@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/cli/artifact-validation/signed-review.mjs

@@ -1,14 +1,18 @@
 import { ACQUISITION_DECISIONS, ACQUISITION_MANUAL_CHECKS, ACQUISITION_DECISION_PACKET_SCHEMA, ACQUISITION_DECISION_PACKET_VERSION, } from "../../packages/investigation/acquisition-decision-packet.mjs";
 import { BULK_DOMAIN_COMPARISON_EXPORT_VERSION, BULK_DOMAIN_COMPARISON_SCHEMA, } from "../../packages/investigation/bulk-domain-comparison.mjs";
 import { BULK_MAIL_EXPOSURE_EXPORT_VERSION, BULK_MAIL_EXPOSURE_SCHEMA, MAX_BULK_MAIL_EXPOSURE_ROWS, } from "../../packages/investigation/bulk-mail-exposure.mjs";
-import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, } from "../../packages/investigation/bulk-review-export.mjs";
+import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS, } from "../../packages/contracts/investigation-portability.mjs";
+import { MAX_BULK_SESSION_ROWS, MAX_BULK_SESSION_SOURCES } from "../../packages/contracts/workspace-portability.mjs";
+import { BULK_SORT_KEYS } from "../../packages/workspace/bulk-sort.mjs";
+import { normalizeExplicitIsoTimestamp } from "../../packages/evidence/observation.mjs";
 import { LOOKUP_CLAIM_PASSPORT_SCHEMA, LOOKUP_CLAIM_PASSPORT_TARGET_TYPES, LOOKUP_CLAIM_PASSPORT_VERSION, MAX_LOOKUP_CLAIM_PASSPORT_LIMITATIONS, MAX_LOOKUP_CLAIM_PASSPORT_REQUIREMENTS, } from "../../packages/investigation/lookup-claim-passport.mjs";
 import { LOOKUP_CLAIM_IDS, LOOKUP_CLAIM_READINESS_VERSION, LOOKUP_CLAIM_REQUIREMENT_IDS, } from "../../packages/investigation/lookup-claim-readiness.mjs";
 import { normalizeDomainControlManifestDocument } from "../../packages/evidence/domain-control-runtime.mjs";
-import { DOMAIN_CHANGE_PACKET_SCHEMA, DOMAIN_CHANGE_PACKET_VERSION, } from "../../lib/domain-change-packet.mjs";
+import { DOMAIN_CHANGE_PACKET_SCHEMA, DOMAIN_CHANGE_PACKET_REVIEW_VERSIONS, } from "../../lib/domain-change-packet.mjs";
+import { DOMAIN_CHANGE_REVIEW_SCHEMA } from "../../lib/domain-change-review.mjs";
 import { DOMAIN_CONTROL_MANIFEST_SCHEMA } from "../../packages/contracts/domain-control-manifest.mjs";
-import { INVESTIGATION_MANIFEST_SCHEMA, INVESTIGATION_MANIFEST_VERSION, MAX_INVESTIGATION_MANIFEST_ARTIFACTS, MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES, } from "../investigation-manifest.mjs";
-import { array, boolean, domain, digest, enumeration, exact, fail, integer, iso, optionalText, sameValues, strings, text, validateIntegrity, } from "./structure-primitives.mjs";
+import { INVESTIGATION_MANIFEST_SCHEMA, validateInvestigationManifest, } from "../investigation-manifest.mjs";
+import { array, boolean, domain, enumeration, exact, fail, integer, iso, optionalText, sameValues, strings, text, validateIntegrity, } from "./structure-primitives.mjs";
 const CLAIM_PASSPORT_SOURCE_STATES = ['complete', 'not_found', 'partial', 'skipped', 'unavailable', 'unknown', 'unsupported'];
 const COMPARISON_STATES = ['conflicting', 'different', 'equal', 'missing', 'not_recorded', 'unavailable'];
 const SOURCE_STATES = ['complete', 'error', 'not_found', 'not_recorded', 'partial', 'skipped', 'unavailable', 'unsupported'];
@@ -209,11 +213,17 @@ function validateDomainComparison(value) {
     strings(comparison.limitations, 'Domain comparison limitations', 12, 600);
     validateIntegrity(root.integrity, 'Domain comparison integrity', root.version, BULK_DOMAIN_COMPARISON_EXPORT_VERSION);
 }
-function validateSourceCoverage(value, label) {
-    const source = exact(value, ['source', 'state'], label);
+function validateNullableObservationTime(value, label) {
+    if (value !== null && normalizeExplicitIsoTimestamp(value) !== value)
+        fail(label);
+}
+function validateSourceCoverage(value, label, observedTime = false) {
+    const source = exact(value, ['source', 'state', ...(observedTime ? ['observedAt'] : [])], label);
     if (typeof source.source !== 'string' || !/^[a-z][a-z0-9_-]{0,39}$/u.test(source.source))
         fail(label);
     enumeration(source.state, SOURCE_STATES.filter((state) => state !== 'not_recorded'), label);
+    if (observedTime)
+        validateNullableObservationTime(source.observedAt, `${label} observedAt`);
 }
 function validateProfileContext(value, label) {
     const context = exact(value, ['sourceState', 'activeProfileId', 'profileUpdatedAt', 'limitation'], label);
@@ -281,29 +291,40 @@ function validateBulkView(value, label) {
     text(view.caseDispositionFilter, label, 60, true);
     enumeration(view.reviewStateFilter, ['', 'unreviewed', 'reviewing', 'reviewed', 'deferred'], label);
     text(view.groupBy, label, 60, true);
-    enumeration(view.sortKey, ['domain', 'availability', 'risk', 'opportunity', 'activity', 'registrar', 'mutation'], label);
+    enumeration(view.sortKey, BULK_SORT_KEYS, label);
     if (view.sortDirection !== 1 && view.sortDirection !== -1)
         fail(label);
 }
 function validateBulkReviewManifest(value) {
     const root = exact(value, ['schema', 'version', 'generatedAt', 'observedAt', 'lookupProfile', 'selection', 'view', 'rows', 'limitations', 'integrity'], 'Bulk review manifest');
+    const version = SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS.find((candidate) => candidate === root.version);
+    if (version === undefined)
+        fail('Bulk review manifest version');
+    const sourceTimes = version === BULK_REVIEW_MANIFEST_VERSION;
+    const maximumRows = sourceTimes ? MAX_BULK_SESSION_ROWS : 2_000;
+    const maximumSources = sourceTimes ? MAX_BULK_SESSION_SOURCES : 12;
     iso(root.generatedAt, 'Bulk review manifest generatedAt');
-    iso(root.observedAt, 'Bulk review manifest observedAt');
+    if (sourceTimes)
+        validateNullableObservationTime(root.observedAt, 'Bulk review manifest observedAt');
+    else
+        iso(root.observedAt, 'Bulk review manifest observedAt');
     enumeration(root.lookupProfile, ['deep', 'fast'], 'Bulk review manifest lookup profile');
     const selection = exact(root.selection, ['count', 'domains'], 'Bulk review manifest selection');
-    const domains = strings(selection.domains, 'Bulk review manifest selected domains', 2_000, 253);
+    const domains = strings(selection.domains, 'Bulk review manifest selected domains', maximumRows, 253);
     domains.forEach((item) => domain(item, 'Bulk review manifest selected domain'));
-    if (integer(selection.count, 'Bulk review manifest selection count', 0, 2_000) !== domains.length)
+    if (integer(selection.count, 'Bulk review manifest selection count', 0, maximumRows) !== domains.length)
         fail('Bulk review manifest selection');
     validateBulkView(root.view, 'Bulk review manifest view');
-    const rows = array(root.rows, 'Bulk review manifest rows', 2_000);
+    const rows = array(root.rows, 'Bulk review manifest rows', maximumRows);
     for (const [index, candidate] of rows.entries()) {
-        const row = exact(candidate, ['domain', 'reviewState', 'resultState', 'scanDepth', 'sourceCoverage', 'profileContext'], `Bulk review manifest row ${index + 1}`);
+        const row = exact(candidate, ['domain', 'reviewState', 'resultState', 'scanDepth', ...(sourceTimes ? ['observedAt'] : []), 'sourceCoverage', 'profileContext'], `Bulk review manifest row ${index + 1}`);
         domain(row.domain, 'Bulk review manifest row domain');
         enumeration(row.reviewState, ['unreviewed', 'reviewing', 'reviewed', 'deferred'], 'Bulk review manifest review state');
         enumeration(row.resultState, ['complete', 'error'], 'Bulk review manifest result state');
         enumeration(row.scanDepth, ['deep', 'fast'], 'Bulk review manifest scan depth');
-        array(row.sourceCoverage, 'Bulk review manifest source coverage', 12).forEach((item, sourceIndex) => validateSourceCoverage(item, `Bulk review manifest source ${sourceIndex + 1}`));
+        if (sourceTimes)
+            validateNullableObservationTime(row.observedAt, 'Bulk review manifest row observedAt');
+        array(row.sourceCoverage, 'Bulk review manifest source coverage', maximumSources).forEach((item, sourceIndex) => validateSourceCoverage(item, `Bulk review manifest source ${sourceIndex + 1}`, sourceTimes));
         validateProfileContext(row.profileContext, 'Bulk review manifest profile context');
         if (domains[index] !== row.domain)
             fail('Bulk review manifest selection');
@@ -311,59 +332,49 @@ function validateBulkReviewManifest(value) {
     if (rows.length !== domains.length)
         fail('Bulk review manifest selection');
     strings(root.limitations, 'Bulk review manifest limitations', 8, 600);
-    validateIntegrity(root.integrity, 'Bulk review manifest integrity', root.version, BULK_REVIEW_MANIFEST_VERSION);
+    validateIntegrity(root.integrity, 'Bulk review manifest integrity', root.version, version);
 }
-function validateInvestigationManifest(value) {
-    const root = exact(value, ['schema', 'version', 'generatedAt', 'application', 'workflow', 'configuration', 'artifacts', 'steps', 'summary', 'limitations', 'integrity'], 'Investigation manifest');
-    iso(root.generatedAt, 'Investigation manifest generatedAt');
-    const application = exact(root.application, ['name', 'version'], 'Investigation manifest application');
-    if (application.name !== 'WHOISleuth CLI' || typeof application.version !== 'string'
-        || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u.test(application.version))
-        fail('Investigation manifest application');
-    text(root.workflow, 'Investigation manifest workflow', 160);
-    const configuration = exact(root.configuration, ['digestSha256'], 'Investigation manifest configuration');
-    if (configuration.digestSha256 !== null)
-        digest(configuration.digestSha256, 'Investigation manifest configuration');
-    const artifacts = array(root.artifacts, 'Investigation manifest artifacts', MAX_INVESTIGATION_MANIFEST_ARTIFACTS, 1);
-    const steps = array(root.steps, 'Investigation manifest steps', MAX_INVESTIGATION_MANIFEST_ARTIFACTS, 1);
-    let totalBytes = 0;
-    for (const [index, candidate] of artifacts.entries()) {
-        const item = exact(candidate, ['sequence', 'id', 'schema', 'version', 'byteLength', 'contentDigestSha256', 'canonicalDigestSha256'], `Investigation manifest artifact ${index + 1}`);
-        if (integer(item.sequence, 'Investigation manifest artifact sequence', 1, artifacts.length) !== index + 1
-            || item.id !== `artifact-${index + 1}`)
-            fail('Investigation manifest artifact order');
-        if (item.schema !== null)
-            text(item.schema, 'Investigation manifest artifact schema', 160);
-        if (item.version !== null)
-            integer(item.version, 'Investigation manifest artifact version', 1, 1_000);
-        totalBytes += integer(item.byteLength, 'Investigation manifest artifact bytes', 1, 15 * 1024 * 1024);
-        digest(item.contentDigestSha256, 'Investigation manifest content digest');
-        digest(item.canonicalDigestSha256, 'Investigation manifest canonical digest');
-        const step = exact(steps[index], ['sequence', 'artifactId', 'contentDigestSha256'], `Investigation manifest step ${index + 1}`);
-        if (step.sequence !== item.sequence || step.artifactId !== item.id || step.contentDigestSha256 !== item.contentDigestSha256)
-            fail('Investigation manifest step linkage');
-    }
-    const summary = exact(root.summary, ['artifactCount', 'totalBytes'], 'Investigation manifest summary');
-    if (integer(summary.artifactCount, 'Investigation manifest artifact count', 1, MAX_INVESTIGATION_MANIFEST_ARTIFACTS) !== artifacts.length
-        || integer(summary.totalBytes, 'Investigation manifest total bytes', 1, MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES) !== totalBytes)
-        fail('Investigation manifest summary');
-    strings(root.limitations, 'Investigation manifest limitations', 8, 600);
-    validateIntegrity(root.integrity, 'Investigation manifest integrity', root.version, INVESTIGATION_MANIFEST_VERSION);
+function validateSourceObservations(value, label) {
+    const names = new Set();
+    return array(value, label, 16).map((candidate) => {
+        const source = exact(candidate, ['label', 'source', 'state', 'observedAt'], label);
+        const name = text(source.label, `${label} label`, 120).toLowerCase();
+        if (names.has(name))
+            fail(`${label} duplicate label`);
+        names.add(name);
+        text(source.source, `${label} source`, 240);
+        enumeration(source.state, ['observed', 'partial', 'unavailable'], `${label} state`);
+        iso(source.observedAt, `${label} observedAt`);
+        return source;
+    });
 }
-function validateReviewMatrix(value, label) {
+function validateReviewMatrix(value, label, sources) {
     for (const [rowIndex, candidate] of array(value, label, 500).entries()) {
         const row = exact(candidate, ['owner', 'type', 'state', 'observations'], `${label} row ${rowIndex + 1}`);
         text(row.owner, `${label} owner`, 253);
         enumeration(row.type, DNS_TYPES, `${label} type`);
         const observations = array(row.observations, `${label} observations`, 16);
+        if (sources && observations.length !== sources.length)
+            fail(`${label} source coverage`);
         let complete = 0;
         const signatures = new Set();
+        const names = new Set();
         for (const observationCandidate of observations) {
-            const observation = exact(observationCandidate, ['label', 'source', 'state', 'values', 'ttlRange'], `${label} observation`);
+            const observation = exact(observationCandidate, ['label', 'source', 'state', 'values', 'ttlRange', ...(sources ? ['observedAt'] : [])], `${label} observation`);
             text(observation.label, `${label} observation label`, 120);
             text(observation.source, `${label} observation source`, 240);
             const state = enumeration(observation.state, ['observed', 'partial', 'unavailable'], `${label} observation state`);
             const values = strings(observation.values, `${label} observation values`, 500, 16_384);
+            if (sources) {
+                const name = String(observation.label).toLowerCase();
+                if (names.has(name))
+                    fail(`${label} duplicate observation`);
+                names.add(name);
+                const source = sources.find((item) => item.label === observation.label);
+                if (!source || ['label', 'source', 'state', 'observedAt'].some((key) => observation[key] !== source[key]))
+                    fail(`${label} source provenance`);
+                iso(observation.observedAt, `${label} observation time`);
+            }
             if (state === 'observed') {
                 complete += 1;
                 signatures.add(JSON.stringify(values));
@@ -381,15 +392,17 @@ function validateReviewMatrix(value, label) {
             fail(`${label} state`);
     }
 }
-function validateDomainChangeReview(value, label) {
-    const review = exact(value, ['schema', 'version', 'generatedAt', 'domain', 'state', 'authoritativeRecordMatrix', 'resolverDivergenceMatrix', 'dnssecAutomation', 'acmeDependencies', 'certificate', 'services', 'hsts', 'gate', 'limitations'], label);
-    if (review.schema !== 'whoisleuth.domain-change.review' || review.version !== 1)
+function validateDomainChangeReview(value, label, version) {
+    const retainedTimes = version >= 2;
+    const review = exact(value, ['schema', 'version', 'generatedAt', 'domain', 'state', 'authoritativeRecordMatrix', 'resolverDivergenceMatrix', 'dnssecAutomation', 'acmeDependencies', 'certificate', 'services', 'hsts', 'gate', 'limitations', ...(retainedTimes ? ['sourceObservations'] : [])], label);
+    if (review.schema !== DOMAIN_CHANGE_REVIEW_SCHEMA || review.version !== version)
         fail(label);
     iso(review.generatedAt, `${label} generatedAt`);
     domain(review.domain, `${label} domain`);
     enumeration(review.state, ['ready', 'review'], `${label} state`);
-    validateReviewMatrix(review.authoritativeRecordMatrix, `${label} authority matrix`);
-    validateReviewMatrix(review.resolverDivergenceMatrix, `${label} resolver matrix`);
+    const sources = retainedTimes ? exact(review.sourceObservations, ['authorities', 'resolvers'], `${label} source observations`) : null;
+    validateReviewMatrix(review.authoritativeRecordMatrix, `${label} authority matrix`, sources ? validateSourceObservations(sources.authorities, `${label} authority sources`) : undefined);
+    validateReviewMatrix(review.resolverDivergenceMatrix, `${label} resolver matrix`, sources ? validateSourceObservations(sources.resolvers, `${label} resolver sources`) : undefined);
     const automation = exact(review.dnssecAutomation, ['state', 'cdsObserved', 'cdnskeyObserved', 'csyncObserved', 'conflictingTypes', 'detail'], `${label} DNSSEC automation`);
     enumeration(automation.state, ['not_observed', 'conflict', 'partial', 'review_ready'], `${label} DNSSEC automation`);
     boolean(automation.cdsObserved, `${label} CDS observed`);
@@ -405,8 +418,13 @@ function validateDomainChangeReview(value, label) {
         optionalText(dependency.provider, `${label} ACME provider`, 120);
         enumeration(dependency.state, ['confirmed', 'partial', 'unknown'], `${label} ACME state`);
     }
-    const certificate = exact(review.certificate, ['state', 'continuity', 'findings'], `${label} certificate`);
+    const certificate = exact(review.certificate, ['state', 'continuity', 'findings', ...(retainedTimes ? ['observedAt'] : [])], `${label} certificate`);
     enumeration(certificate.state, ['not_supplied', 'observed', 'partial', 'unavailable'], `${label} certificate state`);
+    if (retainedTimes) {
+        iso(certificate.observedAt, `${label} certificate observedAt`, true);
+        if ((certificate.state === 'not_supplied') !== (certificate.observedAt === null))
+            fail(`${label} certificate observation time`);
+    }
     enumeration(certificate.continuity, ['unknown', 'retained', 'changes'], `${label} certificate continuity`);
     strings(certificate.findings, `${label} certificate findings`, 8, 600);
     for (const candidate of array(review.services, `${label} services`, 1_000)) {
@@ -534,6 +552,10 @@ function expectedDomainChangeSummary(before, after) {
 }
 function validateDomainChangePacket(value) {
     const root = exact(value, ['schema', 'version', 'generatedAt', 'domain', 'reference', 'state', 'gate', 'summary', 'evidence', 'limitations', 'integrity'], 'Domain change packet');
+    const version = integer(root.version, 'Domain change packet version', 1, 1_000);
+    const reviewVersion = DOMAIN_CHANGE_PACKET_REVIEW_VERSIONS[version];
+    if (reviewVersion === undefined)
+        fail('Domain change packet version');
     iso(root.generatedAt, 'Domain change packet generatedAt');
     domain(root.domain, 'Domain change packet domain');
     text(root.reference, 'Domain change packet reference', 200);
@@ -556,8 +578,8 @@ function validateDomainChangePacket(value) {
     enumeration(summary.postChangeState, ['ready', 'review'], 'Domain change packet post-change state');
     enumeration(summary.assuranceState, ['incomplete', 'needs_review', 'ready'], 'Domain change packet assurance state');
     const evidence = exact(root.evidence, ['preChange', 'postChange', 'assurance'], 'Domain change packet evidence');
-    const pre = validateDomainChangeReview(evidence.preChange, 'Domain change packet pre-change review');
-    const post = validateDomainChangeReview(evidence.postChange, 'Domain change packet post-change review');
+    const pre = validateDomainChangeReview(evidence.preChange, 'Domain change packet pre-change review', reviewVersion);
+    const post = validateDomainChangeReview(evidence.postChange, 'Domain change packet post-change review', reviewVersion);
     const assurance = validatePlannedAssurance(evidence.assurance, 'Domain change packet assurance');
     const assuranceResult = assurance.result;
     if (pre.generatedAt !== root.generatedAt || post.generatedAt !== root.generatedAt || assurance.generatedAt !== root.generatedAt
@@ -584,7 +606,7 @@ function validateDomainChangePacket(value) {
     }))
         fail('Domain change packet summary');
     strings(root.limitations, 'Domain change packet limitations', 8, 600);
-    validateIntegrity(root.integrity, 'Domain change packet integrity', root.version, DOMAIN_CHANGE_PACKET_VERSION);
+    validateIntegrity(root.integrity, 'Domain change packet integrity', root.version, version);
 }
 export function validateSignedDigestArtifactStructure(schema, value) {
     if (value.schema !== schema)

package/cli/artifact-validation/structure-primitives.mjs

@@ -1,105 +1 @@
-const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
-const DIGEST_RE = /^sha256:[a-f0-9]{64}$/u;
-const DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
-export const HEX_DIGEST_RE = /^[a-f0-9]{64}$/u;
-export const SEMANTIC_VERSION_RE = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
-export function fail(label) {
-    throw new TypeError(`${label} has an unsupported or malformed structure.`);
-}
-export function record(value, label) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        fail(label);
-    return value;
-}
-export function exact(value, keys, label) {
-    const source = record(value, label);
-    const actual = Object.keys(source);
-    if (actual.length !== keys.length || actual.some((key) => !keys.includes(key)))
-        fail(label);
-    return source;
-}
-export function exactOptional(value, required, optional, label) {
-    const source = record(value, label);
-    const actual = Object.keys(source);
-    if (required.some((key) => !actual.includes(key))
-        || actual.some((key) => !required.includes(key) && !optional.includes(key)))
-        fail(label);
-    return source;
-}
-export function text(value, label, maximum = 2_000, allowEmpty = false) {
-    if (typeof value !== 'string' || value.length > maximum || CONTROL_RE.test(value) || (!allowEmpty && !value))
-        fail(label);
-    return value;
-}
-export function optionalText(value, label, maximum = 2_000) {
-    if (value !== null)
-        text(value, label, maximum);
-}
-export function iso(value, label, nullable = false) {
-    if (nullable && value === null)
-        return;
-    const candidate = text(value, label, 64);
-    const parsed = Date.parse(candidate);
-    if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== candidate)
-        fail(label);
-}
-export function integer(value, label, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) {
-    if (!Number.isSafeInteger(value) || Number(value) < minimum || Number(value) > maximum)
-        fail(label);
-    return Number(value);
-}
-export function boolean(value, label) {
-    if (typeof value !== 'boolean')
-        fail(label);
-}
-export function enumeration(value, allowed, label) {
-    if (typeof value !== 'string' || !allowed.includes(value))
-        fail(label);
-    return value;
-}
-export function array(value, label, maximum, minimum = 0) {
-    if (!Array.isArray(value) || value.length < minimum || value.length > maximum)
-        fail(label);
-    return value;
-}
-export function strings(value, label, maximum, textMaximum = 2_000) {
-    const values = array(value, label, maximum);
-    for (const item of values)
-        text(item, label, textMaximum);
-    return values;
-}
-export function digest(value, label) {
-    if (typeof value !== 'string' || !DIGEST_RE.test(value))
-        fail(label);
-}
-export function sameValues(left, right) {
-    return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-export function domain(value, label) {
-    if (typeof value !== 'string' || !DOMAIN_RE.test(value))
-        fail(label);
-}
-export function absoluteUrl(value, label, protocols) {
-    const candidate = text(value, label, 2_048);
-    try {
-        const parsed = new URL(candidate);
-        if (!protocols.includes(parsed.protocol) || parsed.username || parsed.password || parsed.search || parsed.hash)
-            fail(label);
-        return parsed;
-    }
-    catch {
-        return fail(label);
-    }
-}
-export function nullableRecord(value, label) {
-    if (value !== null)
-        record(value, label);
-}
-export function validateIntegrity(value, label, version, currentVersion) {
-    if (version !== currentVersion)
-        fail(label);
-    const integrity = exact(value, ['algorithm', 'canonicalization', 'digestSha256'], label);
-    if (integrity.algorithm !== 'SHA-256' || integrity.canonicalization !== 'sorted-json-v2')
-        fail(label);
-    digest(integrity.digestSha256, label);
-}
+export * from "../../packages/evidence/artifact-structure.mjs";

package/cli/artifact-verify.mjs

@@ -1,24 +1,25 @@
 import { Buffer } from 'node:buffer';
 import { createHash } from 'node:crypto';
-import { parseBoundedJsonObject } from "./bounded-json.mjs";
+import { readEditableCaseExport } from "../packages/cases/case-export-input.mjs";
+import { boundedJsonLimitsForBytes, parseBoundedJsonObject } from "./bounded-json.mjs";
 import { validateInvestigationCapsuleStructure, validateLookupEvidenceArtifactStructure, validateOfflineArtifactStructure, validateSignedDigestArtifactStructure, } from "./offline-artifact-validation.mjs";
 import { verifyCaseResponsePacketIntegrity, } from "../packages/cases/case-response-packet.mjs";
 import { CASE_PORTABILITY_VERIFIER_DISPATCH, CASE_RESPONSE_PACKET_VERSION, CASE_RESPONSE_PACKET_SCHEMA, CLI_CASE_PACK_VERSION, CLI_CASE_PACK_SCHEMA, } from "../packages/contracts/case-portability.mjs";
 import { ACQUISITION_DECISION_PACKET_SCHEMA, BULK_DOMAIN_COMPARISON_SCHEMA, BULK_MAIL_EXPOSURE_SCHEMA, BULK_REVIEW_MANIFEST_SCHEMA, LOOKUP_CLAIM_PASSPORT_SCHEMA, LOOKUP_CLAIM_PASSPORT_VERSION, SUPPORTED_ACQUISITION_DECISION_PACKET_VERSIONS, SUPPORTED_BULK_DOMAIN_COMPARISON_EXPORT_VERSIONS, SUPPORTED_BULK_MAIL_EXPOSURE_EXPORT_VERSIONS, SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS, } from "../packages/contracts/investigation-portability.mjs";
-import { decryptWorkspaceArchive, inspectEncryptedWorkspaceArchive, isEncryptedWorkspaceArchive, } from "../packages/workspace/workspace-archive-crypto.mjs";
-import { WORKSPACE_ARCHIVE_SCHEMA, previewWorkspaceArchive, readWorkspaceArchive, } from "../packages/workspace/workspace-archive.mjs";
+import { decryptWorkspaceArchiveWithMetadata, inspectEncryptedWorkspaceArchive, isEncryptedWorkspaceArchive, MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES, } from "../packages/workspace/workspace-archive-crypto.mjs";
+import { WORKSPACE_ARCHIVE_SCHEMA, prepareWorkspaceArchive, readWorkspaceArchive, } from "../packages/workspace/workspace-archive.mjs";
 import { canonicalArtifactJsonFor, resolveArtifactCanonicalization, sha256ArtifactDigestFor, SORTED_JSON_V2, } from "../packages/evidence/artifact-integrity.mjs";
 import { SAVED_LOOKUP_SCHEMA, SUPPORTED_SAVED_LOOKUP_SCHEMA_VERSIONS, parseCliLookupDocument, } from "./saved-lookup.mjs";
 import { DOMAIN_CONTROL_MANIFEST_SCHEMA, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
-import { DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, } from "../packages/contracts/domain-control-manifest.mjs";
-import { DOMAIN_CHANGE_PACKET_SCHEMA, DOMAIN_CHANGE_PACKET_VERSION, } from "../lib/domain-change-packet.mjs";
+import { DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, MAX_DOMAIN_CONTROL_MANIFEST_BYTES, } from "../packages/contracts/domain-control-manifest.mjs";
+import { DOMAIN_CHANGE_PACKET_SCHEMA, SUPPORTED_DOMAIN_CHANGE_PACKET_VERSIONS, } from "../lib/domain-change-packet.mjs";
 import { INVESTIGATION_CAPSULE_SCHEMA, SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS, verifyInvestigationCapsule, } from "../packages/investigation/investigation-capsule.mjs";
-import { INVESTIGATION_MANIFEST_SCHEMA, INVESTIGATION_MANIFEST_VERSION, } from "./investigation-manifest.mjs";
+import { INVESTIGATION_MANIFEST_SCHEMA, SUPPORTED_INVESTIGATION_MANIFEST_VERSIONS, } from "./investigation-manifest.mjs";
 import { verifyCliCasePack } from "./case-pack.mjs";
 import { LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES, LOOKUP_EVIDENCE_SCHEMA, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, } from "../lib/evidence-export.mjs";
 export const OFFLINE_ARTIFACT_VERIFICATION_SCHEMA = 'whoisleuth.offline-artifact-verification';
-export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 3;
-export const MAX_OFFLINE_ARTIFACT_BYTES = 15 * 1024 * 1024;
+export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 4;
+export const MAX_OFFLINE_ARTIFACT_BYTES = Math.max(MAX_DOMAIN_CONTROL_MANIFEST_BYTES, MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES);
 export const MAX_OFFLINE_PASSPHRASE_FILE_BYTES = 1024;
 export class UnsupportedOfflineArtifactError extends TypeError {
     code = 'unsupported_artifact';
@@ -41,8 +42,8 @@ const SIGNED_ARTIFACT_ROUTES = Object.freeze({
     [BULK_MAIL_EXPOSURE_SCHEMA]: currentCanonicalizationRoutes(SUPPORTED_BULK_MAIL_EXPOSURE_EXPORT_VERSIONS),
     [BULK_REVIEW_MANIFEST_SCHEMA]: currentCanonicalizationRoutes(SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS),
     [DOMAIN_CONTROL_MANIFEST_SCHEMA]: DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES,
-    [DOMAIN_CHANGE_PACKET_SCHEMA]: currentCanonicalizationRoutes([DOMAIN_CHANGE_PACKET_VERSION]),
-    [INVESTIGATION_MANIFEST_SCHEMA]: currentCanonicalizationRoutes([INVESTIGATION_MANIFEST_VERSION]),
+    [DOMAIN_CHANGE_PACKET_SCHEMA]: currentCanonicalizationRoutes(SUPPORTED_DOMAIN_CHANGE_PACKET_VERSIONS),
+    [INVESTIGATION_MANIFEST_SCHEMA]: currentCanonicalizationRoutes(SUPPORTED_INVESTIGATION_MANIFEST_VERSIONS),
 });
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
@@ -83,8 +84,16 @@ function rejectUnsupportedCasePortabilityVersion(label, version, currentVersion)
     }
     throw new UnsupportedOfflineArtifactError(`This ${label} version is malformed or unsupported; no data was changed.`);
 }
-function parseJson(raw) {
-    return parseBoundedJsonObject(raw, { maximumBytes: MAX_OFFLINE_ARTIFACT_BYTES });
+export function parseOfflineArtifactJson(raw) {
+    const value = parseBoundedJsonObject(raw, {
+        maximumBytes: MAX_OFFLINE_ARTIFACT_BYTES,
+        limits: boundedJsonLimitsForBytes(MAX_OFFLINE_ARTIFACT_BYTES),
+    });
+    if (value.schema !== WORKSPACE_ARCHIVE_SCHEMA && !isEncryptedWorkspaceArchive(value)
+        && Buffer.byteLength(raw, 'utf8') > MAX_DOMAIN_CONTROL_MANIFEST_BYTES) {
+        throw new TypeError(`Non-workspace artefacts are limited to ${MAX_DOMAIN_CONTROL_MANIFEST_BYTES} bytes.`);
+    }
+    return value;
 }
 export function hasVerifiedArtifactStructure(report) {
     return report.checks.structure === 'verified';
@@ -92,6 +101,7 @@ export function hasVerifiedArtifactStructure(report) {
 export function hasVerifiedApplicableIntegrity(report) {
     return report.checks.contentIntegrity === 'verified'
         && (report.checks.contentIntegrityScope === 'whole_artifact'
+            || report.checks.contentIntegrityScope === 'manifest_and_files'
             || report.checks.contentIntegrityScope === 'embedded_projections');
 }
 export function hasVerifiedWholeArtifactIntegrity(report) {
@@ -108,6 +118,9 @@ export function offlineArtifactSatisfiesAssurance(report, requirement) {
     return hasVerifiedWholeArtifactIntegrity(report);
 }
 export function isCompleteOfflineArtifactVerification(report) {
+    if (report.artifact.kind === 'bagit')
+        return report.state === 'integrity_valid' && report.bagit?.state === 'valid'
+            && report.checks.structure === 'verified' && report.checks.contentIntegrity === 'verified';
     return (report.state === 'verified' || report.state === 'structure_valid')
         && (report.manifestIdentity === null || report.manifestIdentity.state === 'identity_verified');
 }
@@ -124,8 +137,7 @@ function artifactVersion(value) {
 function inputBytes(raw) {
     return Buffer.byteLength(raw, 'utf8');
 }
-async function archiveReport(raw, source, archive, encrypted, ciphertextBytes) {
-    const preview = await previewWorkspaceArchive(source, {});
+function archiveReport(raw, archive, preview, encrypted, ciphertextBytes) {
     const readySectionCount = preview.sections.filter((section) => section.status === 'ready').length;
     const unsupportedSectionCount = preview.sections.filter((section) => section.status === 'unsupported').length;
     const blockedSectionCount = preview.sections.filter((section) => section.status === 'blocked').length;
@@ -172,6 +184,24 @@ async function archiveReport(raw, source, archive, encrypted, ciphertextBytes) {
         ]),
     });
 }
+async function verifyWorkspaceArchiveValue(raw, value, passphrase) {
+    const encrypted = isEncryptedWorkspaceArchive(value);
+    if (encrypted && !passphrase) {
+        throw new TypeError('Encrypted archive inspection requires a separate passphrase file.');
+    }
+    if (!encrypted)
+        artifactVersion(value);
+    const decrypted = encrypted ? await decryptWorkspaceArchiveWithMetadata(value, passphrase) : null;
+    const source = decrypted ? decrypted.archive : value;
+    const prepared = await prepareWorkspaceArchive(source);
+    const archive = prepared.read();
+    const report = archiveReport(raw, archive, prepared.preview({}), encrypted, decrypted?.ciphertextBytes ?? null);
+    return { archive, report, encrypted };
+}
+/** Verify an archive once and retain its sections for bounded offline inspection. */
+export async function verifyOfflineWorkspaceArchive(raw, options = {}) {
+    return verifyWorkspaceArchiveValue(raw, parseOfflineArtifactJson(raw), options.passphrase);
+}
 async function verifySignedArtifact(raw, value, schema, version) {
     const routes = SIGNED_ARTIFACT_ROUTES[schema] ?? [];
     if (!routes.some((route) => route.version === version)) {
@@ -215,7 +245,7 @@ async function verifySignedArtifact(raw, value, schema, version) {
     });
 }
 async function verifyOfflineArtifactCore(raw, options = {}) {
-    const value = parseJson(raw);
+    const value = parseOfflineArtifactJson(raw);
     const casePortabilityVerifier = selectCasePortabilityVerifier(value);
     if (casePortabilityVerifier?.id === 'cli-case-pack') {
         const casePackVersion = casePortabilityVersion(casePortabilityVerifier, value);
@@ -249,9 +279,24 @@ async function verifyOfflineArtifactCore(raw, options = {}) {
             ]),
         });
     }
+    if (value.schema === undefined && Array.isArray(value.cases)) {
+        const cases = readEditableCaseExport(raw);
+        return Object.freeze({
+            schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA, version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,
+            artifact: Object.freeze({ kind: 'case_export', schema: null, version: artifactVersion(value) }),
+            state: 'structure_valid',
+            checks: Object.freeze({ structure: 'verified', contentIntegrity: 'not_checked', contentIntegrityScope: 'not_applicable', authenticatedEncryption: 'not_applicable' }),
+            summary: Object.freeze({ inputBytes: inputBytes(raw), sectionCount: 1, recordCount: cases.length, ciphertextBytes: null }),
+            limitations: Object.freeze([
+                'The ordinary Case export matches its exact supported structure without repairing or removing retained records. It has no embedded checksum or signature.',
+                'Original-file references do not include original bytes. Verify a selected evidence package to check which references have matching bytes.',
+                'The Case includes private analyst content. Structural validity does not authenticate its author or establish factual accuracy, currentness or response authority.',
+            ]),
+        });
+    }
     if (isEncryptedWorkspaceArchive(value)) {
-        const inspected = inspectEncryptedWorkspaceArchive(value);
         if (!options.passphrase) {
+            const inspected = inspectEncryptedWorkspaceArchive(value);
             return Object.freeze({
                 schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
                 version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,
@@ -279,14 +324,12 @@ async function verifyOfflineArtifactCore(raw, options = {}) {
                 ]),
             });
         }
-        const decrypted = await decryptWorkspaceArchive(value, options.passphrase);
-        const archive = await readWorkspaceArchive(decrypted);
-        return archiveReport(raw, decrypted, archive, true, inspected.ciphertextBytes);
+        return (await verifyWorkspaceArchiveValue(raw, value, options.passphrase)).report;
     }
     const schema = typeof value.schema === 'string' ? value.schema : '';
     const version = artifactVersion(value);
     if (schema === WORKSPACE_ARCHIVE_SCHEMA) {
-        return archiveReport(raw, value, await readWorkspaceArchive(value), false, null);
+        return (await verifyWorkspaceArchiveValue(raw, value)).report;
     }
     if (casePortabilityVerifier?.id === 'case-response-packet') {
         if (!supportsCasePortabilityVersion(casePortabilityVerifier, version)) {
@@ -432,13 +475,13 @@ async function verifyManifestIdentity(artifactRaw, manifestRaw, entryId) {
         || manifestReport.checks.contentIntegrityScope !== 'whole_artifact') {
         throw new TypeError('The selected manifest is not a fully integrity-verified investigation manifest.');
     }
-    const manifest = parseJson(manifestRaw);
+    const manifest = parseOfflineArtifactJson(manifestRaw);
     const entries = Array.isArray(manifest.artifacts) ? manifest.artifacts : [];
     const entry = entries.find((candidate) => record(candidate)?.id === entryId);
     const item = record(entry);
     if (!item)
         throw new TypeError('The requested investigation manifest entry was not found.');
-    const artifactValue = parseJson(artifactRaw);
+    const artifactValue = parseOfflineArtifactJson(artifactRaw);
     const metadata = artifactMetadata(artifactValue);
     const actualByteLength = inputBytes(artifactRaw);
     const expectedByteLength = Number(item.byteLength);
@@ -466,7 +509,7 @@ async function verifyManifestIdentity(artifactRaw, manifestRaw, entryId) {
             : 'mismatch';
     return Object.freeze({
         state,
-        manifest: Object.freeze({ schema: INVESTIGATION_MANIFEST_SCHEMA, version: INVESTIGATION_MANIFEST_VERSION, entryId }),
+        manifest: Object.freeze({ schema: INVESTIGATION_MANIFEST_SCHEMA, version: manifestReport.artifact.version, entryId }),
         checks,
         expectedByteLength,
         actualByteLength,
@@ -490,8 +533,9 @@ export async function verifyOfflineArtifact(raw, options = {}) {
 export function formatOfflineArtifactVerification(report) {
     const lines = [
         'WHOISleuth offline artefact verification',
-        `Artifact: ${report.artifact.kind} · ${report.artifact.schema} v${report.artifact.version}`,
+        `Artifact: ${report.artifact.kind} · ${report.artifact.schema ?? 'no schema identifier'} v${report.artifact.version}`,
         `State: ${report.state}`,
+        'Automation: use --strict-exit for exit 4 on incomplete verification; default exit 0 means the report was produced.',
         `Structure: ${report.checks.structure}`,
         `Content integrity: ${report.checks.contentIntegrity}`,
         `Content integrity scope: ${report.checks.contentIntegrityScope}`,
@@ -534,6 +578,28 @@ export function formatOfflineArtifactVerification(report) {
         for (const limitation of report.manifestIdentity.limitations)
             lines.push(`Manifest limitation: ${limitation}`);
     }
+    if (report.bagit) {
+        const bag = report.bagit;
+        lines.push(`BagIt: ${bag.state}`, `Payload: ${bag.entries.length} files; ${bag.payloadBytes} present bytes`, `Tag checksums: ${bag.verifiedTagFiles} of ${bag.tagFiles} tag files checked`, `Fetch declarations: ${bag.fetchEntries}; ${bag.fetchMissing} files missing; no requests made`, `Unsupported manifests: ${bag.unsupportedManifests}`);
+        for (const entry of bag.entries)
+            lines.push(`${entry.id}: ${entry.state} · ${entry.byteLength ?? 'unknown'} bytes`);
+        for (const issue of bag.issues)
+            lines.push(`BagIt issue: ${issue}`);
+    }
+    if (report.package) {
+        lines.push(`Package bytes: ${report.package.digestSha256}`, 'Storage: unchanged; inspection only', 'Audience: private; review selected file contents before sharing', 'Signature trust: not checked', 'Trusted timestamp: not checked', 'Factual accuracy: not established');
+        for (const entry of report.package.entries)
+            lines.push(`${entry.id}: ${entry.state} · ${entry.byteLength} bytes · ${entry.mediaType}${entry.issue ? ` · ${entry.issue}` : ''}`);
+        for (const link of report.package.links)
+            lines.push(`Source link ${link.capsuleEntryId}: ${link.state}${link.sourceEntryId ? ` (${link.sourceEntryId})` : ''}`);
+        for (const capture of report.package.captureManifests) {
+            lines.push(`Capture manifest ${capture.entryId}: ${capture.state}`);
+            for (const artifact of capture.artifacts)
+                lines.push(`Capture ${artifact.capture} ${artifact.kind}: ${artifact.state}${artifact.matchingIds.length ? ` (${artifact.matchingIds.join(', ')})` : ''}`);
+        }
+        for (const item of report.package.caseFiles)
+            lines.push(`Case files ${item.entryId} (${item.caseCount} Case${item.caseCount === 1 ? '' : 's'}): ${item.matched} of ${item.references} references matched; ${item.missing} missing`);
+    }
     for (const limitation of report.limitations)
         lines.push(`Limitation: ${limitation}`);
     return `${lines.join('\n')}\n`;