@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/cli/artifact-validation/signed-review.mjs

@@ -1,14 +1,20 @@
 import { ACQUISITION_DECISIONS, ACQUISITION_MANUAL_CHECKS, ACQUISITION_DECISION_PACKET_SCHEMA, ACQUISITION_DECISION_PACKET_VERSION, } from "../../packages/investigation/acquisition-decision-packet.mjs";
 import { BULK_DOMAIN_COMPARISON_EXPORT_VERSION, BULK_DOMAIN_COMPARISON_SCHEMA, } from "../../packages/investigation/bulk-domain-comparison.mjs";
 import { BULK_MAIL_EXPOSURE_EXPORT_VERSION, BULK_MAIL_EXPOSURE_SCHEMA, MAX_BULK_MAIL_EXPOSURE_ROWS, } from "../../packages/investigation/bulk-mail-exposure.mjs";
-import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, } from "../../packages/investigation/bulk-review-export.mjs";
+import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS, } from "../../packages/contracts/investigation-portability.mjs";
+import { MAX_BULK_SESSION_ROWS, MAX_BULK_SESSION_SOURCES } from "../../packages/contracts/workspace-portability.mjs";
+import { MANAGED_INDICATOR_SET_SCHEMA } from "../../packages/contracts/analyst-interchange.mjs";
+import { validateManagedIndicatorSet } from "../../packages/interchange/managed-indicator-set.mjs";
+import { BULK_SORT_KEYS } from "../../packages/workspace/bulk-sort.mjs";
+import { normalizeExplicitIsoTimestamp } from "../../packages/evidence/observation.mjs";
 import { LOOKUP_CLAIM_PASSPORT_SCHEMA, LOOKUP_CLAIM_PASSPORT_TARGET_TYPES, LOOKUP_CLAIM_PASSPORT_VERSION, MAX_LOOKUP_CLAIM_PASSPORT_LIMITATIONS, MAX_LOOKUP_CLAIM_PASSPORT_REQUIREMENTS, } from "../../packages/investigation/lookup-claim-passport.mjs";
 import { LOOKUP_CLAIM_IDS, LOOKUP_CLAIM_READINESS_VERSION, LOOKUP_CLAIM_REQUIREMENT_IDS, } from "../../packages/investigation/lookup-claim-readiness.mjs";
 import { normalizeDomainControlManifestDocument } from "../../packages/evidence/domain-control-runtime.mjs";
-import { DOMAIN_CHANGE_PACKET_SCHEMA, DOMAIN_CHANGE_PACKET_VERSION, } from "../../lib/domain-change-packet.mjs";
+import { DOMAIN_CHANGE_PACKET_SCHEMA, DOMAIN_CHANGE_PACKET_REVIEW_VERSIONS, } from "../../lib/domain-change-packet.mjs";
+import { DOMAIN_CHANGE_REVIEW_SCHEMA } from "../../lib/domain-change-review.mjs";
 import { DOMAIN_CONTROL_MANIFEST_SCHEMA } from "../../packages/contracts/domain-control-manifest.mjs";
-import { INVESTIGATION_MANIFEST_SCHEMA, INVESTIGATION_MANIFEST_VERSION, MAX_INVESTIGATION_MANIFEST_ARTIFACTS, MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES, } from "../investigation-manifest.mjs";
-import { array, boolean, domain, digest, enumeration, exact, fail, integer, iso, optionalText, sameValues, strings, text, validateIntegrity, } from "./structure-primitives.mjs";
+import { INVESTIGATION_MANIFEST_SCHEMA, validateInvestigationManifest, } from "../investigation-manifest.mjs";
+import { array, boolean, domain, enumeration, exact, fail, integer, iso, optionalText, sameValues, strings, text, validateIntegrity, } from "./structure-primitives.mjs";
 const CLAIM_PASSPORT_SOURCE_STATES = ['complete', 'not_found', 'partial', 'skipped', 'unavailable', 'unknown', 'unsupported'];
 const COMPARISON_STATES = ['conflicting', 'different', 'equal', 'missing', 'not_recorded', 'unavailable'];
 const SOURCE_STATES = ['complete', 'error', 'not_found', 'not_recorded', 'partial', 'skipped', 'unavailable', 'unsupported'];
@@ -209,11 +215,17 @@ function validateDomainComparison(value) {
     strings(comparison.limitations, 'Domain comparison limitations', 12, 600);
     validateIntegrity(root.integrity, 'Domain comparison integrity', root.version, BULK_DOMAIN_COMPARISON_EXPORT_VERSION);
 }
-function validateSourceCoverage(value, label) {
-    const source = exact(value, ['source', 'state'], label);
+function validateNullableObservationTime(value, label) {
+    if (value !== null && normalizeExplicitIsoTimestamp(value) !== value)
+        fail(label);
+}
+function validateSourceCoverage(value, label, observedTime = false) {
+    const source = exact(value, ['source', 'state', ...(observedTime ? ['observedAt'] : [])], label);
     if (typeof source.source !== 'string' || !/^[a-z][a-z0-9_-]{0,39}$/u.test(source.source))
         fail(label);
     enumeration(source.state, SOURCE_STATES.filter((state) => state !== 'not_recorded'), label);
+    if (observedTime)
+        validateNullableObservationTime(source.observedAt, `${label} observedAt`);
 }
 function validateProfileContext(value, label) {
     const context = exact(value, ['sourceState', 'activeProfileId', 'profileUpdatedAt', 'limitation'], label);
@@ -281,29 +293,40 @@ function validateBulkView(value, label) {
     text(view.caseDispositionFilter, label, 60, true);
     enumeration(view.reviewStateFilter, ['', 'unreviewed', 'reviewing', 'reviewed', 'deferred'], label);
     text(view.groupBy, label, 60, true);
-    enumeration(view.sortKey, ['domain', 'availability', 'risk', 'opportunity', 'activity', 'registrar', 'mutation'], label);
+    enumeration(view.sortKey, BULK_SORT_KEYS, label);
     if (view.sortDirection !== 1 && view.sortDirection !== -1)
         fail(label);
 }
 function validateBulkReviewManifest(value) {
     const root = exact(value, ['schema', 'version', 'generatedAt', 'observedAt', 'lookupProfile', 'selection', 'view', 'rows', 'limitations', 'integrity'], 'Bulk review manifest');
+    const version = SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS.find((candidate) => candidate === root.version);
+    if (version === undefined)
+        fail('Bulk review manifest version');
+    const sourceTimes = version === BULK_REVIEW_MANIFEST_VERSION;
+    const maximumRows = sourceTimes ? MAX_BULK_SESSION_ROWS : 2_000;
+    const maximumSources = sourceTimes ? MAX_BULK_SESSION_SOURCES : 12;
     iso(root.generatedAt, 'Bulk review manifest generatedAt');
-    iso(root.observedAt, 'Bulk review manifest observedAt');
+    if (sourceTimes)
+        validateNullableObservationTime(root.observedAt, 'Bulk review manifest observedAt');
+    else
+        iso(root.observedAt, 'Bulk review manifest observedAt');
     enumeration(root.lookupProfile, ['deep', 'fast'], 'Bulk review manifest lookup profile');
     const selection = exact(root.selection, ['count', 'domains'], 'Bulk review manifest selection');
-    const domains = strings(selection.domains, 'Bulk review manifest selected domains', 2_000, 253);
+    const domains = strings(selection.domains, 'Bulk review manifest selected domains', maximumRows, 253);
     domains.forEach((item) => domain(item, 'Bulk review manifest selected domain'));
-    if (integer(selection.count, 'Bulk review manifest selection count', 0, 2_000) !== domains.length)
+    if (integer(selection.count, 'Bulk review manifest selection count', 0, maximumRows) !== domains.length)
         fail('Bulk review manifest selection');
     validateBulkView(root.view, 'Bulk review manifest view');
-    const rows = array(root.rows, 'Bulk review manifest rows', 2_000);
+    const rows = array(root.rows, 'Bulk review manifest rows', maximumRows);
     for (const [index, candidate] of rows.entries()) {
-        const row = exact(candidate, ['domain', 'reviewState', 'resultState', 'scanDepth', 'sourceCoverage', 'profileContext'], `Bulk review manifest row ${index + 1}`);
+        const row = exact(candidate, ['domain', 'reviewState', 'resultState', 'scanDepth', ...(sourceTimes ? ['observedAt'] : []), 'sourceCoverage', 'profileContext'], `Bulk review manifest row ${index + 1}`);
         domain(row.domain, 'Bulk review manifest row domain');
         enumeration(row.reviewState, ['unreviewed', 'reviewing', 'reviewed', 'deferred'], 'Bulk review manifest review state');
         enumeration(row.resultState, ['complete', 'error'], 'Bulk review manifest result state');
         enumeration(row.scanDepth, ['deep', 'fast'], 'Bulk review manifest scan depth');
-        array(row.sourceCoverage, 'Bulk review manifest source coverage', 12).forEach((item, sourceIndex) => validateSourceCoverage(item, `Bulk review manifest source ${sourceIndex + 1}`));
+        if (sourceTimes)
+            validateNullableObservationTime(row.observedAt, 'Bulk review manifest row observedAt');
+        array(row.sourceCoverage, 'Bulk review manifest source coverage', maximumSources).forEach((item, sourceIndex) => validateSourceCoverage(item, `Bulk review manifest source ${sourceIndex + 1}`, sourceTimes));
         validateProfileContext(row.profileContext, 'Bulk review manifest profile context');
         if (domains[index] !== row.domain)
             fail('Bulk review manifest selection');
@@ -311,59 +334,81 @@ function validateBulkReviewManifest(value) {
     if (rows.length !== domains.length)
         fail('Bulk review manifest selection');
     strings(root.limitations, 'Bulk review manifest limitations', 8, 600);
-    validateIntegrity(root.integrity, 'Bulk review manifest integrity', root.version, BULK_REVIEW_MANIFEST_VERSION);
+    validateIntegrity(root.integrity, 'Bulk review manifest integrity', root.version, version);
 }
-function validateInvestigationManifest(value) {
-    const root = exact(value, ['schema', 'version', 'generatedAt', 'application', 'workflow', 'configuration', 'artifacts', 'steps', 'summary', 'limitations', 'integrity'], 'Investigation manifest');
-    iso(root.generatedAt, 'Investigation manifest generatedAt');
-    const application = exact(root.application, ['name', 'version'], 'Investigation manifest application');
-    if (application.name !== 'WHOISleuth CLI' || typeof application.version !== 'string'
-        || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u.test(application.version))
-        fail('Investigation manifest application');
-    text(root.workflow, 'Investigation manifest workflow', 160);
-    const configuration = exact(root.configuration, ['digestSha256'], 'Investigation manifest configuration');
-    if (configuration.digestSha256 !== null)
-        digest(configuration.digestSha256, 'Investigation manifest configuration');
-    const artifacts = array(root.artifacts, 'Investigation manifest artifacts', MAX_INVESTIGATION_MANIFEST_ARTIFACTS, 1);
-    const steps = array(root.steps, 'Investigation manifest steps', MAX_INVESTIGATION_MANIFEST_ARTIFACTS, 1);
-    let totalBytes = 0;
-    for (const [index, candidate] of artifacts.entries()) {
-        const item = exact(candidate, ['sequence', 'id', 'schema', 'version', 'byteLength', 'contentDigestSha256', 'canonicalDigestSha256'], `Investigation manifest artifact ${index + 1}`);
-        if (integer(item.sequence, 'Investigation manifest artifact sequence', 1, artifacts.length) !== index + 1
-            || item.id !== `artifact-${index + 1}`)
-            fail('Investigation manifest artifact order');
-        if (item.schema !== null)
-            text(item.schema, 'Investigation manifest artifact schema', 160);
-        if (item.version !== null)
-            integer(item.version, 'Investigation manifest artifact version', 1, 1_000);
-        totalBytes += integer(item.byteLength, 'Investigation manifest artifact bytes', 1, 15 * 1024 * 1024);
-        digest(item.contentDigestSha256, 'Investigation manifest content digest');
-        digest(item.canonicalDigestSha256, 'Investigation manifest canonical digest');
-        const step = exact(steps[index], ['sequence', 'artifactId', 'contentDigestSha256'], `Investigation manifest step ${index + 1}`);
-        if (step.sequence !== item.sequence || step.artifactId !== item.id || step.contentDigestSha256 !== item.contentDigestSha256)
-            fail('Investigation manifest step linkage');
-    }
-    const summary = exact(root.summary, ['artifactCount', 'totalBytes'], 'Investigation manifest summary');
-    if (integer(summary.artifactCount, 'Investigation manifest artifact count', 1, MAX_INVESTIGATION_MANIFEST_ARTIFACTS) !== artifacts.length
-        || integer(summary.totalBytes, 'Investigation manifest total bytes', 1, MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES) !== totalBytes)
-        fail('Investigation manifest summary');
-    strings(root.limitations, 'Investigation manifest limitations', 8, 600);
-    validateIntegrity(root.integrity, 'Investigation manifest integrity', root.version, INVESTIGATION_MANIFEST_VERSION);
+function validateSourceObservations(value, label, queryCoverage) {
+    const names = new Set();
+    let queryCount = 0;
+    return array(value, label, 16).map((candidate) => {
+        const source = exact(candidate, ['label', 'source', 'state', 'observedAt', ...(queryCoverage ? ['queries'] : [])], label);
+        const name = text(source.label, `${label} label`, 120).toLowerCase();
+        if (names.has(name))
+            fail(`${label} duplicate label`);
+        names.add(name);
+        text(source.source, `${label} source`, 240);
+        enumeration(source.state, ['observed', 'partial', 'unavailable'], `${label} state`);
+        iso(source.observedAt, `${label} observedAt`);
+        if (queryCoverage) {
+            const keys = new Set();
+            const queries = array(source.queries, `${label} queries`, 500 - queryCount);
+            queryCount += queries.length;
+            for (const candidate of queries) {
+                const query = exact(candidate, ['owner', 'type', 'state'], `${label} query`);
+                text(query.owner, `${label} query owner`, 253);
+                enumeration(query.type, DNS_TYPES, `${label} query type`);
+                enumeration(query.state, ['observed', 'partial', 'unavailable'], `${label} query state`);
+                const key = `${query.owner}\u0000${query.type}`;
+                if (keys.has(key))
+                    fail(`${label} duplicate query`);
+                keys.add(key);
+                if ((source.state === 'observed' && query.state !== 'observed')
+                    || (source.state === 'unavailable' && query.state !== 'unavailable'))
+                    fail(`${label} query state`);
+            }
+        }
+        return source;
+    });
 }
-function validateReviewMatrix(value, label) {
+function validateReviewMatrix(value, label, sources, queryCoverage = false) {
+    const rowKeys = new Set();
     for (const [rowIndex, candidate] of array(value, label, 500).entries()) {
         const row = exact(candidate, ['owner', 'type', 'state', 'observations'], `${label} row ${rowIndex + 1}`);
         text(row.owner, `${label} owner`, 253);
         enumeration(row.type, DNS_TYPES, `${label} type`);
+        const key = `${row.owner}\u0000${row.type}`;
+        if (queryCoverage && rowKeys.has(key))
+            fail(`${label} duplicate row`);
+        rowKeys.add(key);
         const observations = array(row.observations, `${label} observations`, 16);
+        if (sources && observations.length !== sources.length)
+            fail(`${label} source coverage`);
         let complete = 0;
         const signatures = new Set();
+        const names = new Set();
         for (const observationCandidate of observations) {
-            const observation = exact(observationCandidate, ['label', 'source', 'state', 'values', 'ttlRange'], `${label} observation`);
+            const observation = exact(observationCandidate, ['label', 'source', 'state', 'values', 'ttlRange', ...(sources ? ['observedAt'] : [])], `${label} observation`);
             text(observation.label, `${label} observation label`, 120);
             text(observation.source, `${label} observation source`, 240);
-            const state = enumeration(observation.state, ['observed', 'partial', 'unavailable'], `${label} observation state`);
+            const state = enumeration(observation.state, ['observed', 'partial', 'unavailable', ...(queryCoverage ? ['not_queried'] : [])], `${label} observation state`);
             const values = strings(observation.values, `${label} observation values`, 500, 16_384);
+            if (sources) {
+                const name = String(observation.label).toLowerCase();
+                if (names.has(name))
+                    fail(`${label} duplicate observation`);
+                names.add(name);
+                const source = sources.find((item) => item.label === observation.label);
+                const provenance = queryCoverage ? ['label', 'source', 'observedAt'] : ['label', 'source', 'state', 'observedAt'];
+                if (!source || provenance.some((key) => observation[key] !== source[key]))
+                    fail(`${label} source provenance`);
+                if (queryCoverage) {
+                    const query = source.queries.find((item) => item.owner === row.owner && item.type === row.type);
+                    if (state !== (query?.state ?? 'not_queried'))
+                        fail(`${label} query provenance`);
+                    if (['not_queried', 'unavailable'].includes(state) && (values.length || observation.ttlRange !== null))
+                        fail(`${label} unavailable values`);
+                }
+                iso(observation.observedAt, `${label} observation time`);
+            }
             if (state === 'observed') {
                 complete += 1;
                 signatures.add(JSON.stringify(values));
@@ -376,20 +421,28 @@ function validateReviewMatrix(value, label) {
                     fail(`${label} TTL range`);
             }
         }
-        const expected = complete < 2 ? 'insufficient' : signatures.size === 1 ? 'aligned' : 'different';
+        const expected = complete < 2 || (queryCoverage && complete !== observations.length) ? 'insufficient' : signatures.size === 1 ? 'aligned' : 'different';
         if (row.state !== expected)
             fail(`${label} state`);
     }
+    if (queryCoverage && sources) {
+        const expectedKeys = new Set(sources.flatMap((source) => source.queries.map((item) => `${item.owner}\u0000${item.type}`)));
+        if (rowKeys.size !== expectedKeys.size || [...rowKeys].some((key) => !expectedKeys.has(key)))
+            fail(`${label} query coverage`);
+    }
 }
-function validateDomainChangeReview(value, label) {
-    const review = exact(value, ['schema', 'version', 'generatedAt', 'domain', 'state', 'authoritativeRecordMatrix', 'resolverDivergenceMatrix', 'dnssecAutomation', 'acmeDependencies', 'certificate', 'services', 'hsts', 'gate', 'limitations'], label);
-    if (review.schema !== 'whoisleuth.domain-change.review' || review.version !== 1)
+function validateDomainChangeReview(value, label, version) {
+    const retainedTimes = version >= 2;
+    const queryCoverage = version >= 3;
+    const review = exact(value, ['schema', 'version', 'generatedAt', 'domain', 'state', 'authoritativeRecordMatrix', 'resolverDivergenceMatrix', 'dnssecAutomation', 'acmeDependencies', 'certificate', 'services', 'hsts', 'gate', 'limitations', ...(retainedTimes ? ['sourceObservations'] : [])], label);
+    if (review.schema !== DOMAIN_CHANGE_REVIEW_SCHEMA || review.version !== version)
         fail(label);
     iso(review.generatedAt, `${label} generatedAt`);
     domain(review.domain, `${label} domain`);
     enumeration(review.state, ['ready', 'review'], `${label} state`);
-    validateReviewMatrix(review.authoritativeRecordMatrix, `${label} authority matrix`);
-    validateReviewMatrix(review.resolverDivergenceMatrix, `${label} resolver matrix`);
+    const sources = retainedTimes ? exact(review.sourceObservations, ['authorities', 'resolvers'], `${label} source observations`) : null;
+    validateReviewMatrix(review.authoritativeRecordMatrix, `${label} authority matrix`, sources ? validateSourceObservations(sources.authorities, `${label} authority sources`, queryCoverage) : undefined, queryCoverage);
+    validateReviewMatrix(review.resolverDivergenceMatrix, `${label} resolver matrix`, sources ? validateSourceObservations(sources.resolvers, `${label} resolver sources`, queryCoverage) : undefined, queryCoverage);
     const automation = exact(review.dnssecAutomation, ['state', 'cdsObserved', 'cdnskeyObserved', 'csyncObserved', 'conflictingTypes', 'detail'], `${label} DNSSEC automation`);
     enumeration(automation.state, ['not_observed', 'conflict', 'partial', 'review_ready'], `${label} DNSSEC automation`);
     boolean(automation.cdsObserved, `${label} CDS observed`);
@@ -405,8 +458,13 @@ function validateDomainChangeReview(value, label) {
         optionalText(dependency.provider, `${label} ACME provider`, 120);
         enumeration(dependency.state, ['confirmed', 'partial', 'unknown'], `${label} ACME state`);
     }
-    const certificate = exact(review.certificate, ['state', 'continuity', 'findings'], `${label} certificate`);
+    const certificate = exact(review.certificate, ['state', 'continuity', 'findings', ...(retainedTimes ? ['observedAt'] : [])], `${label} certificate`);
     enumeration(certificate.state, ['not_supplied', 'observed', 'partial', 'unavailable'], `${label} certificate state`);
+    if (retainedTimes) {
+        iso(certificate.observedAt, `${label} certificate observedAt`, true);
+        if ((certificate.state === 'not_supplied') !== (certificate.observedAt === null))
+            fail(`${label} certificate observation time`);
+    }
     enumeration(certificate.continuity, ['unknown', 'retained', 'changes'], `${label} certificate continuity`);
     strings(certificate.findings, `${label} certificate findings`, 8, 600);
     for (const candidate of array(review.services, `${label} services`, 1_000)) {
@@ -496,7 +554,7 @@ function validatePlannedAssurance(value, label) {
     strings(assurance.limitations, `${label} limitations`, 8, 600);
     return assurance;
 }
-function expectedDomainChangeSummary(before, after) {
+function expectedDomainChangeSummary(before, after, queryCoverage) {
     const rows = (review) => new Map(review.authoritativeRecordMatrix.map((row) => [`${row.owner}\u0000${row.type}`, row]));
     const beforeRows = rows(before);
     const afterRows = rows(after);
@@ -508,7 +566,7 @@ function expectedDomainChangeSummary(before, after) {
     };
     const rowEvidence = (review, row) => {
         if (!row)
-            return { state: collectionComplete(review) ? 'complete' : 'unavailable', values: [] };
+            return { state: !queryCoverage && collectionComplete(review) ? 'complete' : 'unavailable', values: [] };
         const observations = row.observations;
         if (observations.some((item) => item.state !== 'observed'))
             return { state: 'partial', values: [] };
@@ -519,21 +577,28 @@ function expectedDomainChangeSummary(before, after) {
         return { state: 'complete', values: [...new Set(observations.flatMap((item) => item.values))].sort() };
     };
     const changed = [];
+    const reasons = queryCoverage && keys.length > 500 ? ['The comparison exceeds 500 owner and record-type pairs.'] : [];
     for (const key of keys.slice(0, 500)) {
         const left = rowEvidence(before, beforeRows.get(key));
         const right = rowEvidence(after, afterRows.get(key));
         const [owner, type] = key.split('\u0000');
         if (left.state !== 'complete' || right.state !== 'complete') {
+            if (queryCoverage)
+                reasons.push(`Comparison evidence is incomplete for ${owner} ${type}.`);
             continue;
         }
         else if (!sameValues(left.values, right.values)) {
             changed.push({ owner: owner ?? '', type: type ?? '', beforeValues: left.values, afterValues: right.values });
         }
     }
-    return changed;
+    return { changed, reasons };
 }
 function validateDomainChangePacket(value) {
     const root = exact(value, ['schema', 'version', 'generatedAt', 'domain', 'reference', 'state', 'gate', 'summary', 'evidence', 'limitations', 'integrity'], 'Domain change packet');
+    const version = integer(root.version, 'Domain change packet version', 1, 1_000);
+    const reviewVersion = DOMAIN_CHANGE_PACKET_REVIEW_VERSIONS[version];
+    if (reviewVersion === undefined)
+        fail('Domain change packet version');
     iso(root.generatedAt, 'Domain change packet generatedAt');
     domain(root.domain, 'Domain change packet domain');
     text(root.reference, 'Domain change packet reference', 200);
@@ -556,8 +621,8 @@ function validateDomainChangePacket(value) {
     enumeration(summary.postChangeState, ['ready', 'review'], 'Domain change packet post-change state');
     enumeration(summary.assuranceState, ['incomplete', 'needs_review', 'ready'], 'Domain change packet assurance state');
     const evidence = exact(root.evidence, ['preChange', 'postChange', 'assurance'], 'Domain change packet evidence');
-    const pre = validateDomainChangeReview(evidence.preChange, 'Domain change packet pre-change review');
-    const post = validateDomainChangeReview(evidence.postChange, 'Domain change packet post-change review');
+    const pre = validateDomainChangeReview(evidence.preChange, 'Domain change packet pre-change review', reviewVersion);
+    const post = validateDomainChangeReview(evidence.postChange, 'Domain change packet post-change review', reviewVersion);
     const assurance = validatePlannedAssurance(evidence.assurance, 'Domain change packet assurance');
     const assuranceResult = assurance.result;
     if (pre.generatedAt !== root.generatedAt || post.generatedAt !== root.generatedAt || assurance.generatedAt !== root.generatedAt
@@ -568,13 +633,14 @@ function validateDomainChangePacket(value) {
     const expectedReasons = [
         ...pre.gate.reasons,
     ].map((reason) => `Pre-change evidence: ${reason}`);
-    expectedReasons.push(...post.gate.reasons.map((reason) => `Post-change evidence: ${reason}`), ...(assuranceResult.review.reasons.map((reason) => `Change plan: ${reason}`)));
+    const comparison = expectedDomainChangeSummary(pre, post, reviewVersion >= 3);
+    expectedReasons.push(...post.gate.reasons.map((reason) => `Post-change evidence: ${reason}`), ...(assuranceResult.review.reasons.map((reason) => `Change plan: ${reason}`)), ...comparison.reasons);
     const boundedReasons = expectedReasons.slice(0, 100);
     if (!sameValues(gateReasons, boundedReasons)
         || gate.pass !== (boundedReasons.length === 0)
         || root.state !== (boundedReasons.length === 0 ? 'ready' : 'review'))
         fail('Domain change packet gate');
-    const expectedChanges = expectedDomainChangeSummary(pre, post);
+    const expectedChanges = comparison.changed;
     if (changed.length !== expectedChanges.length || changed.some((candidate, index) => {
         const item = candidate;
         const expected = expectedChanges[index];
@@ -584,13 +650,15 @@ function validateDomainChangePacket(value) {
     }))
         fail('Domain change packet summary');
     strings(root.limitations, 'Domain change packet limitations', 8, 600);
-    validateIntegrity(root.integrity, 'Domain change packet integrity', root.version, DOMAIN_CHANGE_PACKET_VERSION);
+    validateIntegrity(root.integrity, 'Domain change packet integrity', root.version, version);
 }
 export function validateSignedDigestArtifactStructure(schema, value) {
     if (value.schema !== schema)
         fail('Signed review artefact');
     if (schema === ACQUISITION_DECISION_PACKET_SCHEMA)
         validateAcquisition(value);
+    else if (schema === MANAGED_INDICATOR_SET_SCHEMA)
+        validateManagedIndicatorSet(value);
     else if (schema === LOOKUP_CLAIM_PASSPORT_SCHEMA)
         validateLookupClaimPassport(value);
     else if (schema === BULK_DOMAIN_COMPARISON_SCHEMA)

package/cli/artifact-validation/structure-primitives.mjs

@@ -1,105 +1 @@
-const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
-const DIGEST_RE = /^sha256:[a-f0-9]{64}$/u;
-const DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
-export const HEX_DIGEST_RE = /^[a-f0-9]{64}$/u;
-export const SEMANTIC_VERSION_RE = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
-export function fail(label) {
-    throw new TypeError(`${label} has an unsupported or malformed structure.`);
-}
-export function record(value, label) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        fail(label);
-    return value;
-}
-export function exact(value, keys, label) {
-    const source = record(value, label);
-    const actual = Object.keys(source);
-    if (actual.length !== keys.length || actual.some((key) => !keys.includes(key)))
-        fail(label);
-    return source;
-}
-export function exactOptional(value, required, optional, label) {
-    const source = record(value, label);
-    const actual = Object.keys(source);
-    if (required.some((key) => !actual.includes(key))
-        || actual.some((key) => !required.includes(key) && !optional.includes(key)))
-        fail(label);
-    return source;
-}
-export function text(value, label, maximum = 2_000, allowEmpty = false) {
-    if (typeof value !== 'string' || value.length > maximum || CONTROL_RE.test(value) || (!allowEmpty && !value))
-        fail(label);
-    return value;
-}
-export function optionalText(value, label, maximum = 2_000) {
-    if (value !== null)
-        text(value, label, maximum);
-}
-export function iso(value, label, nullable = false) {
-    if (nullable && value === null)
-        return;
-    const candidate = text(value, label, 64);
-    const parsed = Date.parse(candidate);
-    if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== candidate)
-        fail(label);
-}
-export function integer(value, label, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) {
-    if (!Number.isSafeInteger(value) || Number(value) < minimum || Number(value) > maximum)
-        fail(label);
-    return Number(value);
-}
-export function boolean(value, label) {
-    if (typeof value !== 'boolean')
-        fail(label);
-}
-export function enumeration(value, allowed, label) {
-    if (typeof value !== 'string' || !allowed.includes(value))
-        fail(label);
-    return value;
-}
-export function array(value, label, maximum, minimum = 0) {
-    if (!Array.isArray(value) || value.length < minimum || value.length > maximum)
-        fail(label);
-    return value;
-}
-export function strings(value, label, maximum, textMaximum = 2_000) {
-    const values = array(value, label, maximum);
-    for (const item of values)
-        text(item, label, textMaximum);
-    return values;
-}
-export function digest(value, label) {
-    if (typeof value !== 'string' || !DIGEST_RE.test(value))
-        fail(label);
-}
-export function sameValues(left, right) {
-    return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-export function domain(value, label) {
-    if (typeof value !== 'string' || !DOMAIN_RE.test(value))
-        fail(label);
-}
-export function absoluteUrl(value, label, protocols) {
-    const candidate = text(value, label, 2_048);
-    try {
-        const parsed = new URL(candidate);
-        if (!protocols.includes(parsed.protocol) || parsed.username || parsed.password || parsed.search || parsed.hash)
-            fail(label);
-        return parsed;
-    }
-    catch {
-        return fail(label);
-    }
-}
-export function nullableRecord(value, label) {
-    if (value !== null)
-        record(value, label);
-}
-export function validateIntegrity(value, label, version, currentVersion) {
-    if (version !== currentVersion)
-        fail(label);
-    const integrity = exact(value, ['algorithm', 'canonicalization', 'digestSha256'], label);
-    if (integrity.algorithm !== 'SHA-256' || integrity.canonicalization !== 'sorted-json-v2')
-        fail(label);
-    digest(integrity.digestSha256, label);
-}
+export * from "../../packages/evidence/artifact-structure.mjs";