@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/lib/bounded-contract-normalizers.mjs

@@ -62,6 +62,10 @@ export function requireRecord(value, label) {
         throw new TypeError(`${label} must be an object.`);
     return value;
 }
+/** Stable ordering for bounded record selection, independent of host collation. */
+export function compareCodeUnits(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
 export function requireBoundedString(value, label, maxLength) {
     const normalised = strictBoundedString(value, maxLength);
     if (!normalised) {

package/lib/bounded-file.mjs

@@ -1,7 +1,9 @@
 import { constants } from 'node:fs';
 import { lstat, open, realpath } from 'node:fs/promises';
 import path from 'node:path';
-const MAX_BOUNDED_FILE_BYTES = 64 * 1024 * 1024;
+// Caller-specific payload limits remain authoritative. The emergency ceiling
+// also admits a 64-MiB evidence package plus its bounded manifest/ZIP headers.
+const MAX_BOUNDED_FILE_BYTES = 128 * 1024 * 1024;
 function boundedSize(value, fallback) {
     return Number.isSafeInteger(value) && Number(value) >= 0 && Number(value) <= MAX_BOUNDED_FILE_BYTES
         ? Number(value)

package/lib/bounded-html-document.mjs

@@ -0,0 +1,125 @@
+// Native HTML tree construction over an already-captured body. Resource limits
+// are enforced while nodes are created, including implied/reconstructed nodes;
+// a post-parse traversal limit alone would not bound hostile parser work.
+import { parse, defaultTreeAdapter as adapter } from 'parse5';
+import { MAX_HOMEPAGE_BYTES } from "./outbound-request-bounds.mjs";
+import { MAX_STATIC_HTML_TAGS, MAX_STATIC_HTML_NODES, MAX_STATIC_HTML_DEPTH, } from "../packages/contracts/page-fingerprints.mjs";
+export { MAX_STATIC_HTML_TAGS, MAX_STATIC_HTML_NODES, MAX_STATIC_HTML_DEPTH, MAX_STATIC_HTML_TREE_EVENTS, } from "../packages/contracts/page-fingerprints.mjs";
+// UTF-8 decoding cannot produce more UTF-16 code units than captured bytes.
+// Direct string callers share this ceiling; tree construction remains bounded
+// independently of the source size.
+export const MAX_STATIC_HTML_CHARS = MAX_HOMEPAGE_BYTES;
+const MAX_CONSTRUCTED_ATTRIBUTE_CHARS = MAX_STATIC_HTML_CHARS * 4;
+const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
+export function parseBoundedHtml(value) {
+    const supplied = typeof value === 'string' ? value : '';
+    const stop = new Error('Static HTML construction limit reached.');
+    let document;
+    let nodes = 0;
+    let elements = 0;
+    let depth = 0;
+    let attributeCharacters = 0;
+    let constructionLimitReached = false;
+    function reserveNode() {
+        if (nodes >= MAX_STATIC_HTML_NODES)
+            throw stop;
+        nodes += 1;
+    }
+    function reserveAttributes(attributes) {
+        for (const attribute of attributes) {
+            attributeCharacters += attribute.name.length + attribute.value.length;
+            if (attributeCharacters > MAX_CONSTRUCTED_ATTRIBUTE_CHARS)
+                throw stop;
+        }
+    }
+    const boundedAdapter = {
+        ...adapter,
+        createDocument() {
+            reserveNode();
+            document = adapter.createDocument();
+            return document;
+        },
+        createDocumentFragment() { reserveNode(); return adapter.createDocumentFragment(); },
+        createElement(name, namespace, attributes) {
+            // Allow the three mandatory document elements in addition to source tags.
+            // Reconstructed formatting elements also consume this finite allowance.
+            if (elements >= MAX_STATIC_HTML_TAGS + 3)
+                throw stop;
+            elements += 1;
+            reserveAttributes(attributes);
+            reserveNode();
+            return adapter.createElement(name, namespace, attributes);
+        },
+        createCommentNode(text) { reserveNode(); return adapter.createCommentNode(text); },
+        insertText(parent, text) {
+            const previous = parent.childNodes.at(-1);
+            if (!previous || !adapter.isTextNode(previous))
+                reserveNode();
+            adapter.insertText(parent, text);
+        },
+        insertTextBefore(parent, text, reference) {
+            const previous = parent.childNodes[parent.childNodes.indexOf(reference) - 1];
+            if (!previous || !adapter.isTextNode(previous))
+                reserveNode();
+            adapter.insertTextBefore(parent, text, reference);
+        },
+        setDocumentType(parent, name, publicId, systemId) {
+            if (!parent.childNodes.some((node) => node.nodeName === '#documentType'))
+                reserveNode();
+            adapter.setDocumentType(parent, name, publicId, systemId);
+        },
+        adoptAttributes(element, attributes) {
+            reserveAttributes(attributes);
+            adapter.adoptAttributes(element, attributes);
+        },
+        onItemPush() {
+            depth += 1;
+            if (depth > MAX_STATIC_HTML_DEPTH)
+                throw stop;
+        },
+        onItemPop() { depth -= 1; },
+    };
+    try {
+        parse(supplied.slice(0, MAX_STATIC_HTML_CHARS), {
+            treeAdapter: boundedAdapter,
+            sourceCodeLocationInfo: true,
+            scriptingEnabled: true,
+        });
+    }
+    catch (error) {
+        if (error !== stop)
+            throw error;
+        constructionLimitReached = true;
+    }
+    // Parser or adapter failures are not silently re-labelled as empty evidence.
+    if (!document)
+        throw new Error('Static HTML document was not initialised.');
+    return { document, inputLimitReached: supplied.length > MAX_STATIC_HTML_CHARS, constructionLimitReached };
+}
+export function isHtmlElement(node) {
+    return adapter.isElementNode(node) && node.namespaceURI === HTML_NAMESPACE;
+}
+// Iterative native-tree order, without entering inert template fragments.
+// Foreign elements are retained for structure, not interpreted as HTML forms.
+export function* htmlTreeEvents(document) {
+    const pending = [{ node: document, exit: false }];
+    while (pending.length) {
+        const { node, exit } = pending.pop();
+        if (adapter.isElementNode(node)) {
+            yield { kind: exit ? 'end' : 'start', element: node };
+            if (exit)
+                continue;
+            pending.push({ node, exit: true });
+            if (isHtmlElement(node) && node.tagName === 'template')
+                continue;
+        }
+        else if (adapter.isTextNode(node)) {
+            yield { kind: 'text', text: node.value };
+        }
+        if ('childNodes' in node) {
+            for (let index = node.childNodes.length - 1; index >= 0; index -= 1) {
+                pending.push({ node: node.childNodes[index], exit: false });
+            }
+        }
+    }
+}

package/lib/bounded-json.mjs

@@ -1,290 +1,2 @@
-export const MAX_BOUNDED_JSON_DEPTH = 48;
-export const MAX_BOUNDED_JSON_KEYS = 50_000;
-export const MAX_BOUNDED_JSON_VALUES = 100_000;
-export const MAX_BOUNDED_JSON_CONTAINER_ITEMS = 10_000;
-export const UNSAFE_JSON_OBJECT_KEYS = Object.freeze(['__proto__']);
-function syntaxError() {
-    throw new TypeError('Artefact input is not valid JSON.');
-}
-export function isSafeJsonObjectKey(value) {
-    return !UNSAFE_JSON_OBJECT_KEYS.includes(value);
-}
-export function assertBoundedJsonStructure(value, label = 'JSON value', limits = {}) {
-    const maximumDepth = limits.maximumDepth ?? MAX_BOUNDED_JSON_DEPTH;
-    const maximumKeys = limits.maximumKeys ?? MAX_BOUNDED_JSON_KEYS;
-    const maximumValues = limits.maximumValues ?? MAX_BOUNDED_JSON_VALUES;
-    const maximumContainerItems = limits.maximumContainerItems ?? MAX_BOUNDED_JSON_CONTAINER_ITEMS;
-    let keys = 0;
-    let values = 0;
-    const ancestors = new Set();
-    const visit = (current, depth) => {
-        values += 1;
-        if (values > maximumValues) {
-            throw new TypeError(`${label} exceeds the ${maximumValues}-value limit.`);
-        }
-        if (depth > maximumDepth) {
-            throw new TypeError(`${label} exceeds the ${maximumDepth}-level nesting limit.`);
-        }
-        if (current === null || typeof current === 'string' || typeof current === 'boolean')
-            return;
-        if (typeof current === 'number') {
-            if (!Number.isFinite(current))
-                throw new TypeError(`${label} contains a non-JSON number.`);
-            return;
-        }
-        if (typeof current !== 'object')
-            throw new TypeError(`${label} contains a non-JSON value.`);
-        if (ancestors.has(current))
-            throw new TypeError(`${label} contains a cyclic object reference.`);
-        let prototype;
-        let ownKeys;
-        let descriptors;
-        try {
-            prototype = Object.getPrototypeOf(current);
-            ownKeys = Reflect.ownKeys(current);
-            descriptors = Object.getOwnPropertyDescriptors(current);
-        }
-        catch {
-            throw new TypeError(`${label} could not be inspected safely.`);
-        }
-        if (ownKeys.some((key) => typeof key !== 'string')) {
-            throw new TypeError(`${label} contains a symbol key.`);
-        }
-        if (ownKeys.some((key) => {
-            const descriptor = descriptors[String(key)];
-            return !descriptor || !Object.hasOwn(descriptor, 'value');
-        })) {
-            throw new TypeError(`${label} contains an accessor property.`);
-        }
-        ancestors.add(current);
-        if (Array.isArray(current)) {
-            if (prototype !== Array.prototype) {
-                throw new TypeError(`${label} contains an array with a custom prototype.`);
-            }
-            const length = descriptors.length?.value;
-            if (!Number.isSafeInteger(length) || length < 0 || length > maximumContainerItems) {
-                throw new TypeError(`${label} contains a container with more than ${maximumContainerItems} items.`);
-            }
-            const indexes = ownKeys.filter((key) => key !== 'length');
-            if (indexes.length !== length
-                || indexes.some((key, index) => key !== String(index) || descriptors[key]?.enumerable !== true)) {
-                throw new TypeError(`${label} contains a sparse, extended, or non-enumerable array.`);
-            }
-            for (const key of indexes)
-                visit(descriptors[key].value, depth + 1);
-        }
-        else {
-            if (prototype !== Object.prototype && prototype !== null) {
-                throw new TypeError(`${label} contains an object with a custom prototype.`);
-            }
-            const objectKeys = ownKeys;
-            if (objectKeys.length > maximumContainerItems) {
-                throw new TypeError(`${label} contains a container with more than ${maximumContainerItems} items.`);
-            }
-            if (objectKeys.some((key) => descriptors[key]?.enumerable !== true)) {
-                throw new TypeError(`${label} contains a non-enumerable object property.`);
-            }
-            keys += objectKeys.length;
-            if (keys > maximumKeys) {
-                throw new TypeError(`${label} exceeds the ${maximumKeys}-key limit.`);
-            }
-            for (const key of objectKeys) {
-                if (!isSafeJsonObjectKey(key))
-                    throw new TypeError(`${label} contains an unsafe object key.`);
-                visit(descriptors[key].value, depth + 1);
-            }
-        }
-        ancestors.delete(current);
-    };
-    visit(value, 0);
-}
-export function scanBoundedJson(raw, limits = {}, observeString) {
-    const maximumDepth = limits.maximumDepth ?? MAX_BOUNDED_JSON_DEPTH;
-    const maximumKeys = limits.maximumKeys ?? MAX_BOUNDED_JSON_KEYS;
-    const maximumValues = limits.maximumValues ?? MAX_BOUNDED_JSON_VALUES;
-    const maximumContainerItems = limits.maximumContainerItems ?? MAX_BOUNDED_JSON_CONTAINER_ITEMS;
-    let index = 0;
-    let keys = 0;
-    let values = 0;
-    const whitespace = () => {
-        while (index < raw.length && /[\t\n\r ]/u.test(raw[index]))
-            index += 1;
-    };
-    const stringToken = () => {
-        const start = index;
-        index += 1;
-        while (index < raw.length) {
-            const character = raw[index];
-            if (character === '"') {
-                index += 1;
-                try {
-                    return { value: JSON.parse(raw.slice(start, index)), offset: start };
-                }
-                catch {
-                    syntaxError();
-                }
-            }
-            if (character === '\\') {
-                index += 1;
-                if (index >= raw.length)
-                    syntaxError();
-                if (raw[index] === 'u') {
-                    if (!/^[a-fA-F0-9]{4}$/u.test(raw.slice(index + 1, index + 5)))
-                        syntaxError();
-                    index += 5;
-                }
-                else {
-                    if (!/["\\/bfnrt]/u.test(raw[index]))
-                        syntaxError();
-                    index += 1;
-                }
-                continue;
-            }
-            if (character.charCodeAt(0) <= 0x1f)
-                syntaxError();
-            index += 1;
-        }
-        return syntaxError();
-    };
-    const literal = (token) => {
-        if (raw.slice(index, index + token.length) !== token)
-            syntaxError();
-        index += token.length;
-    };
-    const number = () => {
-        const match = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/u.exec(raw.slice(index));
-        if (!match)
-            syntaxError();
-        if (!Number.isFinite(Number(match[0]))) {
-            throw new TypeError('Artefact JSON contains a non-finite number.');
-        }
-        index += match[0].length;
-    };
-    const value = (depth, propertyKey) => {
-        values += 1;
-        if (values > maximumValues) {
-            throw new TypeError(`Artefact JSON exceeds the ${maximumValues}-value limit.`);
-        }
-        if (depth > maximumDepth) {
-            throw new TypeError(`Artefact JSON exceeds the ${maximumDepth}-level nesting limit.`);
-        }
-        whitespace();
-        const character = raw[index];
-        if (character === '"') {
-            const parsedString = stringToken();
-            observeString?.({ ...parsedString, kind: 'value', ...(propertyKey === undefined ? {} : { propertyKey }) });
-            return;
-        }
-        if (character === '{') {
-            index += 1;
-            whitespace();
-            const seen = new Set();
-            if (raw[index] === '}') {
-                index += 1;
-                return;
-            }
-            while (index < raw.length) {
-                if (raw[index] !== '"')
-                    syntaxError();
-                const parsedKey = stringToken();
-                const key = parsedKey.value;
-                if (seen.size >= maximumContainerItems) {
-                    throw new TypeError(`Artefact JSON contains a container with more than ${maximumContainerItems} items.`);
-                }
-                keys += 1;
-                if (keys > maximumKeys) {
-                    throw new TypeError(`Artefact JSON exceeds the ${maximumKeys}-key limit.`);
-                }
-                if (seen.has(key))
-                    throw new TypeError('Artefact JSON contains a duplicate object key.');
-                if (!isSafeJsonObjectKey(key))
-                    throw new TypeError('Artefact JSON contains an unsafe object key.');
-                seen.add(key);
-                observeString?.({ ...parsedKey, kind: 'key' });
-                whitespace();
-                if (raw[index] !== ':')
-                    syntaxError();
-                index += 1;
-                value(depth + 1, key);
-                whitespace();
-                if (raw[index] === '}') {
-                    index += 1;
-                    return;
-                }
-                if (raw[index] !== ',')
-                    syntaxError();
-                index += 1;
-                whitespace();
-            }
-            syntaxError();
-        }
-        if (character === '[') {
-            index += 1;
-            whitespace();
-            if (raw[index] === ']') {
-                index += 1;
-                return;
-            }
-            let items = 0;
-            while (index < raw.length) {
-                items += 1;
-                if (items > maximumContainerItems) {
-                    throw new TypeError(`Artefact JSON contains a container with more than ${maximumContainerItems} items.`);
-                }
-                value(depth + 1);
-                whitespace();
-                if (raw[index] === ']') {
-                    index += 1;
-                    return;
-                }
-                if (raw[index] !== ',')
-                    syntaxError();
-                index += 1;
-                whitespace();
-            }
-            syntaxError();
-        }
-        if (character === 't') {
-            literal('true');
-            return;
-        }
-        if (character === 'f') {
-            literal('false');
-            return;
-        }
-        if (character === 'n') {
-            literal('null');
-            return;
-        }
-        number();
-    };
-    whitespace();
-    value(0);
-    whitespace();
-    if (index !== raw.length)
-        syntaxError();
-}
-export function parseBoundedJson(raw, options) {
-    const label = options.label ?? 'Artefact input';
-    if (typeof raw !== 'string')
-        throw new TypeError(`${label} must be UTF-8 JSON text.`);
-    const bytes = new TextEncoder().encode(raw).byteLength;
-    if (bytes < 1 || bytes > options.maximumBytes) {
-        throw new TypeError(`${label} must be between 1 byte and ${options.maximumBytes} bytes.`);
-    }
-    scanBoundedJson(raw, options.limits);
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        return syntaxError();
-    }
-}
-export function parseBoundedJsonObject(raw, options) {
-    const label = options.label ?? 'Artefact input';
-    const parsed = parseBoundedJson(raw, options);
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        throw new TypeError(`${label} must contain one JSON object.`);
-    }
-    return parsed;
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/bounded-json.mjs";