@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/lib/dnssec-evidence-validation.mjs

@@ -1,6 +1,7 @@
 import { Buffer } from 'node:buffer';
 import { createHash } from 'node:crypto';
 import { domainToASCII } from 'node:url';
+import { normalizeLegacyIsoTimestamp } from "../packages/evidence/observation.mjs";
 const DNSSEC_EVIDENCE_SCHEMA = 'whoisleuth.dnssec-evidence-validation';
 const DNSSEC_EVIDENCE_VERSION = 1;
 const MAX_DNSSEC_RECORDS = 50;
@@ -99,20 +100,25 @@ function dsDigest(owner, dnskey, digestType) {
 }
 function normalizeRrsig(value) {
     const source = record(value);
-    if (!source || typeof source.inception !== 'string' || typeof source.expiration !== 'string')
+    if (!source)
+        return null;
+    const normalizedInception = normalizeLegacyIsoTimestamp(source.inception);
+    const normalizedExpiration = normalizeLegacyIsoTimestamp(source.expiration);
+    if (!normalizedInception || !normalizedExpiration)
         return null;
-    const inception = Date.parse(source.inception);
-    const expiration = Date.parse(source.expiration);
-    if (!Number.isFinite(inception) || !Number.isFinite(expiration) || inception > expiration)
+    const inception = Date.parse(normalizedInception);
+    const expiration = Date.parse(normalizedExpiration);
+    if (inception > expiration)
         return null;
     return Object.freeze({ inception, expiration });
 }
 function signatureTimeState(value, observedAt) {
-    if (!value.length || typeof observedAt !== 'string')
+    if (!value.length)
         return 'unavailable';
-    const observed = Date.parse(observedAt);
-    if (!Number.isFinite(observed))
+    const normalizedObservedAt = normalizeLegacyIsoTimestamp(observedAt);
+    if (!normalizedObservedAt)
         return 'unavailable';
+    const observed = Date.parse(normalizedObservedAt);
     let withinWindow = 0;
     for (const item of value) {
         if (observed >= item.inception && observed <= item.expiration)
@@ -160,7 +166,8 @@ function validateDnssecEvidence(input) {
             limitations: Object.freeze(limitations),
         });
     }
-    if (input.delegationSigned === false && dsRecords.length === 0) {
+    const incompleteInput = rejectedCount > 0 || truncated;
+    if (input.delegationSigned === false && dsRecords.length === 0 && !incompleteInput) {
         findings.push('The supplied delegation state was unsigned and no DS records were supplied.');
         return Object.freeze({
             schema: DNSSEC_EVIDENCE_SCHEMA,
@@ -191,18 +198,24 @@ function validateDnssecEvidence(input) {
         if (matched)
             matchedDsCount += 1;
     }
-    const definiteConflict = input.delegationSigned === false && dsRecords.length > 0
+    const observedConflict = input.delegationSigned === false && dsRecords.length > 0
         || input.delegationSigned === true && dsRecords.length === 0 && !truncated
         || signatureState === 'outside_window'
         || (dsRecords.length > 0 && dnskeys.length > 0 && matchedDsCount === 0 && unsupportedDigestCount < dsRecords.length);
+    const definiteConflict = observedConflict && !incompleteInput;
     if (definiteConflict)
         findings.push('The supplied delegation, signature-time, DS, or DNSKEY evidence conflicts.');
+    else if (observedConflict)
+        findings.push('The retained subset contains conflicting evidence, but omitted or rejected records prevent a definitive conflict conclusion.');
     if (matchedDsCount > 0)
         findings.push(`${matchedDsCount} supplied DS record(s) matched a supplied DNSKEY.`);
     if (unsupportedDigestCount > 0)
         findings.push(`${unsupportedDigestCount} DS digest type(s) were retained as unsupported.`);
     if (signatureState === 'mixed')
         findings.push('The supplied RRSIG validity windows were mixed at the observation time.');
+    if (input.delegationSigned === false && dsRecords.length === 0 && incompleteInput) {
+        findings.push('The retained subset contains no usable DS record, but omitted or rejected records prevent a definitive unsigned conclusion.');
+    }
     if (rejectedCount > 0)
         findings.push(`${rejectedCount} malformed record(s) were rejected.`);
     if (truncated)
@@ -210,7 +223,7 @@ function validateDnssecEvidence(input) {
     const completeLocalRelationship = dsRecords.length > 0
         && dnskeys.length > 0
         && matchedDsCount > 0
-        && !definiteConflict
+        && !observedConflict
         && rejectedCount === 0
         && !truncated
         && unsupportedDigestCount === 0

package/lib/domain-assurance.mjs

@@ -1,9 +1,10 @@
 import { domainToASCII } from 'node:url';
 import { exactKeys } from "./bounded-contract-normalizers.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 const DOMAIN_ASSURANCE_INPUT_SCHEMA = 'whoisleuth.domain-assurance.input';
 const DOMAIN_ASSURANCE_SCHEMA = 'whoisleuth.domain-assurance';
 const DOMAIN_ASSURANCE_VERSION = 2;
-const DOMAIN_ASSURANCE_SUPPORTED_INPUT_VERSIONS = Object.freeze([1, 2]);
+const DOMAIN_ASSURANCE_SUPPORTED_INPUT_VERSIONS = Object.freeze([DOMAIN_ASSURANCE_VERSION]);
 const MAX_ASSURANCE_INPUT_BYTES = 2 * 1024 * 1024;
 const ROOT_KEYS = Object.freeze({
     'planned-change': new Set(['schema', 'version', 'kind', 'domain', 'change']),
@@ -45,9 +46,10 @@ function optionalText(value, maximum = 160) {
 }
 function timestamp(value, field) {
     const normalized = text(value, field, 64);
-    if (!Number.isFinite(Date.parse(normalized)))
-        throw new Error(`${field} must be an ISO-compatible timestamp.`);
-    return new Date(normalized).toISOString();
+    const canonical = normalizeExplicitIsoTimestamp(normalized);
+    if (canonical)
+        return canonical;
+    throw new Error(`${field} must be an ISO timestamp with an explicit timezone.`);
 }
 function optionalTimestamp(value, field) {
     if (value === null || value === undefined || value === '')
@@ -252,7 +254,7 @@ const RETIREMENT_CHECKS = Object.freeze([
     ['delegatedDnsMonitored', 'Delegated DNS remains monitored during retirement', true],
     ['reRegistrationPrevented', 'Registration continuity or defensive renewal is planned', true],
 ]);
-function buildRetirement(input, inputVersion) {
+function buildRetirement(input) {
     const checksInput = record(input.checks);
     exactKeys(checksInput, new Set(RETIREMENT_CHECKS.map(([id]) => id)), 'checks');
     const fixedChecks = RETIREMENT_CHECKS.map(([id, checkLabel, expected]) => {
@@ -266,7 +268,7 @@ function buildRetirement(input, inputVersion) {
     });
     const fixedIds = new Set(RETIREMENT_CHECKS.map(([id]) => id));
     const customIds = new Set();
-    const customChecks = inputVersion === 2 && input.customChecks !== undefined
+    const customChecks = input.customChecks !== undefined
         ? boundedArray(input.customChecks, 'customChecks', 0, 20).map((raw, index) => {
             const item = record(raw);
             exactKeys(item, CUSTOM_RETIREMENT_CHECK_KEYS, `customChecks[${index}]`);
@@ -304,18 +306,16 @@ function buildRetirement(input, inputVersion) {
 }
 function buildDomainAssurance(inputRaw, generatedAt = new Date().toISOString()) {
     const input = record(inputRaw);
-    if (input.schema !== DOMAIN_ASSURANCE_INPUT_SCHEMA
-        || !DOMAIN_ASSURANCE_SUPPORTED_INPUT_VERSIONS.includes(input.version)) {
-        throw new Error(`Domain assurance input must use ${DOMAIN_ASSURANCE_INPUT_SCHEMA} version 1 or ${DOMAIN_ASSURANCE_VERSION}.`);
+    if (input.schema !== DOMAIN_ASSURANCE_INPUT_SCHEMA || input.version !== DOMAIN_ASSURANCE_VERSION) {
+        throw new Error(`Domain assurance input must use ${DOMAIN_ASSURANCE_INPUT_SCHEMA} version ${DOMAIN_ASSURANCE_VERSION}.`);
     }
-    const inputVersion = input.version;
     const kind = enumValue(input.kind, 'kind', ['planned-change', 'recovery-dependencies', 'retirement']);
-    exactKeys(input, kind === 'retirement' && inputVersion === 2 ? RETIREMENT_ROOT_KEYS_V2 : ROOT_KEYS[kind], 'Domain assurance input');
+    exactKeys(input, kind === 'retirement' ? RETIREMENT_ROOT_KEYS_V2 : ROOT_KEYS[kind], 'Domain assurance input');
     const result = kind === 'planned-change'
         ? buildPlannedChange(input)
         : kind === 'recovery-dependencies'
             ? buildRecoveryDependencies(input)
-            : buildRetirement(input, inputVersion);
+            : buildRetirement(input);
     return {
         schema: DOMAIN_ASSURANCE_SCHEMA,
         version: DOMAIN_ASSURANCE_VERSION,

package/lib/domain-change-packet.mjs

@@ -1,10 +1,11 @@
 import { exactKeys, requireBoundedString, requireDomainName, requireIsoTimestamp, requireRecord, } from "./bounded-contract-normalizers.mjs";
 import { DOMAIN_ASSURANCE_INPUT_SCHEMA, buildDomainAssurance, } from "./domain-assurance.mjs";
 import { DOMAIN_CHANGE_INPUT_SCHEMA, reviewDomainChange, } from "./domain-change-review.mjs";
-import { sha256ArtifactDigest } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../packages/evidence/artifact-integrity.mjs";
 export const DOMAIN_CHANGE_PACKET_INPUT_SCHEMA = 'whoisleuth.domain-change-packet.input';
 export const DOMAIN_CHANGE_PACKET_SCHEMA = 'whoisleuth.domain-change-packet';
-export const DOMAIN_CHANGE_PACKET_VERSION = 1;
+export const DOMAIN_CHANGE_PACKET_INPUT_VERSION = 1;
+export const DOMAIN_CHANGE_PACKET_VERSION = 2;
 export const MAX_DOMAIN_CHANGE_PACKET_INPUT_BYTES = 6 * 1024 * 1024;
 const ROOT_KEYS = new Set([
     'schema',
@@ -57,8 +58,8 @@ function changeSummary(before, after) {
 }
 export async function buildDomainChangePacket(inputRaw, generatedAtValue = new Date().toISOString()) {
     const input = record(inputRaw, 'Domain change packet input');
-    if (input.schema !== DOMAIN_CHANGE_PACKET_INPUT_SCHEMA || input.version !== 1) {
-        throw new TypeError(`Domain change packet input must use ${DOMAIN_CHANGE_PACKET_INPUT_SCHEMA} version 1.`);
+    if (input.schema !== DOMAIN_CHANGE_PACKET_INPUT_SCHEMA || input.version !== DOMAIN_CHANGE_PACKET_INPUT_VERSION) {
+        throw new TypeError(`Domain change packet input must use ${DOMAIN_CHANGE_PACKET_INPUT_SCHEMA} version ${DOMAIN_CHANGE_PACKET_INPUT_VERSION}.`);
     }
     exactKeys(input, ROOT_KEYS, 'Domain change packet input');
     const domain = requireDomainName(input.domain, 'domain');
@@ -105,7 +106,8 @@ export async function buildDomainChangePacket(inputRaw, generatedAtValue = new D
         ...unsigned,
         integrity: Object.freeze({
             algorithm: 'SHA-256',
-            digestSha256: await sha256ArtifactDigest(unsigned),
+            canonicalization: SORTED_JSON_V2,
+            digestSha256: await sha256ArtifactDigestV2(unsigned),
         }),
     });
 }