@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/cli/review-command-runner.mjs

@@ -1,10 +1,22 @@
+import { runIntakeCommand } from "./intake-command.mjs";
+import { runIndicatorSetCommand } from "./indicator-set-command.mjs";
+import { CONTEXT_REVIEW_KINDS } from "../packages/contracts/context-review.mjs";
+import { readBoundedRegularFile } from "../lib/bounded-file.mjs";
+import { MAX_ENCRYPTED_INVESTIGATION_PACKAGE_BYTES } from "../packages/contracts/investigation-package-limits.mjs";
+import { verifyOfflineInvestigationFolder, verifyOfflineInvestigationPackage } from "./investigation-package-review.mjs";
+import { readInvestigationFolder } from "./investigation-folder.mjs";
+import { readBagItFolder } from "./bagit-folder.mjs";
+import { verifyOfflineBagIt } from "./bagit-review.mjs";
+import { MAX_BAGIT_ZIP_BYTES } from "../packages/interchange/bagit.mjs";
 import { MAX_OFFLINE_ARTIFACT_BYTES, formatOfflineArtifactVerification, isCompleteOfflineArtifactVerification, verifyOfflineArtifact, } from "./artifact-verify.mjs";
 import { MAX_CASE_PACK_INPUT_BYTES, buildCliCasePack, formatCliCasePack } from "./case-pack.mjs";
 import { MAX_COMPARE_INPUT_BYTES, compareLookupDocument, parseCliLookupDocument, } from "./compare.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
+import { LOCAL_MMDB_REVIEW_SCHEMA, LOCAL_MMDB_REVIEW_VERSION } from "./local-mmdb-review.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 import { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, } from "./offline-evidence-review.mjs";
 import { buildCliLookupBrief, formatCliLookupBrief } from "./lookup-brief.mjs";
+import { runCaseCommand } from "./case-command.mjs";
 import { MAX_MAIL_REVIEW_INPUT_BYTES, buildCliMailReview, formatCliMailReview, } from "./mail-review.mjs";
 import { MAX_MAIL_HEADER_INPUT_BYTES, buildCliMailHeaderReview, formatCliMailHeaderReview, } from "./mail-header-review.mjs";
 import { buildCliPageComparison, formatCliPageComparison } from "./page-compare.mjs";
@@ -15,21 +27,67 @@ import { formatTerminalCompare } from "./formatters/terminal.mjs";
 import { MAX_SAVED_LOOKUP_INPUT_BYTES } from "./saved-lookup.mjs";
 import { REVIEW_INLINE_COMMANDS } from "./inline-command-families.mjs";
 import { runDiscriminatedCommandHandler } from "./discriminated-command-handlers.mjs";
-async function runVerifyArtifactCommand(args, dependencies, context) {
-    context.setFailureLabel('Artefact verification');
+/** Readers retain their command-specific bounds and injection points. Only
+ * usage-error presentation and empty-input handling are shared. */
+async function readReviewInput(read, label, emptyMessage) {
     let input;
     try {
-        input = dependencies.readArtifactInput
-            ? await dependencies.readArtifactInput(args.source)
-            : await context.readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Artefact input');
+        input = await read();
     }
     catch (error) {
         if (error instanceof CliUsageError)
             throw error;
-        throw new CliUsageError(`Could not read artifact input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+        throw new CliUsageError(`Could not read ${label}: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
     }
-    if (!input.trim())
-        throw new CliUsageError('verify-artifact requires one JSON file or an artefact on stdin.');
+    if (emptyMessage && !input.trim())
+        throw new CliUsageError(emptyMessage);
+    return input;
+}
+function writeReviewReport(context, args, report, format) {
+    if (!args.quiet)
+        context.writeStdout(args.output === 'json'
+            ? formatJsonDocument(report)
+            : context.terminal(format(report), args.color));
+}
+async function runVerifyArtifactCommand(args, dependencies, context) {
+    context.setFailureLabel('Artefact verification');
+    if (args.folder) {
+        let files;
+        try {
+            files = await (args.bagit ? readBagItFolder : readInvestigationFolder)(args.folder, dependencies.signal);
+        }
+        catch (cause) {
+            dependencies.signal?.throwIfAborted();
+            const reason = cause instanceof TypeError ? boundedCliErrorMessage(cause) : 'The selected folder is unavailable or could not be read.';
+            throw new CliUsageError(`Could not read evidence folder: ${reason}`);
+        }
+        const report = await (args.bagit ? verifyOfflineBagIt : verifyOfflineInvestigationFolder)(files);
+        dependencies.signal?.throwIfAborted();
+        writeReviewReport(context, args, report, formatOfflineArtifactVerification);
+        return args.strictExit && !isCompleteOfflineArtifactVerification(report) ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+    }
+    if (args.package) {
+        if (!args.source || args.source === '-')
+            throw new CliUsageError('--package requires a selected ZIP file; binary stdin is not accepted.');
+        let bytes;
+        try {
+            bytes = dependencies.readBinaryArtifactInput ? await dependencies.readBinaryArtifactInput(args.source)
+                : await readBoundedRegularFile(args.source, { maximumBytes: args.bagit ? MAX_BAGIT_ZIP_BYTES : MAX_ENCRYPTED_INVESTIGATION_PACKAGE_BYTES, minimumBytes: 22, label: 'Investigation package', ...(dependencies.signal ? { signal: dependencies.signal } : {}) });
+        }
+        catch (error) {
+            if (error instanceof CliUsageError)
+                throw error;
+            throw new CliUsageError(`Could not read package input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+        }
+        const passphrase = args.passphraseSource ? await context.readPassphraseSource(args.passphraseSource) : undefined;
+        const report = args.bagit ? await verifyOfflineBagIt(bytes) : await verifyOfflineInvestigationPackage(bytes, passphrase);
+        dependencies.signal?.throwIfAborted();
+        writeReviewReport(context, args, report, formatOfflineArtifactVerification);
+        return args.strictExit && !isCompleteOfflineArtifactVerification(report) ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+    }
+    const input = await readReviewInput(async () => dependencies.readArtifactInput
+        ? await dependencies.readArtifactInput(args.source)
+        : await context.readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Artefact input'), 'artifact input', 'verify-artifact requires one JSON file or an artefact on stdin.');
     const passphrase = args.passphraseSource ? await context.readPassphraseSource(args.passphraseSource) : null;
     let manifest = null;
     if (args.manifestSource && args.manifestEntryId) {
@@ -49,90 +107,44 @@ async function runVerifyArtifactCommand(args, dependencies, context) {
         manifest = Object.freeze({ raw, entryId: args.manifestEntryId });
     }
     const report = await verifyOfflineArtifact(input, { passphrase, manifest });
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(report)
-            : context.terminal(formatOfflineArtifactVerification(report), args.color));
-    }
+    writeReviewReport(context, args, report, formatOfflineArtifactVerification);
     return args.strictExit && !isCompleteOfflineArtifactVerification(report)
         ? EXIT_CODES.PARTIAL_FAILURE
         : EXIT_CODES.SUCCESS;
 }
 async function runInterchangeReportCommand(args, dependencies, context) {
     context.setFailureLabel('Interchange fidelity report');
-    let input;
-    try {
-        input = dependencies.readArtifactInput
-            ? await dependencies.readArtifactInput(args.source)
-            : await context.readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Interchange input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read interchange input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
-    if (!input.trim())
-        throw new CliUsageError('interchange-report requires one JSON file or an artefact on stdin.');
+    const input = await readReviewInput(async () => dependencies.readArtifactInput
+        ? await dependencies.readArtifactInput(args.source)
+        : await context.readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Interchange input'), 'interchange input', 'interchange-report requires one JSON file or an artefact on stdin.');
     const passphrase = args.passphraseSource ? await context.readPassphraseSource(args.passphraseSource) : null;
     const report = await buildInterchangeFidelityReport(input, {
         generatedAt: context.now(),
         passphrase,
     });
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(report)
-            : context.terminal(formatInterchangeFidelityReport(report), args.color));
-    }
+    writeReviewReport(context, args, report, formatInterchangeFidelityReport);
     return EXIT_CODES.SUCCESS;
 }
 async function runSourceReportCommand(args, dependencies, context) {
     context.setFailureLabel('Source reliability report');
-    let input;
-    try {
-        input = dependencies.readSourceReliabilityInput
-            ? await dependencies.readSourceReliabilityInput(args.source)
-            : await context.readInput(args.source, MAX_SOURCE_RELIABILITY_INPUT_BYTES, 'Source reliability input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read source reliability input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
-    if (!input.trim())
-        throw new CliUsageError('source-report requires one JSON file or lookup documents on stdin.');
+    const input = await readReviewInput(async () => dependencies.readSourceReliabilityInput
+        ? await dependencies.readSourceReliabilityInput(args.source)
+        : await context.readInput(args.source, MAX_SOURCE_RELIABILITY_INPUT_BYTES, 'Source reliability input'), 'source reliability input', 'source-report requires one JSON file or lookup documents on stdin.');
     const report = buildSourceReliabilityReport(input, context.now());
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(report)
-            : context.terminal(formatSourceReliabilityReport(report), args.color));
-    }
+    writeReviewReport(context, args, report, formatSourceReliabilityReport);
     return EXIT_CODES.SUCCESS;
 }
 async function runCompareCommand(args, dependencies, context) {
     context.setFailureLabel('Registry comparison');
-    let input;
-    try {
-        input = dependencies.readCompareInput
-            ? await dependencies.readCompareInput(args.source)
-            : await context.readInput(args.source, MAX_COMPARE_INPUT_BYTES, 'Comparison input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read comparison input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
-    if (!input.trim())
-        throw new CliUsageError('compare requires one lookup JSON file or a lookup document on stdin.');
+    const input = await readReviewInput(async () => dependencies.readCompareInput
+        ? await dependencies.readCompareInput(args.source)
+        : await context.readInput(args.source, MAX_COMPARE_INPUT_BYTES, 'Comparison input'), 'comparison input', 'compare requires one lookup JSON file or a lookup document on stdin.');
     const parsed = parseCliLookupDocument(input);
     const loadComparison = dependencies.loadRegistryComparison || (() => import("../lib/registry-comparison.mjs"));
     const comparisonModule = await loadComparison();
     const result = compareLookupDocument(parsed, comparisonModule.compareRegistrySources, comparisonModule.compareRdapPublications);
     const document = buildCliCompareDocument(result, context.now());
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(document)
-            : context.terminal(formatTerminalCompare(document), args.color));
-    }
+    writeReviewReport(context, args, document, formatTerminalCompare);
     return EXIT_CODES.SUCCESS;
 }
 async function runPageCompareCommand(args, dependencies, context) {
@@ -153,80 +165,36 @@ async function runPageCompareCommand(args, dependencies, context) {
         throw new CliUsageError(`Could not read page comparison input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
     }
     const document = buildCliPageComparison(leftInput, rightInput, context.now());
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(document)
-            : context.terminal(formatCliPageComparison(document), args.color));
-    }
+    writeReviewReport(context, args, document, formatCliPageComparison);
     return EXIT_CODES.SUCCESS;
 }
 async function runMailReviewCommand(args, dependencies, context) {
     context.setFailureLabel('Passive mail review');
-    let input;
-    try {
-        input = dependencies.readMailReviewInput
-            ? await dependencies.readMailReviewInput(args.source)
-            : await context.readInput(args.source, MAX_MAIL_REVIEW_INPUT_BYTES, 'Mail review input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read mail review input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
+    const input = await readReviewInput(async () => dependencies.readMailReviewInput
+        ? await dependencies.readMailReviewInput(args.source)
+        : await context.readInput(args.source, MAX_MAIL_REVIEW_INPUT_BYTES, 'Mail review input'), 'mail review input');
     const document = buildCliMailReview(input, context.now());
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(document)
-            : context.terminal(formatCliMailReview(document), args.color));
-    }
+    writeReviewReport(context, args, document, formatCliMailReview);
     return EXIT_CODES.SUCCESS;
 }
 async function runMailHeadersCommand(args, dependencies, context) {
     context.setFailureLabel('Mail-header review');
-    let input;
-    try {
-        input = dependencies.readMailHeaderInput
-            ? await dependencies.readMailHeaderInput(args.source)
-            : await context.readHeaderInput(args.source, MAX_MAIL_HEADER_INPUT_BYTES, 'Mail-header input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read mail-header input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
-    if (!input.trim())
-        throw new CliUsageError('mail-headers requires one message or header file, or headers on stdin.');
-    const document = buildCliMailHeaderReview(input, context.now());
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(document)
-            : context.terminal(formatCliMailHeaderReview(document), args.color));
-    }
+    const input = await readReviewInput(async () => dependencies.readMailHeaderInput
+        ? await dependencies.readMailHeaderInput(args.source)
+        : await context.readHeaderInput(args.source, MAX_MAIL_HEADER_INPUT_BYTES, 'Mail-header input'), 'mail-header input', 'mail-headers requires one message or header file, or headers on stdin.');
+    const document = buildCliMailHeaderReview(input, context.now(), args.trustedAuthHeaders);
+    writeReviewReport(context, args, document, formatCliMailHeaderReview);
     return EXIT_CODES.SUCCESS;
 }
 async function runOfflineEvidenceReviewCommand(args, dependencies, context) {
     context.setFailureLabel('Offline evidence review');
-    let input;
-    try {
-        input = dependencies.readArtifactInput
-            ? await dependencies.readArtifactInput(args.source)
-            : await context.readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Offline evidence input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read offline evidence input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
-    if (!input.trim())
-        throw new CliUsageError('review-evidence requires one JSON file or a document on stdin.');
+    const input = await readReviewInput(async () => dependencies.readArtifactInput
+        ? await dependencies.readArtifactInput(args.source)
+        : await context.readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Offline evidence input'), 'offline evidence input', 'review-evidence requires one JSON file or a document on stdin.');
     const document = args.mmdbSource
         ? await buildOfflineEvidenceReviewWithLocalResources(input, context.now(), { mmdbPath: args.mmdbSource })
         : buildOfflineEvidenceReview(input, context.now());
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(document)
-            : context.terminal(formatOfflineEvidenceReview(document), args.color));
-    }
+    writeReviewReport(context, args, document, formatOfflineEvidenceReview);
     if (args.strictExit) {
         const result = document.result && typeof document.result === 'object' && !Array.isArray(document.result)
             ? document.result
@@ -237,7 +205,9 @@ async function runOfflineEvidenceReviewCommand(args, dependencies, context) {
         const zoneMismatch = document.kind === 'zone_intent' && (result.complete !== true
             || (result.counts && typeof result.counts === 'object' && !Array.isArray(result.counts)
                 && ['different', 'missing', 'unexpected', 'incomplete'].some((key) => Number(result.counts[key]) > 0)));
-        if (gate?.pass === false || zoneMismatch)
+        const contextPartial = CONTEXT_REVIEW_KINDS.includes(document.kind) && result.state === 'partial';
+        const mmdbIncomplete = result.schema === LOCAL_MMDB_REVIEW_SCHEMA && result.version === LOCAL_MMDB_REVIEW_VERSION && result.completeness !== 'complete';
+        if (gate?.pass === false || zoneMismatch || contextPartial || mmdbIncomplete)
             return EXIT_CODES.PARTIAL_FAILURE;
     }
     return EXIT_CODES.SUCCESS;
@@ -245,34 +215,16 @@ async function runOfflineEvidenceReviewCommand(args, dependencies, context) {
 async function runBriefOrCasePackCommand(args, dependencies, context) {
     const isBrief = args.action === 'brief';
     context.setFailureLabel(isBrief ? 'Lookup brief' : 'Case pack');
-    let input;
-    try {
-        input = dependencies.readArtifactInput
-            ? await dependencies.readArtifactInput(args.source)
-            : await context.readInput(args.source, isBrief ? MAX_SAVED_LOOKUP_INPUT_BYTES : MAX_CASE_PACK_INPUT_BYTES, isBrief ? 'Lookup brief input' : 'Case-pack input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read ${isBrief ? 'Lookup brief' : 'case-pack'} input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
-    if (!input.trim())
-        throw new CliUsageError(`${args.action} requires one JSON file or a document on stdin.`);
+    const input = await readReviewInput(async () => dependencies.readArtifactInput
+        ? await dependencies.readArtifactInput(args.source)
+        : await context.readInput(args.source, isBrief ? MAX_SAVED_LOOKUP_INPUT_BYTES : MAX_CASE_PACK_INPUT_BYTES, isBrief ? 'Lookup brief input' : 'Case-pack input'), `${isBrief ? 'Lookup brief' : 'case-pack'} input`, `${args.action} requires one JSON file or a document on stdin.`);
     if (args.action === 'brief') {
         const document = buildCliLookupBrief(input, context.now());
-        if (!args.quiet) {
-            context.writeStdout(args.output === 'json'
-                ? formatJsonDocument(document)
-                : context.terminal(formatCliLookupBrief(document), args.color));
-        }
+        writeReviewReport(context, args, document, formatCliLookupBrief);
     }
     else {
         const document = buildCliCasePack(input, { audience: args.audience, reviewed: args.reviewed }, context.now());
-        if (!args.quiet) {
-            context.writeStdout(args.output === 'json'
-                ? formatJsonDocument(document)
-                : context.terminal(formatCliCasePack(document), args.color));
-        }
+        writeReviewReport(context, args, document, formatCliCasePack);
     }
     return EXIT_CODES.SUCCESS;
 }
@@ -284,9 +236,12 @@ const REVIEW_COMMAND_HANDLERS = Object.freeze({
     'page-compare': runPageCompareCommand,
     'mail-review': runMailReviewCommand,
     'mail-headers': runMailHeadersCommand,
+    intake: runIntakeCommand,
     'review-evidence': runOfflineEvidenceReviewCommand,
     'brief': runBriefOrCasePackCommand,
+    'case': runCaseCommand,
     'case-pack': runBriefOrCasePackCommand,
+    'indicator-set': runIndicatorSetCommand,
 });
 function runReviewCommand(args, dependencies, context) {
     return runDiscriminatedCommandHandler(REVIEW_COMMAND_HANDLERS, args, dependencies, context);

package/cli/risk-calibration.mjs

@@ -1,14 +1,14 @@
 import { Buffer } from 'node:buffer';
 import { decodeBoundedUtf8 } from "../lib/bounded-file.mjs";
-import { isValidAsciiDomainName } from "../lib/hostname.mjs";
-import { scanBoundedJson } from "../lib/bounded-json.mjs";
-import { canonicalRegistrableDomain } from "../lib/registrable-domain.mjs";
-import { ANALYST_REVIEW_REASON_VALUES, analystInteroperabilityTags } from "../lib/analyst-taxonomy.mjs";
-import { buildRiskCalibrationSummaryReport, parseRiskCalibrationSummaryReport, RISK_CALIBRATION_SUMMARY_INTERPRETATION, RISK_CALIBRATION_SUMMARY_THRESHOLDS, } from "../lib/risk-calibration-summary.mjs";
+import { isValidAsciiDomainName } from "../packages/contracts/domain-name.mjs";
+import { scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
+import { canonicalRegistrableDomain } from "../packages/analysis/registrable-domain.mjs";
+import { ANALYST_REVIEW_REASON_VALUES, analystInteroperabilityTags } from "../packages/analysis/analyst-taxonomy.mjs";
+import { buildRiskCalibrationSummaryReport, parseRiskCalibrationSummaryReport, RISK_CALIBRATION_SUMMARY_INTERPRETATION, RISK_CALIBRATION_SUMMARY_THRESHOLDS, } from "../packages/analysis/risk-calibration-summary.mjs";
 import { MAX_RISK_CALIBRATION_ACTIVITY_LENGTH, MAX_RISK_CALIBRATION_AVAILABILITY_LENGTH, MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, MAX_RISK_CALIBRATION_DOMAIN_AGE_DAYS, MAX_RISK_CALIBRATION_DOMAIN_LENGTH, MAX_RISK_CALIBRATION_FINDING_CATEGORY_LENGTH, MAX_RISK_CALIBRATION_FINDINGS_PER_PROVIDER, MAX_RISK_CALIBRATION_INPUT_BYTES, MAX_RISK_CALIBRATION_JSON_CONTAINER_ITEMS, MAX_RISK_CALIBRATION_JSON_DEPTH, MAX_RISK_CALIBRATION_JSON_KEYS, MAX_RISK_CALIBRATION_JSON_VALUES, MAX_RISK_CALIBRATION_MUTATIONS, MAX_RISK_CALIBRATION_PROVIDER_ID_LENGTH, MAX_RISK_CALIBRATION_PROVIDER_STATE_LENGTH, MAX_RISK_CALIBRATION_PROVIDERS, MAX_RISK_CALIBRATION_RECORD_ID_LENGTH, MAX_RISK_CALIBRATION_RECORDS, MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH, MAX_RISK_CALIBRATION_SCAN_DEPTH_LENGTH, MAX_RISK_CALIBRATION_STRING_LENGTH, MAX_RISK_CALIBRATION_TIMESTAMP_LENGTH, RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_DATASET_VERSION, RISK_CALIBRATION_REPORT_SCHEMA, RISK_CALIBRATION_REPORT_VERSION, RISK_CALIBRATION_DISPOSITIONS, serializeRiskCalibrationSnapshot, snapshotRiskCalibrationReportForSerialization, SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS, } from "../packages/contracts/risk-calibration.mjs";
-import { CliUsageError } from "./arguments.mjs";
-import { RISK_MUTATION_TYPES } from "../lib/risk-scoring.mjs";
-import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_SCHEMA, } from "../lib/threat-intelligence-types.mjs";
+import { CliUsageError } from "./errors.mjs";
+import { RISK_MUTATION_TYPES } from "../packages/analysis/risk-scoring.mjs";
+import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_SCHEMA, } from "../packages/analysis/threat-intelligence-types.mjs";
 export { MAX_RISK_CALIBRATION_INPUT_BYTES, MAX_RISK_CALIBRATION_RECORDS, MAX_RISK_CALIBRATION_STRING_LENGTH, RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_DATASET_VERSION, RISK_CALIBRATION_REPORT_SCHEMA, RISK_CALIBRATION_REPORT_VERSION, SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS, } from "../packages/contracts/risk-calibration.mjs";
 export const RISK_CALIBRATION_THRESHOLDS = RISK_CALIBRATION_SUMMARY_THRESHOLDS;
 const CONTROL_RE = /[\x00-\x1f\x7f]/;

package/cli/runner.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from 'node:module';
 import { abortable } from "../lib/abort.mjs";
-import { parseCliArguments } from "./arguments.mjs";
+import { isCliCommandForOwner, parseCliArguments } from "./arguments.mjs";
 import { HELP, commandDefinition, commandHelp, } from "./command-reference.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import { evidenceCommandFailureLabel, isEvidenceCommand, runEvidenceCommand, } from "./evidence-command-runner.mjs";
@@ -9,7 +9,7 @@ import { readCliHeaderInput, readCliTextInput } from "./input.mjs";
 import { INLINE_CLI_COMMANDS, runInlineCommand } from "./inline-command-runner.mjs";
 import { canLaunchInteractiveCli, launchInteractiveCli, } from "./interactive-launcher.mjs";
 import { MAX_OFFLINE_PASSPHRASE_FILE_BYTES, } from "./artifact-verify.mjs";
-import { cleanupPendingOutputFiles, createBufferedOutput, writePrivateFile } from "./output-file.mjs";
+import { cleanupPendingOutputFiles, createBufferedOutput, writePrivateFile, MAX_CLI_OUTPUT_BYTES } from "./output-file.mjs";
 import { createTerminalProgress } from "./progress.mjs";
 import { presentTerminalOutput, terminalPresentation, } from "./terminal-presentation.mjs";
 const require = createRequire(import.meta.url);
@@ -40,17 +40,7 @@ function isCancellation(error, signal) {
     return signal?.aborted === true
         || Boolean(error && typeof error === 'object' && 'name' in error && error.name === 'AbortError');
 }
-function usageEventReason(error) {
-    const message = boundedCliErrorMessage(error, 'Invalid command input').toLowerCase();
-    if (message.includes('could not read'))
-        return 'input_unavailable';
-    if (message.includes('cannot be combined') || message.includes('mutually exclusive'))
-        return 'conflicting_options';
-    if (message.includes('requires') || message.includes('did not contain'))
-        return 'missing_input';
-    return 'invalid_input';
-}
-async function runParsedCli(args, dependencies = {}) {
+async function runParsedCli(args, dependencies = {}, writeBinaryOutput) {
     const stdout = dependencies.stdout || process.stdout;
     const stderr = dependencies.stderr || process.stderr;
     const environment = dependencies.environment || process.env;
@@ -113,7 +103,7 @@ async function runParsedCli(args, dependencies = {}) {
             catch (error) {
                 if (error instanceof CliUsageError)
                     throw error;
-                throw new CliUsageError(`Could not read passphrase file: ${boundedCliErrorMessage(error, 'File could not be read')}`);
+                throw new CliUsageError(`Could not read passphrase file: ${boundedCliErrorMessage(error, 'File could not be read')}`, 'input_unavailable');
             }
             const passphrase = passphraseText.replace(/\r?\n$/u, '');
             if (!passphrase || /[\r\n\u0000]/u.test(passphrase)) {
@@ -128,6 +118,7 @@ async function runParsedCli(args, dependencies = {}) {
             terminal,
             presentation: (color) => terminalPresentation(stdout, color, environment, palette),
             writeStdout: (value) => write(stdout, value),
+            ...(writeBinaryOutput ? { writeBinaryOutput } : {}),
             writeStderr: (value) => write(stderr, value),
             readSingleInput,
             readInput,
@@ -197,25 +188,9 @@ async function runParsedCli(args, dependencies = {}) {
             });
         }
         if (handlerOwner === 'network') {
-            if (args.action !== 'ct-search'
-                && args.action !== 'posture'
-                && args.action !== 'http'
-                && args.action !== 'tls'
-                && args.action !== 'dnssec-validate'
-                && args.action !== 'mail-transport') {
+            if (!isCliCommandForOwner(args, 'network')) {
                 throw new Error('Network command registry ownership is inconsistent.');
             }
-            failureLabel = args.action === 'ct-search'
-                ? 'Certificate Transparency search'
-                : args.action === 'posture'
-                    ? 'Domain posture audit'
-                    : args.action === 'http'
-                        ? 'HTTP probe'
-                        : args.action === 'tls'
-                            ? 'TLS evidence collection'
-                            : args.action === 'dnssec-validate'
-                                ? 'DNSSEC chain validation'
-                                : 'Mail transport review';
             const { runNetworkCommand } = await import("./network-command-runner.mjs");
             return await runNetworkCommand(args, dependencies, commandContext);
         }
@@ -243,7 +218,7 @@ async function runParsedCli(args, dependencies = {}) {
             eventProgress.current?.emit({
                 event: 'failed',
                 state: 'usage',
-                reason: usageEventReason(error),
+                reason: error.reason,
                 exitCode: EXIT_CODES.USAGE,
             });
             if (!eventProgress.current?.enabled)
@@ -305,15 +280,72 @@ async function runCliCommand(argv, dependencies = {}) {
     }
     if (!args.destination)
         return runParsedCli(args, dependencies);
-    const buffered = createBufferedOutput();
-    const code = await runParsedCli(args, { ...dependencies, stdout: buffered.stream });
-    if (code !== EXIT_CODES.SUCCESS && code !== EXIT_CODES.PARTIAL_FAILURE)
-        return code;
+    const buffered = createBufferedOutput({ binary: args.action === 'manifest' && args.package === true });
+    let checkpoint = null;
+    let capturedSource = null;
     try {
-        await writePrivateFile(args.destination, buffered.value(), { force: args.force === true });
+        if (args.action === 'workflow-run') {
+            const { prepareInvestigationCheckpoint } = await import("./investigation-checkpoint.mjs");
+            const workflowCheckpoint = await prepareInvestigationCheckpoint({
+                destination: args.destination, resumeSource: args.resumeSource, force: args.force === true,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+            });
+            checkpoint = workflowCheckpoint;
+            capturedSource = workflowCheckpoint.resumeInput;
+        }
+        else if (args.action === 'case') {
+            const { prepareLocalDocumentWrite } = await import("./local-document-checkpoint.mjs");
+            const { MAX_EDITABLE_CASE_INPUT_BYTES, MAX_EDITABLE_CASE_OUTPUT_BYTES } = await import("../packages/contracts/case-portability.mjs");
+            const caseCheckpoint = await prepareLocalDocumentWrite({
+                destination: args.destination, source: args.source, force: args.force === true, label: 'Case',
+                allowSourceReplacement: args.operation !== 'show',
+                maximumInputBytes: MAX_EDITABLE_CASE_INPUT_BYTES, maximumOutputBytes: MAX_EDITABLE_CASE_OUTPUT_BYTES,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+            });
+            checkpoint = caseCheckpoint;
+            capturedSource = caseCheckpoint.sourceInput;
+        }
+        else if (args.action === 'indicator-set') {
+            const { prepareLocalDocumentWrite } = await import("./local-document-checkpoint.mjs");
+            const { MAX_MANAGED_INDICATOR_PLAN_BYTES, MAX_MANAGED_INDICATOR_SET_BYTES } = await import("../packages/contracts/analyst-interchange.mjs");
+            const indicatorCheckpoint = await prepareLocalDocumentWrite({
+                destination: args.destination, source: args.source,
+                force: args.force === true, label: 'Indicator revision', allowSourceReplacement: false,
+                maximumInputBytes: args.operation === 'revise' ? MAX_MANAGED_INDICATOR_PLAN_BYTES : MAX_MANAGED_INDICATOR_SET_BYTES,
+                maximumOutputBytes: MAX_CLI_OUTPUT_BYTES,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+            });
+            checkpoint = indicatorCheckpoint;
+            capturedSource = indicatorCheckpoint.sourceInput;
+        }
+        const code = await runParsedCli(args, {
+            ...dependencies, stdout: buffered.stream,
+            ...(args.action === 'workflow-run' && args.resumeSource && capturedSource !== null
+                ? { workflowResumeInput: capturedSource }
+                : {}),
+            ...(args.action === 'case' && capturedSource !== null ? { caseFileInput: capturedSource } : {}),
+            ...(args.action === 'indicator-set' && capturedSource !== null ? { readArtifactInput: async () => capturedSource } : {}),
+        }, buffered.writeBinary);
+        if (code !== EXIT_CODES.SUCCESS && code !== EXIT_CODES.PARTIAL_FAILURE)
+            return code;
+        const content = buffered.value();
+        if (checkpoint) {
+            if (typeof content !== 'string')
+                throw new TypeError('Local document output must be text.');
+            await checkpoint.publish(content);
+        }
+        else
+            await writePrivateFile(args.destination, content, {
+                force: args.force === true,
+                beforePublish: async () => { dependencies.signal?.throwIfAborted(); },
+            });
         return code;
     }
     catch (error) {
+        if (isCancellation(error, dependencies.signal)) {
+            write(stderr, 'Cancelled by analyst.\n');
+            return EXIT_CODES.CANCELLED;
+        }
         if (error instanceof CliUsageError) {
             write(stderr, `Usage error: ${boundedCliErrorMessage(error, 'Output file could not be written')}\n`);
             return EXIT_CODES.USAGE;
@@ -321,6 +353,11 @@ async function runCliCommand(argv, dependencies = {}) {
         write(stderr, `Output failed: ${boundedCliErrorMessage(error, 'Output file could not be written')}\n`);
         return EXIT_CODES.LOOKUP_FAILED;
     }
+    finally {
+        if (checkpoint && await checkpoint.release() > 0) {
+            write(stderr, `${args.action === 'case' ? 'Case' : args.action === 'indicator-set' ? 'Indicator revision' : 'Workflow'} cleanup warning: File ownership changed or a lease could not be removed. Inspect the selected directory before resuming.\n`);
+        }
+    }
 }
 async function runCli(argv, dependencies = {}) {
     const stderr = dependencies.stderr || process.stderr;

package/cli/saved-lookup.mjs

@@ -1,9 +1,9 @@
 import { Buffer } from 'node:buffer';
 import { types as utilTypes } from 'node:util';
 import { classifyQuery } from "../lib/classify.mjs";
-import { isSafeJsonObjectKey, scanBoundedJson, } from "../lib/bounded-json.mjs";
+import { isSafeJsonObjectKey, scanBoundedJson, } from "../packages/analysis/bounded-json.mjs";
 import { decodeBoundedUtf8 } from "../lib/bounded-file.mjs";
-import { CliUsageError } from "./arguments.mjs";
+import { CliUsageError } from "./errors.mjs";
 import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "../lib/homepage-metadata-contract.mjs";
 import { registrarStandingObservedBy, resolveRegistrarIanaId, validRegistrarStanding, } from "../lib/registrar-standing-contract.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";

package/cli/selected-input-worker.mjs

@@ -0,0 +1,63 @@
+import { Worker, isMainThread, parentPort, workerData } from 'node:worker_threads';
+import { reviewSelectedInput } from "../packages/investigation/selected-input-review.mjs";
+import { assertMessageBytes } from "../packages/investigation/intake-report.mjs";
+import { DOCUMENT_REVIEW_DEADLINE_MS } from "../packages/contracts/document-intake.mjs";
+import { MESSAGE_INTAKE_SCHEMA, MESSAGE_INTAKE_VERSION } from "../packages/contracts/message-intake.mjs";
+if (!isMainThread && parentPort) {
+    const port = parentPort, request = workerData;
+    try {
+        port.postMessage({ result: await reviewSelectedInput(request.bytes, request.kind, request.reviewedAt) });
+    }
+    catch {
+        port.postMessage({ error: true });
+    }
+    finally {
+        if (request.bytes instanceof Uint8Array)
+            request.bytes.fill(0);
+        port.close();
+    }
+}
+/** A disposable worker makes synchronous parser work cancellable, not a sandbox. */
+export async function reviewSelectedInputInWorker(bytes, kind, reviewedAt, signal) {
+    assertMessageBytes(bytes);
+    signal?.throwIfAborted();
+    // Buffer.slice() can retain a pooled, non-transferable backing store.
+    const copy = Uint8Array.from(bytes);
+    const worker = new Worker(new URL(import.meta.url), { workerData: { bytes: copy, kind, reviewedAt },
+        transferList: [copy.buffer], env: {}, execArgv: [], stdout: true, stderr: true,
+        resourceLimits: { maxOldGenerationSizeMb: 512, maxYoungGenerationSizeMb: 32, stackSizeMb: 4 } });
+    worker.stdout.resume();
+    worker.stderr.resume();
+    try {
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            const finish = (value, cause) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                signal?.removeEventListener('abort', abort);
+                if (value)
+                    resolve(value);
+                else
+                    reject(cause ?? new TypeError('The selected input could not be reviewed within its format and processing bounds.'));
+            };
+            const abort = () => finish(undefined, new Error('Selected input review was cancelled. Nothing was saved.'));
+            const timer = setTimeout(() => finish(undefined, new Error('Selected input review exceeded its processing deadline. Nothing was saved.')), DOCUMENT_REVIEW_DEADLINE_MS);
+            worker.once('message', (reply) => {
+                if (reply && typeof reply === 'object' && 'result' in reply && reply.result?.report.schema === MESSAGE_INTAKE_SCHEMA && reply.result.report.schemaVersion === MESSAGE_INTAKE_VERSION)
+                    finish(reply.result);
+                else
+                    finish();
+            });
+            worker.once('error', () => finish());
+            worker.once('exit', () => finish());
+            signal?.addEventListener('abort', abort, { once: true });
+            if (signal?.aborted)
+                abort();
+        });
+    }
+    finally {
+        await worker.terminate();
+    }
+}