+    'namesComplete',
 ]);
 const STRUCTURED_OBSERVATION_SCHEMAS = new Set([
     'whoisleuth.domain-observation-rows',
     'whoisleuth.dns-observation-rows',
     'whoisleuth.certificate-observation-rows',
 ]);
+const SHA256_RE = /^[a-f0-9]{64}$/u;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -56,8 +59,8 @@ function requiredText(value, maximum, label) {
     if (typeof value !== 'string'
         || !value.trim()
         || value.length > maximum
-        || CONTROL_RE.test(value)) {
-        throw new Error(`${label} must be non-empty, bounded text without control characters.`);
+        || hasUnsafeRetainedText(value)) {
+        throw new Error(`${label} must be non-empty, bounded text without unsafe control characters or formatting controls.`);
     }
     return value.trim();
 }
@@ -70,10 +73,10 @@ function iso(value, label, optional = false) {
     if (optional && (value === undefined || value === null || value === ''))
         return null;
     const text = requiredText(value, 64, label);
-    const parsed = Date.parse(text);
-    if (!Number.isFinite(parsed))
-        throw new Error(`${label} must be a valid date and time.`);
-    return new Date(parsed).toISOString();
+    const normalized = normalizeExplicitIsoTimestamp(text);
+    if (!normalized)
+        throw new Error(`${label} must be a valid date and time with an explicit timezone.`);
+    return normalized;
 }
 function limitations(value, index) {
     if (value === undefined)
@@ -104,9 +107,44 @@ function structuredObservation(value, index) {
     const issuer = optionalText(item.issuer, 160, `Finding ${index + 1} certificate issuer`);
     const notAfter = iso(item.notAfter, `Finding ${index + 1} certificate expiry`, true);
     const certificateSchema = item.sourceSchema === 'whoisleuth.certificate-observation-rows';
+    if (certificateSchema && (field === 'certificateSha256' || field === 'fingerprintSha256') && !SHA256_RE.test(observationValue.toLowerCase())) {
+        throw new Error(`Finding ${index + 1} certificate observation value must be a SHA-256 hexadecimal digest.`);
+    }
     if (!certificateSchema && (issuer !== null || notAfter !== null)) {
         throw new Error(`Finding ${index + 1} non-certificate observation cannot declare certificate metadata.`);
     }
+    const declaresEventMetadata = ['eventId', 'logId', 'certificateSha256', 'dnsNameCount', 'namesComplete']
+        .some((key) => item[key] !== undefined && item[key] !== null);
+    let eventId = null;
+    let logId = null;
+    let certificateSha256 = null;
+    let dnsNameCount = null;
+    let namesComplete = null;
+    if (declaresEventMetadata) {
+        if (!certificateSchema) {
+            throw new Error(`Finding ${index + 1} certificate-event metadata requires external-findings schema version 4.`);
+        }
+        eventId = requiredText(item.eventId, 64, `Finding ${index + 1} certificate event id`);
+        if (!/^[A-Za-z0-9_-]{1,64}$/u.test(eventId)) {
+            throw new Error(`Finding ${index + 1} certificate event id is invalid.`);
+        }
+        logId = requiredText(item.logId, 200, `Finding ${index + 1} certificate log id`);
+        certificateSha256 = requiredText(item.certificateSha256, 64, `Finding ${index + 1} certificate digest`).toLowerCase();
+        if (!SHA256_RE.test(certificateSha256)) {
+            throw new Error(`Finding ${index + 1} certificate event digest must be a SHA-256 hexadecimal digest.`);
+        }
+        if (certificateSha256 !== observationValue.toLowerCase()) {
+            throw new Error(`Finding ${index + 1} certificate event digest must match the structured observation value.`);
+        }
+        if (!Number.isSafeInteger(item.dnsNameCount) || Number(item.dnsNameCount) < 1 || Number(item.dnsNameCount) > 100) {
+            throw new Error(`Finding ${index + 1} certificate DNS name count is invalid.`);
+        }
+        dnsNameCount = Number(item.dnsNameCount);
+        if (typeof item.namesComplete !== 'boolean') {
+            throw new Error(`Finding ${index + 1} certificate name completeness is invalid.`);
+        }
+        namesComplete = item.namesComplete;
+    }
     return {
         sourceSchema: item.sourceSchema,
         sourceVersion: 1,
@@ -114,6 +152,11 @@ function structuredObservation(value, index) {
         value: observationValue,
         issuer,
         notAfter,
+        eventId,
+        logId,
+        certificateSha256,
+        dnsNameCount,
+        namesComplete,
     };
 }
 function findingKey(finding, sourceName) {
@@ -125,6 +168,7 @@ function findingKey(finding, sourceName) {
         finding.observedAt,
         finding.completeness,
         sourceName,
+        finding.structuredObservation?.eventId ?? '',
     ].join('\u0000');
 }
 export function parseExternalFindingsDocument(value) {
@@ -133,8 +177,8 @@ export function parseExternalFindingsDocument(value) {
         throw new Error('External findings must use the documented object shape without additional top-level fields.');
     }
     if (root.schema !== EXTERNAL_FINDINGS_SCHEMA
-        || ![1, 2, EXTERNAL_FINDINGS_VERSION].includes(Number(root.schemaVersion))) {
-        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version 1, 2, or ${EXTERNAL_FINDINGS_VERSION}.`);
+        || root.schemaVersion !== EXTERNAL_FINDINGS_VERSION) {
+        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version ${EXTERNAL_FINDINGS_VERSION}.`);
     }
     const sourceValue = record(root.source);
     if (!sourceValue || !hasOnlyKeys(sourceValue, SOURCE_KEYS)) {
@@ -166,9 +210,7 @@ export function parseExternalFindingsDocument(value) {
         if (typeof item.completeness !== 'string' || !COMPLETENESS.has(item.completeness)) {
             throw new Error(`Finding ${index + 1} completeness is unsupported.`);
         }
-        const evidenceClass = item.evidenceClass === undefined && root.schemaVersion === 1
-            ? 'provider_report'
-            : item.evidenceClass;
+        const evidenceClass = item.evidenceClass;
         if (evidenceClass !== 'deployment_observation' && evidenceClass !== 'provider_report') {
             throw new Error(`Finding ${index + 1} evidence class is unsupported.`);
         }
@@ -206,6 +248,13 @@ export function parseExternalFindingsDocument(value) {
         findings: normalized,
     };
 }
+export function serializeExternalFindingsDocument(value) {
+    const serialised = JSON.stringify(value, null, 2);
+    if (typeof serialised !== 'string') {
+        throw new TypeError('External findings must be JSON-serialisable.');
+    }
+    return `${serialised}\n`;
+}
 function pinValue(finding) {
     return finding.reference
         ? `${finding.summary} Reference: ${finding.reference}`
@@ -229,12 +278,28 @@ function existingPinKey(recordValue, finding, sourceName) {
         && (!observation || (pin.field === observation.field
             && pin.sourceSchema?.collection === 'external_observations'
             && pin.sourceSchema.schema === observation.sourceSchema
-            && pin.sourceSchema.version === observation.sourceVersion)))) ? findingKey(finding, sourceName) : '';
+            && pin.sourceSchema.version === observation.sourceVersion
+            && (observation.eventId === null || pin.certificateObservation?.eventId === observation.eventId))))) ? findingKey(finding, sourceName) : '';
 }
 function structuredPinFields(finding) {
     const observation = finding.structuredObservation;
     if (!observation)
         return {};
+    const certificateObservation = observation.eventId
+        && observation.logId
+        && observation.certificateSha256
+        && observation.dnsNameCount !== null
+        && observation.namesComplete !== null
+        ? {
+            eventId: observation.eventId,
+            logId: observation.logId,
+            certificateSha256: observation.certificateSha256,
+            issuer: observation.issuer,
+            notAfter: observation.notAfter,
+            dnsNameCount: observation.dnsNameCount,
+            namesComplete: observation.namesComplete,
+        }
+        : null;
     return {
         field: observation.field,
         category: finding.category,
@@ -243,6 +308,7 @@ function structuredPinFields(finding) {
             schema: observation.sourceSchema,
             version: observation.sourceVersion,
         },
+        certificateObservation,
     };
 }
 export function mergeExternalFindingsIntoCases(current, document, now = new Date().toISOString()) {

package/packages/interchange/retained-text.mjs

@@ -0,0 +1,8 @@
+const UNSAFE_RETAINED_TEXT_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/u;
+const UNSAFE_RETAINED_TEXT_GLOBAL_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/gu;
+export function hasUnsafeRetainedText(value) {
+    return UNSAFE_RETAINED_TEXT_RE.test(value);
+}
+export function neutralizeUnsafeRetainedText(value) {
+    return value.replace(UNSAFE_RETAINED_TEXT_GLOBAL_RE, ' ');
+}

package/{frontend/src/lib/analysis/acquisition-decision-packet.js → packages/investigation/acquisition-decision-packet.mjs}

@@ -1,6 +1,7 @@
-import { sha256ArtifactDigest } from "./artifact-integrity.js";
-export const ACQUISITION_DECISION_PACKET_SCHEMA = 'whoisleuth.acquisition-decision';
-export const ACQUISITION_DECISION_PACKET_VERSION = 1;
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../evidence/artifact-integrity.mjs";
+import { ACQUISITION_DECISION_PACKET_SCHEMA, ACQUISITION_DECISION_PACKET_VERSION, } from "../contracts/investigation-portability.mjs";
+import { isValidAsciiDomainName } from "../../lib/hostname.mjs";
+export { ACQUISITION_DECISION_PACKET_SCHEMA, ACQUISITION_DECISION_PACKET_VERSION };
 export const ACQUISITION_DECISIONS = [
     'unresolved',
     'continue_manual_review',
@@ -28,11 +29,13 @@ function timestamp(value) {
     return new Date(value).toISOString();
 }
 function target(value) {
-    const normalized = text(value, 253).toLowerCase().replace(/\.$/u, '');
-    if (!normalized || !normalized.includes('.') || /[/\\\s]/u.test(normalized)) {
+    const submitted = typeof value === 'string'
+        ? value.trim().replace(/\.$/u, '')
+        : '';
+    if (!isValidAsciiDomainName(submitted, { requireDot: true })) {
         throw new Error('A canonical domain is required for an acquisition decision packet.');
     }
-    return normalized;
+    return submitted.toLowerCase();
 }
 function decision(value) {
     return typeof value === 'string' && DECISION_SET.has(value)
@@ -80,10 +83,10 @@ export async function buildAcquisitionDecisionPacket(input) {
                 : []),
         ],
     };
-    const digestSha256 = await sha256ArtifactDigest(unsigned);
+    const digestSha256 = await sha256ArtifactDigestV2(unsigned);
     const document = {
         ...unsigned,
-        integrity: { algorithm: 'SHA-256', digestSha256 },
+        integrity: { algorithm: 'SHA-256', canonicalization: SORTED_JSON_V2, digestSha256 },
     };
     return {
         document,