@slicedearth/whoisleuth-cli 1.43.0 → 1.47.4

package/frontend/src/lib/analysis/comparison-ledger-contract.js

@@ -0,0 +1,241 @@
+import { safeComparisonLedgerHref, stableComparisonLedgerId, } from "./comparison-ledger-serialization.js";
+import { projectComparisonLedgerJson } from "./comparison-ledger-json.js";
+export { stableComparisonLedgerJson } from "./comparison-ledger-json.js";
+export { safeComparisonLedgerHref, stableComparisonLedgerId } from "./comparison-ledger-serialization.js";
+export const COMPARISON_LEDGER_MODES = Object.freeze([
+    'publication',
+    'entity',
+    'temporal',
+    'expectation',
+    'membership',
+    'reconciliation',
+]);
+export const COMPARISON_LEDGER_STATES = Object.freeze([
+    'equivalent',
+    'added',
+    'removed',
+    'different',
+    'conflict',
+    'collection_changed',
+    'model_changed',
+    'incomplete',
+    'unavailable',
+    'unsupported',
+    'not_compared',
+]);
+export const MAX_COMPARISON_LEDGER_INDEX_ITEMS = 2_000;
+export const MAX_COMPARISON_LEDGER_ENTITIES_PER_REQUEST = 20;
+export const MAX_COMPARISON_LEDGER_DETAIL_ROWS = 256;
+export const MAX_COMPARISON_LEDGER_LIMITATIONS = 8;
+export const MAX_COMPARISON_LEDGER_STRING_LENGTH = 500;
+export const MAX_COMPARISON_LEDGER_ID_LENGTH = 128;
+export const MAX_COMPARISON_LEDGER_BULK_PAIRS = MAX_COMPARISON_LEDGER_INDEX_ITEMS;
+const MAX_LABEL_LENGTH = 160;
+const MAX_FIELD_LENGTH = 120;
+const MAX_SOURCE_LENGTH = 120;
+const MAX_LIMITATION_SCAN = MAX_COMPARISON_LEDGER_LIMITATIONS * 4;
+const CONTROL_RE = /[\u0000-\u001f\u007f]/gu;
+const CONTROL_TEST_RE = /[\u0000-\u001f\u007f]/u;
+export function freshComparisonLedgerCounters() {
+    return { inputRecords: 0, inputScanTruncations: 0, invalidRecords: 0, duplicateRecords: 0, limitations: 0, truncatedStrings: 0 };
+}
+export function comparisonLedgerRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+export function comparisonLedgerInputArray(value) {
+    return Array.isArray(value) ? value : [];
+}
+export function boundedComparisonLedgerText(value, maximum, counters, preserveWhitespace = false) {
+    if (typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'boolean')
+        return '';
+    const raw = String(value).replace(CONTROL_RE, ' ');
+    const normalised = preserveWhitespace ? raw.trim() : raw.replace(/\s+/gu, ' ').trim();
+    if (normalised.length > maximum)
+        counters && (counters.truncatedStrings += 1);
+    return normalised.slice(0, maximum).trim();
+}
+export function boundedComparisonLedgerId(value, counters) {
+    const text = boundedComparisonLedgerText(value, MAX_COMPARISON_LEDGER_ID_LENGTH * 2, counters);
+    const safe = text.replace(/[^A-Za-z0-9:._-]+/gu, '-').replace(/^-+|-+$/gu, '');
+    if (safe.length > MAX_COMPARISON_LEDGER_ID_LENGTH)
+        counters && (counters.truncatedStrings += 1);
+    return safe.slice(0, MAX_COMPARISON_LEDGER_ID_LENGTH);
+}
+function timestamp(value) {
+    if (typeof value !== 'string' || value.length > 64 || CONTROL_TEST_RE.test(value))
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+function normaliseCompleteness(value) {
+    return value === 'complete' || value === 'partial' || value === 'unavailable' || value === 'not_reported'
+        ? value
+        : 'not_reported';
+}
+export function boundedComparisonLedgerLimitations(value, counters) {
+    const raw = Array.isArray(value) ? value : [];
+    const unscanned = Math.max(0, raw.length - MAX_LIMITATION_SCAN);
+    const seen = new Set();
+    const all = [];
+    for (const item of raw.slice(0, MAX_LIMITATION_SCAN)) {
+        const entry = boundedComparisonLedgerText(item, MAX_COMPARISON_LEDGER_STRING_LENGTH, counters);
+        if (!entry || seen.has(entry))
+            continue;
+        seen.add(entry);
+        all.push(entry);
+    }
+    const values = all.slice(0, MAX_COMPARISON_LEDGER_LIMITATIONS);
+    const omitted = unscanned + Math.max(0, all.length - values.length);
+    counters.limitations += omitted;
+    return { values: Object.freeze(values), omitted };
+}
+function exactValue(value, counters) {
+    if (value === null || value === undefined)
+        return { value: null, truncated: false };
+    const traversal = typeof value === 'string'
+        ? { value, truncated: false }
+        : projectComparisonLedgerJson(value);
+    const before = counters.truncatedStrings;
+    if (traversal.truncated)
+        counters.truncatedStrings += 1;
+    const projected = boundedComparisonLedgerText(traversal.value, MAX_COMPARISON_LEDGER_STRING_LENGTH, counters, true);
+    return { value: projected || null, truncated: counters.truncatedStrings > before };
+}
+function sourceSide(raw, counters) {
+    const projected = exactValue(raw.value, counters);
+    return {
+        side: Object.freeze({
+            source: boundedComparisonLedgerText(raw.source, MAX_SOURCE_LENGTH, counters) || 'Not recorded',
+            sourceState: boundedComparisonLedgerText(raw.sourceState, 64, counters) || 'not_reported',
+            value: projected.value,
+            observedAt: timestamp(raw.observedAt),
+            publishedAt: timestamp(raw.publishedAt),
+            retainedAt: timestamp(raw.retainedAt),
+        }),
+        truncated: projected.truncated,
+    };
+}
+function isMode(value) {
+    return typeof value === 'string' && COMPARISON_LEDGER_MODES.includes(value);
+}
+function isState(value) {
+    return typeof value === 'string' && COMPARISON_LEDGER_STATES.includes(value);
+}
+export function normaliseComparisonLedgerRowWithCounters(raw, counters) {
+    const item = comparisonLedgerRecord(raw);
+    const earlierRaw = comparisonLedgerRecord(item?.earlier);
+    const laterRaw = comparisonLedgerRecord(item?.later);
+    const ownerId = boundedComparisonLedgerId(item?.ownerId, counters);
+    const entityId = boundedComparisonLedgerId(item?.entityId, counters);
+    const mode = item?.mode;
+    const state = item?.state;
+    const field = boundedComparisonLedgerText(item?.field, MAX_FIELD_LENGTH, counters);
+    const family = boundedComparisonLedgerText(item?.family, MAX_FIELD_LENGTH, counters);
+    if (!item || !earlierRaw || !laterRaw || !ownerId || !entityId || !isMode(mode) || !isState(state) || !field || !family) {
+        return null;
+    }
+    const earlier = sourceSide(earlierRaw, counters);
+    const later = sourceSide(laterRaw, counters);
+    const rowLimitations = boundedComparisonLedgerLimitations(item.limitations, counters);
+    const truncated = item.truncated === true || earlier.truncated || later.truncated || rowLimitations.omitted > 0;
+    const completeness = normaliseCompleteness(item.completeness);
+    const comparisonId = boundedComparisonLedgerId(item.comparisonId, counters);
+    const id = stableComparisonLedgerId('ledger-row', [
+        comparisonId, ownerId, entityId, mode, state, family, field,
+        earlier.side.source, earlier.side.sourceState, earlier.side.value,
+        earlier.side.observedAt, earlier.side.publishedAt, earlier.side.retainedAt,
+        later.side.source, later.side.sourceState, later.side.value,
+        later.side.observedAt, later.side.publishedAt, later.side.retainedAt,
+        completeness, truncated, rowLimitations.omitted, ...rowLimitations.values,
+    ]);
+    return Object.freeze({
+        id,
+        ownerId,
+        entityId,
+        mode,
+        state,
+        field,
+        family,
+        earlier: earlier.side,
+        later: later.side,
+        completeness,
+        truncated,
+        limitations: rowLimitations.values,
+        omittedLimitations: rowLimitations.omitted,
+    });
+}
+export function normaliseComparisonLedgerRow(raw) {
+    return normaliseComparisonLedgerRowWithCounters(raw, freshComparisonLedgerCounters());
+}
+export function comparisonLedgerCollector() {
+    const output = {
+        rows: [],
+        totalRows: 0,
+        add(row) {
+            output.totalRows += 1;
+            if (output.rows.length < MAX_COMPARISON_LEDGER_DETAIL_ROWS)
+                output.rows.push(row);
+        },
+    };
+    return output;
+}
+export function comparisonLedgerValuePresent(value) {
+    if (value === null || value === undefined)
+        return false;
+    if (typeof value === 'string')
+        return value.trim() !== '' && value.trim() !== '—';
+    if (Array.isArray(value))
+        return value.length > 0;
+    return true;
+}
+export function comparisonLedgerValueState(before, after, removalAllowed) {
+    if (!comparisonLedgerValuePresent(before) && comparisonLedgerValuePresent(after))
+        return 'added';
+    if (comparisonLedgerValuePresent(before) && !comparisonLedgerValuePresent(after))
+        return removalAllowed ? 'removed' : 'incomplete';
+    return 'different';
+}
+function indexSide(raw, counters) {
+    return Object.freeze({
+        source: boundedComparisonLedgerText(raw.source, MAX_SOURCE_LENGTH, counters) || 'Not recorded',
+        sourceState: boundedComparisonLedgerText(raw.sourceState, 64, counters) || 'not_reported',
+        observedAt: timestamp(raw.observedAt),
+        publishedAt: timestamp(raw.publishedAt),
+        retainedAt: timestamp(raw.retainedAt),
+    });
+}
+export function makeComparisonLedgerCandidate(raw, counters) {
+    const ownerId = boundedComparisonLedgerId(raw.ownerId, counters);
+    const entityId = boundedComparisonLedgerId(raw.entityId, counters);
+    const label = boundedComparisonLedgerText(raw.label, MAX_LABEL_LENGTH, counters);
+    if (!ownerId || !entityId || !label)
+        return null;
+    const projectedLimitations = boundedComparisonLedgerLimitations(raw.limitations, counters);
+    const id = stableComparisonLedgerId(`ledger-${raw.ownerType}`, raw.idParts);
+    const item = Object.freeze({
+        id,
+        ownerType: raw.ownerType,
+        ownerId,
+        entityId,
+        label,
+        mode: raw.mode,
+        earlier: indexSide(raw.earlier, counters),
+        later: indexSide(raw.later, counters),
+        completeness: raw.completeness,
+        truncated: raw.truncated || projectedLimitations.omitted > 0,
+        limitations: projectedLimitations.values,
+        omittedLimitations: projectedLimitations.omitted,
+        sourceOmittedRows: Math.max(0, Math.trunc(Number(raw.sourceOmittedRows) || 0)),
+        ownerHref: safeComparisonLedgerHref(raw.ownerHref),
+    });
+    return Object.freeze({ item, buildDetails: raw.buildDetails });
+}
+export function validComparisonLedgerRequestId(value) {
+    return typeof value === 'string'
+        && value.length > 0
+        && value.length <= MAX_COMPARISON_LEDGER_ID_LENGTH
+        && !CONTROL_TEST_RE.test(value)
+        && boundedComparisonLedgerId(value) === value;
+}

package/frontend/src/lib/analysis/comparison-ledger-json.js

@@ -0,0 +1,79 @@
+const MAX_COLLECTION_SCAN = 256;
+const MAX_DEPTH = 8;
+const MAX_SCALAR_LENGTH = 2_000;
+const MAX_TRAVERSAL_NODES = 1_024;
+const MAX_SERIALISED_LENGTH = 8_192;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function boundedJsonString(value, state) {
+    if (value.length > MAX_SCALAR_LENGTH)
+        state.truncated = true;
+    return JSON.stringify(value.slice(0, MAX_SCALAR_LENGTH));
+}
+function stableJson(value, depth, state) {
+    if (depth > MAX_DEPTH) {
+        state.truncated = true;
+        return '"[bounded depth]"';
+    }
+    if (state.nodes >= MAX_TRAVERSAL_NODES) {
+        state.truncated = true;
+        return '"[bounded traversal]"';
+    }
+    state.nodes += 1;
+    if (value === null)
+        return 'null';
+    if (typeof value === 'string')
+        return boundedJsonString(value, state);
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? String(value) : 'null';
+    if (typeof value === 'boolean')
+        return value ? 'true' : 'false';
+    if (Array.isArray(value)) {
+        const values = [];
+        const limit = Math.min(value.length, MAX_COLLECTION_SCAN);
+        for (let index = 0; index < limit && state.nodes < MAX_TRAVERSAL_NODES; index += 1) {
+            values.push(stableJson(value[index], depth + 1, state));
+        }
+        if (values.length < value.length)
+            state.truncated = true;
+        return `[${values.join(',')}]`;
+    }
+    const item = record(value);
+    if (!item)
+        return 'null';
+    const keys = [];
+    for (const key in item) {
+        if (!Object.hasOwn(item, key))
+            continue;
+        if (keys.length >= MAX_COLLECTION_SCAN) {
+            state.truncated = true;
+            break;
+        }
+        keys.push(key);
+    }
+    keys.sort();
+    const values = [];
+    for (const key of keys) {
+        if (state.nodes >= MAX_TRAVERSAL_NODES) {
+            state.truncated = true;
+            break;
+        }
+        values.push(`${boundedJsonString(key, state)}:${stableJson(item[key], depth + 1, state)}`);
+    }
+    if (values.length < keys.length)
+        state.truncated = true;
+    return `{${values.join(',')}}`;
+}
+export function projectComparisonLedgerJson(value) {
+    const state = { truncated: false, nodes: 0 };
+    const serialised = stableJson(value, 0, state);
+    if (serialised.length > MAX_SERIALISED_LENGTH)
+        state.truncated = true;
+    return Object.freeze({ value: serialised.slice(0, MAX_SERIALISED_LENGTH), truncated: state.truncated });
+}
+export function stableComparisonLedgerJson(value) {
+    return projectComparisonLedgerJson(value).value;
+}

package/frontend/src/lib/analysis/comparison-ledger-serialization.js

@@ -0,0 +1,51 @@
+const CONTROL_RE = /[\u0000-\u001f\u007f]/gu;
+const MAX_ID_PARTS = 32;
+const MAX_ID_PART_LENGTH = 500;
+function stableHash(value) {
+    let first = 0x811c9dc5;
+    let second = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        first ^= code;
+        first = Math.imul(first, 0x01000193);
+        second = (second + code) | 0;
+        second = (second + (second << 10)) | 0;
+        second ^= second >>> 6;
+    }
+    second = (second + (second << 3)) | 0;
+    second ^= second >>> 11;
+    second = (second + (second << 15)) | 0;
+    return `${(first >>> 0).toString(36).padStart(7, '0')}${(second >>> 0).toString(36).padStart(7, '0')}`;
+}
+export function stableComparisonLedgerId(prefix, parts) {
+    const encoded = parts.slice(0, MAX_ID_PARTS).map((part) => {
+        let value = '';
+        try {
+            value = part === null || part === undefined || ['string', 'number', 'boolean', 'bigint'].includes(typeof part)
+                ? String(part ?? '')
+                : Object.prototype.toString.call(part);
+        }
+        catch {
+            value = '[unreadable]';
+        }
+        const bounded = value.slice(0, MAX_ID_PART_LENGTH);
+        const typed = `${typeof part}:${value.length}:${bounded}`;
+        return `${typed.length}:${typed}`;
+    }).join('');
+    const material = `${parts.length}:${encoded}`;
+    return `${prefix.slice(0, 64)}-${stableHash(material)}`;
+}
+export function safeComparisonLedgerHref(value) {
+    if (typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'boolean')
+        return '';
+    const href = String(value).replace(CONTROL_RE, ' ').replace(/\s+/gu, ' ').trim().slice(0, 500).trim();
+    if (!href.startsWith('/') || href.startsWith('//') || href.includes('\\'))
+        return '';
+    try {
+        const base = new URL('https://comparison-ledger.invalid/');
+        return new URL(href, base).origin === base.origin ? href : '';
+    }
+    catch {
+        return '';
+    }
+}

package/frontend/src/lib/analysis/domain-control-manifest-core.js

@@ -0,0 +1,145 @@
+import { canonicalArtifactJsonFor, resolveArtifactCanonicalization, SORTED_JSON_V1, SORTED_JSON_V2, } from "./artifact-integrity.js";
+import { normalizeDomain } from "./case-record-core.js";
+import { canonicalDomainControlRecordList } from "./domain-control-records.js";
+export const DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA = 'whoisleuth.domain-control-manifest-input';
+export const DOMAIN_CONTROL_PASSPORT_SCHEMA = 'whoisleuth.domain-control-manifest';
+export const DOMAIN_CONTROL_PASSPORT_VERSION = 1;
+export const DOMAIN_CONTROL_MANIFEST_VERSION = 2;
+export const MAX_DOMAIN_CONTROL_PASSPORT_ENTRIES = 100;
+export const DOMAIN_CONTROL_PASSPORT_LIMITATIONS = Object.freeze([
+    'This analyst-authored manifest records intended domain-control state. It does not collect evidence or change registrar, DNS, mail, or certificate configuration.',
+    'Empty desired fields are unconfigured rather than claims that a record should be absent.',
+]);
+const INPUT_KEYS = new Set(['schema', 'version', 'expiresAt', 'entries']);
+const MANIFEST_KEYS = new Set(['schema', 'version', 'generatedAt', 'expiresAt', 'entries', 'limitations', 'integrity']);
+const ENTRY_KEYS = new Set(['domain', 'nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock', 'renewalReviewAt', 'note']);
+const INTEGRITY_KEYS = new Set(['algorithm', 'canonicalization', 'digestSha256']);
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function exactKeys(value, allowed, label) {
+    const unknown = Object.keys(value).find((key) => !allowed.has(key));
+    if (unknown)
+        throw new TypeError(`${label} contains unknown field: ${unknown}.`);
+}
+function text(value, maximum = 300) {
+    if (typeof value !== 'string' || value.length > maximum * 4 || CONTROL_RE.test(value))
+        return null;
+    return value.replace(/\s+/gu, ' ').trim().slice(0, maximum) || null;
+}
+function timestamp(value) {
+    const candidate = text(value, 64);
+    if (!candidate)
+        return null;
+    const parsed = Date.parse(candidate);
+    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+function hostnames(value) {
+    if (!Array.isArray(value))
+        return [];
+    return [...new Set(value.slice(0, 128).flatMap((item) => {
+            const normalized = normalizeDomain(item);
+            return normalized ? [normalized] : [];
+        }))].sort().slice(0, 32);
+}
+function digest(value) {
+    const candidate = text(value, 64)?.toLowerCase() ?? '';
+    return /^[a-f0-9]{64}$/u.test(candidate) ? candidate : null;
+}
+function normalizeEntry(value) {
+    const source = record(value);
+    if (!source)
+        return null;
+    exactKeys(source, ENTRY_KEYS, 'Domain control manifest entry');
+    const domain = normalizeDomain(source.domain);
+    if (!domain)
+        return null;
+    return Object.freeze({
+        domain,
+        nameservers: Object.freeze(hostnames(source.nameservers)),
+        ds: Object.freeze(canonicalDomainControlRecordList(source.ds, 'ds')),
+        mx: Object.freeze(canonicalDomainControlRecordList(source.mx, 'mx')),
+        caa: Object.freeze(canonicalDomainControlRecordList(source.caa, 'caa')),
+        tlsIssuer: text(source.tlsIssuer, 300)?.toLowerCase() ?? null,
+        tlsSpkiSha256: digest(source.tlsSpkiSha256),
+        registrarLock: source.registrarLock === 'required' || source.registrarLock === 'not_required'
+            ? source.registrarLock
+            : null,
+        renewalReviewAt: timestamp(source.renewalReviewAt),
+        note: text(source.note, 500),
+    });
+}
+export function buildUnsignedDomainControlPassport(input, generatedAtValue) {
+    const source = record(input);
+    if (!source || source.schema !== DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA || source.version !== DOMAIN_CONTROL_PASSPORT_VERSION) {
+        throw new TypeError(`Domain control manifest input must use ${DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA} version ${DOMAIN_CONTROL_PASSPORT_VERSION}.`);
+    }
+    exactKeys(source, INPUT_KEYS, 'Domain control manifest input');
+    const generatedAt = timestamp(generatedAtValue);
+    const expiresAt = timestamp(source.expiresAt);
+    if (!generatedAt || !expiresAt || Date.parse(expiresAt) <= Date.parse(generatedAt)) {
+        throw new TypeError('Domain control manifest expiry must be a valid time after generation.');
+    }
+    if (!Array.isArray(source.entries) || source.entries.length < 1 || source.entries.length > MAX_DOMAIN_CONTROL_PASSPORT_ENTRIES) {
+        throw new TypeError(`Domain control manifest input must contain between 1 and ${MAX_DOMAIN_CONTROL_PASSPORT_ENTRIES} entries.`);
+    }
+    const entries = source.entries.map(normalizeEntry);
+    if (entries.some((entry) => entry === null))
+        throw new TypeError('Domain control manifest contains an invalid entry.');
+    const normalizedEntries = entries;
+    if (new Set(normalizedEntries.map((entry) => entry.domain)).size !== normalizedEntries.length) {
+        throw new TypeError('Domain control manifest entries must use unique domains.');
+    }
+    return Object.freeze({
+        schema: DOMAIN_CONTROL_PASSPORT_SCHEMA,
+        version: DOMAIN_CONTROL_MANIFEST_VERSION,
+        generatedAt,
+        expiresAt,
+        entries: Object.freeze([...normalizedEntries].sort((left, right) => left.domain.localeCompare(right.domain))),
+        limitations: DOMAIN_CONTROL_PASSPORT_LIMITATIONS,
+    });
+}
+export function normalizeDomainControlPassportDocument(value) {
+    const source = record(value);
+    const integrity = record(source?.integrity);
+    if (!source
+        || source.schema !== DOMAIN_CONTROL_PASSPORT_SCHEMA
+        || !integrity
+        || integrity.algorithm !== 'SHA-256'
+        || typeof integrity.digestSha256 !== 'string'
+        || !/^sha256:[a-f0-9]{64}$/u.test(integrity.digestSha256)) {
+        throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
+    }
+    exactKeys(source, MANIFEST_KEYS, 'Domain control manifest');
+    exactKeys(integrity, INTEGRITY_KEYS, 'Domain control manifest integrity');
+    const canonicalization = resolveArtifactCanonicalization(source.version, integrity.canonicalization, [
+        { version: DOMAIN_CONTROL_PASSPORT_VERSION, canonicalization: SORTED_JSON_V1, explicit: true },
+        { version: DOMAIN_CONTROL_MANIFEST_VERSION, canonicalization: SORTED_JSON_V2, explicit: true },
+    ], 'Domain control manifest');
+    if (!Array.isArray(source.limitations)
+        || source.limitations.length !== DOMAIN_CONTROL_PASSPORT_LIMITATIONS.length
+        || source.limitations.some((item, index) => item !== DOMAIN_CONTROL_PASSPORT_LIMITATIONS[index])) {
+        throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
+    }
+    const baseUnsigned = buildUnsignedDomainControlPassport({
+        schema: DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA,
+        version: DOMAIN_CONTROL_PASSPORT_VERSION,
+        expiresAt: source.expiresAt,
+        entries: source.entries,
+    }, source.generatedAt);
+    const unsigned = Object.freeze({ ...baseUnsigned, version: source.version });
+    const { integrity: _integrity, ...suppliedUnsigned } = source;
+    const canonicalUnsigned = canonicalArtifactJsonFor(unsigned, canonicalization);
+    if (canonicalArtifactJsonFor(suppliedUnsigned, canonicalization) !== canonicalUnsigned) {
+        throw new TypeError('Domain control manifest must use its canonical normalised content.');
+    }
+    return {
+        manifest: source,
+        unsigned,
+        canonicalUnsigned,
+        canonicalization,
+    };
+}

package/frontend/src/lib/analysis/domain-control-records.js

@@ -0,0 +1,88 @@
+import { normalizeDomain } from "./case-record-core.js";
+export const MAX_CANONICAL_DOMAIN_CONTROL_RECORDS = 32;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function text(value, maximum = 500) {
+    if (typeof value !== 'string' || value.length > maximum * 4 || /[\u0000-\u001f\u007f]/u.test(value))
+        return '';
+    return value.replace(/\s+/gu, ' ').trim().slice(0, maximum).trim();
+}
+function integer(value, maximum) {
+    const candidate = typeof value === 'number' ? value : typeof value === 'string' && /^\d+$/u.test(value.trim()) ? Number(value) : NaN;
+    return Number.isSafeInteger(candidate) && candidate >= 0 && candidate <= maximum ? candidate : null;
+}
+function exchange(value) {
+    const candidate = text(value, 253).toLowerCase();
+    if (candidate === '.')
+        return '.';
+    return normalizeDomain(candidate) ?? '';
+}
+export function canonicalMxRecord(value) {
+    const item = record(value);
+    if (Object.keys(item).length) {
+        const host = exchange(item.exchange ?? item.host ?? item.value);
+        const priority = integer(item.priority ?? item.preference, 65_535);
+        return host && priority !== null ? `${priority} ${host}` : '';
+    }
+    const candidate = text(value, 500).toLowerCase();
+    const match = /^(\d{1,5})\s+(.+)$/u.exec(candidate);
+    if (match) {
+        const priority = integer(match[1], 65_535);
+        const host = exchange(match[2]);
+        return priority !== null && host ? `${priority} ${host}` : '';
+    }
+    return exchange(candidate);
+}
+function caaValue(value) {
+    return text(value, 500).replace(/^(?:"([\s\S]*)"|'([\s\S]*)')$/u, '$1$2').trim().toLowerCase();
+}
+export function canonicalCaaRecord(value) {
+    const item = record(value);
+    if (Object.keys(item).length) {
+        const flags = integer(item.critical ?? item.flags ?? 0, 255);
+        const tag = text(item.tag, 32).toLowerCase();
+        const payload = caaValue(item.value);
+        return flags !== null && /^(?:issue|issuewild|iodef)$/u.test(tag) && payload
+            ? `${flags} ${tag} ${payload}`
+            : '';
+    }
+    const candidate = text(value, 600);
+    const match = /^(\d{1,3})\s+(issue|issuewild|iodef)\s+(.+)$/iu.exec(candidate);
+    if (!match)
+        return '';
+    const flags = integer(match[1], 255);
+    const tag = match[2]?.toLowerCase() ?? '';
+    const payload = caaValue(match[3]);
+    return flags !== null && payload ? `${flags} ${tag} ${payload}` : '';
+}
+export function canonicalDsRecord(value) {
+    const item = record(value);
+    if (Object.keys(item).length) {
+        const keyTag = integer(item.keyTag ?? item.key_tag, 65_535);
+        const algorithm = integer(item.algorithm, 255);
+        const digestType = integer(item.digestType ?? item.digest_type, 255);
+        const digest = text(item.digest, 1024).replace(/\s+/gu, '').toLowerCase();
+        return keyTag !== null && algorithm !== null && digestType !== null && /^[a-f0-9]{2,1024}$/u.test(digest)
+            ? `${keyTag} ${algorithm} ${digestType} ${digest}`
+            : '';
+    }
+    const candidate = text(value, 1200);
+    const match = /^(\d{1,5})\s+(\d{1,3})\s+(\d{1,3})\s+([a-f0-9\s]+)$/iu.exec(candidate);
+    if (!match)
+        return '';
+    return canonicalDsRecord({ keyTag: match[1], algorithm: match[2], digestType: match[3], digest: match[4] });
+}
+export function canonicalDomainControlRecordList(value, kind) {
+    if (!Array.isArray(value))
+        return [];
+    const normalizer = kind === 'mx' ? canonicalMxRecord : kind === 'caa' ? canonicalCaaRecord : canonicalDsRecord;
+    return [...new Set(value
+            .slice(0, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS * 4)
+            .map(normalizer)
+            .filter(Boolean))]
+        .sort()
+        .slice(0, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS);
+}