@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/{frontend/src/lib/analysis/watchlist-store.js → packages/workspace/watchlist-store.mjs}

@@ -1,22 +1,15 @@
 // Pure browser-local watchlist collection model. Watchlist history owns the
 // evidence shape and diff semantics; this module owns collection names, schema
 // migration, import merging, and exact serialized-byte accounting.
-import { MAX_WATCHLIST_DOMAINS, normalizeWatchlistEntry } from "./watchlist-history.js";
-export const WATCHLIST_SCHEMA_VERSION = 2;
-export const WATCHLIST_SCHEMA = 'whoisleuth.watchlists';
-export const MAX_WATCHLISTS = 100;
-export const MAX_WATCHLIST_INPUTS = MAX_WATCHLISTS * 4;
-export const MAX_WATCHLIST_NAME_LENGTH = 100;
-// Cases and other analyst stores share the same origin quota. A two-megabyte
-// ceiling accommodates practical Bulk results while failing before the browser
-// turns storage pressure into an opaque quota exception.
-export const MAX_WATCHLIST_STORE_BYTES = 2 * 1024 * 1024;
+import { MAX_WATCHLIST_DOMAINS, normalizeWatchlistEntry } from "./watchlist-history.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { MAX_WATCHLIST_INPUTS, MAX_WATCHLIST_NAME_LENGTH, MAX_WATCHLISTS, MAX_WATCHLIST_STORE_BYTES, WATCHLIST_SCHEMA, WATCHLIST_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
+export { MAX_WATCHLIST_INPUTS, MAX_WATCHLIST_NAME_LENGTH, MAX_WATCHLISTS, MAX_WATCHLIST_STORE_BYTES, WATCHLIST_SCHEMA, WATCHLIST_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
 const BLOCKED_NAMES = new Set(['__proto__', 'prototype', 'constructor']);
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
 function plainRecord(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : null;
+    return ordinaryWorkspaceRecord(value, 'Watchlist input');
 }
 function isEnvelope(value) {
     return Boolean(value && value.schema === WATCHLIST_SCHEMA && plainRecord(value.watchlists));
@@ -37,14 +30,23 @@ function watchlistMap(raw) {
 }
 export function watchlistStoreVersion(raw) {
     const value = plainRecord(raw);
-    if (!value || !isEnvelope(value))
-        return value ? 1 : null;
+    if (!value)
+        return null;
+    if (!isEnvelope(value))
+        return WATCHLIST_SCHEMA_VERSION;
     return typeof value.version === 'number' && Number.isFinite(value.version) && value.version > 0 ? value.version : null;
 }
 function defineEntry(target, name, entry) {
     Object.defineProperty(target, name, { value: entry, writable: true, enumerable: true, configurable: true });
 }
 export function normalizeWatchlistStore(raw) {
+    assertWorkspaceInputGraph(raw, 'Watchlist store');
+    const root = plainRecord(raw);
+    if (root?.schema === WATCHLIST_SCHEMA)
+        assertWorkspaceDeclaredVersion(raw, 'Watchlist store');
+    if (root?.schema === WATCHLIST_SCHEMA && watchlistStoreVersion(root) !== WATCHLIST_SCHEMA_VERSION) {
+        throw new Error(`Watchlist schema ${String(root.version)} is unsupported; no data was changed.`);
+    }
     const source = watchlistMap(raw);
     const watchlists = {};
     if (!source)
@@ -83,6 +85,9 @@ function validateImportShape(raw) {
     }
 }
 export function mergeWatchlistStores(localRaw, importedRaw) {
+    assertWorkspaceInputGraph(localRaw, 'Local watchlist store');
+    assertWorkspaceInputGraph(importedRaw, 'Imported watchlist document');
+    assertWorkspacePortableVersion(importedRaw, WATCHLIST_SCHEMA_VERSION, 'Imported watchlist document');
     validateImportShape(importedRaw);
     const importedVersion = watchlistStoreVersion(importedRaw);
     if (importedVersion !== null && importedVersion > WATCHLIST_SCHEMA_VERSION) {
@@ -117,11 +122,13 @@ export function mergeWatchlistStores(localRaw, importedRaw) {
     return { watchlists: local, added, updated, skipped };
 }
 export function buildWatchlistExport(watchlists, nowIso = new Date().toISOString()) {
-    const parsed = typeof nowIso === 'string' ? Date.parse(nowIso) : Number.NaN;
+    const exportedAt = normalizeExplicitIsoTimestamp(nowIso);
+    if (!exportedAt)
+        throw new Error('Watchlist export time must use an explicit timezone.');
     return {
         schema: WATCHLIST_SCHEMA,
         version: WATCHLIST_SCHEMA_VERSION,
-        exportedAt: Number.isFinite(parsed) ? new Date(parsed).toISOString() : new Date().toISOString(),
+        exportedAt,
         watchlists: normalizeWatchlistStore(watchlists).watchlists,
     };
 }

package/{frontend/src/lib/analysis/website-snapshot-model.js → packages/workspace/website-snapshot-model.mjs}

@@ -1,16 +1,14 @@
-import { normalizeDomain } from "./case-model.js";
-export const WEBSITE_SNAPSHOT_SCHEMA = 'whoisleuth.website-profile-snapshots';
-export const WEBSITE_SNAPSHOT_SCHEMA_VERSION = 4;
-export const MAX_WEBSITE_SNAPSHOTS = 60;
-export const MAX_WEBSITE_SNAPSHOTS_PER_DOMAIN = 12;
-export const MAX_WEBSITE_SNAPSHOT_STORE_BYTES = 512 * 1024;
-export const MAX_WEBSITE_SNAPSHOT_IMPORT_BYTES = 768 * 1024;
+import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { MAX_WEBSITE_SNAPSHOTS, MAX_WEBSITE_SNAPSHOTS_PER_DOMAIN, MAX_WEBSITE_SNAPSHOT_STORE_BYTES, SUPPORTED_WEBSITE_SNAPSHOT_SCHEMA_VERSIONS, WEBSITE_SNAPSHOT_SCHEMA, WEBSITE_SNAPSHOT_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
+export { MAX_WEBSITE_SNAPSHOTS, MAX_WEBSITE_SNAPSHOTS_PER_DOMAIN, MAX_WEBSITE_SNAPSHOT_IMPORT_BYTES, MAX_WEBSITE_SNAPSHOT_STORE_BYTES, SUPPORTED_WEBSITE_SNAPSHOT_SCHEMA_VERSIONS, WEBSITE_SNAPSHOT_SCHEMA, WEBSITE_SNAPSHOT_SCHEMA_VERSION, } from "../contracts/workspace-portability.mjs";
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const DIGEST_RE = /^[a-f0-9]{16,128}$/iu;
 const SHA256_RE = /^[a-f0-9]{64}$/iu;
 const SERIAL_RE = /^[a-f0-9]{1,128}$/iu;
 function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+    return ordinaryWorkspaceRecord(value, 'Website-snapshot input');
 }
 function text(value, maximum) {
     return typeof value === 'string' && value.length <= maximum && !CONTROL_RE.test(value)
@@ -18,9 +16,7 @@ function text(value, maximum) {
         : '';
 }
 function timestamp(value) {
-    const candidate = text(value, 64);
-    const parsed = Date.parse(candidate);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : '';
+    return normalizeExplicitIsoTimestamp(value) ?? '';
 }
 function digest(value) {
     const candidate = text(value, 128).toLowerCase();
@@ -183,13 +179,20 @@ export function normalizeWebsiteProfileSnapshot(raw) {
     };
 }
 export function normalizeWebsiteSnapshotStore(raw) {
+    assertWorkspaceInputGraph(raw, 'Website-snapshot store');
+    assertWorkspaceDeclaredVersion(raw, 'Website-snapshot store');
     const value = record(raw);
     if (value?.schema === WEBSITE_SNAPSHOT_SCHEMA
         && Number(value?.version) > WEBSITE_SNAPSHOT_SCHEMA_VERSION) {
         throw new Error('This website-snapshot collection uses a newer schema and cannot be read safely.');
     }
+    if (value?.schema === WEBSITE_SNAPSHOT_SCHEMA
+        && Number.isSafeInteger(value.version)
+        && !SUPPORTED_WEBSITE_SNAPSHOT_SCHEMA_VERSIONS.includes(Number(value.version))) {
+        throw new Error('This website-snapshot collection uses an unsupported schema and cannot be read safely.');
+    }
     const sourceValues = Array.isArray(raw) ? raw : Array.isArray(value?.snapshots) ? value.snapshots : [];
-    const snapshots = values(sourceValues, MAX_WEBSITE_SNAPSHOTS * 2, normalizeWebsiteProfileSnapshot);
+    const snapshots = values(sourceValues, MAX_WEBSITE_SNAPSHOTS * 2, (candidate) => normalizeWebsiteProfileSnapshot(candidate));
     const perDomain = new Map();
     const retained = [];
     for (const snapshot of snapshots.sort((left, right) => right.savedAt.localeCompare(left.savedAt))) {
@@ -230,6 +233,9 @@ export function buildWebsiteSnapshotExport(raw, generatedAt = new Date().toISOSt
     return { ...store, generatedAt: timestamp(generatedAt) || new Date().toISOString() };
 }
 export function mergeWebsiteSnapshots(localRaw, incomingRaw) {
+    assertWorkspaceInputGraph(localRaw, 'Local website-snapshot store');
+    assertWorkspaceInputGraph(incomingRaw, 'Imported website-snapshot document');
+    assertWorkspacePortableVersion(incomingRaw, WEBSITE_SNAPSHOT_SCHEMA_VERSION, 'Imported website-snapshot document');
     const local = normalizeWebsiteSnapshotStore(localRaw).snapshots;
     const incoming = normalizeWebsiteSnapshotStore(incomingRaw).snapshots;
     const byId = new Map(local.map((item) => [item.id, item]));

package/{frontend/src/lib/analysis/workspace-archive-crypto.js → packages/workspace/workspace-archive-crypto.mjs}

@@ -1,19 +1,18 @@
 // Browser-local authenticated encryption for portable workspace archives.
 // This protects a downloaded file while it is locked. It does not encrypt the
 // active IndexedDB workspace or defend an unlocked page from same-origin code.
-import { MAX_WORKSPACE_ARCHIVE_BYTES, WORKSPACE_ARCHIVE_SCHEMA, isSupportedWorkspaceArchiveVersion, readWorkspaceArchive, } from "./workspace-archive.js";
-export const ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA = 'whoisleuth.encrypted-workspace-archive';
-export const ENCRYPTED_WORKSPACE_ARCHIVE_VERSION = 1;
-export const WORKSPACE_ARCHIVE_PBKDF2_ITERATIONS = 600_000;
-export const MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS = 12;
-export const MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES = 1024;
-export const MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES = Math.ceil(MAX_WORKSPACE_ARCHIVE_BYTES * 4 / 3) + 4096;
+import { WORKSPACE_ARCHIVE_SCHEMA, WORKSPACE_ARCHIVE_VERSION, SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS, isSupportedWorkspaceArchiveVersion, readWorkspaceArchive, } from "./workspace-archive.mjs";
+import { parseBoundedJson } from "../../lib/bounded-json.mjs";
+import { ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA, ENCRYPTED_WORKSPACE_ARCHIVE_VERSION, MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES, MAX_WORKSPACE_ARCHIVE_BYTES, MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES, MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS, WORKSPACE_ARCHIVE_PBKDF2_ITERATIONS, } from "../contracts/case-portability.mjs";
+import { assertWorkspaceInputGraph } from "./hostile-input.mjs";
+export { ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA, ENCRYPTED_WORKSPACE_ARCHIVE_VERSION, MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES, MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES, MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS, WORKSPACE_ARCHIVE_PBKDF2_ITERATIONS, };
 const SALT_BYTES = 16;
 const IV_BYTES = 12;
 const AES_KEY_BITS = 256;
 const AES_GCM_TAG_BITS = 128;
 const MAX_CIPHERTEXT_BASE64URL_CHARACTERS = Math.ceil((MAX_WORKSPACE_ARCHIVE_BYTES + AES_GCM_TAG_BITS / 8) * 4 / 3);
 const BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
+const BASE64URL_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
 const ISO_TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
 const encoder = new TextEncoder();
 const decoder = new TextDecoder('utf-8', { fatal: true });
@@ -46,11 +45,20 @@ function assertPassphrase(passphrase) {
     return bytes;
 }
 function base64url(bytes) {
-    let binary = '';
-    for (let index = 0; index < bytes.length; index += 0x8000) {
-        binary += String.fromCharCode(...bytes.subarray(index, Math.min(index + 0x8000, bytes.length)));
+    let encoded = '';
+    for (let index = 0; index < bytes.length; index += 3) {
+        const first = bytes[index] ?? 0;
+        const second = bytes[index + 1] ?? 0;
+        const third = bytes[index + 2] ?? 0;
+        const aggregate = (first << 16) | (second << 8) | third;
+        encoded += BASE64URL_ALPHABET[(aggregate >>> 18) & 63];
+        encoded += BASE64URL_ALPHABET[(aggregate >>> 12) & 63];
+        if (index + 1 < bytes.length)
+            encoded += BASE64URL_ALPHABET[(aggregate >>> 6) & 63];
+        if (index + 2 < bytes.length)
+            encoded += BASE64URL_ALPHABET[aggregate & 63];
     }
-    return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/u, '');
+    return encoded;
 }
 function decodeBase64url(value, expectedBytes, label) {
     const expectedCharacters = expectedBytes === null ? null : Math.ceil(expectedBytes * 4 / 3);
@@ -60,15 +68,25 @@ function decodeBase64url(value, expectedBytes, label) {
         || !BASE64URL_RE.test(value)) {
         throw new Error(`The encrypted workspace archive has an invalid ${label}.`);
     }
-    const padding = (4 - value.length % 4) % 4;
-    let binary = '';
-    try {
-        binary = atob(value.replaceAll('-', '+').replaceAll('_', '/') + '='.repeat(padding));
-    }
-    catch {
+    if (value.length % 4 === 1) {
         throw new Error(`The encrypted workspace archive has an invalid ${label}.`);
     }
-    const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    const bytes = new Uint8Array(Math.floor(value.length * 6 / 8));
+    let outputIndex = 0;
+    let accumulator = 0;
+    let bits = 0;
+    for (const character of value) {
+        const decoded = BASE64URL_ALPHABET.indexOf(character);
+        if (decoded < 0)
+            throw new Error(`The encrypted workspace archive has an invalid ${label}.`);
+        accumulator = (accumulator << 6) | decoded;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            bytes[outputIndex] = (accumulator >>> bits) & 0xff;
+            outputIndex += 1;
+        }
+    }
     if (expectedBytes !== null && bytes.byteLength !== expectedBytes) {
         throw new Error(`The encrypted workspace archive has an invalid ${label}.`);
     }
@@ -94,6 +112,7 @@ function validTimestamp(value) {
     return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value;
 }
 function validateEnvelope(raw) {
+    assertWorkspaceInputGraph(raw, 'Encrypted workspace archive');
     const value = record(raw);
     if (!value || value.schema !== ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA) {
         throw new Error('This file is not an encrypted WHOISleuth workspace archive.');
@@ -111,6 +130,14 @@ function validateEnvelope(raw) {
         throw new Error('The encrypted workspace archive has an invalid creation time.');
     }
     const content = record(value.content);
+    if (content?.schema === WORKSPACE_ARCHIVE_SCHEMA && Number.isSafeInteger(content.version)) {
+        if (content.version < Math.min(...SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS)) {
+            throw new Error(`Encrypted workspace content schema ${String(content.version)} is retired. Decrypt and re-export it as schema ${WORKSPACE_ARCHIVE_VERSION} with the last broad-reader release; no data was changed.`);
+        }
+        if (content.version > WORKSPACE_ARCHIVE_VERSION) {
+            throw new Error(`Encrypted workspace content schema ${String(content.version)} is newer than the supported schema ${WORKSPACE_ARCHIVE_VERSION}; no data was changed.`);
+        }
+    }
     if (!content
         || !hasExactKeys(content, ['schema', 'version'])
         || content.schema !== WORKSPACE_ARCHIVE_SCHEMA
@@ -266,7 +293,10 @@ export async function decryptWorkspaceArchive(raw, passphrase, provider) {
         if (plaintext.byteLength > MAX_WORKSPACE_ARCHIVE_BYTES) {
             throw new Error('The decrypted workspace archive exceeds its byte limit.');
         }
-        return JSON.parse(decoder.decode(plaintext));
+        return parseBoundedJson(decoder.decode(plaintext), {
+            label: 'Decrypted workspace archive',
+            maximumBytes: MAX_WORKSPACE_ARCHIVE_BYTES,
+        });
     }
     catch (cause) {
         if (cause instanceof Error && cause.message === 'The decrypted workspace archive exceeds its byte limit.')