@slicedearth/whoisleuth-cli 1.43.0 → 1.47.4

package/cli/saved-lookup.mjs

@@ -1,4 +1,6 @@
 import { Buffer } from 'node:buffer';
+import { classifyQuery } from "../lib/classify.mjs";
+import { scanBoundedJson } from "../lib/bounded-json.mjs";
 import { CliUsageError } from "./arguments.mjs";
 const MAX_SAVED_LOOKUP_INPUT_BYTES = 8 * 1024 * 1024;
 const MAX_SAVED_LOOKUP_STRING_LENGTH = 1024;
@@ -46,9 +48,21 @@ function parseSavedLookupDocument(text, options = {}) {
     if (Buffer.byteLength(text, 'utf8') > MAX_SAVED_LOOKUP_INPUT_BYTES) {
         throw new CliUsageError(`${label} is limited to ${MAX_SAVED_LOOKUP_INPUT_BYTES} bytes.`);
     }
+    const normalized = text.replace(/^\uFEFF/, '');
+    try {
+        scanBoundedJson(normalized);
+    }
+    catch (cause) {
+        const detail = cause instanceof Error ? cause.message : '';
+        if (detail === 'Artefact input is not valid JSON.') {
+            throw new CliUsageError(`${label} must be valid JSON.`);
+        }
+        const boundedDetail = detail.replace(/^Artefact JSON /u, '');
+        throw new CliUsageError(boundedDetail ? `${label} ${boundedDetail}` : `${label} must be valid JSON.`);
+    }
     let parsed;
     try {
-        parsed = JSON.parse(text.replace(/^\uFEFF/, ''));
+        parsed = JSON.parse(normalized);
     }
     catch {
         throw new CliUsageError(`${label} must be valid JSON.`);
@@ -64,8 +78,17 @@ function parseSavedLookupDocument(text, options = {}) {
     if (document.mode !== 'fast' && document.mode !== 'deep') {
         throw new CliUsageError(`${label} has an unsupported lookup mode.`);
     }
-    requiredBoundedString(document.query, 'query');
-    requiredBoundedString(document.registrableDomain, 'registrableDomain');
+    const query = requiredBoundedString(document.query, 'query');
+    const registrableDomain = requiredBoundedString(document.registrableDomain, 'registrableDomain');
+    try {
+        const classified = classifyQuery(query);
+        if (classified.type !== 'domain' || classified.registrableDomain !== registrableDomain.toLowerCase().replace(/\.$/u, '')) {
+            throw new Error('Saved query does not match its declared registrable domain.');
+        }
+    }
+    catch {
+        throw new CliUsageError('query must identify the declared registrable domain.');
+    }
     requiredBoundedString(document.generatedAt, 'generatedAt');
     const diagnostics = objectOrNull(document.diagnostics);
     const rdapDiagnostics = objectOrNull(diagnostics?.rdap);

package/cli/sharing-review.mjs

@@ -1,6 +1,6 @@
-import { UnsupportedOfflineArtifactError, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { hasVerifiedWholeArtifactIntegrity, UnsupportedOfflineArtifactError, verifyOfflineArtifact, } from "./artifact-verify.mjs";
 const SHARING_REVIEW_SCHEMA = 'whoisleuth.cli.sharing-review';
-const SHARING_REVIEW_VERSION = 1;
+const SHARING_REVIEW_VERSION = 2;
 const MAX_SHARING_REVIEW_BYTES = 15 * 1024 * 1024;
 const TLP_MARKINGS = ['clear', 'green', 'amber', 'amber-strict', 'red'];
 const RECIPIENT_SCOPES = ['public', 'community', 'organization', 'named-recipients'];
@@ -103,7 +103,11 @@ async function buildSharingReview(raw, options, generatedAt = new Date().toISOSt
     let integrity = 'unsupported';
     try {
         const verification = await verifyOfflineArtifact(raw);
-        integrity = verification.checks.contentIntegrity === 'verified' ? 'verified' : 'structure_only';
+        integrity = verification.state === 'verified' && hasVerifiedWholeArtifactIntegrity(verification)
+            ? 'verified'
+            : verification.state === 'integrity_valid'
+                ? 'projection_integrity'
+                : 'structure_only';
     }
     catch (error) {
         integrity = error instanceof UnsupportedOfflineArtifactError ? 'unsupported' : 'failed';
@@ -114,9 +118,11 @@ async function buildSharingReview(raw, options, generatedAt = new Date().toISOSt
         ? 'The artefact passed its supported local integrity contract.'
         : integrity === 'structure_only'
             ? 'The artefact passed its structural contract but has no verified content digest.'
-            : integrity === 'unsupported'
-                ? 'This artefact schema has no supported local integrity verifier; review its producer and digest contract manually.'
-                : 'The artefact failed its supported structure or integrity contract.');
+            : integrity === 'projection_integrity'
+                ? 'The artefact passed its structural contract and projection digests, but those digests do not cover the whole file.'
+                : integrity === 'unsupported'
+                    ? 'This artefact schema has no supported local integrity verifier; review its producer and digest contract manually.'
+                    : 'The artefact failed its supported structure or integrity contract.');
     add('human-review', options.humanReviewed ? 'pass' : 'block', 'Human review', options.humanReviewed
         ? 'A deliberate human review was recorded for this sharing decision.'
         : 'Complete a deliberate human review before sharing.');