@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/cli/artifact-validation/case-response.mjs

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
+import { readCaseEvidenceRequest, readCasePacketAmendment, assertEvidenceRequestEvent, assertEvidenceRequestHistory, assertPacketAmendmentSelection } from "../../packages/cases/case-requested-evidence.mjs";
 import { canonicalArtifactJsonV2 } from "../../packages/evidence/artifact-integrity.mjs";
-import { CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_2_CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_3_CASE_RESPONSE_PACKET_VERSION, PUBLIC_CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_CASE_RESPONSE_PACKET_VERSION, CASE_RESPONSE_REVIEW_INPUTS_SCHEMA, CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_2_CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_3_CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_CASE_RESPONSE_REVIEW_INPUTS_VERSION, MAX_ABUSIVE_URLS, MAX_RESPONSE_ARTEFACT_REFERENCES, MAX_RESPONSE_AUTHORISATION_CLOCK_SKEW_MS, MAX_RESPONSE_ACTION_HISTORY, MAX_RESPONSE_CONTACTS, MAX_RESPONSE_CONTRADICTIONS, MAX_RESPONSE_SELECTED_EVIDENCE, RESPONSE_AUTHORISATION_CONFIRMATION_IDS, RESPONSE_PACKET_PROFILES, RESPONSE_CONTACT_KINDS, RESPONSE_PACKET_PROFILE_IDS, RESPONSE_READINESS_ROW_IDS, RESPONSE_READINESS_STATES, RESPONSE_ROUTE_STALE_AFTER_DAYS, } from "../../packages/cases/case-response-packet.mjs";
+import { CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_2_CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_3_CASE_RESPONSE_PACKET_VERSION, PUBLIC_CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_CASE_RESPONSE_PACKET_VERSION, CASE_RESPONSE_REVIEW_INPUTS_SCHEMA, CASE_RESPONSE_REVIEW_INPUTS_VERSION, LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION, LATEST_PUBLIC_CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_2_CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_3_CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_CASE_RESPONSE_REVIEW_INPUTS_VERSION, MAX_ABUSIVE_URLS, MAX_RESPONSE_ARTEFACT_REFERENCES, MAX_RESPONSE_AUTHORISATION_CLOCK_SKEW_MS, MAX_RESPONSE_ACTION_HISTORY, MAX_RESPONSE_CONTACTS, MAX_RESPONSE_CONTRADICTIONS, MAX_RESPONSE_SELECTED_EVIDENCE, RESPONSE_AUTHORISATION_CONFIRMATION_IDS, RESPONSE_PACKET_PROFILES, RESPONSE_CONTACT_KINDS, RESPONSE_PACKET_PROFILE_IDS, RESPONSE_READINESS_ROW_IDS, RESPONSE_READINESS_STATES, RESPONSE_ROUTE_STALE_AFTER_DAYS, } from "../../packages/cases/case-response-packet.mjs";
 import { CASE_ACTION_EVENT_SOURCE_CLASSES, CASE_ACTION_STATES, CASE_ACTION_TYPES, CASE_CLOSURE_REASONS, CASE_OBSERVED_EFFECT_SOURCE_CLASSES, CASE_OBSERVED_EFFECT_STATES, CASE_PROVIDER_OUTCOMES, isLegalCaseActionTransition, MAX_CASE_ACTION_EVENTS_PER_ACTION, MAX_CASE_ACTIONS, MAX_CASE_ASSERTIONS, MAX_CASE_DECISIONS, MAX_CASE_EVIDENCE_PINS, MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_LIMITATION_LENGTH, MAX_RESPONSE_LIMITATIONS, MAX_RESPONSE_RECIPIENT_LENGTH, } from "../../packages/cases/case-response-model.mjs";
 import { HEX_DIGEST_RE, array, boolean, domain, enumeration, exact, exactOptional, fail, integer, iso, optionalText, sameValues, strings, text, } from "./structure-primitives.mjs";
 const CASE_RESPONSE_PREFLIGHT_IDS_V6 = [
@@ -543,13 +544,14 @@ function validateVersionedCaseResponsePacket(value, version) {
     const actionIdOrder = [];
     const providerEvents = [];
     for (const candidate of history) {
-        const action = exact(candidate, [
+        const action = exactOptional(candidate, [
             'actionId', 'type', 'recipient', 'contactSource', 'state', 'reference',
             'providerOutcome', 'outcomeDetail', 'originActionId', 'historyOmitted',
             'historyLimitations', 'transitions', 'createdAt', 'updatedAt',
             ...(hasActionBinding ? ['routeObservedAt'] : []),
             ...(hasPlatformRoutes ? ['routeReviewAfter'] : []),
-        ], 'Case-response escalation action');
+        ], Number(root.schemaVersion) >= 11 ? ['amendment'] : [], 'Case-response escalation action');
+        readCasePacketAmendment(action.amendment);
         const actionId = text(action.actionId, 'Case-response action id', 64);
         if (actionIds.has(actionId))
             fail('Case-response action identity');
@@ -571,6 +573,7 @@ function validateVersionedCaseResponsePacket(value, version) {
         integer(action.historyOmitted, 'Case-response action omitted history', 0, 1_000_000);
         strings(action.historyLimitations, 'Case-response action history limitations', 8, 240);
         const transitions = array(action.transitions, 'Case-response action transitions', MAX_CASE_ACTION_EVENTS_PER_ACTION, 1);
+        const requestEvents = [];
         const eventIds = new Set();
         let projectedState = null;
         let latestReference = null;
@@ -580,8 +583,11 @@ function validateVersionedCaseResponsePacket(value, version) {
         let previousTime = Number.NEGATIVE_INFINITY;
         let previousEventId = '';
         for (const eventCandidate of transitions) {
-            const event = exact(eventCandidate, ['id', 'previousState', 'nextState', 'occurredAt', 'sourceClass', 'provenance', 'reference', 'evidencePinId', 'limitations', 'providerOutcome', 'outcomeDetail', 'originActionId', 'applied'], 'Case-response action transition');
+            const event = exactOptional(eventCandidate, ['id', 'previousState', 'nextState', 'occurredAt', 'sourceClass', 'provenance', 'reference', 'evidencePinId', 'limitations', 'providerOutcome', 'outcomeDetail', 'originActionId', 'applied'], Number(root.schemaVersion) >= 11 ? ['evidenceRequest'] : [], 'Case-response action transition');
+            const evidenceRequest = readCaseEvidenceRequest(event.evidenceRequest);
+            assertEvidenceRequestEvent(evidenceRequest, event);
             const eventId = text(event.id, 'Case-response action event id', 64);
+            requestEvents.push({ id: eventId, ...(evidenceRequest ? { evidenceRequest } : {}) });
             if (eventIds.has(eventId))
                 fail('Case-response action event identity');
             eventIds.add(eventId);
@@ -650,6 +656,7 @@ function validateVersionedCaseResponsePacket(value, version) {
                 }
             }
         }
+        assertEvidenceRequestHistory(requestEvents, Number(action.historyOmitted) > 0);
         if ((projectedState ?? 'drafting') !== action.state
             || latestReference !== action.reference
             || latestProviderOutcome !== action.providerOutcome
@@ -667,6 +674,11 @@ function validateVersionedCaseResponsePacket(value, version) {
         if (recipientRoute && !actionIds.has(recipientRoute.actionId))
             fail('Case-response recipient action');
     }
+    if (version >= 11)
+        assertPacketAmendmentSelection(history.map(candidate => {
+            const action = candidate;
+            return { id: action.actionId, history: action.transitions, originActionId: action.originActionId, amendment: action.amendment };
+        }), selectedActionId, evidenceIds);
     const lifecycle = exact(root.responseLifecycle, ['providerOutcomeState', 'latestProviderOutcome', 'observedChangeState', 'latestObservedEffect', 'latestObservedChangeAt', 'closure', 'limitations'], 'Case-response lifecycle');
     const providerOutcomeState = enumeration(lifecycle.providerOutcomeState, ['available', 'missing', 'ambiguous'], 'Case-response lifecycle provider state');
     let actualLatestProvider = null;
@@ -731,8 +743,9 @@ function validateVersionedCaseResponsePacket(value, version) {
         contract: CASE_RESPONSE_REVIEW_INPUTS_SCHEMA,
         version: version === CASE_RESPONSE_PACKET_VERSION
             ? CASE_RESPONSE_REVIEW_INPUTS_VERSION
-            : hasPlatformRoutes ? PUBLISHED_V2_3_CASE_RESPONSE_REVIEW_INPUTS_VERSION
-                : hasActionBinding ? PUBLISHED_V2_2_CASE_RESPONSE_REVIEW_INPUTS_VERSION : PUBLISHED_V2_CASE_RESPONSE_REVIEW_INPUTS_VERSION,
+            : version === LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION ? LATEST_PUBLIC_CASE_RESPONSE_REVIEW_INPUTS_VERSION
+                : hasPlatformRoutes ? PUBLISHED_V2_3_CASE_RESPONSE_REVIEW_INPUTS_VERSION
+                    : hasActionBinding ? PUBLISHED_V2_2_CASE_RESPONSE_REVIEW_INPUTS_VERSION : PUBLISHED_V2_CASE_RESPONSE_REVIEW_INPUTS_VERSION,
         profile: {
             id: profile.id,
             label: profile.label,
@@ -781,6 +794,8 @@ function validateVersionedCaseResponsePacket(value, version) {
         fail('Case-response integrity');
 }
 export function validateCaseResponsePacket(value) {
+    if (value.schemaVersion === LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION)
+        return validateVersionedCaseResponsePacket(value, LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION);
     if (value.schemaVersion === PUBLIC_CASE_RESPONSE_PACKET_VERSION)
         return validateCaseResponsePacketV6(value);
     if (value.schemaVersion === PUBLISHED_V2_CASE_RESPONSE_PACKET_VERSION) {

package/cli/artifact-validation/lookup-evidence.mjs

@@ -4,7 +4,7 @@ import { validLookupObservationScope } from "../../packages/evidence/lookup-targ
 import { registrarStandingObservedBy, resolveRegistrarIanaId, validRegistrarStanding, } from "../../lib/registrar-standing-contract.mjs";
 import { compareRegistrySources } from "../../lib/registry-comparison.mjs";
 import { buildRegistryInsights } from "../../lib/registry-insights.mjs";
-import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "../../lib/project-metadata.mjs";
+import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "../../packages/analysis/project-metadata.mjs";
 import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "../../lib/homepage-metadata-contract.mjs";
 import { HEX_DIGEST_RE, SEMANTIC_VERSION_RE, absoluteUrl, array, boolean, domain, enumeration, exact, exactOptional, fail, integer, iso, nullableRecord, optionalText, record, strings, text, } from "./structure-primitives.mjs";
 const LOOKUP_RDAP_ATTEMPT_OUTCOMES = [
@@ -675,7 +675,7 @@ export function validateLookupEvidenceArtifactStructure(value) {
         }
         validateLookupEvidenceHomepageMetadata(availability, version);
         if (!isDeepStrictEqual(analysis.availability, currentAvailability
-            ? projectLookupEvidenceAvailability(analysis.availability)
+            ? projectLookupEvidenceAvailability(analysis.availability, { legacyUris: version < HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION })
             : projectLookupEvidenceAvailabilityPublic(analysis.availability)))
             fail('Lookup evidence availability analysis');
     }
@@ -715,7 +715,7 @@ export function validateLookupEvidenceArtifactStructure(value) {
         if (!isDeepStrictEqual(registryInsights, expectedInsights))
             fail('Lookup evidence registry insight derivation');
         try {
-            assertLookupEvidencePrivacySafeTree(root);
+            assertLookupEvidencePrivacySafeTree(root, { legacyUris: version < HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION });
         }
         catch {
             fail('Lookup evidence privacy boundary');

package/cli/artifact-validation/signed-review.mjs

@@ -3,6 +3,8 @@ import { BULK_DOMAIN_COMPARISON_EXPORT_VERSION, BULK_DOMAIN_COMPARISON_SCHEMA, }
 import { BULK_MAIL_EXPOSURE_EXPORT_VERSION, BULK_MAIL_EXPOSURE_SCHEMA, MAX_BULK_MAIL_EXPOSURE_ROWS, } from "../../packages/investigation/bulk-mail-exposure.mjs";
 import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS, } from "../../packages/contracts/investigation-portability.mjs";
 import { MAX_BULK_SESSION_ROWS, MAX_BULK_SESSION_SOURCES } from "../../packages/contracts/workspace-portability.mjs";
+import { MANAGED_INDICATOR_SET_SCHEMA } from "../../packages/contracts/analyst-interchange.mjs";
+import { validateManagedIndicatorSet } from "../../packages/interchange/managed-indicator-set.mjs";
 import { BULK_SORT_KEYS } from "../../packages/workspace/bulk-sort.mjs";
 import { normalizeExplicitIsoTimestamp } from "../../packages/evidence/observation.mjs";
 import { LOOKUP_CLAIM_PASSPORT_SCHEMA, LOOKUP_CLAIM_PASSPORT_TARGET_TYPES, LOOKUP_CLAIM_PASSPORT_VERSION, MAX_LOOKUP_CLAIM_PASSPORT_LIMITATIONS, MAX_LOOKUP_CLAIM_PASSPORT_REQUIREMENTS, } from "../../packages/investigation/lookup-claim-passport.mjs";
@@ -334,10 +336,11 @@ function validateBulkReviewManifest(value) {
     strings(root.limitations, 'Bulk review manifest limitations', 8, 600);
     validateIntegrity(root.integrity, 'Bulk review manifest integrity', root.version, version);
 }
-function validateSourceObservations(value, label) {
+function validateSourceObservations(value, label, queryCoverage) {
     const names = new Set();
+    let queryCount = 0;
     return array(value, label, 16).map((candidate) => {
-        const source = exact(candidate, ['label', 'source', 'state', 'observedAt'], label);
+        const source = exact(candidate, ['label', 'source', 'state', 'observedAt', ...(queryCoverage ? ['queries'] : [])], label);
         const name = text(source.label, `${label} label`, 120).toLowerCase();
         if (names.has(name))
             fail(`${label} duplicate label`);
@@ -345,14 +348,37 @@ function validateSourceObservations(value, label) {
         text(source.source, `${label} source`, 240);
         enumeration(source.state, ['observed', 'partial', 'unavailable'], `${label} state`);
         iso(source.observedAt, `${label} observedAt`);
+        if (queryCoverage) {
+            const keys = new Set();
+            const queries = array(source.queries, `${label} queries`, 500 - queryCount);
+            queryCount += queries.length;
+            for (const candidate of queries) {
+                const query = exact(candidate, ['owner', 'type', 'state'], `${label} query`);
+                text(query.owner, `${label} query owner`, 253);
+                enumeration(query.type, DNS_TYPES, `${label} query type`);
+                enumeration(query.state, ['observed', 'partial', 'unavailable'], `${label} query state`);
+                const key = `${query.owner}\u0000${query.type}`;
+                if (keys.has(key))
+                    fail(`${label} duplicate query`);
+                keys.add(key);
+                if ((source.state === 'observed' && query.state !== 'observed')
+                    || (source.state === 'unavailable' && query.state !== 'unavailable'))
+                    fail(`${label} query state`);
+            }
+        }
         return source;
     });
 }
-function validateReviewMatrix(value, label, sources) {
+function validateReviewMatrix(value, label, sources, queryCoverage = false) {
+    const rowKeys = new Set();
     for (const [rowIndex, candidate] of array(value, label, 500).entries()) {
         const row = exact(candidate, ['owner', 'type', 'state', 'observations'], `${label} row ${rowIndex + 1}`);
         text(row.owner, `${label} owner`, 253);
         enumeration(row.type, DNS_TYPES, `${label} type`);
+        const key = `${row.owner}\u0000${row.type}`;
+        if (queryCoverage && rowKeys.has(key))
+            fail(`${label} duplicate row`);
+        rowKeys.add(key);
         const observations = array(row.observations, `${label} observations`, 16);
         if (sources && observations.length !== sources.length)
             fail(`${label} source coverage`);
@@ -363,7 +389,7 @@ function validateReviewMatrix(value, label, sources) {
             const observation = exact(observationCandidate, ['label', 'source', 'state', 'values', 'ttlRange', ...(sources ? ['observedAt'] : [])], `${label} observation`);
             text(observation.label, `${label} observation label`, 120);
             text(observation.source, `${label} observation source`, 240);
-            const state = enumeration(observation.state, ['observed', 'partial', 'unavailable'], `${label} observation state`);
+            const state = enumeration(observation.state, ['observed', 'partial', 'unavailable', ...(queryCoverage ? ['not_queried'] : [])], `${label} observation state`);
             const values = strings(observation.values, `${label} observation values`, 500, 16_384);
             if (sources) {
                 const name = String(observation.label).toLowerCase();
@@ -371,8 +397,16 @@ function validateReviewMatrix(value, label, sources) {
                     fail(`${label} duplicate observation`);
                 names.add(name);
                 const source = sources.find((item) => item.label === observation.label);
-                if (!source || ['label', 'source', 'state', 'observedAt'].some((key) => observation[key] !== source[key]))
+                const provenance = queryCoverage ? ['label', 'source', 'observedAt'] : ['label', 'source', 'state', 'observedAt'];
+                if (!source || provenance.some((key) => observation[key] !== source[key]))
                     fail(`${label} source provenance`);
+                if (queryCoverage) {
+                    const query = source.queries.find((item) => item.owner === row.owner && item.type === row.type);
+                    if (state !== (query?.state ?? 'not_queried'))
+                        fail(`${label} query provenance`);
+                    if (['not_queried', 'unavailable'].includes(state) && (values.length || observation.ttlRange !== null))
+                        fail(`${label} unavailable values`);
+                }
                 iso(observation.observedAt, `${label} observation time`);
             }
             if (state === 'observed') {
@@ -387,13 +421,19 @@ function validateReviewMatrix(value, label, sources) {
                     fail(`${label} TTL range`);
             }
         }
-        const expected = complete < 2 ? 'insufficient' : signatures.size === 1 ? 'aligned' : 'different';
+        const expected = complete < 2 || (queryCoverage && complete !== observations.length) ? 'insufficient' : signatures.size === 1 ? 'aligned' : 'different';
         if (row.state !== expected)
             fail(`${label} state`);
     }
+    if (queryCoverage && sources) {
+        const expectedKeys = new Set(sources.flatMap((source) => source.queries.map((item) => `${item.owner}\u0000${item.type}`)));
+        if (rowKeys.size !== expectedKeys.size || [...rowKeys].some((key) => !expectedKeys.has(key)))
+            fail(`${label} query coverage`);
+    }
 }
 function validateDomainChangeReview(value, label, version) {
     const retainedTimes = version >= 2;
+    const queryCoverage = version >= 3;
     const review = exact(value, ['schema', 'version', 'generatedAt', 'domain', 'state', 'authoritativeRecordMatrix', 'resolverDivergenceMatrix', 'dnssecAutomation', 'acmeDependencies', 'certificate', 'services', 'hsts', 'gate', 'limitations', ...(retainedTimes ? ['sourceObservations'] : [])], label);
     if (review.schema !== DOMAIN_CHANGE_REVIEW_SCHEMA || review.version !== version)
         fail(label);
@@ -401,8 +441,8 @@ function validateDomainChangeReview(value, label, version) {
     domain(review.domain, `${label} domain`);
     enumeration(review.state, ['ready', 'review'], `${label} state`);
     const sources = retainedTimes ? exact(review.sourceObservations, ['authorities', 'resolvers'], `${label} source observations`) : null;
-    validateReviewMatrix(review.authoritativeRecordMatrix, `${label} authority matrix`, sources ? validateSourceObservations(sources.authorities, `${label} authority sources`) : undefined);
-    validateReviewMatrix(review.resolverDivergenceMatrix, `${label} resolver matrix`, sources ? validateSourceObservations(sources.resolvers, `${label} resolver sources`) : undefined);
+    validateReviewMatrix(review.authoritativeRecordMatrix, `${label} authority matrix`, sources ? validateSourceObservations(sources.authorities, `${label} authority sources`, queryCoverage) : undefined, queryCoverage);
+    validateReviewMatrix(review.resolverDivergenceMatrix, `${label} resolver matrix`, sources ? validateSourceObservations(sources.resolvers, `${label} resolver sources`, queryCoverage) : undefined, queryCoverage);
     const automation = exact(review.dnssecAutomation, ['state', 'cdsObserved', 'cdnskeyObserved', 'csyncObserved', 'conflictingTypes', 'detail'], `${label} DNSSEC automation`);
     enumeration(automation.state, ['not_observed', 'conflict', 'partial', 'review_ready'], `${label} DNSSEC automation`);
     boolean(automation.cdsObserved, `${label} CDS observed`);
@@ -514,7 +554,7 @@ function validatePlannedAssurance(value, label) {
     strings(assurance.limitations, `${label} limitations`, 8, 600);
     return assurance;
 }
-function expectedDomainChangeSummary(before, after) {
+function expectedDomainChangeSummary(before, after, queryCoverage) {
     const rows = (review) => new Map(review.authoritativeRecordMatrix.map((row) => [`${row.owner}\u0000${row.type}`, row]));
     const beforeRows = rows(before);
     const afterRows = rows(after);
@@ -526,7 +566,7 @@ function expectedDomainChangeSummary(before, after) {
     };
     const rowEvidence = (review, row) => {
         if (!row)
-            return { state: collectionComplete(review) ? 'complete' : 'unavailable', values: [] };
+            return { state: !queryCoverage && collectionComplete(review) ? 'complete' : 'unavailable', values: [] };
         const observations = row.observations;
         if (observations.some((item) => item.state !== 'observed'))
             return { state: 'partial', values: [] };
@@ -537,18 +577,21 @@ function expectedDomainChangeSummary(before, after) {
         return { state: 'complete', values: [...new Set(observations.flatMap((item) => item.values))].sort() };
     };
     const changed = [];
+    const reasons = queryCoverage && keys.length > 500 ? ['The comparison exceeds 500 owner and record-type pairs.'] : [];
     for (const key of keys.slice(0, 500)) {
         const left = rowEvidence(before, beforeRows.get(key));
         const right = rowEvidence(after, afterRows.get(key));
         const [owner, type] = key.split('\u0000');
         if (left.state !== 'complete' || right.state !== 'complete') {
+            if (queryCoverage)
+                reasons.push(`Comparison evidence is incomplete for ${owner} ${type}.`);
             continue;
         }
         else if (!sameValues(left.values, right.values)) {
             changed.push({ owner: owner ?? '', type: type ?? '', beforeValues: left.values, afterValues: right.values });
         }
     }
-    return changed;
+    return { changed, reasons };
 }
 function validateDomainChangePacket(value) {
     const root = exact(value, ['schema', 'version', 'generatedAt', 'domain', 'reference', 'state', 'gate', 'summary', 'evidence', 'limitations', 'integrity'], 'Domain change packet');
@@ -590,13 +633,14 @@ function validateDomainChangePacket(value) {
     const expectedReasons = [
         ...pre.gate.reasons,
     ].map((reason) => `Pre-change evidence: ${reason}`);
-    expectedReasons.push(...post.gate.reasons.map((reason) => `Post-change evidence: ${reason}`), ...(assuranceResult.review.reasons.map((reason) => `Change plan: ${reason}`)));
+    const comparison = expectedDomainChangeSummary(pre, post, reviewVersion >= 3);
+    expectedReasons.push(...post.gate.reasons.map((reason) => `Post-change evidence: ${reason}`), ...(assuranceResult.review.reasons.map((reason) => `Change plan: ${reason}`)), ...comparison.reasons);
     const boundedReasons = expectedReasons.slice(0, 100);
     if (!sameValues(gateReasons, boundedReasons)
         || gate.pass !== (boundedReasons.length === 0)
         || root.state !== (boundedReasons.length === 0 ? 'ready' : 'review'))
         fail('Domain change packet gate');
-    const expectedChanges = expectedDomainChangeSummary(pre, post);
+    const expectedChanges = comparison.changed;
     if (changed.length !== expectedChanges.length || changed.some((candidate, index) => {
         const item = candidate;
         const expected = expectedChanges[index];
@@ -613,6 +657,8 @@ export function validateSignedDigestArtifactStructure(schema, value) {
         fail('Signed review artefact');
     if (schema === ACQUISITION_DECISION_PACKET_SCHEMA)
         validateAcquisition(value);
+    else if (schema === MANAGED_INDICATOR_SET_SCHEMA)
+        validateManagedIndicatorSet(value);
     else if (schema === LOOKUP_CLAIM_PASSPORT_SCHEMA)
         validateLookupClaimPassport(value);
     else if (schema === BULK_DOMAIN_COMPARISON_SCHEMA)

package/cli/artifact-verify.mjs

@@ -1,4 +1,5 @@
 import { Buffer } from 'node:buffer';
+import { MANAGED_INDICATOR_SET_SCHEMA, MANAGED_INDICATOR_SET_VERSION } from "../packages/contracts/analyst-interchange.mjs";
 import { createHash } from 'node:crypto';
 import { readEditableCaseExport } from "../packages/cases/case-export-input.mjs";
 import { boundedJsonLimitsForBytes, parseBoundedJsonObject } from "./bounded-json.mjs";
@@ -36,6 +37,7 @@ function currentCanonicalizationRoutes(versions) {
     })));
 }
 const SIGNED_ARTIFACT_ROUTES = Object.freeze({
+    [MANAGED_INDICATOR_SET_SCHEMA]: currentCanonicalizationRoutes([MANAGED_INDICATOR_SET_VERSION]),
     [ACQUISITION_DECISION_PACKET_SCHEMA]: currentCanonicalizationRoutes(SUPPORTED_ACQUISITION_DECISION_PACKET_VERSIONS),
     [LOOKUP_CLAIM_PASSPORT_SCHEMA]: currentCanonicalizationRoutes([LOOKUP_CLAIM_PASSPORT_VERSION]),
     [BULK_DOMAIN_COMPARISON_SCHEMA]: currentCanonicalizationRoutes(SUPPORTED_BULK_DOMAIN_COMPARISON_EXPORT_VERSIONS),

package/cli/assurance-arguments.mjs

@@ -0,0 +1,56 @@
+import {} from "./command-argument-grammar.mjs";
+import { CliUsageError } from "./errors.mjs";
+import { MAX_INVESTIGATION_MANIFEST_ARTIFACTS } from "../packages/contracts/investigation-package-limits.mjs";
+import { terminalOptions, jsonOutput, singleInputAction } from "./argument-values.mjs";
+function parseManifestArguments(parsed) {
+    const sources = parsed.positionalValues('artefacts');
+    if (sources.some((source) => !source))
+        throw new CliUsageError(`manifest requires from 1 to ${MAX_INVESTIGATION_MANIFEST_ARTIFACTS} artefact files.`);
+    if (new Set(sources).size !== sources.length)
+        throw new CliUsageError('manifest artefact files must be different.');
+    const configurationDigestSha256 = parsed.optionValue('--configuration-digest');
+    if (configurationDigestSha256 !== null && !/^sha256:[a-f0-9]{64}$/u.test(configurationDigestSha256)) {
+        throw new CliUsageError('--configuration-digest requires a sha256: hexadecimal digest.');
+    }
+    return {
+        action: 'manifest',
+        sources,
+        workflow: parsed.optionValue('--workflow'),
+        configurationDigestSha256,
+        ...(parsed.optionValue('--passphrase-file')
+            ? { passphraseSource: parsed.optionValue('--passphrase-file') }
+            : {}),
+        ...(parsed.hasOption('--package') ? { package: true } : {}),
+        ...(parsed.hasOption('--bagit') ? { bagit: true } : {}),
+        ...(parsed.optionValue('--folder') ? { folder: parsed.optionValue('--folder') } : {}),
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    };
+}
+function parseSharingReviewArguments(parsed) {
+    const purpose = parsed.optionValue('--purpose').replace(/\s+/gu, ' ').trim();
+    if (!purpose || purpose.length > 200)
+        throw new CliUsageError('--purpose is limited to 200 characters.');
+    return {
+        action: 'sharing-review',
+        source: parsed.positionalValue('source'),
+        output: jsonOutput(parsed),
+        marking: parsed.optionValue('--marking'),
+        recipientScope: parsed.optionValue('--recipient-scope'),
+        purpose,
+        humanReviewed: parsed.hasOption('--human-reviewed'),
+        personalDataReviewed: parsed.hasOption('--personal-data-reviewed'),
+        redactionsConfirmed: parsed.hasOption('--redactions-confirmed'),
+        ...terminalOptions(parsed),
+    };
+}
+export const ASSURANCE_ARGUMENT_PARSERS = Object.freeze({
+    manifest: parseManifestArguments,
+    'map-observations': (parsed) => singleInputAction('map-observations', parsed),
+    'oam-export': (parsed) => singleInputAction('oam-export', parsed),
+    'ct-intake': (parsed) => singleInputAction('ct-intake', parsed),
+    'domain-control': (parsed) => singleInputAction('domain-control', parsed),
+    assurance: (parsed) => singleInputAction('assurance', parsed),
+    'change-packet': (parsed) => singleInputAction('change-packet', parsed),
+    'sharing-review': parseSharingReviewArguments,
+});

package/cli/assurance-command-definitions.mjs

@@ -0,0 +1,179 @@
+import { MAX_INVESTIGATION_MANIFEST_ARTIFACTS, MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES } from "../packages/investigation/investigation-manifest.mjs";
+import { positional, OPTIONAL_FILE_POSITIONAL, constraint, EMPTY_CONSTRAINTS, commandSeed, flag, file } from "./command-definition.mjs";
+export const ASSURANCE_COMMAND_DEFINITIONS = Object.freeze({
+    manifest: commandSeed({
+        reference: {
+            description: `Record an ordered, path-free manifest for up to ${MAX_INVESTIGATION_MANIFEST_ARTIFACTS} local files. Use --package --output evidence.zip for a ZIP, add --passphrase-file to encrypt the ordinary package, or use --folder ./evidence for a new unencrypted folder. Add --bagit to ZIP or folder output for BagIt 1.0 with SHA-512 checksums.`,
+            example: 'whoisleuth manifest lookup.json comparison.json --workflow "domain review" --json',
+            boundary: 'Ordinary output contains metadata only. ZIP and folder output include unchanged selected bytes and are private until reviewed for sharing. Folders must be new; existing destinations are never replaced and a failed write may leave explicit partial output. BagIt output is unencrypted; its checksums do not authenticate evidence. Filenames ending in .json are parsed as JSON; other files are opaque and never executed. Original paths are omitted. No network request is made.',
+        },
+        collection: { scope: `Reads 1 to ${MAX_INVESTIGATION_MANIFEST_ARTIFACTS} local files, at most ${MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES / 1024 / 1024} MiB each and ${MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES.toLocaleString('en-AU')} bytes combined; retains no source paths.` },
+        summary: 'Build an evidence manifest offline',
+        options: ['--workflow', '--configuration-digest', '--package', '--bagit', '--passphrase-file', '--folder', '--json', '--quiet', '--no-color'],
+        optionOverrides: {
+            '--package': flag('Create a portable evidence ZIP containing the selected files.'),
+            '--folder': file('Create a new evidence folder containing the selected files.'),
+            '--bagit': flag('Create a BagIt 1.0 package with SHA-512 checksums.'),
+        },
+        positionals: Object.freeze([positional('artefacts', 'file', 1, MAX_INVESTIGATION_MANIFEST_ARTIFACTS)]),
+        constraints: Object.freeze([
+            constraint({ kind: 'required', options: ['--workflow'] }),
+            constraint({ kind: 'requires_any', option: '--bagit', requiredOptions: ['--package', '--folder'] }),
+            constraint({ kind: 'excludes_all', option: '--bagit', excludedOptions: ['--passphrase-file'] }),
+            constraint({ kind: 'requires_all', option: '--package', requiredOptions: ['--output'] }),
+            constraint({ kind: 'requires_all', option: '--passphrase-file', requiredOptions: ['--package'] }),
+            constraint({ kind: 'mutually_exclusive', options: ['--package', '--json'] }),
+            constraint({ kind: 'excludes_all', option: '--folder', excludedOptions: ['--package', '--output', '--force'] }),
+        ]),
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.investigation-manifest']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "map-observations": commandSeed({
+        reference: {
+            description: 'Apply one bounded declarative field-mapping profile to local source observations.',
+            example: 'whoisleuth map-observations mapping.json --json',
+            boundary: 'Profiles select allowlisted dotted fields only. They execute no scripts, make no requests, and emit the browser-compatible external-findings contract.',
+        },
+        collection: { scope: 'Reads one mapping document capped at 4 MiB and executes no scripts or requests.' },
+        summary: 'Apply a declarative observation map offline',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.external-observation-mapping']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "oam-export": commandSeed({
+        reference: {
+            description: 'Project browser-compatible external findings into a bounded Open Asset Model bridge document.',
+            example: 'whoisleuth oam-export external-findings.json --json',
+            boundary: 'The projection is offline, preserves source completeness without inventing confidence, and covers only bounded FQDN, IP address, certificate, and related edge vocabulary.',
+        },
+        collection: { scope: 'Reads one browser-compatible external-findings document and projects bounded graph records locally.' },
+        summary: 'Project external findings to Open Asset Model',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.open-asset-model-bridge']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "ct-intake": commandSeed({
+        reference: {
+            description: 'Normalise source-qualified local certificate events into browser-compatible findings.',
+            example: 'whoisleuth ct-intake certificate-events.json --json',
+            boundary: 'The command is offline, caps output at 100 findings, and treats every event as a review lead rather than proof of serving or control.',
+        },
+        collection: { scope: 'Reads one source-qualified event batch capped at 4 MiB and makes no request.' },
+        summary: 'Normalise certificate observations offline',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.ct-event-batch', 'whoisleuth.external-findings']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "domain-control": commandSeed({
+        reference: {
+            description: 'Build an integrity-protected desired-state manifest or compare one with supplied observations.',
+            example: 'whoisleuth domain-control domain-control-input.json --json',
+            boundary: 'The command is offline and changes no registrar, DNS, mail, or certificate configuration. Only complete, recent source observations can establish drift or expected absence.',
+        },
+        collection: { scope: 'Reads one bounded desired-state or review document and performs no collection or configuration change.' },
+        summary: 'Build or review a domain control manifest',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.domain-control-review-input', 'whoisleuth.cli.domain-control-review']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    assurance: commandSeed({
+        reference: {
+            description: 'Review a versioned domain change, recovery-dependency, or retirement plan.',
+            example: 'whoisleuth assurance domain-assurance.json --json',
+            boundary: 'The command is offline and treats every provider label, readiness state, and evidence reference as analyst-authored input. It changes no configuration.',
+        },
+        collection: { scope: 'Reads one versioned plan capped at 2 MiB and makes no request or configuration change.' },
+        summary: 'Review domain change, recovery, or retirement plans',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.domain-assurance.input', 'whoisleuth.domain-assurance']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "change-packet": commandSeed({
+        reference: {
+            description: 'Assemble pre-change, post-change, and planning evidence into one integrity-protected packet.',
+            example: 'whoisleuth change-packet change-review.json --json',
+            boundary: 'Assembly is offline. Readiness reflects only the supplied bounded evidence and does not authorise or perform a domain change.',
+        },
+        collection: { scope: 'Reads one versioned packet input capped at 6 MiB and makes no request or configuration change.' },
+        summary: 'Build a reviewed change packet offline',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.domain-change-packet.input', 'whoisleuth.domain-change-packet']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "sharing-review": commandSeed({
+        reference: {
+            description: 'Lint one reviewed artefact against local integrity, marking, recipient, personal-data, and redaction controls.',
+            example: 'whoisleuth sharing-review packet.json --marking amber --recipient-scope organization --purpose "Reviewed incident handoff" --human-reviewed --personal-data-reviewed --redactions-confirmed --json',
+            boundary: 'The command is offline and emits only bounded schema/version metadata, no content values, and no raw evidence. Its result is a review aid, not legal advice or recipient authorisation.',
+        },
+        collection: { scope: 'Reads one bounded artefact, emits only schema/version metadata and no content values, and performs no transmission.' },
+        summary: 'Lint an artefact before deliberate sharing',
+        options: ['--marking', '--recipient-scope', '--purpose', '--human-reviewed', '--personal-data-reviewed', '--redactions-confirmed', '--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: Object.freeze([
+            constraint({ kind: 'required', options: ['--marking', '--recipient-scope', '--purpose'] }),
+        ]),
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.sharing-review']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+});

package/cli/assurance-command-runner.mjs

@@ -4,7 +4,7 @@ import { buildInvestigationPackage } from "../packages/investigation/investigati
 import { encryptInvestigationPackage } from "../packages/investigation/investigation-package-crypto.mjs";
 import { writeInvestigationFolder, writePreparedEvidenceFolder } from "./investigation-folder.mjs";
 import { buildInvestigationBagIt, prepareInvestigationBagIt } from "../packages/investigation/investigation-bagit.mjs";
-import { scanBoundedJson } from "../lib/bounded-json.mjs";
+import { scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
 import { MAX_ASSURANCE_INPUT_BYTES, buildDomainAssurance, formatDomainAssurance, } from "../lib/domain-assurance.mjs";
 import { MAX_DOMAIN_CHANGE_PACKET_INPUT_BYTES, buildDomainChangePacket, formatDomainChangePacket, } from "../lib/domain-change-packet.mjs";
 import { DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA, buildDomainControlFlightRecorder, formatDomainControlFlightRecorder, serializeDomainControlFlightRecorder, } from "../lib/domain-control-flight-recorder.mjs";

package/cli/bounded-json.mjs

@@ -1 +1 @@
-export { boundedJsonLimitsForBytes, MAX_BOUNDED_JSON_DEPTH, MAX_BOUNDED_JSON_KEYS, MAX_BOUNDED_JSON_VALUES, parseBoundedJson, parseBoundedJsonObject, scanBoundedJson, } from "../lib/bounded-json.mjs";
+export { boundedJsonLimitsForBytes, MAX_BOUNDED_JSON_DEPTH, MAX_BOUNDED_JSON_KEYS, MAX_BOUNDED_JSON_VALUES, parseBoundedJson, parseBoundedJsonObject, scanBoundedJson, } from "../packages/analysis/bounded-json.mjs";

package/cli/bulk-checkpoint.mjs

@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto';
 import { lstat } from 'node:fs/promises';
 import { recordOrNull } from "../lib/bounded-contract-normalizers.mjs";
 import { readBoundedRegularTextFile } from "../lib/bounded-file.mjs";
-import { scanBoundedJson } from "../lib/bounded-json.mjs";
+import { scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { boundedCliInputError, CliUsageError } from "./errors.mjs";
 import { writePrivateFile } from "./output-file.mjs";

package/cli/bulk-command-runner.mjs

@@ -28,12 +28,12 @@ async function runBulkCommand(args, dependencies, context) {
     catch (error) {
         if (error instanceof CliUsageError)
             throw error;
-        throw new CliUsageError(`Could not read bulk input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+        throw new CliUsageError(`Could not read bulk input: ${boundedCliErrorMessage(error, 'Input could not be read')}`, 'input_unavailable');
     }
     const parsed = parseBulkQueries(input, { deep: args.deep });
     if (args.plan) {
         const document = buildCollectionPreflight({
-            command: 'bulk', targetCount: parsed.queries.length, targetLimit: args.deep ? 50 : 500,
+            command: 'bulk', targetCount: parsed.queries.length,
             deep: args.deep, concurrency: args.concurrency, output: args.output, checkpoint: false,
         });
         context.writeStdout(args.output === 'json' ? formatJsonDocument(document) : context.terminal(formatCollectionPreflight(document), args.color));

package/cli/bulk.mjs

@@ -1,8 +1,7 @@
 import { Buffer } from 'node:buffer';
 import { abortable } from "../lib/abort.mjs";
 import { decodeBoundedUtf8 } from "../lib/bounded-file.mjs";
-import { CliUsageError } from "./arguments.mjs";
-import { hasUnsafeCliText } from "./errors.mjs";
+import { CliUsageError, hasUnsafeCliText } from "./errors.mjs";
 import { MAX_DEEP_BULK_QUERIES, MAX_FAST_BULK_QUERIES, } from "../lib/bulk-limits.mjs";
 const MAX_BULK_INPUT_BYTES = 1024 * 1024;
 async function readTextStreamBounded(stream, limit = MAX_BULK_INPUT_BYTES, signal) {
@@ -65,7 +64,7 @@ function parseBulkQueries(text, { deep = false } = {}) {
         }
     }
     if (!queries.length)
-        throw new CliUsageError('Bulk input did not contain any queries.');
+        throw new CliUsageError('Bulk input did not contain any queries.', 'missing_input');
     return { queries, duplicates, limit };
 }
 function boundedLookupError(error) {