@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/cli/artifact-validation/signed-review.mjs

@@ -1,14 +1,18 @@
 import { ACQUISITION_DECISIONS, ACQUISITION_MANUAL_CHECKS, ACQUISITION_DECISION_PACKET_SCHEMA, ACQUISITION_DECISION_PACKET_VERSION, } from "../../packages/investigation/acquisition-decision-packet.mjs";
 import { BULK_DOMAIN_COMPARISON_EXPORT_VERSION, BULK_DOMAIN_COMPARISON_SCHEMA, } from "../../packages/investigation/bulk-domain-comparison.mjs";
 import { BULK_MAIL_EXPOSURE_EXPORT_VERSION, BULK_MAIL_EXPOSURE_SCHEMA, MAX_BULK_MAIL_EXPOSURE_ROWS, } from "../../packages/investigation/bulk-mail-exposure.mjs";
-import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, } from "../../packages/investigation/bulk-review-export.mjs";
+import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS, } from "../../packages/contracts/investigation-portability.mjs";
+import { MAX_BULK_SESSION_ROWS, MAX_BULK_SESSION_SOURCES } from "../../packages/contracts/workspace-portability.mjs";
+import { BULK_SORT_KEYS } from "../../packages/workspace/bulk-sort.mjs";
+import { normalizeExplicitIsoTimestamp } from "../../packages/evidence/observation.mjs";
 import { LOOKUP_CLAIM_PASSPORT_SCHEMA, LOOKUP_CLAIM_PASSPORT_TARGET_TYPES, LOOKUP_CLAIM_PASSPORT_VERSION, MAX_LOOKUP_CLAIM_PASSPORT_LIMITATIONS, MAX_LOOKUP_CLAIM_PASSPORT_REQUIREMENTS, } from "../../packages/investigation/lookup-claim-passport.mjs";
 import { LOOKUP_CLAIM_IDS, LOOKUP_CLAIM_READINESS_VERSION, LOOKUP_CLAIM_REQUIREMENT_IDS, } from "../../packages/investigation/lookup-claim-readiness.mjs";
 import { normalizeDomainControlManifestDocument } from "../../packages/evidence/domain-control-runtime.mjs";
-import { DOMAIN_CHANGE_PACKET_SCHEMA, DOMAIN_CHANGE_PACKET_VERSION } from "../../lib/domain-change-packet.mjs";
+import { DOMAIN_CHANGE_PACKET_SCHEMA, DOMAIN_CHANGE_PACKET_REVIEW_VERSIONS, } from "../../lib/domain-change-packet.mjs";
+import { DOMAIN_CHANGE_REVIEW_SCHEMA } from "../../lib/domain-change-review.mjs";
 import { DOMAIN_CONTROL_MANIFEST_SCHEMA } from "../../packages/contracts/domain-control-manifest.mjs";
-import { INVESTIGATION_MANIFEST_SCHEMA, INVESTIGATION_MANIFEST_VERSION, MAX_INVESTIGATION_MANIFEST_ARTIFACTS, MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES, } from "../investigation-manifest.mjs";
-import { array, boolean, domain, digest, enumeration, exact, fail, integer, iso, optionalText, sameValues, strings, text, validateIntegrity, } from "./structure-primitives.mjs";
+import { INVESTIGATION_MANIFEST_SCHEMA, validateInvestigationManifest, } from "../investigation-manifest.mjs";
+import { array, boolean, domain, enumeration, exact, fail, integer, iso, optionalText, sameValues, strings, text, validateIntegrity, } from "./structure-primitives.mjs";
 const CLAIM_PASSPORT_SOURCE_STATES = ['complete', 'not_found', 'partial', 'skipped', 'unavailable', 'unknown', 'unsupported'];
 const COMPARISON_STATES = ['conflicting', 'different', 'equal', 'missing', 'not_recorded', 'unavailable'];
 const SOURCE_STATES = ['complete', 'error', 'not_found', 'not_recorded', 'partial', 'skipped', 'unavailable', 'unsupported'];
@@ -209,11 +213,17 @@ function validateDomainComparison(value) {
     strings(comparison.limitations, 'Domain comparison limitations', 12, 600);
     validateIntegrity(root.integrity, 'Domain comparison integrity', root.version, BULK_DOMAIN_COMPARISON_EXPORT_VERSION);
 }
-function validateSourceCoverage(value, label) {
-    const source = exact(value, ['source', 'state'], label);
+function validateNullableObservationTime(value, label) {
+    if (value !== null && normalizeExplicitIsoTimestamp(value) !== value)
+        fail(label);
+}
+function validateSourceCoverage(value, label, observedTime = false) {
+    const source = exact(value, ['source', 'state', ...(observedTime ? ['observedAt'] : [])], label);
     if (typeof source.source !== 'string' || !/^[a-z][a-z0-9_-]{0,39}$/u.test(source.source))
         fail(label);
     enumeration(source.state, SOURCE_STATES.filter((state) => state !== 'not_recorded'), label);
+    if (observedTime)
+        validateNullableObservationTime(source.observedAt, `${label} observedAt`);
 }
 function validateProfileContext(value, label) {
     const context = exact(value, ['sourceState', 'activeProfileId', 'profileUpdatedAt', 'limitation'], label);
@@ -281,29 +291,40 @@ function validateBulkView(value, label) {
     text(view.caseDispositionFilter, label, 60, true);
     enumeration(view.reviewStateFilter, ['', 'unreviewed', 'reviewing', 'reviewed', 'deferred'], label);
     text(view.groupBy, label, 60, true);
-    enumeration(view.sortKey, ['domain', 'availability', 'risk', 'opportunity', 'activity', 'registrar', 'mutation'], label);
+    enumeration(view.sortKey, BULK_SORT_KEYS, label);
     if (view.sortDirection !== 1 && view.sortDirection !== -1)
         fail(label);
 }
 function validateBulkReviewManifest(value) {
     const root = exact(value, ['schema', 'version', 'generatedAt', 'observedAt', 'lookupProfile', 'selection', 'view', 'rows', 'limitations', 'integrity'], 'Bulk review manifest');
+    const version = SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS.find((candidate) => candidate === root.version);
+    if (version === undefined)
+        fail('Bulk review manifest version');
+    const sourceTimes = version === BULK_REVIEW_MANIFEST_VERSION;
+    const maximumRows = sourceTimes ? MAX_BULK_SESSION_ROWS : 2_000;
+    const maximumSources = sourceTimes ? MAX_BULK_SESSION_SOURCES : 12;
     iso(root.generatedAt, 'Bulk review manifest generatedAt');
-    iso(root.observedAt, 'Bulk review manifest observedAt');
+    if (sourceTimes)
+        validateNullableObservationTime(root.observedAt, 'Bulk review manifest observedAt');
+    else
+        iso(root.observedAt, 'Bulk review manifest observedAt');
     enumeration(root.lookupProfile, ['deep', 'fast'], 'Bulk review manifest lookup profile');
     const selection = exact(root.selection, ['count', 'domains'], 'Bulk review manifest selection');
-    const domains = strings(selection.domains, 'Bulk review manifest selected domains', 2_000, 253);
+    const domains = strings(selection.domains, 'Bulk review manifest selected domains', maximumRows, 253);
     domains.forEach((item) => domain(item, 'Bulk review manifest selected domain'));
-    if (integer(selection.count, 'Bulk review manifest selection count', 0, 2_000) !== domains.length)
+    if (integer(selection.count, 'Bulk review manifest selection count', 0, maximumRows) !== domains.length)
         fail('Bulk review manifest selection');
     validateBulkView(root.view, 'Bulk review manifest view');
-    const rows = array(root.rows, 'Bulk review manifest rows', 2_000);
+    const rows = array(root.rows, 'Bulk review manifest rows', maximumRows);
     for (const [index, candidate] of rows.entries()) {
-        const row = exact(candidate, ['domain', 'reviewState', 'resultState', 'scanDepth', 'sourceCoverage', 'profileContext'], `Bulk review manifest row ${index + 1}`);
+        const row = exact(candidate, ['domain', 'reviewState', 'resultState', 'scanDepth', ...(sourceTimes ? ['observedAt'] : []), 'sourceCoverage', 'profileContext'], `Bulk review manifest row ${index + 1}`);
         domain(row.domain, 'Bulk review manifest row domain');
         enumeration(row.reviewState, ['unreviewed', 'reviewing', 'reviewed', 'deferred'], 'Bulk review manifest review state');
         enumeration(row.resultState, ['complete', 'error'], 'Bulk review manifest result state');
         enumeration(row.scanDepth, ['deep', 'fast'], 'Bulk review manifest scan depth');
-        array(row.sourceCoverage, 'Bulk review manifest source coverage', 12).forEach((item, sourceIndex) => validateSourceCoverage(item, `Bulk review manifest source ${sourceIndex + 1}`));
+        if (sourceTimes)
+            validateNullableObservationTime(row.observedAt, 'Bulk review manifest row observedAt');
+        array(row.sourceCoverage, 'Bulk review manifest source coverage', maximumSources).forEach((item, sourceIndex) => validateSourceCoverage(item, `Bulk review manifest source ${sourceIndex + 1}`, sourceTimes));
         validateProfileContext(row.profileContext, 'Bulk review manifest profile context');
         if (domains[index] !== row.domain)
             fail('Bulk review manifest selection');
@@ -311,59 +332,49 @@ function validateBulkReviewManifest(value) {
     if (rows.length !== domains.length)
         fail('Bulk review manifest selection');
     strings(root.limitations, 'Bulk review manifest limitations', 8, 600);
-    validateIntegrity(root.integrity, 'Bulk review manifest integrity', root.version, BULK_REVIEW_MANIFEST_VERSION);
+    validateIntegrity(root.integrity, 'Bulk review manifest integrity', root.version, version);
 }
-function validateInvestigationManifest(value) {
-    const root = exact(value, ['schema', 'version', 'generatedAt', 'application', 'workflow', 'configuration', 'artifacts', 'steps', 'summary', 'limitations', 'integrity'], 'Investigation manifest');
-    iso(root.generatedAt, 'Investigation manifest generatedAt');
-    const application = exact(root.application, ['name', 'version'], 'Investigation manifest application');
-    if (application.name !== 'WHOISleuth CLI' || typeof application.version !== 'string'
-        || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u.test(application.version))
-        fail('Investigation manifest application');
-    text(root.workflow, 'Investigation manifest workflow', 160);
-    const configuration = exact(root.configuration, ['digestSha256'], 'Investigation manifest configuration');
-    if (configuration.digestSha256 !== null)
-        digest(configuration.digestSha256, 'Investigation manifest configuration');
-    const artifacts = array(root.artifacts, 'Investigation manifest artifacts', MAX_INVESTIGATION_MANIFEST_ARTIFACTS, 1);
-    const steps = array(root.steps, 'Investigation manifest steps', MAX_INVESTIGATION_MANIFEST_ARTIFACTS, 1);
-    let totalBytes = 0;
-    for (const [index, candidate] of artifacts.entries()) {
-        const item = exact(candidate, ['sequence', 'id', 'schema', 'version', 'byteLength', 'contentDigestSha256', 'canonicalDigestSha256'], `Investigation manifest artifact ${index + 1}`);
-        if (integer(item.sequence, 'Investigation manifest artifact sequence', 1, artifacts.length) !== index + 1
-            || item.id !== `artifact-${index + 1}`)
-            fail('Investigation manifest artifact order');
-        if (item.schema !== null)
-            text(item.schema, 'Investigation manifest artifact schema', 160);
-        if (item.version !== null)
-            integer(item.version, 'Investigation manifest artifact version', 1, 1_000);
-        totalBytes += integer(item.byteLength, 'Investigation manifest artifact bytes', 1, 15 * 1024 * 1024);
-        digest(item.contentDigestSha256, 'Investigation manifest content digest');
-        digest(item.canonicalDigestSha256, 'Investigation manifest canonical digest');
-        const step = exact(steps[index], ['sequence', 'artifactId', 'contentDigestSha256'], `Investigation manifest step ${index + 1}`);
-        if (step.sequence !== item.sequence || step.artifactId !== item.id || step.contentDigestSha256 !== item.contentDigestSha256)
-            fail('Investigation manifest step linkage');
-    }
-    const summary = exact(root.summary, ['artifactCount', 'totalBytes'], 'Investigation manifest summary');
-    if (integer(summary.artifactCount, 'Investigation manifest artifact count', 1, MAX_INVESTIGATION_MANIFEST_ARTIFACTS) !== artifacts.length
-        || integer(summary.totalBytes, 'Investigation manifest total bytes', 1, MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES) !== totalBytes)
-        fail('Investigation manifest summary');
-    strings(root.limitations, 'Investigation manifest limitations', 8, 600);
-    validateIntegrity(root.integrity, 'Investigation manifest integrity', root.version, INVESTIGATION_MANIFEST_VERSION);
+function validateSourceObservations(value, label) {
+    const names = new Set();
+    return array(value, label, 16).map((candidate) => {
+        const source = exact(candidate, ['label', 'source', 'state', 'observedAt'], label);
+        const name = text(source.label, `${label} label`, 120).toLowerCase();
+        if (names.has(name))
+            fail(`${label} duplicate label`);
+        names.add(name);
+        text(source.source, `${label} source`, 240);
+        enumeration(source.state, ['observed', 'partial', 'unavailable'], `${label} state`);
+        iso(source.observedAt, `${label} observedAt`);
+        return source;
+    });
 }
-function validateReviewMatrix(value, label) {
+function validateReviewMatrix(value, label, sources) {
     for (const [rowIndex, candidate] of array(value, label, 500).entries()) {
         const row = exact(candidate, ['owner', 'type', 'state', 'observations'], `${label} row ${rowIndex + 1}`);
         text(row.owner, `${label} owner`, 253);
         enumeration(row.type, DNS_TYPES, `${label} type`);
         const observations = array(row.observations, `${label} observations`, 16);
+        if (sources && observations.length !== sources.length)
+            fail(`${label} source coverage`);
         let complete = 0;
         const signatures = new Set();
+        const names = new Set();
         for (const observationCandidate of observations) {
-            const observation = exact(observationCandidate, ['label', 'source', 'state', 'values', 'ttlRange'], `${label} observation`);
+            const observation = exact(observationCandidate, ['label', 'source', 'state', 'values', 'ttlRange', ...(sources ? ['observedAt'] : [])], `${label} observation`);
             text(observation.label, `${label} observation label`, 120);
             text(observation.source, `${label} observation source`, 240);
             const state = enumeration(observation.state, ['observed', 'partial', 'unavailable'], `${label} observation state`);
             const values = strings(observation.values, `${label} observation values`, 500, 16_384);
+            if (sources) {
+                const name = String(observation.label).toLowerCase();
+                if (names.has(name))
+                    fail(`${label} duplicate observation`);
+                names.add(name);
+                const source = sources.find((item) => item.label === observation.label);
+                if (!source || ['label', 'source', 'state', 'observedAt'].some((key) => observation[key] !== source[key]))
+                    fail(`${label} source provenance`);
+                iso(observation.observedAt, `${label} observation time`);
+            }
             if (state === 'observed') {
                 complete += 1;
                 signatures.add(JSON.stringify(values));
@@ -381,15 +392,17 @@ function validateReviewMatrix(value, label) {
             fail(`${label} state`);
     }
 }
-function validateDomainChangeReview(value, label) {
-    const review = exact(value, ['schema', 'version', 'generatedAt', 'domain', 'state', 'authoritativeRecordMatrix', 'resolverDivergenceMatrix', 'dnssecAutomation', 'acmeDependencies', 'certificate', 'services', 'hsts', 'gate', 'limitations'], label);
-    if (review.schema !== 'whoisleuth.domain-change.review' || review.version !== 1)
+function validateDomainChangeReview(value, label, version) {
+    const retainedTimes = version >= 2;
+    const review = exact(value, ['schema', 'version', 'generatedAt', 'domain', 'state', 'authoritativeRecordMatrix', 'resolverDivergenceMatrix', 'dnssecAutomation', 'acmeDependencies', 'certificate', 'services', 'hsts', 'gate', 'limitations', ...(retainedTimes ? ['sourceObservations'] : [])], label);
+    if (review.schema !== DOMAIN_CHANGE_REVIEW_SCHEMA || review.version !== version)
         fail(label);
     iso(review.generatedAt, `${label} generatedAt`);
     domain(review.domain, `${label} domain`);
     enumeration(review.state, ['ready', 'review'], `${label} state`);
-    validateReviewMatrix(review.authoritativeRecordMatrix, `${label} authority matrix`);
-    validateReviewMatrix(review.resolverDivergenceMatrix, `${label} resolver matrix`);
+    const sources = retainedTimes ? exact(review.sourceObservations, ['authorities', 'resolvers'], `${label} source observations`) : null;
+    validateReviewMatrix(review.authoritativeRecordMatrix, `${label} authority matrix`, sources ? validateSourceObservations(sources.authorities, `${label} authority sources`) : undefined);
+    validateReviewMatrix(review.resolverDivergenceMatrix, `${label} resolver matrix`, sources ? validateSourceObservations(sources.resolvers, `${label} resolver sources`) : undefined);
     const automation = exact(review.dnssecAutomation, ['state', 'cdsObserved', 'cdnskeyObserved', 'csyncObserved', 'conflictingTypes', 'detail'], `${label} DNSSEC automation`);
     enumeration(automation.state, ['not_observed', 'conflict', 'partial', 'review_ready'], `${label} DNSSEC automation`);
     boolean(automation.cdsObserved, `${label} CDS observed`);
@@ -405,8 +418,13 @@ function validateDomainChangeReview(value, label) {
         optionalText(dependency.provider, `${label} ACME provider`, 120);
         enumeration(dependency.state, ['confirmed', 'partial', 'unknown'], `${label} ACME state`);
     }
-    const certificate = exact(review.certificate, ['state', 'continuity', 'findings'], `${label} certificate`);
+    const certificate = exact(review.certificate, ['state', 'continuity', 'findings', ...(retainedTimes ? ['observedAt'] : [])], `${label} certificate`);
     enumeration(certificate.state, ['not_supplied', 'observed', 'partial', 'unavailable'], `${label} certificate state`);
+    if (retainedTimes) {
+        iso(certificate.observedAt, `${label} certificate observedAt`, true);
+        if ((certificate.state === 'not_supplied') !== (certificate.observedAt === null))
+            fail(`${label} certificate observation time`);
+    }
     enumeration(certificate.continuity, ['unknown', 'retained', 'changes'], `${label} certificate continuity`);
     strings(certificate.findings, `${label} certificate findings`, 8, 600);
     for (const candidate of array(review.services, `${label} services`, 1_000)) {
@@ -501,21 +519,43 @@ function expectedDomainChangeSummary(before, after) {
     const beforeRows = rows(before);
     const afterRows = rows(after);
     const keys = [...new Set([...beforeRows.keys(), ...afterRows.keys()])].sort();
-    return keys.slice(0, 500).flatMap((key) => {
-        const left = beforeRows.get(key);
-        const right = afterRows.get(key);
-        const values = (row) => [...new Set((row?.observations ?? [])
-                .flatMap((observation) => observation.values))].sort();
-        const beforeValues = values(left);
-        const afterValues = values(right);
-        if (sameValues(beforeValues, afterValues))
-            return [];
+    const collectionComplete = (review) => {
+        const row = (review.authoritativeRecordMatrix[0]);
+        const observations = row?.observations ?? [];
+        return observations.length >= 2 && observations.every((item) => item.state === 'observed');
+    };
+    const rowEvidence = (review, row) => {
+        if (!row)
+            return { state: collectionComplete(review) ? 'complete' : 'unavailable', values: [] };
+        const observations = row.observations;
+        if (observations.some((item) => item.state !== 'observed'))
+            return { state: 'partial', values: [] };
+        if (row.state === 'different')
+            return { state: 'inconsistent', values: [] };
+        if (row.state !== 'aligned')
+            return { state: 'insufficient', values: [] };
+        return { state: 'complete', values: [...new Set(observations.flatMap((item) => item.values))].sort() };
+    };
+    const changed = [];
+    for (const key of keys.slice(0, 500)) {
+        const left = rowEvidence(before, beforeRows.get(key));
+        const right = rowEvidence(after, afterRows.get(key));
         const [owner, type] = key.split('\u0000');
-        return [{ owner: owner ?? '', type: type ?? '', beforeValues, afterValues }];
-    });
+        if (left.state !== 'complete' || right.state !== 'complete') {
+            continue;
+        }
+        else if (!sameValues(left.values, right.values)) {
+            changed.push({ owner: owner ?? '', type: type ?? '', beforeValues: left.values, afterValues: right.values });
+        }
+    }
+    return changed;
 }
 function validateDomainChangePacket(value) {
     const root = exact(value, ['schema', 'version', 'generatedAt', 'domain', 'reference', 'state', 'gate', 'summary', 'evidence', 'limitations', 'integrity'], 'Domain change packet');
+    const version = integer(root.version, 'Domain change packet version', 1, 1_000);
+    const reviewVersion = DOMAIN_CHANGE_PACKET_REVIEW_VERSIONS[version];
+    if (reviewVersion === undefined)
+        fail('Domain change packet version');
     iso(root.generatedAt, 'Domain change packet generatedAt');
     domain(root.domain, 'Domain change packet domain');
     text(root.reference, 'Domain change packet reference', 200);
@@ -538,8 +578,8 @@ function validateDomainChangePacket(value) {
     enumeration(summary.postChangeState, ['ready', 'review'], 'Domain change packet post-change state');
     enumeration(summary.assuranceState, ['incomplete', 'needs_review', 'ready'], 'Domain change packet assurance state');
     const evidence = exact(root.evidence, ['preChange', 'postChange', 'assurance'], 'Domain change packet evidence');
-    const pre = validateDomainChangeReview(evidence.preChange, 'Domain change packet pre-change review');
-    const post = validateDomainChangeReview(evidence.postChange, 'Domain change packet post-change review');
+    const pre = validateDomainChangeReview(evidence.preChange, 'Domain change packet pre-change review', reviewVersion);
+    const post = validateDomainChangeReview(evidence.postChange, 'Domain change packet post-change review', reviewVersion);
     const assurance = validatePlannedAssurance(evidence.assurance, 'Domain change packet assurance');
     const assuranceResult = assurance.result;
     if (pre.generatedAt !== root.generatedAt || post.generatedAt !== root.generatedAt || assurance.generatedAt !== root.generatedAt
@@ -566,7 +606,7 @@ function validateDomainChangePacket(value) {
     }))
         fail('Domain change packet summary');
     strings(root.limitations, 'Domain change packet limitations', 8, 600);
-    validateIntegrity(root.integrity, 'Domain change packet integrity', root.version, DOMAIN_CHANGE_PACKET_VERSION);
+    validateIntegrity(root.integrity, 'Domain change packet integrity', root.version, version);
 }
 export function validateSignedDigestArtifactStructure(schema, value) {
     if (value.schema !== schema)

package/cli/artifact-validation/structure-primitives.mjs

@@ -1,105 +1 @@
-const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
-const DIGEST_RE = /^sha256:[a-f0-9]{64}$/u;
-const DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
-export const HEX_DIGEST_RE = /^[a-f0-9]{64}$/u;
-export const SEMANTIC_VERSION_RE = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
-export function fail(label) {
-    throw new TypeError(`${label} has an unsupported or malformed structure.`);
-}
-export function record(value, label) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        fail(label);
-    return value;
-}
-export function exact(value, keys, label) {
-    const source = record(value, label);
-    const actual = Object.keys(source);
-    if (actual.length !== keys.length || actual.some((key) => !keys.includes(key)))
-        fail(label);
-    return source;
-}
-export function exactOptional(value, required, optional, label) {
-    const source = record(value, label);
-    const actual = Object.keys(source);
-    if (required.some((key) => !actual.includes(key))
-        || actual.some((key) => !required.includes(key) && !optional.includes(key)))
-        fail(label);
-    return source;
-}
-export function text(value, label, maximum = 2_000, allowEmpty = false) {
-    if (typeof value !== 'string' || value.length > maximum || CONTROL_RE.test(value) || (!allowEmpty && !value))
-        fail(label);
-    return value;
-}
-export function optionalText(value, label, maximum = 2_000) {
-    if (value !== null)
-        text(value, label, maximum);
-}
-export function iso(value, label, nullable = false) {
-    if (nullable && value === null)
-        return;
-    const candidate = text(value, label, 64);
-    const parsed = Date.parse(candidate);
-    if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== candidate)
-        fail(label);
-}
-export function integer(value, label, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) {
-    if (!Number.isSafeInteger(value) || Number(value) < minimum || Number(value) > maximum)
-        fail(label);
-    return Number(value);
-}
-export function boolean(value, label) {
-    if (typeof value !== 'boolean')
-        fail(label);
-}
-export function enumeration(value, allowed, label) {
-    if (typeof value !== 'string' || !allowed.includes(value))
-        fail(label);
-    return value;
-}
-export function array(value, label, maximum, minimum = 0) {
-    if (!Array.isArray(value) || value.length < minimum || value.length > maximum)
-        fail(label);
-    return value;
-}
-export function strings(value, label, maximum, textMaximum = 2_000) {
-    const values = array(value, label, maximum);
-    for (const item of values)
-        text(item, label, textMaximum);
-    return values;
-}
-export function digest(value, label) {
-    if (typeof value !== 'string' || !DIGEST_RE.test(value))
-        fail(label);
-}
-export function sameValues(left, right) {
-    return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-export function domain(value, label) {
-    if (typeof value !== 'string' || !DOMAIN_RE.test(value))
-        fail(label);
-}
-export function absoluteUrl(value, label, protocols) {
-    const candidate = text(value, label, 2_048);
-    try {
-        const parsed = new URL(candidate);
-        if (!protocols.includes(parsed.protocol) || parsed.username || parsed.password || parsed.search || parsed.hash)
-            fail(label);
-        return parsed;
-    }
-    catch {
-        return fail(label);
-    }
-}
-export function nullableRecord(value, label) {
-    if (value !== null)
-        record(value, label);
-}
-export function validateIntegrity(value, label, version, currentVersion) {
-    if (version !== currentVersion)
-        fail(label);
-    const integrity = exact(value, ['algorithm', 'canonicalization', 'digestSha256'], label);
-    if (integrity.algorithm !== 'SHA-256' || integrity.canonicalization !== 'sorted-json-v2')
-        fail(label);
-    digest(integrity.digestSha256, label);
-}
+export * from "../../packages/evidence/artifact-structure.mjs";