@slicedearth/whoisleuth-cli 1.43.0 → 1.47.4

package/cli/discovery-scan-command-runner.mjs

@@ -1,9 +1,8 @@
-import { createReadStream } from 'node:fs';
 import { classifyQuery } from "../lib/classify.mjs";
 import { normalizeSelectedDnsResolvers } from "../lib/dns-resolver-selection.mjs";
 import { runUnifiedLookup } from "../lib/lookup.mjs";
 import { createBulkCheckpointWriter } from "./bulk-checkpoint.mjs";
-import { buildDiscoveryScanDocument, formatDiscoveryScanCsv, formatDiscoveryScanDomains, formatDiscoveryScanJsonLines, formatTerminalDiscoveryScan, parseDiscoveryScanAllowlist, readDiscoveryScanListBounded, runDiscoveryScanChunks, } from "./discovery-scan.mjs";
+import { buildDiscoveryScanDocument, formatDiscoveryScanCsv, formatDiscoveryScanDomains, formatDiscoveryScanJsonLines, formatTerminalDiscoveryScan, parseDiscoveryScanAllowlist, runDiscoveryScanChunks, } from "./discovery-scan.mjs";
 import { updateDiscoveryObservationSnapshot } from "./discovery-observation-snapshot.mjs";
 import { generateDiscoveryCandidates } from "./discovery-workflow.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
@@ -12,13 +11,13 @@ import { formatJsonDocument } from "./formatters/json.mjs";
 import { createCliProgressEvents } from "./progress-events.mjs";
 import { buildCollectionPreflight, formatCollectionPreflight } from "./collection-preflight.mjs";
 import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
-async function readAllowlist(source, dependencies, classify) {
+async function readAllowlist(source, dependencies, context, classify) {
     if (!source)
         return new Set();
     try {
         const text = dependencies.readDiscoveryAllowlist
             ? await dependencies.readDiscoveryAllowlist(source)
-            : await readDiscoveryScanListBounded(createReadStream(source, { highWaterMark: 64 * 1024 }));
+            : await context.readInput(source, 64 * 1024, 'Discovery scan allowlist');
         return parseDiscoveryScanAllowlist(text, classify);
     }
     catch (error) {
@@ -61,7 +60,7 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
             throw new CliUsageError(boundedCliErrorMessage(error, 'Invalid DNS resolver selection'));
         }
     }
-    const allowlist = await readAllowlist(args.allowlistSource, dependencies, classify);
+    const allowlist = await readAllowlist(args.allowlistSource, dependencies, context, classify);
     const checkpointWriter = dependencies.createBulkCheckpointWriter || createBulkCheckpointWriter;
     const checkpoint = args.checkpoint
         ? await checkpointWriter({
@@ -75,6 +74,8 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
         : null;
     const indicator = context.beginProgress(`Collecting 0 of ${queries.length} generated candidates`);
     let completed = checkpoint?.initialResults.length || 0;
+    const resumedItems = new Map((checkpoint?.initialResults ?? []).map((item) => [item.index, item]));
+    const settledItems = new Map();
     if (completed)
         indicator.update(`Resumed ${completed} of ${queries.length} generated candidates`);
     let checkpointFailure = null;
@@ -90,12 +91,23 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
             ...(checkpoint ? { initialResults: checkpoint.initialResults } : {}),
             ...(dependencies.signal ? { signal: dependencies.signal } : {}),
             onItemSettled: (item) => {
+                const observed = {
+                    ...item,
+                    observedAt: context.now(),
+                    collectionOrigin: 'current_run',
+                };
+                settledItems.set(item.index, observed);
                 completed += 1;
                 indicator.update(`Collected ${completed} of ${queries.length} generated candidates`);
                 eventProgress.emit({ event: 'item_settled', index: item.index, ok: item.ok });
-                checkpoint?.record(item);
+                checkpoint?.record(observed);
             },
         });
+        items = items.map((item) => resumedItems.get(item.index) ?? settledItems.get(item.index) ?? {
+            ...item,
+            observedAt: null,
+            collectionOrigin: 'current_run',
+        });
     }
     finally {
         context.endProgress();

package/cli/discovery-snapshot.mjs

@@ -1,13 +1,12 @@
 import { createHash } from 'node:crypto';
-import { open } from 'node:fs/promises';
-import { CliUsageError } from "./errors.mjs";
+import { boundedCliInputError, CliUsageError } from "./errors.mjs";
 import { writePrivateFile } from "./output-file.mjs";
 import { isValidAsciiDomainName } from "../lib/hostname.mjs";
+import { readBoundedRegularTextFile } from "../lib/bounded-file.mjs";
 export const CLI_DISCOVERY_SNAPSHOT_SCHEMA = 'whoisleuth.cli.discovery-snapshot';
 export const CLI_DISCOVERY_SNAPSHOT_VERSION = 1;
 export const MAX_DISCOVERY_SNAPSHOT_BYTES = 4 * 1024 * 1024;
 export const MAX_DISCOVERY_SNAPSHOT_DOMAINS = 10_000;
-const SHA256_RE = /^[a-f0-9]{64}$/u;
 function configurationDigest(configuration) {
     return createHash('sha256').update(JSON.stringify({
         seed: configuration.seed,
@@ -69,22 +68,16 @@ function parseDiscoverySnapshot(text, expectedConfigurationDigest) {
 }
 async function readExistingSnapshot(path) {
     try {
-        const handle = await open(path, 'r');
-        try {
-            const metadata = await handle.stat();
-            if (!metadata.isFile() || metadata.size > MAX_DISCOVERY_SNAPSHOT_BYTES) {
-                throw new CliUsageError(`Discovery snapshot input is limited to ${MAX_DISCOVERY_SNAPSHOT_BYTES} bytes.`);
-            }
-            return await handle.readFile({ encoding: 'utf8' });
-        }
-        finally {
-            await handle.close();
-        }
+        return await readBoundedRegularTextFile(path, {
+            maximumBytes: MAX_DISCOVERY_SNAPSHOT_BYTES,
+            label: 'Discovery snapshot input',
+            allowSymbolicLink: true,
+        });
     }
     catch (error) {
         if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT')
             return null;
-        throw error;
+        throw boundedCliInputError(error, 'Discovery snapshot input');
     }
 }
 async function updateDiscoverySnapshot(path, candidatesValue, configuration, generatedAt) {

package/cli/discovery-workflow.mjs

@@ -1,6 +1,5 @@
 import { createHash } from 'node:crypto';
-import { createReadStream } from 'node:fs';
-import { DEFAULT_DISCOVERY_TLDS, MAX_DISCOVERY_DICTIONARY_BYTES, normalizeDiscoveryTlds, readDiscoveryDictionaryBounded, } from "./discover.mjs";
+import { DEFAULT_DISCOVERY_TLDS, MAX_DISCOVERY_DICTIONARY_BYTES, normalizeDiscoveryTlds, } from "./discover.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 async function generateDiscoveryCandidates(args, dependencies, context) {
     const seed = args.seed || await context.readSingleInput();
@@ -29,7 +28,7 @@ async function generateDiscoveryCandidates(args, dependencies, context) {
         try {
             dictionaryText = dependencies.readDiscoveryDictionary
                 ? await dependencies.readDiscoveryDictionary(args.dictionarySource)
-                : await readDiscoveryDictionaryBounded(createReadStream(args.dictionarySource, { highWaterMark: MAX_DISCOVERY_DICTIONARY_BYTES }), MAX_DISCOVERY_DICTIONARY_BYTES);
+                : await context.readInput(args.dictionarySource, MAX_DISCOVERY_DICTIONARY_BYTES, 'Discovery dictionary');
         }
         catch (error) {
             if (error instanceof CliUsageError)

package/cli/doctor.mjs

@@ -1,6 +1,6 @@
 import { withTimeout } from "../lib/abort.mjs";
-const DOCTOR_SCHEMA = 'whoisleuth.cli.doctor';
-const DOCTOR_VERSION = 1;
+export const DOCTOR_SCHEMA = 'whoisleuth.cli.doctor';
+export const DOCTOR_VERSION = 1;
 const MINIMUM_NODE_MAJOR = 24;
 const NETWORK_HOST = 'whois.iana.org';
 const NETWORK_QUERY = 'example.com';

package/cli/domain-control-monitor.mjs

@@ -1,4 +1,5 @@
 import { classifyQuery } from "../lib/classify.mjs";
+import { scanBoundedJson } from "../lib/bounded-json.mjs";
 import { buildDomainControlFlightRecorder, } from "../lib/domain-control-flight-recorder.mjs";
 import { verifyDomainControlManifest } from "../lib/domain-control-manifest.mjs";
 import { buildCliLookupDocument } from "./formatters/json.mjs";
@@ -7,16 +8,27 @@ import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 export const CLI_DOMAIN_CONTROL_MONITOR_SCHEMA = 'whoisleuth.cli.domain-control-monitor';
 export const CLI_DOMAIN_CONTROL_MONITOR_VERSION = 1;
 export const MAX_DOMAIN_CONTROL_MONITOR_DOMAINS = 20;
-function previousSnapshot(input) {
-    if (!input)
-        return { observations: [] };
-    let parsed;
+function parseMonitorJson(input, label) {
+    const normalized = input.replace(/^\uFEFF/u, '');
     try {
-        parsed = JSON.parse(input.replace(/^\uFEFF/u, ''));
+        scanBoundedJson(normalized);
+        return JSON.parse(normalized);
     }
-    catch {
-        throw new CliUsageError('Previous monitor snapshot must be valid JSON.');
+    catch (cause) {
+        const detail = cause instanceof Error ? cause.message : '';
+        if (detail === 'Artefact input is not valid JSON.') {
+            throw new CliUsageError(`${label} must be valid JSON.`);
+        }
+        if (detail.startsWith('Artefact JSON ')) {
+            throw new CliUsageError(`${label} ${detail.slice('Artefact JSON '.length)}`);
+        }
+        throw new CliUsageError(`${label} must satisfy the bounded JSON structure contract.`);
     }
+}
+function previousSnapshot(input) {
+    if (!input)
+        return { observations: [] };
+    const parsed = parseMonitorJson(input, 'Previous monitor snapshot');
     const root = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
     if (root.schema !== CLI_DOMAIN_CONTROL_MONITOR_SCHEMA || root.version !== CLI_DOMAIN_CONTROL_MONITOR_VERSION || !Array.isArray(root.observations)) {
         throw new CliUsageError(`Previous monitor snapshot must use ${CLI_DOMAIN_CONTROL_MONITOR_SCHEMA} version ${CLI_DOMAIN_CONTROL_MONITOR_VERSION}.`);
@@ -29,14 +41,9 @@ function previousSnapshot(input) {
 }
 export async function runDomainControlMonitor(manifestInput, previousInput, options) {
     const generatedAt = options.now();
-    let rawManifest;
-    try {
-        rawManifest = JSON.parse(manifestInput.replace(/^\uFEFF/u, ''));
-    }
-    catch {
-        throw new CliUsageError('Domain-control manifest must be valid JSON.');
-    }
+    const rawManifest = parseMonitorJson(manifestInput, 'Domain-control manifest');
     const manifest = verifyDomainControlManifest(rawManifest);
+    const previous = previousSnapshot(previousInput);
     const entries = manifest.entries.slice(0, Math.min(options.limit, MAX_DOMAIN_CONTROL_MONITOR_DOMAINS));
     const lookups = new Array(entries.length);
     const failures = [];
@@ -69,7 +76,6 @@ export async function runDomainControlMonitor(manifestInput, previousInput, opti
     const review = buildCliDomainControlReview(JSON.stringify({
         schema: 'whoisleuth.cli.domain-control-review-input', version: 1, manifest, lookups: successful,
     }), generatedAt);
-    const previous = previousSnapshot(previousInput);
     const observations = review.observations;
     const flightRecorder = buildDomainControlFlightRecorder({
         schema: 'whoisleuth.domain-control-flight-recorder.input', version: 1,

package/cli/domain-control-observations.mjs

@@ -1,4 +1,5 @@
 import { Buffer } from 'node:buffer';
+import { MAX_BOUNDED_JSON_DEPTH, MAX_BOUNDED_JSON_KEYS, MAX_BOUNDED_JSON_VALUES, scanBoundedJson, } from "../lib/bounded-json.mjs";
 import { DOMAIN_CONTROL_FLIGHT_RECORDER_FIELDS, } from "../lib/domain-control-flight-recorder.mjs";
 import { DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, reviewDomainControlManifest, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
 import { CliUsageError } from "./errors.mjs";
@@ -7,6 +8,10 @@ export const CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA = 'whoisleuth.cli.domain-con
 export const CLI_DOMAIN_CONTROL_REVIEW_SCHEMA = 'whoisleuth.cli.domain-control-review';
 export const CLI_DOMAIN_CONTROL_REVIEW_VERSION = 1;
 export const MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES = 32 * 1024 * 1024;
+export const MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS = 100;
+export const MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH = MAX_BOUNDED_JSON_DEPTH + 2;
+export const MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS = MAX_BOUNDED_JSON_KEYS * (MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS + 1);
+export const MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES = MAX_BOUNDED_JSON_VALUES * (MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS + 1);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -134,9 +139,27 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
     if (Buffer.byteLength(inputText, 'utf8') > MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES) {
         throw new CliUsageError(`Domain-control review input is limited to ${MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES} bytes.`);
     }
+    const normalizedInput = inputText.replace(/^\uFEFF/u, '');
+    try {
+        scanBoundedJson(normalizedInput, {
+            maximumDepth: MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH,
+            maximumKeys: MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS,
+            maximumValues: MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES,
+        });
+    }
+    catch (cause) {
+        const detail = cause instanceof Error ? cause.message : '';
+        if (detail === 'Artefact input is not valid JSON.') {
+            throw new CliUsageError('Domain-control review input must be valid JSON.');
+        }
+        const boundedDetail = detail.replace(/^Artefact JSON /u, '');
+        throw new CliUsageError(boundedDetail
+            ? `Domain-control review input ${boundedDetail}`
+            : 'Domain-control review input must be valid JSON.');
+    }
     let parsed;
     try {
-        parsed = JSON.parse(inputText.replace(/^\uFEFF/u, ''));
+        parsed = JSON.parse(normalizedInput);
     }
     catch {
         throw new CliUsageError('Domain-control review input must be valid JSON.');
@@ -148,7 +171,7 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
     if (Object.keys(input).some((key) => !new Set(['schema', 'version', 'manifest', 'lookups']).has(key))) {
         throw new CliUsageError('Domain-control review input contains an unsupported field.');
     }
-    if (input.lookups.length < 1 || input.lookups.length > 100) {
+    if (input.lookups.length < 1 || input.lookups.length > MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS) {
         throw new CliUsageError('Domain-control review requires from 1 to 100 saved Lookup documents.');
     }
     const manifest = verifyDomainControlManifest(input.manifest);

package/cli/errors.mjs

@@ -18,4 +18,10 @@ function boundedCliErrorMessage(error, fallback = 'Unexpected command failure')
         .trim()
         .slice(0, MAX_CLI_ERROR_MESSAGE_LENGTH) || fallback;
 }
-export { CliUsageError, MAX_CLI_ERROR_MESSAGE_LENGTH, boundedCliErrorMessage };
+function boundedCliInputError(error, label) {
+    if (error instanceof CliUsageError)
+        return error;
+    const safeLabel = label.replace(/[^A-Za-z0-9 ()_-]+/gu, '').trim().slice(0, 80) || 'Input';
+    return new CliUsageError(`${safeLabel} could not be read as a bounded regular file.`);
+}
+export { CliUsageError, MAX_CLI_ERROR_MESSAGE_LENGTH, boundedCliErrorMessage, boundedCliInputError, };

package/cli/evidence-command-runner.mjs

@@ -1,11 +1,10 @@
-import { createReadStream } from 'node:fs';
 import { MAX_OFFLINE_ARTIFACT_BYTES, MAX_OFFLINE_PASSPHRASE_FILE_BYTES, } from "./artifact-verify.mjs";
 import { formatArchiveInspection, inspectWorkspaceArchive, } from "./archive-inspect.mjs";
 import { MAX_SIGNING_KEY_FILE_BYTES, formatEvidenceSignatureVerification, signEvidencePackage, verifyEvidencePackageSignature, } from "./evidence-signing.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 import { formatJsonDocument } from "./formatters/json.mjs";
-import { readSavedLookupInputBounded, } from "./saved-lookup.mjs";
+import { readCliTextInput } from "./input.mjs";
 export function isEvidenceCommand(args) {
     return args.action === 'inspect-archive'
         || args.action === 'sign-artifact'
@@ -22,11 +21,10 @@ async function readArtifact(source, label, dependencies) {
     try {
         return dependencies.readArtifactInput
             ? await dependencies.readArtifactInput(source)
-            : await readSavedLookupInputBounded(source
-                ? createReadStream(source, { highWaterMark: 64 * 1024 })
-                : dependencies.stdin, {
-                limit: MAX_OFFLINE_ARTIFACT_BYTES,
+            : await readCliTextInput(source, dependencies.stdin, {
+                maximumBytes: MAX_OFFLINE_ARTIFACT_BYTES,
                 label,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
             });
     }
     catch (error) {
@@ -35,11 +33,15 @@ async function readArtifact(source, label, dependencies) {
         throw new CliUsageError(`Could not read ${label.toLowerCase()}: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
     }
 }
-async function readKey(source, label, injected) {
+async function readKey(source, label, injected, dependencies) {
     try {
         return injected
             ? await injected(source)
-            : await readSavedLookupInputBounded(createReadStream(source, { highWaterMark: MAX_SIGNING_KEY_FILE_BYTES }), { limit: MAX_SIGNING_KEY_FILE_BYTES, label });
+            : await readCliTextInput(source, dependencies.stdin, {
+                maximumBytes: MAX_SIGNING_KEY_FILE_BYTES,
+                label,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+            });
     }
     catch (error) {
         if (error instanceof CliUsageError)
@@ -50,7 +52,11 @@ async function readKey(source, label, injected) {
 async function readPassphrase(source, dependencies) {
     const passphraseText = dependencies.readPassphraseFile
         ? await dependencies.readPassphraseFile(source)
-        : await readSavedLookupInputBounded(createReadStream(source, { highWaterMark: MAX_OFFLINE_PASSPHRASE_FILE_BYTES }), { limit: MAX_OFFLINE_PASSPHRASE_FILE_BYTES, label: 'Passphrase file' });
+        : await readCliTextInput(source, dependencies.stdin, {
+            maximumBytes: MAX_OFFLINE_PASSPHRASE_FILE_BYTES,
+            label: 'Passphrase file',
+            ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+        });
     const passphrase = passphraseText.replace(/\r?\n$/u, '');
     if (!passphrase || /[\r\n\u0000]/u.test(passphrase)) {
         throw new CliUsageError('Passphrase file must contain exactly one non-empty UTF-8 line.');
@@ -85,7 +91,7 @@ export async function runEvidenceCommand(args, dependencies) {
         if (!input.trim()) {
             throw new CliUsageError('sign-artifact requires one reviewed artefact file or an artefact on stdin.');
         }
-        const privateKey = await readKey(args.privateKeySource, 'Private key file', dependencies.readPrivateKeyFile);
+        const privateKey = await readKey(args.privateKeySource, 'Private key file', dependencies.readPrivateKeyFile, dependencies);
         const signed = await signEvidencePackage(input, privateKey, dependencies.now ? dependencies.now() : new Date().toISOString());
         dependencies.stdout.write(formatJsonDocument(signed));
         return EXIT_CODES.SUCCESS;
@@ -95,7 +101,7 @@ export async function runEvidenceCommand(args, dependencies) {
         throw new CliUsageError('verify-signature requires one signed package file or a package on stdin.');
     }
     const publicKey = args.publicKeySource
-        ? await readKey(args.publicKeySource, 'Public key file', dependencies.readPublicKeyFile)
+        ? await readKey(args.publicKeySource, 'Public key file', dependencies.readPublicKeyFile, dependencies)
         : null;
     const report = await verifyEvidencePackageSignature(input, publicKey);
     if (!args.quiet) {

package/cli/evidence-signing.mjs

@@ -1,11 +1,15 @@
 import { Buffer } from 'node:buffer';
 import { createHash, createPrivateKey, createPublicKey, sign, verify, } from 'node:crypto';
-import { canonicalArtifactJson } from "../frontend/src/lib/analysis/artifact-integrity.js";
-import { MAX_OFFLINE_ARTIFACT_BYTES, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { canonicalArtifactJsonFor, resolveArtifactCanonicalization, SORTED_JSON_V1, SORTED_JSON_V2, } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { hasVerifiedApplicableIntegrity, hasVerifiedArtifactStructure, MAX_OFFLINE_ARTIFACT_BYTES, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { parseBoundedJsonObject } from "./bounded-json.mjs";
 export const SIGNED_EVIDENCE_PACKAGE_SCHEMA = 'whoisleuth.signed-evidence-package';
-export const SIGNED_EVIDENCE_PACKAGE_VERSION = 1;
+export const SIGNED_EVIDENCE_PACKAGE_VERSION = 2;
+export const LEGACY_SIGNED_EVIDENCE_PACKAGE_VERSION = 1;
+export const EVIDENCE_SIGNATURE_VERIFICATION_SCHEMA = 'whoisleuth.evidence-signature-verification';
+export const EVIDENCE_SIGNATURE_VERIFICATION_VERSION = 2;
 export const EVIDENCE_SIGNATURE_ALGORITHM = 'Ed25519';
-export const EVIDENCE_SIGNATURE_CANONICALIZATION = 'sorted-json-v1';
+export const EVIDENCE_SIGNATURE_CANONICALIZATION = SORTED_JSON_V2;
 export const MAX_SIGNING_KEY_FILE_BYTES = 16 * 1024;
 const SHA256_RE = /^[a-f0-9]{64}$/u;
 const BASE64_RE = /^[A-Za-z0-9+/]+={0,2}$/u;
@@ -23,23 +27,7 @@ function record(value) {
         : null;
 }
 function parseObject(raw, label) {
-    if (typeof raw !== 'string')
-        throw new TypeError(`${label} must be UTF-8 JSON text.`);
-    const bytes = Buffer.byteLength(raw, 'utf8');
-    if (bytes === 0 || bytes > MAX_OFFLINE_ARTIFACT_BYTES) {
-        throw new TypeError(`${label} must be between 1 byte and ${MAX_OFFLINE_ARTIFACT_BYTES} bytes.`);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new TypeError(`${label} must be valid JSON.`);
-    }
-    const value = record(parsed);
-    if (!value)
-        throw new TypeError(`${label} must contain one JSON object.`);
-    return value;
+    return parseBoundedJsonObject(raw, { label, maximumBytes: MAX_OFFLINE_ARTIFACT_BYTES });
 }
 function hasExactKeys(value, expected) {
     const keys = Object.keys(value);
@@ -54,6 +42,12 @@ function timestamp(value) {
         throw new TypeError('Signature time must be a valid timestamp.');
     return new Date(parsed).toISOString();
 }
+function canonicalTimestamp(value) {
+    const normalized = timestamp(value);
+    if (value !== normalized)
+        throw new TypeError('Signature time must use canonical UTC timestamp text.');
+    return normalized;
+}
 function importPrivateKey(pem) {
     if (Buffer.byteLength(pem, 'utf8') > MAX_SIGNING_KEY_FILE_BYTES) {
         throw new TypeError(`Private key file exceeds ${MAX_SIGNING_KEY_FILE_BYTES} bytes.`);
@@ -96,8 +90,8 @@ function spkiDer(key) {
 function keyId(publicDer) {
     return createHash('sha256').update(publicDer).digest('hex');
 }
-function payloadBytes(payload) {
-    return Buffer.from(canonicalArtifactJson(payload), 'utf8');
+function payloadBytes(payload, canonicalization) {
+    return Buffer.from(canonicalArtifactJsonFor(payload, canonicalization), 'utf8');
 }
 async function signableArtifact(raw) {
     const artifact = parseObject(raw, 'Evidence artefact');
@@ -105,6 +99,9 @@ async function signableArtifact(raw) {
     if (!['case_response_packet', 'investigation_capsule', 'signed_review_artifact'].includes(verification.artifact.kind)) {
         throw new TypeError('Only reviewed response packets, investigation capsules, and supported review manifests can be signed.');
     }
+    if (!hasVerifiedArtifactStructure(verification) || !hasVerifiedApplicableIntegrity(verification)) {
+        throw new TypeError('Evidence signing requires verified structure and a verified applicable integrity contract.');
+    }
     return { artifact, verification };
 }
 export async function signEvidencePackage(raw, privateKeyPem, signedAt = new Date().toISOString()) {
@@ -124,7 +121,7 @@ export async function signEvidencePackage(raw, privateKeyPem, signedAt = new Dat
             canonicalization: EVIDENCE_SIGNATURE_CANONICALIZATION,
             publicKeySpkiDerBase64: publicDer.toString('base64'),
             keyIdSha256: keyId(publicDer),
-            valueBase64: sign(null, payloadBytes(payload), privateKey).toString('base64'),
+            valueBase64: sign(null, payloadBytes(payload, SORTED_JSON_V2), privateKey).toString('base64'),
         }),
     });
 }
@@ -134,12 +131,11 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
     const artifact = record(value.artifact);
     if (!hasExactKeys(value, PACKAGE_KEYS)
         || value.schema !== SIGNED_EVIDENCE_PACKAGE_SCHEMA
-        || value.version !== SIGNED_EVIDENCE_PACKAGE_VERSION
+        || (value.version !== LEGACY_SIGNED_EVIDENCE_PACKAGE_VERSION && value.version !== SIGNED_EVIDENCE_PACKAGE_VERSION)
         || !artifact
         || !signature
         || !hasExactKeys(signature, SIGNATURE_KEYS)
         || signature.algorithm !== EVIDENCE_SIGNATURE_ALGORITHM
-        || signature.canonicalization !== EVIDENCE_SIGNATURE_CANONICALIZATION
         || typeof signature.publicKeySpkiDerBase64 !== 'string'
         || signature.publicKeySpkiDerBase64.length > 4096
         || !BASE64_RE.test(signature.publicKeySpkiDerBase64)
@@ -150,7 +146,17 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
         || !SHA256_RE.test(signature.keyIdSha256)) {
         throw new TypeError('Signed evidence package has an unsupported or malformed envelope.');
     }
-    const signedAt = timestamp(value.signedAt);
+    let canonicalization;
+    try {
+        canonicalization = resolveArtifactCanonicalization(value.version, signature.canonicalization, [
+            { version: LEGACY_SIGNED_EVIDENCE_PACKAGE_VERSION, canonicalization: SORTED_JSON_V1, explicit: true },
+            { version: SIGNED_EVIDENCE_PACKAGE_VERSION, canonicalization: SORTED_JSON_V2, explicit: true },
+        ], 'Signed evidence package');
+    }
+    catch {
+        throw new TypeError('Signed evidence package has an unsupported or malformed envelope.');
+    }
+    const signedAt = canonicalTimestamp(value.signedAt);
     const publicDer = Buffer.from(signature.publicKeySpkiDerBase64, 'base64');
     if (keyId(publicDer) !== signature.keyIdSha256) {
         throw new TypeError('Signed evidence package public-key identifier does not match its embedded key.');
@@ -158,16 +164,20 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
     const embeddedPublicKey = importPublicKey(publicDer, 'Embedded evidence-signing public key');
     const payload = {
         schema: SIGNED_EVIDENCE_PACKAGE_SCHEMA,
-        version: SIGNED_EVIDENCE_PACKAGE_VERSION,
+        version: value.version,
         signedAt,
         artifact,
     };
     const signatureBytes = Buffer.from(signature.valueBase64, 'base64');
     if (signatureBytes.length !== 64
-        || !verify(null, payloadBytes(payload), embeddedPublicKey, signatureBytes)) {
+        || !verify(null, payloadBytes(payload, canonicalization), embeddedPublicKey, signatureBytes)) {
         throw new TypeError('Signed evidence package failed Ed25519 verification.');
     }
-    const artifactVerification = await verifyOfflineArtifact(JSON.stringify(artifact));
+    let artifactVerification = null;
+    try {
+        artifactVerification = await verifyOfflineArtifact(JSON.stringify(artifact));
+    }
+    catch { /* Signature validity remains independently reportable. */ }
     let publicKeyMatched = null;
     if (trustedPublicKeyPem) {
         const trustedDer = spkiDer(importPublicKey(trustedPublicKeyPem, 'Trusted public key file'));
@@ -176,24 +186,41 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
             throw new TypeError('Signed evidence package does not match the trusted public key.');
     }
     return Object.freeze({
-        schema: 'whoisleuth.evidence-signature-verification',
-        version: 1,
-        valid: true,
+        schema: EVIDENCE_SIGNATURE_VERIFICATION_SCHEMA,
+        version: EVIDENCE_SIGNATURE_VERIFICATION_VERSION,
         state: 'signature_valid',
-        signerTrust: trustedPublicKeyPem ? 'trusted_key' : 'embedded_key_only',
-        signedAt,
-        keyIdSha256: signature.keyIdSha256,
-        publicKeyMatched,
+        signature: Object.freeze({
+            state: 'valid',
+            signerTrust: trustedPublicKeyPem ? 'trusted_key' : 'embedded_key_only',
+            signedAt,
+            keyIdSha256: signature.keyIdSha256,
+            publicKeyMatched,
+        }),
         artifact: Object.freeze({
-            schema: artifactVerification.artifact.schema,
-            version: artifactVerification.artifact.version,
-            kind: artifactVerification.artifact.kind,
+            schema: artifactVerification?.artifact.schema
+                ?? (typeof artifact.schema === 'string' && /^[a-z0-9.-]{1,160}$/u.test(artifact.schema) ? artifact.schema : null),
+            version: artifactVerification?.artifact.version
+                ?? (Number.isSafeInteger(artifact.version ?? artifact.schemaVersion)
+                    && Number(artifact.version ?? artifact.schemaVersion) >= 1
+                    && Number(artifact.version ?? artifact.schemaVersion) <= 1_000
+                    ? Number(artifact.version ?? artifact.schemaVersion)
+                    : null),
+            kind: artifactVerification?.artifact.kind ?? 'unverified_artifact',
+            assurance: Object.freeze({
+                state: artifactVerification?.state ?? 'not_verified',
+                structure: artifactVerification?.checks.structure ?? 'not_checked',
+                contentIntegrity: artifactVerification?.checks.contentIntegrity ?? 'not_checked',
+                contentIntegrityScope: artifactVerification?.checks.contentIntegrityScope ?? 'not_checked',
+            }),
         }),
         limitations: Object.freeze([
             trustedPublicKeyPem
                 ? 'The signature and supplied public key match; recipient trust still depends on obtaining that public key through an authenticated channel.'
                 : 'The signature is internally valid for the embedded public key, but signer identity was not authenticated because no trusted public key was supplied.',
             'The signature authenticates the canonical sorted-JSON content, not the original whitespace, indentation, or object-key order of the serialised file.',
+            ...(artifactVerification
+                ? [`Embedded-artifact assurance is reported separately as ${artifactVerification.state}; it does not change the cryptographic signature result.`]
+                : ['The embedded artefact did not pass a supported local assurance contract. The cryptographic signature remains valid for its bytes, but no structure or inner-integrity claim is made.']),
             'A valid signature proves the canonical package content has not changed since signing; it does not establish that the retained observations or analyst statements are accurate.',
             'WHOISleuth does not generate, store, recover, rotate, or publish signing keys.',
         ]),
@@ -203,11 +230,12 @@ export function formatEvidenceSignatureVerification(report) {
     const lines = [
         'WHOISleuth evidence signature verification',
         `State: ${report.state}`,
-        `Signer trust: ${report.signerTrust}`,
-        `Artifact: ${report.artifact.kind} · ${report.artifact.schema} v${report.artifact.version}`,
-        `Signed: ${report.signedAt}`,
-        `Key ID: sha256:${report.keyIdSha256}`,
-        `Trusted public key: ${report.publicKeyMatched === null ? 'not supplied' : 'matched'}`,
+        `Signer trust: ${report.signature.signerTrust}`,
+        `Artifact: ${report.artifact.kind} · ${report.artifact.schema ?? 'unrecognised'} v${report.artifact.version ?? 'unrecognised'}`,
+        `Artifact assurance: ${report.artifact.assurance.state}`,
+        `Signed: ${report.signature.signedAt}`,
+        `Key ID: sha256:${report.signature.keyIdSha256}`,
+        `Trusted public key: ${report.signature.publicKeyMatched === null ? 'not supplied' : 'matched'}`,
     ];
     for (const limitation of report.limitations)
         lines.push(`Limitation: ${limitation}`);

package/cli/export-evidence.mjs

@@ -1,8 +1,9 @@
-import { createRequire } from 'node:module';
 import { projectCliLookupComparisonInput } from "./compare.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
-const require = createRequire(import.meta.url);
-const { version: APPLICATION_VERSION } = require('../package.json');
+import { validateLookupEvidenceArtifactStructure } from "./artifact-structure.mjs";
+import { WHOISLEUTH_APPLICATION_VERSION } from "../lib/application-version.mjs";
+import { LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES, serializeLookupEvidence, } from "../lib/evidence-export.mjs";
+const APPLICATION_VERSION = WHOISLEUTH_APPLICATION_VERSION;
 function objectOrNull(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
@@ -27,9 +28,15 @@ function buildCliEvidenceExport(text, evidenceModule, generatedAt = new Date().t
         || result.schemaVersion !== dependency.LOOKUP_EVIDENCE_SCHEMA_VERSION) {
         throw new TypeError('Lookup evidence builder returned an unsupported report contract.');
     }
+    validateLookupEvidenceArtifactStructure(result);
+    serializeLookupEvidence(result);
     return result;
 }
 function formatCliEvidenceExport(document, compact = false) {
-    return `${JSON.stringify(document, null, compact ? 0 : 2)}\n`;
+    const output = `${serializeLookupEvidence(document, !compact)}\n`;
+    if (new TextEncoder().encode(output).byteLength > LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES) {
+        throw new TypeError('Lookup evidence exceeds the 5 MiB portable file limit.');
+    }
+    return output;
 }
 export { APPLICATION_VERSION, buildCliEvidenceExport, formatCliEvidenceExport };

package/cli/formatters/html.mjs

@@ -26,8 +26,8 @@ function renderRegistrarComparison(comparison) {
         : '';
     return `<div class="table-scroll"><table><caption>Normalized registry and registrar RDAP publication comparison</caption><thead><tr><th scope="col">Field</th><th scope="col">Result</th><th scope="col">Registry RDAP</th><th scope="col">Registrar RDAP</th></tr></thead><tbody>${rows}</tbody></table></div>${omitted}`;
 }
-function formatLookupEvidenceHtml(document) {
-    const report = buildLookupEvidenceReport(document);
+function formatLookupEvidenceHtml(document, options = {}) {
+    const report = buildLookupEvidenceReport(document, options);
     const title = `Lookup evidence report: ${report.title}`;
     return `<!doctype html>
 <html lang="en">
@@ -60,7 +60,7 @@ function formatLookupEvidenceHtml(document) {
   <section class="block"><h2>Network evidence</h2>${renderGroups(report.networkGroups)}</section>
   <section class="block"><h2>Collection diagnostics</h2>${renderFields(report.diagnostics)}</section>
   <section class="block"><h2>Limitations</h2><ul>${report.limitations.map((item) => `<li>${escapeHtml(item)}</li>`).join('')}</ul></section>
-  <footer>Offline, self-contained report. No scripts, forms, external resources, or active links are included.</footer>
+  <footer>Offline, self-contained report. No scripts, forms, external resources, or active links are included.${report.attribution ? `<br>${escapeHtml(report.attribution)}` : ''}</footer>
 </main>
 </body>
 </html>