@slicedearth/whoisleuth-cli 1.43.0 → 1.47.4

package/cli/formatters/json.mjs

@@ -10,11 +10,11 @@ const CLI_HTTP_SCHEMA = 'whoisleuth.cli.http';
 const CLI_TLS_SCHEMA = 'whoisleuth.cli.tls';
 const CLI_COMPARE_SCHEMA = 'whoisleuth.cli.compare';
 const CLI_LOOKUP_SCHEMA_VERSION = 1;
-const CLI_BULK_SCHEMA_VERSION = 2;
+const CLI_BULK_SCHEMA_VERSION = 3;
 const CLI_CT_SEARCH_SCHEMA_VERSION = 1;
 const CLI_DISCOVER_SCHEMA_VERSION = 2;
 const CLI_POSTURE_SCHEMA_VERSION = 1;
-const CLI_HTTP_SCHEMA_VERSION = 1;
+const CLI_HTTP_SCHEMA_VERSION = 2;
 const CLI_TLS_SCHEMA_VERSION = 1;
 const CLI_COMPARE_SCHEMA_VERSION = 3;
 function buildCliLookupDocument(query, classified, result, generatedAt = new Date().toISOString(), mode = 'fast', collectionContext = {}) {
@@ -25,6 +25,7 @@ function buildCliLookupDocument(query, classified, result, generatedAt = new Dat
         ? collectionContext.vantageLabel
         : null;
     return {
+        ...result,
         schema: CLI_LOOKUP_SCHEMA,
         version: CLI_LOOKUP_SCHEMA_VERSION,
         generatedAt,
@@ -40,7 +41,6 @@ function buildCliLookupDocument(query, classified, result, generatedAt = new Dat
                 ...(vantageLabel ? { vantageLabel } : {}),
             },
         } : {}),
-        ...result,
     };
 }
 function formatJsonDocument(document) {
@@ -105,15 +105,21 @@ function buildCliCompareDocument(result, generatedAt = new Date().toISOString())
     return { ...result, schema: CLI_COMPARE_SCHEMA, version: CLI_COMPARE_SCHEMA_VERSION, generatedAt };
 }
 function bulkJsonItem(item, metadata) {
+    const provenance = {
+        observedAt: item.observedAt ?? null,
+        collectionOrigin: item.collectionOrigin ?? 'current_run',
+    };
     if (!item.ok) {
         return {
             schema: CLI_BULK_ITEM_SCHEMA, version: CLI_BULK_SCHEMA_VERSION, generatedAt: metadata.generatedAt,
+            ...provenance,
             index: item.index, query: item.query, ok: false, error: item.error,
         };
     }
     const result = item.result;
     return {
         schema: CLI_BULK_ITEM_SCHEMA, version: CLI_BULK_SCHEMA_VERSION, generatedAt: metadata.generatedAt,
+        ...provenance,
         index: item.index, query: item.query, ok: true,
         type: item.classified.type,
         inputHostname: item.classified.inputHostname,
@@ -142,6 +148,8 @@ function buildCliBulkDocument(items, metadata) {
     };
 }
 function formatJsonLines(items, metadata) {
-    return `${items.map((item) => JSON.stringify(bulkJsonItem(item, metadata))).join('\n')}\n`;
+    return items.length
+        ? `${items.map((item) => JSON.stringify(bulkJsonItem(item, metadata))).join('\n')}\n`
+        : '';
 }
 export { CLI_BULK_ITEM_SCHEMA, CLI_BULK_SCHEMA, CLI_BULK_SCHEMA_VERSION, CLI_COMPARE_SCHEMA, CLI_COMPARE_SCHEMA_VERSION, CLI_CT_SEARCH_SCHEMA, CLI_CT_SEARCH_SCHEMA_VERSION, CLI_DISCOVER_ITEM_SCHEMA, CLI_DISCOVER_SCHEMA, CLI_DISCOVER_SCHEMA_VERSION, CLI_HTTP_SCHEMA, CLI_HTTP_SCHEMA_VERSION, CLI_POSTURE_SCHEMA, CLI_POSTURE_SCHEMA_VERSION, CLI_TLS_SCHEMA, CLI_TLS_SCHEMA_VERSION, CLI_LOOKUP_SCHEMA, CLI_LOOKUP_SCHEMA_VERSION, buildCliBulkDocument, buildCliCompareDocument, buildCliCtSearchDocument, buildCliDiscoverDocument, buildCliHttpDocument, buildCliLookupDocument, buildCliPostureDocument, buildCliTlsDocument, bulkJsonItem, discoverJsonItem, formatDiscoverDomainList, formatDiscoverJsonLines, formatJsonDocument, formatJsonLines, };

package/cli/formatters/terminal.mjs

@@ -271,6 +271,9 @@ function formatTerminalRegistrySupport(document) {
         `WHOIS scope    ${supportLabel(whois.queryScope)}`,
         `WHOIS encoding ${supportLabel(whois.encodingProfile)}`,
         `WHOIS parser   ${supportLabel(whois.parserProfile)}`,
+        ...(typeof profile.officialLookupUrl === 'string' && profile.officialLookupUrl
+            ? [`Official lookup ${safeTerminalValue(profile.officialLookupUrl)}`]
+            : []),
         `Fixture states ${fixtures.length ? fixtures.map((value) => supportLabel(value)).join(', ') : 'None documented'}`,
     ];
     for (const file of files)
@@ -431,7 +434,7 @@ function formatTerminalHttp(document) {
     const lines = [
         `Domain         ${safeTerminalValue(document.domain)}`,
         `Probe          ${titleCase(document.probeStatus)}`,
-        `Activity       ${titleCase(document.activityStatus)}`,
+        `Assessment     ${titleCase(document.assessment ?? document.activityStatus)}`,
         `Evidence       ${titleCase(http.status)}`,
         `Final URL      ${safeTerminalValue(http.finalUrl)}`,
         `HTTP status    ${safeTerminalValue(response.status)}`,

package/cli/http.mjs

@@ -17,7 +17,8 @@ function buildHttpProbeResult(domain, probe) {
     return {
         domain,
         probeStatus: status,
-        activityStatus: status === 'fetched' || status === 'responded' ? 'active' : 'unreachable',
+        assessment: status === 'fetched' || status === 'responded' ? 'active' : 'inconclusive',
+        activityStatus: status === 'fetched' || status === 'responded' ? 'active' : null,
         detail: boundedDetail(input.detail),
         http: input.http && typeof input.http === 'object' && !Array.isArray(input.http)
             ? input.http

package/cli/input.mjs

@@ -0,0 +1,57 @@
+import { Buffer } from 'node:buffer';
+import { readBoundedRegularTextFile } from "../lib/bounded-file.mjs";
+import { CliUsageError } from "./errors.mjs";
+function abortError(signal) {
+    return signal.reason instanceof Error
+        ? signal.reason
+        : new DOMException('The operation was aborted.', 'AbortError');
+}
+export async function readCliTextInput(source, stdin, options) {
+    if (options.signal?.aborted)
+        throw abortError(options.signal);
+    if (source) {
+        try {
+            return await readBoundedRegularTextFile(source, {
+                maximumBytes: options.maximumBytes,
+                label: options.label,
+                allowSymbolicLink: true,
+                ...(options.signal ? { signal: options.signal } : {}),
+            });
+        }
+        catch (error) {
+            if (options.signal?.aborted)
+                throw abortError(options.signal);
+            if (error instanceof CliUsageError)
+                throw error;
+            const message = error instanceof Error ? error.message : `${options.label} could not be read.`;
+            throw new CliUsageError(message);
+        }
+    }
+    if (!stdin || stdin.isTTY)
+        return '';
+    let bytes = 0;
+    const chunks = [];
+    const onAbort = () => {
+        if ('destroy' in stdin && typeof stdin.destroy === 'function')
+            stdin.destroy(abortError(options.signal));
+    };
+    options.signal?.addEventListener('abort', onAbort, { once: true });
+    try {
+        for await (const chunk of stdin) {
+            if (options.signal?.aborted)
+                throw abortError(options.signal);
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            bytes += buffer.length;
+            if (bytes > options.maximumBytes) {
+                throw new CliUsageError(`${options.label} is limited to ${options.maximumBytes} bytes.`);
+            }
+            chunks.push(buffer);
+        }
+        if (options.signal?.aborted)
+            throw abortError(options.signal);
+        return Buffer.concat(chunks, bytes).toString('utf8');
+    }
+    finally {
+        options.signal?.removeEventListener('abort', onAbort);
+    }
+}

package/cli/interchange-report.mjs

@@ -0,0 +1,226 @@
+import { Buffer } from 'node:buffer';
+import { INTERCHANGE_ARTIFACT_CONTRACTS, } from "../lib/interchange-fidelity-registry.mjs";
+import { offlineArtifactSatisfiesAssurance, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { mergeBrandProfiles } from "../frontend/src/lib/analysis/brand-profile-model.js";
+import { parseBoundedJsonObject } from "./bounded-json.mjs";
+export const INTERCHANGE_FIDELITY_REPORT_SCHEMA = 'whoisleuth.interchange-fidelity-report';
+export const INTERCHANGE_FIDELITY_REPORT_VERSION = 2;
+export const MAX_INTERCHANGE_REPORT_BYTES = 15 * 1024 * 1024;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function parseInput(raw) {
+    if (typeof raw !== 'string')
+        throw new TypeError('Interchange input must be UTF-8 JSON text.');
+    const bytes = Buffer.byteLength(raw, 'utf8');
+    if (bytes < 1 || bytes > MAX_INTERCHANGE_REPORT_BYTES) {
+        throw new TypeError(`Interchange input must be between 1 byte and ${MAX_INTERCHANGE_REPORT_BYTES} bytes.`);
+    }
+    return parseBoundedJsonObject(raw.replace(/^\uFEFF/u, ''), {
+        label: 'Interchange input',
+        maximumBytes: MAX_INTERCHANGE_REPORT_BYTES,
+    });
+}
+function nestedRecord(value, path) {
+    let current = value;
+    for (const part of path)
+        current = record(current?.[part]);
+    return current;
+}
+function identify(value) {
+    for (const contract of INTERCHANGE_ARTIFACT_CONTRACTS) {
+        const container = nestedRecord(value, contract.nestedSchemaPath);
+        if (container?.schema !== contract.schema)
+            continue;
+        const declared = container[contract.versionField];
+        return {
+            contract,
+            version: Number.isSafeInteger(declared) && Number(declared) > 0 && Number(declared) <= 1000
+                ? Number(declared)
+                : null,
+        };
+    }
+    return null;
+}
+function timestamp(value) {
+    if (typeof value !== 'string' || value.length > 64 || /[\u0000-\u001f\u007f]/u.test(value)) {
+        throw new TypeError('Interchange report time is invalid.');
+    }
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed))
+        throw new TypeError('Interchange report time is invalid.');
+    return new Date(parsed).toISOString();
+}
+function validateBrandProfileExport(value) {
+    const profiles = value.profiles;
+    if (!Array.isArray(profiles) || profiles.length > 100) {
+        throw new TypeError('Brand Profile export does not contain a bounded profiles collection.');
+    }
+    if (typeof value.exportedAt !== 'string' || value.exportedAt.length > 64 || !Number.isFinite(Date.parse(value.exportedAt))) {
+        throw new TypeError('Brand Profile export time is invalid.');
+    }
+    let nextId = 0;
+    const result = mergeBrandProfiles([], value, {
+        nowIso: new Date(Date.parse(value.exportedAt)).toISOString(),
+        makeId: () => `interchange-profile-${++nextId}`,
+    });
+    return Object.freeze({ accepted: result.profiles.length, skipped: result.skipped });
+}
+export async function buildInterchangeFidelityReport(raw, options = {}) {
+    const inputBytes = Buffer.byteLength(raw, 'utf8');
+    const value = parseInput(raw);
+    const identified = identify(value);
+    const generatedAt = timestamp(options.generatedAt ?? new Date().toISOString());
+    if (!identified)
+        return Object.freeze({
+            schema: INTERCHANGE_FIDELITY_REPORT_SCHEMA,
+            version: INTERCHANGE_FIDELITY_REPORT_VERSION,
+            generatedAt,
+            recognised: false,
+            artifact: Object.freeze({ id: null, schema: null, version: null, versionSupported: false }),
+            verification: Object.freeze({ state: 'not_verified', requiredAssurance: null, assuranceSatisfied: false }),
+            compatibility: Object.freeze({
+                browser: null,
+                cli: null,
+                fidelity: 'not_verified',
+                preservedFieldGroups: Object.freeze([]),
+                excludedFieldGroups: Object.freeze([]),
+                futureVersionBehaviour: null,
+                fullyImportable: null,
+            }),
+            summary: Object.freeze({
+                inputBytes, recordCount: null, sectionCount: null, encryptedContentVerified: null,
+                acceptedRecordCount: null, skippedRecordCount: null, unsupportedSectionCount: null,
+                blockedSectionCount: null, prunedRecordCount: null,
+            }),
+            limitations: Object.freeze([
+                'The file did not match a registered interchange contract. Its supplied schema text and contents are not echoed.',
+                'This report makes no request and does not establish that evidence is accurate, current, complete, or safe to share.',
+            ]),
+        });
+    const { contract, version } = identified;
+    const supported = version !== null && contract.versions.includes(version);
+    let verificationState = supported ? 'not_verified' : 'unsupported_version';
+    let assuranceSatisfied = false;
+    let recordCount = null;
+    let sectionCount = null;
+    let encryptedContentVerified = contract.id === 'encrypted_workspace' ? false : null;
+    let acceptedRecordCount = null;
+    let skippedRecordCount = null;
+    let unsupportedSectionCount = null;
+    let blockedSectionCount = null;
+    let prunedRecordCount = null;
+    let fullyImportable = null;
+    if (supported && contract.fidelity !== 'unsupported') {
+        try {
+            if (contract.id === 'brand_profiles') {
+                const validation = validateBrandProfileExport(value);
+                recordCount = validation.accepted;
+                acceptedRecordCount = validation.accepted;
+                skippedRecordCount = validation.skipped;
+                verificationState = validation.skipped === 0 ? 'structure_valid' : 'not_verified';
+                assuranceSatisfied = validation.skipped === 0 && contract.requiredAssurance === 'structure';
+            }
+            else {
+                const verification = await verifyOfflineArtifact(raw, { passphrase: options.passphrase ?? null });
+                verificationState = verification.state;
+                assuranceSatisfied = contract.requiredAssurance === 'whole_integrity'
+                    ? offlineArtifactSatisfiesAssurance(verification, 'whole_integrity')
+                    : contract.requiredAssurance === 'structure'
+                        ? offlineArtifactSatisfiesAssurance(verification, 'structure')
+                        : contract.requiredAssurance === 'authenticated_whole_integrity'
+                            ? offlineArtifactSatisfiesAssurance(verification, 'whole_integrity')
+                                && verification.checks.authenticatedEncryption === 'verified'
+                            : false;
+                recordCount = verification.summary.recordCount;
+                sectionCount = verification.summary.sectionCount;
+                const unsupportedSections = verification.summary.unsupportedSectionCount ?? 0;
+                unsupportedSectionCount = unsupportedSections;
+                blockedSectionCount = verification.summary.blockedSectionCount ?? null;
+                skippedRecordCount = verification.summary.skippedRecordCount ?? skippedRecordCount;
+                prunedRecordCount = verification.summary.prunedRecordCount ?? null;
+                if (verification.summary.fullyImportable !== undefined
+                    && verification.summary.fullyImportable !== null) {
+                    fullyImportable = assuranceSatisfied && verification.summary.fullyImportable;
+                }
+                if (contract.id === 'encrypted_workspace')
+                    encryptedContentVerified = verification.state === 'verified'
+                        && verification.checks.authenticatedEncryption === 'verified';
+            }
+        }
+        catch {
+            verificationState = 'not_verified';
+            assuranceSatisfied = false;
+        }
+    }
+    const fidelityEligible = assuranceSatisfied && fullyImportable !== false;
+    const fidelity = !supported
+        ? 'unsupported'
+        : fidelityEligible
+            ? contract.fidelity
+            : contract.fidelity === 'unsupported'
+                ? 'unsupported'
+                : 'not_verified';
+    return Object.freeze({
+        schema: INTERCHANGE_FIDELITY_REPORT_SCHEMA,
+        version: INTERCHANGE_FIDELITY_REPORT_VERSION,
+        generatedAt,
+        recognised: true,
+        artifact: Object.freeze({ id: contract.id, schema: contract.schema, version, versionSupported: supported }),
+        verification: Object.freeze({
+            state: verificationState,
+            requiredAssurance: contract.requiredAssurance,
+            assuranceSatisfied,
+        }),
+        compatibility: Object.freeze({
+            browser: contract.browser,
+            cli: contract.cli,
+            fidelity,
+            preservedFieldGroups: contract.preservedFieldGroups,
+            excludedFieldGroups: contract.excludedFieldGroups,
+            futureVersionBehaviour: contract.futureVersionBehaviour,
+            fullyImportable,
+        }),
+        summary: Object.freeze({
+            inputBytes, recordCount, sectionCount, encryptedContentVerified,
+            acceptedRecordCount, skippedRecordCount, unsupportedSectionCount,
+            blockedSectionCount, prunedRecordCount,
+        }),
+        limitations: Object.freeze([
+            'Compatibility describes declared field groups and supported operations, not byte-for-byte equality or evidence truth.',
+            'The report emits only registered metadata, counts, and fixed field-group identifiers. Targets, notes, contacts, passphrases, and evidence values are not included.',
+            'A verified integrity envelope detects file changes but does not establish author identity, source accuracy, currency, completeness, or sharing authority.',
+        ]),
+    });
+}
+export function formatInterchangeFidelityReport(report) {
+    const browser = report.compatibility.browser;
+    const cli = report.compatibility.cli;
+    return [
+        'Interchange fidelity report',
+        `Recognised     ${report.recognised ? 'yes' : 'no'}`,
+        `Artifact       ${report.artifact.id ?? 'unrecognised'}`,
+        `Version        ${report.artifact.version ?? 'unavailable'}${report.artifact.versionSupported ? '' : ' (unsupported)'}`,
+        `Verification   ${report.verification.state}`,
+        `Assurance      ${report.verification.requiredAssurance ?? 'unregistered'} · ${report.verification.assuranceSatisfied ? 'satisfied' : 'withheld'}`,
+        `Fidelity       ${report.compatibility.fidelity}`,
+        ...(report.compatibility.fullyImportable === null ? [] : [`Importability  ${report.compatibility.fullyImportable ? 'complete' : 'partial'}`]),
+        `Browser        import ${browser?.import ?? 'unknown'} · export ${browser?.export ?? 'unknown'}`,
+        `CLI            read ${cli?.read ?? 'unknown'} · write ${cli?.write ?? 'unknown'} · verify ${cli?.verify ?? 'unknown'}`,
+        `Records        ${report.summary.recordCount ?? 'not disclosed'}`,
+        `Sections       ${report.summary.sectionCount ?? 'not disclosed'}`,
+        ...(report.summary.acceptedRecordCount === null ? [] : [`Accepted       ${report.summary.acceptedRecordCount}`]),
+        ...(report.summary.skippedRecordCount === null ? [] : [`Skipped        ${report.summary.skippedRecordCount}`]),
+        ...(report.summary.unsupportedSectionCount === null ? [] : [`Unsupported    ${report.summary.unsupportedSectionCount}`]),
+        ...(report.summary.blockedSectionCount === null ? [] : [`Blocked        ${report.summary.blockedSectionCount}`]),
+        ...(report.summary.prunedRecordCount === null ? [] : [`Pruned         ${report.summary.prunedRecordCount}`]),
+        '',
+        `Preserved      ${report.compatibility.preservedFieldGroups.join(', ') || 'none declared'}`,
+        `Excluded       ${report.compatibility.excludedFieldGroups.join(', ') || 'none declared'}`,
+        '',
+        ...report.limitations.map((item) => `Limitation: ${item}`),
+        '',
+    ].join('\n');
+}

package/cli/investigation-manifest.mjs

@@ -1,10 +1,11 @@
 import { Buffer } from 'node:buffer';
 import { createHash } from 'node:crypto';
-import { canonicalArtifactJson, sha256ArtifactDigest, } from "../frontend/src/lib/analysis/artifact-integrity.js";
-import { recordOrNull, requireBoundedString, requireIsoTimestamp, } from "../lib/bounded-contract-normalizers.mjs";
+import { canonicalArtifactJsonV2, SORTED_JSON_V2, sha256ArtifactDigestV2, } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { requireBoundedString, requireIsoTimestamp, } from "../lib/bounded-contract-normalizers.mjs";
 import { normalizeBoundedSemanticVersion } from "../lib/semantic-version.mjs";
+import { parseBoundedJsonObject } from "./bounded-json.mjs";
 export const INVESTIGATION_MANIFEST_SCHEMA = 'whoisleuth.investigation-manifest';
-export const INVESTIGATION_MANIFEST_VERSION = 1;
+export const INVESTIGATION_MANIFEST_VERSION = 2;
 export const MAX_INVESTIGATION_MANIFEST_ARTIFACTS = 16;
 export const MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES = 15 * 1024 * 1024;
 export const MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES = 32 * 1024 * 1024;
@@ -40,20 +41,17 @@ export async function buildInvestigationManifest(input, generatedAtValue, applic
         if (byteLength < 1 || byteLength > MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES) {
             throw new TypeError(`Artifact ${index + 1} must be between 1 byte and ${MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES} bytes.`);
         }
-        let parsed;
-        try {
-            parsed = JSON.parse(artifact.content);
+        if (totalBytes > MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES) {
+            throw new TypeError(`Manifest artefacts exceed the ${MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES}-byte combined limit.`);
         }
-        catch {
-            throw new TypeError(`Artifact ${index + 1} must be valid JSON.`);
-        }
-        const value = recordOrNull(parsed);
-        if (!value)
-            throw new TypeError(`Artifact ${index + 1} must contain one JSON object.`);
+        const value = parseBoundedJsonObject(artifact.content, {
+            label: `Artifact ${index + 1}`,
+            maximumBytes: MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES,
+        });
         const schema = value.schema === undefined
             ? null
             : requireBoundedString(value.schema, `Artifact ${index + 1} schema`, 160);
-        const canonical = canonicalArtifactJson(value);
+        const canonical = canonicalArtifactJsonV2(value);
         const contentDigestSha256 = digest(artifact.content);
         return Object.freeze({
             sequence: index + 1,
@@ -65,9 +63,6 @@ export async function buildInvestigationManifest(input, generatedAtValue, applic
             canonicalDigestSha256: digest(canonical),
         });
     });
-    if (totalBytes > MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES) {
-        throw new TypeError(`Manifest artefacts exceed the ${MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES}-byte combined limit.`);
-    }
     const unsigned = Object.freeze({
         schema: INVESTIGATION_MANIFEST_SCHEMA,
         version: INVESTIGATION_MANIFEST_VERSION,
@@ -90,7 +85,11 @@ export async function buildInvestigationManifest(input, generatedAtValue, applic
     });
     return Object.freeze({
         ...unsigned,
-        integrity: Object.freeze({ algorithm: 'SHA-256', digestSha256: await sha256ArtifactDigest(unsigned) }),
+        integrity: Object.freeze({
+            algorithm: 'SHA-256',
+            canonicalization: SORTED_JSON_V2,
+            digestSha256: await sha256ArtifactDigestV2(unsigned),
+        }),
     });
 }
 export function formatInvestigationManifest(manifest) {

package/cli/investigation-run.mjs

@@ -1,6 +1,7 @@
 import { Buffer } from 'node:buffer';
 import { buildInvestigationPlan, } from "./investigation-plan.mjs";
 import { CliUsageError } from "./errors.mjs";
+import { scanBoundedJson } from "../lib/bounded-json.mjs";
 export const CLI_INVESTIGATION_RUN_SCHEMA = 'whoisleuth.cli.investigation-run';
 export const CLI_INVESTIGATION_RUN_VERSION = 1;
 export const MAX_INVESTIGATION_RUN_BYTES = 24 * 1024 * 1024;
@@ -9,50 +10,93 @@ function boundedResult(value) {
         throw new CliUsageError(`Investigation step output is limited to ${MAX_INVESTIGATION_RUN_BYTES} bytes.`);
     }
     try {
+        scanBoundedJson(value);
         return JSON.parse(value);
     }
-    catch {
+    catch (cause) {
+        if (cause instanceof TypeError && cause.message !== 'Artefact input is not valid JSON.') {
+            throw new CliUsageError(`Investigation step output ${cause.message.replace(/^Artefact JSON /u, '')}`);
+        }
         return value.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/gu, '').slice(0, MAX_INVESTIGATION_RUN_BYTES);
     }
 }
-function parseResumeState(input, recipe, subject) {
+function resultSchema(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) && typeof value.schema === 'string'
+        ? String(value.schema)
+        : null;
+}
+function sameArguments(left, right) {
+    return Array.isArray(left)
+        && left.length === right.length
+        && left.every((value, index) => typeof value === 'string' && value === right[index]);
+}
+function parseResumeState(input, plan) {
     if (!input)
         return [];
     if (Buffer.byteLength(input, 'utf8') > MAX_INVESTIGATION_RUN_BYTES)
         throw new CliUsageError('Investigation resume state exceeds the 24 MiB limit.');
+    const normalizedInput = input.replace(/^\uFEFF/u, '');
+    try {
+        scanBoundedJson(normalizedInput);
+    }
+    catch (cause) {
+        const detail = cause instanceof Error ? cause.message : '';
+        if (detail === 'Artefact input is not valid JSON.')
+            throw new CliUsageError('Investigation resume state must be valid JSON.');
+        throw new CliUsageError(detail ? `Investigation resume state ${detail.replace(/^Artefact JSON /u, '')}` : 'Investigation resume state must be valid JSON.');
+    }
     let parsed;
     try {
-        parsed = JSON.parse(input.replace(/^\uFEFF/u, ''));
+        parsed = JSON.parse(normalizedInput);
     }
     catch {
         throw new CliUsageError('Investigation resume state must be valid JSON.');
     }
     const root = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
-    if (root.schema !== CLI_INVESTIGATION_RUN_SCHEMA || root.version !== CLI_INVESTIGATION_RUN_VERSION || root.recipe !== recipe || root.subject !== subject || !Array.isArray(root.completedSteps)) {
+    if (root.schema !== CLI_INVESTIGATION_RUN_SCHEMA || root.version !== CLI_INVESTIGATION_RUN_VERSION || root.recipe !== plan.recipe.id || root.subject !== plan.subject || !Array.isArray(root.completedSteps)) {
         throw new CliUsageError('Investigation resume state must match this versioned recipe and subject.');
     }
-    return root.completedSteps.slice(0, 16).flatMap((value) => {
-        if (!value || typeof value !== 'object' || Array.isArray(value))
-            return [];
+    if (root.completedSteps.length > plan.steps.length) {
+        throw new CliUsageError('Investigation resume state contains more steps than the installed fixed recipe.');
+    }
+    const completed = [];
+    for (const [index, value] of root.completedSteps.entries()) {
+        const planned = plan.steps[index];
+        if (!planned || !value || typeof value !== 'object' || Array.isArray(value)) {
+            throw new CliUsageError('Investigation resume state contains a malformed or out-of-order step.');
+        }
         const item = value;
-        if (typeof item.id !== 'string' || typeof item.command !== 'string' || !Array.isArray(item.arguments) || !['offline', 'network'].includes(String(item.mode)) || !Number.isSafeInteger(item.exitCode))
-            return [];
-        return [Object.freeze({
-                id: item.id,
-                command: item.command,
-                arguments: Object.freeze(item.arguments.filter((entry) => typeof entry === 'string').slice(0, 32)),
-                mode: item.mode,
-                exitCode: Number(item.exitCode),
-                result: item.result,
-            })];
-    });
+        if (item.id !== planned.id
+            || item.command !== planned.command
+            || item.mode !== planned.mode
+            || !sameArguments(item.arguments, planned.arguments)
+            || !Number.isSafeInteger(item.exitCode)) {
+            throw new CliUsageError('Investigation resume state does not match the installed fixed recipe.');
+        }
+        const exitCode = Number(item.exitCode);
+        if (exitCode !== 0 && exitCode !== 2) {
+            if (index !== root.completedSteps.length - 1) {
+                throw new CliUsageError('A failed investigation step must be the final retained step.');
+            }
+            break;
+        }
+        if (resultSchema(item.result) !== planned.produces) {
+            throw new CliUsageError('Investigation resume state contains output from an unexpected command contract.');
+        }
+        completed.push(Object.freeze({
+            id: planned.id,
+            command: planned.command,
+            arguments: planned.arguments,
+            mode: planned.mode,
+            exitCode,
+            result: item.result,
+        }));
+    }
+    return completed;
 }
 export async function runInvestigationRecipe(recipe, subjectValue, options) {
     const plan = buildInvestigationPlan(recipe, subjectValue, options.generatedAt);
-    const prior = parseResumeState(options.resumeInput, recipe, plan.subject);
-    const allowedStepIds = new Set(plan.steps.map((step) => step.id));
-    if (prior.some((step) => !allowedStepIds.has(step.id)))
-        throw new CliUsageError('Investigation resume state contains a step outside the fixed recipe.');
+    const prior = parseResumeState(options.resumeInput, plan);
     const completed = [...prior];
     let state = 'complete';
     let currentStep = null;
@@ -69,13 +113,17 @@ export async function runInvestigationRecipe(recipe, subjectValue, options) {
             break;
         }
         const result = await options.execute(step.command, step.arguments);
+        const parsedResult = boundedResult(result.stdout);
+        if ((result.exitCode === 0 || result.exitCode === 2) && resultSchema(parsedResult) !== step.produces) {
+            throw new CliUsageError(`Investigation step ${step.id} returned an unexpected command contract.`);
+        }
         completed.push(Object.freeze({
             id: step.id,
             command: step.command,
             arguments: step.arguments,
             mode: step.mode,
             exitCode: result.exitCode,
-            result: boundedResult(result.stdout),
+            result: parsedResult,
         }));
         if (result.exitCode !== 0 && result.exitCode !== 2) {
             state = 'step_failed';