@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/packages/investigation/page-behaviour.mjs

@@ -0,0 +1,113 @@
+import { array, boolean, enumeration, exact, integer, text, HEX_DIGEST_RE } from "../evidence/artifact-structure.mjs";
+import { MESSAGE_ACTION_HINTS } from "../contracts/message-intake.mjs";
+import { readCaptureCoverage, captureCoverageIsPartial, captureAttemptDescription } from "./capture-coverage.mjs";
+export const PAGE_BEHAVIOUR_VERSION = 1;
+// Separate from the capture's request, DOM traversal and aggregate byte bounds.
+export const MAX_PAGE_OBSERVATIONS = 500;
+export const PAGE_ACTION_HINTS = MESSAGE_ACTION_HINTS;
+export function pageObservationOrigin(raw, base) {
+    if (typeof raw !== 'string' || raw.length > 8_192 || /[\u0000-\u0020\u007f]/u.test(raw))
+        return null;
+    try {
+        const url = new URL(raw, base);
+        return ['https:', 'http:'].includes(url.protocol) && !url.username && !url.password ? url.origin : null;
+    }
+    catch {
+        return null;
+    }
+}
+function origin(value, nullable = false) {
+    if (nullable && value === null)
+        return null;
+    const candidate = text(value, 'Page observation origin', 500);
+    if (pageObservationOrigin(candidate) !== candidate)
+        throw new TypeError('Page observations retain origins only.');
+    return candidate;
+}
+function hash(value) {
+    if (value === null)
+        return null;
+    if (typeof value !== 'string' || !HEX_DIGEST_RE.test(value))
+        throw new TypeError('Page observation digest must be SHA-256.');
+    return value;
+}
+function ordered(values) {
+    if (values.some((value, index) => index > 0 && value.position <= values[index - 1].position))
+        throw new TypeError('Page observation positions must be unique and increasing.');
+    return values;
+}
+export function readPageBehaviour(raw) {
+    const value = exact(raw, ['version', 'state', 'requests', 'elements', 'actionHints', 'clipboardWriteAttempts', 'coverage'], 'Page behaviour');
+    if (value.version !== PAGE_BEHAVIOUR_VERSION)
+        throw new TypeError('Unsupported page behaviour version.');
+    const requests = ordered(array(value.requests, 'Page requests', MAX_PAGE_OBSERVATIONS).map(raw => {
+        const item = exact(raw, ['position', 'kind', 'origin', 'contentSha256', 'status', 'cspEnforced', 'cspReportOnly'], 'Page request');
+        boolean(item.cspEnforced, 'Enforced policy presence');
+        boolean(item.cspReportOnly, 'Report-only policy presence');
+        const kind = enumeration(item.kind, ['navigation', 'script', 'frame', 'document'], 'Page request kind'), contentSha256 = hash(item.contentSha256);
+        if (kind !== 'script' && contentSha256 !== null)
+            throw new TypeError('Only script response bodies are hashed in page observations.');
+        return { position: integer(item.position, 'Request position', 1, 10_000), kind, origin: origin(item.origin), contentSha256,
+            status: integer(item.status, 'Response status', 100, 599), cspEnforced: item.cspEnforced, cspReportOnly: item.cspReportOnly };
+    }));
+    const elements = ordered(array(value.elements, 'Page elements', MAX_PAGE_OBSERVATIONS).map(raw => {
+        const item = exact(raw, ['position', 'kind', 'origin', 'inline', 'integrity', 'method', 'passwordFields', 'scriptSha256'], 'Page element');
+        const kind = enumeration(item.kind, ['script', 'frame', 'form'], 'Page element kind');
+        boolean(item.inline, 'Inline script');
+        const method = item.method === null ? null : enumeration(item.method, ['get', 'post', 'other'], 'Form method');
+        const passwordFields = integer(item.passwordFields, 'Password field count', 0, 20_000), scriptSha256 = hash(item.scriptSha256);
+        const integrity = enumeration(item.integrity, ['present', 'absent', 'not_applicable'], 'Integrity attribute');
+        if (kind !== 'form' && (method !== null || passwordFields !== 0) || kind === 'form' && method === null
+            || kind !== 'script' && (item.inline || scriptSha256 !== null || integrity !== 'not_applicable')
+            || kind === 'script' && (item.inline && item.origin !== null || !item.inline && scriptSha256 !== null))
+            throw new TypeError('Page element fields do not match their kind.');
+        return { position: integer(item.position, 'Element position', 1, 20_000), kind, origin: origin(item.origin, true), inline: item.inline, integrity, method, passwordFields, scriptSha256 };
+    }));
+    const actionHints = array(value.actionHints, 'Requested-action hints', PAGE_ACTION_HINTS.length).map(raw => enumeration(raw, PAGE_ACTION_HINTS, 'Requested-action hint'));
+    if (new Set(actionHints).size !== actionHints.length)
+        throw new TypeError('Page action hints must not repeat.');
+    const coverage = readCaptureCoverage(value.coverage);
+    if (value.state === 'observed' && captureCoverageIsPartial(coverage))
+        throw new TypeError('Partial request coverage cannot declare complete page observations.');
+    return { version: PAGE_BEHAVIOUR_VERSION, state: enumeration(value.state, ['observed', 'partial'], 'Page observation state'), requests, elements, actionHints,
+        clipboardWriteAttempts: integer(value.clipboardWriteAttempts, 'Blocked clipboard attempts', 0, 1_000_000), coverage };
+}
+export function readManifestPageBehaviour(value, manifestVersion) {
+    if (manifestVersion === 2 && value === undefined)
+        return null;
+    if (manifestVersion !== 3)
+        throw new TypeError('Page behaviour requires capture manifest version 3.');
+    return readPageBehaviour(value);
+}
+/** A missing/partial observation cannot establish removal or unchanged content. */
+export function pageBehaviourRows(input) {
+    return [
+        ...input.requests.map(value => ({ identity: JSON.stringify(['request', value.kind, value.origin, value.contentSha256, value.status, value.cspEnforced, value.cspReportOnly]),
+            label: `${value.kind} response ${value.position} · HTTP ${value.status} · enforced CSP ${value.cspEnforced ? 'present' : 'absent'} · report-only CSP ${value.cspReportOnly ? 'present' : 'absent'}`, origin: value.origin, digest: value.contentSha256 })),
+        ...input.elements.map(value => ({ identity: JSON.stringify(['element', value.kind, value.origin, value.inline, value.integrity, value.method, value.passwordFields, value.scriptSha256]),
+            label: `${value.kind} element ${value.position}${value.inline ? ' · inline' : ''}${value.kind === 'form' ? ` · ${value.method} · ${value.passwordFields} password fields` : value.kind === 'script' ? ` · integrity attribute ${value.integrity}` : ''}`,
+            origin: value.origin, digest: value.scriptSha256 })),
+        ...input.actionHints.map(value => ({ identity: JSON.stringify(['action_wording', value]), label: `Body text wording · ${value.replaceAll('_', ' ')}`, origin: null, digest: null })),
+        ...input.coverage.attempts.filter(value => !['navigation', 'script', 'frame', 'document'].includes(value.channel) || value.state !== 'observed').map(value => ({
+            identity: JSON.stringify(['request_channel', value.channel, value.method, value.origin, value.state, value.reason, value.collectionStarted]),
+            label: `${value.channel.replaceAll('_', ' ')} request ${value.position} · ${captureAttemptDescription(value)}`,
+            origin: value.origin, digest: null,
+        })),
+    ];
+}
+export function comparePageBehaviour(before, after) {
+    const counts = (input) => { const map = new Map(); for (const row of input ? pageBehaviourRows(input) : [])
+        map.set(row.identity, { ...row, count: (map.get(row.identity)?.count ?? 0) + 1 }); return map; };
+    const left = counts(before), right = counts(after), complete = before?.state === 'observed' && after?.state === 'observed';
+    const difference = (a, b) => [...a.values()].filter(row => row.count > (b.get(row.identity)?.count ?? 0))
+        .map(row => ({ ...row, count: row.count - (b.get(row.identity)?.count ?? 0) }));
+    const added = difference(right, left), notReobserved = difference(left, right);
+    const navigation = (value) => value.requests.filter(row => row.kind === 'navigation').map(row => [row.origin, row.status]);
+    const navigationChanged = before && after ? JSON.stringify(navigation(before)) !== JSON.stringify(navigation(after)) : null;
+    const clipboardWriteDelta = before && after ? after.clipboardWriteAttempts - before.clipboardWriteAttempts : null;
+    const requestChannelsChanged = before && after ? JSON.stringify(before.coverage) !== JSON.stringify(after.coverage) : null;
+    return { state: !before || !after ? 'unavailable' : complete ? added.length || notReobserved.length || navigationChanged || clipboardWriteDelta || requestChannelsChanged ? 'changed' : 'unchanged' : 'inconclusive',
+        navigationChanged, clipboardWriteDelta, requestChannelsChanged,
+        added: before ? added : [], notReobserved: after ? notReobserved : [], removalEstablished: false,
+        boundary: 'Selected capture observations, not proof of authorisation, worldwide removal or compromise. Script hashes identify collected bytes; an integrity attribute is not a verified integrity result.' };
+}

package/packages/investigation/pdf-intake.mjs

@@ -0,0 +1,155 @@
+import { getDocument, ImageKind, OPS } from 'pdfjs-dist/legacy/build/pdf.mjs';
+import { createDocumentIntake } from "./document-intake.mjs";
+import { MAX_DOCUMENT_IMAGE_PIXELS, MAX_DOCUMENT_PAGES, MAX_DOCUMENT_TEXT_BYTES, MAX_DOCUMENT_PAGE_OPERATIONS } from "../contracts/document-intake.mjs";
+import { readEvidenceImageDimensions } from "../evidence/image-regions.mjs";
+import { MAX_INTAKE_LINKS, MAX_INTAKE_URL_LENGTH } from "../contracts/message-intake.mjs";
+/** No document-controlled resource can reach a filesystem or network fetcher. */
+class NoExternalBinaryData {
+    async fetch() { throw new TypeError('External PDF resources are not loaded.'); }
+}
+function imagePixels(raw) {
+    if (!raw || typeof raw !== 'object')
+        throw new TypeError('The PDF image is unavailable.');
+    const value = raw;
+    const { width, height } = readEvidenceImageDimensions(value.width, value.height);
+    if (!(value.data instanceof Uint8Array) && !(value.data instanceof Uint8ClampedArray))
+        throw new TypeError('The PDF image has no supported pixel data.');
+    const data = value.data, count = width * height, pixels = new Uint8ClampedArray(count * 4);
+    if (value.kind === ImageKind.RGBA_32BPP && data.length === pixels.length)
+        pixels.set(data);
+    else if (value.kind === ImageKind.RGB_24BPP && data.length === count * 3) {
+        for (let index = 0; index < count; index++) {
+            pixels.set(data.subarray(index * 3, index * 3 + 3), index * 4);
+            pixels[index * 4 + 3] = 255;
+        }
+    }
+    else if (value.kind === ImageKind.GRAYSCALE_1BPP && data.length === Math.ceil(width / 8) * height) {
+        const stride = Math.ceil(width / 8);
+        for (let y = 0; y < height; y++)
+            for (let x = 0; x < width; x++) {
+                const colour = data[y * stride + (x >> 3)] & (128 >> (x % 8)) ? 255 : 0;
+                pixels.set([colour, colour, colour, 255], (y * width + x) * 4);
+            }
+    }
+    else
+        throw new TypeError('The PDF image pixel layout is unsupported.');
+    return { width, height, pixels };
+}
+export async function reviewPdfInput(bytes, reviewedAt, worker) {
+    const review = await createDocumentIntake(bytes, 'pdf', reviewedAt);
+    // PDF.js takes ownership of its input. The selected original stays unchanged.
+    const task = getDocument({ data: bytes.slice(), ...(worker ? { worker } : {}),
+        BinaryDataFactory: NoExternalBinaryData, useWorkerFetch: false, useWasm: false,
+        useSystemFonts: false, disableFontFace: true, enableXfa: false,
+        isOffscreenCanvasSupported: false, isImageDecoderSupported: false,
+        maxImageSize: MAX_DOCUMENT_IMAGE_PIXELS, stopAtErrors: true, verbosity: 0,
+        disableAutoFetch: true, disableStream: true, disableRange: true });
+    try {
+        const document = await task.promise;
+        const total = document.numPages, admitted = Math.min(total, MAX_DOCUMENT_PAGES);
+        review.pages(total, 0);
+        if (total > admitted)
+            review.partial('Further PDF pages exceed the page review bound.');
+        if (document.isPureXfa) {
+            review.unavailable('unsupported', 'XFA documents are not rendered or executed.');
+            return review.finish();
+        }
+        let textCharacters = 0;
+        for (let pageNumber = 1; pageNumber <= admitted; pageNumber++) {
+            const page = await document.getPage(pageNumber);
+            try {
+                const reader = page.streamTextContent().getReader();
+                let text = '';
+                try {
+                    for (;;) {
+                        const chunk = await reader.read();
+                        if (chunk.done)
+                            break;
+                        for (const item of chunk.value.items) {
+                            if (typeof item.str !== 'string')
+                                continue;
+                            textCharacters += item.str.length + 1;
+                            if (textCharacters > MAX_DOCUMENT_TEXT_BYTES) {
+                                review.partial('Further PDF text exceeds the text review bound.');
+                                break;
+                            }
+                            text += item.str + (item.hasEOL ? '\n' : ' ');
+                        }
+                        if (textCharacters > MAX_DOCUMENT_TEXT_BYTES) {
+                            await reader.cancel();
+                            break;
+                        }
+                    }
+                    await review.text(text, pageNumber);
+                }
+                catch {
+                    review.partial(`Text on page ${pageNumber} could not be fully decoded.`);
+                }
+                finally {
+                    reader.releaseLock();
+                }
+                try {
+                    const annotations = await page.getAnnotations(), destinations = [];
+                    for (const annotation of annotations) {
+                        if (typeof annotation.url !== 'string')
+                            continue;
+                        if (annotation.url.length > MAX_INTAKE_URL_LENGTH || destinations.length >= MAX_INTAKE_LINKS) {
+                            review.partial(`Some links on page ${pageNumber} exceed the link review bound.`);
+                            continue;
+                        }
+                        destinations.push(annotation.url);
+                    }
+                    await review.destinations(destinations, pageNumber);
+                }
+                catch {
+                    review.partial(`Links on page ${pageNumber} could not be fully decoded.`);
+                }
+                try {
+                    const operations = await page.getOperatorList(), seen = new Set();
+                    if (operations.fnArray.length > MAX_DOCUMENT_PAGE_OPERATIONS)
+                        review.partial(`Image operations on page ${pageNumber} exceed the review bound.`);
+                    else
+                        for (let index = 0; index < operations.fnArray.length; index++) {
+                            const operation = operations.fnArray[index], args = operations.argsArray[index];
+                            let raw;
+                            if (operation === OPS.paintImageXObject || operation === OPS.paintImageXObjectRepeat) {
+                                const id = args?.[0];
+                                if (typeof id !== 'string' || seen.has(id))
+                                    continue;
+                                seen.add(id);
+                                raw = await new Promise(resolve => (id.startsWith('g_') ? page.commonObjs : page.objs).get(id, resolve));
+                            }
+                            else if (operation === OPS.paintInlineImageXObject)
+                                raw = args?.[0];
+                            else
+                                continue;
+                            try {
+                                await review.image(imagePixels(raw), pageNumber);
+                            }
+                            catch {
+                                review.partial(`An image on page ${pageNumber} has unsupported or unavailable pixels.`);
+                            }
+                        }
+                }
+                catch {
+                    review.partial(`Image operations on page ${pageNumber} could not be fully decoded.`);
+                }
+                review.pages(total, pageNumber);
+            }
+            finally {
+                page.cleanup();
+            }
+        }
+        review.partial('QR review covers decoded embedded raster images, not vector artwork or a rendered-page reconstruction. Scripts, forms, embedded files and external resources are not executed or opened.');
+    }
+    catch (cause) {
+        if (cause instanceof Error && cause.name === 'PasswordException')
+            review.unavailable('encrypted', 'The PDF requires a password. Review an explicitly decrypted copy; no password was requested or retained.');
+        else
+            review.unavailable('unsupported', 'The PDF could not be decoded completely within this review. The original bytes are unchanged.');
+    }
+    finally {
+        await task.destroy();
+    }
+    return review.finish();
+}

package/packages/investigation/platform-continuity-review.mjs

@@ -0,0 +1,60 @@
+import { array, enumeration, exact, iso, text } from "../evidence/artifact-structure.mjs";
+import { pageObservationOrigin } from "./page-behaviour.mjs";
+import { CASE_PROVIDER_OUTCOMES, CASE_OBSERVED_EFFECT_STATES } from "../cases/case-response-records.mjs";
+import { CONTEXT_REVIEW_SCHEMA, CONTEXT_REVIEW_VERSION, MAX_CONTEXT_RECORDS } from "../contracts/context-review.mjs";
+export { PLATFORM_CONTINUITY_INPUT_SCHEMA, PLATFORM_CONTINUITY_INPUT_VERSION } from "../contracts/context-review.mjs";
+export const PLATFORM_OBJECT_TYPES = ['account', 'tenant', 'application', 'extension', 'package', 'page', 'channel', 'post'];
+export const PLATFORM_REPORT_STATES = ['not_reported', 'submitted', 'acknowledged'];
+export function readPlatformObjects(raw) {
+    const rows = array(raw, 'Platform objects', MAX_CONTEXT_RECORDS).map(value => {
+        const row = exact(value, ['platformOrigin', 'objectType', 'objectId', 'version', 'observedAt', 'source', 'report', 'providerOutcome', 'recheck', 'recheckedAt'], 'Platform object');
+        const platformOrigin = text(row.platformOrigin, 'Platform origin', 500);
+        if (pageObservationOrigin(platformOrigin) !== platformOrigin)
+            throw new TypeError('Platform origin must be an HTTP(S) origin without credentials, paths or query data.');
+        const objectId = text(row.objectId, 'Stable object ID', 240);
+        if (!/^[A-Za-z0-9_@.:%/+~-]+$/u.test(objectId))
+            throw new TypeError('Stable object ID must contain identifier characters, not free text.');
+        iso(row.observedAt, 'Object observation time');
+        iso(row.recheckedAt, 'Object recheck time', true);
+        const recheck = enumeration(row.recheck, CASE_OBSERVED_EFFECT_STATES, 'Object recheck');
+        if ((recheck === 'not_checked') !== (row.recheckedAt === null))
+            throw new TypeError('A recheck result needs its own observation time; unchecked objects must not carry one.');
+        if (row.recheckedAt !== null && Date.parse(row.recheckedAt) < Date.parse(row.observedAt))
+            throw new TypeError('Object recheck predates its observation.');
+        const report = enumeration(row.report, PLATFORM_REPORT_STATES, 'Report status');
+        const providerOutcome = row.providerOutcome === null ? null : enumeration(row.providerOutcome, CASE_PROVIDER_OUTCOMES, 'Provider outcome');
+        if (providerOutcome !== null && report === 'not_reported')
+            throw new TypeError('A provider outcome needs a reported object.');
+        return { platformOrigin, objectType: enumeration(row.objectType, PLATFORM_OBJECT_TYPES, 'Platform object type'), objectId,
+            version: row.version === null ? null : text(row.version, 'Object version', 100), observedAt: row.observedAt, source: text(row.source, 'Object source', 500), report, providerOutcome, recheck, recheckedAt: row.recheckedAt };
+    });
+    const identities = rows.map(row => JSON.stringify([row.platformOrigin, row.objectType, row.objectId, row.version, row.observedAt]));
+    if (new Set(identities).size !== rows.length)
+        throw new TypeError('Duplicate platform object observations must be reconciled explicitly.');
+    return rows;
+}
+export function groupPlatformObjects(rows) {
+    const groups = new Map();
+    for (const row of rows) {
+        const key = JSON.stringify([row.platformOrigin, row.objectType, row.objectId]);
+        groups.set(key, [...(groups.get(key) ?? []), row]);
+    }
+    return [...groups.values()].map(values => values.sort((a, b) => Date.parse(a.observedAt) - Date.parse(b.observedAt)));
+}
+export function reviewPlatformContinuity(raw, reviewedAt) {
+    iso(reviewedAt, 'Review time');
+    const rows = readPlatformObjects(raw), groups = groupPlatformObjects(rows);
+    const observations = [];
+    for (const values of groups) {
+        const versions = new Set(values.map(row => row.version).filter(value => value !== null));
+        for (const row of values)
+            observations.push({ label: `${row.objectType} · ${row.objectId}${row.version ? ` · version ${row.version}` : ''}`, state: 'reported',
+                detail: `${row.report.replaceAll('_', ' ')}; provider outcome: ${row.providerOutcome?.replaceAll('_', ' ') ?? 'not supplied'}; independent recheck: ${row.recheck.replaceAll('_', ' ')}${row.recheckedAt ? ` at ${row.recheckedAt}` : ''}. ${versions.size > 1 ? `${versions.size} versions retained for this same declared object.` : 'No version change established.'}`,
+                source: `${row.platformOrigin} · ${row.source}`, observedAt: row.observedAt, hostname: new URL(row.platformOrigin).hostname });
+    }
+    const unresolved = rows.filter(row => ['not_checked', 'still_observed', 'changed', 'unavailable'].includes(row.recheck)).length;
+    return { schema: CONTEXT_REVIEW_SCHEMA, version: CONTEXT_REVIEW_VERSION, kind: 'platform_continuity', reviewedAt, title: 'Platform object continuity',
+        state: rows.length ? 'reviewed' : 'partial', summary: `Recorded observations: ${rows.length}; distinct platform objects: ${groups.length}; observations needing follow-up or a qualified outcome: ${unresolved}.`, observations,
+        nextSteps: ['Use the exact object and version when preparing a provider report; do not report an entire shared platform from a hosted URL alone.', 'Record each report and recheck separately. New versions, changed content and newly observed objects require their own review.'],
+        limitations: ['Platform origin, object identity and outcomes are analyst-supplied metadata, not verified provider telemetry.', 'A matching object ID establishes only declared continuity within that platform and object type. Provider resolution is separate from independent recheck; not reproduced does not establish worldwide removal.'] };
+}

package/packages/investigation/qr-intake.mjs

@@ -0,0 +1,56 @@
+import { binarize, Decoder, Detector } from '@nuintun/qrcode';
+import { decodeEvidencePng } from "../evidence/png-pixels.mjs";
+import { assertMessageBytes, reviewMessageInput } from "./message-intake.mjs";
+import { readEvidenceImageDimensions } from "../evidence/image-regions.mjs";
+export const MAX_QR_DETECTION_ATTEMPTS = 256;
+export function decodeQrPixels(image) {
+    readEvidenceImageDimensions(image.width, image.height);
+    if (!(image.pixels instanceof Uint8ClampedArray) || image.pixels.length !== image.width * image.height * 4)
+        throw new TypeError('Invalid QR pixel surface.');
+    const luminance = new Uint8Array(image.width * image.height);
+    for (let index = 0; index < luminance.length; index++) {
+        const offset = index * 4, alpha = image.pixels[offset + 3] / 255;
+        luminance[index] = Math.round((image.pixels[offset] * 0.299 + image.pixels[offset + 1] * 0.587 + image.pixels[offset + 2] * 0.114) * alpha + 255 * (1 - alpha));
+    }
+    const texts = new Set();
+    let attempts = 0, bounded = false, structured = false;
+    // Normal and inverted symbols are both considered, without altering originals.
+    for (const inverted of [false, true]) {
+        if (inverted)
+            for (let index = 0; index < luminance.length; index++)
+                luminance[index] = 255 - luminance[index];
+        const candidates = new Detector().detect(binarize(luminance, image.width, image.height)), decoder = new Decoder();
+        let candidate = candidates.next();
+        while (!candidate.done) {
+            if (++attempts > MAX_QR_DETECTION_ATTEMPTS) {
+                bounded = true;
+                candidates.return();
+                break;
+            }
+            let decoded = false;
+            try {
+                const symbol = decoder.decode(candidate.value.matrix);
+                decoded = true;
+                if (symbol.structured)
+                    structured = true;
+                else if (symbol.content.length <= 8_192)
+                    texts.add(symbol.content);
+                else
+                    bounded = true;
+            }
+            catch { /* A finder-pattern candidate need not contain a decodable symbol. */ }
+            candidate = candidates.next(decoded);
+        }
+        if (bounded)
+            break;
+    }
+    return { texts: [...texts], bounded, structured };
+}
+export async function reviewQrInput(bytes, reviewedAt) {
+    assertMessageBytes(bytes);
+    const { texts, bounded, structured } = decodeQrPixels(decodeEvidencePng(bytes));
+    const result = await reviewMessageInput(bytes, 'qr', reviewedAt, texts);
+    const boundsReached = [...result.report.coverage.boundsReached, ...(bounded ? ['QR candidate work'] : []), ...(structured ? ['Multi-symbol structured content requires reassembly'] : [])];
+    return { ...result, report: { ...result.report, coverage: { ...result.report.coverage,
+                state: boundsReached.length ? 'partial' : result.report.coverage.state, boundsReached } } };
+}

package/packages/investigation/requested-action-hints.mjs

@@ -0,0 +1,11 @@
+const HINTS = {
+    clipboard_instruction: /(?:clipboard|copy.{0,40}(?:paste|command)|paste.{0,40}(?:terminal|run|console))/iu,
+    shell_instruction: /(?:powershell|cmd\.exe|curl\s|wget\s|terminal|windows\s*\+\s*r)/iu,
+    verification_prompt: /(?:verify.{0,40}(?:human|browser)|not a robot|captcha|browser.{0,40}(?:repair|update))/iu,
+    device_code_instruction: /(?:device[ -]code|enter.{0,40}code.{0,40}(?:sign|login|log in))/iu,
+    consent_instruction: /(?:grant.{0,40}(?:access|permission)|consent|approve.{0,40}(?:application|permission))/iu,
+};
+/** Wording matches are review leads, never a conclusion about intent or execution. */
+export function requestedActionHints(value) {
+    return Object.entries(HINTS).filter(([, expression]) => expression.test(value)).map(([hint]) => hint);
+}

package/packages/investigation/selected-input-review.mjs

@@ -0,0 +1,17 @@
+/** One format dispatch for browser and CLI; parsers load only when selected. */
+export async function reviewSelectedInput(bytes, kind, reviewedAt, pdfWorker) {
+    switch (kind) {
+        case 'text':
+        case 'email':
+        case 'calendar': return (await import("./message-intake.mjs")).reviewMessageInput(bytes, kind, reviewedAt);
+        case 'qr': return (await import("./qr-intake.mjs")).reviewQrInput(bytes, reviewedAt);
+        case 'docx': return (await import("./docx-intake.mjs")).reviewDocxInput(bytes, reviewedAt);
+        case 'pdf': return (await import("./pdf-intake.mjs")).reviewPdfInput(bytes, reviewedAt, pdfWorker);
+        case 'har': return (await import("./har-intake.mjs")).reviewHarInput(bytes, reviewedAt);
+        case 'identity': return (await import("./identity-event-intake.mjs")).reviewIdentityEventInput(bytes, reviewedAt);
+        default: {
+            const unsupported = kind;
+            throw new TypeError(`Unsupported selected input: ${String(unsupported)}`);
+        }
+    }
+}

package/packages/investigation/storefront-review.mjs

@@ -0,0 +1,70 @@
+import { array, boolean, domain, enumeration, exact, HEX_DIGEST_RE, iso, text } from "../evidence/artifact-structure.mjs";
+import { pageObservationOrigin } from "./page-behaviour.mjs";
+import { CONTEXT_REVIEW_SCHEMA, CONTEXT_REVIEW_VERSION, MAX_CONTEXT_RECORDS } from "../contracts/context-review.mjs";
+export { STOREFRONT_INPUT_SCHEMA, STOREFRONT_INPUT_VERSION } from "../contracts/context-review.mjs";
+export const STOREFRONT_FIELDS = [
+    { id: 'brandNames', label: 'Displayed brand names', treatment: 'text' },
+    { id: 'contactDomains', label: 'Published contact domains', treatment: 'domain' },
+    { id: 'policyHashes', label: 'Policy text SHA-256 digests', treatment: 'hash' },
+    { id: 'checkoutOrigins', label: 'Checkout destinations', treatment: 'origin' },
+    { id: 'paymentMethods', label: 'Advertised payment methods', treatment: 'text' },
+    { id: 'assetHashes', label: 'Distinctive asset SHA-256 digests', treatment: 'hash' },
+];
+export function readStorefrontObservation(raw) {
+    const row = exact(raw, ['hostname', 'observedAt', 'source', ...STOREFRONT_FIELDS.map(field => field.id)], 'Storefront observation');
+    domain(row.hostname, 'Storefront hostname');
+    iso(row.observedAt, 'Storefront observation time');
+    const fields = {};
+    let count = 0;
+    for (const field of STOREFRONT_FIELDS) {
+        if (row[field.id] === null) {
+            fields[field.id] = null;
+            continue;
+        }
+        const values = array(row[field.id], field.label, MAX_CONTEXT_RECORDS);
+        count += values.length;
+        if (count > MAX_CONTEXT_RECORDS)
+            throw new TypeError('A storefront observation exceeds the aggregate evidence-item bound.');
+        fields[field.id] = [...new Set(values.map(value => {
+                const candidate = text(value, field.label, 500);
+                if (field.treatment === 'domain')
+                    domain(candidate, field.label);
+                if (field.treatment === 'hash' && !HEX_DIGEST_RE.test(candidate))
+                    throw new TypeError('Storefront digests must be lowercase hexadecimal SHA-256.');
+                if (field.treatment === 'origin' && pageObservationOrigin(candidate) !== candidate)
+                    throw new TypeError('Checkout observations retain HTTP(S) origins only.');
+                return candidate;
+            }))].sort();
+    }
+    return { hostname: row.hostname, observedAt: row.observedAt, source: text(row.source, 'Storefront source', 500), ...fields };
+}
+export function reviewStorefront(raw, reviewedAt) {
+    iso(reviewedAt, 'Review time');
+    const input = exact(raw, ['official', 'candidate', 'authorisedComparator', 'resellerStatus', 'resellerSource'], 'Storefront comparison');
+    boolean(input.authorisedComparator, 'Comparator authority');
+    if (!input.authorisedComparator)
+        throw new TypeError('Confirm that the official comparator is owned or authorised for this review.');
+    const official = readStorefrontObservation(input.official), candidate = readStorefrontObservation(input.candidate);
+    if (official.hostname === candidate.hostname)
+        throw new TypeError('Select a different candidate hostname for storefront comparison.');
+    const reseller = enumeration(input.resellerStatus, ['authorised', 'not_authorised', 'unknown'], 'Reseller status');
+    const resellerSource = input.resellerSource === null ? null : text(input.resellerSource, 'Reseller evidence', 500);
+    if (reseller !== 'unknown' && !resellerSource)
+        throw new TypeError('A reseller-status declaration needs its source or authority reference.');
+    const observations = [];
+    let missing = 0;
+    for (const field of STOREFRONT_FIELDS) {
+        const left = official[field.id], right = candidate[field.id];
+        if (left === null || right === null)
+            missing++;
+        const shared = left && right ? right.filter(value => left.includes(value)) : [];
+        observations.push({ label: field.label, state: left === null || right === null ? 'unknown' : 'observed',
+            detail: `Official: ${left === null ? 'not reviewed' : left.length ? left.join(', ') : 'no values recorded'}. Candidate: ${right === null ? 'not reviewed' : right.length ? right.join(', ') : 'no values recorded'}. ${left !== null && right !== null ? `Exact shared values: ${shared.length}.` : 'No comparison established.'}`,
+            source: `${official.hostname} · ${official.source} · ${official.observedAt} / ${candidate.hostname} · ${candidate.source}`, observedAt: candidate.observedAt, hostname: candidate.hostname });
+    }
+    observations.push({ label: 'Reseller or affiliate authority', state: reseller === 'unknown' ? 'unknown' : 'reported', detail: reseller.replaceAll('_', ' '), source: resellerSource ?? 'No authority evidence supplied', observedAt: null, hostname: candidate.hostname });
+    return { schema: CONTEXT_REVIEW_SCHEMA, version: CONTEXT_REVIEW_VERSION, kind: 'storefront', reviewedAt, title: 'Storefront comparison', state: missing ? 'partial' : 'reviewed',
+        summary: `${candidate.hostname} compared with the authorised reference ${official.hostname}; evidence categories missing one side: ${missing}.`, observations,
+        nextSteps: ['Check reseller, affiliate and regional-store authority before preparing a complaint.', 'Retain the source pages and distinctive assets privately; select relevant findings in the Case response packet.', 'Use the observed checkout platform and the rights or policy evidence to choose a reporting route. Do not enter payment information or submit an order.'],
+        limitations: ['This compares analyst-supplied observations. It does not collect a page, verify a merchant, submit a payment or issue a scam score.', 'Shared wording, assets and payment providers can have legitimate explanations. Digests establish byte equality only when inputs were captured consistently; missing observations do not establish absence.'] };
+}

package/packages/workspace/brand-profile-model.mjs

@@ -1,7 +1,7 @@
 // Pure Brand Profile normalization and storage model. The browser wrapper owns
 // persistence and downloads; this module owns schema migration, semantic field
 // bounds, import merging, and exact serialized-byte accounting.
-import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { canonicalDomainControlRecords, normalizeDeclaredDomainControlRecordModes, normalizeDomainControlRecordModes } from "../evidence/domain-control-runtime.mjs";
 import { DOMAIN_CONTROL_RECORD_LIST_FIELDS } from "../contracts/domain-control-manifest.mjs";
@@ -10,7 +10,7 @@ import { MAX_IDENTITY_DIGEST_BYTES, sha256IdentityHex } from "../evidence/record
 import { DOMAIN_POSTURE_COMPARISON_VERSION, MAX_POSTURE_CHECKS, MAX_POSTURE_CHECK_RECORDS, MAX_POSTURE_RECORD_LENGTH, normalizeDomainPostureSourceContext, normalizeDomainPostureProfileContext } from "../evidence/domain-posture-context.mjs";
 import { normalizeOpaqueReferenceId } from "../cases/opaque-reference-id.mjs";
 import { normalizePageBaseline } from "./page-baseline.mjs";
-import { isInformativePerceptualHash as isInformativeFaviconHash } from "../../lib/perceptual-hash-comparison.mjs";
+import { isInformativePerceptualHash as isInformativeFaviconHash } from "../analysis/perceptual-hash-comparison.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_OFFICIAL_CHANNELS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_URL_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, MAX_RIGHTS_REFERENCES, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
 export { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_OFFICIAL_CHANNELS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_URL_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, MAX_RIGHTS_REFERENCES, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";

package/packages/workspace/bulk-review-model.mjs

@@ -1,4 +1,4 @@
-import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { CASE_DISPOSITIONS as CASE_DISPOSITION_OPTIONS } from "../cases/case-record-contracts.mjs";
 import { BULK_SORT_KEYS, normalizeBulkPresentationSortKey } from "./bulk-sort.mjs";
 import { normalizeBulkResultColumns } from "./bulk-columns.mjs";
@@ -235,37 +235,38 @@ export function mergeBulkReviewStores(localRaw, importedRaw) {
     const rows = new Map(local.rows.map((item) => [item.domain, item]));
     let added = 0;
     let updated = 0;
-    let skipped = 0;
-    for (const candidate of imported.presets) {
-        const existing = presets.get(candidate.id);
-        if (!existing) {
-            presets.set(candidate.id, candidate);
-            added += 1;
-        }
-        else if (candidate.updatedAt > existing.updatedAt) {
-            presets.set(candidate.id, candidate);
-            updated += 1;
-        }
-        else {
+    const supplied = sourceLists(importedRaw);
+    let skipped = supplied.presets.length + supplied.rows.length - imported.presets.length - imported.rows.length;
+    let capacitySkipped = 0;
+    let bytes = byteLength(JSON.stringify(local));
+    if (bytes > MAX_BULK_REVIEW_STORE_BYTES)
+        throw new Error('Existing Bulk review preferences exceed the workspace storage limit; no imported changes were applied.');
+    function admit(target, key, candidate, maximum) {
+        const existing = target.get(key);
+        if (existing && candidate.updatedAt <= existing.updatedAt) {
             skipped += 1;
+            return;
         }
-    }
-    for (const candidate of imported.rows) {
-        const existing = rows.get(candidate.domain);
-        if (!existing) {
-            rows.set(candidate.domain, candidate);
-            added += 1;
-        }
-        else if (candidate.updatedAt > existing.updatedAt) {
-            rows.set(candidate.domain, candidate);
-            updated += 1;
-        }
-        else {
+        const delta = byteLength(JSON.stringify(candidate)) - (existing ? byteLength(JSON.stringify(existing)) : 0)
+            + (!existing && target.size ? 1 : 0);
+        if ((!existing && target.size >= maximum) || bytes + delta > MAX_BULK_REVIEW_STORE_BYTES) {
             skipped += 1;
+            capacitySkipped += 1;
+            return;
         }
+        target.set(key, candidate);
+        bytes += delta;
+        if (existing)
+            updated += 1;
+        else
+            added += 1;
     }
+    for (const candidate of imported.presets)
+        admit(presets, candidate.id, candidate, MAX_BULK_REVIEW_PRESETS);
+    for (const candidate of imported.rows)
+        admit(rows, candidate.domain, candidate, MAX_BULK_REVIEW_ROWS);
     return {
-        store: enforceBulkReviewBudget({
+        store: normalizeBulkReviewStore({
             schema: BULK_REVIEW_SCHEMA,
             version: BULK_REVIEW_SCHEMA_VERSION,
             presets: [...presets.values()],
@@ -274,5 +275,6 @@ export function mergeBulkReviewStores(localRaw, importedRaw) {
         added,
         updated,
         skipped,
+        reason: capacitySkipped ? `${capacitySkipped} imported Bulk review records did not fit the remaining storage capacity. Existing local records are preserved.` : '',
     };
 }