@slicedearth/whoisleuth-cli 1.47.4 → 2.0.1

package/cli/artifact-verify.mjs

@@ -2,22 +2,19 @@ import { Buffer } from 'node:buffer';
 import { createHash } from 'node:crypto';
 import { parseBoundedJsonObject } from "./bounded-json.mjs";
 import { validateInvestigationCapsuleStructure, validateLookupEvidenceArtifactStructure, validateOfflineArtifactStructure, validateSignedDigestArtifactStructure, } from "./artifact-structure.mjs";
-import { CASE_RESPONSE_PACKET_SCHEMA, CASE_RESPONSE_PACKET_VERSION, LEGACY_CASE_RESPONSE_PACKET_VERSION, verifyCaseResponsePacketIntegrity, } from "../frontend/src/lib/analysis/case-response-packet.js";
-import { ACQUISITION_DECISION_PACKET_SCHEMA, ACQUISITION_DECISION_PACKET_VERSION, } from "../frontend/src/lib/analysis/acquisition-decision-packet.js";
-import { LOOKUP_CLAIM_PASSPORT_SCHEMA, LOOKUP_CLAIM_PASSPORT_VERSION, } from "../frontend/src/lib/analysis/lookup-claim-passport.js";
-import { BULK_DOMAIN_COMPARISON_SCHEMA, BULK_DOMAIN_COMPARISON_EXPORT_VERSION, } from "../frontend/src/lib/analysis/bulk-domain-comparison.js";
-import { BULK_MAIL_EXPOSURE_SCHEMA, BULK_MAIL_EXPOSURE_EXPORT_VERSION, } from "../frontend/src/lib/analysis/bulk-mail-exposure.js";
-import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, } from "../frontend/src/lib/analysis/bulk-review-export.js";
-import { decryptWorkspaceArchive, inspectEncryptedWorkspaceArchive, isEncryptedWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive-crypto.js";
-import { WORKSPACE_ARCHIVE_SCHEMA, previewWorkspaceArchive, readWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive.js";
-import { canonicalArtifactJsonFor, resolveArtifactCanonicalization, sha256ArtifactDigestFor, SORTED_JSON_V1, SORTED_JSON_V2, } from "../frontend/src/lib/analysis/artifact-integrity.js";
-import { SAVED_LOOKUP_SCHEMA, SAVED_LOOKUP_SCHEMA_VERSION, parseSavedLookupDocument, } from "./saved-lookup.mjs";
-import { DOMAIN_CONTROL_MANIFEST_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
-import { DOMAIN_CONTROL_PASSPORT_VERSION } from "../frontend/src/lib/analysis/domain-control-manifest-core.js";
+import { verifyCaseResponsePacketIntegrity, } from "../packages/cases/case-response-packet.mjs";
+import { CASE_PORTABILITY_VERIFIER_DISPATCH, CASE_RESPONSE_PACKET_VERSION, CASE_RESPONSE_PACKET_SCHEMA, CLI_CASE_PACK_VERSION, CLI_CASE_PACK_SCHEMA, } from "../packages/contracts/case-portability.mjs";
+import { ACQUISITION_DECISION_PACKET_SCHEMA, BULK_DOMAIN_COMPARISON_SCHEMA, BULK_MAIL_EXPOSURE_SCHEMA, BULK_REVIEW_MANIFEST_SCHEMA, LOOKUP_CLAIM_PASSPORT_SCHEMA, LOOKUP_CLAIM_PASSPORT_VERSION, SUPPORTED_ACQUISITION_DECISION_PACKET_VERSIONS, SUPPORTED_BULK_DOMAIN_COMPARISON_EXPORT_VERSIONS, SUPPORTED_BULK_MAIL_EXPOSURE_EXPORT_VERSIONS, SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS, } from "../packages/contracts/investigation-portability.mjs";
+import { decryptWorkspaceArchive, inspectEncryptedWorkspaceArchive, isEncryptedWorkspaceArchive, } from "../packages/workspace/workspace-archive-crypto.mjs";
+import { WORKSPACE_ARCHIVE_SCHEMA, previewWorkspaceArchive, readWorkspaceArchive, } from "../packages/workspace/workspace-archive.mjs";
+import { canonicalArtifactJsonFor, resolveArtifactCanonicalization, sha256ArtifactDigestFor, SORTED_JSON_V2, } from "../packages/evidence/artifact-integrity.mjs";
+import { SAVED_LOOKUP_SCHEMA, SUPPORTED_SAVED_LOOKUP_SCHEMA_VERSIONS, parseCliLookupDocument, } from "./saved-lookup.mjs";
+import { DOMAIN_CONTROL_MANIFEST_SCHEMA, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
+import { DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, } from "../packages/contracts/domain-control-manifest.mjs";
 import { DOMAIN_CHANGE_PACKET_SCHEMA, DOMAIN_CHANGE_PACKET_VERSION, } from "../lib/domain-change-packet.mjs";
-import { INVESTIGATION_CAPSULE_SCHEMA, INVESTIGATION_CAPSULE_VERSION, LEGACY_INVESTIGATION_CAPSULE_VERSION, verifyInvestigationCapsule, } from "../frontend/src/lib/analysis/investigation-capsule.js";
+import { INVESTIGATION_CAPSULE_SCHEMA, SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS, verifyInvestigationCapsule, } from "../packages/investigation/investigation-capsule.mjs";
 import { INVESTIGATION_MANIFEST_SCHEMA, INVESTIGATION_MANIFEST_VERSION, } from "./investigation-manifest.mjs";
-import { CLI_CASE_PACK_SCHEMA, verifyCliCasePack, } from "./case-pack.mjs";
+import { verifyCliCasePack } from "./case-pack.mjs";
 import { LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES, LOOKUP_EVIDENCE_SCHEMA, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, } from "../lib/evidence-export.mjs";
 export const OFFLINE_ARTIFACT_VERIFICATION_SCHEMA = 'whoisleuth.offline-artifact-verification';
 export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 3;
@@ -30,31 +27,62 @@ export class UnsupportedOfflineArtifactError extends TypeError {
         this.name = 'UnsupportedOfflineArtifactError';
     }
 }
-const SIGNED_ARTIFACT_VERSIONS = Object.freeze({
-    [ACQUISITION_DECISION_PACKET_SCHEMA]: new Set([1, ACQUISITION_DECISION_PACKET_VERSION]),
-    [LOOKUP_CLAIM_PASSPORT_SCHEMA]: new Set([LOOKUP_CLAIM_PASSPORT_VERSION]),
-    [BULK_DOMAIN_COMPARISON_SCHEMA]: new Set([3, BULK_DOMAIN_COMPARISON_EXPORT_VERSION]),
-    [BULK_MAIL_EXPOSURE_SCHEMA]: new Set([1, BULK_MAIL_EXPOSURE_EXPORT_VERSION]),
-    [BULK_REVIEW_MANIFEST_SCHEMA]: new Set([1, BULK_REVIEW_MANIFEST_VERSION]),
-    [DOMAIN_CONTROL_MANIFEST_SCHEMA]: new Set([DOMAIN_CONTROL_PASSPORT_VERSION, DOMAIN_CONTROL_MANIFEST_VERSION]),
-    [DOMAIN_CHANGE_PACKET_SCHEMA]: new Set([1, DOMAIN_CHANGE_PACKET_VERSION]),
-    [INVESTIGATION_MANIFEST_SCHEMA]: new Set([1, INVESTIGATION_MANIFEST_VERSION]),
-});
-const SIGNED_ARTIFACT_CANONICALIZATION = Object.freeze({
-    [ACQUISITION_DECISION_PACKET_SCHEMA]: [{ version: 1, canonicalization: SORTED_JSON_V1, explicit: false }, { version: ACQUISITION_DECISION_PACKET_VERSION, canonicalization: SORTED_JSON_V2, explicit: true }],
-    [LOOKUP_CLAIM_PASSPORT_SCHEMA]: [{ version: LOOKUP_CLAIM_PASSPORT_VERSION, canonicalization: SORTED_JSON_V2, explicit: true }],
-    [BULK_DOMAIN_COMPARISON_SCHEMA]: [{ version: 3, canonicalization: SORTED_JSON_V1, explicit: false }, { version: BULK_DOMAIN_COMPARISON_EXPORT_VERSION, canonicalization: SORTED_JSON_V2, explicit: true }],
-    [BULK_MAIL_EXPOSURE_SCHEMA]: [{ version: 1, canonicalization: SORTED_JSON_V1, explicit: false }, { version: BULK_MAIL_EXPOSURE_EXPORT_VERSION, canonicalization: SORTED_JSON_V2, explicit: true }],
-    [BULK_REVIEW_MANIFEST_SCHEMA]: [{ version: 1, canonicalization: SORTED_JSON_V1, explicit: false }, { version: BULK_REVIEW_MANIFEST_VERSION, canonicalization: SORTED_JSON_V2, explicit: true }],
-    [DOMAIN_CONTROL_MANIFEST_SCHEMA]: [{ version: DOMAIN_CONTROL_PASSPORT_VERSION, canonicalization: SORTED_JSON_V1, explicit: true }, { version: DOMAIN_CONTROL_MANIFEST_VERSION, canonicalization: SORTED_JSON_V2, explicit: true }],
-    [DOMAIN_CHANGE_PACKET_SCHEMA]: [{ version: 1, canonicalization: SORTED_JSON_V1, explicit: false }, { version: DOMAIN_CHANGE_PACKET_VERSION, canonicalization: SORTED_JSON_V2, explicit: true }],
-    [INVESTIGATION_MANIFEST_SCHEMA]: [{ version: 1, canonicalization: SORTED_JSON_V1, explicit: false }, { version: INVESTIGATION_MANIFEST_VERSION, canonicalization: SORTED_JSON_V2, explicit: true }],
+function currentCanonicalizationRoutes(versions) {
+    return Object.freeze(versions.map((version) => Object.freeze({
+        version,
+        canonicalization: SORTED_JSON_V2,
+        explicit: true,
+    })));
+}
+const SIGNED_ARTIFACT_ROUTES = Object.freeze({
+    [ACQUISITION_DECISION_PACKET_SCHEMA]: currentCanonicalizationRoutes(SUPPORTED_ACQUISITION_DECISION_PACKET_VERSIONS),
+    [LOOKUP_CLAIM_PASSPORT_SCHEMA]: currentCanonicalizationRoutes([LOOKUP_CLAIM_PASSPORT_VERSION]),
+    [BULK_DOMAIN_COMPARISON_SCHEMA]: currentCanonicalizationRoutes(SUPPORTED_BULK_DOMAIN_COMPARISON_EXPORT_VERSIONS),
+    [BULK_MAIL_EXPOSURE_SCHEMA]: currentCanonicalizationRoutes(SUPPORTED_BULK_MAIL_EXPOSURE_EXPORT_VERSIONS),
+    [BULK_REVIEW_MANIFEST_SCHEMA]: currentCanonicalizationRoutes(SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS),
+    [DOMAIN_CONTROL_MANIFEST_SCHEMA]: DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES,
+    [DOMAIN_CHANGE_PACKET_SCHEMA]: currentCanonicalizationRoutes([DOMAIN_CHANGE_PACKET_VERSION]),
+    [INVESTIGATION_MANIFEST_SCHEMA]: currentCanonicalizationRoutes([INVESTIGATION_MANIFEST_VERSION]),
 });
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
         : null;
 }
+function selectCasePortabilityVerifier(value) {
+    const packet = record(value.packet);
+    for (const descriptor of CASE_PORTABILITY_VERIFIER_DISPATCH) {
+        if (descriptor.id === 'case-response-packet'
+            && descriptor.discriminator === 'root_schema'
+            && value.schema === CASE_RESPONSE_PACKET_SCHEMA)
+            return descriptor;
+        if (descriptor.id === 'cli-case-pack'
+            && descriptor.discriminator === 'packet_schema'
+            && packet?.schema === CLI_CASE_PACK_SCHEMA)
+            return descriptor;
+    }
+    return null;
+}
+function casePortabilityVersion(descriptor, value) {
+    if (descriptor.versionField === 'schemaVersion')
+        return artifactVersion(value);
+    const packet = record(value.packet);
+    if (!packet)
+        throw new TypeError('The Case portability verifier discriminator is missing.');
+    return artifactVersion(packet);
+}
+function supportsCasePortabilityVersion(descriptor, version) {
+    return descriptor.supportedVersions.some((candidate) => candidate === version);
+}
+function rejectUnsupportedCasePortabilityVersion(label, version, currentVersion) {
+    if (Number.isSafeInteger(version) && version >= 1 && version < currentVersion) {
+        throw new UnsupportedOfflineArtifactError(`${label} version ${String(version)} is retired. Export it again as version ${String(currentVersion)} with the last broad-reader release; no data was changed.`);
+    }
+    if (Number.isSafeInteger(version) && version > currentVersion) {
+        throw new UnsupportedOfflineArtifactError(`${label} version ${String(version)} is newer than the supported version ${String(currentVersion)}; no data was changed.`);
+    }
+    throw new UnsupportedOfflineArtifactError(`This ${label} version is malformed or unsupported; no data was changed.`);
+}
 function parseJson(raw) {
     return parseBoundedJsonObject(raw, { maximumBytes: MAX_OFFLINE_ARTIFACT_BYTES });
 }
@@ -115,11 +143,11 @@ async function archiveReport(raw, source, archive, encrypted, ciphertextBytes) {
             schema: WORKSPACE_ARCHIVE_SCHEMA,
             version: archive.sourceVersion,
         }),
-        state: 'verified',
+        state: encrypted ? 'verified' : 'integrity_valid',
         checks: Object.freeze({
             structure: 'verified',
             contentIntegrity: 'verified',
-            contentIntegrityScope: 'whole_artifact',
+            contentIntegrityScope: encrypted ? 'whole_artifact' : 'embedded_projections',
             authenticatedEncryption: encrypted ? 'verified' : 'not_applicable',
         }),
         summary: Object.freeze({
@@ -135,7 +163,9 @@ async function archiveReport(raw, source, archive, encrypted, ciphertextBytes) {
             fullyImportable,
         }),
         limitations: Object.freeze([
-            'Verification checks the retained file against its declared versioned integrity contract; it does not establish that the original observations were accurate or remain current.',
+            ...(encrypted
+                ? ['Authenticated decryption and archive validation cover the complete encrypted workspace content; they do not establish that the original observations were accurate or remain current.']
+                : ['Section digest verification covers the archive projections, not root metadata such as generation time or archive limitations. It does not establish that the original observations were accurate or remain current.']),
             ...(!fullyImportable
                 ? ['One or more integrity-valid archive sections cannot be imported completely by this version. Inspect the archive before selecting data to restore.']
                 : []),
@@ -143,8 +173,8 @@ async function archiveReport(raw, source, archive, encrypted, ciphertextBytes) {
     });
 }
 async function verifySignedArtifact(raw, value, schema, version) {
-    const supported = SIGNED_ARTIFACT_VERSIONS[schema];
-    if (!supported?.has(version)) {
+    const routes = SIGNED_ARTIFACT_ROUTES[schema] ?? [];
+    if (!routes.some((route) => route.version === version)) {
         throw new UnsupportedOfflineArtifactError('This signed review-artifact schema or version is not supported.');
     }
     validateSignedDigestArtifactStructure(schema, value);
@@ -155,7 +185,7 @@ async function verifySignedArtifact(raw, value, schema, version) {
         || !/^sha256:[a-f0-9]{64}$/u.test(integrity.digestSha256)) {
         throw new TypeError('The signed review artefact has a missing or malformed integrity envelope.');
     }
-    const canonicalization = resolveArtifactCanonicalization(version, integrity.canonicalization, SIGNED_ARTIFACT_CANONICALIZATION[schema] ?? [], 'Signed review artefact');
+    const canonicalization = resolveArtifactCanonicalization(version, integrity.canonicalization, routes, 'Signed review artefact');
     const { integrity: _integrity, ...unsigned } = value;
     if (await sha256ArtifactDigestFor(unsigned, canonicalization) !== integrity.digestSha256) {
         throw new TypeError('The signed review artefact failed its SHA-256 integrity check.');
@@ -186,8 +216,12 @@ async function verifySignedArtifact(raw, value, schema, version) {
 }
 async function verifyOfflineArtifactCore(raw, options = {}) {
     const value = parseJson(raw);
-    const casePackPacket = record(value.packet);
-    if (casePackPacket?.schema === CLI_CASE_PACK_SCHEMA) {
+    const casePortabilityVerifier = selectCasePortabilityVerifier(value);
+    if (casePortabilityVerifier?.id === 'cli-case-pack') {
+        const casePackVersion = casePortabilityVersion(casePortabilityVerifier, value);
+        if (!supportsCasePortabilityVersion(casePortabilityVerifier, casePackVersion)) {
+            rejectUnsupportedCasePortabilityVersion('CLI Case-pack', casePackVersion, CLI_CASE_PACK_VERSION);
+        }
         const verified = verifyCliCasePack(value);
         return Object.freeze({
             schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
@@ -195,7 +229,7 @@ async function verifyOfflineArtifactCore(raw, options = {}) {
             artifact: Object.freeze({
                 kind: 'cli_case_pack',
                 schema: CLI_CASE_PACK_SCHEMA,
-                version: Number(casePackPacket.version),
+                version: casePackVersion,
             }),
             state: 'verified',
             checks: Object.freeze({
@@ -254,11 +288,11 @@ async function verifyOfflineArtifactCore(raw, options = {}) {
     if (schema === WORKSPACE_ARCHIVE_SCHEMA) {
         return archiveReport(raw, value, await readWorkspaceArchive(value), false, null);
     }
-    if (schema === CASE_RESPONSE_PACKET_SCHEMA) {
-        if (version !== LEGACY_CASE_RESPONSE_PACKET_VERSION && version !== CASE_RESPONSE_PACKET_VERSION) {
-            throw new UnsupportedOfflineArtifactError('This case-response packet version is not supported.');
+    if (casePortabilityVerifier?.id === 'case-response-packet') {
+        if (!supportsCasePortabilityVersion(casePortabilityVerifier, version)) {
+            rejectUnsupportedCasePortabilityVersion('case-response packet', version, CASE_RESPONSE_PACKET_VERSION);
         }
-        validateOfflineArtifactStructure(schema, value);
+        validateOfflineArtifactStructure(CASE_RESPONSE_PACKET_SCHEMA, value);
         const integrity = record(value.integrity);
         if (!integrity || !await verifyCaseResponsePacketIntegrity(value)) {
             throw new TypeError('The case-response packet failed its manifest integrity check.');
@@ -266,7 +300,7 @@ async function verifyOfflineArtifactCore(raw, options = {}) {
         return Object.freeze({
             schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
             version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,
-            artifact: Object.freeze({ kind: 'case_response_packet', schema, version }),
+            artifact: Object.freeze({ kind: 'case_response_packet', schema: CASE_RESPONSE_PACKET_SCHEMA, version }),
             state: 'verified',
             checks: Object.freeze({
                 structure: 'verified',
@@ -286,23 +320,22 @@ async function verifyOfflineArtifactCore(raw, options = {}) {
         });
     }
     if (schema === INVESTIGATION_CAPSULE_SCHEMA) {
-        if (version !== LEGACY_INVESTIGATION_CAPSULE_VERSION && version !== INVESTIGATION_CAPSULE_VERSION) {
+        if (!SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS.some((candidate) => candidate === version)) {
             throw new UnsupportedOfflineArtifactError('This investigation-capsule version is not supported.');
         }
         validateInvestigationCapsuleStructure(value);
         const verification = await verifyInvestigationCapsule(value);
         if (!verification.valid)
             throw new TypeError('The investigation capsule failed its embedded projection integrity checks.');
-        const current = version === INVESTIGATION_CAPSULE_VERSION;
         return Object.freeze({
             schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
             version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,
             artifact: Object.freeze({ kind: 'investigation_capsule', schema, version }),
-            state: current ? 'verified' : 'integrity_valid',
+            state: 'verified',
             checks: Object.freeze({
                 structure: 'verified',
                 contentIntegrity: 'verified',
-                contentIntegrityScope: current ? 'whole_artifact' : 'embedded_projections',
+                contentIntegrityScope: 'whole_artifact',
                 authenticatedEncryption: 'not_applicable',
             }),
             summary: Object.freeze({
@@ -312,9 +345,7 @@ async function verifyOfflineArtifactCore(raw, options = {}) {
                 ciphertextBytes: null,
             }),
             limitations: Object.freeze([
-                ...(current
-                    ? ['The whole capsule matches its declared digest, including metadata and the linked source-contract projection digests. The non-embedded Lookup evidence remains linked by digest and must be retained separately.']
-                    : ['The embedded brief, graph, and optional analyst-record projections match their declared digests. Capsule metadata and the linked Lookup evidence are outside those projection digests and must not be treated as whole-file integrity verified.']),
+                'The whole capsule matches its declared digest, including metadata and the linked source-contract projection digests. The non-embedded Lookup evidence remains linked by digest and must be retained separately.',
                 'Digest verification detects changed content but does not authenticate the analyst, signer, collection source, or truth of retained observations and assertions.',
             ]),
         });
@@ -352,10 +383,10 @@ async function verifyOfflineArtifactCore(raw, options = {}) {
         });
     }
     if (schema === SAVED_LOOKUP_SCHEMA) {
-        if (version !== SAVED_LOOKUP_SCHEMA_VERSION) {
+        if (!SUPPORTED_SAVED_LOOKUP_SCHEMA_VERSIONS.some((supported) => supported === version)) {
             throw new UnsupportedOfflineArtifactError('This saved Lookup document version is not supported.');
         }
-        const document = parseSavedLookupDocument(raw, { label: 'Saved Lookup artefact' });
+        parseCliLookupDocument(raw, { label: 'Saved Lookup artefact' });
         return Object.freeze({
             schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
             version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,
@@ -374,7 +405,7 @@ async function verifyOfflineArtifactCore(raw, options = {}) {
                 ciphertextBytes: null,
             }),
             limitations: Object.freeze([
-                `The saved ${document.mode} Lookup matches its versioned structural contract, but this document format has no embedded checksum or signature. Structural validity does not prove that its evidence is accurate, current, or unchanged since collection.`,
+                'The saved Lookup matches its versioned structural contract, but this document format has no embedded checksum or signature. Structural validity does not prove that its evidence is accurate, current, or unchanged since collection.',
             ]),
         });
     }
@@ -409,15 +440,13 @@ async function verifyManifestIdentity(artifactRaw, manifestRaw, entryId) {
         throw new TypeError('The requested investigation manifest entry was not found.');
     const artifactValue = parseJson(artifactRaw);
     const metadata = artifactMetadata(artifactValue);
-    const manifestVersion = artifactVersion(manifest);
-    const canonicalization = manifestVersion === 1 ? SORTED_JSON_V1 : SORTED_JSON_V2;
     const actualByteLength = inputBytes(artifactRaw);
     const expectedByteLength = Number(item.byteLength);
     const checks = Object.freeze({
         manifestIntegrity: 'verified',
         byteLength: actualByteLength === expectedByteLength ? 'verified' : 'mismatch',
         rawContentDigest: rawContentDigest(artifactRaw) === item.contentDigestSha256 ? 'verified' : 'mismatch',
-        canonicalDigest: rawContentDigest(canonicalArtifactJsonFor(artifactValue, canonicalization)) === item.canonicalDigestSha256 ? 'verified' : 'mismatch',
+        canonicalDigest: rawContentDigest(canonicalArtifactJsonFor(artifactValue, SORTED_JSON_V2)) === item.canonicalDigestSha256 ? 'verified' : 'mismatch',
         schema: metadata.schema === item.schema ? 'verified' : 'mismatch',
         version: metadata.version === item.version ? 'verified' : 'mismatch',
     });
@@ -437,7 +466,7 @@ async function verifyManifestIdentity(artifactRaw, manifestRaw, entryId) {
             : 'mismatch';
     return Object.freeze({
         state,
-        manifest: Object.freeze({ schema: INVESTIGATION_MANIFEST_SCHEMA, version: manifestVersion, entryId }),
+        manifest: Object.freeze({ schema: INVESTIGATION_MANIFEST_SCHEMA, version: INVESTIGATION_MANIFEST_VERSION, entryId }),
         checks,
         expectedByteLength,
         actualByteLength,

package/cli/bounded-json.mjs

@@ -1 +1 @@
-export { MAX_BOUNDED_JSON_DEPTH, MAX_BOUNDED_JSON_KEYS, MAX_BOUNDED_JSON_VALUES, parseBoundedJsonObject, scanBoundedJson, } from "../lib/bounded-json.mjs";
+export { MAX_BOUNDED_JSON_DEPTH, MAX_BOUNDED_JSON_KEYS, MAX_BOUNDED_JSON_VALUES, parseBoundedJson, parseBoundedJsonObject, scanBoundedJson, } from "../lib/bounded-json.mjs";

package/cli/bulk-checkpoint.mjs

@@ -2,11 +2,12 @@ import { createHash } from 'node:crypto';
 import { lstat } from 'node:fs/promises';
 import { recordOrNull } from "../lib/bounded-contract-normalizers.mjs";
 import { readBoundedRegularTextFile } from "../lib/bounded-file.mjs";
+import { scanBoundedJson } from "../lib/bounded-json.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { boundedCliInputError, CliUsageError } from "./errors.mjs";
 import { writePrivateFile } from "./output-file.mjs";
 export const CLI_BULK_CHECKPOINT_SCHEMA = 'whoisleuth.cli.bulk-checkpoint';
 export const CLI_BULK_CHECKPOINT_VERSION = 2;
-const SUPPORTED_BULK_CHECKPOINT_VERSIONS = new Set([1, CLI_BULK_CHECKPOINT_VERSION]);
 export const MAX_BULK_CHECKPOINT_BYTES = 16 * 1024 * 1024;
 const MAX_CHECKPOINT_JSON_DEPTH = 12;
 const MAX_CHECKPOINT_OBJECT_KEYS = 256;
@@ -19,8 +20,8 @@ function checkpointDigest(queries, deep) {
         .update(queries.join('\n'))
         .digest('hex');
 }
-function validTimestamp(value) {
-    return typeof value === 'string' && value.length <= 64 && Number.isFinite(Date.parse(value));
+function normalizedTimestamp(value) {
+    return normalizeExplicitIsoTimestamp(value);
 }
 function isBoundedCheckpointJson(value, depth = 0) {
     if (depth > MAX_CHECKPOINT_JSON_DEPTH)
@@ -53,7 +54,7 @@ function normalizeCompactResult(value) {
         return null;
     return result;
 }
-function normalizeCheckpointResult(value, queries, classifyQuery, version = CLI_BULK_CHECKPOINT_VERSION) {
+function normalizeCheckpointResult(value, queries, classifyQuery) {
     const item = recordOrNull(value);
     const index = item?.index;
     if (!Number.isSafeInteger(index) || Number(index) < 0 || Number(index) >= queries.length)
@@ -61,11 +62,9 @@ function normalizeCheckpointResult(value, queries, classifyQuery, version = CLI_
     const query = queries[Number(index)];
     if (typeof item?.query !== 'string' || item.query !== query)
         return null;
-    const observedAt = version >= 2
-        ? item.observedAt === null
-            ? null
-            : validTimestamp(item.observedAt) ? new Date(item.observedAt).toISOString() : undefined
-        : null;
+    const observedAt = item.observedAt === null
+        ? null
+        : normalizedTimestamp(item.observedAt) ?? undefined;
     if (observedAt === undefined)
         return null;
     if (item.ok === false) {
@@ -86,33 +85,37 @@ function parseBulkCheckpoint(text, options) {
     if (typeof text !== 'string' || Buffer.byteLength(text, 'utf8') > MAX_BULK_CHECKPOINT_BYTES) {
         throw new CliUsageError(`Bulk checkpoint input is limited to ${MAX_BULK_CHECKPOINT_BYTES} bytes.`);
     }
+    const normalized = text.replace(/^\uFEFF/u, '');
     let parsed;
     try {
-        parsed = JSON.parse(text.replace(/^\uFEFF/u, ''));
+        scanBoundedJson(normalized);
+        parsed = JSON.parse(normalized);
     }
     catch {
-        throw new CliUsageError('Bulk checkpoint must be valid JSON.');
+        throw new CliUsageError('Bulk checkpoint must be valid bounded JSON without duplicate keys.');
     }
     const document = recordOrNull(parsed);
     const expectedDigest = checkpointDigest(options.queries, options.deep);
     const version = typeof document?.version === 'number' && Number.isSafeInteger(document.version)
         ? document.version
         : 0;
-    if (document?.schema !== CLI_BULK_CHECKPOINT_SCHEMA || !SUPPORTED_BULK_CHECKPOINT_VERSIONS.has(version)) {
-        throw new CliUsageError(`Bulk checkpoint must use ${CLI_BULK_CHECKPOINT_SCHEMA} version 1 or ${CLI_BULK_CHECKPOINT_VERSION}.`);
+    if (document?.schema !== CLI_BULK_CHECKPOINT_SCHEMA || version !== CLI_BULK_CHECKPOINT_VERSION) {
+        throw new CliUsageError(`Bulk checkpoint must use ${CLI_BULK_CHECKPOINT_SCHEMA} version ${CLI_BULK_CHECKPOINT_VERSION}.`);
     }
     if (document.mode !== (options.deep ? 'deep' : 'fast')
         || document.inputDigestSha256 !== expectedDigest
         || document.queryCount !== options.queries.length) {
         throw new CliUsageError('Bulk checkpoint does not match the current input or scan mode.');
     }
-    if (!validTimestamp(document.startedAt) || !validTimestamp(document.updatedAt) || !Array.isArray(document.results)) {
+    const startedAt = normalizedTimestamp(document.startedAt);
+    const updatedAt = normalizedTimestamp(document.updatedAt);
+    if (!startedAt || !updatedAt || !Array.isArray(document.results)) {
         throw new CliUsageError('Bulk checkpoint metadata is invalid.');
     }
     const results = [];
     const seen = new Set();
     for (const candidate of document.results.slice(0, options.queries.length + 1)) {
-        const result = normalizeCheckpointResult(candidate, options.queries, options.classifyQuery, version);
+        const result = normalizeCheckpointResult(candidate, options.queries, options.classifyQuery);
         if (!result || seen.has(result.index))
             throw new CliUsageError('Bulk checkpoint contains an invalid or duplicate result.');
         seen.add(result.index);
@@ -124,8 +127,8 @@ function parseBulkCheckpoint(text, options) {
         mode: options.deep ? 'deep' : 'fast',
         inputDigestSha256: expectedDigest,
         queryCount: options.queries.length,
-        startedAt: new Date(document.startedAt).toISOString(),
-        updatedAt: new Date(document.updatedAt).toISOString(),
+        startedAt,
+        updatedAt,
         results: results.sort((left, right) => left.index - right.index),
     };
 }
@@ -164,14 +167,20 @@ async function createBulkCheckpointWriter(options) {
     const resumed = options.resume
         ? parseBulkCheckpoint(await readCheckpointFile(options.path), options)
         : null;
-    const startedAt = resumed?.startedAt || now();
+    const currentTimestamp = () => {
+        const timestamp = normalizedTimestamp(now());
+        if (!timestamp)
+            throw new CliUsageError('Bulk checkpoint collection time is invalid.');
+        return timestamp;
+    };
+    const startedAt = resumed?.startedAt || currentTimestamp();
     const results = new Map((resumed?.results || []).map((item) => [item.index, item]));
     let activeWrite = null;
     let dirty = false;
     let writeFailure = null;
     let created = resumed !== null;
     function document() {
-        const updatedAt = now();
+        const updatedAt = currentTimestamp();
         return {
             schema: CLI_BULK_CHECKPOINT_SCHEMA,
             version: CLI_BULK_CHECKPOINT_VERSION,
@@ -226,7 +235,11 @@ async function createBulkCheckpointWriter(options) {
     return Object.freeze({
         initialResults: Object.freeze([...results.values()].sort((left, right) => left.index - right.index)),
         record(result) {
-            const observedAt = validTimestamp(result.observedAt) ? new Date(result.observedAt).toISOString() : now();
+            const observedAt = normalizedTimestamp(result.observedAt) ?? normalizedTimestamp(now());
+            if (!observedAt) {
+                writeFailure ||= new CliUsageError('Bulk checkpoint collection time is invalid.');
+                return;
+            }
             const normalized = normalizeCheckpointResult({ ...result, observedAt }, options.queries, options.classifyQuery);
             if (!normalized) {
                 writeFailure ||= new CliUsageError('Bulk checkpoint result is not a bounded compact lookup result.');

package/cli/bulk.mjs

@@ -1,6 +1,8 @@
 import { Buffer } from 'node:buffer';
 import { abortable } from "../lib/abort.mjs";
+import { decodeBoundedUtf8 } from "../lib/bounded-file.mjs";
 import { CliUsageError } from "./arguments.mjs";
+import { hasUnsafeCliText } from "./errors.mjs";
 import { MAX_DEEP_BULK_QUERIES, MAX_FAST_BULK_QUERIES, } from "../lib/bulk-limits.mjs";
 const MAX_BULK_INPUT_BYTES = 1024 * 1024;
 async function readTextStreamBounded(stream, limit = MAX_BULK_INPUT_BYTES, signal) {
@@ -26,7 +28,12 @@ async function readTextStreamBounded(stream, limit = MAX_BULK_INPUT_BYTES, signa
     finally {
         signal?.removeEventListener('abort', abort);
     }
-    return Buffer.concat(chunks).toString('utf8');
+    try {
+        return decodeBoundedUtf8(Buffer.concat(chunks), 'Bulk input');
+    }
+    catch (cause) {
+        throw new CliUsageError(cause instanceof Error ? cause.message : 'Bulk input must contain valid UTF-8 text.');
+    }
 }
 function parseBulkQueries(text, { deep = false } = {}) {
     if (typeof text !== 'string')
@@ -43,7 +50,7 @@ function parseBulkQueries(text, { deep = false } = {}) {
         const query = line.trim();
         if (!query)
             continue;
-        if (query.length > 1024 || /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(query)) {
+        if (query.length > 1024 || hasUnsafeCliText(query)) {
             throw new CliUsageError('Bulk input contains an overlong query or unsupported control character.');
         }
         const key = query.toLowerCase();