@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/packages/workspace/workspace-archive-crypto.mjs

@@ -2,13 +2,13 @@
 // This protects a downloaded file while it is locked. It does not encrypt the
 // active IndexedDB workspace or defend an unlocked page from same-origin code.
 import { WORKSPACE_ARCHIVE_SCHEMA, WORKSPACE_ARCHIVE_VERSION, SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS, isSupportedWorkspaceArchiveVersion, readWorkspaceArchive, } from "./workspace-archive.mjs";
-import { parseBoundedJson } from "../../lib/bounded-json.mjs";
+import { boundedJsonLimitsForBytes, parseBoundedJson } from "../../lib/bounded-json.mjs";
 import { ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA, ENCRYPTED_WORKSPACE_ARCHIVE_VERSION, MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES, MAX_WORKSPACE_ARCHIVE_BYTES, MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES, MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS, WORKSPACE_ARCHIVE_PBKDF2_ITERATIONS, } from "../contracts/case-portability.mjs";
 import { assertWorkspaceInputGraph } from "./hostile-input.mjs";
+import { AES_KEY_BITS, arrayBuffer, assertPassphrase, cryptoProvider, deriveArchiveKey } from "../evidence/passphrase-encryption.mjs";
 export { ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA, ENCRYPTED_WORKSPACE_ARCHIVE_VERSION, MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES, MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES, MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS, WORKSPACE_ARCHIVE_PBKDF2_ITERATIONS, };
 const SALT_BYTES = 16;
 const IV_BYTES = 12;
-const AES_KEY_BITS = 256;
 const AES_GCM_TAG_BITS = 128;
 const MAX_CIPHERTEXT_BASE64URL_CHARACTERS = Math.ceil((MAX_WORKSPACE_ARCHIVE_BYTES + AES_GCM_TAG_BITS / 8) * 4 / 3);
 const BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
@@ -25,25 +25,6 @@ function hasExactKeys(value, expected) {
     const keys = Object.keys(value);
     return keys.length === expected.length && keys.every((key) => expected.includes(key));
 }
-function arrayBuffer(bytes) {
-    return bytes.slice().buffer;
-}
-function assertPassphrase(passphrase) {
-    if (typeof passphrase !== 'string') {
-        throw new Error(`Use a backup passphrase with at least ${MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS} characters.`);
-    }
-    if (passphrase.length > MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES) {
-        throw new Error('Backup passphrases are limited to 1024 UTF-8 bytes.');
-    }
-    if (Array.from(passphrase).length < MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS) {
-        throw new Error(`Use a backup passphrase with at least ${MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS} characters.`);
-    }
-    const bytes = encoder.encode(passphrase);
-    if (bytes.byteLength > MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES) {
-        throw new Error('Backup passphrases are limited to 1024 UTF-8 bytes.');
-    }
-    return bytes;
-}
 function base64url(bytes) {
     let encoded = '';
     for (let index = 0; index < bytes.length; index += 3) {
@@ -112,7 +93,7 @@ function validTimestamp(value) {
     return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value;
 }
 function validateEnvelope(raw) {
-    assertWorkspaceInputGraph(raw, 'Encrypted workspace archive');
+    assertWorkspaceInputGraph(raw, 'Encrypted workspace archive', { maximumBytes: MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES });
     const value = record(raw);
     if (!value || value.schema !== ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA) {
         throw new Error('This file is not an encrypted WHOISleuth workspace archive.');
@@ -197,26 +178,6 @@ function validateEnvelope(raw) {
         ciphertext,
     };
 }
-function cryptoProvider(provider = globalThis.crypto) {
-    if (!provider
-        || typeof provider.getRandomValues !== 'function'
-        || typeof provider.subtle?.importKey !== 'function'
-        || typeof provider.subtle?.deriveKey !== 'function'
-        || typeof provider.subtle?.encrypt !== 'function'
-        || typeof provider.subtle?.decrypt !== 'function') {
-        throw new Error('Encrypted workspace archives are unavailable in this browser.');
-    }
-    return provider;
-}
-async function deriveArchiveKey(provider, passphraseBytes, salt, usages) {
-    const material = await provider.subtle.importKey('raw', arrayBuffer(passphraseBytes), 'PBKDF2', false, ['deriveKey']);
-    return provider.subtle.deriveKey({
-        name: 'PBKDF2',
-        hash: 'SHA-256',
-        salt: arrayBuffer(salt),
-        iterations: WORKSPACE_ARCHIVE_PBKDF2_ITERATIONS,
-    }, material, { name: 'AES-GCM', length: AES_KEY_BITS }, false, usages);
-}
 export function isEncryptedWorkspaceArchive(raw) {
     return record(raw)?.schema === ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA;
 }
@@ -227,15 +188,19 @@ export function inspectEncryptedWorkspaceArchive(raw) {
 }
 /** Encrypt one already-built workspace archive using browser-native Web Crypto. */
 export async function encryptWorkspaceArchive(archive, passphrase, provider) {
-    await readWorkspaceArchive(archive);
-    const archiveVersion = record(archive)?.version;
-    if (!isSupportedWorkspaceArchiveVersion(archiveVersion)) {
-        throw new Error('The workspace archive declares an unsupported content contract.');
-    }
+    assertWorkspaceInputGraph(archive, 'Workspace archive', { maximumBytes: MAX_WORKSPACE_ARCHIVE_BYTES });
     const plaintext = JSON.stringify(archive);
     const plaintextBytes = encoder.encode(plaintext);
     if (plaintextBytes.byteLength > MAX_WORKSPACE_ARCHIVE_BYTES) {
-        throw new Error('Workspace archives are limited to 10 MiB. Export smaller collections separately before trying again.');
+        throw new Error(`Workspace archives are limited to ${MAX_WORKSPACE_ARCHIVE_BYTES / 1024 / 1024} MiB. Export smaller collections separately before trying again.`);
+    }
+    // Validation and encryption consume the same snapshot, including when the
+    // caller changes the original object while checksum verification is pending.
+    const snapshot = JSON.parse(plaintext);
+    await readWorkspaceArchive(snapshot);
+    const archiveVersion = record(snapshot)?.version;
+    if (!isSupportedWorkspaceArchiveVersion(archiveVersion)) {
+        throw new Error('The workspace archive declares an unsupported content contract.');
     }
     const crypto = cryptoProvider(provider);
     const passphraseBytes = assertPassphrase(passphrase);
@@ -278,30 +243,45 @@ export async function encryptWorkspaceArchive(archive, passphrase, provider) {
 }
 /** Decrypt and parse one encrypted archive. The ordinary archive reader remains authoritative. */
 export async function decryptWorkspaceArchive(raw, passphrase, provider) {
+    return (await decryptWorkspaceArchiveWithMetadata(raw, passphrase, provider)).archive;
+}
+/** Authenticate one envelope and return its inner JSON with verified byte metadata. */
+export async function decryptWorkspaceArchiveWithMetadata(raw, passphrase, provider) {
     const { envelope, salt, iv, ciphertext } = validateEnvelope(raw);
     const crypto = cryptoProvider(provider);
     const passphraseBytes = assertPassphrase(passphrase);
     const { ciphertext: _ciphertext, ...metadata } = envelope;
     try {
-        const key = await deriveArchiveKey(crypto, passphraseBytes, salt, ['decrypt']);
-        const plaintext = await crypto.subtle.decrypt({
-            name: 'AES-GCM',
-            iv: arrayBuffer(iv),
-            additionalData: arrayBuffer(encoder.encode(canonicalMetadata(metadata))),
-            tagLength: AES_GCM_TAG_BITS,
-        }, key, arrayBuffer(ciphertext));
+        let plaintext;
+        try {
+            const key = await deriveArchiveKey(crypto, passphraseBytes, salt, ['decrypt']);
+            plaintext = await crypto.subtle.decrypt({
+                name: 'AES-GCM',
+                iv: arrayBuffer(iv),
+                additionalData: arrayBuffer(encoder.encode(canonicalMetadata(metadata))),
+                tagLength: AES_GCM_TAG_BITS,
+            }, key, arrayBuffer(ciphertext));
+        }
+        catch {
+            // Authentication failure cannot distinguish a wrong key from tampering.
+            throw new Error('The backup passphrase is incorrect or the encrypted file is corrupted.');
+        }
         if (plaintext.byteLength > MAX_WORKSPACE_ARCHIVE_BYTES) {
             throw new Error('The decrypted workspace archive exceeds its byte limit.');
         }
-        return parseBoundedJson(decoder.decode(plaintext), {
+        let json;
+        try {
+            json = decoder.decode(plaintext);
+        }
+        catch {
+            throw new Error('The backup decrypted, but its contents are not valid UTF-8.');
+        }
+        const archive = parseBoundedJson(json, {
             label: 'Decrypted workspace archive',
             maximumBytes: MAX_WORKSPACE_ARCHIVE_BYTES,
+            limits: boundedJsonLimitsForBytes(MAX_WORKSPACE_ARCHIVE_BYTES),
         });
-    }
-    catch (cause) {
-        if (cause instanceof Error && cause.message === 'The decrypted workspace archive exceeds its byte limit.')
-            throw cause;
-        throw new Error('The backup passphrase is incorrect or the encrypted file is corrupted.');
+        return { archive, ciphertextBytes: ciphertext.byteLength };
     }
     finally {
         passphraseBytes.fill(0);

package/packages/workspace/workspace-archive.mjs

@@ -18,6 +18,8 @@ import { buildAnalystReviewStateExport, emptyAnalystReviewStateStore, mergeAnaly
 import { isSupportedWorkspaceArchiveVersion, MAX_WORKSPACE_ARCHIVE_BYTES, MAX_WORKSPACE_ARCHIVE_SECTION_BYTES, MAX_WORKSPACE_ARCHIVE_SECTIONS, serialiseWorkspaceArchiveSection, SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS, WORKSPACE_ARCHIVE_CASE_SECTION, WORKSPACE_ARCHIVE_SCHEMA, WORKSPACE_ARCHIVE_SECTION_IDS, PUBLIC_WORKSPACE_ARCHIVE_SECTION_IDS, PUBLIC_WORKSPACE_ARCHIVE_VERSION, WORKSPACE_ARCHIVE_VERSION, WORKSPACE_SETTINGS_COMPATIBILITY, WORKSPACE_SETTINGS_SCHEMA, WORKSPACE_SETTINGS_VERSION, } from "../contracts/case-portability.mjs";
 import { ANALYST_REVIEW_STATE_COMPATIBILITY } from "../contracts/analyst-review-state.mjs";
 import { WORKSPACE_PORTABILITY_ARCHIVE_SECTION_REFERENCES } from "../contracts/workspace-portability.mjs";
+import { CASE_VIEWS_COMPATIBILITY } from "../contracts/case-views.mjs";
+import { emptyCaseViewsStore, mergeCaseViews, normalizeCaseViewsStore } from "./case-views.mjs";
 export { isSupportedWorkspaceArchiveVersion, MAX_WORKSPACE_ARCHIVE_BYTES, MAX_WORKSPACE_ARCHIVE_SECTION_BYTES, MAX_WORKSPACE_ARCHIVE_SECTIONS, SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS, WORKSPACE_ARCHIVE_CASE_SECTION, WORKSPACE_ARCHIVE_SCHEMA, WORKSPACE_ARCHIVE_SECTION_IDS, PUBLIC_WORKSPACE_ARCHIVE_SECTION_IDS, PUBLIC_WORKSPACE_ARCHIVE_VERSION, WORKSPACE_ARCHIVE_VERSION, WORKSPACE_SETTINGS_SCHEMA, WORKSPACE_SETTINGS_VERSION, };
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
 const CHECKSUM_RE = /^sha256:[a-f0-9]{64}$/;
@@ -111,6 +113,7 @@ function workspaceArchiveSections(input, now) {
         investigationTemplates: buildInvestigationTemplateExport(input.investigationTemplates, now),
         bulkReview: buildBulkReviewExport(input.bulkReview),
         analystReviewState: buildAnalystReviewStateExport(input.analystReviewState),
+        caseViews: normalizeCaseViewsStore(input.caseViews),
         settings: settingsDocument(input),
     };
 }
@@ -150,7 +153,7 @@ const SECTION_DEFINITIONS = [
         merge: (local, data) => {
             const result = mergeCases(local.cases, data);
             const bounded = enforceStoreBudget(result.cases);
-            return { ...result, cases: bounded.cases, pruned: bounded.pruned };
+            return { ...result, document: bounded.cases, pruned: bounded.pruned };
         },
     },
     {
@@ -158,7 +161,7 @@ const SECTION_DEFINITIONS = [
         count: (data) => arrayCount(data, 'campaigns'),
         merge: (local, data) => {
             const result = mergeCampaigns(local.campaigns, data);
-            return { ...result, campaigns: assertCampaignStoreBudget(result.campaigns).campaigns };
+            return { ...result, document: assertCampaignStoreBudget(result.campaigns).campaigns };
         },
     },
     {
@@ -166,7 +169,8 @@ const SECTION_DEFINITIONS = [
         count: (data) => arrayCount(data, 'profiles'),
         merge: (local, data, now) => {
             const result = mergeBrandProfiles(local.brandProfiles, data, { nowIso: now });
-            return { ...result, profiles: assertBrandProfileStoreBudget(result.profiles).profiles };
+            const profiles = assertBrandProfileStoreBudget(result.profiles).profiles;
+            return { ...result, profiles, document: profiles };
         },
     },
     {
@@ -174,7 +178,7 @@ const SECTION_DEFINITIONS = [
         count: (data) => objectCount(data, 'watchlists'),
         merge: (local, data) => {
             const result = mergeWatchlistStores(local.watchlists, data);
-            return { ...result, watchlists: assertWatchlistStoreBudget(result.watchlists).watchlists };
+            return { ...result, document: assertWatchlistStoreBudget(result.watchlists).watchlists };
         },
     },
     {
@@ -182,7 +186,7 @@ const SECTION_DEFINITIONS = [
         count: (data) => arrayCount(data, 'entries'),
         merge: (local, data) => {
             const result = mergeShortlistStores(local.shortlist, data);
-            return { ...result, entries: assertShortlistStoreBudget(result.entries).entries };
+            return { ...result, document: assertShortlistStoreBudget(result.entries).entries };
         },
     },
     {
@@ -190,14 +194,17 @@ const SECTION_DEFINITIONS = [
         count: (data) => arrayCount(data, 'rules'),
         merge: (local, data) => {
             const result = mergeDetectionRules(local.detectionRules, data);
-            return { ...result, rules: assertDetectionRuleStoreBudget(result.rules).rules };
+            return { ...result, document: assertDetectionRuleStoreBudget(result.rules).rules };
         },
     },
     {
         ...sectionContract('relationshipObservations'),
         label: 'Retained relationship observations',
         count: (data) => arrayCount(data, 'observations'),
-        merge: (local, data) => mergeRelationshipObservations(local.relationshipObservations, data),
+        merge: (local, data) => {
+            const result = mergeRelationshipObservations(local.relationshipObservations, data);
+            return { ...result, document: result.observations };
+        },
     },
     {
         ...sectionContract('bulkSessions'),
@@ -205,27 +212,36 @@ const SECTION_DEFINITIONS = [
         count: (data) => arrayCount(data, 'sessions'),
         merge: (local, data) => {
             const result = mergeBulkSessions(local.bulkSessions, data);
-            enforceBulkSessionStoreBudget(result.sessions);
-            return result;
+            const bounded = enforceBulkSessionStoreBudget(result.sessions);
+            return { ...result, document: bounded.store.sessions };
         },
     },
     {
         ...sectionContract('websiteSnapshots'),
         label: 'Website profile snapshots',
         count: (data) => arrayCount(data, 'snapshots'),
-        merge: (local, data) => mergeWebsiteSnapshots(local.websiteSnapshots, data),
+        merge: (local, data) => {
+            const result = mergeWebsiteSnapshots(local.websiteSnapshots, data);
+            return { ...result, document: result.snapshots };
+        },
     },
     {
         ...sectionContract('investigationTemplates'),
         label: 'Investigation templates',
         count: (data) => arrayCount(data, 'templates'),
-        merge: (local, data) => mergeInvestigationTemplates(local.investigationTemplates, data),
+        merge: (local, data) => {
+            const result = mergeInvestigationTemplates(local.investigationTemplates, data);
+            return { ...result, document: result.templates };
+        },
     },
     {
         ...sectionContract('bulkReview'),
         label: 'Bulk saved views and review queue',
         count: (data) => arrayCount(data, 'presets') + arrayCount(data, 'rows'),
-        merge: (local, data) => mergeBulkReviewStores(local.bulkReview, data),
+        merge: (local, data) => {
+            const result = mergeBulkReviewStores(local.bulkReview, data);
+            return { ...result, document: result.store };
+        },
     },
     {
         id: 'analystReviewState',
@@ -234,7 +250,19 @@ const SECTION_DEFINITIONS = [
         version: ANALYST_REVIEW_STATE_COMPATIBILITY.currentVersion,
         supportedVersions: ANALYST_REVIEW_STATE_COMPATIBILITY.supportedVersions,
         count: (data) => arrayCount(data, 'records'),
-        merge: (local, data) => mergeAnalystReviewStateStores(local.analystReviewState, data),
+        merge: (local, data) => {
+            const result = mergeAnalystReviewStateStores(local.analystReviewState, data);
+            return { ...result, document: result.store };
+        },
+    },
+    {
+        id: 'caseViews', label: 'Saved Case views', schema: compatibilitySchema(CASE_VIEWS_COMPATIBILITY),
+        version: CASE_VIEWS_COMPATIBILITY.currentVersion, supportedVersions: CASE_VIEWS_COMPATIBILITY.supportedVersions,
+        count: (data) => arrayCount(data, 'views'),
+        merge: (local, data) => {
+            const result = mergeCaseViews(local.caseViews, data);
+            return { ...result, document: result.store };
+        },
     },
     {
         id: 'settings', label: 'Workspace settings', schema: compatibilitySchema(WORKSPACE_SETTINGS_COMPATIBILITY),
@@ -245,6 +273,19 @@ const SECTION_DEFINITIONS = [
     },
 ];
 const DEFINITION_BY_ID = new Map(SECTION_DEFINITIONS.map((definition) => [definition.id, definition]));
+/** Apply previously verified data sections through the same owners as preview. */
+export function mergeReadyWorkspaceArchiveData(localInput, sections, generatedAt) {
+    if (sections.length > MAX_WORKSPACE_ARCHIVE_SECTIONS || new Set(sections.map(section => section.id)).size !== sections.length) {
+        throw new Error('Workspace data sections exceed their count or contain duplicate identities.');
+    }
+    const local = normalizedInput(localInput);
+    return sections.map(section => {
+        const definition = DEFINITION_BY_ID.get(section.id);
+        if (section.status !== 'ready' || !definition?.merge)
+            throw new Error('Only verified, supported workspace data sections can be merged.');
+        return { ...definition.merge(local, section.data, generatedAt), id: section.id };
+    });
+}
 const SECTION_ORDER = new Map(WORKSPACE_ARCHIVE_SECTION_IDS.map((id, index) => [id, index]));
 function canonicalSectionOrder(left, right) {
     const leftIndex = SECTION_ORDER.get(left.id) ?? Number.MAX_SAFE_INTEGER;
@@ -266,6 +307,7 @@ function normalizedInput(input) {
         investigationTemplates: Array.isArray(value.investigationTemplates) ? value.investigationTemplates : [],
         bulkReview: record(value.bulkReview) || {},
         analystReviewState: record(value.analystReviewState) || emptyAnalystReviewStateStore(),
+        caseViews: value.caseViews ?? emptyCaseViewsStore(),
         settings: record(value.settings) || {},
     };
 }
@@ -273,7 +315,7 @@ function ensureArchiveBudget(value) {
     const serialized = serialize(value);
     const bytes = byteLength(serialized);
     if (bytes > MAX_WORKSPACE_ARCHIVE_BYTES) {
-        throw new Error('Workspace archives are limited to 10 MiB. Export smaller collections separately before trying again.');
+        throw new Error(`Workspace archives are limited to ${MAX_WORKSPACE_ARCHIVE_BYTES / 1024 / 1024} MiB. Export smaller collections separately before trying again.`);
     }
     return { serialized, bytes };
 }
@@ -290,7 +332,7 @@ export async function buildWorkspaceArchive(input, options = {}) {
         const data = sections[definition.id];
         const sectionBytes = byteLength(serialize(data));
         if (sectionBytes > MAX_WORKSPACE_ARCHIVE_SECTION_BYTES) {
-            throw new Error(`${definition.label} exceeds the 5 MiB workspace archive section limit.`);
+            throw new Error(`${definition.label} exceeds the ${MAX_WORKSPACE_ARCHIVE_SECTION_BYTES / 1024 / 1024} MiB workspace archive section limit.`);
         }
         const recordCount = definition.count(data);
         manifestSections.push({
@@ -338,8 +380,11 @@ function manifestEntry(raw) {
 }
 /** Validate structure, section byte counts, and checksums without applying data. */
 export async function readWorkspaceArchive(raw, options = {}) {
-    assertWorkspaceInputGraph(raw, 'Workspace archive');
-    const value = record(raw);
+    assertWorkspaceInputGraph(raw, 'Workspace archive', { maximumBytes: MAX_WORKSPACE_ARCHIVE_BYTES });
+    // Snapshot before the first asynchronous digest: caller-owned data must not
+    // change between its checksum, contract checks and eventual import preview.
+    const { serialized, bytes } = ensureArchiveBudget(raw);
+    const value = record(JSON.parse(serialized));
     if (!value || value.schema !== WORKSPACE_ARCHIVE_SCHEMA) {
         throw new Error('This file is not a WHOISleuth workspace archive.');
     }
@@ -355,11 +400,10 @@ export async function readWorkspaceArchive(raw, options = {}) {
     const sourceVersion = value.version;
     const expectedSectionIds = sourceVersion === PUBLIC_WORKSPACE_ARCHIVE_VERSION
         ? PUBLIC_WORKSPACE_ARCHIVE_SECTION_IDS
-        : WORKSPACE_ARCHIVE_SECTION_IDS;
+        : sourceVersion < 9 ? WORKSPACE_ARCHIVE_SECTION_IDS.filter(id => id !== 'caseViews') : WORKSPACE_ARCHIVE_SECTION_IDS;
     const generatedAt = timestamp(value.generatedAt);
     if (!generatedAt)
         throw new Error('The workspace archive generation time is invalid.');
-    const { bytes } = ensureArchiveBudget(value);
     assertExactKeys(value, WORKSPACE_ARCHIVE_ROOT_KEYS, `version ${sourceVersion} envelope`);
     const manifest = record(value.manifest);
     const sectionValues = record(value.sections);
@@ -423,7 +467,7 @@ export async function readWorkspaceArchive(raw, options = {}) {
         else if (definition.count(data) !== entry.recordCount) {
             throw new Error(`${entry.id} does not match its manifest record count.`);
         }
-        sections.push({ ...entry, label: definition?.label || entry.id, status, reason, data: clone(data) });
+        sections.push({ ...entry, label: definition?.label || entry.id, status, reason, data });
         totalRecords += entry.recordCount;
     }
     if (Object.keys(sectionValues).some((id) => !seen.has(id))) {
@@ -450,6 +494,15 @@ export async function readWorkspaceArchive(raw, options = {}) {
             data,
         });
     }
+    if (sourceVersion < 9) {
+        const data = emptyCaseViewsStore();
+        sections.push({
+            id: 'caseViews', label: 'Saved Case views', schema: compatibilitySchema(CASE_VIEWS_COMPATIBILITY),
+            version: CASE_VIEWS_COMPATIBILITY.currentVersion, recordCount: 0,
+            bytes: byteLength(serialize(data)), checksum: await checksum(data, options.cryptoProvider), status: 'ready',
+            reason: 'This archive predates saved Case views. Import supplies an empty section and does not remove existing views.', data,
+        });
+    }
     sections.sort(canonicalSectionOrder);
     return {
         schema: WORKSPACE_ARCHIVE_SCHEMA,
@@ -491,9 +544,20 @@ function settingsPreview(data, local, mergedProfiles) {
         || (skipped === 0 && activeProfileId !== retainedActiveProfileId));
     return { added: 0, updated, skipped, reason, settings: { activeProfileId, theme } };
 }
+/** Retain one verified snapshot; each read or preview returns an independent copy. */
+export async function prepareWorkspaceArchive(raw, options = {}) {
+    const archive = await readWorkspaceArchive(raw, options);
+    return Object.freeze({
+        read: () => clone(archive),
+        preview: (localInput, selection = {}) => previewVerifiedWorkspaceArchive(clone(archive), localInput, selection),
+    });
+}
 /** Preview section-specific non-destructive merge outcomes without writing. */
 export async function previewWorkspaceArchive(raw, localInput, options = {}) {
-    const archive = await readWorkspaceArchive(raw, options);
+    // A one-shot preview owns the reader result directly; retained readers copy it.
+    return previewVerifiedWorkspaceArchive(await readWorkspaceArchive(raw, options), localInput, options);
+}
+function previewVerifiedWorkspaceArchive(archive, localInput, options) {
     const local = normalizedInput(localInput);
     const results = [];
     let mergedProfiles = local.brandProfiles;
@@ -528,6 +592,7 @@ export async function previewWorkspaceArchive(raw, localInput, options = {}) {
                 skipped: result.skipped ?? 0,
                 pruned: result.pruned ?? 0,
                 brandProfileReferencesOmitted: result.brandProfileReferencesOmitted ?? 0,
+                authoredHistoryOmitted: result.authoredHistoryOmitted ?? 0,
                 selected,
                 normalizedSettings: result.settings || null,
             });
@@ -567,6 +632,7 @@ export async function previewWorkspaceArchive(raw, localInput, options = {}) {
                 skipped: dependentSection.recordCount,
                 pruned: 0,
                 brandProfileReferencesOmitted: 0,
+                authoredHistoryOmitted: 0,
                 selected: false,
                 normalizedSettings: dependentId === 'settings' ? null : dependentSection.normalizedSettings ?? null,
             };

package/third-party-notices.txt

@@ -2,9 +2,9 @@ WHOISleuth CLI third-party production dependency notices
 
 Generated deterministically from package-lock.json and the installed production
 dependency packages. Do not edit this file directly; run npm run licenses:update.
-The inventory is the exact transitive closure of the packaged CLI runtime dependencies.
+The inventory is the exact transitive closure of the packaged runtime dependencies.
 
-Package count: 27
+Package count: 28
 
 ================================================================================
 @peculiar/asn1-cms@2.9.4
@@ -384,6 +384,33 @@ Redistributions in binary form must reproduce the above copyright notice, this l
 THIS IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS,
 EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ================================================================================
+fflate@0.8.3
+Relationship: direct production dependency
+Declared licence: MIT
+Licence source: LICENSE
+
+MIT License
+
+Copyright (c) 2026 Arjun Barrett
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+================================================================================
 maxmind@5.0.7
 Relationship: direct production dependency
 Declared licence: MIT

package/cli/evidence-command-arguments.mjs

@@ -1,156 +0,0 @@
-import { CliUsageError } from "./errors.mjs";
-export function parseInspectArchiveArguments(argv) {
-    let source = null;
-    let passphraseSource = null;
-    let search = null;
-    let reveal = false;
-    let requireMatch = false;
-    let expectedContentDigest = null;
-    let output = 'terminal';
-    let quiet = false;
-    let color = true;
-    for (let index = 0; index < argv.length; index++) {
-        const argument = argv[index];
-        if (argument === undefined)
-            break;
-        if (argument === '--json') {
-            if (output !== 'terminal')
-                throw new CliUsageError('--json may be supplied only once.');
-            output = 'json';
-        }
-        else if (argument === '--passphrase-file') {
-            if (passphraseSource !== null)
-                throw new CliUsageError('--passphrase-file may be supplied only once.');
-            const value = argv[++index];
-            if (!value || value.startsWith('-'))
-                throw new CliUsageError('--passphrase-file requires one bounded UTF-8 file.');
-            passphraseSource = value;
-        }
-        else if (argument === '--search') {
-            if (search !== null)
-                throw new CliUsageError('--search may be supplied only once.');
-            const value = argv[++index];
-            if (!value || value.startsWith('-'))
-                throw new CliUsageError('--search requires one exact bounded value.');
-            search = value;
-        }
-        else if (argument === '--reveal') {
-            if (reveal)
-                throw new CliUsageError('--reveal may be supplied only once.');
-            reveal = true;
-        }
-        else if (argument === '--require-match') {
-            if (requireMatch)
-                throw new CliUsageError('--require-match may be supplied only once.');
-            requireMatch = true;
-        }
-        else if (argument === '--expect-content-digest') {
-            if (expectedContentDigest !== null)
-                throw new CliUsageError('--expect-content-digest may be supplied only once.');
-            const value = argv[++index];
-            if (!value || !/^sha256:[a-f0-9]{64}$/u.test(value)) {
-                throw new CliUsageError('--expect-content-digest requires sha256 followed by 64 lowercase hexadecimal characters.');
-            }
-            expectedContentDigest = value;
-        }
-        else if (argument === '--quiet')
-            quiet = true;
-        else if (argument === '--no-color')
-            color = false;
-        else if (argument.startsWith('-'))
-            throw new CliUsageError(`Unknown option "${argument}".`);
-        else if (source === null)
-            source = argument;
-        else
-            throw new CliUsageError('inspect-archive accepts one optional JSON file. Otherwise pipe one archive on stdin.');
-    }
-    if (reveal && search === null)
-        throw new CliUsageError('--reveal requires --search.');
-    if (requireMatch && search === null)
-        throw new CliUsageError('--require-match requires --search.');
-    if (quiet && output !== 'terminal')
-        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return {
-        action: 'inspect-archive',
-        source,
-        passphraseSource,
-        search,
-        reveal,
-        requireMatch,
-        expectedContentDigest,
-        output,
-        quiet,
-        color,
-    };
-}
-export function parseSignArtifactArguments(argv) {
-    let source = null;
-    let privateKeySource = null;
-    for (let index = 0; index < argv.length; index++) {
-        const argument = argv[index];
-        if (argument === undefined)
-            break;
-        if (argument === '--private-key-file') {
-            if (privateKeySource !== null)
-                throw new CliUsageError('--private-key-file may be supplied only once.');
-            const value = argv[++index];
-            if (!value || value.startsWith('-'))
-                throw new CliUsageError('--private-key-file requires one bounded PEM file.');
-            privateKeySource = value;
-        }
-        else if (argument.startsWith('-'))
-            throw new CliUsageError(`Unknown option "${argument}".`);
-        else if (source === null)
-            source = argument;
-        else
-            throw new CliUsageError('sign-artifact accepts one optional JSON file. Otherwise pipe one artefact on stdin.');
-    }
-    if (!privateKeySource)
-        throw new CliUsageError('sign-artifact requires --private-key-file.');
-    return { action: 'sign-artifact', source, privateKeySource };
-}
-export function parseVerifySignatureArguments(argv) {
-    let source = null;
-    let publicKeySource = null;
-    let output = 'terminal';
-    let quiet = false;
-    let color = true;
-    for (let index = 0; index < argv.length; index++) {
-        const argument = argv[index];
-        if (argument === undefined)
-            break;
-        if (argument === '--json') {
-            if (output !== 'terminal')
-                throw new CliUsageError('--json may be supplied only once.');
-            output = 'json';
-        }
-        else if (argument === '--public-key-file') {
-            if (publicKeySource !== null)
-                throw new CliUsageError('--public-key-file may be supplied only once.');
-            const value = argv[++index];
-            if (!value || value.startsWith('-'))
-                throw new CliUsageError('--public-key-file requires one bounded PEM file.');
-            publicKeySource = value;
-        }
-        else if (argument === '--quiet')
-            quiet = true;
-        else if (argument === '--no-color')
-            color = false;
-        else if (argument.startsWith('-'))
-            throw new CliUsageError(`Unknown option "${argument}".`);
-        else if (source === null)
-            source = argument;
-        else
-            throw new CliUsageError('verify-signature accepts one optional JSON file. Otherwise pipe one package on stdin.');
-    }
-    if (quiet && output !== 'terminal')
-        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
-    return {
-        action: 'verify-signature',
-        source,
-        publicKeySource,
-        output,
-        quiet,
-        color,
-    };
-}