@slicedearth/whoisleuth-cli 1.47.4 → 2.0.0

package/lib/ct-search.mjs

@@ -10,8 +10,9 @@ import { parse } from 'tldts';
 import { normalizeCtQuery } from "./ct-query.mjs";
 import { safeFetch, readTextCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 import { isValidAsciiHostname } from "./hostname.mjs";
+import { normalizeCtTimestamp } from "../packages/evidence/observation.mjs";
 import { MAX_CT_RESPONSE_CERTIFICATE_GROUPS, MAX_CT_RESPONSE_DOMAINS_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH, MAX_CT_RESPONSE_RESULTS, MAX_CT_RESPONSE_TIMESTAMP_LENGTH, } from "./ct-response-bounds.mjs";
 const CRT_SH_TIMEOUT_MS = 20000;
 const MAX_RESULTS = MAX_CT_RESPONSE_RESULTS;
@@ -107,7 +108,7 @@ async function fetchCrtSh(keyword, attempt = 0, dependencies = {}) {
                 ? `crt.sh is temporarily overloaded (${res.status} after ${attempt + 1} attempts) - it's a free public service that intermittently struggles under load; try again in a moment.`
                 : `crt.sh returned ${res.status}`);
         }
-        const { text, truncated } = await readTextCapped(res, CRT_SH_MAX_BYTES);
+        const { text, truncated } = await readTextCapped(res, CRT_SH_MAX_BYTES, { fatalUtf8: true });
         if (truncated) {
             throw new Error(`crt.sh returned more than ${CRT_SH_MAX_BYTES / (1024 * 1024)}MB of results for "${keyword}" - try a narrower/more specific keyword.`);
         }
@@ -155,6 +156,16 @@ function resolveCertId(row, index) {
     }
     return `row:${index}`;
 }
+function suppliedCertificateIdentityMalformed(row) {
+    const hasId = Object.hasOwn(row, 'id') && row.id !== null && row.id !== undefined;
+    if (hasId)
+        return canonicalCertId(row.id) === null;
+    const hasIssuer = Object.hasOwn(row, 'issuer_ca_id') && row.issuer_ca_id !== null && row.issuer_ca_id !== undefined;
+    const hasSerial = Object.hasOwn(row, 'serial_number') && row.serial_number !== null && row.serial_number !== undefined;
+    return hasIssuer || hasSerial
+        ? canonicalCertId(row.issuer_ca_id) === null || normalizeSerial(row.serial_number) === null
+        : false;
+}
 /**
  * Canonicalises a crt.sh certificate ID field for use in identity comparison.
  * Accepts only safe positive integers or digit-only strings that can be
@@ -230,20 +241,9 @@ function normalizeSerial(value) {
  * @returns {string | null}
  */
 function validateEntryTimestamp(value) {
-    if (typeof value !== 'string')
-        return null;
-    if (value.length === 0 || value.length > MAX_TIMESTAMP_LENGTH)
-        return null;
-    // Reject control characters and overlong strings before any parsing.
-    if (/[\x00-\x1f\x7f]/.test(value))
-        return null;
-    const trimmed = value.trim();
-    if (trimmed.length === 0)
-        return null;
-    const parsed = new Date(trimmed);
-    if (Number.isNaN(parsed.getTime()))
-        return null;
-    return parsed.toISOString();
+    return typeof value === 'string' && value.length <= MAX_TIMESTAMP_LENGTH
+        ? normalizeCtTimestamp(value)
+        : null;
 }
 // ---------------------------------------------------------------------------
 // Pure summarizer
@@ -288,10 +288,24 @@ function summarizeCtResults(rows) {
     const certificateMap = new Map();
     let namesExamined = 0;
     let workTruncated = false;
+    let rejectedRows = 0;
     rowLoop: for (let i = 0; i < rows.length; i++) {
         const row = rows[i];
-        if (!row || typeof row !== 'object')
+        if (!row || typeof row !== 'object' || Array.isArray(row)) {
+            rejectedRows += 1;
             continue;
+        }
+        const missingNameFields = ![row.name_value, row.common_name]
+            .some((value) => typeof value === 'string'
+            && /[^\p{White_Space}\p{Default_Ignorable_Code_Point}\u0000-\u001f\u007f-\u009f]/u.test(value));
+        const malformedNameField = ['name_value', 'common_name'].some((field) => (Object.hasOwn(row, field) && typeof row[field] !== 'string'));
+        const malformedTimestamp = Object.hasOwn(row, 'entry_timestamp')
+            && row.entry_timestamp !== null
+            && row.entry_timestamp !== undefined
+            && validateEntryTimestamp(row.entry_timestamp) === null;
+        if (missingNameFields || malformedNameField || malformedTimestamp || suppliedCertificateIdentityMalformed(row)) {
+            rejectedRows += 1;
+        }
         const certId = resolveCertId(row, i);
         // Collect only direct string fields. Implicitly stringifying a nested
         // array or object would traverse attacker-controlled structure before any
@@ -442,7 +456,8 @@ function summarizeCtResults(rows) {
         certificateGroupsTruncated,
         namesExamined,
         workTruncated,
-        truncated: workTruncated || legacyTruncated || matchTruncated || perMatchTruncated,
+        rejectedRows,
+        truncated: rejectedRows > 0 || workTruncated || legacyTruncated || matchTruncated || perMatchTruncated,
     };
 }
 // ---------------------------------------------------------------------------
@@ -454,12 +469,12 @@ async function searchCertificateTransparency(keyword, dependencies = {}) {
     if (!trimmed) {
         return {
             domains: [], certCount: 0, truncated: false, matches: [], certificateGroups: [], certificateGroupsTruncated: false,
-            namesExamined: 0, workTruncated: false,
+            namesExamined: 0, workTruncated: false, rejectedRows: 0,
             observation: createObservation({
                 status: 'success', observedAt: new Date().toISOString(), source: 'certificate_transparency',
                 durationMs: Date.now() - startedAt, complete: true, truncated: false,
                 limitations: ['Certificate Transparency observations indicate public certificate logging, not current site activity or maliciousness.'],
-                diagnostics: { certificateRows: 0, namesExamined: 0, workTruncated: false, matches: 0, certificateGroups: 0 },
+                diagnostics: { certificateRows: 0, rejectedRows: 0, namesExamined: 0, workTruncated: false, matches: 0, certificateGroups: 0 },
             }),
         };
     }
@@ -477,10 +492,11 @@ async function searchCertificateTransparency(keyword, dependencies = {}) {
             truncated: summary.truncated || summary.certificateGroupsTruncated,
             limitations: [
                 'Certificate Transparency observations indicate public certificate logging, not current site activity or maliciousness.',
+                ...(summary.rejectedRows ? [`${summary.rejectedRows} certificate row${summary.rejectedRows === 1 ? '' : 's'} contained rejected content; unusable rows or malformed fields were excluded, so retained results are partial.`] : []),
                 ...(summary.workTruncated ? ['The response contained more hostname entries than the bounded local analysis could examine; retained results are partial.'] : []),
                 ...(summary.certificateGroupsTruncated ? ['The optional certificate-group projection was capped independently of the registrable-domain result set.'] : []),
             ],
-            diagnostics: { certificateRows: data.length, namesExamined: summary.namesExamined, workTruncated: summary.workTruncated, matches: summary.matches.length, certificateGroups: summary.certificateGroups.length, certificateGroupsTruncated: summary.certificateGroupsTruncated },
+            diagnostics: { certificateRows: data.length, rejectedRows: summary.rejectedRows, namesExamined: summary.namesExamined, workTruncated: summary.workTruncated, matches: summary.matches.length, certificateGroups: summary.certificateGroups.length, certificateGroupsTruncated: summary.certificateGroupsTruncated },
         }),
     };
 }

package/lib/distributed-operation-budget.mjs

@@ -8,6 +8,8 @@ import crypto from 'node:crypto';
 import { safeFetch, readTextCapped } from "./safe-fetch.mjs";
 const DEFAULT_NAMESPACE = 'whoisleuth:operation-budget:v1';
 const DEFAULT_LEASE_TTL_MS = 5 * 60 * 1000;
+const MIN_LEASE_TTL_MS = 30_000;
+const MAX_LEASE_TTL_MS = 15 * 60 * 1000;
 const REQUEST_TIMEOUT_MS = 4_000;
 const MAX_RESPONSE_BYTES = 16 * 1024;
 const PROVIDER_RETRY_AFTER_SECONDS = 5;
@@ -150,7 +152,7 @@ function normalizedNamespace(value = DEFAULT_NAMESPACE) {
 }
 function normalizedLeaseTtl(value = DEFAULT_LEASE_TTL_MS) {
     const ttl = Number(value);
-    if (!Number.isSafeInteger(ttl) || ttl < 30_000 || ttl > 15 * 60 * 1000) {
+    if (!Number.isSafeInteger(ttl) || ttl < MIN_LEASE_TTL_MS || ttl > MAX_LEASE_TTL_MS) {
         throw new Error('The distributed-budget lease TTL must be between 30 seconds and 15 minutes');
     }
     return ttl;
@@ -458,4 +460,4 @@ function createDistributedOperationBudget(config, dependencies = {}) {
         status,
     };
 }
-export { DEFAULT_NAMESPACE, DEFAULT_LEASE_TTL_MS, PROVIDER_RETRY_AFTER_SECONDS, DAY_WINDOW_MS, THIRTY_DAY_WINDOW_MS, ACQUIRE_SCRIPT, ACQUIRE_WITH_USAGE_SCRIPT, RELEASE_SCRIPT, STATUS_SCRIPT, normalizedRestUrl, normalizedToken, normalizedNamespace, normalizedLimits, normalizedUsageLimits, normalizedOperationFeature, createRestCommandClient, createDistributedOperationBudget, };
+export { DEFAULT_NAMESPACE, DEFAULT_LEASE_TTL_MS, MIN_LEASE_TTL_MS, MAX_LEASE_TTL_MS, REQUEST_TIMEOUT_MS, MAX_RESPONSE_BYTES, PROVIDER_RETRY_AFTER_SECONDS, MAX_USAGE_LIMIT, DAY_WINDOW_MS, THIRTY_DAY_WINDOW_MS, ACQUIRE_SCRIPT, ACQUIRE_WITH_USAGE_SCRIPT, RELEASE_SCRIPT, STATUS_SCRIPT, normalizedRestUrl, normalizedToken, normalizedNamespace, normalizedLimits, normalizedUsageLimits, normalizedOperationFeature, createRestCommandClient, createDistributedOperationBudget, };

package/lib/dns-delegation-health.mjs

@@ -4,7 +4,8 @@
 // availability and never treats a failed query as record absence.
 import { promises as dns } from 'node:dns';
 import * as net from 'node:net';
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
+import { isValidAsciiHostname } from "./hostname.mjs";
 import { isPrivateAddress } from "./safe-fetch.mjs";
 const DNS_DELEGATION_HEALTH_VERSION = 1;
 const MAX_AUTHORITIES = 4;
@@ -26,10 +27,8 @@ function boundedText(value, maximum) {
     return value.replace(/\s+/gu, ' ').trim() || null;
 }
 function hostname(value) {
-    const normalized = boundedText(value, 253)?.toLowerCase().replace(/\.+$/u, '') ?? '';
-    if (!normalized || !normalized.includes('.'))
-        return null;
-    return normalized.split('.').every((label) => (/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/iu.test(label))) ? normalized : null;
+    const candidate = boundedText(value, 253)?.replace(/\.+$/u, '') ?? '';
+    return isValidAsciiHostname(candidate) ? candidate.toLowerCase() : null;
 }
 function hostnames(value, maximum = MAX_NAMESERVERS) {
     const output = new Set();
@@ -529,7 +528,8 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                         ? 'Fewer than two complete authority observations were available for one or more record types'
                         : 'Observed A, AAAA, CAA, and MX answers agree across selected authorities', recordMatrix.map((row) => `${row.type}: ${row.state}`).join(' · '), 'Review propagation timing and the intended zone values before relying on a DNS change.')] : []),
     ];
-    const collectionIncomplete = parentStatus === 'error'
+    const collectionIncomplete = parentStatus !== 'success'
+        || candidates.length === 0
         || parentQuery.truncated === true
         || registry.truncated
         || authorities.some((authority) => authority.state !== 'success')
@@ -557,6 +557,9 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 'A direct answer does not prove global reachability, and a failed query is not evidence that the record is absent.',
                 'DNS health does not decide registration availability, ownership, control, intent, safety, or maliciousness.',
                 'The DNSSEC check compares bounded registry publication fields; it does not validate the full cryptographic chain.',
+                ...(!candidates.length
+                    ? ['No eligible authority was identified, so the delegation-health observation is incomplete.']
+                    : []),
             ],
             diagnostics: {
                 authorityCount: authorities.length,

package/lib/dns-intelligence.mjs

@@ -6,7 +6,7 @@ import { promises as dns } from 'node:dns';
 import * as net from 'node:net';
 import { classifyMxRecords } from "./dns-mx.mjs";
 import { collectDnsDelegationHealth, skippedDnsDelegationHealth, } from "./dns-delegation-health.mjs";
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_LOOKUP_DNS_RECORDS_PER_TYPE, MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS, } from "./lookup-network-evidence-bounds.mjs";
 import { isPrivateAddress } from "./safe-fetch.mjs";
 import { resolveServiceBindingRecords } from "./service-binding-dns.mjs";

package/lib/dnssec-chain-validation.mjs

@@ -10,6 +10,7 @@ import { randomInt } from 'node:crypto';
 import { isIP } from 'node:net';
 import { domainToASCII } from 'node:url';
 import { isPrivateAddress } from "./safe-fetch.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { MAX_DNS_MESSAGE_BYTES, defaultTcpExchange, formatIpv6, } from "./service-binding-dns.mjs";
 const DNSSEC_CHAIN_SCHEMA = 'whoisleuth.dnssec-chain-validation';
 const DNSSEC_CHAIN_VERSION = 1;
@@ -95,9 +96,7 @@ function normalizedText(value, maximum) {
 }
 function normalizedTimestamp(value) {
     const text = normalizedText(value, 64);
-    if (!text || !Number.isFinite(Date.parse(text)))
-        return null;
-    return new Date(text).toISOString();
+    return text ? normalizeExplicitIsoTimestamp(text) : null;
 }
 function normalizeTrustAnchorDs(value) {
     const source = value && typeof value === 'object' && !Array.isArray(value) ? value : null;

package/lib/dnssec-evidence-validation.mjs

@@ -1,6 +1,7 @@
 import { Buffer } from 'node:buffer';
 import { createHash } from 'node:crypto';
 import { domainToASCII } from 'node:url';
+import { normalizeLegacyIsoTimestamp } from "../packages/evidence/observation.mjs";
 const DNSSEC_EVIDENCE_SCHEMA = 'whoisleuth.dnssec-evidence-validation';
 const DNSSEC_EVIDENCE_VERSION = 1;
 const MAX_DNSSEC_RECORDS = 50;
@@ -99,20 +100,25 @@ function dsDigest(owner, dnskey, digestType) {
 }
 function normalizeRrsig(value) {
     const source = record(value);
-    if (!source || typeof source.inception !== 'string' || typeof source.expiration !== 'string')
+    if (!source)
+        return null;
+    const normalizedInception = normalizeLegacyIsoTimestamp(source.inception);
+    const normalizedExpiration = normalizeLegacyIsoTimestamp(source.expiration);
+    if (!normalizedInception || !normalizedExpiration)
         return null;
-    const inception = Date.parse(source.inception);
-    const expiration = Date.parse(source.expiration);
-    if (!Number.isFinite(inception) || !Number.isFinite(expiration) || inception > expiration)
+    const inception = Date.parse(normalizedInception);
+    const expiration = Date.parse(normalizedExpiration);
+    if (inception > expiration)
         return null;
     return Object.freeze({ inception, expiration });
 }
 function signatureTimeState(value, observedAt) {
-    if (!value.length || typeof observedAt !== 'string')
+    if (!value.length)
         return 'unavailable';
-    const observed = Date.parse(observedAt);
-    if (!Number.isFinite(observed))
+    const normalizedObservedAt = normalizeLegacyIsoTimestamp(observedAt);
+    if (!normalizedObservedAt)
         return 'unavailable';
+    const observed = Date.parse(normalizedObservedAt);
     let withinWindow = 0;
     for (const item of value) {
         if (observed >= item.inception && observed <= item.expiration)

package/lib/domain-assurance.mjs

@@ -1,9 +1,10 @@
 import { domainToASCII } from 'node:url';
 import { exactKeys } from "./bounded-contract-normalizers.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 const DOMAIN_ASSURANCE_INPUT_SCHEMA = 'whoisleuth.domain-assurance.input';
 const DOMAIN_ASSURANCE_SCHEMA = 'whoisleuth.domain-assurance';
 const DOMAIN_ASSURANCE_VERSION = 2;
-const DOMAIN_ASSURANCE_SUPPORTED_INPUT_VERSIONS = Object.freeze([1, 2]);
+const DOMAIN_ASSURANCE_SUPPORTED_INPUT_VERSIONS = Object.freeze([DOMAIN_ASSURANCE_VERSION]);
 const MAX_ASSURANCE_INPUT_BYTES = 2 * 1024 * 1024;
 const ROOT_KEYS = Object.freeze({
     'planned-change': new Set(['schema', 'version', 'kind', 'domain', 'change']),
@@ -45,9 +46,10 @@ function optionalText(value, maximum = 160) {
 }
 function timestamp(value, field) {
     const normalized = text(value, field, 64);
-    if (!Number.isFinite(Date.parse(normalized)))
-        throw new Error(`${field} must be an ISO-compatible timestamp.`);
-    return new Date(normalized).toISOString();
+    const canonical = normalizeExplicitIsoTimestamp(normalized);
+    if (canonical)
+        return canonical;
+    throw new Error(`${field} must be an ISO timestamp with an explicit timezone.`);
 }
 function optionalTimestamp(value, field) {
     if (value === null || value === undefined || value === '')
@@ -252,7 +254,7 @@ const RETIREMENT_CHECKS = Object.freeze([
     ['delegatedDnsMonitored', 'Delegated DNS remains monitored during retirement', true],
     ['reRegistrationPrevented', 'Registration continuity or defensive renewal is planned', true],
 ]);
-function buildRetirement(input, inputVersion) {
+function buildRetirement(input) {
     const checksInput = record(input.checks);
     exactKeys(checksInput, new Set(RETIREMENT_CHECKS.map(([id]) => id)), 'checks');
     const fixedChecks = RETIREMENT_CHECKS.map(([id, checkLabel, expected]) => {
@@ -266,7 +268,7 @@ function buildRetirement(input, inputVersion) {
     });
     const fixedIds = new Set(RETIREMENT_CHECKS.map(([id]) => id));
     const customIds = new Set();
-    const customChecks = inputVersion === 2 && input.customChecks !== undefined
+    const customChecks = input.customChecks !== undefined
         ? boundedArray(input.customChecks, 'customChecks', 0, 20).map((raw, index) => {
             const item = record(raw);
             exactKeys(item, CUSTOM_RETIREMENT_CHECK_KEYS, `customChecks[${index}]`);
@@ -304,18 +306,16 @@ function buildRetirement(input, inputVersion) {
 }
 function buildDomainAssurance(inputRaw, generatedAt = new Date().toISOString()) {
     const input = record(inputRaw);
-    if (input.schema !== DOMAIN_ASSURANCE_INPUT_SCHEMA
-        || !DOMAIN_ASSURANCE_SUPPORTED_INPUT_VERSIONS.includes(input.version)) {
-        throw new Error(`Domain assurance input must use ${DOMAIN_ASSURANCE_INPUT_SCHEMA} version 1 or ${DOMAIN_ASSURANCE_VERSION}.`);
+    if (input.schema !== DOMAIN_ASSURANCE_INPUT_SCHEMA || input.version !== DOMAIN_ASSURANCE_VERSION) {
+        throw new Error(`Domain assurance input must use ${DOMAIN_ASSURANCE_INPUT_SCHEMA} version ${DOMAIN_ASSURANCE_VERSION}.`);
     }
-    const inputVersion = input.version;
     const kind = enumValue(input.kind, 'kind', ['planned-change', 'recovery-dependencies', 'retirement']);
-    exactKeys(input, kind === 'retirement' && inputVersion === 2 ? RETIREMENT_ROOT_KEYS_V2 : ROOT_KEYS[kind], 'Domain assurance input');
+    exactKeys(input, kind === 'retirement' ? RETIREMENT_ROOT_KEYS_V2 : ROOT_KEYS[kind], 'Domain assurance input');
     const result = kind === 'planned-change'
         ? buildPlannedChange(input)
         : kind === 'recovery-dependencies'
             ? buildRecoveryDependencies(input)
-            : buildRetirement(input, inputVersion);
+            : buildRetirement(input);
     return {
         schema: DOMAIN_ASSURANCE_SCHEMA,
         version: DOMAIN_ASSURANCE_VERSION,

package/lib/domain-change-packet.mjs

@@ -1,7 +1,7 @@
 import { exactKeys, requireBoundedString, requireDomainName, requireIsoTimestamp, requireRecord, } from "./bounded-contract-normalizers.mjs";
 import { DOMAIN_ASSURANCE_INPUT_SCHEMA, buildDomainAssurance, } from "./domain-assurance.mjs";
 import { DOMAIN_CHANGE_INPUT_SCHEMA, reviewDomainChange, } from "./domain-change-review.mjs";
-import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../packages/evidence/artifact-integrity.mjs";
 export const DOMAIN_CHANGE_PACKET_INPUT_SCHEMA = 'whoisleuth.domain-change-packet.input';
 export const DOMAIN_CHANGE_PACKET_SCHEMA = 'whoisleuth.domain-change-packet';
 export const DOMAIN_CHANGE_PACKET_INPUT_VERSION = 1;