@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/lib/dnssec-evidence-validation.mjs

@@ -160,7 +160,8 @@ function validateDnssecEvidence(input) {
             limitations: Object.freeze(limitations),
         });
     }
-    if (input.delegationSigned === false && dsRecords.length === 0) {
+    const incompleteInput = rejectedCount > 0 || truncated;
+    if (input.delegationSigned === false && dsRecords.length === 0 && !incompleteInput) {
         findings.push('The supplied delegation state was unsigned and no DS records were supplied.');
         return Object.freeze({
             schema: DNSSEC_EVIDENCE_SCHEMA,
@@ -191,18 +192,24 @@ function validateDnssecEvidence(input) {
         if (matched)
             matchedDsCount += 1;
     }
-    const definiteConflict = input.delegationSigned === false && dsRecords.length > 0
+    const observedConflict = input.delegationSigned === false && dsRecords.length > 0
         || input.delegationSigned === true && dsRecords.length === 0 && !truncated
         || signatureState === 'outside_window'
         || (dsRecords.length > 0 && dnskeys.length > 0 && matchedDsCount === 0 && unsupportedDigestCount < dsRecords.length);
+    const definiteConflict = observedConflict && !incompleteInput;
     if (definiteConflict)
         findings.push('The supplied delegation, signature-time, DS, or DNSKEY evidence conflicts.');
+    else if (observedConflict)
+        findings.push('The retained subset contains conflicting evidence, but omitted or rejected records prevent a definitive conflict conclusion.');
     if (matchedDsCount > 0)
         findings.push(`${matchedDsCount} supplied DS record(s) matched a supplied DNSKEY.`);
     if (unsupportedDigestCount > 0)
         findings.push(`${unsupportedDigestCount} DS digest type(s) were retained as unsupported.`);
     if (signatureState === 'mixed')
         findings.push('The supplied RRSIG validity windows were mixed at the observation time.');
+    if (input.delegationSigned === false && dsRecords.length === 0 && incompleteInput) {
+        findings.push('The retained subset contains no usable DS record, but omitted or rejected records prevent a definitive unsigned conclusion.');
+    }
     if (rejectedCount > 0)
         findings.push(`${rejectedCount} malformed record(s) were rejected.`);
     if (truncated)
@@ -210,7 +217,7 @@ function validateDnssecEvidence(input) {
     const completeLocalRelationship = dsRecords.length > 0
         && dnskeys.length > 0
         && matchedDsCount > 0
-        && !definiteConflict
+        && !observedConflict
         && rejectedCount === 0
         && !truncated
         && unsupportedDigestCount === 0

package/lib/domain-change-packet.mjs

@@ -1,10 +1,11 @@
 import { exactKeys, requireBoundedString, requireDomainName, requireIsoTimestamp, requireRecord, } from "./bounded-contract-normalizers.mjs";
 import { DOMAIN_ASSURANCE_INPUT_SCHEMA, buildDomainAssurance, } from "./domain-assurance.mjs";
 import { DOMAIN_CHANGE_INPUT_SCHEMA, reviewDomainChange, } from "./domain-change-review.mjs";
-import { sha256ArtifactDigest } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../frontend/src/lib/analysis/artifact-integrity.js";
 export const DOMAIN_CHANGE_PACKET_INPUT_SCHEMA = 'whoisleuth.domain-change-packet.input';
 export const DOMAIN_CHANGE_PACKET_SCHEMA = 'whoisleuth.domain-change-packet';
-export const DOMAIN_CHANGE_PACKET_VERSION = 1;
+export const DOMAIN_CHANGE_PACKET_INPUT_VERSION = 1;
+export const DOMAIN_CHANGE_PACKET_VERSION = 2;
 export const MAX_DOMAIN_CHANGE_PACKET_INPUT_BYTES = 6 * 1024 * 1024;
 const ROOT_KEYS = new Set([
     'schema',
@@ -57,8 +58,8 @@ function changeSummary(before, after) {
 }
 export async function buildDomainChangePacket(inputRaw, generatedAtValue = new Date().toISOString()) {
     const input = record(inputRaw, 'Domain change packet input');
-    if (input.schema !== DOMAIN_CHANGE_PACKET_INPUT_SCHEMA || input.version !== 1) {
-        throw new TypeError(`Domain change packet input must use ${DOMAIN_CHANGE_PACKET_INPUT_SCHEMA} version 1.`);
+    if (input.schema !== DOMAIN_CHANGE_PACKET_INPUT_SCHEMA || input.version !== DOMAIN_CHANGE_PACKET_INPUT_VERSION) {
+        throw new TypeError(`Domain change packet input must use ${DOMAIN_CHANGE_PACKET_INPUT_SCHEMA} version ${DOMAIN_CHANGE_PACKET_INPUT_VERSION}.`);
     }
     exactKeys(input, ROOT_KEYS, 'Domain change packet input');
     const domain = requireDomainName(input.domain, 'domain');
@@ -105,7 +106,8 @@ export async function buildDomainChangePacket(inputRaw, generatedAtValue = new D
         ...unsigned,
         integrity: Object.freeze({
             algorithm: 'SHA-256',
-            digestSha256: await sha256ArtifactDigest(unsigned),
+            canonicalization: SORTED_JSON_V2,
+            digestSha256: await sha256ArtifactDigestV2(unsigned),
         }),
     });
 }

package/lib/domain-control-manifest.mjs

@@ -1,27 +1,21 @@
 import { createHash } from 'node:crypto';
 import { domainToASCII } from 'node:url';
-import { canonicalArtifactJson } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { canonicalArtifactJsonV2, SORTED_JSON_V2, } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { buildUnsignedDomainControlPassport, DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_PASSPORT_SCHEMA, MAX_DOMAIN_CONTROL_PASSPORT_ENTRIES, normalizeDomainControlPassportDocument, } from "../frontend/src/lib/analysis/domain-control-manifest-core.js";
+import { canonicalDomainControlRecordList } from "../frontend/src/lib/analysis/domain-control-records.js";
 import { exactKeys } from "./bounded-contract-normalizers.mjs";
-export const DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA = 'whoisleuth.domain-control-manifest-input';
-export const DOMAIN_CONTROL_MANIFEST_SCHEMA = 'whoisleuth.domain-control-manifest';
-export const DOMAIN_CONTROL_MANIFEST_VERSION = 1;
+export const DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA = DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA;
+export const DOMAIN_CONTROL_MANIFEST_SCHEMA = DOMAIN_CONTROL_PASSPORT_SCHEMA;
+export { DOMAIN_CONTROL_MANIFEST_VERSION };
 export const DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA = 'whoisleuth.domain-control-review-input';
 export const DOMAIN_CONTROL_REVIEW_SCHEMA = 'whoisleuth.domain-control-review';
 export const DOMAIN_CONTROL_REVIEW_VERSION = 1;
-export const MAX_DOMAIN_CONTROL_ENTRIES = 100;
+export const MAX_DOMAIN_CONTROL_ENTRIES = MAX_DOMAIN_CONTROL_PASSPORT_ENTRIES;
 export const MAX_DOMAIN_CONTROL_RECORDS = 32;
-const MANIFEST_KEYS = new Set(['schema', 'version', 'generatedAt', 'expiresAt', 'entries', 'limitations', 'integrity']);
-const MANIFEST_ENTRY_KEYS = new Set(['domain', 'nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock', 'renewalReviewAt', 'note']);
-const MANIFEST_INTEGRITY_KEYS = new Set(['algorithm', 'canonicalization', 'digestSha256']);
-const MANIFEST_INPUT_KEYS = new Set(['schema', 'version', 'expiresAt', 'entries']);
 const REVIEW_INPUT_KEYS = new Set(['schema', 'version', 'manifest', 'observations']);
 const OBSERVATION_KEYS = new Set(['domain', 'fields']);
 const OBSERVATION_FIELDS = new Set(['nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock']);
 const OBSERVATION_FIELD_KEYS = new Set(['state', 'values', 'source', 'observedAt']);
-const DOMAIN_CONTROL_LIMITATIONS = Object.freeze([
-    'This analyst-authored manifest records intended domain-control state. It does not collect evidence or change registrar, DNS, mail, or certificate configuration.',
-    'Empty desired fields are unconfigured rather than claims that a record should be absent.',
-]);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -70,135 +64,29 @@ function spkiFingerprint(value) {
     const text = boundedText(value, 64)?.toLowerCase();
     return text && /^[a-f0-9]{64}$/u.test(text) ? text : null;
 }
-function normalizeEntry(value) {
-    const source = record(value);
-    const normalizedDomain = domain(source?.domain);
-    if (!source || !normalizedDomain)
-        return null;
-    const registrarLock = source.registrarLock === 'required' || source.registrarLock === 'not_required'
-        ? source.registrarLock
-        : null;
-    return Object.freeze({
-        domain: normalizedDomain,
-        nameservers: Object.freeze(hostnameList(source.nameservers)),
-        ds: Object.freeze(textList(source.ds, 500)),
-        mx: Object.freeze(hostnameList(source.mx)),
-        caa: Object.freeze(textList(source.caa, 500)),
-        tlsIssuer: boundedText(source.tlsIssuer, 300)?.toLowerCase() ?? null,
-        tlsSpkiSha256: spkiFingerprint(source.tlsSpkiSha256),
-        registrarLock,
-        renewalReviewAt: timestamp(source.renewalReviewAt),
-        note: boundedText(source.note, 500),
-    });
-}
-function unsignedManifest(value) {
-    return value;
-}
-function integrityDigest(value) {
-    return `sha256:${createHash('sha256').update(canonicalArtifactJson(value)).digest('hex')}`;
-}
 export function buildDomainControlManifest(input, generatedAtValue = new Date().toISOString()) {
-    const source = record(input);
-    if (!source || source.schema !== DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA || source.version !== 1) {
-        throw new TypeError(`Domain control manifest input must use ${DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA} version 1.`);
-    }
-    exactKeys(source, MANIFEST_INPUT_KEYS, 'Domain control manifest input');
-    const generatedAt = timestamp(generatedAtValue);
-    const expiresAt = timestamp(source.expiresAt);
-    if (!generatedAt || !expiresAt || Date.parse(expiresAt) <= Date.parse(generatedAt)) {
-        throw new TypeError('Domain control manifest expiry must be a valid time after generation.');
-    }
-    if (!Array.isArray(source.entries) || source.entries.length < 1 || source.entries.length > MAX_DOMAIN_CONTROL_ENTRIES) {
-        throw new TypeError(`Domain control manifest input must contain between 1 and ${MAX_DOMAIN_CONTROL_ENTRIES} entries.`);
-    }
-    const entries = source.entries.map((entry, index) => {
-        exactKeys(entry, MANIFEST_ENTRY_KEYS, `Domain control manifest input entry ${index + 1}`);
-        return normalizeEntry(entry);
-    });
-    if (entries.some((entry) => entry === null))
-        throw new TypeError('Domain control manifest contains an invalid entry.');
-    const normalizedEntries = entries;
-    const domains = new Set(normalizedEntries.map((entry) => entry.domain));
-    if (domains.size !== normalizedEntries.length)
-        throw new TypeError('Domain control manifest entries must use unique domains.');
-    const base = Object.freeze({
-        schema: DOMAIN_CONTROL_MANIFEST_SCHEMA,
-        version: DOMAIN_CONTROL_MANIFEST_VERSION,
-        generatedAt,
-        expiresAt,
-        entries: Object.freeze([...normalizedEntries].sort((left, right) => left.domain.localeCompare(right.domain))),
-        limitations: DOMAIN_CONTROL_LIMITATIONS,
-    });
+    const unsigned = buildUnsignedDomainControlPassport(input, generatedAtValue);
     return Object.freeze({
-        ...base,
+        ...unsigned,
         integrity: Object.freeze({
             algorithm: 'SHA-256',
-            canonicalization: 'sorted-json-v1',
-            digestSha256: integrityDigest(unsignedManifest(base)),
+            canonicalization: SORTED_JSON_V2,
+            digestSha256: `sha256:${createHash('sha256').update(canonicalArtifactJsonV2(unsigned)).digest('hex')}`,
         }),
     });
 }
 export function verifyDomainControlManifest(value) {
-    const source = record(value);
-    const integrity = record(source?.integrity);
-    if (!source
-        || source.schema !== DOMAIN_CONTROL_MANIFEST_SCHEMA
-        || source.version !== DOMAIN_CONTROL_MANIFEST_VERSION
-        || !Array.isArray(source.entries)
-        || source.entries.length < 1
-        || source.entries.length > MAX_DOMAIN_CONTROL_ENTRIES
-        || !Array.isArray(source.limitations)
-        || source.limitations.length !== DOMAIN_CONTROL_LIMITATIONS.length
-        || source.limitations.some((limitation, index) => limitation !== DOMAIN_CONTROL_LIMITATIONS[index])
-        || !integrity
-        || integrity.algorithm !== 'SHA-256'
-        || integrity.canonicalization !== 'sorted-json-v1'
-        || typeof integrity.digestSha256 !== 'string'
-        || !/^sha256:[a-f0-9]{64}$/u.test(integrity.digestSha256)) {
-        throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
-    }
-    exactKeys(source, MANIFEST_KEYS, 'Domain control manifest');
-    exactKeys(integrity, MANIFEST_INTEGRITY_KEYS, 'Domain control manifest integrity');
-    for (const [index, entry] of source.entries.entries()) {
-        exactKeys(entry, MANIFEST_ENTRY_KEYS, `Domain control manifest entry ${index + 1}`);
-    }
-    const generatedAt = timestamp(source.generatedAt);
-    const expiresAt = timestamp(source.expiresAt);
-    const entries = source.entries.map(normalizeEntry);
-    if (!generatedAt || !expiresAt || Date.parse(expiresAt) <= Date.parse(generatedAt) || entries.some((entry) => entry === null)) {
-        throw new TypeError('Domain control manifest has invalid normalised content.');
-    }
-    const normalizedEntries = entries;
-    if (new Set(normalizedEntries.map((entry) => entry.domain)).size !== normalizedEntries.length) {
-        throw new TypeError('Domain control manifest entries must use unique domains.');
-    }
-    const { integrity: _integrity, ...unsigned } = source;
-    const canonical = Object.freeze({
-        schema: DOMAIN_CONTROL_MANIFEST_SCHEMA,
-        version: DOMAIN_CONTROL_MANIFEST_VERSION,
-        generatedAt,
-        expiresAt,
-        entries: Object.freeze([...normalizedEntries].sort((left, right) => left.domain.localeCompare(right.domain))),
-        limitations: DOMAIN_CONTROL_LIMITATIONS,
-    });
-    let suppliedCanonical;
-    try {
-        suppliedCanonical = canonicalArtifactJson(unsigned);
-    }
-    catch {
-        throw new TypeError('Domain control manifest has invalid normalised content.');
-    }
-    if (suppliedCanonical !== canonicalArtifactJson(canonical)) {
-        throw new TypeError('Domain control manifest must use its canonical normalised content.');
-    }
-    if (`sha256:${createHash('sha256').update(suppliedCanonical).digest('hex')}` !== integrity.digestSha256) {
+    const normalized = normalizeDomainControlPassportDocument(value);
+    if (`sha256:${createHash('sha256').update(normalized.canonicalUnsigned).digest('hex')}` !== normalized.manifest.integrity.digestSha256) {
         throw new TypeError('Domain control manifest failed its SHA-256 integrity check.');
     }
-    return source;
+    return normalized.manifest;
 }
 function fieldValues(field, value) {
-    if (field === 'nameservers' || field === 'mx')
+    if (field === 'nameservers')
         return hostnameList(value);
+    if (field === 'mx' || field === 'caa' || field === 'ds')
+        return canonicalDomainControlRecordList(Array.isArray(value) ? value : [value], field);
     if (field === 'tlsSpkiSha256') {
         const normalized = Array.isArray(value) ? value.map(spkiFingerprint).filter(Boolean) : [spkiFingerprint(value)].filter(Boolean);
         return [...new Set(normalized)].sort().slice(0, MAX_DOMAIN_CONTROL_RECORDS);

package/lib/domain-posture.mjs

@@ -602,15 +602,18 @@ function buildPostureReport(domain, input) {
         summary[item.status] += 1;
     return { domain, summary, checks };
 }
-async function fetchMtaStsPolicy(domain) {
+async function fetchMtaStsPolicy(domain, fetcher = safeFetch) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), POLICY_TIMEOUT_MS);
     try {
         const url = `https://mta-sts.${domain}/.well-known/mta-sts.txt`;
-        const res = await safeFetch(url, {
+        // RFC 8461 section 3.3 requires a direct HTTPS 200 response and forbids
+        // following HTTP redirects for policy discovery. A zero-hop safe fetch
+        // also keeps the returned body bound to the required policy host/path.
+        const res = await fetcher(url, {
             signal: controller.signal,
             headers: whoisleuthRequestHeaders({ Accept: 'text/plain' }),
-        });
+        }, 0);
         if (!res.ok) {
             // Not reading this body - release it explicitly instead of leaving an
             // unconsumed stream (and the connection it's tied to) open until
@@ -743,4 +746,4 @@ async function checkDomainPosture(domain, { dkimSelectors = [], retiredDkimSelec
         externalDependencies,
     };
 }
-export { normalizeAuditDomain, normalizeDkimSelectors, normalizeMailProtectionProfile, matchesMtaPattern, buildPostureReport, checkDomainPosture, };
+export { normalizeAuditDomain, normalizeDkimSelectors, normalizeMailProtectionProfile, matchesMtaPattern, fetchMtaStsPolicy, buildPostureReport, checkDomainPosture, };