@slicedearth/whoisleuth-cli 1.47.4 → 2.0.0

package/packages/evidence/observation.mjs

@@ -0,0 +1,384 @@
+// Compact provenance envelope for network-derived evidence. Type-specific
+// payloads remain beside this object; the envelope only standardises source
+// health, timing, completeness, truncation, and bounded limitations.
+const OBSERVATION_VERSION = 1;
+const STATUSES = new Set([
+    'success',
+    'partial',
+    'not_found',
+    'skipped',
+    'error',
+    'unsupported',
+    'not_applicable',
+]);
+const SCAN_MODES = new Set(['fast', 'deep']);
+const MAX_OBSERVATION_LIMITATIONS = 10;
+const MAX_OBSERVATION_LIMITATION_LENGTH = 300;
+const MAX_OBSERVATION_DIAGNOSTICS = 20;
+const MAX_DIAGNOSTICS = MAX_OBSERVATION_DIAGNOSTICS;
+const MAX_DIAGNOSTIC_KEY = 40;
+const MAX_DIAGNOSTIC_STRING = 240;
+const MAX_DURATION_MS = 120_000;
+const MAX_OBSERVATION_INPUT_LIMITATIONS = MAX_OBSERVATION_LIMITATIONS * 4;
+const MAX_DIAGNOSTIC_DEPTH = 4;
+const MAX_DIAGNOSTIC_VALUES_PER_ENTRY = 32;
+const OBSERVATION_INPUT_FIELDS = [
+    'version',
+    'status',
+    'observedAt',
+    'scanMode',
+    'source',
+    'durationMs',
+    'complete',
+    'truncated',
+    'limitations',
+    'diagnostics',
+];
+// Observation v1 diagnostics use a closed, source-owned vocabulary. Reading
+// only these descriptors keeps normalisation independent of an untrusted
+// object's total key count and preserves the deployed producer fields.
+const REGISTERED_DIAGNOSTIC_KEYS = [
+    'a',
+    'aaaa',
+    'addressSource',
+    'advisoryMatches',
+    'arrayItemsExamined',
+    'attemptCount',
+    'authorityCount',
+    'caa',
+    'caa_policy',
+    'catalogComponents',
+    'certificateGroups',
+    'certificateGroupsTruncated',
+    'certificateRows',
+    'charactersExamined',
+    'cidrCount',
+    'classifiedInputs',
+    'cname',
+    'connectionAttempts',
+    'delegation',
+    'discarded',
+    'discardedAuthorityRecordValueCount',
+    'discardedFields',
+    'discardedProperties',
+    'discardedUrls',
+    'discarded_attributes',
+    'discarded_entities',
+    'discarded_metadata',
+    'discarded_relationships',
+    'dmarc',
+    'documentsParsed',
+    'entities',
+    'error',
+    'externalScriptsSkipped',
+    'findings',
+    'formsObserved',
+    'generatorEvaluated',
+    'htmlEvaluated',
+    'httpStatus',
+    'https',
+    'ignoredCount',
+    'indicatorsObserved',
+    'inlineCharactersExamined',
+    'inlineScriptsExamined',
+    'inlineSignatureCharactersExamined',
+    'inlineSignatureTimedOut',
+    'inlineSignatureUnavailable',
+    'inputsObserved',
+    'knownExploitedMatches',
+    'lameAuthorityCount',
+    'malformedCount',
+    'malformedScripts',
+    'matches',
+    'mx',
+    'namesExamined',
+    'ns',
+    'objectsExamined',
+    'observed',
+    'observedAbsence',
+    'partialAuthorityCount',
+    'passiveHeadersEvaluated',
+    'potentialExposure',
+    'ptr',
+    'queriedAddressCount',
+    'redirectCount',
+    'referencesExamined',
+    'rejectedRows',
+    'relationshipTagsExamined',
+    'relationshipUrlsDiscarded',
+    'relationships',
+    'requestCount',
+    'resolvedAddressCount',
+    'resourceOriginsEvaluated',
+    'rolesObserved',
+    'scriptElementsExamined',
+    'scriptsExamined',
+    'scriptsObserved',
+    'serverEvaluated',
+    'soa',
+    'spf',
+    'successfulAuthorityCount',
+    'tagLimitReached',
+    'tagsExamined',
+    'trackingIdentifiersTruncated',
+    'tree',
+    'truncatedAuthorityRecordSetCount',
+    'truncatedNames',
+    'truncatedSameAsLists',
+    'truncatedTypeLists',
+    'unavailable',
+    'unclassifiedActions',
+    'unreachableAuthorityCount',
+    'workTruncated',
+];
+const ISO_DATE_TIME_RE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(\.\d{1,43})?(Z|[+-]\d{2}:\d{2})$/iu;
+const LEGACY_ISO_DATE_TIME_RE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(\.\d{1,43})?(Z|[+-]\d{2}:\d{2})?$/iu;
+const CT_DATE_TIME_RE = /^(\d{4})-(\d{2})-(\d{2})[ T](\d{2}):(\d{2}):(\d{2})(\.\d{1,43})?(Z|[+-]\d{2}:\d{2})?$/iu;
+function isObservationStatus(value) {
+    return typeof value === 'string' && STATUSES.has(value);
+}
+function isScanMode(value) {
+    return typeof value === 'string' && SCAN_MODES.has(value);
+}
+function safeString(value, maxLength) {
+    if (typeof value !== 'string' || value.length > maxLength * 4)
+        return null;
+    const normalised = value.trim().replace(/[\u0000-\u001f\u007f]/g, ' ');
+    return normalised ? normalised.slice(0, maxLength) : null;
+}
+function ownDataValue(value, key) {
+    try {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        return descriptor && 'value' in descriptor ? descriptor.value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function snapshotObservationInput(value) {
+    const snapshot = {};
+    for (const field of OBSERVATION_INPUT_FIELDS) {
+        const fieldValue = ownDataValue(value, field);
+        if (fieldValue === undefined)
+            continue;
+        Object.defineProperty(snapshot, field, {
+            configurable: true,
+            enumerable: true,
+            value: fieldValue,
+            writable: true,
+        });
+    }
+    return snapshot;
+}
+function safelyIsArray(value) {
+    try {
+        return Array.isArray(value);
+    }
+    catch {
+        return true;
+    }
+}
+function boundedArrayDataValues(value, maximum) {
+    if (!safelyIsArray(value))
+        return [];
+    const output = [];
+    const rawLength = ownDataValue(value, 'length');
+    const length = typeof rawLength === 'number' && Number.isSafeInteger(rawLength) && rawLength >= 0
+        ? Math.min(rawLength, maximum)
+        : 0;
+    for (let index = 0; index < length; index += 1) {
+        const item = ownDataValue(value, String(index));
+        if (item !== undefined)
+            output.push(item);
+    }
+    return output;
+}
+function validCalendarParts(parts) {
+    const year = Number(parts[1]);
+    const month = Number(parts[2]);
+    const day = Number(parts[3]);
+    const hour = Number(parts[4]);
+    const minute = Number(parts[5]);
+    const second = Number(parts[6]);
+    if (year < 1 || month < 1 || month > 12 || day < 1 || hour > 23 || minute > 59 || second > 59)
+        return false;
+    const date = new Date(0);
+    date.setUTCFullYear(year, month - 1, day);
+    date.setUTCHours(hour, minute, second, 0);
+    return date.getUTCFullYear() === year
+        && date.getUTCMonth() === month - 1
+        && date.getUTCDate() === day
+        && date.getUTCHours() === hour
+        && date.getUTCMinutes() === minute
+        && date.getUTCSeconds() === second;
+}
+function canonicalTimestamp(value, expression, assignUtcWhenMissing) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 64 || /[\u0000-\u001f\u007f]/u.test(value))
+        return null;
+    const match = expression.exec(value);
+    if (!match || !validCalendarParts(match))
+        return null;
+    const zone = match[8] || (assignUtcWhenMissing ? 'Z' : '');
+    if (!zone)
+        return null;
+    if (zone !== 'Z' && zone.toUpperCase() !== 'Z') {
+        const hours = Number(zone.slice(1, 3));
+        const minutes = Number(zone.slice(4, 6));
+        if (hours > 23 || minutes > 59)
+            return null;
+    }
+    const normalised = `${match[1]}-${match[2]}-${match[3]}T${match[4]}:${match[5]}:${match[6]}${match[7] || ''}${zone.toUpperCase() === 'Z' ? 'Z' : zone}`;
+    const timestamp = Date.parse(normalised);
+    if (!Number.isFinite(timestamp))
+        return null;
+    const date = new Date(timestamp);
+    const utcYear = date.getUTCFullYear();
+    return utcYear >= 1 && utcYear <= 9_999 ? date.toISOString() : null;
+}
+function normalizeExplicitIsoTimestamp(value) {
+    return canonicalTimestamp(value, ISO_DATE_TIME_RE, false);
+}
+// Frozen legacy schemas accepted zone-less ISO date-times. Preserve that
+// migration path deterministically by assigning UTC instead of consulting the
+// host timezone. Current schemas must use normalizeExplicitIsoTimestamp.
+function normalizeLegacyIsoTimestamp(value) {
+    return canonicalTimestamp(value, LEGACY_ISO_DATE_TIME_RE, true);
+}
+function normalizeCtTimestamp(value) {
+    return canonicalTimestamp(value, CT_DATE_TIME_RE, true);
+}
+function isoTimestamp(value) {
+    return normalizeExplicitIsoTimestamp(value);
+}
+function normalizeDiagnosticValue(value, budget, depth = 0) {
+    budget.remaining -= 1;
+    if (budget.remaining < 0) {
+        budget.exhausted = true;
+        return null;
+    }
+    if (depth > MAX_DIAGNOSTIC_DEPTH)
+        return null;
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? value : null;
+    if (typeof value === 'string')
+        return safeString(value, MAX_DIAGNOSTIC_STRING);
+    if (!value || typeof value !== 'object' || safelyIsArray(value))
+        return null;
+    const objectValue = value;
+    if (budget.active.has(objectValue))
+        return null;
+    const record = value;
+    const output = {};
+    budget.active.add(objectValue);
+    try {
+        for (const field of ['status', 'error', 'detail', 'truncated', 'discarded', 'count']) {
+            const fieldValue = ownDataValue(record, field);
+            if (fieldValue === undefined)
+                continue;
+            const normalised = normalizeDiagnosticValue(fieldValue, budget, depth + 1);
+            if (normalised !== null) {
+                Object.defineProperty(output, field, {
+                    configurable: true,
+                    enumerable: true,
+                    value: normalised,
+                    writable: true,
+                });
+            }
+        }
+    }
+    finally {
+        budget.active.delete(objectValue);
+    }
+    return Object.keys(output).length ? output : null;
+}
+function normalizeDiagnostics(value) {
+    if (!value || typeof value !== 'object' || safelyIsArray(value))
+        return {};
+    const record = value;
+    const output = {};
+    let retained = 0;
+    for (const key of REGISTERED_DIAGNOSTIC_KEYS) {
+        if (retained >= MAX_DIAGNOSTICS)
+            break;
+        if (key.length > MAX_DIAGNOSTIC_KEY)
+            continue;
+        const entryValue = ownDataValue(record, key);
+        if (entryValue === undefined)
+            continue;
+        const budget = {
+            remaining: MAX_DIAGNOSTIC_VALUES_PER_ENTRY,
+            active: new Set(),
+            exhausted: false,
+        };
+        const normalised = normalizeDiagnosticValue(entryValue, budget);
+        if (normalised !== null && !budget.exhausted) {
+            Object.defineProperty(output, key, {
+                configurable: true,
+                enumerable: true,
+                value: normalised,
+                writable: true,
+            });
+            retained += 1;
+        }
+    }
+    return output;
+}
+function createObservationFromSnapshot(record) {
+    const rawStatus = record.status;
+    const rawSource = record.source;
+    const rawObservedAt = record.observedAt;
+    const rawDuration = record.durationMs;
+    const rawScanMode = record.scanMode;
+    const status = isObservationStatus(rawStatus) ? rawStatus : 'error';
+    const source = safeString(rawSource, 40) || 'unknown';
+    const observedAt = isoTimestamp(rawObservedAt) || new Date().toISOString();
+    const duration = typeof rawDuration === 'number' ? rawDuration : Number.NaN;
+    const limitations = [...new Set(boundedArrayDataValues(record.limitations, MAX_OBSERVATION_INPUT_LIMITATIONS)
+            .map((item) => safeString(item, MAX_OBSERVATION_LIMITATION_LENGTH))
+            .filter((item) => item !== null))]
+        .slice(0, MAX_OBSERVATION_LIMITATIONS);
+    return {
+        version: OBSERVATION_VERSION,
+        status,
+        observedAt,
+        scanMode: isScanMode(rawScanMode) ? rawScanMode : null,
+        source,
+        durationMs: Number.isFinite(duration) ? Math.max(0, Math.min(MAX_DURATION_MS, Math.round(duration))) : null,
+        complete: record.complete === true,
+        truncated: record.truncated === true,
+        limitations,
+        diagnostics: normalizeDiagnostics(record.diagnostics),
+    };
+}
+function createObservation(input = {}) {
+    const record = input && typeof input === 'object' && !safelyIsArray(input)
+        ? snapshotObservationInput(input)
+        : {};
+    return createObservationFromSnapshot(record);
+}
+function readObservationEnvelope(value) {
+    if (value === undefined || value === null)
+        return { state: 'absent', observation: null };
+    if (!value || typeof value !== 'object' || safelyIsArray(value))
+        return { state: 'invalid', observation: null };
+    const record = snapshotObservationInput(value);
+    const version = record.version;
+    const status = record.status;
+    const source = record.source;
+    const observedAt = record.observedAt;
+    if (typeof version === 'number'
+        && Number.isInteger(version)
+        && version > OBSERVATION_VERSION) {
+        return { state: 'unsupported', observation: null };
+    }
+    if (version !== OBSERVATION_VERSION
+        || !isObservationStatus(status)
+        || !safeString(source, 40)
+        || !isoTimestamp(observedAt)) {
+        return { state: 'invalid', observation: null };
+    }
+    return { state: 'supported', observation: createObservationFromSnapshot(record) };
+}
+export { MAX_OBSERVATION_DIAGNOSTICS, MAX_OBSERVATION_LIMITATIONS, MAX_OBSERVATION_LIMITATION_LENGTH, OBSERVATION_VERSION, createObservation, normalizeCtTimestamp, normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp, readObservationEnvelope, };

package/{frontend/src/lib/analysis/external-findings-import.js → packages/interchange/external-findings-import.mjs}

@@ -1,10 +1,8 @@
-import { normalizeDomain, openOrCreateCase, updateCase, } from "./case-model.js";
-export const EXTERNAL_FINDINGS_SCHEMA = 'whoisleuth.external-findings';
-export const EXTERNAL_FINDINGS_VERSION = 4;
-export const MAX_EXTERNAL_FINDINGS_IMPORT_BYTES = 384 * 1024;
-export const MAX_EXTERNAL_FINDINGS = 100;
-export const MAX_EXTERNAL_FINDINGS_PER_DOMAIN = 20;
-export const MAX_EXTERNAL_FINDING_DOMAINS = 25;
+import { normalizeDomain, openOrCreateCase, updateCase, } from "../cases/case-model.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, } from "../contracts/external-observation-interchange.mjs";
+import { hasUnsafeRetainedText } from "./retained-text.mjs";
+export { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, };
 export const EXTERNAL_FINDING_CATEGORIES = [
     'certificate',
     'dns',
@@ -17,7 +15,6 @@ export const EXTERNAL_FINDING_CATEGORIES = [
 ];
 const CATEGORIES = new Set(EXTERNAL_FINDING_CATEGORIES);
 const COMPLETENESS = new Set(['complete', 'inconclusive', 'partial', 'unknown']);
-const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const ROOT_KEYS = new Set(['schema', 'schemaVersion', 'source', 'findings']);
 const SOURCE_KEYS = new Set(['name', 'reference', 'collectedAt']);
 const FINDING_KEYS = new Set([
@@ -62,8 +59,8 @@ function requiredText(value, maximum, label) {
     if (typeof value !== 'string'
         || !value.trim()
         || value.length > maximum
-        || CONTROL_RE.test(value)) {
-        throw new Error(`${label} must be non-empty, bounded text without control characters.`);
+        || hasUnsafeRetainedText(value)) {
+        throw new Error(`${label} must be non-empty, bounded text without unsafe control characters or formatting controls.`);
     }
     return value.trim();
 }
@@ -76,10 +73,10 @@ function iso(value, label, optional = false) {
     if (optional && (value === undefined || value === null || value === ''))
         return null;
     const text = requiredText(value, 64, label);
-    const parsed = Date.parse(text);
-    if (!Number.isFinite(parsed))
-        throw new Error(`${label} must be a valid date and time.`);
-    return new Date(parsed).toISOString();
+    const normalized = normalizeExplicitIsoTimestamp(text);
+    if (!normalized)
+        throw new Error(`${label} must be a valid date and time with an explicit timezone.`);
+    return normalized;
 }
 function limitations(value, index) {
     if (value === undefined)
@@ -92,7 +89,7 @@ function limitations(value, index) {
         unique.add(requiredText(item, 240, `Finding ${index + 1} limitation`));
     return [...unique];
 }
-function structuredObservation(value, index, documentVersion) {
+function structuredObservation(value, index) {
     if (value === undefined || value === null)
         return null;
     const item = record(value);
@@ -124,7 +121,7 @@ function structuredObservation(value, index, documentVersion) {
     let dnsNameCount = null;
     let namesComplete = null;
     if (declaresEventMetadata) {
-        if (!certificateSchema || documentVersion < 4) {
+        if (!certificateSchema) {
             throw new Error(`Finding ${index + 1} certificate-event metadata requires external-findings schema version 4.`);
         }
         eventId = requiredText(item.eventId, 64, `Finding ${index + 1} certificate event id`);
@@ -180,8 +177,8 @@ export function parseExternalFindingsDocument(value) {
         throw new Error('External findings must use the documented object shape without additional top-level fields.');
     }
     if (root.schema !== EXTERNAL_FINDINGS_SCHEMA
-        || ![1, 2, 3, EXTERNAL_FINDINGS_VERSION].includes(Number(root.schemaVersion))) {
-        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version 1, 2, 3, or ${EXTERNAL_FINDINGS_VERSION}.`);
+        || root.schemaVersion !== EXTERNAL_FINDINGS_VERSION) {
+        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version ${EXTERNAL_FINDINGS_VERSION}.`);
     }
     const sourceValue = record(root.source);
     if (!sourceValue || !hasOnlyKeys(sourceValue, SOURCE_KEYS)) {
@@ -213,9 +210,7 @@ export function parseExternalFindingsDocument(value) {
         if (typeof item.completeness !== 'string' || !COMPLETENESS.has(item.completeness)) {
             throw new Error(`Finding ${index + 1} completeness is unsupported.`);
         }
-        const evidenceClass = item.evidenceClass === undefined && root.schemaVersion === 1
-            ? 'provider_report'
-            : item.evidenceClass;
+        const evidenceClass = item.evidenceClass;
         if (evidenceClass !== 'deployment_observation' && evidenceClass !== 'provider_report') {
             throw new Error(`Finding ${index + 1} evidence class is unsupported.`);
         }
@@ -228,7 +223,7 @@ export function parseExternalFindingsDocument(value) {
             completeness: item.completeness,
             limitations: limitations(item.limitations, index),
             reference: optionalText(item.reference, 500, `Finding ${index + 1} reference`),
-            structuredObservation: structuredObservation(item.structuredObservation, index, Number(root.schemaVersion)),
+            structuredObservation: structuredObservation(item.structuredObservation, index),
         };
         const key = findingKey(finding, source.name);
         if (seen.has(key))
@@ -253,6 +248,13 @@ export function parseExternalFindingsDocument(value) {
         findings: normalized,
     };
 }
+export function serializeExternalFindingsDocument(value) {
+    const serialised = JSON.stringify(value, null, 2);
+    if (typeof serialised !== 'string') {
+        throw new TypeError('External findings must be JSON-serialisable.');
+    }
+    return `${serialised}\n`;
+}
 function pinValue(finding) {
     return finding.reference
         ? `${finding.summary} Reference: ${finding.reference}`

package/packages/interchange/retained-text.mjs

@@ -0,0 +1,8 @@
+const UNSAFE_RETAINED_TEXT_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/u;
+const UNSAFE_RETAINED_TEXT_GLOBAL_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/gu;
+export function hasUnsafeRetainedText(value) {
+    return UNSAFE_RETAINED_TEXT_RE.test(value);
+}
+export function neutralizeUnsafeRetainedText(value) {
+    return value.replace(UNSAFE_RETAINED_TEXT_GLOBAL_RE, ' ');
+}

package/{frontend/src/lib/analysis/acquisition-decision-packet.js → packages/investigation/acquisition-decision-packet.mjs}

@@ -1,6 +1,7 @@
-import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "./artifact-integrity.js";
-export const ACQUISITION_DECISION_PACKET_SCHEMA = 'whoisleuth.acquisition-decision';
-export const ACQUISITION_DECISION_PACKET_VERSION = 2;
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../evidence/artifact-integrity.mjs";
+import { ACQUISITION_DECISION_PACKET_SCHEMA, ACQUISITION_DECISION_PACKET_VERSION, } from "../contracts/investigation-portability.mjs";
+import { isValidAsciiDomainName } from "../../lib/hostname.mjs";
+export { ACQUISITION_DECISION_PACKET_SCHEMA, ACQUISITION_DECISION_PACKET_VERSION };
 export const ACQUISITION_DECISIONS = [
     'unresolved',
     'continue_manual_review',
@@ -28,11 +29,13 @@ function timestamp(value) {
     return new Date(value).toISOString();
 }
 function target(value) {
-    const normalized = text(value, 253).toLowerCase().replace(/\.$/u, '');
-    if (!normalized || !normalized.includes('.') || /[/\\\s]/u.test(normalized)) {
+    const submitted = typeof value === 'string'
+        ? value.trim().replace(/\.$/u, '')
+        : '';
+    if (!isValidAsciiDomainName(submitted, { requireDot: true })) {
         throw new Error('A canonical domain is required for an acquisition decision packet.');
     }
-    return normalized;
+    return submitted.toLowerCase();
 }
 function decision(value) {
     return typeof value === 'string' && DECISION_SET.has(value)

package/{frontend/src/lib/analysis/bulk-domain-comparison.js → packages/investigation/bulk-domain-comparison.mjs}

@@ -1,9 +1,8 @@
-import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
-import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "./artifact-integrity.js";
-import { BULK_REVIEW_STALE_AFTER_DAYS } from "./bulk-retry-plan.js";
-export const BULK_DOMAIN_COMPARISON_SCHEMA = 'whoisleuth.domain-comparison';
-export const BULK_DOMAIN_COMPARISON_VERSION = 3;
-export const BULK_DOMAIN_COMPARISON_EXPORT_VERSION = 4;
+import { normalizeBulkSessionResult, } from "../workspace/bulk-session-model.mjs";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../evidence/artifact-integrity.mjs";
+import { BULK_REVIEW_STALE_AFTER_DAYS } from "./bulk-review-policy.mjs";
+import { BULK_DOMAIN_COMPARISON_EXPORT_VERSION, BULK_DOMAIN_COMPARISON_SCHEMA, BULK_DOMAIN_COMPARISON_VERSION, } from "../contracts/investigation-portability.mjs";
+export { BULK_DOMAIN_COMPARISON_EXPORT_VERSION, BULK_DOMAIN_COMPARISON_SCHEMA, BULK_DOMAIN_COMPARISON_VERSION };
 function text(value, maximum = 500) {
     return typeof value === 'string'
         ? value.replace(/[\u0000-\u001f\u007f]/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum)

package/{frontend/src/lib/analysis/bulk-mail-exposure.js → packages/investigation/bulk-mail-exposure.mjs}

@@ -1,9 +1,7 @@
-import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "./artifact-integrity.js";
-import { BULK_PROFILE_CONTEXT_MISMATCH_LIMITATION, normalizeBulkProfileContext, normalizeBulkSessionResult, } from "./bulk-session-model.js";
-export const BULK_MAIL_EXPOSURE_SCHEMA = 'whoisleuth.bulk-mail-exposure';
-export const BULK_MAIL_EXPOSURE_VERSION = 1;
-export const BULK_MAIL_EXPOSURE_EXPORT_VERSION = 2;
-export const MAX_BULK_MAIL_EXPOSURE_ROWS = 2_000;
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../evidence/artifact-integrity.mjs";
+import { BULK_PROFILE_CONTEXT_MISMATCH_LIMITATION, normalizeBulkProfileContext, normalizeBulkSessionResult, } from "../workspace/bulk-session-model.mjs";
+import { BULK_MAIL_EXPOSURE_EXPORT_VERSION, BULK_MAIL_EXPOSURE_SCHEMA, BULK_MAIL_EXPOSURE_VERSION, MAX_BULK_MAIL_EXPOSURE_ROWS, } from "../contracts/investigation-portability.mjs";
+export { BULK_MAIL_EXPOSURE_EXPORT_VERSION, BULK_MAIL_EXPOSURE_SCHEMA, BULK_MAIL_EXPOSURE_VERSION, MAX_BULK_MAIL_EXPOSURE_ROWS };
 const STATE_LABELS = {
     authenticated_mail: 'Receiving mail with SPF and DMARC',
     evidence_incomplete: 'Mail evidence incomplete',

package/{frontend/src/lib/analysis/bulk-review-export.js → packages/investigation/bulk-review-export.mjs}

@@ -1,8 +1,8 @@
-import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
-import { BULK_REVIEW_STATES, } from "./bulk-review-model.js";
-import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "./artifact-integrity.js";
-export const BULK_REVIEW_MANIFEST_SCHEMA = 'whoisleuth.bulk-review-manifest';
-export const BULK_REVIEW_MANIFEST_VERSION = 2;
+import { normalizeBulkSessionResult, } from "../workspace/bulk-session-model.mjs";
+import { BULK_REVIEW_STATES, } from "../workspace/bulk-review-model.mjs";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../evidence/artifact-integrity.mjs";
+import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, } from "../contracts/investigation-portability.mjs";
+export { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION };
 const MAX_MANIFEST_ROWS = 2_000;
 const REVIEW_STATE_SET = new Set(BULK_REVIEW_STATES);
 function timestamp(value, fallback) {

package/packages/investigation/bulk-review-policy.mjs

@@ -0,0 +1 @@
+export const BULK_REVIEW_STALE_AFTER_DAYS = 7;