@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/cli/domain-control-monitor.mjs

@@ -1,49 +1,222 @@
 import { classifyQuery } from "../lib/classify.mjs";
-import { buildDomainControlFlightRecorder, } from "../lib/domain-control-flight-recorder.mjs";
-import { verifyDomainControlManifest } from "../lib/domain-control-manifest.mjs";
+import { scanBoundedJson } from "../lib/bounded-json.mjs";
+import { buildDomainControlFlightRecorder, validateDomainControlFlightRecorderDocument, } from "../lib/domain-control-flight-recorder.mjs";
+import { DOMAIN_CONTROL_FLIGHT_RECORDER_SCHEMA, DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA, DOMAIN_CONTROL_FLIGHT_RECORDER_VERSION, } from "../packages/contracts/domain-control-flight-recorder.mjs";
+import { DOMAIN_CONTROL_REVIEW_SCHEMA, DOMAIN_CONTROL_REVIEW_VERSION, CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_VERSION, } from "../packages/contracts/domain-control-review.mjs";
+import { CLI_DOMAIN_CONTROL_MONITOR_SCHEMA, CLI_DOMAIN_CONTROL_MONITOR_VERSION, DOMAIN_CONTROL_MONITOR_COLLECTION_KEYS, DOMAIN_CONTROL_MONITOR_FAILURE_CATEGORIES, DOMAIN_CONTROL_MONITOR_FAILURE_KEYS, DOMAIN_CONTROL_MONITOR_LIMITATIONS, DOMAIN_CONTROL_MONITOR_MANIFEST_KEYS, DOMAIN_CONTROL_MONITOR_ROOT_KEYS, MAX_DOMAIN_CONTROL_MONITOR_CONCURRENCY, MAX_DOMAIN_CONTROL_MONITOR_DOMAINS as CONTRACT_MAX_DOMAIN_CONTROL_MONITOR_DOMAINS, MAX_DOMAIN_CONTROL_MONITOR_ERROR_LENGTH, MAX_DOMAIN_CONTROL_MONITOR_FAILURES, MAX_DOMAIN_CONTROL_MONITOR_INPUT_BYTES, MAX_DOMAIN_CONTROL_MONITOR_JSON_CONTAINER_ITEMS, MAX_DOMAIN_CONTROL_MONITOR_JSON_DEPTH, MAX_DOMAIN_CONTROL_MONITOR_JSON_KEYS, MAX_DOMAIN_CONTROL_MONITOR_JSON_VALUES, MIN_DOMAIN_CONTROL_MONITOR_CONCURRENCY, MIN_DOMAIN_CONTROL_MONITOR_DOMAINS, } from "../packages/contracts/domain-control-monitor.mjs";
+import { validateDomainControlReviewDocument, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
+import { requireDomainName, requireIsoTimestamp } from "../lib/bounded-contract-normalizers.mjs";
 import { buildCliLookupDocument } from "./formatters/json.mjs";
 import { buildCliDomainControlReview, } from "./domain-control-observations.mjs";
-import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
-export const CLI_DOMAIN_CONTROL_MONITOR_SCHEMA = 'whoisleuth.cli.domain-control-monitor';
-export const CLI_DOMAIN_CONTROL_MONITOR_VERSION = 1;
-export const MAX_DOMAIN_CONTROL_MONITOR_DOMAINS = 20;
-function previousSnapshot(input) {
-    if (!input)
+import { CliUsageError } from "./errors.mjs";
+export { CLI_DOMAIN_CONTROL_MONITOR_SCHEMA, CLI_DOMAIN_CONTROL_MONITOR_VERSION };
+export const MAX_DOMAIN_CONTROL_MONITOR_DOMAINS = CONTRACT_MAX_DOMAIN_CONTROL_MONITOR_DOMAINS;
+function parseMonitorJson(input, label) {
+    const normalized = input.replace(/^\uFEFF/u, '');
+    if (Buffer.byteLength(input, 'utf8') > MAX_DOMAIN_CONTROL_MONITOR_INPUT_BYTES) {
+        throw new CliUsageError(`${label} exceeds the ${MAX_DOMAIN_CONTROL_MONITOR_INPUT_BYTES}-byte limit.`);
+    }
+    try {
+        scanBoundedJson(normalized, {
+            maximumDepth: MAX_DOMAIN_CONTROL_MONITOR_JSON_DEPTH,
+            maximumKeys: MAX_DOMAIN_CONTROL_MONITOR_JSON_KEYS,
+            maximumValues: MAX_DOMAIN_CONTROL_MONITOR_JSON_VALUES,
+            maximumContainerItems: MAX_DOMAIN_CONTROL_MONITOR_JSON_CONTAINER_ITEMS,
+        });
+        return JSON.parse(normalized);
+    }
+    catch (cause) {
+        const detail = cause instanceof Error ? cause.message : '';
+        if (detail === 'Artefact input is not valid JSON.') {
+            throw new CliUsageError(`${label} must be valid JSON.`);
+        }
+        if (detail.startsWith('Artefact JSON ')) {
+            throw new CliUsageError(`${label} ${detail.slice('Artefact JSON '.length)}`);
+        }
+        throw new CliUsageError(`${label} must satisfy the bounded JSON structure contract.`);
+    }
+}
+function exactMonitorRecord(value, keys, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new CliUsageError(`${label} must use its exact object fields.`);
+    }
+    const record = value;
+    const actualKeys = Object.keys(record);
+    if (actualKeys.length !== keys.length || actualKeys.some((key) => !keys.includes(key))) {
+        throw new CliUsageError(`${label} must use its exact object fields.`);
+    }
+    return record;
+}
+function monitorInteger(value, minimum, maximum, label) {
+    if (!Number.isSafeInteger(value) || Number(value) < minimum || Number(value) > maximum) {
+        throw new CliUsageError(`${label} must be an integer from ${minimum} to ${maximum}.`);
+    }
+    return Number(value);
+}
+function previousSnapshot(input, currentGeneratedAt) {
+    if (input === null)
         return { observations: [] };
-    let parsed;
+    const parsed = parseMonitorJson(input, 'Previous monitor snapshot');
+    const root = exactMonitorRecord(parsed, DOMAIN_CONTROL_MONITOR_ROOT_KEYS, 'Previous monitor snapshot');
+    if (root.schema !== CLI_DOMAIN_CONTROL_MONITOR_SCHEMA || root.version !== CLI_DOMAIN_CONTROL_MONITOR_VERSION) {
+        throw new CliUsageError(`Previous monitor snapshot must use ${CLI_DOMAIN_CONTROL_MONITOR_SCHEMA} version ${CLI_DOMAIN_CONTROL_MONITOR_VERSION}.`);
+    }
+    let previousGeneratedAt;
     try {
-        parsed = JSON.parse(input.replace(/^\uFEFF/u, ''));
+        previousGeneratedAt = requireIsoTimestamp(root.generatedAt, 'Previous monitor snapshot generatedAt');
     }
     catch {
-        throw new CliUsageError('Previous monitor snapshot must be valid JSON.');
+        throw new CliUsageError('Previous monitor snapshot generatedAt must be a valid ISO 8601 timestamp.');
     }
-    const root = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
-    if (root.schema !== CLI_DOMAIN_CONTROL_MONITOR_SCHEMA || root.version !== CLI_DOMAIN_CONTROL_MONITOR_VERSION || !Array.isArray(root.observations)) {
-        throw new CliUsageError(`Previous monitor snapshot must use ${CLI_DOMAIN_CONTROL_MONITOR_SCHEMA} version ${CLI_DOMAIN_CONTROL_MONITOR_VERSION}.`);
+    if (Date.parse(previousGeneratedAt) >= Date.parse(currentGeneratedAt)) {
+        throw new CliUsageError('Previous monitor snapshot must precede the current monitor run.');
     }
-    const validated = buildDomainControlFlightRecorder({
-        schema: 'whoisleuth.domain-control-flight-recorder.input', version: 1, observations: root.observations, approvedWindows: [],
-    });
-    void validated;
-    return { observations: root.observations };
+    const manifest = exactMonitorRecord(root.manifest, DOMAIN_CONTROL_MONITOR_MANIFEST_KEYS, 'Previous monitor snapshot manifest');
+    if (typeof manifest.digestSha256 !== 'string'
+        || !/^sha256:[a-f0-9]{64}$/u.test(manifest.digestSha256)
+        || typeof manifest.expiresAt !== 'string') {
+        throw new CliUsageError('Previous monitor snapshot manifest is invalid.');
+    }
+    try {
+        requireIsoTimestamp(manifest.expiresAt, 'Previous monitor snapshot manifest expiresAt');
+    }
+    catch {
+        throw new CliUsageError('Previous monitor snapshot manifest expiresAt must be a valid ISO 8601 timestamp.');
+    }
+    if (Date.parse(manifest.expiresAt) <= Date.parse(previousGeneratedAt)) {
+        throw new CliUsageError('Previous monitor snapshot manifest must have been unexpired when the checkpoint was generated.');
+    }
+    const collection = exactMonitorRecord(root.collection, DOMAIN_CONTROL_MONITOR_COLLECTION_KEYS, 'Previous monitor snapshot collection');
+    const requested = monitorInteger(collection.requested, MIN_DOMAIN_CONTROL_MONITOR_DOMAINS, MAX_DOMAIN_CONTROL_MONITOR_DOMAINS, 'Previous monitor snapshot requested count');
+    const succeeded = monitorInteger(collection.succeeded, MIN_DOMAIN_CONTROL_MONITOR_DOMAINS, MAX_DOMAIN_CONTROL_MONITOR_DOMAINS, 'Previous monitor snapshot succeeded count');
+    const failed = monitorInteger(collection.failed, 0, MAX_DOMAIN_CONTROL_MONITOR_FAILURES, 'Previous monitor snapshot failed count');
+    if (requested !== succeeded + failed || !Array.isArray(collection.failures) || collection.failures.length !== failed) {
+        throw new CliUsageError('Previous monitor snapshot collection counts are inconsistent.');
+    }
+    const failureDomains = new Set();
+    const failureDomainOrder = [];
+    for (const [index, failureValue] of collection.failures.entries()) {
+        const failure = exactMonitorRecord(failureValue, DOMAIN_CONTROL_MONITOR_FAILURE_KEYS, `Previous monitor snapshot failure ${index + 1}`);
+        let failureDomain;
+        try {
+            failureDomain = requireDomainName(failure.domain, `Previous monitor snapshot failure ${index + 1} domain`);
+        }
+        catch {
+            throw new CliUsageError(`Previous monitor snapshot failure ${index + 1} domain is invalid.`);
+        }
+        if (failureDomain !== failure.domain
+            || failureDomains.has(failureDomain)
+            || typeof failure.error !== 'string'
+            || !DOMAIN_CONTROL_MONITOR_FAILURE_CATEGORIES.includes(failure.error)
+            || failure.error.length > MAX_DOMAIN_CONTROL_MONITOR_ERROR_LENGTH) {
+            throw new CliUsageError(`Previous monitor snapshot failure ${index + 1} is invalid.`);
+        }
+        failureDomains.add(failureDomain);
+        failureDomainOrder.push(failureDomain);
+    }
+    if (!Array.isArray(root.observations)
+        || root.observations.length !== succeeded
+        || root.observations.length < MIN_DOMAIN_CONTROL_MONITOR_DOMAINS
+        || root.observations.length > MAX_DOMAIN_CONTROL_MONITOR_DOMAINS) {
+        throw new CliUsageError('Previous monitor snapshot observations are inconsistent with its collection summary.');
+    }
+    let review;
+    let flightRecorder;
+    try {
+        review = validateDomainControlReviewDocument(root.review);
+    }
+    catch {
+        throw new CliUsageError(`Previous monitor snapshot review must use the exact ${DOMAIN_CONTROL_REVIEW_SCHEMA} version ${DOMAIN_CONTROL_REVIEW_VERSION} contract.`);
+    }
+    try {
+        flightRecorder = validateDomainControlFlightRecorderDocument(root.flightRecorder);
+    }
+    catch {
+        throw new CliUsageError(`Previous monitor snapshot flight recorder must use the exact ${DOMAIN_CONTROL_FLIGHT_RECORDER_SCHEMA} version ${DOMAIN_CONTROL_FLIGHT_RECORDER_VERSION} contract.`);
+    }
+    if (!Array.isArray(root.limitations)
+        || root.limitations.length !== DOMAIN_CONTROL_MONITOR_LIMITATIONS.length
+        || root.limitations.some((value, index) => value !== DOMAIN_CONTROL_MONITOR_LIMITATIONS[index])) {
+        throw new CliUsageError('Previous monitor snapshot limitations are invalid.');
+    }
+    try {
+        buildDomainControlFlightRecorder({
+            schema: DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA,
+            version: DOMAIN_CONTROL_FLIGHT_RECORDER_VERSION,
+            observations: root.observations,
+            approvedWindows: [],
+        }, previousGeneratedAt);
+    }
+    catch {
+        throw new CliUsageError('Previous monitor snapshot observations must use the exact bounded flight-recorder input contract.');
+    }
+    const observations = root.observations;
+    const observationDomainOrder = observations.map((observation) => observation.domain);
+    const observationDomains = new Set(observationDomainOrder);
+    const requestedDomains = review.domains.slice(0, requested).map((item) => item.domain);
+    const expectedObservationDomains = requestedDomains.filter((domain) => !failureDomains.has(domain));
+    const expectedFailureDomains = requestedDomains.filter((domain) => !observationDomains.has(domain));
+    if (review.domains.length < requested
+        || observationDomains.size !== observations.length
+        || observationDomainOrder.some((domain, index) => domain !== expectedObservationDomains[index])
+        || observationDomainOrder.length !== expectedObservationDomains.length
+        || failureDomainOrder.some((domain, index) => domain !== expectedFailureDomains[index])
+        || failureDomainOrder.length !== expectedFailureDomains.length
+        || observations.some((observation) => observation.observedAt !== previousGeneratedAt)
+        || review.domains.some((item) => item.comparisons.some((comparison) => comparison.observedAt !== null && comparison.observedAt !== previousGeneratedAt))
+        || review.generatedAt !== previousGeneratedAt
+        || review.manifest.digestSha256 !== manifest.digestSha256
+        || review.manifest.expiresAt !== manifest.expiresAt
+        || [...observationDomains].some((domain) => !review.domains.some((item) => item.domain === domain))
+        || flightRecorder.generatedAt !== previousGeneratedAt
+        || flightRecorder.observationCount < observations.length
+        || [...observationDomains].some((domain) => !flightRecorder.domains.includes(domain))) {
+        throw new CliUsageError('Previous monitor snapshot embedded documents are inconsistent with its observation projection.');
+    }
+    return { observations };
+}
+function monitorFailureMessage() {
+    return DOMAIN_CONTROL_MONITOR_FAILURE_CATEGORIES[0];
 }
 export async function runDomainControlMonitor(manifestInput, previousInput, options) {
-    const generatedAt = options.now();
-    let rawManifest;
+    if (!Number.isSafeInteger(options.limit)
+        || options.limit < MIN_DOMAIN_CONTROL_MONITOR_DOMAINS
+        || options.limit > MAX_DOMAIN_CONTROL_MONITOR_DOMAINS) {
+        throw new CliUsageError(`Domain-control monitor limit must be from ${MIN_DOMAIN_CONTROL_MONITOR_DOMAINS} to ${MAX_DOMAIN_CONTROL_MONITOR_DOMAINS}.`);
+    }
+    if (!Number.isSafeInteger(options.concurrency)
+        || options.concurrency < MIN_DOMAIN_CONTROL_MONITOR_CONCURRENCY
+        || options.concurrency > MAX_DOMAIN_CONTROL_MONITOR_CONCURRENCY) {
+        throw new CliUsageError(`Domain-control monitor concurrency must be from ${MIN_DOMAIN_CONTROL_MONITOR_CONCURRENCY} to ${MAX_DOMAIN_CONTROL_MONITOR_CONCURRENCY}.`);
+    }
+    let generatedAt;
+    try {
+        generatedAt = requireIsoTimestamp(options.now(), 'Domain-control monitor time');
+    }
+    catch {
+        throw new CliUsageError('Domain-control monitor time must be a valid ISO 8601 timestamp.');
+    }
+    const rawManifest = parseMonitorJson(manifestInput, 'Domain-control manifest');
+    let manifest;
     try {
-        rawManifest = JSON.parse(manifestInput.replace(/^\uFEFF/u, ''));
+        manifest = verifyDomainControlManifest(rawManifest);
     }
     catch {
-        throw new CliUsageError('Domain-control manifest must be valid JSON.');
+        throw new CliUsageError('Domain-control manifest must satisfy its supported bounded integrity contract.');
+    }
+    const checkedAt = Date.parse(generatedAt);
+    if (Date.parse(manifest.expiresAt) <= checkedAt) {
+        throw new CliUsageError('Domain-control monitor requires an unexpired manifest.');
     }
-    const manifest = verifyDomainControlManifest(rawManifest);
+    const previous = previousSnapshot(previousInput, generatedAt);
     const entries = manifest.entries.slice(0, Math.min(options.limit, MAX_DOMAIN_CONTROL_MONITOR_DOMAINS));
     const lookups = new Array(entries.length);
-    const failures = [];
+    const failuresByIndex = new Array(entries.length);
     let cursor = 0;
     let completed = 0;
     const worker = async () => {
         while (cursor < entries.length) {
+            options.signal?.throwIfAborted();
             const index = cursor++;
             const entry = entries[index];
             if (!entry)
@@ -51,10 +224,14 @@ export async function runDomainControlMonitor(manifestInput, previousInput, opti
             try {
                 const classified = classifyQuery(entry.domain);
                 const result = await options.executeLookup(classified, { fast: false, compact: false, ...(options.signal ? { signal: options.signal } : {}) });
+                options.signal?.throwIfAborted();
                 lookups[index] = buildCliLookupDocument(entry.domain, classified, result, generatedAt, 'deep');
             }
-            catch (cause) {
-                failures.push({ domain: entry.domain, error: boundedCliErrorMessage(cause, 'Lookup failed') });
+            catch {
+                if (options.signal?.aborted) {
+                    throw options.signal.reason || new DOMException('Aborted', 'AbortError');
+                }
+                failuresByIndex[index] = Object.freeze({ domain: entry.domain, error: monitorFailureMessage() });
             }
             finally {
                 completed += 1;
@@ -63,17 +240,23 @@ export async function runDomainControlMonitor(manifestInput, previousInput, opti
         }
     };
     await Promise.all(Array.from({ length: Math.min(options.concurrency, Math.max(entries.length, 1)) }, worker));
+    options.signal?.throwIfAborted();
+    const failures = failuresByIndex.filter((failure) => Boolean(failure));
     const successful = lookups.filter(Boolean);
     if (!successful.length)
         throw new Error('No domain-control monitor lookup completed successfully.');
     const review = buildCliDomainControlReview(JSON.stringify({
-        schema: 'whoisleuth.cli.domain-control-review-input', version: 1, manifest, lookups: successful,
+        schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA,
+        version: CLI_DOMAIN_CONTROL_REVIEW_VERSION,
+        manifest,
+        lookups: successful,
     }), generatedAt);
-    const previous = previousSnapshot(previousInput);
     const observations = review.observations;
     const flightRecorder = buildDomainControlFlightRecorder({
-        schema: 'whoisleuth.domain-control-flight-recorder.input', version: 1,
-        observations: [...previous.observations, ...observations], approvedWindows: [],
+        schema: DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA,
+        version: DOMAIN_CONTROL_FLIGHT_RECORDER_VERSION,
+        observations: [...previous.observations, ...observations],
+        approvedWindows: [],
     }, generatedAt);
     return Object.freeze({
         schema: CLI_DOMAIN_CONTROL_MONITOR_SCHEMA,
@@ -84,11 +267,7 @@ export async function runDomainControlMonitor(manifestInput, previousInput, opti
         observations,
         review: review.review,
         flightRecorder,
-        limitations: Object.freeze([
-            'This is one bounded run, not a daemon. Scheduling and secure checkpoint retention remain operator-controlled.',
-            'The output retains compact normalised observations and errors, not raw RDAP, WHOIS, DNS, HTTP, TLS or page payloads.',
-            'A failed source or lookup remains incomplete and does not establish that a previously observed value disappeared.',
-        ]),
+        limitations: DOMAIN_CONTROL_MONITOR_LIMITATIONS,
     });
 }
 export function formatDomainControlMonitor(document) {

package/cli/domain-control-observations.mjs

@@ -1,12 +1,12 @@
 import { Buffer } from 'node:buffer';
+import { scanBoundedJson, } from "../lib/bounded-json.mjs";
+import { CLI_DOMAIN_CONTROL_REVIEW_INPUT_KEYS, CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS, CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_VERSION, DOMAIN_CONTROL_REVIEW_VERSION, MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES, MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH, MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS, MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES, MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS, MIN_DOMAIN_CONTROL_REVIEW_LOOKUPS, } from "../packages/contracts/domain-control-review.mjs";
 import { DOMAIN_CONTROL_FLIGHT_RECORDER_FIELDS, } from "../lib/domain-control-flight-recorder.mjs";
 import { DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, reviewDomainControlManifest, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
-export const CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA = 'whoisleuth.cli.domain-control-review-input';
-export const CLI_DOMAIN_CONTROL_REVIEW_SCHEMA = 'whoisleuth.cli.domain-control-review';
-export const CLI_DOMAIN_CONTROL_REVIEW_VERSION = 1;
-export const MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES = 32 * 1024 * 1024;
+export { CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_VERSION, MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES, MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH, MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS, MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES, MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS, };
+const CLI_REVIEW_INPUT_KEY_SET = new Set(CLI_DOMAIN_CONTROL_REVIEW_INPUT_KEYS);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -134,22 +134,43 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
     if (Buffer.byteLength(inputText, 'utf8') > MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES) {
         throw new CliUsageError(`Domain-control review input is limited to ${MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES} bytes.`);
     }
+    const normalizedInput = inputText.replace(/^\uFEFF/u, '');
+    try {
+        scanBoundedJson(normalizedInput, {
+            maximumDepth: MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH,
+            maximumKeys: MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS,
+            maximumValues: MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES,
+        });
+    }
+    catch (cause) {
+        const detail = cause instanceof Error ? cause.message : '';
+        if (detail === 'Artefact input is not valid JSON.') {
+            throw new CliUsageError('Domain-control review input must be valid JSON.');
+        }
+        const boundedDetail = detail.replace(/^Artefact JSON /u, '');
+        throw new CliUsageError(boundedDetail
+            ? `Domain-control review input ${boundedDetail}`
+            : 'Domain-control review input must be valid JSON.');
+    }
     let parsed;
     try {
-        parsed = JSON.parse(inputText.replace(/^\uFEFF/u, ''));
+        parsed = JSON.parse(normalizedInput);
     }
     catch {
         throw new CliUsageError('Domain-control review input must be valid JSON.');
     }
     const input = record(parsed);
-    if (input.schema !== CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA || input.version !== 1 || !Array.isArray(input.lookups)) {
-        throw new CliUsageError(`Domain-control review input must use ${CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA} version 1.`);
+    if (input.schema !== CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA
+        || input.version !== CLI_DOMAIN_CONTROL_REVIEW_VERSION
+        || !Array.isArray(input.lookups)) {
+        throw new CliUsageError(`Domain-control review input must use ${CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA} version ${CLI_DOMAIN_CONTROL_REVIEW_VERSION}.`);
     }
-    if (Object.keys(input).some((key) => !new Set(['schema', 'version', 'manifest', 'lookups']).has(key))) {
+    if (Object.keys(input).some((key) => !CLI_REVIEW_INPUT_KEY_SET.has(key))) {
         throw new CliUsageError('Domain-control review input contains an unsupported field.');
     }
-    if (input.lookups.length < 1 || input.lookups.length > 100) {
-        throw new CliUsageError('Domain-control review requires from 1 to 100 saved Lookup documents.');
+    if (input.lookups.length < MIN_DOMAIN_CONTROL_REVIEW_LOOKUPS
+        || input.lookups.length > MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS) {
+        throw new CliUsageError(`Domain-control review requires from ${MIN_DOMAIN_CONTROL_REVIEW_LOOKUPS} to ${MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS} saved Lookup documents.`);
     }
     const manifest = verifyDomainControlManifest(input.manifest);
     const lookups = input.lookups.map((item, index) => parseSavedLookupDocument(JSON.stringify(item), { label: `Lookup ${index + 1}` }));
@@ -162,7 +183,7 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
     const observations = [...latest.values()].map(domainControlObservationFromSavedLookup);
     const review = reviewDomainControlManifest({
         schema: DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA,
-        version: 1,
+        version: DOMAIN_CONTROL_REVIEW_VERSION,
         manifest,
         observations: observations.map((item) => ({
             domain: item.domain,
@@ -202,17 +223,13 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
             latestDomainObservations: observations.length,
             ignoredHistoricalLookups: lookups.length - observations.length,
         }),
-        limitations: Object.freeze([
-            'The review uses only supplied saved Lookup documents and performs no request.',
-            'The newest supplied observation per domain is used for desired-state comparison; all supplied observations remain available to a separate flight-recorder review.',
-            'Raw RDAP, WHOIS, HTTP, TLS, and page payloads are not copied into this output.',
-        ]),
+        limitations: CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS,
     });
 }
 export function buildControlReviewInput(manifest, lookupDocuments) {
     return Object.freeze({
         schema: CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA,
-        version: 1,
+        version: CLI_DOMAIN_CONTROL_REVIEW_VERSION,
         manifest,
         lookups: Object.freeze(lookupDocuments),
     });

package/cli/errors.mjs

@@ -1,4 +1,6 @@
 const MAX_CLI_ERROR_MESSAGE_LENGTH = 300;
+const CLI_DEFAULT_IGNORABLE_RE = /\p{Default_Ignorable_Code_Point}/u;
+const CLI_DEFAULT_IGNORABLE_GLOBAL_RE = /\p{Default_Ignorable_Code_Point}/gu;
 class CliUsageError extends Error {
     constructor(message) {
         super(message);
@@ -12,16 +14,19 @@ function errorMessage(error) {
 }
 function boundedCliErrorMessage(error, fallback = 'Unexpected command failure') {
     return String(errorMessage(error) || error || fallback)
-        .replace(/[\x00-\x1f\x7f]+/g, ' ')
-        .replace(/[\u061c\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/g, '')
+        .replace(/[\x00-\x1f\x7f-\x9f]+/g, ' ')
+        .replace(CLI_DEFAULT_IGNORABLE_GLOBAL_RE, '')
         .replace(/\s+/g, ' ')
         .trim()
         .slice(0, MAX_CLI_ERROR_MESSAGE_LENGTH) || fallback;
 }
+function hasUnsafeCliText(value) {
+    return /[\x00-\x1f\x7f-\x9f]/u.test(value) || CLI_DEFAULT_IGNORABLE_RE.test(value);
+}
 function boundedCliInputError(error, label) {
     if (error instanceof CliUsageError)
         return error;
     const safeLabel = label.replace(/[^A-Za-z0-9 ()_-]+/gu, '').trim().slice(0, 80) || 'Input';
     return new CliUsageError(`${safeLabel} could not be read as a bounded regular file.`);
 }
-export { CliUsageError, MAX_CLI_ERROR_MESSAGE_LENGTH, boundedCliErrorMessage, boundedCliInputError, };
+export { CliUsageError, MAX_CLI_ERROR_MESSAGE_LENGTH, boundedCliErrorMessage, boundedCliInputError, hasUnsafeCliText, };

package/cli/evidence-command-runner.mjs

@@ -1,11 +1,10 @@
-import { createReadStream } from 'node:fs';
 import { MAX_OFFLINE_ARTIFACT_BYTES, MAX_OFFLINE_PASSPHRASE_FILE_BYTES, } from "./artifact-verify.mjs";
 import { formatArchiveInspection, inspectWorkspaceArchive, } from "./archive-inspect.mjs";
 import { MAX_SIGNING_KEY_FILE_BYTES, formatEvidenceSignatureVerification, signEvidencePackage, verifyEvidencePackageSignature, } from "./evidence-signing.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 import { formatJsonDocument } from "./formatters/json.mjs";
-import { readSavedLookupInputBounded, } from "./saved-lookup.mjs";
+import { readCliTextInput } from "./input.mjs";
 export function isEvidenceCommand(args) {
     return args.action === 'inspect-archive'
         || args.action === 'sign-artifact'
@@ -22,11 +21,10 @@ async function readArtifact(source, label, dependencies) {
     try {
         return dependencies.readArtifactInput
             ? await dependencies.readArtifactInput(source)
-            : await readSavedLookupInputBounded(source
-                ? createReadStream(source, { highWaterMark: 64 * 1024 })
-                : dependencies.stdin, {
-                limit: MAX_OFFLINE_ARTIFACT_BYTES,
+            : await readCliTextInput(source, dependencies.stdin, {
+                maximumBytes: MAX_OFFLINE_ARTIFACT_BYTES,
                 label,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
             });
     }
     catch (error) {
@@ -35,11 +33,15 @@ async function readArtifact(source, label, dependencies) {
         throw new CliUsageError(`Could not read ${label.toLowerCase()}: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
     }
 }
-async function readKey(source, label, injected) {
+async function readKey(source, label, injected, dependencies) {
     try {
         return injected
             ? await injected(source)
-            : await readSavedLookupInputBounded(createReadStream(source, { highWaterMark: MAX_SIGNING_KEY_FILE_BYTES }), { limit: MAX_SIGNING_KEY_FILE_BYTES, label });
+            : await readCliTextInput(source, dependencies.stdin, {
+                maximumBytes: MAX_SIGNING_KEY_FILE_BYTES,
+                label,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+            });
     }
     catch (error) {
         if (error instanceof CliUsageError)
@@ -50,7 +52,11 @@ async function readKey(source, label, injected) {
 async function readPassphrase(source, dependencies) {
     const passphraseText = dependencies.readPassphraseFile
         ? await dependencies.readPassphraseFile(source)
-        : await readSavedLookupInputBounded(createReadStream(source, { highWaterMark: MAX_OFFLINE_PASSPHRASE_FILE_BYTES }), { limit: MAX_OFFLINE_PASSPHRASE_FILE_BYTES, label: 'Passphrase file' });
+        : await readCliTextInput(source, dependencies.stdin, {
+            maximumBytes: MAX_OFFLINE_PASSPHRASE_FILE_BYTES,
+            label: 'Passphrase file',
+            ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+        });
     const passphrase = passphraseText.replace(/\r?\n$/u, '');
     if (!passphrase || /[\r\n\u0000]/u.test(passphrase)) {
         throw new CliUsageError('Passphrase file must contain exactly one non-empty UTF-8 line.');
@@ -85,7 +91,7 @@ export async function runEvidenceCommand(args, dependencies) {
         if (!input.trim()) {
             throw new CliUsageError('sign-artifact requires one reviewed artefact file or an artefact on stdin.');
         }
-        const privateKey = await readKey(args.privateKeySource, 'Private key file', dependencies.readPrivateKeyFile);
+        const privateKey = await readKey(args.privateKeySource, 'Private key file', dependencies.readPrivateKeyFile, dependencies);
         const signed = await signEvidencePackage(input, privateKey, dependencies.now ? dependencies.now() : new Date().toISOString());
         dependencies.stdout.write(formatJsonDocument(signed));
         return EXIT_CODES.SUCCESS;
@@ -95,7 +101,7 @@ export async function runEvidenceCommand(args, dependencies) {
         throw new CliUsageError('verify-signature requires one signed package file or a package on stdin.');
     }
     const publicKey = args.publicKeySource
-        ? await readKey(args.publicKeySource, 'Public key file', dependencies.readPublicKeyFile)
+        ? await readKey(args.publicKeySource, 'Public key file', dependencies.readPublicKeyFile, dependencies)
         : null;
     const report = await verifyEvidencePackageSignature(input, publicKey);
     if (!args.quiet) {