@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/packages/investigation/mail-authentication-review.mjs

@@ -0,0 +1,222 @@
+import { lexicalSegments, normalizeHeaderDomain, addressDomains } from "./mail-header-identity.mjs";
+import { MAX_AUTHENTICATION_HEADERS, MAX_AUTHENTICATION_CLAUSES, MAX_AUTHENTICATION_VALUE_LENGTH, MAIL_AUTHENTICATION_METHODS, MAIL_AUTHENTICATION_PROPERTIES } from "../contracts/mail-authentication.mjs";
+const KEYWORD = /^[a-z][a-z0-9_-]{0,31}$/iu;
+const RESULTS = {
+    spf: ['pass', 'fail', 'softfail', 'neutral', 'none', 'temperror', 'permerror'],
+    dkim: ['pass', 'fail', 'policy', 'neutral', 'none', 'temperror', 'permerror'],
+    dmarc: ['pass', 'fail', 'none', 'temperror', 'permerror'],
+    arc: ['pass', 'fail', 'none'],
+};
+/** Remove comments, never quoted content. Keep separators so tokens cannot join. */
+function withoutComments(value) {
+    let depth = 0, quoted = false, escaped = false, output = '';
+    for (const character of value) {
+        if (escaped) {
+            if (!depth)
+                output += character;
+            escaped = false;
+            continue;
+        }
+        if (character === '\\' && (depth || quoted)) {
+            if (!depth)
+                output += character;
+            escaped = true;
+            continue;
+        }
+        if (depth) {
+            if (character === '(')
+                depth++;
+            else if (character === ')')
+                depth--;
+            continue;
+        }
+        if (character === '"')
+            quoted = !quoted;
+        if (!quoted && character === '(') {
+            depth = 1;
+            output += ' ';
+        }
+        else if (!quoted && character === ')')
+            return null;
+        else
+            output += character;
+    }
+    return depth || quoted || escaped ? null : output;
+}
+// Only the restricted, non-personal identifier projection enters a report.
+function serviceId(value) {
+    return /^[a-z0-9_.-]{1,253}$/iu.test(value) ? value : null;
+}
+function unquote(value) {
+    return value.startsWith('"') ? value.slice(1, -1).replace(/\\(.)/gu, '$1') : value;
+}
+function domainProperty(value) {
+    const direct = normalizeHeaderDomain(value) ?? normalizeHeaderDomain(value.startsWith('@') ? value.slice(1) : '');
+    if (direct)
+        return direct;
+    const domains = addressDomains([value]);
+    return domains.length === 1 ? domains[0] : null;
+}
+function properties(value) {
+    const result = new Map();
+    let rest = value.trim(), count = 0;
+    while (rest) {
+        if (++count > MAX_AUTHENTICATION_CLAUSES)
+            return { result, complete: false };
+        const match = /^([a-z][a-z0-9_-]*(?:\s*\.\s*[a-z][a-z0-9_-]*)?)\s*=\s*("(?:[^"\\]|\\.)*"|[^\s";]+)(?=\s|$)/iu.exec(rest);
+        if (!match)
+            return { result, complete: false };
+        const key = match[1].replaceAll(/\s/gu, '').toLowerCase();
+        const values = result.get(key) ?? [];
+        values.push(unquote(match[2]));
+        result.set(key, values);
+        rest = rest.slice(match[0].length).trim();
+    }
+    return { result, complete: true };
+}
+function domainsFromProperties(values) {
+    const domains = [];
+    const duplicateProperties = [];
+    let omitted = false;
+    for (const property of MAIL_AUTHENTICATION_PROPERTIES) {
+        const supplied = values.get(property);
+        if (!supplied)
+            continue;
+        if (supplied.length !== 1) {
+            duplicateProperties.push(property);
+            continue;
+        }
+        const domain = domainProperty(supplied[0]);
+        if (domain)
+            domains.push({ property, domain });
+        else
+            omitted = true;
+    }
+    return { domains, duplicateProperties, omitted };
+}
+function readHeader(input, part, headerIndex, duplicateOf) {
+    const headerName = input.name;
+    const base = { part, headerIndex, headerName, duplicateOf, receiverTrust: 'not_established' };
+    const issues = new Set();
+    const invalid = (issue) => ({ ...base, authservId: null, state: 'malformed', claims: [], issues: [issue] });
+    if (input.value.length > MAX_AUTHENTICATION_VALUE_LENGTH)
+        return invalid('Header value exceeds the authentication review bound.');
+    if (/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]|\p{Default_Ignorable_Code_Point}/u.test(input.value))
+        return invalid('Header value contains unsupported control characters.');
+    const segments = lexicalSegments(input.value, ';');
+    if (!segments)
+        return invalid('Header has unbalanced quoting or comments.');
+    const clauses = segments.slice(0, MAX_AUTHENTICATION_CLAUSES + 1).map(withoutComments);
+    if (clauses.some(value => value === null))
+        return invalid('Header comments could not be parsed.');
+    if (segments.length > MAX_AUTHENTICATION_CLAUSES + 1)
+        issues.add('Some clauses exceed the authentication review bound.');
+    if (headerName === 'received-spf') {
+        const first = /^\s*([a-z][a-z0-9_-]*)\b(.*)$/iu.exec(clauses.shift() ?? '');
+        if (!first || !KEYWORD.test(first[1]))
+            return invalid('The reported SPF result is malformed.');
+        const supplied = properties([first[2], ...clauses].join(' '));
+        const receiver = supplied.result.get('receiver');
+        const authservId = receiver?.length === 1 ? serviceId(receiver[0]) : null;
+        if (!supplied.complete)
+            issues.add('Some SPF properties could not be parsed.');
+        if (receiver && (receiver.length !== 1 || !authservId))
+            issues.add('The receiver identifier is ambiguous or outside the retained identifier format.');
+        const renamed = new Map(supplied.result);
+        for (const [key, property] of [['envelope-from', 'smtp.mailfrom'], ['helo', 'smtp.helo']]) {
+            if (supplied.result.has(key))
+                renamed.set(property, supplied.result.get(key));
+        }
+        const projected = domainsFromProperties(renamed);
+        if (projected.omitted)
+            issues.add('Some identity properties cannot be represented as domains.');
+        if (projected.duplicateProperties.length)
+            issues.add('Repeated identity properties were retained as ambiguous, without selecting a value.');
+        const result = first[1].toLowerCase();
+        if (!RESULTS.spf.includes(result))
+            issues.add('The reported SPF result is unsupported.');
+        return { ...base, authservId, state: issues.size ? 'partial' : 'parsed', claims: [{ method: 'spf', methodVersion: 1, result,
+                    state: RESULTS.spf.includes(result) ? 'reported' : 'unsupported', domains: projected.domains, duplicateProperties: projected.duplicateProperties }], issues: [...issues] };
+    }
+    const first = /^\s*("(?:[^"\\]|\\.)*"|[^\s";]+)(?:\s+(\d{1,9}))?\s*$/u.exec(clauses.shift() ?? '');
+    if (!first)
+        return invalid('The authentication service identifier or header version is malformed.');
+    const authservId = serviceId(unquote(first[1]));
+    if (!authservId)
+        issues.add('The service identifier is outside the retained non-personal identifier format.');
+    if (first[2] && first[2] !== '1')
+        return { ...base, authservId, state: 'unsupported', claims: [], issues: ['The header declares an unsupported authentication-results version.'] };
+    if (clauses.length === 1 && clauses[0].trim().toLowerCase() === 'none')
+        return { ...base, authservId, state: 'none', claims: [], issues: [...issues] };
+    const claims = [];
+    if (!clauses.length)
+        issues.add('The header does not contain a result clause.');
+    for (const clause of clauses) {
+        const match = /^\s*([a-z][a-z0-9_-]*)(?:\s*\/\s*(\d{1,9}))?\s*=\s*([a-z][a-z0-9_-]*)(?=\s|$)(.*)$/iu.exec(clause);
+        if (!match || !KEYWORD.test(match[1]) || !KEYWORD.test(match[3])) {
+            issues.add('A result clause is malformed.');
+            continue;
+        }
+        const method = match[1].toLowerCase();
+        if (!MAIL_AUTHENTICATION_METHODS.includes(method)) {
+            issues.add('A reported authentication method is outside this review.');
+            continue;
+        }
+        const supplied = properties(match[4]);
+        const projected = domainsFromProperties(supplied.result);
+        if (!supplied.complete)
+            issues.add('Some result properties could not be parsed.');
+        if (projected.omitted)
+            issues.add('Some identity properties cannot be represented as domains.');
+        if (projected.duplicateProperties.length)
+            issues.add('Repeated identity properties were retained as ambiguous, without selecting a value.');
+        const known = method, result = match[3].toLowerCase(), methodVersion = Number(match[2] ?? 1);
+        const state = methodVersion === 1 && RESULTS[known].includes(result) ? 'reported' : 'unsupported';
+        if (state === 'unsupported')
+            issues.add('A method version or result is unsupported.');
+        claims.push({ method: known, methodVersion, result, state, domains: projected.domains, duplicateProperties: projected.duplicateProperties });
+    }
+    return { ...base, authservId, state: issues.size ? claims.length ? 'partial' : 'malformed' : 'parsed', claims, issues: [...issues] };
+}
+/** Physical header order is preserved. Equal service names never imply trust. */
+export function reviewMailAuthentication(fields, part = 1, maximumHeaders = MAX_AUTHENTICATION_HEADERS) {
+    if (!Number.isSafeInteger(part) || part < 1 || !Number.isSafeInteger(maximumHeaders) || maximumHeaders < 0 || maximumHeaders > MAX_AUTHENTICATION_HEADERS)
+        throw new TypeError('Invalid authentication review bounds.');
+    const headers = [], previous = new Map();
+    let omittedHeaders = 0;
+    for (const [index, field] of fields.entries()) {
+        if (!['authentication-results', 'received-spf'].includes(field.name))
+            continue;
+        if (headers.length >= maximumHeaders) {
+            omittedHeaders++;
+            continue;
+        }
+        // Do not retain an oversized raw value in the temporary duplicate index.
+        const key = field.value.length <= MAX_AUTHENTICATION_VALUE_LENGTH ? `${field.name}:${field.value}` : null;
+        const duplicateOf = key === null ? null : previous.get(key) ?? null;
+        headers.push(readHeader(field, part, index + 1, duplicateOf));
+        if (key !== null && duplicateOf === null)
+            previous.set(key, index + 1);
+    }
+    return { headers, omittedHeaders };
+}
+export function selectReceiverTrust(review, selected) {
+    if (!Array.isArray(selected) || selected.length > MAX_AUTHENTICATION_HEADERS || new Set(selected).size !== selected.length
+        || selected.some(value => !/^[1-9]\d{0,5}:[1-9]\d{0,5}$/u.test(value)
+            || !review.headers.some(header => `${header.part}:${header.headerIndex}` === value && header.authservId !== null && ['parsed', 'partial', 'none'].includes(header.state)))) {
+        throw new TypeError('Select each recognised receiver header by part:header-index; unidentified, malformed and unsupported headers cannot be trusted.');
+    }
+    return { ...review, headers: review.headers.map(header => ({ ...header, receiverTrust: selected.includes(`${header.part}:${header.headerIndex}`) ? 'analyst_selected' : 'not_established' })) };
+}
+export function authenticationHeaderLabel(header) {
+    return `Part ${header.part}, header ${header.headerIndex} · ${header.headerName} · ${header.authservId ?? 'service unidentified'}`;
+}
+/** Compatibility summary only: all parsed sources, with no receiver-trust verdict. */
+export function aggregateMailAuthentication(review) {
+    const known = new Set(['fail', 'neutral', 'none', 'pass', 'permerror', 'softfail', 'temperror']);
+    return Object.fromEntries(MAIL_AUTHENTICATION_METHODS.map(method => {
+        const claims = review.headers.flatMap(header => header.claims.filter(claim => claim.method === method));
+        const states = new Set(claims.map(claim => claim.state === 'reported' && known.has(claim.result) ? claim.result : 'unknown'));
+        return [method, { state: states.size > 1 ? 'mixed' : [...states][0] ?? 'unknown', observations: claims.length }];
+    }));
+}

package/packages/investigation/mail-header-identity.mjs

@@ -0,0 +1,209 @@
+import { isValidAsciiDomainName } from "../contracts/domain-name.mjs";
+import { MAIL_AUTHENTICATION_METHODS } from "../contracts/mail-authentication.mjs";
+export const MAX_MAIL_REVIEW_DOMAINS = 128;
+export const AUTHENTICATION_METHODS = MAIL_AUTHENTICATION_METHODS;
+export function normalizeHeaderDomain(value) {
+    const normalized = value.trim().toLowerCase().replace(/^\[|\]$/gu, '').replace(/\.$/u, '');
+    return isValidAsciiDomainName(normalized, { requireLowercase: true }) ? normalized : null;
+}
+export function lexicalSegments(value, delimiter, trackAngles = false) {
+    const segments = [];
+    let start = 0;
+    let quoted = false;
+    let escaped = false;
+    let commentDepth = 0;
+    let angleDepth = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        const character = value[index] ?? '';
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (character === '\\' && (quoted || commentDepth > 0)) {
+            escaped = true;
+            continue;
+        }
+        if (commentDepth > 0) {
+            if (character === '(')
+                commentDepth += 1;
+            else if (character === ')')
+                commentDepth -= 1;
+            continue;
+        }
+        if (quoted) {
+            if (character === '"')
+                quoted = false;
+            continue;
+        }
+        if (character === '"')
+            quoted = true;
+        else if (character === '(')
+            commentDepth = 1;
+        else if (character === ')')
+            return null;
+        else if (trackAngles && character === '<') {
+            if (angleDepth !== 0)
+                return null;
+            angleDepth = 1;
+        }
+        else if (trackAngles && character === '>') {
+            if (angleDepth !== 1)
+                return null;
+            angleDepth = 0;
+        }
+        else if (character === delimiter && angleDepth === 0) {
+            segments.push(value.slice(start, index));
+            start = index + 1;
+        }
+    }
+    if (escaped || quoted || commentDepth !== 0 || angleDepth !== 0)
+        return null;
+    segments.push(value.slice(start));
+    return segments;
+}
+function angleAddress(value) {
+    let quoted = false;
+    let escaped = false;
+    let commentDepth = 0;
+    let start = -1;
+    let end = -1;
+    for (let index = 0; index < value.length; index += 1) {
+        const character = value[index] ?? '';
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (character === '\\' && (quoted || commentDepth > 0)) {
+            escaped = true;
+            continue;
+        }
+        if (commentDepth > 0) {
+            if (character === '(')
+                commentDepth += 1;
+            else if (character === ')')
+                commentDepth -= 1;
+            continue;
+        }
+        if (quoted) {
+            if (character === '"')
+                quoted = false;
+            continue;
+        }
+        if (character === '"')
+            quoted = true;
+        else if (character === '(')
+            commentDepth = 1;
+        else if (character === ')')
+            return null;
+        else if (character === '<') {
+            if (start >= 0 || end >= 0)
+                return null;
+            start = index;
+        }
+        else if (character === '>') {
+            if (start < 0 || end >= 0)
+                return null;
+            end = index;
+        }
+    }
+    if (escaped || quoted || commentDepth !== 0 || (start >= 0) !== (end >= 0))
+        return null;
+    return start >= 0 ? value.slice(start + 1, end) : value;
+}
+function addressDomain(value) {
+    let candidate = '';
+    let quoted = false;
+    let escaped = false;
+    let commentDepth = 0;
+    const separators = [];
+    for (const character of value) {
+        if (escaped) {
+            candidate += character;
+            escaped = false;
+            continue;
+        }
+        if (character === '\\' && (quoted || commentDepth > 0)) {
+            if (quoted)
+                candidate += character;
+            escaped = true;
+            continue;
+        }
+        if (commentDepth > 0) {
+            if (character === '(')
+                commentDepth += 1;
+            else if (character === ')')
+                commentDepth -= 1;
+            continue;
+        }
+        if (quoted) {
+            candidate += character;
+            if (character === '"')
+                quoted = false;
+            continue;
+        }
+        if (character === '"') {
+            quoted = true;
+            candidate += character;
+        }
+        else if (character === '(')
+            commentDepth = 1;
+        else if (character === ')')
+            return null;
+        else {
+            if (character === '@')
+                separators.push(candidate.length);
+            candidate += character;
+        }
+    }
+    if (escaped || quoted || commentDepth !== 0 || separators.length !== 1)
+        return null;
+    const separator = separators[0] ?? -1;
+    const local = candidate.slice(0, separator).trim();
+    const domain = candidate.slice(separator + 1).trim();
+    const validLocal = /^(?:[^\s"<>(),:;@]+|"(?:[^"\\]|\\.)+")$/u.test(local);
+    if (!validLocal || !domain || /\s/u.test(domain))
+        return null;
+    return normalizeHeaderDomain(domain);
+}
+export function addressDomains(values) {
+    const domains = new Set();
+    for (const value of values) {
+        const mailboxes = lexicalSegments(value, ',', true);
+        if (!mailboxes)
+            continue;
+        for (const mailbox of mailboxes) {
+            const selected = angleAddress(mailbox);
+            const domain = selected === null ? null : addressDomain(selected);
+            if (domain)
+                domains.add(domain);
+            if (domains.size >= MAX_MAIL_REVIEW_DOMAINS)
+                return [...domains].sort();
+        }
+    }
+    return [...domains].sort();
+}
+export function messageIdDomains(values) {
+    return addressDomains(values.map((value) => value.replace(/[<>]/gu, '')));
+}
+export function authenticationServiceDomains(values) {
+    const output = new Set();
+    for (const value of values) {
+        const clauses = lexicalSegments(value, ';');
+        const service = normalizeHeaderDomain((clauses?.[0] ?? '').trim().split(/\s/u, 1)[0] ?? '');
+        if (service)
+            output.add(service);
+    }
+    return [...output].sort().slice(0, MAX_MAIL_REVIEW_DOMAINS);
+}
+export function dkimSigningDomains(values) {
+    const output = new Set();
+    for (const value of values) {
+        for (const clause of lexicalSegments(value, ';') ?? []) {
+            const match = /^\s*d\s*=\s*([^\s;]+)/iu.exec(clause);
+            const domain = normalizeHeaderDomain(match?.[1] ?? '');
+            if (domain)
+                output.add(domain);
+        }
+    }
+    return [...output].sort().slice(0, MAX_MAIL_REVIEW_DOMAINS);
+}

package/packages/investigation/message-intake.mjs

@@ -0,0 +1,195 @@
+import PostalMime, {} from 'postal-mime';
+import { parse, defaultTreeAdapter } from 'parse5';
+import { sha256ArtifactBytes } from "../evidence/artifact-integrity.mjs";
+import { createLinkIntake } from "./link-intake.mjs";
+import { AUTHENTICATION_METHODS, addressDomains, authenticationServiceDomains, dkimSigningDomains } from "./mail-header-identity.mjs";
+import { createIntakeReport } from "./intake-report.mjs";
+export { assertMessageBytes } from "./intake-report.mjs";
+import { requestedActionHints } from "./requested-action-hints.mjs";
+import { reviewMailAuthentication, aggregateMailAuthentication } from "./mail-authentication-review.mjs";
+import { MAX_AUTHENTICATION_HEADERS } from "../contracts/mail-authentication.mjs";
+import { MAX_MESSAGE_INTAKE_BYTES, MAX_MESSAGE_PARTS, MAX_MESSAGE_DEPTH, MAX_MESSAGE_HTML_NODES } from "../contracts/message-intake.mjs";
+/** All parsing is inert. Only HTTP(S) link targets are offered for deliberate collection. */
+export async function reviewMessageInput(bytes, kind, reviewedAt, qrText) {
+    const base = await createIntakeReport(bytes, kind, reviewedAt);
+    if (!['text', 'email', 'calendar', 'qr'].includes(kind))
+        throw new TypeError('Use the selected-file intake entry point for this format.');
+    const links = createLinkIntake(), identities = [], authenticationClaims = [];
+    const actionHints = new Set(), bounds = new Set();
+    const authenticationHeaders = [];
+    const messageParts = [];
+    let omittedAuthenticationHeaders = 0;
+    let partialAuthentication = false;
+    let reviewedParts = 0, unreviewedAttachments = 0, decodedBytes = 0;
+    const text = (value, source) => {
+        for (const hint of requestedActionHints(value))
+            actionHints.add(hint);
+        links.addText(value, source);
+    };
+    function html(value) {
+        // parse5 never renders, loads resources, or runs supplied script.
+        let allocated = 0;
+        const htmlBound = new Error('HTML work bound');
+        const admit = () => { if (++allocated > MAX_MESSAGE_HTML_NODES)
+            throw htmlBound; };
+        let tree;
+        try {
+            tree = parse(value, { treeAdapter: { ...defaultTreeAdapter,
+                    createElement(...args) { admit(); return defaultTreeAdapter.createElement(...args); },
+                    createTextNode(...args) { admit(); return defaultTreeAdapter.createTextNode(...args); },
+                    createCommentNode(...args) { admit(); return defaultTreeAdapter.createCommentNode(...args); },
+                } });
+        }
+        catch (cause) {
+            if (cause !== htmlBound)
+                throw cause;
+            bounds.add('HTML nodes');
+            return;
+        }
+        const queue = [tree];
+        let nodes = 0;
+        while (queue.length) {
+            if (++nodes > MAX_MESSAGE_HTML_NODES) {
+                bounds.add('HTML nodes');
+                break;
+            }
+            const node = queue.pop();
+            if ('tagName' in node) {
+                const attrs = new Map(node.attrs.map(attr => [attr.name, attr.value]));
+                if (node.tagName === 'a' && attrs.has('href')) {
+                    const shown = [], children = [...node.childNodes];
+                    let count = 0;
+                    while (children.length && ++count <= MAX_MESSAGE_HTML_NODES) {
+                        const child = children.pop();
+                        if ('value' in child)
+                            shown.push(child.value);
+                        if ('childNodes' in child)
+                            children.push(...child.childNodes);
+                    }
+                    links.add(attrs.get('href'), 'html_link', shown.reverse().join('').trim());
+                }
+                if (node.tagName === 'form' && attrs.has('action'))
+                    links.add(attrs.get('action'), 'html_form');
+                if ((node.tagName === 'iframe' || node.tagName === 'frame') && attrs.has('src'))
+                    links.add(attrs.get('src'), 'html_frame');
+                if (node.tagName === 'script' || node.tagName === 'style')
+                    continue;
+            }
+            if ('value' in node)
+                text(node.value, 'text');
+            if ('childNodes' in node)
+                for (let index = node.childNodes.length - 1; index >= 0; index--)
+                    queue.push(node.childNodes[index]);
+        }
+    }
+    function calendar(value) {
+        const unfolded = value.replace(/\r?\n[ \t]/gu, '');
+        // No attendee names, addresses, descriptions or event identifiers enter the report.
+        for (const line of unfolded.split(/\r?\n/u)) {
+            const colon = line.indexOf(':');
+            if (colon < 0)
+                continue;
+            const key = line.slice(0, colon).split(';', 1)[0]?.toUpperCase();
+            if (['URL', 'DESCRIPTION', 'LOCATION', 'X-ALT-DESC'].includes(key ?? ''))
+                text(line.slice(colon + 1).replace(/\\n/giu, '\n').replace(/\\([,;\\])/gu, '$1'), 'calendar');
+        }
+    }
+    function identity(part, role, domains) {
+        for (const domain of domains)
+            identities.push({ part, role, domain });
+    }
+    function headers(mail, part) {
+        const sourceReview = reviewMailAuthentication(mail.headers.map(header => ({ name: header.key, value: header.value })), part, MAX_AUTHENTICATION_HEADERS - authenticationHeaders.length);
+        authenticationHeaders.push(...sourceReview.headers);
+        omittedAuthenticationHeaders += sourceReview.omittedHeaders;
+        partialAuthentication ||= sourceReview.headers.some(header => !['parsed', 'none'].includes(header.state));
+        if (sourceReview.omittedHeaders)
+            bounds.add('Authentication headers');
+        const values = (name) => mail.headers.filter(header => header.key === name).map(header => header.value);
+        identity(part, 'from', addressDomains(values('from')));
+        identity(part, 'reply_to', addressDomains(values('reply-to')));
+        identity(part, 'return_path', addressDomains(values('return-path')));
+        identity(part, 'dkim', dkimSigningDomains(values('dkim-signature')));
+        const reported = values('authentication-results');
+        identity(part, 'authentication_service', authenticationServiceDomains(reported));
+        const aggregate = aggregateMailAuthentication(sourceReview);
+        for (const method of AUTHENTICATION_METHODS) {
+            const claim = aggregate[method];
+            if (claim.observations)
+                authenticationClaims.push({ part, method, result: claim.state });
+        }
+    }
+    async function message(input, depth, parentPart) {
+        if (depth > MAX_MESSAGE_DEPTH || reviewedParts >= MAX_MESSAGE_PARTS) {
+            bounds.add('Message nesting or parts');
+            unreviewedAttachments++;
+            return;
+        }
+        decodedBytes += input.byteLength;
+        if (decodedBytes > MAX_MESSAGE_INTAKE_BYTES * 2) {
+            bounds.add('Decoded message bytes');
+            unreviewedAttachments++;
+            return;
+        }
+        let mail;
+        try {
+            mail = await PostalMime.parse(input, { maxNestingDepth: MAX_MESSAGE_DEPTH, maxHeadersSize: 256 * 1024, rfc822Attachments: true, forceRfc822Attachments: true, attachmentEncoding: 'arraybuffer' });
+        }
+        catch {
+            throw new TypeError('The message could not be decoded within the MIME nesting and header limits. No input was retained.');
+        }
+        const part = ++reviewedParts;
+        messageParts.push({ part, parentPart, digestSha256: parentPart === null ? base.source.digestSha256 : await sha256ArtifactBytes(input), byteLength: input.byteLength });
+        headers(mail, part);
+        if (mail.text)
+            text(mail.text, 'text');
+        if (mail.html)
+            html(mail.html);
+        for (const attachment of mail.attachments) {
+            if (reviewedParts >= MAX_MESSAGE_PARTS) {
+                bounds.add('Message parts');
+                unreviewedAttachments++;
+                continue;
+            }
+            const body = typeof attachment.content === 'string' ? new TextEncoder().encode(attachment.content) : new Uint8Array(attachment.content);
+            if (attachment.mimeType === 'message/rfc822')
+                await message(body, depth + 1, part);
+            else if (attachment.mimeType === 'text/calendar') {
+                reviewedParts++;
+                calendar(new TextDecoder().decode(body));
+            }
+            else {
+                unreviewedAttachments++;
+            }
+        }
+    }
+    if (kind === 'email')
+        await message(bytes, 0, null);
+    else if (kind === 'qr') {
+        if (!Array.isArray(qrText) || qrText.length > MAX_MESSAGE_PARTS || qrText.some(value => typeof value !== 'string' || value.length > 8_192))
+            throw new TypeError('QR review requires bounded decoded text.');
+        reviewedParts = qrText.length;
+        for (const value of qrText) {
+            for (const hint of requestedActionHints(value))
+                actionHints.add(hint);
+            links.addQr(value);
+        }
+    }
+    else {
+        reviewedParts = 1;
+        const value = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        if (kind === 'calendar')
+            calendar(value);
+        else
+            text(value, 'text');
+    }
+    const result = links.result();
+    for (const limitation of result.limitations)
+        bounds.add(limitation);
+    if (result.bounded)
+        bounds.add('Link extraction');
+    return { report: { ...base,
+            coverage: { state: bounds.size || unreviewedAttachments || partialAuthentication ? 'partial' : 'reviewed', reviewedParts, unreviewedAttachments, rejectedLinks: result.rejected, boundsReached: [...bounds] },
+            identities, authenticationClaims, authenticationReview: { headers: authenticationHeaders, omittedHeaders: omittedAuthenticationHeaders }, messageParts,
+            links: result.links, actionHints: [...actionHints] }, targets: result.targets };
+}