@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/frontend/src/lib/analysis/workspace-archive.js

@@ -1,15 +1,15 @@
 // Pure, bounded workspace archive composition. Existing typed store models remain the
 // authority for normalization and merge semantics; this module only packages
 // their portable contracts, verifies integrity, and previews conflicts.
-import { buildCaseExport, CASE_SCHEMA_VERSION, enforceStoreBudget, mergeCases, } from "./case-model.js";
-import { assertBrandProfileStoreBudget, BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, buildBrandProfileExport, mergeBrandProfiles, normalizeBrandProfileId, } from "./brand-profile-model.js";
+import { buildCaseExport, CASE_SCHEMA_VERSION, CASE_IMPORT_VERSIONS, enforceStoreBudget, mergeCases, } from "./case-model.js";
+import { assertBrandProfileStoreBudget, BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, buildBrandProfileExport, mergeBrandProfiles, normalizeBrandProfileId, } from "./brand-profile-model.js";
 import { assertCampaignStoreBudget, buildCampaignExport, CAMPAIGN_SCHEMA, CAMPAIGN_SCHEMA_VERSION, mergeCampaigns, } from "./campaign-model.js";
 import { assertWatchlistStoreBudget, buildWatchlistExport, mergeWatchlistStores, WATCHLIST_SCHEMA, WATCHLIST_SCHEMA_VERSION, } from "./watchlist-store.js";
-import { assertShortlistStoreBudget, buildShortlistExport, mergeShortlistStores, SHORTLIST_SCHEMA, SHORTLIST_SCHEMA_VERSION, } from "./shortlist-model.js";
+import { assertShortlistStoreBudget, buildShortlistExport, mergeShortlistStores, SHORTLIST_SCHEMA, SHORTLIST_SCHEMA_VERSION, SUPPORTED_SHORTLIST_SCHEMA_VERSIONS, } from "./shortlist-model.js";
 import { assertDetectionRuleStoreBudget, buildDetectionRuleExport, DETECTION_RULE_SCHEMA, DETECTION_RULE_SCHEMA_VERSION, mergeDetectionRules, } from "./detection-rule-model.js";
 import { buildRelationshipObservationExport, mergeRelationshipObservations, RELATIONSHIP_OBSERVATION_SCHEMA, RELATIONSHIP_OBSERVATION_SCHEMA_VERSION, } from "./relationship-observation-model.js";
-import { BULK_SESSION_SCHEMA, BULK_SESSION_SCHEMA_VERSION, buildBulkSessionExport, enforceBulkSessionStoreBudget, mergeBulkSessions, } from "./bulk-session-model.js";
-import { WEBSITE_SNAPSHOT_SCHEMA, WEBSITE_SNAPSHOT_SCHEMA_VERSION, buildWebsiteSnapshotExport, mergeWebsiteSnapshots, } from "./website-snapshot-model.js";
+import { BULK_SESSION_SCHEMA, BULK_SESSION_SCHEMA_VERSION, SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS, buildBulkSessionExport, enforceBulkSessionStoreBudget, mergeBulkSessions, } from "./bulk-session-model.js";
+import { WEBSITE_SNAPSHOT_SCHEMA, WEBSITE_SNAPSHOT_SCHEMA_VERSION, SUPPORTED_WEBSITE_SNAPSHOT_SCHEMA_VERSIONS, buildWebsiteSnapshotExport, mergeWebsiteSnapshots, } from "./website-snapshot-model.js";
 import { INVESTIGATION_TEMPLATE_SCHEMA, INVESTIGATION_TEMPLATE_VERSION, buildInvestigationTemplateExport, mergeInvestigationTemplates, } from "./investigation-template-model.js";
 import { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, buildBulkReviewExport, mergeBulkReviewStores, } from "./bulk-review-model.js";
 export const WORKSPACE_ARCHIVE_SCHEMA = 'whoisleuth.workspace-archive';
@@ -41,9 +41,24 @@ export function isSupportedWorkspaceArchiveVersion(value) {
 }
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
 const CHECKSUM_RE = /^sha256:[a-f0-9]{64}$/;
+const WORKSPACE_ARCHIVE_ROOT_KEYS = Object.freeze({
+    1: Object.freeze(['schema', 'version', 'generatedAt', 'manifest', 'sections', 'limitations']),
+    2: Object.freeze(['schema', 'version', 'generatedAt', 'manifest', 'sections', 'limitations']),
+    3: Object.freeze(['schema', 'version', 'generatedAt', 'manifest', 'sections', 'limitations']),
+    4: Object.freeze(['schema', 'version', 'generatedAt', 'manifest', 'sections', 'limitations']),
+    5: Object.freeze(['schema', 'version', 'generatedAt', 'manifest', 'sections', 'limitations']),
+});
+const WORKSPACE_ARCHIVE_MANIFEST_KEYS = Object.freeze(['sectionCount', 'totalRecords', 'sections']);
+const WORKSPACE_ARCHIVE_MANIFEST_ENTRY_KEYS = Object.freeze(['id', 'schema', 'version', 'recordCount', 'bytes', 'checksum']);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
+function assertExactKeys(value, expected, label) {
+    const keys = Object.keys(value);
+    if (keys.length !== expected.length || keys.some((key) => !expected.includes(key))) {
+        throw new Error(`The workspace archive ${label} contains missing or undeclared fields.`);
+    }
+}
 function byteLength(value) {
     return new TextEncoder().encode(value).byteLength;
 }
@@ -139,6 +154,7 @@ function objectCount(data, key) {
 const SECTION_DEFINITIONS = [
     {
         id: 'cases', label: 'Cases', schema: null, version: CASE_SCHEMA_VERSION,
+        supportedVersions: CASE_IMPORT_VERSIONS,
         count: (data) => arrayCount(data, 'cases'),
         merge: (local, data) => {
             const result = mergeCases(local.cases, data);
@@ -156,6 +172,7 @@ const SECTION_DEFINITIONS = [
     },
     {
         id: 'brandProfiles', label: 'Brand profiles', schema: BRAND_PROFILE_SCHEMA, version: BRAND_PROFILE_SCHEMA_VERSION,
+        supportedVersions: SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS,
         count: (data) => arrayCount(data, 'profiles'),
         merge: (local, data, now) => {
             const result = mergeBrandProfiles(local.brandProfiles, data, { nowIso: now });
@@ -172,6 +189,7 @@ const SECTION_DEFINITIONS = [
     },
     {
         id: 'shortlist', label: 'Shortlist', schema: SHORTLIST_SCHEMA, version: SHORTLIST_SCHEMA_VERSION,
+        supportedVersions: SUPPORTED_SHORTLIST_SCHEMA_VERSIONS,
         count: (data) => arrayCount(data, 'entries'),
         merge: (local, data) => {
             const result = mergeShortlistStores(local.shortlist, data);
@@ -199,6 +217,7 @@ const SECTION_DEFINITIONS = [
         label: 'Saved Bulk sessions',
         schema: BULK_SESSION_SCHEMA,
         version: BULK_SESSION_SCHEMA_VERSION,
+        supportedVersions: SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS,
         count: (data) => arrayCount(data, 'sessions'),
         merge: (local, data) => {
             const result = mergeBulkSessions(local.bulkSessions, data);
@@ -211,6 +230,7 @@ const SECTION_DEFINITIONS = [
         label: 'Website profile snapshots',
         schema: WEBSITE_SNAPSHOT_SCHEMA,
         version: WEBSITE_SNAPSHOT_SCHEMA_VERSION,
+        supportedVersions: SUPPORTED_WEBSITE_SNAPSHOT_SCHEMA_VERSIONS,
         count: (data) => arrayCount(data, 'snapshots'),
         merge: (local, data) => mergeWebsiteSnapshots(local.websiteSnapshots, data),
     },
@@ -339,11 +359,13 @@ export async function readWorkspaceArchive(raw, options = {}) {
     }
     const sourceVersion = value.version;
     const { bytes } = ensureArchiveBudget(value);
+    assertExactKeys(value, WORKSPACE_ARCHIVE_ROOT_KEYS[sourceVersion] ?? [], `version ${sourceVersion} envelope`);
     const manifest = record(value.manifest);
     const sectionValues = record(value.sections);
     if (!manifest || !sectionValues || !Array.isArray(manifest.sections)) {
         throw new Error('The workspace archive manifest is missing or malformed.');
     }
+    assertExactKeys(manifest, WORKSPACE_ARCHIVE_MANIFEST_KEYS, 'manifest');
     if (manifest.sections.length > MAX_WORKSPACE_ARCHIVE_SECTIONS) {
         throw new Error(`Workspace archives are limited to ${MAX_WORKSPACE_ARCHIVE_SECTIONS} sections.`);
     }
@@ -351,6 +373,10 @@ export async function readWorkspaceArchive(raw, options = {}) {
     const sections = [];
     let totalRecords = 0;
     for (const rawEntry of manifest.sections) {
+        const rawEntryRecord = record(rawEntry);
+        if (!rawEntryRecord)
+            throw new Error('The workspace archive manifest contains a malformed section entry.');
+        assertExactKeys(rawEntryRecord, WORKSPACE_ARCHIVE_MANIFEST_ENTRY_KEYS, 'manifest section entry');
         const entry = manifestEntry(rawEntry);
         if (!entry || seen.has(entry.id) || !Object.prototype.hasOwnProperty.call(sectionValues, entry.id)) {
             throw new Error('The workspace archive manifest contains an invalid, duplicate, or missing section.');
@@ -363,6 +389,21 @@ export async function readWorkspaceArchive(raw, options = {}) {
         if (await checksum(data, options.cryptoProvider) !== entry.checksum) {
             throw new Error(`${entry.id} failed its archive checksum check.`);
         }
+        const embedded = record(data);
+        const embeddedVersion = embedded?.version;
+        const embeddedSchema = embedded && Object.prototype.hasOwnProperty.call(embedded, 'schema')
+            ? embedded.schema
+            : null;
+        if (!embedded
+            || typeof embeddedVersion !== 'number'
+            || !Number.isSafeInteger(embeddedVersion)
+            || embeddedVersion < 1
+            || embeddedVersion > 1000
+            || (embeddedSchema !== null && typeof embeddedSchema !== 'string')
+            || embeddedVersion !== entry.version
+            || embeddedSchema !== entry.schema) {
+            throw new Error(`${entry.id} section contract does not match its archive manifest.`);
+        }
         const definition = DEFINITION_BY_ID.get(entry.id);
         let status = 'ready';
         let reason = '';
@@ -370,7 +411,7 @@ export async function readWorkspaceArchive(raw, options = {}) {
             status = 'unsupported';
             reason = 'This app does not recognise the archive section.';
         }
-        else if (entry.version !== definition.version || entry.schema !== definition.schema) {
+        else if (!(definition.supportedVersions ?? [definition.version]).includes(entry.version) || entry.schema !== definition.schema) {
             status = 'unsupported';
             reason = entry.version > definition.version
                 ? `This section uses newer schema ${entry.version}.`
@@ -403,14 +444,31 @@ export async function readWorkspaceArchive(raw, options = {}) {
 }
 function settingsPreview(data, local, mergedProfiles) {
     const value = record(data) || {};
-    const activeProfileId = normalizeBrandProfileId(value.activeProfileId) || '';
+    const rawActiveProfileId = value.activeProfileId;
+    const intentionalClear = rawActiveProfileId === '';
+    const normalizedActiveProfileId = normalizeBrandProfileId(rawActiveProfileId);
+    const validActiveProfileId = typeof rawActiveProfileId === 'string'
+        && rawActiveProfileId.length > 0
+        && normalizedActiveProfileId === rawActiveProfileId;
     const theme = normalizeTheme(value.theme);
+    const retainedActiveProfileId = normalizeBrandProfileId(local.settings?.activeProfileId) || '';
+    let activeProfileId = retainedActiveProfileId;
     let skipped = 0;
-    if (activeProfileId && !mergedProfiles.some((profile) => profile?.id === activeProfileId))
-        skipped++;
+    let reason = '';
+    if (!intentionalClear && !validActiveProfileId) {
+        skipped = 1;
+        reason = 'The imported active Brand Profile preference is missing or malformed. Existing active-profile context is preserved.';
+    }
+    else if (validActiveProfileId && !mergedProfiles.some((profile) => profile?.id === normalizedActiveProfileId)) {
+        skipped = 1;
+        reason = 'The imported active Brand Profile preference will be skipped because its identifier is not available in the selected Profile data or the current browser. Existing active-profile context is preserved.';
+    }
+    else {
+        activeProfileId = intentionalClear ? '' : normalizedActiveProfileId ?? retainedActiveProfileId;
+    }
     const updated = Number(theme !== normalizeTheme(local.settings?.theme)
-        || (Boolean(activeProfileId) && activeProfileId !== local.settings?.activeProfileId && skipped === 0));
-    return { added: 0, updated, skipped, settings: { activeProfileId: skipped ? '' : activeProfileId, theme } };
+        || (skipped === 0 && activeProfileId !== retainedActiveProfileId));
+    return { added: 0, updated, skipped, reason, settings: { activeProfileId, theme } };
 }
 /** Preview section-specific non-destructive merge outcomes without writing. */
 export async function previewWorkspaceArchive(raw, localInput, options = {}) {
@@ -418,6 +476,9 @@ export async function previewWorkspaceArchive(raw, localInput, options = {}) {
     const local = normalizedInput(localInput);
     const results = [];
     let mergedProfiles = local.brandProfiles;
+    const selectedIds = options.selectedSectionIds
+        ? new Set(options.selectedSectionIds.slice(0, MAX_WORKSPACE_ARCHIVE_SECTIONS))
+        : null;
     for (const section of archive.sections) {
         if (section.status !== 'ready') {
             results.push({ ...section, added: 0, updated: 0, skipped: section.recordCount, selected: false });
@@ -432,17 +493,21 @@ export async function previewWorkspaceArchive(raw, localInput, options = {}) {
                 : definition.merge
                     ? definition.merge(local, section.data, archive.generatedAt)
                     : { added: 0, updated: 0, skipped: section.recordCount };
-            if (definition.id === 'brandProfiles' && result.profiles)
+            const selected = selectedIds ? selectedIds.has(section.id) : true;
+            if (definition.id === 'brandProfiles' && selected && result.profiles)
                 mergedProfiles = result.profiles;
             results.push({
                 ...section,
                 status: 'ready',
-                reason: '',
+                reason: definition.id === 'settings' && selected && (result.skipped ?? 0) > 0
+                    ? result.reason ?? 'The imported workspace preference was skipped. Existing browser-local context is preserved.'
+                    : '',
                 added: result.added ?? 0,
                 updated: result.updated ?? 0,
                 skipped: result.skipped ?? 0,
                 pruned: result.pruned ?? 0,
-                selected: true,
+                brandProfileReferencesOmitted: result.brandProfileReferencesOmitted ?? 0,
+                selected,
                 normalizedSettings: result.settings || null,
             });
         }
@@ -461,6 +526,31 @@ export async function previewWorkspaceArchive(raw, localInput, options = {}) {
             });
         }
     }
+    const profileCollision = results.find((section) => section.id === 'brandProfiles'
+        && section.status === 'blocked'
+        && /reuses one exact identifier for different normalised profile names/iu.test(section.reason));
+    if (profileCollision) {
+        for (const dependentId of ['cases', 'settings']) {
+            const dependentIndex = results.findIndex((section) => section.id === dependentId && section.status === 'ready');
+            const dependentSection = results[dependentIndex];
+            if (dependentIndex < 0 || !dependentSection)
+                continue;
+            results[dependentIndex] = {
+                ...dependentSection,
+                status: 'blocked',
+                reason: dependentId === 'cases'
+                    ? 'Cases were not selected because a Brand Profile identifier collision must be resolved before their opaque references can be imported safely.'
+                    : 'Workspace settings were not selected because an active Brand Profile preference could otherwise bind to a different local profile that reuses the same identifier.',
+                added: 0,
+                updated: 0,
+                skipped: dependentSection.recordCount,
+                pruned: 0,
+                brandProfileReferencesOmitted: 0,
+                selected: false,
+                normalizedSettings: dependentId === 'settings' ? null : dependentSection.normalizedSettings ?? null,
+            };
+        }
+    }
     return {
         ...archive,
         sections: results,

package/lib/application-version.mjs

@@ -0,0 +1,3 @@
+import packageDocument from '../package.json' with { type: 'json' };
+import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
+export const WHOISLEUTH_APPLICATION_VERSION = normalizeBoundedSemanticVersion(packageDocument.version, 'Application manifest');

package/lib/availability.mjs

@@ -115,18 +115,17 @@ const PRIVACY_MARKERS = [
     /not disclosed/i,
     /withheld for privacy/i,
 ];
-// Only ever called after a lookup has already succeeded (this runs inside
-// checkDomainAvailability once RDAP or WHOIS has returned real data), so a
-// missing/empty registrant here isn't "we don't know" - it means the
-// registry gave us a response with no usable contact in it, which for
-// sourcing purposes (can I reach this owner from this data alone?) is the
-// same practical answer as an explicit privacy-proxy service: no.
+// Explicit privacy/redaction markers establish a positive privacy signal.
+// Usable public contact data establishes a negative one. A missing or blank
+// contact can instead reflect registry policy, access tier, parser coverage,
+// or ordinary omission, so it remains inconclusive rather than being promoted
+// to an affirmative privacy claim.
 function isPrivacyProtected(registrant) {
     if (!registrant)
-        return true;
+        return null;
     const blob = [registrant.name, registrant.org, registrant.email].filter(Boolean).join(' ');
     if (!blob)
-        return true; // record exists but every contact field is blank - that's redaction
+        return null;
     return PRIVACY_MARKERS.some((re) => re.test(blob));
 }
 // RDAP Lookup retains a bounded multi-value contact inventory, but Bulk and
@@ -197,7 +196,10 @@ async function checkDnsDelegation(domain, { resolver = dns.resolveNs } = {}) {
 // domain has "no site": transient DNS/TLS/network failures, a slow origin, or
 // an HTTP error can all produce the same null body. Keeping that distinction
 // avoids turning an inconclusive probe into a false inactivity claim.
-async function fetchHomepage(domain, { fetcher = safeFetchDetailed } = {}) {
+async function fetchHomepage(domain, { fetcher = safeFetchDetailed, timeoutMs = HOMEPAGE_FETCH_TIMEOUT_MS } = {}) {
+    const requestTimeoutMs = Number.isInteger(timeoutMs) && timeoutMs >= 10 && timeoutMs <= HOMEPAGE_FETCH_TIMEOUT_MS
+        ? timeoutMs
+        : HOMEPAGE_FETCH_TIMEOUT_MS;
     const headers = whoisleuthRequestHeaders();
     const failures = [];
     const probeStartedAt = Date.now();
@@ -205,7 +207,7 @@ async function fetchHomepage(domain, { fetcher = safeFetchDetailed } = {}) {
         const requestUrl = `${scheme}://${domain}`;
         const attemptStartedAt = Date.now();
         const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), HOMEPAGE_FETCH_TIMEOUT_MS);
+        const timeout = setTimeout(() => controller.abort(), requestTimeoutMs);
         try {
             const fetched = await fetcher(requestUrl, { signal: controller.signal, headers });
             const fetchedResponse = fetched instanceof Response ? fetched : fetched.response;
@@ -274,7 +276,7 @@ async function fetchHomepage(domain, { fetcher = safeFetchDetailed } = {}) {
         catch (err) {
             const error = errorRecord(err);
             const reason = error.name === 'AbortError'
-                ? 'timed out after 6 seconds'
+                ? `timed out after ${requestTimeoutMs} milliseconds`
                 : nonEmptyErrorMessage(err, 'request failed')
                     .replace(/[\u0000-\u001f\u007f]+/g, ' ')
                     .slice(0, 180);
@@ -733,4 +735,4 @@ async function checkDomainAvailability(domain, options = {}) {
         hasDmarc: dnsIntelligence.hasDmarc,
     };
 }
-export { checkDomainAvailability, checkDnsDelegation, fetchHomepage, deriveWebsiteActivity, forSaleRedirectSignal, parseRegistryDate as parseWhoisDate, };
+export { checkDomainAvailability, checkDnsDelegation, fetchHomepage, isPrivacyProtected, deriveWebsiteActivity, forSaleRedirectSignal, parseRegistryDate as parseWhoisDate, };

package/lib/bounded-file.mjs

@@ -6,6 +6,13 @@ function boundedSize(value, fallback) {
         ? Number(value)
         : fallback;
 }
+function throwIfAborted(signal) {
+    if (!signal?.aborted)
+        return;
+    throw signal.reason instanceof Error
+        ? signal.reason
+        : new DOMException('The operation was aborted.', 'AbortError');
+}
 export async function readBoundedRegularFile(filePath, options, dependencies = {}) {
     const label = options.label?.trim().slice(0, 120) || 'Input file';
     const maximumBytes = boundedSize(options.maximumBytes, 0);
@@ -19,6 +26,7 @@ export async function readBoundedRegularFile(filePath, options, dependencies = {
     if (expectedBytes !== null && (expectedBytes < minimumBytes || expectedBytes > maximumBytes)) {
         throw new TypeError(`${label} expected size is outside its byte boundary.`);
     }
+    throwIfAborted(options.signal);
     // Non-blocking open prevents a named pipe from stalling the process before
     // the descriptor can be classified. Final-component symlinks remain denied
     // unless an analyst-facing input explicitly opts in; artefacts resolved
@@ -28,7 +36,9 @@ export async function readBoundedRegularFile(filePath, options, dependencies = {
         | (options.allowSymbolicLink ? 0 : constants.O_NOFOLLOW);
     const handle = await (dependencies.openFile ?? open)(filePath, flags);
     try {
+        throwIfAborted(options.signal);
         const before = await handle.stat();
+        throwIfAborted(options.signal);
         if (!before.isFile())
             throw new TypeError(`${label} must be a regular file.`);
         if (before.size < minimumBytes)
@@ -44,12 +54,15 @@ export async function readBoundedRegularFile(filePath, options, dependencies = {
         const storage = Buffer.allocUnsafe(Math.min(maximumBytes + 1, before.size + 1));
         let offset = 0;
         while (offset < storage.length) {
+            throwIfAborted(options.signal);
             const { bytesRead } = await handle.read(storage, offset, storage.length - offset, null);
             if (bytesRead === 0)
                 break;
             offset += bytesRead;
         }
+        throwIfAborted(options.signal);
         const after = await handle.stat();
+        throwIfAborted(options.signal);
         if (offset > maximumBytes
             || after.size !== before.size
             || offset !== after.size

package/lib/bounded-json-response.mjs

@@ -42,7 +42,7 @@ function boundedPositiveInteger(value, fallback, maximum) {
         ? Math.max(1, Math.min(maximum, Math.round(value)))
         : fallback;
 }
-export async function readJsonResponseCapped(response, maximumBytes = STANDARD_JSON_RESPONSE_BYTES, signal) {
+export async function readJsonResponseCapped(response, maximumBytes = STANDARD_JSON_RESPONSE_BYTES, signal, validateRawJson) {
     const maxBytes = boundedPositiveInteger(maximumBytes, STANDARD_JSON_RESPONSE_BYTES, LARGE_JSON_RESPONSE_BYTES);
     const declared = response.headers.get('content-length');
     if (declared && /^\d+$/u.test(declared)) {
@@ -85,11 +85,24 @@ export async function readJsonResponseCapped(response, maximumBytes = STANDARD_J
         bytes.set(chunk, offset);
         offset += chunk.byteLength;
     }
+    let raw;
     try {
-        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        raw = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
     }
     catch {
-        throw new BoundedJsonResponseError('invalid_json', 'Response body was not valid UTF-8 JSON.');
+        throw new BoundedJsonResponseError('invalid_json', 'Response body was not valid UTF-8.');
+    }
+    try {
+        validateRawJson?.(raw);
+    }
+    catch {
+        throw new BoundedJsonResponseError('invalid_json', 'Response body did not satisfy the bounded JSON structure contract.');
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new BoundedJsonResponseError('invalid_json', 'Response body was not valid JSON.');
     }
 }
 export async function requestJsonCapped(input, init = {}, options = {}) {
@@ -122,7 +135,7 @@ export async function requestJsonCapped(input, init = {}, options = {}) {
         }
         let body;
         try {
-            body = await readJsonResponseCapped(response, options.maximumBytes, controller.signal);
+            body = await readJsonResponseCapped(response, options.maximumBytes, controller.signal, options.validateRawJson);
         }
         catch (cause) {
             // Reverse proxies and hosting adapters can replace an upstream JSON

package/lib/bounded-json.mjs

@@ -0,0 +1,249 @@
+export const MAX_BOUNDED_JSON_DEPTH = 48;
+export const MAX_BOUNDED_JSON_KEYS = 50_000;
+export const MAX_BOUNDED_JSON_VALUES = 100_000;
+export const MAX_BOUNDED_JSON_CONTAINER_ITEMS = 10_000;
+export const UNSAFE_JSON_OBJECT_KEYS = Object.freeze(['__proto__']);
+function syntaxError() {
+    throw new TypeError('Artefact input is not valid JSON.');
+}
+export function isSafeJsonObjectKey(value) {
+    return !UNSAFE_JSON_OBJECT_KEYS.includes(value);
+}
+export function assertBoundedJsonStructure(value, label = 'JSON value', limits = {}) {
+    const maximumDepth = limits.maximumDepth ?? MAX_BOUNDED_JSON_DEPTH;
+    const maximumKeys = limits.maximumKeys ?? MAX_BOUNDED_JSON_KEYS;
+    const maximumValues = limits.maximumValues ?? MAX_BOUNDED_JSON_VALUES;
+    const maximumContainerItems = limits.maximumContainerItems ?? MAX_BOUNDED_JSON_CONTAINER_ITEMS;
+    let keys = 0;
+    let values = 0;
+    const ancestors = new Set();
+    const visit = (current, depth) => {
+        values += 1;
+        if (values > maximumValues) {
+            throw new TypeError(`${label} exceeds the ${maximumValues}-value limit.`);
+        }
+        if (depth > maximumDepth) {
+            throw new TypeError(`${label} exceeds the ${maximumDepth}-level nesting limit.`);
+        }
+        if (current === null || typeof current === 'string' || typeof current === 'boolean')
+            return;
+        if (typeof current === 'number') {
+            if (!Number.isFinite(current))
+                throw new TypeError(`${label} contains a non-JSON number.`);
+            return;
+        }
+        if (typeof current !== 'object')
+            throw new TypeError(`${label} contains a non-JSON value.`);
+        if (ancestors.has(current))
+            throw new TypeError(`${label} contains a cyclic object reference.`);
+        ancestors.add(current);
+        if (Array.isArray(current)) {
+            if (current.length > maximumContainerItems) {
+                throw new TypeError(`${label} contains a container with more than ${maximumContainerItems} items.`);
+            }
+            for (const item of current)
+                visit(item, depth + 1);
+        }
+        else {
+            const entries = Object.entries(current);
+            if (entries.length > maximumContainerItems) {
+                throw new TypeError(`${label} contains a container with more than ${maximumContainerItems} items.`);
+            }
+            keys += entries.length;
+            if (keys > maximumKeys) {
+                throw new TypeError(`${label} exceeds the ${maximumKeys}-key limit.`);
+            }
+            for (const [key, item] of entries) {
+                if (!isSafeJsonObjectKey(key))
+                    throw new TypeError(`${label} contains an unsafe object key.`);
+                visit(item, depth + 1);
+            }
+        }
+        ancestors.delete(current);
+    };
+    visit(value, 0);
+}
+export function scanBoundedJson(raw, limits = {}) {
+    const maximumDepth = limits.maximumDepth ?? MAX_BOUNDED_JSON_DEPTH;
+    const maximumKeys = limits.maximumKeys ?? MAX_BOUNDED_JSON_KEYS;
+    const maximumValues = limits.maximumValues ?? MAX_BOUNDED_JSON_VALUES;
+    const maximumContainerItems = limits.maximumContainerItems ?? MAX_BOUNDED_JSON_CONTAINER_ITEMS;
+    let index = 0;
+    let keys = 0;
+    let values = 0;
+    const whitespace = () => {
+        while (index < raw.length && /[\t\n\r ]/u.test(raw[index]))
+            index += 1;
+    };
+    const stringToken = () => {
+        const start = index;
+        index += 1;
+        while (index < raw.length) {
+            const character = raw[index];
+            if (character === '"') {
+                index += 1;
+                try {
+                    return JSON.parse(raw.slice(start, index));
+                }
+                catch {
+                    syntaxError();
+                }
+            }
+            if (character === '\\') {
+                index += 1;
+                if (index >= raw.length)
+                    syntaxError();
+                if (raw[index] === 'u') {
+                    if (!/^[a-fA-F0-9]{4}$/u.test(raw.slice(index + 1, index + 5)))
+                        syntaxError();
+                    index += 5;
+                }
+                else {
+                    if (!/["\\/bfnrt]/u.test(raw[index]))
+                        syntaxError();
+                    index += 1;
+                }
+                continue;
+            }
+            if (character.charCodeAt(0) <= 0x1f)
+                syntaxError();
+            index += 1;
+        }
+        return syntaxError();
+    };
+    const literal = (token) => {
+        if (raw.slice(index, index + token.length) !== token)
+            syntaxError();
+        index += token.length;
+    };
+    const number = () => {
+        const match = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/u.exec(raw.slice(index));
+        if (!match)
+            syntaxError();
+        if (!Number.isFinite(Number(match[0]))) {
+            throw new TypeError('Artefact JSON contains a non-finite number.');
+        }
+        index += match[0].length;
+    };
+    const value = (depth) => {
+        values += 1;
+        if (values > maximumValues) {
+            throw new TypeError(`Artefact JSON exceeds the ${maximumValues}-value limit.`);
+        }
+        if (depth > maximumDepth) {
+            throw new TypeError(`Artefact JSON exceeds the ${maximumDepth}-level nesting limit.`);
+        }
+        whitespace();
+        const character = raw[index];
+        if (character === '"') {
+            stringToken();
+            return;
+        }
+        if (character === '{') {
+            index += 1;
+            whitespace();
+            const seen = new Set();
+            if (raw[index] === '}') {
+                index += 1;
+                return;
+            }
+            while (index < raw.length) {
+                if (raw[index] !== '"')
+                    syntaxError();
+                const key = stringToken();
+                if (seen.size >= maximumContainerItems) {
+                    throw new TypeError(`Artefact JSON contains a container with more than ${maximumContainerItems} items.`);
+                }
+                keys += 1;
+                if (keys > maximumKeys) {
+                    throw new TypeError(`Artefact JSON exceeds the ${maximumKeys}-key limit.`);
+                }
+                if (seen.has(key))
+                    throw new TypeError('Artefact JSON contains a duplicate object key.');
+                if (!isSafeJsonObjectKey(key))
+                    throw new TypeError('Artefact JSON contains an unsafe object key.');
+                seen.add(key);
+                whitespace();
+                if (raw[index] !== ':')
+                    syntaxError();
+                index += 1;
+                value(depth + 1);
+                whitespace();
+                if (raw[index] === '}') {
+                    index += 1;
+                    return;
+                }
+                if (raw[index] !== ',')
+                    syntaxError();
+                index += 1;
+                whitespace();
+            }
+            syntaxError();
+        }
+        if (character === '[') {
+            index += 1;
+            whitespace();
+            if (raw[index] === ']') {
+                index += 1;
+                return;
+            }
+            let items = 0;
+            while (index < raw.length) {
+                items += 1;
+                if (items > maximumContainerItems) {
+                    throw new TypeError(`Artefact JSON contains a container with more than ${maximumContainerItems} items.`);
+                }
+                value(depth + 1);
+                whitespace();
+                if (raw[index] === ']') {
+                    index += 1;
+                    return;
+                }
+                if (raw[index] !== ',')
+                    syntaxError();
+                index += 1;
+                whitespace();
+            }
+            syntaxError();
+        }
+        if (character === 't') {
+            literal('true');
+            return;
+        }
+        if (character === 'f') {
+            literal('false');
+            return;
+        }
+        if (character === 'n') {
+            literal('null');
+            return;
+        }
+        number();
+    };
+    whitespace();
+    value(0);
+    whitespace();
+    if (index !== raw.length)
+        syntaxError();
+}
+export function parseBoundedJsonObject(raw, options) {
+    const label = options.label ?? 'Artefact input';
+    if (typeof raw !== 'string')
+        throw new TypeError(`${label} must be UTF-8 JSON text.`);
+    const bytes = new TextEncoder().encode(raw).byteLength;
+    if (bytes < 1 || bytes > options.maximumBytes) {
+        throw new TypeError(`${label} must be between 1 byte and ${options.maximumBytes} bytes.`);
+    }
+    scanBoundedJson(raw);
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        syntaxError();
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new TypeError(`${label} must contain one JSON object.`);
+    }
+    return parsed;
+}

package/lib/certificate-extension-profile.mjs

@@ -3,7 +3,8 @@
 // retained; malformed extensions fail soft and leave an explicit partial flag.
 import 'reflect-metadata';
 import { CertificatePolicyExtension, CRLDistributionPointsExtension, X509Certificate, } from '@peculiar/x509';
-export const MAX_CERTIFICATE_POLICIES = 16;
+import { MAX_LOOKUP_TLS_CERTIFICATE_POLICIES } from "./lookup-network-evidence-bounds.mjs";
+export const MAX_CERTIFICATE_POLICIES = MAX_LOOKUP_TLS_CERTIFICATE_POLICIES;
 export const MAX_CRL_DISTRIBUTION_POINTS = 32;
 function emptyProfile(partial = false) {
     return Object.freeze({