@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/cli/artifact-validation/case-response.mjs

@@ -1,6 +1,12 @@
 import { createHash } from 'node:crypto';
+import { readCaseEvidenceRequest, readCasePacketAmendment, assertEvidenceRequestEvent, assertEvidenceRequestHistory, assertPacketAmendmentSelection } from "../../packages/cases/case-requested-evidence.mjs";
+import { readCaseDeliveryPacketReceipt, readCasePacketCorrection, assertDeliveryPacketReceipt, correctionDelivery } from "../../packages/cases/case-packet-correction.mjs";
+import { CASE_SELECTED_EVIDENCE_SOURCE_LIMITATION } from "../../packages/cases/case-evidence-links.mjs";
+import { OBJECT_RESPONSE_CASE_PACKET_VERSION, OBJECT_RESPONSE_CASE_REVIEW_INPUTS_VERSION } from "../../packages/contracts/case-portability.mjs";
 import { canonicalArtifactJsonV2 } from "../../packages/evidence/artifact-integrity.mjs";
-import { CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_2_CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_3_CASE_RESPONSE_PACKET_VERSION, PUBLIC_CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_CASE_RESPONSE_PACKET_VERSION, CASE_RESPONSE_REVIEW_INPUTS_SCHEMA, CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_2_CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_3_CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_CASE_RESPONSE_REVIEW_INPUTS_VERSION, MAX_ABUSIVE_URLS, MAX_RESPONSE_ARTEFACT_REFERENCES, MAX_RESPONSE_AUTHORISATION_CLOCK_SKEW_MS, MAX_RESPONSE_ACTION_HISTORY, MAX_RESPONSE_CONTACTS, MAX_RESPONSE_CONTRADICTIONS, MAX_RESPONSE_SELECTED_EVIDENCE, RESPONSE_AUTHORISATION_CONFIRMATION_IDS, RESPONSE_PACKET_PROFILES, RESPONSE_CONTACT_KINDS, RESPONSE_PACKET_PROFILE_IDS, RESPONSE_READINESS_ROW_IDS, RESPONSE_READINESS_STATES, RESPONSE_ROUTE_STALE_AFTER_DAYS, } from "../../packages/cases/case-response-packet.mjs";
+import { EVIDENCE_FOLLOW_UP_CASE_RESPONSE_PACKET_VERSION, EVIDENCE_FOLLOW_UP_CASE_RESPONSE_REVIEW_INPUTS_VERSION } from "../../packages/contracts/case-portability.mjs";
+import { readCaseResponseObject, readCaseResponseObjects, readCaseResponseObjectOutcome, assertCaseObjectOutcome } from "../../packages/cases/case-response-object.mjs";
+import { CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_2_CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_3_CASE_RESPONSE_PACKET_VERSION, PUBLIC_CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_CASE_RESPONSE_PACKET_VERSION, CASE_RESPONSE_REVIEW_INPUTS_SCHEMA, CASE_RESPONSE_REVIEW_INPUTS_VERSION, LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION, LATEST_PUBLIC_CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_2_CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_3_CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_CASE_RESPONSE_REVIEW_INPUTS_VERSION, MAX_ABUSIVE_URLS, MAX_RESPONSE_ARTEFACT_REFERENCES, MAX_RESPONSE_AUTHORISATION_CLOCK_SKEW_MS, MAX_RESPONSE_ACTION_HISTORY, MAX_RESPONSE_CONTACTS, MAX_RESPONSE_CONTRADICTIONS, MAX_RESPONSE_SELECTED_EVIDENCE, RESPONSE_AUTHORISATION_CONFIRMATION_IDS, RESPONSE_PACKET_PROFILES, RESPONSE_CONTACT_KINDS, RESPONSE_PACKET_PROFILE_IDS, RESPONSE_READINESS_ROW_IDS, RESPONSE_READINESS_STATES, RESPONSE_ROUTE_STALE_AFTER_DAYS, } from "../../packages/cases/case-response-packet.mjs";
 import { CASE_ACTION_EVENT_SOURCE_CLASSES, CASE_ACTION_STATES, CASE_ACTION_TYPES, CASE_CLOSURE_REASONS, CASE_OBSERVED_EFFECT_SOURCE_CLASSES, CASE_OBSERVED_EFFECT_STATES, CASE_PROVIDER_OUTCOMES, isLegalCaseActionTransition, MAX_CASE_ACTION_EVENTS_PER_ACTION, MAX_CASE_ACTIONS, MAX_CASE_ASSERTIONS, MAX_CASE_DECISIONS, MAX_CASE_EVIDENCE_PINS, MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_LIMITATION_LENGTH, MAX_RESPONSE_LIMITATIONS, MAX_RESPONSE_RECIPIENT_LENGTH, } from "../../packages/cases/case-response-model.mjs";
 import { HEX_DIGEST_RE, array, boolean, domain, enumeration, exact, exactOptional, fail, integer, iso, optionalText, sameValues, strings, text, } from "./structure-primitives.mjs";
 const CASE_RESPONSE_PREFLIGHT_IDS_V6 = [
@@ -281,7 +287,8 @@ function validateVersionedCaseResponsePacket(value, version) {
         fail('Case-response abusive URLs');
     text(incident.observedHarm, 'Case-response observed harm', 2_000);
     iso(incident.observedAt, 'Case-response observedAt');
-    if (profile.subject !== `${selectedProfile?.subjectPrefix}: ${caseRecord.domain} (${incident.category})`)
+    if (profile.subject !== `${selectedProfile?.subjectPrefix}: ${caseRecord.domain} (${incident.category})`
+        && (version < 13 || profile.subject !== `Correction or retraction request: ${caseRecord.domain} (${incident.category})`))
         fail('Case-response profile subject');
     const contacts = array(root.contacts, 'Case-response contacts', MAX_RESPONSE_CONTACTS);
     const contactKeys = new Set();
@@ -378,7 +385,10 @@ function validateVersionedCaseResponsePacket(value, version) {
     const evidence = array(root.selectedEvidence, 'Case-response selected evidence', MAX_RESPONSE_SELECTED_EVIDENCE);
     const evidenceIds = new Set();
     for (const candidate of evidence) {
-        const item = exactOptional(candidate, ['id', 'label', 'source', 'observedAt', 'completeness', 'limitations'], version > PUBLISHED_V2_3_CASE_RESPONSE_PACKET_VERSION ? ['observationHostname'] : [], 'Case-response selected evidence');
+        const item = exactOptional(candidate, ['id', 'label', 'source', 'observedAt', 'completeness', 'limitations'], [...(version > PUBLISHED_V2_3_CASE_RESPONSE_PACKET_VERSION ? ['observationHostname', 'webObservationMode'] : []), ...(version >= 12 ? ['responseObject'] : [])], 'Case-response selected evidence');
+        readCaseResponseObject(item.responseObject);
+        if (item.webObservationMode !== undefined && item.webObservationMode !== 'selected_url')
+            fail('Case-response web observation mode');
         const id = text(item.id, 'Case-response evidence id', 64);
         if (evidenceIds.has(id))
             fail('Case-response selected evidence');
@@ -543,13 +553,17 @@ function validateVersionedCaseResponsePacket(value, version) {
     const actionIdOrder = [];
     const providerEvents = [];
     for (const candidate of history) {
-        const action = exact(candidate, [
+        const action = exactOptional(candidate, [
             'actionId', 'type', 'recipient', 'contactSource', 'state', 'reference',
             'providerOutcome', 'outcomeDetail', 'originActionId', 'historyOmitted',
             'historyLimitations', 'transitions', 'createdAt', 'updatedAt',
             ...(hasActionBinding ? ['routeObservedAt'] : []),
             ...(hasPlatformRoutes ? ['routeReviewAfter'] : []),
-        ], 'Case-response escalation action');
+        ], [...(Number(root.schemaVersion) >= 11 ? ['amendment'] : []), ...(version >= 12 ? ['responseObjects'] : []), ...(version >= 13 ? ['correction'] : [])], 'Case-response escalation action');
+        readCaseResponseObjects(action.responseObjects);
+        readCasePacketAmendment(action.amendment);
+        if (readCasePacketCorrection(action.correction) && action.amendment)
+            throw new TypeError('Correction and provider amendment must remain separate.');
         const actionId = text(action.actionId, 'Case-response action id', 64);
         if (actionIds.has(actionId))
             fail('Case-response action identity');
@@ -571,6 +585,7 @@ function validateVersionedCaseResponsePacket(value, version) {
         integer(action.historyOmitted, 'Case-response action omitted history', 0, 1_000_000);
         strings(action.historyLimitations, 'Case-response action history limitations', 8, 240);
         const transitions = array(action.transitions, 'Case-response action transitions', MAX_CASE_ACTION_EVENTS_PER_ACTION, 1);
+        const requestEvents = [];
         const eventIds = new Set();
         let projectedState = null;
         let latestReference = null;
@@ -580,8 +595,23 @@ function validateVersionedCaseResponsePacket(value, version) {
         let previousTime = Number.NEGATIVE_INFINITY;
         let previousEventId = '';
         for (const eventCandidate of transitions) {
-            const event = exact(eventCandidate, ['id', 'previousState', 'nextState', 'occurredAt', 'sourceClass', 'provenance', 'reference', 'evidencePinId', 'limitations', 'providerOutcome', 'outcomeDetail', 'originActionId', 'applied'], 'Case-response action transition');
+            const event = exactOptional(eventCandidate, ['id', 'previousState', 'nextState', 'occurredAt', 'sourceClass', 'provenance', 'reference', 'evidencePinId', 'limitations', 'providerOutcome', 'outcomeDetail', 'originActionId', 'applied'], [...(Number(root.schemaVersion) >= 11 ? ['evidenceRequest'] : []), ...(version >= 12 ? ['responseObjects', 'objectOutcome'] : []), ...(version >= 13 ? ['packetReceipt'] : [])], 'Case-response action transition');
+            const receipt = readCaseDeliveryPacketReceipt(event.packetReceipt);
+            assertDeliveryPacketReceipt(receipt, event, actionId);
+            if (receipt && (receipt.caseId !== caseRecord.id || receipt.target !== caseRecord.domain || receipt.recipient !== action.recipient))
+                fail('Case-response receipt Case, target or recipient');
+            const responseObjects = readCaseResponseObjects(event.responseObjects);
+            const objectOutcome = readCaseResponseObjectOutcome(event.objectOutcome);
+            if (objectOutcome) {
+                if (!responseObjects?.length || !['submitted', 'acknowledged', 'terminal'].includes(String(event.nextState))
+                    || !['analyst', 'provider'].includes(String(event.sourceClass)) || event.previousState === 'authorised')
+                    fail('Case-response object outcome scope');
+                responseObjects.forEach(object => assertCaseObjectOutcome(objectOutcome, object));
+            }
+            const evidenceRequest = readCaseEvidenceRequest(event.evidenceRequest);
+            assertEvidenceRequestEvent(evidenceRequest, event);
             const eventId = text(event.id, 'Case-response action event id', 64);
+            requestEvents.push({ id: eventId, ...(evidenceRequest ? { evidenceRequest } : {}) });
             if (eventIds.has(eventId))
                 fail('Case-response action event identity');
             eventIds.add(eventId);
@@ -650,6 +680,7 @@ function validateVersionedCaseResponsePacket(value, version) {
                 }
             }
         }
+        assertEvidenceRequestHistory(requestEvents, Number(action.historyOmitted) > 0);
         if ((projectedState ?? 'drafting') !== action.state
             || latestReference !== action.reference
             || latestProviderOutcome !== action.providerOutcome
@@ -667,6 +698,20 @@ function validateVersionedCaseResponsePacket(value, version) {
         if (recipientRoute && !actionIds.has(recipientRoute.actionId))
             fail('Case-response recipient action');
     }
+    if (version >= 11)
+        assertPacketAmendmentSelection(history.map(candidate => {
+            const action = candidate;
+            return { id: action.actionId, history: action.transitions, originActionId: action.originActionId, amendment: action.amendment };
+        }), selectedActionId, evidenceIds);
+    if (version >= 13) {
+        const actions = history.map(candidate => { const action = candidate; return { ...action, id: action.actionId, history: action.transitions }; });
+        const selected = actions.find(action => action.id === selectedActionId);
+        if (selected?.correction)
+            correctionDelivery(actions, selected, { caseId: caseRecord.id, target: caseRecord.domain, profile: profile.id, selectedPinIds: evidenceIds });
+        const expectedPrefix = selected?.correction ? 'Correction or retraction request' : selectedProfile?.subjectPrefix;
+        if (profile.subject !== `${expectedPrefix}: ${caseRecord.domain} (${incident.category})`)
+            fail('Case-response correction subject');
+    }
     const lifecycle = exact(root.responseLifecycle, ['providerOutcomeState', 'latestProviderOutcome', 'observedChangeState', 'latestObservedEffect', 'latestObservedChangeAt', 'closure', 'limitations'], 'Case-response lifecycle');
     const providerOutcomeState = enumeration(lifecycle.providerOutcomeState, ['available', 'missing', 'ambiguous'], 'Case-response lifecycle provider state');
     let actualLatestProvider = null;
@@ -709,7 +754,10 @@ function validateVersionedCaseResponsePacket(value, version) {
         fail('Case-response lifecycle provider state');
     const observedChangeState = enumeration(lifecycle.observedChangeState, ['available', 'missing', 'ambiguous'], 'Case-response lifecycle observed-change state');
     if (lifecycle.latestObservedEffect !== null) {
-        const effect = exact(lifecycle.latestObservedEffect, ['reviewId', 'state', 'observedAt', 'sourceClass', 'source'], 'Case-response lifecycle observed effect');
+        const effect = exactOptional(lifecycle.latestObservedEffect, ['reviewId', 'state', 'observedAt', 'sourceClass', 'source'], version >= 12 ? ['responseObject', 'objectOutcome'] : [], 'Case-response lifecycle observed effect');
+        const responseObject = readCaseResponseObject(effect.responseObject);
+        const objectOutcome = readCaseResponseObjectOutcome(effect.objectOutcome);
+        assertCaseObjectOutcome(objectOutcome, responseObject);
         text(effect.reviewId, 'Case-response effect review id', 64);
         enumeration(effect.state, CASE_OBSERVED_EFFECT_STATES, 'Case-response effect state');
         iso(effect.observedAt, 'Case-response effect observedAt');
@@ -731,8 +779,11 @@ function validateVersionedCaseResponsePacket(value, version) {
         contract: CASE_RESPONSE_REVIEW_INPUTS_SCHEMA,
         version: version === CASE_RESPONSE_PACKET_VERSION
             ? CASE_RESPONSE_REVIEW_INPUTS_VERSION
-            : hasPlatformRoutes ? PUBLISHED_V2_3_CASE_RESPONSE_REVIEW_INPUTS_VERSION
-                : hasActionBinding ? PUBLISHED_V2_2_CASE_RESPONSE_REVIEW_INPUTS_VERSION : PUBLISHED_V2_CASE_RESPONSE_REVIEW_INPUTS_VERSION,
+            : version === OBJECT_RESPONSE_CASE_PACKET_VERSION ? OBJECT_RESPONSE_CASE_REVIEW_INPUTS_VERSION
+                : version === EVIDENCE_FOLLOW_UP_CASE_RESPONSE_PACKET_VERSION ? EVIDENCE_FOLLOW_UP_CASE_RESPONSE_REVIEW_INPUTS_VERSION
+                    : version === LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION ? LATEST_PUBLIC_CASE_RESPONSE_REVIEW_INPUTS_VERSION
+                        : hasPlatformRoutes ? PUBLISHED_V2_3_CASE_RESPONSE_REVIEW_INPUTS_VERSION
+                            : hasActionBinding ? PUBLISHED_V2_2_CASE_RESPONSE_REVIEW_INPUTS_VERSION : PUBLISHED_V2_CASE_RESPONSE_REVIEW_INPUTS_VERSION,
         profile: {
             id: profile.id,
             label: profile.label,
@@ -755,6 +806,7 @@ function validateVersionedCaseResponsePacket(value, version) {
         escalationHistoryOmitted: root.escalationHistoryOmitted,
         escalationHistoryLimitations: root.escalationHistoryLimitations,
         responseLifecycle: root.responseLifecycle,
+        ...(version >= 13 ? { sourceQualifications: strings(root.provenance.limitations, 'Case-response limitations', 8, 600).filter(value => value === CASE_SELECTED_EVIDENCE_SOURCE_LIMITATION) } : {}),
     };
     const expectedReviewDigest = createHash('sha256')
         .update(canonicalArtifactJsonV2(reviewedInputs))
@@ -781,6 +833,12 @@ function validateVersionedCaseResponsePacket(value, version) {
         fail('Case-response integrity');
 }
 export function validateCaseResponsePacket(value) {
+    if (value.schemaVersion === OBJECT_RESPONSE_CASE_PACKET_VERSION)
+        return validateVersionedCaseResponsePacket(value, OBJECT_RESPONSE_CASE_PACKET_VERSION);
+    if (value.schemaVersion === EVIDENCE_FOLLOW_UP_CASE_RESPONSE_PACKET_VERSION)
+        return validateVersionedCaseResponsePacket(value, EVIDENCE_FOLLOW_UP_CASE_RESPONSE_PACKET_VERSION);
+    if (value.schemaVersion === LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION)
+        return validateVersionedCaseResponsePacket(value, LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION);
     if (value.schemaVersion === PUBLIC_CASE_RESPONSE_PACKET_VERSION)
         return validateCaseResponsePacketV6(value);
     if (value.schemaVersion === PUBLISHED_V2_CASE_RESPONSE_PACKET_VERSION) {

package/cli/artifact-validation/lookup-evidence.mjs

@@ -1,10 +1,12 @@
 import { isDeepStrictEqual } from 'node:util';
 import { assertLookupEvidencePrivacySafeTree, assertLookupEvidencePortableTree, LOOKUP_EVIDENCE_SCHEMA, LOOKUP_EVIDENCE_SCHEMA_VERSION, HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION, PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION, REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION, V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION, projectLookupEvidenceAvailability, projectLookupEvidenceAvailabilityPublic, projectLookupEvidenceQuery, projectLookupEvidenceRdapPublication, projectLookupEvidenceRegistryInsights, projectLookupEvidenceWhoisPublication, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, } from "../../lib/evidence-export.mjs";
 import { validLookupObservationScope } from "../../packages/evidence/lookup-target.mjs";
+import { externalPasswordFormObservation } from "../../packages/evidence/credential-form-attribution.mjs";
+import { credentialSurfaceContractState } from "../../lib/lookup-child-profile-contract.mjs";
 import { registrarStandingObservedBy, resolveRegistrarIanaId, validRegistrarStanding, } from "../../lib/registrar-standing-contract.mjs";
 import { compareRegistrySources } from "../../lib/registry-comparison.mjs";
 import { buildRegistryInsights } from "../../lib/registry-insights.mjs";
-import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "../../lib/project-metadata.mjs";
+import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "../../packages/analysis/project-metadata.mjs";
 import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "../../lib/homepage-metadata-contract.mjs";
 import { HEX_DIGEST_RE, SEMANTIC_VERSION_RE, absoluteUrl, array, boolean, domain, enumeration, exact, exactOptional, fail, integer, iso, nullableRecord, optionalText, record, strings, text, } from "./structure-primitives.mjs";
 const LOOKUP_RDAP_ATTEMPT_OUTCOMES = [
@@ -24,7 +26,7 @@ const PUBLIC_LOOKUP_AVAILABILITY_ANALYSIS_KEYS = [
     'expiresInDays', 'privacyProtected', 'dnssec', 'activityStatus',
     'websiteProbeStatus', 'websiteProbeDetail', 'http', 'deepScanComplete',
     'faviconHash', 'faviconPHash', 'pageTitle', 'hasPasswordField',
-    'phishingLanguageMatch', 'hasExternalFormAction', 'externalAssetHosts',
+    'phishingLanguageMatch', 'hasExternalFormAction', 'hasExternalPasswordForm', 'externalAssetHosts',
     'pageIdentity', 'credentialSurfaceProfile', 'structuredDataIdentity',
     'technologyProfile', 'pageRoleProfile', 'clientBehaviorProfile',
     'securityPosture', 'dns', 'tls', 'hasMx', 'hasNullMx', 'mxHosts', 'hasSpf',
@@ -42,6 +44,18 @@ const LOOKUP_REGISTRAR_COMPARISON_STATUSES = [
     'registrar_unavailable', 'registry_incomplete', 'registrar_incomplete',
 ];
 function validateLookupEvidenceHomepageMetadata(availability, version) {
+    const credentialProfile = availability.credentialSurfaceProfile === null || availability.credentialSurfaceProfile === undefined
+        ? null : record(availability.credentialSurfaceProfile, 'Lookup evidence credential profile');
+    if (version < 30 && (Object.hasOwn(availability, 'hasExternalPasswordForm') || credentialProfile?.credentialSurfaceVersion === 2)) {
+        fail('Lookup evidence form-attribution epoch');
+    }
+    if (Object.hasOwn(availability, 'hasExternalPasswordForm') && availability.hasExternalPasswordForm !== null)
+        boolean(availability.hasExternalPasswordForm, 'Lookup evidence password-form destination');
+    if (credentialProfile?.credentialSurfaceVersion === 2 && credentialSurfaceContractState(credentialProfile) !== 'supported')
+        fail('Lookup evidence form-attribution profile');
+    if (credentialProfile?.credentialSurfaceVersion === 2 && availability.hasExternalPasswordForm !== undefined
+        && availability.hasExternalPasswordForm !== externalPasswordFormObservation(credentialProfile.formAttribution))
+        fail('Lookup evidence form-attribution consistency');
     const pageIdentity = availability.pageIdentity === null || availability.pageIdentity === undefined
         ? null
         : record(availability.pageIdentity, 'Lookup evidence page identity');
@@ -675,7 +689,7 @@ export function validateLookupEvidenceArtifactStructure(value) {
         }
         validateLookupEvidenceHomepageMetadata(availability, version);
         if (!isDeepStrictEqual(analysis.availability, currentAvailability
-            ? projectLookupEvidenceAvailability(analysis.availability)
+            ? projectLookupEvidenceAvailability(analysis.availability, { legacyUris: version < HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION })
             : projectLookupEvidenceAvailabilityPublic(analysis.availability)))
             fail('Lookup evidence availability analysis');
     }
@@ -715,7 +729,7 @@ export function validateLookupEvidenceArtifactStructure(value) {
         if (!isDeepStrictEqual(registryInsights, expectedInsights))
             fail('Lookup evidence registry insight derivation');
         try {
-            assertLookupEvidencePrivacySafeTree(root);
+            assertLookupEvidencePrivacySafeTree(root, { legacyUris: version < HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION });
         }
         catch {
             fail('Lookup evidence privacy boundary');

package/cli/artifact-validation/signed-review.mjs

@@ -1,8 +1,10 @@
-import { ACQUISITION_DECISIONS, ACQUISITION_MANUAL_CHECKS, ACQUISITION_DECISION_PACKET_SCHEMA, ACQUISITION_DECISION_PACKET_VERSION, } from "../../packages/investigation/acquisition-decision-packet.mjs";
+import { ACQUISITION_DECISION_PACKET_SCHEMA, validateAcquisitionDecisionPacketStructure, } from "../../packages/investigation/acquisition-decision-packet.mjs";
 import { BULK_DOMAIN_COMPARISON_EXPORT_VERSION, BULK_DOMAIN_COMPARISON_SCHEMA, } from "../../packages/investigation/bulk-domain-comparison.mjs";
 import { BULK_MAIL_EXPOSURE_EXPORT_VERSION, BULK_MAIL_EXPOSURE_SCHEMA, MAX_BULK_MAIL_EXPOSURE_ROWS, } from "../../packages/investigation/bulk-mail-exposure.mjs";
 import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS, } from "../../packages/contracts/investigation-portability.mjs";
 import { MAX_BULK_SESSION_ROWS, MAX_BULK_SESSION_SOURCES } from "../../packages/contracts/workspace-portability.mjs";
+import { MANAGED_INDICATOR_SET_SCHEMA } from "../../packages/contracts/analyst-interchange.mjs";
+import { validateManagedIndicatorSet } from "../../packages/interchange/managed-indicator-set.mjs";
 import { BULK_SORT_KEYS } from "../../packages/workspace/bulk-sort.mjs";
 import { normalizeExplicitIsoTimestamp } from "../../packages/evidence/observation.mjs";
 import { LOOKUP_CLAIM_PASSPORT_SCHEMA, LOOKUP_CLAIM_PASSPORT_TARGET_TYPES, LOOKUP_CLAIM_PASSPORT_VERSION, MAX_LOOKUP_CLAIM_PASSPORT_LIMITATIONS, MAX_LOOKUP_CLAIM_PASSPORT_REQUIREMENTS, } from "../../packages/investigation/lookup-claim-passport.mjs";
@@ -24,55 +26,6 @@ const DOMAIN_COMPARISON_ROW_IDS = [
 ];
 const MAIL_STATES = ['authenticated_mail', 'evidence_incomplete', 'mail_auth_gap', 'mail_auth_incomplete', 'no_explicit_mx', 'null_mx'];
 const DNS_TYPES = ['A', 'AAAA', 'CAA', 'CDNSKEY', 'CDS', 'CNAME', 'CSYNC', 'HTTPS', 'MX', 'NS', 'SRV', 'SVCB', 'TLSA', 'TXT'];
-function validateAcquisitionItem(value, label) {
-    const item = exact(value, ['id', 'label', 'state', 'detail', 'provenance'], label);
-    const id = enumeration(item.id, ['availability', 'contacts', 'lifecycle', 'mail', 'nameservers', 'operations', 'policy_eligibility', 'policy_lifecycle', 'policy_transfer', 'tls', 'transfer', 'web'], label);
-    enumeration(item.state, ['authoritative', 'observed', 'review', 'unavailable'], label);
-    text(item.label, label, 200);
-    text(item.detail, label, 2_000);
-    text(item.provenance, label, 300);
-    return id;
-}
-function validateAcquisition(value) {
-    const root = exact(value, ['schema', 'version', 'generatedAt', 'target', 'synthetic', 'evidenceObservedAt', 'analystReview', 'evidenceReview', 'limitations', 'integrity'], 'Acquisition decision packet');
-    iso(root.generatedAt, 'Acquisition decision packet generatedAt');
-    domain(root.target, 'Acquisition decision packet target');
-    boolean(root.synthetic, 'Acquisition decision packet synthetic');
-    iso(root.evidenceObservedAt, 'Acquisition decision packet evidenceObservedAt', true);
-    const review = exact(root.analystReview, ['decision', 'rationale', 'reviewedChecks', 'outstandingChecks', 'state'], 'Acquisition analyst review');
-    const decision = enumeration(review.decision, ACQUISITION_DECISIONS, 'Acquisition analyst review decision');
-    text(review.rationale, 'Acquisition analyst review rationale', 2_000, true);
-    const reviewed = strings(review.reviewedChecks, 'Acquisition reviewed checks', ACQUISITION_MANUAL_CHECKS.length, 40);
-    const outstanding = strings(review.outstandingChecks, 'Acquisition outstanding checks', ACQUISITION_MANUAL_CHECKS.length, 40);
-    const expectedReviewed = ACQUISITION_MANUAL_CHECKS.filter((item) => reviewed.includes(item));
-    const expectedOutstanding = ACQUISITION_MANUAL_CHECKS.filter((item) => !reviewed.includes(item));
-    if (!sameValues(reviewed, expectedReviewed) || !sameValues(outstanding, expectedOutstanding))
-        fail('Acquisition analyst review checks');
-    const expectedState = decision === 'unresolved' || reviewed.length < ACQUISITION_MANUAL_CHECKS.length ? 'draft' : 'reviewed';
-    if (review.state !== expectedState)
-        fail('Acquisition analyst review state');
-    const evidence = exact(root.evidenceReview, ['version', 'label', 'state', 'items', 'transitionDependencies', 'policyChecks', 'nextSteps', 'limitations'], 'Acquisition evidence review');
-    if (evidence.version !== 2)
-        fail('Acquisition evidence review');
-    text(evidence.label, 'Acquisition evidence review label', 200);
-    enumeration(evidence.state, ['incomplete', 'registered', 'review_transition', 'sale_signal', 'unregistered_observation'], 'Acquisition evidence review state');
-    const expectedEvidenceIds = {
-        items: ['availability', 'lifecycle', 'transfer', 'operations', 'contacts'],
-        transitionDependencies: ['nameservers', 'web', 'mail', 'tls'],
-        policyChecks: ['policy_eligibility', 'policy_lifecycle', 'policy_transfer'],
-    };
-    for (const key of ['items', 'transitionDependencies', 'policyChecks']) {
-        const expected = expectedEvidenceIds[key];
-        const values = array(evidence[key], `Acquisition evidence review ${key}`, expected.length, expected.length);
-        const ids = values.map((item, index) => validateAcquisitionItem(item, `Acquisition evidence review ${key}[${index}]`));
-        if (!sameValues(ids, expected))
-            fail(`Acquisition evidence review ${key}`);
-    }
-    strings(evidence.nextSteps, 'Acquisition next steps', 6, 600);
-    strings(evidence.limitations, 'Acquisition evidence limitations', 12, 600);
-    strings(root.limitations, 'Acquisition limitations', 8, 600);
-    validateIntegrity(root.integrity, 'Acquisition integrity', root.version, ACQUISITION_DECISION_PACKET_VERSION);
-}
 function validateClaimPassportTarget(type, value) {
     const candidate = text(value, 'Claim passport target', 253);
     if (type === 'domain') {
@@ -334,10 +287,11 @@ function validateBulkReviewManifest(value) {
     strings(root.limitations, 'Bulk review manifest limitations', 8, 600);
     validateIntegrity(root.integrity, 'Bulk review manifest integrity', root.version, version);
 }
-function validateSourceObservations(value, label) {
+function validateSourceObservations(value, label, queryCoverage) {
     const names = new Set();
+    let queryCount = 0;
     return array(value, label, 16).map((candidate) => {
-        const source = exact(candidate, ['label', 'source', 'state', 'observedAt'], label);
+        const source = exact(candidate, ['label', 'source', 'state', 'observedAt', ...(queryCoverage ? ['queries'] : [])], label);
         const name = text(source.label, `${label} label`, 120).toLowerCase();
         if (names.has(name))
             fail(`${label} duplicate label`);
@@ -345,14 +299,37 @@ function validateSourceObservations(value, label) {
         text(source.source, `${label} source`, 240);
         enumeration(source.state, ['observed', 'partial', 'unavailable'], `${label} state`);
         iso(source.observedAt, `${label} observedAt`);
+        if (queryCoverage) {
+            const keys = new Set();
+            const queries = array(source.queries, `${label} queries`, 500 - queryCount);
+            queryCount += queries.length;
+            for (const candidate of queries) {
+                const query = exact(candidate, ['owner', 'type', 'state'], `${label} query`);
+                text(query.owner, `${label} query owner`, 253);
+                enumeration(query.type, DNS_TYPES, `${label} query type`);
+                enumeration(query.state, ['observed', 'partial', 'unavailable'], `${label} query state`);
+                const key = `${query.owner}\u0000${query.type}`;
+                if (keys.has(key))
+                    fail(`${label} duplicate query`);
+                keys.add(key);
+                if ((source.state === 'observed' && query.state !== 'observed')
+                    || (source.state === 'unavailable' && query.state !== 'unavailable'))
+                    fail(`${label} query state`);
+            }
+        }
         return source;
     });
 }
-function validateReviewMatrix(value, label, sources) {
+function validateReviewMatrix(value, label, sources, queryCoverage = false) {
+    const rowKeys = new Set();
     for (const [rowIndex, candidate] of array(value, label, 500).entries()) {
         const row = exact(candidate, ['owner', 'type', 'state', 'observations'], `${label} row ${rowIndex + 1}`);
         text(row.owner, `${label} owner`, 253);
         enumeration(row.type, DNS_TYPES, `${label} type`);
+        const key = `${row.owner}\u0000${row.type}`;
+        if (queryCoverage && rowKeys.has(key))
+            fail(`${label} duplicate row`);
+        rowKeys.add(key);
         const observations = array(row.observations, `${label} observations`, 16);
         if (sources && observations.length !== sources.length)
             fail(`${label} source coverage`);
@@ -363,7 +340,7 @@ function validateReviewMatrix(value, label, sources) {
             const observation = exact(observationCandidate, ['label', 'source', 'state', 'values', 'ttlRange', ...(sources ? ['observedAt'] : [])], `${label} observation`);
             text(observation.label, `${label} observation label`, 120);
             text(observation.source, `${label} observation source`, 240);
-            const state = enumeration(observation.state, ['observed', 'partial', 'unavailable'], `${label} observation state`);
+            const state = enumeration(observation.state, ['observed', 'partial', 'unavailable', ...(queryCoverage ? ['not_queried'] : [])], `${label} observation state`);
             const values = strings(observation.values, `${label} observation values`, 500, 16_384);
             if (sources) {
                 const name = String(observation.label).toLowerCase();
@@ -371,8 +348,16 @@ function validateReviewMatrix(value, label, sources) {
                     fail(`${label} duplicate observation`);
                 names.add(name);
                 const source = sources.find((item) => item.label === observation.label);
-                if (!source || ['label', 'source', 'state', 'observedAt'].some((key) => observation[key] !== source[key]))
+                const provenance = queryCoverage ? ['label', 'source', 'observedAt'] : ['label', 'source', 'state', 'observedAt'];
+                if (!source || provenance.some((key) => observation[key] !== source[key]))
                     fail(`${label} source provenance`);
+                if (queryCoverage) {
+                    const query = source.queries.find((item) => item.owner === row.owner && item.type === row.type);
+                    if (state !== (query?.state ?? 'not_queried'))
+                        fail(`${label} query provenance`);
+                    if (['not_queried', 'unavailable'].includes(state) && (values.length || observation.ttlRange !== null))
+                        fail(`${label} unavailable values`);
+                }
                 iso(observation.observedAt, `${label} observation time`);
             }
             if (state === 'observed') {
@@ -387,13 +372,19 @@ function validateReviewMatrix(value, label, sources) {
                     fail(`${label} TTL range`);
             }
         }
-        const expected = complete < 2 ? 'insufficient' : signatures.size === 1 ? 'aligned' : 'different';
+        const expected = complete < 2 || (queryCoverage && complete !== observations.length) ? 'insufficient' : signatures.size === 1 ? 'aligned' : 'different';
         if (row.state !== expected)
             fail(`${label} state`);
     }
+    if (queryCoverage && sources) {
+        const expectedKeys = new Set(sources.flatMap((source) => source.queries.map((item) => `${item.owner}\u0000${item.type}`)));
+        if (rowKeys.size !== expectedKeys.size || [...rowKeys].some((key) => !expectedKeys.has(key)))
+            fail(`${label} query coverage`);
+    }
 }
 function validateDomainChangeReview(value, label, version) {
     const retainedTimes = version >= 2;
+    const queryCoverage = version >= 3;
     const review = exact(value, ['schema', 'version', 'generatedAt', 'domain', 'state', 'authoritativeRecordMatrix', 'resolverDivergenceMatrix', 'dnssecAutomation', 'acmeDependencies', 'certificate', 'services', 'hsts', 'gate', 'limitations', ...(retainedTimes ? ['sourceObservations'] : [])], label);
     if (review.schema !== DOMAIN_CHANGE_REVIEW_SCHEMA || review.version !== version)
         fail(label);
@@ -401,8 +392,8 @@ function validateDomainChangeReview(value, label, version) {
     domain(review.domain, `${label} domain`);
     enumeration(review.state, ['ready', 'review'], `${label} state`);
     const sources = retainedTimes ? exact(review.sourceObservations, ['authorities', 'resolvers'], `${label} source observations`) : null;
-    validateReviewMatrix(review.authoritativeRecordMatrix, `${label} authority matrix`, sources ? validateSourceObservations(sources.authorities, `${label} authority sources`) : undefined);
-    validateReviewMatrix(review.resolverDivergenceMatrix, `${label} resolver matrix`, sources ? validateSourceObservations(sources.resolvers, `${label} resolver sources`) : undefined);
+    validateReviewMatrix(review.authoritativeRecordMatrix, `${label} authority matrix`, sources ? validateSourceObservations(sources.authorities, `${label} authority sources`, queryCoverage) : undefined, queryCoverage);
+    validateReviewMatrix(review.resolverDivergenceMatrix, `${label} resolver matrix`, sources ? validateSourceObservations(sources.resolvers, `${label} resolver sources`, queryCoverage) : undefined, queryCoverage);
     const automation = exact(review.dnssecAutomation, ['state', 'cdsObserved', 'cdnskeyObserved', 'csyncObserved', 'conflictingTypes', 'detail'], `${label} DNSSEC automation`);
     enumeration(automation.state, ['not_observed', 'conflict', 'partial', 'review_ready'], `${label} DNSSEC automation`);
     boolean(automation.cdsObserved, `${label} CDS observed`);
@@ -514,7 +505,7 @@ function validatePlannedAssurance(value, label) {
     strings(assurance.limitations, `${label} limitations`, 8, 600);
     return assurance;
 }
-function expectedDomainChangeSummary(before, after) {
+function expectedDomainChangeSummary(before, after, queryCoverage) {
     const rows = (review) => new Map(review.authoritativeRecordMatrix.map((row) => [`${row.owner}\u0000${row.type}`, row]));
     const beforeRows = rows(before);
     const afterRows = rows(after);
@@ -526,7 +517,7 @@ function expectedDomainChangeSummary(before, after) {
     };
     const rowEvidence = (review, row) => {
         if (!row)
-            return { state: collectionComplete(review) ? 'complete' : 'unavailable', values: [] };
+            return { state: !queryCoverage && collectionComplete(review) ? 'complete' : 'unavailable', values: [] };
         const observations = row.observations;
         if (observations.some((item) => item.state !== 'observed'))
             return { state: 'partial', values: [] };
@@ -537,18 +528,21 @@ function expectedDomainChangeSummary(before, after) {
         return { state: 'complete', values: [...new Set(observations.flatMap((item) => item.values))].sort() };
     };
     const changed = [];
+    const reasons = queryCoverage && keys.length > 500 ? ['The comparison exceeds 500 owner and record-type pairs.'] : [];
     for (const key of keys.slice(0, 500)) {
         const left = rowEvidence(before, beforeRows.get(key));
         const right = rowEvidence(after, afterRows.get(key));
         const [owner, type] = key.split('\u0000');
         if (left.state !== 'complete' || right.state !== 'complete') {
+            if (queryCoverage)
+                reasons.push(`Comparison evidence is incomplete for ${owner} ${type}.`);
             continue;
         }
         else if (!sameValues(left.values, right.values)) {
             changed.push({ owner: owner ?? '', type: type ?? '', beforeValues: left.values, afterValues: right.values });
         }
     }
-    return changed;
+    return { changed, reasons };
 }
 function validateDomainChangePacket(value) {
     const root = exact(value, ['schema', 'version', 'generatedAt', 'domain', 'reference', 'state', 'gate', 'summary', 'evidence', 'limitations', 'integrity'], 'Domain change packet');
@@ -590,13 +584,14 @@ function validateDomainChangePacket(value) {
     const expectedReasons = [
         ...pre.gate.reasons,
     ].map((reason) => `Pre-change evidence: ${reason}`);
-    expectedReasons.push(...post.gate.reasons.map((reason) => `Post-change evidence: ${reason}`), ...(assuranceResult.review.reasons.map((reason) => `Change plan: ${reason}`)));
+    const comparison = expectedDomainChangeSummary(pre, post, reviewVersion >= 3);
+    expectedReasons.push(...post.gate.reasons.map((reason) => `Post-change evidence: ${reason}`), ...(assuranceResult.review.reasons.map((reason) => `Change plan: ${reason}`)), ...comparison.reasons);
     const boundedReasons = expectedReasons.slice(0, 100);
     if (!sameValues(gateReasons, boundedReasons)
         || gate.pass !== (boundedReasons.length === 0)
         || root.state !== (boundedReasons.length === 0 ? 'ready' : 'review'))
         fail('Domain change packet gate');
-    const expectedChanges = expectedDomainChangeSummary(pre, post);
+    const expectedChanges = comparison.changed;
     if (changed.length !== expectedChanges.length || changed.some((candidate, index) => {
         const item = candidate;
         const expected = expectedChanges[index];
@@ -612,7 +607,9 @@ export function validateSignedDigestArtifactStructure(schema, value) {
     if (value.schema !== schema)
         fail('Signed review artefact');
     if (schema === ACQUISITION_DECISION_PACKET_SCHEMA)
-        validateAcquisition(value);
+        validateAcquisitionDecisionPacketStructure(value);
+    else if (schema === MANAGED_INDICATOR_SET_SCHEMA)
+        validateManagedIndicatorSet(value);
     else if (schema === LOOKUP_CLAIM_PASSPORT_SCHEMA)
         validateLookupClaimPassport(value);
     else if (schema === BULK_DOMAIN_COMPARISON_SCHEMA)

package/cli/artifact-verify.mjs

@@ -1,4 +1,5 @@
 import { Buffer } from 'node:buffer';
+import { MANAGED_INDICATOR_SET_SCHEMA, MANAGED_INDICATOR_SET_VERSION } from "../packages/contracts/analyst-interchange.mjs";
 import { createHash } from 'node:crypto';
 import { readEditableCaseExport } from "../packages/cases/case-export-input.mjs";
 import { boundedJsonLimitsForBytes, parseBoundedJsonObject } from "./bounded-json.mjs";
@@ -18,7 +19,7 @@ import { INVESTIGATION_MANIFEST_SCHEMA, SUPPORTED_INVESTIGATION_MANIFEST_VERSION
 import { verifyCliCasePack } from "./case-pack.mjs";
 import { LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES, LOOKUP_EVIDENCE_SCHEMA, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, } from "../lib/evidence-export.mjs";
 export const OFFLINE_ARTIFACT_VERIFICATION_SCHEMA = 'whoisleuth.offline-artifact-verification';
-export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 4;
+export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 5;
 export const MAX_OFFLINE_ARTIFACT_BYTES = Math.max(MAX_DOMAIN_CONTROL_MANIFEST_BYTES, MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES);
 export const MAX_OFFLINE_PASSPHRASE_FILE_BYTES = 1024;
 export class UnsupportedOfflineArtifactError extends TypeError {
@@ -36,6 +37,7 @@ function currentCanonicalizationRoutes(versions) {
     })));
 }
 const SIGNED_ARTIFACT_ROUTES = Object.freeze({
+    [MANAGED_INDICATOR_SET_SCHEMA]: currentCanonicalizationRoutes([MANAGED_INDICATOR_SET_VERSION]),
     [ACQUISITION_DECISION_PACKET_SCHEMA]: currentCanonicalizationRoutes(SUPPORTED_ACQUISITION_DECISION_PACKET_VERSIONS),
     [LOOKUP_CLAIM_PASSPORT_SCHEMA]: currentCanonicalizationRoutes([LOOKUP_CLAIM_PASSPORT_VERSION]),
     [BULK_DOMAIN_COMPARISON_SCHEMA]: currentCanonicalizationRoutes(SUPPORTED_BULK_DOMAIN_COMPARISON_EXPORT_VERSIONS),
@@ -588,8 +590,15 @@ export function formatOfflineArtifactVerification(report) {
     }
     if (report.package) {
         lines.push(`Package bytes: ${report.package.digestSha256}`, 'Storage: unchanged; inspection only', 'Audience: private; review selected file contents before sharing', 'Signature trust: not checked', 'Trusted timestamp: not checked', 'Factual accuracy: not established');
-        for (const entry of report.package.entries)
+        for (const entry of report.package.entries) {
             lines.push(`${entry.id}: ${entry.state} · ${entry.byteLength} bytes · ${entry.mediaType}${entry.issue ? ` · ${entry.issue}` : ''}`);
+            if (entry.imageDerivation) {
+                const declaration = entry.imageDerivation;
+                lines.push(`  Declared image derivation: ${declaration.method}; ${declaration.operations.join(', ')}`, `  Parent: ${declaration.source.digestSha256} · ${declaration.source.byteLength} bytes`);
+            }
+            else if (entry.mediaType.startsWith('image/'))
+                lines.push('  Editing history: not declared');
+        }
         for (const link of report.package.links)
             lines.push(`Source link ${link.capsuleEntryId}: ${link.state}${link.sourceEntryId ? ` (${link.sourceEntryId})` : ''}`);
         for (const capture of report.package.captureManifests) {

package/cli/assurance-arguments.mjs

@@ -0,0 +1,56 @@
+import {} from "./command-argument-grammar.mjs";
+import { CliUsageError } from "./errors.mjs";
+import { MAX_INVESTIGATION_MANIFEST_ARTIFACTS } from "../packages/contracts/investigation-package-limits.mjs";
+import { terminalOptions, jsonOutput, singleInputAction } from "./argument-values.mjs";
+function parseManifestArguments(parsed) {
+    const sources = parsed.positionalValues('artefacts');
+    if (sources.some((source) => !source))
+        throw new CliUsageError(`manifest requires from 1 to ${MAX_INVESTIGATION_MANIFEST_ARTIFACTS} artefact files.`);
+    if (new Set(sources).size !== sources.length)
+        throw new CliUsageError('manifest artefact files must be different.');
+    const configurationDigestSha256 = parsed.optionValue('--configuration-digest');
+    if (configurationDigestSha256 !== null && !/^sha256:[a-f0-9]{64}$/u.test(configurationDigestSha256)) {
+        throw new CliUsageError('--configuration-digest requires a sha256: hexadecimal digest.');
+    }
+    return {
+        action: 'manifest',
+        sources,
+        workflow: parsed.optionValue('--workflow'),
+        configurationDigestSha256,
+        ...(parsed.optionValue('--passphrase-file')
+            ? { passphraseSource: parsed.optionValue('--passphrase-file') }
+            : {}),
+        ...(parsed.hasOption('--package') ? { package: true } : {}),
+        ...(parsed.hasOption('--bagit') ? { bagit: true } : {}),
+        ...(parsed.optionValue('--folder') ? { folder: parsed.optionValue('--folder') } : {}),
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    };
+}
+function parseSharingReviewArguments(parsed) {
+    const purpose = parsed.optionValue('--purpose').replace(/\s+/gu, ' ').trim();
+    if (!purpose || purpose.length > 200)
+        throw new CliUsageError('--purpose is limited to 200 characters.');
+    return {
+        action: 'sharing-review',
+        source: parsed.positionalValue('source'),
+        output: jsonOutput(parsed),
+        marking: parsed.optionValue('--marking'),
+        recipientScope: parsed.optionValue('--recipient-scope'),
+        purpose,
+        humanReviewed: parsed.hasOption('--human-reviewed'),
+        personalDataReviewed: parsed.hasOption('--personal-data-reviewed'),
+        redactionsConfirmed: parsed.hasOption('--redactions-confirmed'),
+        ...terminalOptions(parsed),
+    };
+}
+export const ASSURANCE_ARGUMENT_PARSERS = Object.freeze({
+    manifest: parseManifestArguments,
+    'map-observations': (parsed) => singleInputAction('map-observations', parsed),
+    'oam-export': (parsed) => singleInputAction('oam-export', parsed),
+    'ct-intake': (parsed) => singleInputAction('ct-intake', parsed),
+    'domain-control': (parsed) => singleInputAction('domain-control', parsed),
+    assurance: (parsed) => singleInputAction('assurance', parsed),
+    'change-packet': (parsed) => singleInputAction('change-packet', parsed),
+    'sharing-review': parseSharingReviewArguments,
+});