@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/lib/domain-control-manifest.mjs

@@ -1,43 +1,106 @@
 import { createHash } from 'node:crypto';
 import { domainToASCII } from 'node:url';
-import { canonicalArtifactJson } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { canonicalArtifactJsonFor, } from "../packages/evidence/artifact-integrity.mjs";
+import { DOMAIN_CONTROL_MANIFEST_CURRENT_CANONICALIZATION, DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_MANIFEST_SCHEMA, DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_DS_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_INPUT_RECORDS, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH, } from "../packages/contracts/domain-control-manifest.mjs";
+import { DOMAIN_CONTROL_REVIEW_FIELDS, DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, DOMAIN_CONTROL_REVIEW_COUNT_KEYS, DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS, DOMAIN_CONTROL_REVIEW_INPUT_KEYS, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_LIMITATIONS, DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS, DOMAIN_CONTROL_REVIEW_OBSERVATION_FIELD_KEYS, DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS, DOMAIN_CONTROL_REVIEW_ROOT_KEYS, DOMAIN_CONTROL_REVIEW_SCHEMA, DOMAIN_CONTROL_REVIEW_VERSION, MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS, MAX_DOMAIN_CONTROL_REVIEW_SOURCE_LENGTH, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH, } from "../packages/contracts/domain-control-review.mjs";
+import { assertDomainControlManifestByteBudget, buildUnsignedDomainControlManifest, canonicalDomainControlRecordList, normalizeDomainControlManifestDocument, } from "../packages/evidence/domain-control-runtime.mjs";
 import { exactKeys } from "./bounded-contract-normalizers.mjs";
-export const DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA = 'whoisleuth.domain-control-manifest-input';
-export const DOMAIN_CONTROL_MANIFEST_SCHEMA = 'whoisleuth.domain-control-manifest';
-export const DOMAIN_CONTROL_MANIFEST_VERSION = 1;
-export const DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA = 'whoisleuth.domain-control-review-input';
-export const DOMAIN_CONTROL_REVIEW_SCHEMA = 'whoisleuth.domain-control-review';
-export const DOMAIN_CONTROL_REVIEW_VERSION = 1;
-export const MAX_DOMAIN_CONTROL_ENTRIES = 100;
-export const MAX_DOMAIN_CONTROL_RECORDS = 32;
-const MANIFEST_KEYS = new Set(['schema', 'version', 'generatedAt', 'expiresAt', 'entries', 'limitations', 'integrity']);
-const MANIFEST_ENTRY_KEYS = new Set(['domain', 'nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock', 'renewalReviewAt', 'note']);
-const MANIFEST_INTEGRITY_KEYS = new Set(['algorithm', 'canonicalization', 'digestSha256']);
-const MANIFEST_INPUT_KEYS = new Set(['schema', 'version', 'expiresAt', 'entries']);
-const REVIEW_INPUT_KEYS = new Set(['schema', 'version', 'manifest', 'observations']);
-const OBSERVATION_KEYS = new Set(['domain', 'fields']);
-const OBSERVATION_FIELDS = new Set(['nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock']);
-const OBSERVATION_FIELD_KEYS = new Set(['state', 'values', 'source', 'observedAt']);
-const DOMAIN_CONTROL_LIMITATIONS = Object.freeze([
-    'This analyst-authored manifest records intended domain-control state. It does not collect evidence or change registrar, DNS, mail, or certificate configuration.',
-    'Empty desired fields are unconfigured rather than claims that a record should be absent.',
-]);
+import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "../packages/evidence/observation.mjs";
+export { DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_SCHEMA, DOMAIN_CONTROL_REVIEW_VERSION, };
+export const MAX_DOMAIN_CONTROL_ENTRIES = MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES;
+export const MAX_DOMAIN_CONTROL_RECORDS = MAX_CANONICAL_DOMAIN_CONTROL_RECORDS;
+const REVIEW_INPUT_KEYS = new Set(DOMAIN_CONTROL_REVIEW_INPUT_KEYS);
+const OBSERVATION_KEYS = new Set(DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS);
+const OBSERVATION_FIELDS = new Set(DOMAIN_CONTROL_REVIEW_FIELDS);
+const OBSERVATION_FIELD_KEYS = new Set(DOMAIN_CONTROL_REVIEW_OBSERVATION_FIELD_KEYS);
+const REVIEW_ROOT_KEYS = new Set(DOMAIN_CONTROL_REVIEW_ROOT_KEYS);
+const REVIEW_MANIFEST_KEYS = new Set(DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS);
+const REVIEW_COUNT_KEYS = new Set(DOMAIN_CONTROL_REVIEW_COUNT_KEYS);
+const REVIEW_DOMAIN_KEYS = new Set(DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS);
+const REVIEW_COMPARISON_KEYS = new Set(DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
         : null;
 }
+function exactReviewRecord(value, keys, label) {
+    try {
+        if (!value || typeof value !== 'object' || Array.isArray(value)) {
+            throw new TypeError(`${label} must be an object.`);
+        }
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw new TypeError(`${label} must be an ordinary object.`);
+        }
+        const ownKeys = Reflect.ownKeys(value);
+        if (ownKeys.length !== keys.size
+            || ownKeys.some((key) => typeof key !== 'string' || !keys.has(key))) {
+            throw new TypeError(`${label} must use its exact registered fields.`);
+        }
+        const result = {};
+        for (const key of keys) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (!descriptor || !descriptor.enumerable || !('value' in descriptor)) {
+                throw new TypeError(`${label}.${key} must be an enumerable data field.`);
+            }
+            result[key] = descriptor.value;
+        }
+        return Object.freeze(result);
+    }
+    catch (cause) {
+        if (cause instanceof TypeError && cause.message.startsWith(label))
+            throw cause;
+        throw new TypeError(`${label} must be an ordinary object.`);
+    }
+}
+function exactReviewText(value, maximum, label) {
+    const normalized = boundedText(value, maximum);
+    if (!normalized || normalized !== value) {
+        throw new TypeError(`${label} must be a canonical bounded string.`);
+    }
+    return normalized;
+}
+function exactReviewTimestamp(value, label) {
+    const normalized = timestamp(value);
+    if (!normalized || normalized !== value)
+        throw new TypeError(`${label} must be a canonical timestamp.`);
+    return normalized;
+}
+function exactReviewInteger(value, maximum, label) {
+    if (!Number.isSafeInteger(value) || Number(value) < 0 || Number(value) > maximum) {
+        throw new TypeError(`${label} must be a bounded non-negative integer.`);
+    }
+    return Number(value);
+}
+function exactReviewStringArray(value, maximumItems, maximumCharacters, label) {
+    const input = boundedDataArray(value, maximumItems);
+    if (!input)
+        throw new TypeError(`${label} must be a bounded array.`);
+    const output = input.map((item, index) => exactReviewText(item, maximumCharacters, `${label}[${index}]`));
+    if (new Set(output).size !== output.length
+        || output.some((item, index) => index > 0 && output[index - 1] >= item)) {
+        throw new TypeError(`${label} must contain unique canonically ordered values.`);
+    }
+    return Object.freeze(output);
+}
 function boundedText(value, maximum = 300) {
-    if (typeof value !== 'string' || value.length > maximum * 4 || /[\u0000-\u001f\u007f]/u.test(value))
+    if (typeof value !== 'string'
+        || value.length > maximum * DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR
+        || /[\u0000-\u001f\u007f]/u.test(value))
         return null;
     return value.replace(/\s+/gu, ' ').trim().slice(0, maximum) || null;
 }
-function timestamp(value) {
-    const text = boundedText(value, 64);
-    if (!text)
+function timestamp(value, legacy = false) {
+    if (typeof value !== 'string'
+        || value.length > MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH * DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR
+        || /[\u0000-\u001f\u007f]/u.test(value))
+        return null;
+    const text = value.replace(/\s+/gu, ' ').trim();
+    if (!text || text.length > MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH)
         return null;
-    const parsed = Date.parse(text);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+    return text
+        ? normalizeExplicitIsoTimestamp(text) ?? (legacy ? normalizeLegacyIsoTimestamp(text) : null)
+        : null;
 }
 function domain(value) {
     const text = boundedText(value, 253)?.toLowerCase().replace(/\.$/u, '');
@@ -49,165 +112,110 @@ function domain(value) {
     return ascii;
 }
 function hostnameList(value) {
-    if (!Array.isArray(value))
-        return [];
-    return [...new Set(value.slice(0, MAX_DOMAIN_CONTROL_RECORDS * 4)
+    return [...new Set(value
             .map(domain)
             .filter((item) => item !== null))]
         .sort()
         .slice(0, MAX_DOMAIN_CONTROL_RECORDS);
 }
 function textList(value, maximum = 300) {
-    if (!Array.isArray(value))
-        return [];
-    return [...new Set(value.slice(0, MAX_DOMAIN_CONTROL_RECORDS * 4)
+    return [...new Set(value
             .map((item) => boundedText(item, maximum)?.toLowerCase() ?? null)
             .filter((item) => item !== null))]
         .sort()
         .slice(0, MAX_DOMAIN_CONTROL_RECORDS);
 }
 function spkiFingerprint(value) {
-    const text = boundedText(value, 64)?.toLowerCase();
-    return text && /^[a-f0-9]{64}$/u.test(text) ? text : null;
-}
-function normalizeEntry(value) {
-    const source = record(value);
-    const normalizedDomain = domain(source?.domain);
-    if (!source || !normalizedDomain)
+    if (typeof value !== 'string'
+        || value.length > 64 * DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR
+        || /[\u0000-\u001f\u007f]/u.test(value))
         return null;
-    const registrarLock = source.registrarLock === 'required' || source.registrarLock === 'not_required'
-        ? source.registrarLock
-        : null;
-    return Object.freeze({
-        domain: normalizedDomain,
-        nameservers: Object.freeze(hostnameList(source.nameservers)),
-        ds: Object.freeze(textList(source.ds, 500)),
-        mx: Object.freeze(hostnameList(source.mx)),
-        caa: Object.freeze(textList(source.caa, 500)),
-        tlsIssuer: boundedText(source.tlsIssuer, 300)?.toLowerCase() ?? null,
-        tlsSpkiSha256: spkiFingerprint(source.tlsSpkiSha256),
-        registrarLock,
-        renewalReviewAt: timestamp(source.renewalReviewAt),
-        note: boundedText(source.note, 500),
-    });
-}
-function unsignedManifest(value) {
-    return value;
-}
-function integrityDigest(value) {
-    return `sha256:${createHash('sha256').update(canonicalArtifactJson(value)).digest('hex')}`;
+    const text = value.trim().toLowerCase();
+    return text && /^[a-f0-9]{64}$/u.test(text) ? text : null;
 }
 export function buildDomainControlManifest(input, generatedAtValue = new Date().toISOString()) {
-    const source = record(input);
-    if (!source || source.schema !== DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA || source.version !== 1) {
-        throw new TypeError(`Domain control manifest input must use ${DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA} version 1.`);
-    }
-    exactKeys(source, MANIFEST_INPUT_KEYS, 'Domain control manifest input');
-    const generatedAt = timestamp(generatedAtValue);
-    const expiresAt = timestamp(source.expiresAt);
-    if (!generatedAt || !expiresAt || Date.parse(expiresAt) <= Date.parse(generatedAt)) {
-        throw new TypeError('Domain control manifest expiry must be a valid time after generation.');
-    }
-    if (!Array.isArray(source.entries) || source.entries.length < 1 || source.entries.length > MAX_DOMAIN_CONTROL_ENTRIES) {
-        throw new TypeError(`Domain control manifest input must contain between 1 and ${MAX_DOMAIN_CONTROL_ENTRIES} entries.`);
-    }
-    const entries = source.entries.map((entry, index) => {
-        exactKeys(entry, MANIFEST_ENTRY_KEYS, `Domain control manifest input entry ${index + 1}`);
-        return normalizeEntry(entry);
-    });
-    if (entries.some((entry) => entry === null))
-        throw new TypeError('Domain control manifest contains an invalid entry.');
-    const normalizedEntries = entries;
-    const domains = new Set(normalizedEntries.map((entry) => entry.domain));
-    if (domains.size !== normalizedEntries.length)
-        throw new TypeError('Domain control manifest entries must use unique domains.');
-    const base = Object.freeze({
-        schema: DOMAIN_CONTROL_MANIFEST_SCHEMA,
-        version: DOMAIN_CONTROL_MANIFEST_VERSION,
-        generatedAt,
-        expiresAt,
-        entries: Object.freeze([...normalizedEntries].sort((left, right) => left.domain.localeCompare(right.domain))),
-        limitations: DOMAIN_CONTROL_LIMITATIONS,
-    });
-    return Object.freeze({
-        ...base,
+    const unsigned = buildUnsignedDomainControlManifest(input, generatedAtValue);
+    const manifest = Object.freeze({
+        ...unsigned,
         integrity: Object.freeze({
             algorithm: 'SHA-256',
-            canonicalization: 'sorted-json-v1',
-            digestSha256: integrityDigest(unsignedManifest(base)),
+            canonicalization: DOMAIN_CONTROL_MANIFEST_CURRENT_CANONICALIZATION,
+            digestSha256: `sha256:${createHash('sha256').update(canonicalArtifactJsonFor(unsigned, DOMAIN_CONTROL_MANIFEST_CURRENT_CANONICALIZATION)).digest('hex')}`,
         }),
     });
+    assertDomainControlManifestByteBudget(manifest);
+    return manifest;
 }
 export function verifyDomainControlManifest(value) {
-    const source = record(value);
-    const integrity = record(source?.integrity);
-    if (!source
-        || source.schema !== DOMAIN_CONTROL_MANIFEST_SCHEMA
-        || source.version !== DOMAIN_CONTROL_MANIFEST_VERSION
-        || !Array.isArray(source.entries)
-        || source.entries.length < 1
-        || source.entries.length > MAX_DOMAIN_CONTROL_ENTRIES
-        || !Array.isArray(source.limitations)
-        || source.limitations.length !== DOMAIN_CONTROL_LIMITATIONS.length
-        || source.limitations.some((limitation, index) => limitation !== DOMAIN_CONTROL_LIMITATIONS[index])
-        || !integrity
-        || integrity.algorithm !== 'SHA-256'
-        || integrity.canonicalization !== 'sorted-json-v1'
-        || typeof integrity.digestSha256 !== 'string'
-        || !/^sha256:[a-f0-9]{64}$/u.test(integrity.digestSha256)) {
-        throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
-    }
-    exactKeys(source, MANIFEST_KEYS, 'Domain control manifest');
-    exactKeys(integrity, MANIFEST_INTEGRITY_KEYS, 'Domain control manifest integrity');
-    for (const [index, entry] of source.entries.entries()) {
-        exactKeys(entry, MANIFEST_ENTRY_KEYS, `Domain control manifest entry ${index + 1}`);
-    }
-    const generatedAt = timestamp(source.generatedAt);
-    const expiresAt = timestamp(source.expiresAt);
-    const entries = source.entries.map(normalizeEntry);
-    if (!generatedAt || !expiresAt || Date.parse(expiresAt) <= Date.parse(generatedAt) || entries.some((entry) => entry === null)) {
-        throw new TypeError('Domain control manifest has invalid normalised content.');
-    }
-    const normalizedEntries = entries;
-    if (new Set(normalizedEntries.map((entry) => entry.domain)).size !== normalizedEntries.length) {
-        throw new TypeError('Domain control manifest entries must use unique domains.');
+    const normalized = normalizeDomainControlManifestDocument(value);
+    if (`sha256:${createHash('sha256').update(normalized.canonicalUnsigned).digest('hex')}` !== normalized.manifest.integrity.digestSha256) {
+        throw new TypeError('Domain control manifest failed its SHA-256 integrity check.');
     }
-    const { integrity: _integrity, ...unsigned } = source;
-    const canonical = Object.freeze({
-        schema: DOMAIN_CONTROL_MANIFEST_SCHEMA,
-        version: DOMAIN_CONTROL_MANIFEST_VERSION,
-        generatedAt,
-        expiresAt,
-        entries: Object.freeze([...normalizedEntries].sort((left, right) => left.domain.localeCompare(right.domain))),
-        limitations: DOMAIN_CONTROL_LIMITATIONS,
-    });
-    let suppliedCanonical;
+    return normalized.manifest;
+}
+function boundedDataArray(value, maximum) {
     try {
-        suppliedCanonical = canonicalArtifactJson(unsigned);
+        if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype)
+            return null;
+        if (Object.getOwnPropertyDescriptor(value, Symbol.iterator)
+            || Object.getOwnPropertyDescriptor(value, 'toJSON'))
+            return null;
+        const lengthDescriptor = Object.getOwnPropertyDescriptor(value, 'length');
+        const length = lengthDescriptor && !lengthDescriptor.enumerable && 'value' in lengthDescriptor
+            ? lengthDescriptor.value
+            : null;
+        if (!Number.isSafeInteger(length)
+            || Number(length) < 0
+            || Number(length) > maximum)
+            return null;
+        const boundedLength = Number(length);
+        const keys = Reflect.ownKeys(value);
+        if (keys.length !== boundedLength + 1 || !keys.includes('length'))
+            return null;
+        const result = [];
+        for (let index = 0; index < boundedLength; index += 1) {
+            const key = String(index);
+            if (!keys.includes(key))
+                return null;
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (!descriptor || !descriptor.enumerable || !('value' in descriptor))
+                return null;
+            result.push(descriptor.value);
+        }
+        return result;
     }
     catch {
-        throw new TypeError('Domain control manifest has invalid normalised content.');
-    }
-    if (suppliedCanonical !== canonicalArtifactJson(canonical)) {
-        throw new TypeError('Domain control manifest must use its canonical normalised content.');
-    }
-    if (`sha256:${createHash('sha256').update(suppliedCanonical).digest('hex')}` !== integrity.digestSha256) {
-        throw new TypeError('Domain control manifest failed its SHA-256 integrity check.');
+        return null;
     }
-    return source;
 }
 function fieldValues(field, value) {
-    if (field === 'nameservers' || field === 'mx')
-        return hostnameList(value);
+    if (field === 'nameservers') {
+        const normalized = value.map(domain);
+        return normalized.some((item) => item === null)
+            ? null
+            : hostnameList(normalized);
+    }
+    if (field === 'mx' || field === 'caa' || field === 'ds') {
+        const normalized = value.flatMap((item) => canonicalDomainControlRecordList([item], field));
+        return normalized.length === value.length
+            ? [...new Set(normalized)].sort().slice(0, MAX_DOMAIN_CONTROL_RECORDS)
+            : null;
+    }
     if (field === 'tlsSpkiSha256') {
-        const normalized = Array.isArray(value) ? value.map(spkiFingerprint).filter(Boolean) : [spkiFingerprint(value)].filter(Boolean);
-        return [...new Set(normalized)].sort().slice(0, MAX_DOMAIN_CONTROL_RECORDS);
+        const normalized = value.map(spkiFingerprint);
+        return normalized.some((item) => item === null)
+            ? null
+            : [...new Set(normalized)].sort().slice(0, MAX_DOMAIN_CONTROL_RECORDS);
     }
     if (field === 'registrarLock') {
-        const values = Array.isArray(value) ? value : [value];
-        return [...new Set(values.filter((item) => item === 'required' || item === 'not_required'))];
+        return value.every((item) => item === 'required' || item === 'not_required')
+            ? [...new Set(value)].sort()
+            : null;
     }
-    return textList(Array.isArray(value) ? value : [value], 500);
+    const normalized = value.map((item) => boundedText(item, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH)?.toLowerCase() ?? null);
+    return normalized.some((item) => item === null)
+        ? null
+        : textList(normalized, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH);
 }
 function normalizeObservation(value) {
     const source = record(value);
@@ -218,22 +226,31 @@ function normalizeObservation(value) {
     exactKeys(source, OBSERVATION_KEYS, 'Domain control observation');
     exactKeys(rawFields, OBSERVATION_FIELDS, 'Domain control observation fields');
     const fields = {};
-    for (const field of ['nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock']) {
+    for (const field of DOMAIN_CONTROL_REVIEW_FIELDS) {
+        if (!Object.hasOwn(rawFields, field))
+            continue;
         const raw = record(rawFields[field]);
         if (!raw)
-            continue;
+            return null;
         exactKeys(raw, OBSERVATION_FIELD_KEYS, `Domain control observation field ${field}`);
+        if (!DOMAIN_CONTROL_REVIEW_OBSERVATION_FIELD_KEYS.every((key) => Object.hasOwn(raw, key)))
+            return null;
         const state = raw.state;
         if (state !== 'observed' && state !== 'partial' && state !== 'unavailable' && state !== 'unsupported')
             return null;
-        const sourceLabel = boundedText(raw.source, 120);
-        if (!sourceLabel)
+        const sourceLabel = boundedText(raw.source, MAX_DOMAIN_CONTROL_REVIEW_SOURCE_LENGTH);
+        const values = boundedDataArray(raw.values, MAX_DOMAIN_CONTROL_INPUT_RECORDS);
+        if (!sourceLabel || !values)
+            return null;
+        const normalizedValues = fieldValues(field, values);
+        const observedAt = raw.observedAt === null ? null : timestamp(raw.observedAt, true);
+        if (!normalizedValues || (raw.observedAt !== null && !observedAt))
             return null;
         fields[field] = Object.freeze({
             state,
-            values: Object.freeze(fieldValues(field, raw.values)),
+            values: Object.freeze(normalizedValues),
             source: sourceLabel,
-            observedAt: timestamp(raw.observedAt),
+            observedAt,
         });
     }
     return Object.freeze({ domain: normalizedDomain, fields: Object.freeze(fields) });
@@ -299,18 +316,19 @@ function renewalComparison(entry, now) {
 }
 export function reviewDomainControlManifest(input, generatedAtValue = new Date().toISOString()) {
     const source = record(input);
-    if (!source || source.schema !== DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA || source.version !== 1) {
-        throw new TypeError(`Domain control review input must use ${DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA} version 1.`);
+    if (!source || source.schema !== DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA || source.version !== DOMAIN_CONTROL_REVIEW_VERSION) {
+        throw new TypeError(`Domain control review input must use ${DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA} version ${DOMAIN_CONTROL_REVIEW_VERSION}.`);
     }
     exactKeys(source, REVIEW_INPUT_KEYS, 'Domain control review input');
     const generatedAt = timestamp(generatedAtValue);
     if (!generatedAt)
-        throw new TypeError('Domain control review time is invalid.');
+        throw new TypeError('Domain control review time must be valid and include an explicit timezone.');
     const manifest = verifyDomainControlManifest(source.manifest);
-    if (!Array.isArray(source.observations) || source.observations.length > MAX_DOMAIN_CONTROL_ENTRIES * 2) {
+    const rawObservations = boundedDataArray(source.observations, MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS);
+    if (!rawObservations) {
         throw new TypeError('Domain control observations must be a bounded array.');
     }
-    const observations = source.observations.map(normalizeObservation);
+    const observations = rawObservations.map(normalizeObservation);
     if (observations.some((item) => item === null))
         throw new TypeError('Domain control review contains an invalid observation.');
     const normalizedObservations = observations;
@@ -318,7 +336,7 @@ export function reviewDomainControlManifest(input, generatedAtValue = new Date()
         throw new TypeError('Domain control observations must use unique domains.');
     }
     const observationMap = new Map(normalizedObservations.map((item) => [item.domain, item]));
-    const fields = ['nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock'];
+    const fields = DOMAIN_CONTROL_REVIEW_FIELDS;
     const domains = manifest.entries.map((entry) => {
         const observation = observationMap.get(entry.domain) ?? null;
         const comparisons = [...fields.map((field) => compareField(entry, observation, field)), renewalComparison(entry, generatedAt)];
@@ -347,11 +365,136 @@ export function reviewDomainControlManifest(input, generatedAtValue = new Date()
         counts: Object.freeze(counts),
         domains: Object.freeze(domains),
         ignoredObservationCount: normalizedObservations.filter((item) => !manifest.entries.some((entry) => entry.domain === item.domain)).length,
-        limitations: Object.freeze([
-            'This local review compares analyst-authored desired state with separately supplied observations and performs no collection or configuration change.',
-            'Only complete observations can produce drift. Partial, unavailable, unsupported, or missing evidence remains inconclusive.',
-            'A valid manifest digest or signature establishes file integrity, not the correctness of the desired state or supplied observations.',
-        ]),
+        limitations: DOMAIN_CONTROL_REVIEW_LIMITATIONS,
+    });
+}
+export function validateDomainControlReviewDocument(value) {
+    const root = exactReviewRecord(value, REVIEW_ROOT_KEYS, 'Domain control review document');
+    if (root.schema !== DOMAIN_CONTROL_REVIEW_SCHEMA || root.version !== DOMAIN_CONTROL_REVIEW_VERSION) {
+        throw new TypeError(`Domain control review document must use ${DOMAIN_CONTROL_REVIEW_SCHEMA} version ${DOMAIN_CONTROL_REVIEW_VERSION}.`);
+    }
+    const generatedAt = exactReviewTimestamp(root.generatedAt, 'Domain control review document generatedAt');
+    const manifestInput = exactReviewRecord(root.manifest, REVIEW_MANIFEST_KEYS, 'Domain control review document manifest');
+    const manifestGeneratedAt = exactReviewTimestamp(manifestInput.generatedAt, 'Domain control review document manifest generatedAt');
+    const expiresAt = exactReviewTimestamp(manifestInput.expiresAt, 'Domain control review document manifest expiresAt');
+    if (typeof manifestInput.digestSha256 !== 'string' || !/^sha256:[a-f0-9]{64}$/u.test(manifestInput.digestSha256)) {
+        throw new TypeError('Domain control review document manifest digest is invalid.');
+    }
+    const expired = Date.parse(expiresAt) <= Date.parse(generatedAt);
+    if (manifestInput.expired !== expired) {
+        throw new TypeError('Domain control review document manifest currentness is inconsistent.');
+    }
+    const manifest = Object.freeze({
+        generatedAt: manifestGeneratedAt,
+        expiresAt,
+        digestSha256: manifestInput.digestSha256,
+        expired,
+    });
+    const countInput = exactReviewRecord(root.counts, REVIEW_COUNT_KEYS, 'Domain control review document counts');
+    const maximumComparisons = MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES * (DOMAIN_CONTROL_REVIEW_FIELDS.length + 1);
+    const suppliedCounts = Object.fromEntries(DOMAIN_CONTROL_REVIEW_COUNT_KEYS.map((state) => [
+        state,
+        exactReviewInteger(countInput[state], maximumComparisons, `Domain control review document count ${state}`),
+    ]));
+    const domainInput = boundedDataArray(root.domains, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES);
+    if (!domainInput || domainInput.length < 1) {
+        throw new TypeError('Domain control review document domains must be a bounded non-empty array.');
+    }
+    const comparisonFields = [...DOMAIN_CONTROL_REVIEW_FIELDS, 'renewalReviewAt'];
+    const comparisonStates = new Set(DOMAIN_CONTROL_REVIEW_COUNT_KEYS);
+    const calculatedCounts = Object.fromEntries(DOMAIN_CONTROL_REVIEW_COUNT_KEYS.map((state) => [state, 0]));
+    const domains = domainInput.map((domainValue, domainIndex) => {
+        const item = exactReviewRecord(domainValue, REVIEW_DOMAIN_KEYS, `Domain control review document domain ${domainIndex + 1}`);
+        const normalizedDomain = domain(item.domain);
+        if (!normalizedDomain || normalizedDomain !== item.domain) {
+            throw new TypeError(`Domain control review document domain ${domainIndex + 1} is invalid.`);
+        }
+        const comparisonsInput = boundedDataArray(item.comparisons, comparisonFields.length);
+        if (!comparisonsInput || comparisonsInput.length !== comparisonFields.length) {
+            throw new TypeError(`Domain control review document domain ${domainIndex + 1} comparisons are incomplete.`);
+        }
+        const comparisons = comparisonsInput.map((comparisonValue, comparisonIndex) => {
+            const comparison = exactReviewRecord(comparisonValue, REVIEW_COMPARISON_KEYS, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1}`);
+            const expectedField = comparisonFields[comparisonIndex];
+            if (comparison.field !== expectedField
+                || typeof comparison.state !== 'string'
+                || !comparisonStates.has(comparison.state)) {
+                throw new TypeError(`Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} is unsupported.`);
+            }
+            const state = comparison.state;
+            calculatedCounts[state] += 1;
+            const maximumValueCharacters = expectedField === 'ds'
+                ? MAX_DOMAIN_CONTROL_DS_PRESENTATION_LENGTH
+                : expectedField === 'caa'
+                    ? MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH
+                    : MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH;
+            const desired = exactReviewStringArray(comparison.desired, MAX_DOMAIN_CONTROL_RECORDS, maximumValueCharacters, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} desired values`);
+            const observed = exactReviewStringArray(comparison.observed, MAX_DOMAIN_CONTROL_RECORDS, maximumValueCharacters, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} observed values`);
+            const source = comparison.source === null
+                ? null
+                : exactReviewText(comparison.source, MAX_DOMAIN_CONTROL_REVIEW_SOURCE_LENGTH, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} source`);
+            const observedAt = comparison.observedAt === null
+                ? null
+                : exactReviewTimestamp(comparison.observedAt, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} observedAt`);
+            if (expectedField === 'renewalReviewAt' && (observed.length || source !== null || observedAt !== null)) {
+                throw new TypeError(`Domain control review document domain ${domainIndex + 1} renewal comparison is inconsistent.`);
+            }
+            return Object.freeze({
+                field: expectedField,
+                state,
+                desired,
+                observed,
+                source,
+                observedAt,
+                explanation: exactReviewText(comparison.explanation, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} explanation`),
+            });
+        });
+        const expectedState = comparisons.some((comparison) => comparison.state === 'drift' || comparison.state === 'due')
+            ? 'drift'
+            : comparisons.some((comparison) => comparison.state === 'partial'
+                || comparison.state === 'unavailable'
+                || comparison.state === 'unsupported')
+                ? 'partial'
+                : 'aligned';
+        if (item.state !== expectedState) {
+            throw new TypeError(`Domain control review document domain ${domainIndex + 1} state is inconsistent.`);
+        }
+        return Object.freeze({ domain: normalizedDomain, state: expectedState, comparisons: Object.freeze(comparisons) });
+    });
+    if (new Set(domains.map((item) => item.domain)).size !== domains.length) {
+        throw new TypeError('Domain control review document domains must be unique.');
+    }
+    for (const state of DOMAIN_CONTROL_REVIEW_COUNT_KEYS) {
+        if (suppliedCounts[state] !== calculatedCounts[state]) {
+            throw new TypeError('Domain control review document counts are inconsistent.');
+        }
+    }
+    const expectedState = expired
+        ? 'expired'
+        : domains.some((item) => item.state === 'drift')
+            ? 'drift'
+            : domains.some((item) => item.state === 'partial')
+                ? 'partial'
+                : 'aligned';
+    if (root.state !== expectedState)
+        throw new TypeError('Domain control review document state is inconsistent.');
+    const ignoredObservationCount = exactReviewInteger(root.ignoredObservationCount, MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS, 'Domain control review document ignored observation count');
+    const limitationsInput = boundedDataArray(root.limitations, DOMAIN_CONTROL_REVIEW_LIMITATIONS.length);
+    if (!limitationsInput
+        || limitationsInput.length !== DOMAIN_CONTROL_REVIEW_LIMITATIONS.length
+        || limitationsInput.some((item, index) => item !== DOMAIN_CONTROL_REVIEW_LIMITATIONS[index])) {
+        throw new TypeError('Domain control review document limitations are invalid.');
+    }
+    return Object.freeze({
+        schema: DOMAIN_CONTROL_REVIEW_SCHEMA,
+        version: DOMAIN_CONTROL_REVIEW_VERSION,
+        generatedAt,
+        state: expectedState,
+        manifest,
+        counts: Object.freeze(suppliedCounts),
+        domains: Object.freeze(domains),
+        ignoredObservationCount,
+        limitations: DOMAIN_CONTROL_REVIEW_LIMITATIONS,
     });
 }
 export function formatDomainControlResult(value) {

package/lib/domain-posture-analysis.mjs

@@ -10,10 +10,13 @@ const SPF_MAX_BRANCHES = 32;
 const MAX_DMARC_DESTINATIONS = 10;
 const MAX_DEPENDENCIES = 64;
 function strictHostname(value) {
-    const raw = String(value || '').trim().toLowerCase().replace(/\.+$/u, '');
+    const input = String(value || '').trim().replace(/\.+$/u, '');
+    if (/[^\x00-\x7f]/u.test(input))
+        return null;
+    const raw = input.toLowerCase();
     if (!raw || raw.length > 253 || raw.includes('%'))
         return null;
-    if (!raw.split('.').every((label) => /^(?:_?[a-z0-9](?:[a-z0-9_-]{0,61}[a-z0-9])?)$/iu.test(label)))
+    if (!raw.split('.').every((label) => /^(?:_?[a-z0-9](?:[a-z0-9_-]{0,61}[a-z0-9])?)$/u.test(label)))
         return null;
     return raw.includes('.') ? raw : null;
 }

package/lib/domain-posture.mjs

@@ -602,15 +602,18 @@ function buildPostureReport(domain, input) {
         summary[item.status] += 1;
     return { domain, summary, checks };
 }
-async function fetchMtaStsPolicy(domain) {
+async function fetchMtaStsPolicy(domain, fetcher = safeFetch) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), POLICY_TIMEOUT_MS);
     try {
         const url = `https://mta-sts.${domain}/.well-known/mta-sts.txt`;
-        const res = await safeFetch(url, {
+        // RFC 8461 section 3.3 requires a direct HTTPS 200 response and forbids
+        // following HTTP redirects for policy discovery. A zero-hop safe fetch
+        // also keeps the returned body bound to the required policy host/path.
+        const res = await fetcher(url, {
             signal: controller.signal,
             headers: whoisleuthRequestHeaders({ Accept: 'text/plain' }),
-        });
+        }, 0);
         if (!res.ok) {
             // Not reading this body - release it explicitly instead of leaving an
             // unconsumed stream (and the connection it's tied to) open until
@@ -743,4 +746,4 @@ async function checkDomainPosture(domain, { dkimSelectors = [], retiredDkimSelec
         externalDependencies,
     };
 }
-export { normalizeAuditDomain, normalizeDkimSelectors, normalizeMailProtectionProfile, matchesMtaPattern, buildPostureReport, checkDomainPosture, };
+export { normalizeAuditDomain, normalizeDkimSelectors, normalizeMailProtectionProfile, matchesMtaPattern, fetchMtaStsPolicy, buildPostureReport, checkDomainPosture, };

package/lib/encrypted-dns-contract.mjs

@@ -1,3 +1,4 @@
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 const ENCRYPTED_DNS_CONTRACT_SCHEMA = 'whoisleuth.encrypted-dns-adapter';
 const ENCRYPTED_DNS_CONTRACT_VERSION = 1;
 const DNS_TYPES = new Set(['A', 'AAAA', 'CAA', 'CNAME', 'DNSKEY', 'DS', 'HTTPS', 'MX', 'NS', 'RRSIG', 'SOA', 'SVCB', 'TLSA', 'TXT']);
@@ -28,9 +29,7 @@ function normalizeEncryptedDnsAdapter(value) {
     const endpoint = httpsUrl(source.endpoint);
     const termsUrl = httpsUrl(source.termsUrl);
     const privacyUrl = httpsUrl(source.privacyUrl);
-    const reviewedAt = typeof source.reviewedAt === 'string' && Number.isFinite(Date.parse(source.reviewedAt))
-        ? new Date(source.reviewedAt).toISOString()
-        : null;
+    const reviewedAt = normalizeExplicitIsoTimestamp(source.reviewedAt);
     const method = source.method === 'GET' || source.method === 'POST' ? source.method : null;
     const representation = source.representation === 'dns-json' || source.representation === 'dns-wire'
         ? source.representation