@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/packages/investigation/message-intake.mjs

@@ -0,0 +1,195 @@
+import PostalMime, {} from 'postal-mime';
+import { parse, defaultTreeAdapter } from 'parse5';
+import { sha256ArtifactBytes } from "../evidence/artifact-integrity.mjs";
+import { createLinkIntake } from "./link-intake.mjs";
+import { AUTHENTICATION_METHODS, addressDomains, authenticationServiceDomains, dkimSigningDomains } from "./mail-header-identity.mjs";
+import { createIntakeReport } from "./intake-report.mjs";
+export { assertMessageBytes } from "./intake-report.mjs";
+import { requestedActionHints } from "./requested-action-hints.mjs";
+import { reviewMailAuthentication, aggregateMailAuthentication } from "./mail-authentication-review.mjs";
+import { MAX_AUTHENTICATION_HEADERS } from "../contracts/mail-authentication.mjs";
+import { MAX_MESSAGE_INTAKE_BYTES, MAX_MESSAGE_PARTS, MAX_MESSAGE_DEPTH, MAX_MESSAGE_HTML_NODES } from "../contracts/message-intake.mjs";
+/** All parsing is inert. Only HTTP(S) link targets are offered for deliberate collection. */
+export async function reviewMessageInput(bytes, kind, reviewedAt, qrText) {
+    const base = await createIntakeReport(bytes, kind, reviewedAt);
+    if (!['text', 'email', 'calendar', 'qr'].includes(kind))
+        throw new TypeError('Use the selected-file intake entry point for this format.');
+    const links = createLinkIntake(), identities = [], authenticationClaims = [];
+    const actionHints = new Set(), bounds = new Set();
+    const authenticationHeaders = [];
+    const messageParts = [];
+    let omittedAuthenticationHeaders = 0;
+    let partialAuthentication = false;
+    let reviewedParts = 0, unreviewedAttachments = 0, decodedBytes = 0;
+    const text = (value, source) => {
+        for (const hint of requestedActionHints(value))
+            actionHints.add(hint);
+        links.addText(value, source);
+    };
+    function html(value) {
+        // parse5 never renders, loads resources, or runs supplied script.
+        let allocated = 0;
+        const htmlBound = new Error('HTML work bound');
+        const admit = () => { if (++allocated > MAX_MESSAGE_HTML_NODES)
+            throw htmlBound; };
+        let tree;
+        try {
+            tree = parse(value, { treeAdapter: { ...defaultTreeAdapter,
+                    createElement(...args) { admit(); return defaultTreeAdapter.createElement(...args); },
+                    createTextNode(...args) { admit(); return defaultTreeAdapter.createTextNode(...args); },
+                    createCommentNode(...args) { admit(); return defaultTreeAdapter.createCommentNode(...args); },
+                } });
+        }
+        catch (cause) {
+            if (cause !== htmlBound)
+                throw cause;
+            bounds.add('HTML nodes');
+            return;
+        }
+        const queue = [tree];
+        let nodes = 0;
+        while (queue.length) {
+            if (++nodes > MAX_MESSAGE_HTML_NODES) {
+                bounds.add('HTML nodes');
+                break;
+            }
+            const node = queue.pop();
+            if ('tagName' in node) {
+                const attrs = new Map(node.attrs.map(attr => [attr.name, attr.value]));
+                if (node.tagName === 'a' && attrs.has('href')) {
+                    const shown = [], children = [...node.childNodes];
+                    let count = 0;
+                    while (children.length && ++count <= MAX_MESSAGE_HTML_NODES) {
+                        const child = children.pop();
+                        if ('value' in child)
+                            shown.push(child.value);
+                        if ('childNodes' in child)
+                            children.push(...child.childNodes);
+                    }
+                    links.add(attrs.get('href'), 'html_link', shown.reverse().join('').trim());
+                }
+                if (node.tagName === 'form' && attrs.has('action'))
+                    links.add(attrs.get('action'), 'html_form');
+                if ((node.tagName === 'iframe' || node.tagName === 'frame') && attrs.has('src'))
+                    links.add(attrs.get('src'), 'html_frame');
+                if (node.tagName === 'script' || node.tagName === 'style')
+                    continue;
+            }
+            if ('value' in node)
+                text(node.value, 'text');
+            if ('childNodes' in node)
+                for (let index = node.childNodes.length - 1; index >= 0; index--)
+                    queue.push(node.childNodes[index]);
+        }
+    }
+    function calendar(value) {
+        const unfolded = value.replace(/\r?\n[ \t]/gu, '');
+        // No attendee names, addresses, descriptions or event identifiers enter the report.
+        for (const line of unfolded.split(/\r?\n/u)) {
+            const colon = line.indexOf(':');
+            if (colon < 0)
+                continue;
+            const key = line.slice(0, colon).split(';', 1)[0]?.toUpperCase();
+            if (['URL', 'DESCRIPTION', 'LOCATION', 'X-ALT-DESC'].includes(key ?? ''))
+                text(line.slice(colon + 1).replace(/\\n/giu, '\n').replace(/\\([,;\\])/gu, '$1'), 'calendar');
+        }
+    }
+    function identity(part, role, domains) {
+        for (const domain of domains)
+            identities.push({ part, role, domain });
+    }
+    function headers(mail, part) {
+        const sourceReview = reviewMailAuthentication(mail.headers.map(header => ({ name: header.key, value: header.value })), part, MAX_AUTHENTICATION_HEADERS - authenticationHeaders.length);
+        authenticationHeaders.push(...sourceReview.headers);
+        omittedAuthenticationHeaders += sourceReview.omittedHeaders;
+        partialAuthentication ||= sourceReview.headers.some(header => !['parsed', 'none'].includes(header.state));
+        if (sourceReview.omittedHeaders)
+            bounds.add('Authentication headers');
+        const values = (name) => mail.headers.filter(header => header.key === name).map(header => header.value);
+        identity(part, 'from', addressDomains(values('from')));
+        identity(part, 'reply_to', addressDomains(values('reply-to')));
+        identity(part, 'return_path', addressDomains(values('return-path')));
+        identity(part, 'dkim', dkimSigningDomains(values('dkim-signature')));
+        const reported = values('authentication-results');
+        identity(part, 'authentication_service', authenticationServiceDomains(reported));
+        const aggregate = aggregateMailAuthentication(sourceReview);
+        for (const method of AUTHENTICATION_METHODS) {
+            const claim = aggregate[method];
+            if (claim.observations)
+                authenticationClaims.push({ part, method, result: claim.state });
+        }
+    }
+    async function message(input, depth, parentPart) {
+        if (depth > MAX_MESSAGE_DEPTH || reviewedParts >= MAX_MESSAGE_PARTS) {
+            bounds.add('Message nesting or parts');
+            unreviewedAttachments++;
+            return;
+        }
+        decodedBytes += input.byteLength;
+        if (decodedBytes > MAX_MESSAGE_INTAKE_BYTES * 2) {
+            bounds.add('Decoded message bytes');
+            unreviewedAttachments++;
+            return;
+        }
+        let mail;
+        try {
+            mail = await PostalMime.parse(input, { maxNestingDepth: MAX_MESSAGE_DEPTH, maxHeadersSize: 256 * 1024, rfc822Attachments: true, forceRfc822Attachments: true, attachmentEncoding: 'arraybuffer' });
+        }
+        catch {
+            throw new TypeError('The message could not be decoded within the MIME nesting and header limits. No input was retained.');
+        }
+        const part = ++reviewedParts;
+        messageParts.push({ part, parentPart, digestSha256: parentPart === null ? base.source.digestSha256 : await sha256ArtifactBytes(input), byteLength: input.byteLength });
+        headers(mail, part);
+        if (mail.text)
+            text(mail.text, 'text');
+        if (mail.html)
+            html(mail.html);
+        for (const attachment of mail.attachments) {
+            if (reviewedParts >= MAX_MESSAGE_PARTS) {
+                bounds.add('Message parts');
+                unreviewedAttachments++;
+                continue;
+            }
+            const body = typeof attachment.content === 'string' ? new TextEncoder().encode(attachment.content) : new Uint8Array(attachment.content);
+            if (attachment.mimeType === 'message/rfc822')
+                await message(body, depth + 1, part);
+            else if (attachment.mimeType === 'text/calendar') {
+                reviewedParts++;
+                calendar(new TextDecoder().decode(body));
+            }
+            else {
+                unreviewedAttachments++;
+            }
+        }
+    }
+    if (kind === 'email')
+        await message(bytes, 0, null);
+    else if (kind === 'qr') {
+        if (!Array.isArray(qrText) || qrText.length > MAX_MESSAGE_PARTS || qrText.some(value => typeof value !== 'string' || value.length > 8_192))
+            throw new TypeError('QR review requires bounded decoded text.');
+        reviewedParts = qrText.length;
+        for (const value of qrText) {
+            for (const hint of requestedActionHints(value))
+                actionHints.add(hint);
+            links.addQr(value);
+        }
+    }
+    else {
+        reviewedParts = 1;
+        const value = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        if (kind === 'calendar')
+            calendar(value);
+        else
+            text(value, 'text');
+    }
+    const result = links.result();
+    for (const limitation of result.limitations)
+        bounds.add(limitation);
+    if (result.bounded)
+        bounds.add('Link extraction');
+    return { report: { ...base,
+            coverage: { state: bounds.size || unreviewedAttachments || partialAuthentication ? 'partial' : 'reviewed', reviewedParts, unreviewedAttachments, rejectedLinks: result.rejected, boundsReached: [...bounds] },
+            identities, authenticationClaims, authenticationReview: { headers: authenticationHeaders, omittedHeaders: omittedAuthenticationHeaders }, messageParts,
+            links: result.links, actionHints: [...actionHints] }, targets: result.targets };
+}

package/packages/investigation/page-behaviour.mjs

@@ -0,0 +1,113 @@
+import { array, boolean, enumeration, exact, integer, text, HEX_DIGEST_RE } from "../evidence/artifact-structure.mjs";
+import { MESSAGE_ACTION_HINTS } from "../contracts/message-intake.mjs";
+import { readCaptureCoverage, captureCoverageIsPartial, captureAttemptDescription } from "./capture-coverage.mjs";
+export const PAGE_BEHAVIOUR_VERSION = 1;
+// Separate from the capture's request, DOM traversal and aggregate byte bounds.
+export const MAX_PAGE_OBSERVATIONS = 500;
+export const PAGE_ACTION_HINTS = MESSAGE_ACTION_HINTS;
+export function pageObservationOrigin(raw, base) {
+    if (typeof raw !== 'string' || raw.length > 8_192 || /[\u0000-\u0020\u007f]/u.test(raw))
+        return null;
+    try {
+        const url = new URL(raw, base);
+        return ['https:', 'http:'].includes(url.protocol) && !url.username && !url.password ? url.origin : null;
+    }
+    catch {
+        return null;
+    }
+}
+function origin(value, nullable = false) {
+    if (nullable && value === null)
+        return null;
+    const candidate = text(value, 'Page observation origin', 500);
+    if (pageObservationOrigin(candidate) !== candidate)
+        throw new TypeError('Page observations retain origins only.');
+    return candidate;
+}
+function hash(value) {
+    if (value === null)
+        return null;
+    if (typeof value !== 'string' || !HEX_DIGEST_RE.test(value))
+        throw new TypeError('Page observation digest must be SHA-256.');
+    return value;
+}
+function ordered(values) {
+    if (values.some((value, index) => index > 0 && value.position <= values[index - 1].position))
+        throw new TypeError('Page observation positions must be unique and increasing.');
+    return values;
+}
+export function readPageBehaviour(raw) {
+    const value = exact(raw, ['version', 'state', 'requests', 'elements', 'actionHints', 'clipboardWriteAttempts', 'coverage'], 'Page behaviour');
+    if (value.version !== PAGE_BEHAVIOUR_VERSION)
+        throw new TypeError('Unsupported page behaviour version.');
+    const requests = ordered(array(value.requests, 'Page requests', MAX_PAGE_OBSERVATIONS).map(raw => {
+        const item = exact(raw, ['position', 'kind', 'origin', 'contentSha256', 'status', 'cspEnforced', 'cspReportOnly'], 'Page request');
+        boolean(item.cspEnforced, 'Enforced policy presence');
+        boolean(item.cspReportOnly, 'Report-only policy presence');
+        const kind = enumeration(item.kind, ['navigation', 'script', 'frame', 'document'], 'Page request kind'), contentSha256 = hash(item.contentSha256);
+        if (kind !== 'script' && contentSha256 !== null)
+            throw new TypeError('Only script response bodies are hashed in page observations.');
+        return { position: integer(item.position, 'Request position', 1, 10_000), kind, origin: origin(item.origin), contentSha256,
+            status: integer(item.status, 'Response status', 100, 599), cspEnforced: item.cspEnforced, cspReportOnly: item.cspReportOnly };
+    }));
+    const elements = ordered(array(value.elements, 'Page elements', MAX_PAGE_OBSERVATIONS).map(raw => {
+        const item = exact(raw, ['position', 'kind', 'origin', 'inline', 'integrity', 'method', 'passwordFields', 'scriptSha256'], 'Page element');
+        const kind = enumeration(item.kind, ['script', 'frame', 'form'], 'Page element kind');
+        boolean(item.inline, 'Inline script');
+        const method = item.method === null ? null : enumeration(item.method, ['get', 'post', 'other'], 'Form method');
+        const passwordFields = integer(item.passwordFields, 'Password field count', 0, 20_000), scriptSha256 = hash(item.scriptSha256);
+        const integrity = enumeration(item.integrity, ['present', 'absent', 'not_applicable'], 'Integrity attribute');
+        if (kind !== 'form' && (method !== null || passwordFields !== 0) || kind === 'form' && method === null
+            || kind !== 'script' && (item.inline || scriptSha256 !== null || integrity !== 'not_applicable')
+            || kind === 'script' && (item.inline && item.origin !== null || !item.inline && scriptSha256 !== null))
+            throw new TypeError('Page element fields do not match their kind.');
+        return { position: integer(item.position, 'Element position', 1, 20_000), kind, origin: origin(item.origin, true), inline: item.inline, integrity, method, passwordFields, scriptSha256 };
+    }));
+    const actionHints = array(value.actionHints, 'Requested-action hints', PAGE_ACTION_HINTS.length).map(raw => enumeration(raw, PAGE_ACTION_HINTS, 'Requested-action hint'));
+    if (new Set(actionHints).size !== actionHints.length)
+        throw new TypeError('Page action hints must not repeat.');
+    const coverage = readCaptureCoverage(value.coverage);
+    if (value.state === 'observed' && captureCoverageIsPartial(coverage))
+        throw new TypeError('Partial request coverage cannot declare complete page observations.');
+    return { version: PAGE_BEHAVIOUR_VERSION, state: enumeration(value.state, ['observed', 'partial'], 'Page observation state'), requests, elements, actionHints,
+        clipboardWriteAttempts: integer(value.clipboardWriteAttempts, 'Blocked clipboard attempts', 0, 1_000_000), coverage };
+}
+export function readManifestPageBehaviour(value, manifestVersion) {
+    if (manifestVersion === 2 && value === undefined)
+        return null;
+    if (manifestVersion !== 3)
+        throw new TypeError('Page behaviour requires capture manifest version 3.');
+    return readPageBehaviour(value);
+}
+/** A missing/partial observation cannot establish removal or unchanged content. */
+export function pageBehaviourRows(input) {
+    return [
+        ...input.requests.map(value => ({ identity: JSON.stringify(['request', value.kind, value.origin, value.contentSha256, value.status, value.cspEnforced, value.cspReportOnly]),
+            label: `${value.kind} response ${value.position} · HTTP ${value.status} · enforced CSP ${value.cspEnforced ? 'present' : 'absent'} · report-only CSP ${value.cspReportOnly ? 'present' : 'absent'}`, origin: value.origin, digest: value.contentSha256 })),
+        ...input.elements.map(value => ({ identity: JSON.stringify(['element', value.kind, value.origin, value.inline, value.integrity, value.method, value.passwordFields, value.scriptSha256]),
+            label: `${value.kind} element ${value.position}${value.inline ? ' · inline' : ''}${value.kind === 'form' ? ` · ${value.method} · ${value.passwordFields} password fields` : value.kind === 'script' ? ` · integrity attribute ${value.integrity}` : ''}`,
+            origin: value.origin, digest: value.scriptSha256 })),
+        ...input.actionHints.map(value => ({ identity: JSON.stringify(['action_wording', value]), label: `Body text wording · ${value.replaceAll('_', ' ')}`, origin: null, digest: null })),
+        ...input.coverage.attempts.filter(value => !['navigation', 'script', 'frame', 'document'].includes(value.channel) || value.state !== 'observed').map(value => ({
+            identity: JSON.stringify(['request_channel', value.channel, value.method, value.origin, value.state, value.reason, value.collectionStarted]),
+            label: `${value.channel.replaceAll('_', ' ')} request ${value.position} · ${captureAttemptDescription(value)}`,
+            origin: value.origin, digest: null,
+        })),
+    ];
+}
+export function comparePageBehaviour(before, after) {
+    const counts = (input) => { const map = new Map(); for (const row of input ? pageBehaviourRows(input) : [])
+        map.set(row.identity, { ...row, count: (map.get(row.identity)?.count ?? 0) + 1 }); return map; };
+    const left = counts(before), right = counts(after), complete = before?.state === 'observed' && after?.state === 'observed';
+    const difference = (a, b) => [...a.values()].filter(row => row.count > (b.get(row.identity)?.count ?? 0))
+        .map(row => ({ ...row, count: row.count - (b.get(row.identity)?.count ?? 0) }));
+    const added = difference(right, left), notReobserved = difference(left, right);
+    const navigation = (value) => value.requests.filter(row => row.kind === 'navigation').map(row => [row.origin, row.status]);
+    const navigationChanged = before && after ? JSON.stringify(navigation(before)) !== JSON.stringify(navigation(after)) : null;
+    const clipboardWriteDelta = before && after ? after.clipboardWriteAttempts - before.clipboardWriteAttempts : null;
+    const requestChannelsChanged = before && after ? JSON.stringify(before.coverage) !== JSON.stringify(after.coverage) : null;
+    return { state: !before || !after ? 'unavailable' : complete ? added.length || notReobserved.length || navigationChanged || clipboardWriteDelta || requestChannelsChanged ? 'changed' : 'unchanged' : 'inconclusive',
+        navigationChanged, clipboardWriteDelta, requestChannelsChanged,
+        added: before ? added : [], notReobserved: after ? notReobserved : [], removalEstablished: false,
+        boundary: 'Selected capture observations, not proof of authorisation, worldwide removal or compromise. Script hashes identify collected bytes; an integrity attribute is not a verified integrity result.' };
+}

package/packages/investigation/pdf-intake.mjs

@@ -0,0 +1,155 @@
+import { getDocument, ImageKind, OPS } from 'pdfjs-dist/legacy/build/pdf.mjs';
+import { createDocumentIntake } from "./document-intake.mjs";
+import { MAX_DOCUMENT_IMAGE_PIXELS, MAX_DOCUMENT_PAGES, MAX_DOCUMENT_TEXT_BYTES, MAX_DOCUMENT_PAGE_OPERATIONS } from "../contracts/document-intake.mjs";
+import { readEvidenceImageDimensions } from "../evidence/image-regions.mjs";
+import { MAX_INTAKE_LINKS, MAX_INTAKE_URL_LENGTH } from "../contracts/message-intake.mjs";
+/** No document-controlled resource can reach a filesystem or network fetcher. */
+class NoExternalBinaryData {
+    async fetch() { throw new TypeError('External PDF resources are not loaded.'); }
+}
+function imagePixels(raw) {
+    if (!raw || typeof raw !== 'object')
+        throw new TypeError('The PDF image is unavailable.');
+    const value = raw;
+    const { width, height } = readEvidenceImageDimensions(value.width, value.height);
+    if (!(value.data instanceof Uint8Array) && !(value.data instanceof Uint8ClampedArray))
+        throw new TypeError('The PDF image has no supported pixel data.');
+    const data = value.data, count = width * height, pixels = new Uint8ClampedArray(count * 4);
+    if (value.kind === ImageKind.RGBA_32BPP && data.length === pixels.length)
+        pixels.set(data);
+    else if (value.kind === ImageKind.RGB_24BPP && data.length === count * 3) {
+        for (let index = 0; index < count; index++) {
+            pixels.set(data.subarray(index * 3, index * 3 + 3), index * 4);
+            pixels[index * 4 + 3] = 255;
+        }
+    }
+    else if (value.kind === ImageKind.GRAYSCALE_1BPP && data.length === Math.ceil(width / 8) * height) {
+        const stride = Math.ceil(width / 8);
+        for (let y = 0; y < height; y++)
+            for (let x = 0; x < width; x++) {
+                const colour = data[y * stride + (x >> 3)] & (128 >> (x % 8)) ? 255 : 0;
+                pixels.set([colour, colour, colour, 255], (y * width + x) * 4);
+            }
+    }
+    else
+        throw new TypeError('The PDF image pixel layout is unsupported.');
+    return { width, height, pixels };
+}
+export async function reviewPdfInput(bytes, reviewedAt, worker) {
+    const review = await createDocumentIntake(bytes, 'pdf', reviewedAt);
+    // PDF.js takes ownership of its input. The selected original stays unchanged.
+    const task = getDocument({ data: bytes.slice(), ...(worker ? { worker } : {}),
+        BinaryDataFactory: NoExternalBinaryData, useWorkerFetch: false, useWasm: false,
+        useSystemFonts: false, disableFontFace: true, enableXfa: false,
+        isOffscreenCanvasSupported: false, isImageDecoderSupported: false,
+        maxImageSize: MAX_DOCUMENT_IMAGE_PIXELS, stopAtErrors: true, verbosity: 0,
+        disableAutoFetch: true, disableStream: true, disableRange: true });
+    try {
+        const document = await task.promise;
+        const total = document.numPages, admitted = Math.min(total, MAX_DOCUMENT_PAGES);
+        review.pages(total, 0);
+        if (total > admitted)
+            review.partial('Further PDF pages exceed the page review bound.');
+        if (document.isPureXfa) {
+            review.unavailable('unsupported', 'XFA documents are not rendered or executed.');
+            return review.finish();
+        }
+        let textCharacters = 0;
+        for (let pageNumber = 1; pageNumber <= admitted; pageNumber++) {
+            const page = await document.getPage(pageNumber);
+            try {
+                const reader = page.streamTextContent().getReader();
+                let text = '';
+                try {
+                    for (;;) {
+                        const chunk = await reader.read();
+                        if (chunk.done)
+                            break;
+                        for (const item of chunk.value.items) {
+                            if (typeof item.str !== 'string')
+                                continue;
+                            textCharacters += item.str.length + 1;
+                            if (textCharacters > MAX_DOCUMENT_TEXT_BYTES) {
+                                review.partial('Further PDF text exceeds the text review bound.');
+                                break;
+                            }
+                            text += item.str + (item.hasEOL ? '\n' : ' ');
+                        }
+                        if (textCharacters > MAX_DOCUMENT_TEXT_BYTES) {
+                            await reader.cancel();
+                            break;
+                        }
+                    }
+                    await review.text(text, pageNumber);
+                }
+                catch {
+                    review.partial(`Text on page ${pageNumber} could not be fully decoded.`);
+                }
+                finally {
+                    reader.releaseLock();
+                }
+                try {
+                    const annotations = await page.getAnnotations(), destinations = [];
+                    for (const annotation of annotations) {
+                        if (typeof annotation.url !== 'string')
+                            continue;
+                        if (annotation.url.length > MAX_INTAKE_URL_LENGTH || destinations.length >= MAX_INTAKE_LINKS) {
+                            review.partial(`Some links on page ${pageNumber} exceed the link review bound.`);
+                            continue;
+                        }
+                        destinations.push(annotation.url);
+                    }
+                    await review.destinations(destinations, pageNumber);
+                }
+                catch {
+                    review.partial(`Links on page ${pageNumber} could not be fully decoded.`);
+                }
+                try {
+                    const operations = await page.getOperatorList(), seen = new Set();
+                    if (operations.fnArray.length > MAX_DOCUMENT_PAGE_OPERATIONS)
+                        review.partial(`Image operations on page ${pageNumber} exceed the review bound.`);
+                    else
+                        for (let index = 0; index < operations.fnArray.length; index++) {
+                            const operation = operations.fnArray[index], args = operations.argsArray[index];
+                            let raw;
+                            if (operation === OPS.paintImageXObject || operation === OPS.paintImageXObjectRepeat) {
+                                const id = args?.[0];
+                                if (typeof id !== 'string' || seen.has(id))
+                                    continue;
+                                seen.add(id);
+                                raw = await new Promise(resolve => (id.startsWith('g_') ? page.commonObjs : page.objs).get(id, resolve));
+                            }
+                            else if (operation === OPS.paintInlineImageXObject)
+                                raw = args?.[0];
+                            else
+                                continue;
+                            try {
+                                await review.image(imagePixels(raw), pageNumber);
+                            }
+                            catch {
+                                review.partial(`An image on page ${pageNumber} has unsupported or unavailable pixels.`);
+                            }
+                        }
+                }
+                catch {
+                    review.partial(`Image operations on page ${pageNumber} could not be fully decoded.`);
+                }
+                review.pages(total, pageNumber);
+            }
+            finally {
+                page.cleanup();
+            }
+        }
+        review.partial('QR review covers decoded embedded raster images, not vector artwork or a rendered-page reconstruction. Scripts, forms, embedded files and external resources are not executed or opened.');
+    }
+    catch (cause) {
+        if (cause instanceof Error && cause.name === 'PasswordException')
+            review.unavailable('encrypted', 'The PDF requires a password. Review an explicitly decrypted copy; no password was requested or retained.');
+        else
+            review.unavailable('unsupported', 'The PDF could not be decoded completely within this review. The original bytes are unchanged.');
+    }
+    finally {
+        await task.destroy();
+    }
+    return review.finish();
+}

package/packages/investigation/platform-continuity-review.mjs

@@ -0,0 +1,60 @@
+import { array, enumeration, exact, iso, text } from "../evidence/artifact-structure.mjs";
+import { pageObservationOrigin } from "./page-behaviour.mjs";
+import { CASE_PROVIDER_OUTCOMES, CASE_OBSERVED_EFFECT_STATES } from "../cases/case-response-records.mjs";
+import { CONTEXT_REVIEW_SCHEMA, CONTEXT_REVIEW_VERSION, MAX_CONTEXT_RECORDS } from "../contracts/context-review.mjs";
+export { PLATFORM_CONTINUITY_INPUT_SCHEMA, PLATFORM_CONTINUITY_INPUT_VERSION } from "../contracts/context-review.mjs";
+export const PLATFORM_OBJECT_TYPES = ['account', 'tenant', 'application', 'extension', 'package', 'page', 'channel', 'post'];
+export const PLATFORM_REPORT_STATES = ['not_reported', 'submitted', 'acknowledged'];
+export function readPlatformObjects(raw) {
+    const rows = array(raw, 'Platform objects', MAX_CONTEXT_RECORDS).map(value => {
+        const row = exact(value, ['platformOrigin', 'objectType', 'objectId', 'version', 'observedAt', 'source', 'report', 'providerOutcome', 'recheck', 'recheckedAt'], 'Platform object');
+        const platformOrigin = text(row.platformOrigin, 'Platform origin', 500);
+        if (pageObservationOrigin(platformOrigin) !== platformOrigin)
+            throw new TypeError('Platform origin must be an HTTP(S) origin without credentials, paths or query data.');
+        const objectId = text(row.objectId, 'Stable object ID', 240);
+        if (!/^[A-Za-z0-9_@.:%/+~-]+$/u.test(objectId))
+            throw new TypeError('Stable object ID must contain identifier characters, not free text.');
+        iso(row.observedAt, 'Object observation time');
+        iso(row.recheckedAt, 'Object recheck time', true);
+        const recheck = enumeration(row.recheck, CASE_OBSERVED_EFFECT_STATES, 'Object recheck');
+        if ((recheck === 'not_checked') !== (row.recheckedAt === null))
+            throw new TypeError('A recheck result needs its own observation time; unchecked objects must not carry one.');
+        if (row.recheckedAt !== null && Date.parse(row.recheckedAt) < Date.parse(row.observedAt))
+            throw new TypeError('Object recheck predates its observation.');
+        const report = enumeration(row.report, PLATFORM_REPORT_STATES, 'Report status');
+        const providerOutcome = row.providerOutcome === null ? null : enumeration(row.providerOutcome, CASE_PROVIDER_OUTCOMES, 'Provider outcome');
+        if (providerOutcome !== null && report === 'not_reported')
+            throw new TypeError('A provider outcome needs a reported object.');
+        return { platformOrigin, objectType: enumeration(row.objectType, PLATFORM_OBJECT_TYPES, 'Platform object type'), objectId,
+            version: row.version === null ? null : text(row.version, 'Object version', 100), observedAt: row.observedAt, source: text(row.source, 'Object source', 500), report, providerOutcome, recheck, recheckedAt: row.recheckedAt };
+    });
+    const identities = rows.map(row => JSON.stringify([row.platformOrigin, row.objectType, row.objectId, row.version, row.observedAt]));
+    if (new Set(identities).size !== rows.length)
+        throw new TypeError('Duplicate platform object observations must be reconciled explicitly.');
+    return rows;
+}
+export function groupPlatformObjects(rows) {
+    const groups = new Map();
+    for (const row of rows) {
+        const key = JSON.stringify([row.platformOrigin, row.objectType, row.objectId]);
+        groups.set(key, [...(groups.get(key) ?? []), row]);
+    }
+    return [...groups.values()].map(values => values.sort((a, b) => Date.parse(a.observedAt) - Date.parse(b.observedAt)));
+}
+export function reviewPlatformContinuity(raw, reviewedAt) {
+    iso(reviewedAt, 'Review time');
+    const rows = readPlatformObjects(raw), groups = groupPlatformObjects(rows);
+    const observations = [];
+    for (const values of groups) {
+        const versions = new Set(values.map(row => row.version).filter(value => value !== null));
+        for (const row of values)
+            observations.push({ label: `${row.objectType} · ${row.objectId}${row.version ? ` · version ${row.version}` : ''}`, state: 'reported',
+                detail: `${row.report.replaceAll('_', ' ')}; provider outcome: ${row.providerOutcome?.replaceAll('_', ' ') ?? 'not supplied'}; independent recheck: ${row.recheck.replaceAll('_', ' ')}${row.recheckedAt ? ` at ${row.recheckedAt}` : ''}. ${versions.size > 1 ? `${versions.size} versions retained for this same declared object.` : 'No version change established.'}`,
+                source: `${row.platformOrigin} · ${row.source}`, observedAt: row.observedAt, hostname: new URL(row.platformOrigin).hostname });
+    }
+    const unresolved = rows.filter(row => ['not_checked', 'still_observed', 'changed', 'unavailable'].includes(row.recheck)).length;
+    return { schema: CONTEXT_REVIEW_SCHEMA, version: CONTEXT_REVIEW_VERSION, kind: 'platform_continuity', reviewedAt, title: 'Platform object continuity',
+        state: rows.length ? 'reviewed' : 'partial', summary: `Recorded observations: ${rows.length}; distinct platform objects: ${groups.length}; observations needing follow-up or a qualified outcome: ${unresolved}.`, observations,
+        nextSteps: ['Use the exact object and version when preparing a provider report; do not report an entire shared platform from a hosted URL alone.', 'Record each report and recheck separately. New versions, changed content and newly observed objects require their own review.'],
+        limitations: ['Platform origin, object identity and outcomes are analyst-supplied metadata, not verified provider telemetry.', 'A matching object ID establishes only declared continuity within that platform and object type. Provider resolution is separate from independent recheck; not reproduced does not establish worldwide removal.'] };
+}

package/packages/investigation/qr-intake.mjs

@@ -0,0 +1,56 @@
+import { binarize, Decoder, Detector } from '@nuintun/qrcode';
+import { decodeEvidencePng } from "../evidence/png-pixels.mjs";
+import { assertMessageBytes, reviewMessageInput } from "./message-intake.mjs";
+import { readEvidenceImageDimensions } from "../evidence/image-regions.mjs";
+export const MAX_QR_DETECTION_ATTEMPTS = 256;
+export function decodeQrPixels(image) {
+    readEvidenceImageDimensions(image.width, image.height);
+    if (!(image.pixels instanceof Uint8ClampedArray) || image.pixels.length !== image.width * image.height * 4)
+        throw new TypeError('Invalid QR pixel surface.');
+    const luminance = new Uint8Array(image.width * image.height);
+    for (let index = 0; index < luminance.length; index++) {
+        const offset = index * 4, alpha = image.pixels[offset + 3] / 255;
+        luminance[index] = Math.round((image.pixels[offset] * 0.299 + image.pixels[offset + 1] * 0.587 + image.pixels[offset + 2] * 0.114) * alpha + 255 * (1 - alpha));
+    }
+    const texts = new Set();
+    let attempts = 0, bounded = false, structured = false;
+    // Normal and inverted symbols are both considered, without altering originals.
+    for (const inverted of [false, true]) {
+        if (inverted)
+            for (let index = 0; index < luminance.length; index++)
+                luminance[index] = 255 - luminance[index];
+        const candidates = new Detector().detect(binarize(luminance, image.width, image.height)), decoder = new Decoder();
+        let candidate = candidates.next();
+        while (!candidate.done) {
+            if (++attempts > MAX_QR_DETECTION_ATTEMPTS) {
+                bounded = true;
+                candidates.return();
+                break;
+            }
+            let decoded = false;
+            try {
+                const symbol = decoder.decode(candidate.value.matrix);
+                decoded = true;
+                if (symbol.structured)
+                    structured = true;
+                else if (symbol.content.length <= 8_192)
+                    texts.add(symbol.content);
+                else
+                    bounded = true;
+            }
+            catch { /* A finder-pattern candidate need not contain a decodable symbol. */ }
+            candidate = candidates.next(decoded);
+        }
+        if (bounded)
+            break;
+    }
+    return { texts: [...texts], bounded, structured };
+}
+export async function reviewQrInput(bytes, reviewedAt) {
+    assertMessageBytes(bytes);
+    const { texts, bounded, structured } = decodeQrPixels(decodeEvidencePng(bytes));
+    const result = await reviewMessageInput(bytes, 'qr', reviewedAt, texts);
+    const boundsReached = [...result.report.coverage.boundsReached, ...(bounded ? ['QR candidate work'] : []), ...(structured ? ['Multi-symbol structured content requires reassembly'] : [])];
+    return { ...result, report: { ...result.report, coverage: { ...result.report.coverage,
+                state: boundsReached.length ? 'partial' : result.report.coverage.state, boundsReached } } };
+}

package/packages/investigation/requested-action-hints.mjs

@@ -0,0 +1,11 @@
+const HINTS = {
+    clipboard_instruction: /(?:clipboard|copy.{0,40}(?:paste|command)|paste.{0,40}(?:terminal|run|console))/iu,
+    shell_instruction: /(?:powershell|cmd\.exe|curl\s|wget\s|terminal|windows\s*\+\s*r)/iu,
+    verification_prompt: /(?:verify.{0,40}(?:human|browser)|not a robot|captcha|browser.{0,40}(?:repair|update))/iu,
+    device_code_instruction: /(?:device[ -]code|enter.{0,40}code.{0,40}(?:sign|login|log in))/iu,
+    consent_instruction: /(?:grant.{0,40}(?:access|permission)|consent|approve.{0,40}(?:application|permission))/iu,
+};
+/** Wording matches are review leads, never a conclusion about intent or execution. */
+export function requestedActionHints(value) {
+    return Object.entries(HINTS).filter(([, expression]) => expression.test(value)).map(([hint]) => hint);
+}

package/packages/investigation/selected-input-review.mjs

@@ -0,0 +1,17 @@
+/** One format dispatch for browser and CLI; parsers load only when selected. */
+export async function reviewSelectedInput(bytes, kind, reviewedAt, pdfWorker) {
+    switch (kind) {
+        case 'text':
+        case 'email':
+        case 'calendar': return (await import("./message-intake.mjs")).reviewMessageInput(bytes, kind, reviewedAt);
+        case 'qr': return (await import("./qr-intake.mjs")).reviewQrInput(bytes, reviewedAt);
+        case 'docx': return (await import("./docx-intake.mjs")).reviewDocxInput(bytes, reviewedAt);
+        case 'pdf': return (await import("./pdf-intake.mjs")).reviewPdfInput(bytes, reviewedAt, pdfWorker);
+        case 'har': return (await import("./har-intake.mjs")).reviewHarInput(bytes, reviewedAt);
+        case 'identity': return (await import("./identity-event-intake.mjs")).reviewIdentityEventInput(bytes, reviewedAt);
+        default: {
+            const unsupported = kind;
+            throw new TypeError(`Unsupported selected input: ${String(unsupported)}`);
+        }
+    }
+}