@slicedearth/whoisleuth-cli 1.47.4 → 2.0.0

package/lib/domain-control-manifest.mjs

@@ -1,37 +1,106 @@
 import { createHash } from 'node:crypto';
 import { domainToASCII } from 'node:url';
-import { canonicalArtifactJsonV2, SORTED_JSON_V2, } from "../frontend/src/lib/analysis/artifact-integrity.js";
-import { buildUnsignedDomainControlPassport, DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_PASSPORT_SCHEMA, MAX_DOMAIN_CONTROL_PASSPORT_ENTRIES, normalizeDomainControlPassportDocument, } from "../frontend/src/lib/analysis/domain-control-manifest-core.js";
-import { canonicalDomainControlRecordList } from "../frontend/src/lib/analysis/domain-control-records.js";
+import { canonicalArtifactJsonFor, } from "../packages/evidence/artifact-integrity.mjs";
+import { DOMAIN_CONTROL_MANIFEST_CURRENT_CANONICALIZATION, DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_MANIFEST_SCHEMA, DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_DS_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_INPUT_RECORDS, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH, } from "../packages/contracts/domain-control-manifest.mjs";
+import { DOMAIN_CONTROL_REVIEW_FIELDS, DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, DOMAIN_CONTROL_REVIEW_COUNT_KEYS, DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS, DOMAIN_CONTROL_REVIEW_INPUT_KEYS, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_LIMITATIONS, DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS, DOMAIN_CONTROL_REVIEW_OBSERVATION_FIELD_KEYS, DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS, DOMAIN_CONTROL_REVIEW_ROOT_KEYS, DOMAIN_CONTROL_REVIEW_SCHEMA, DOMAIN_CONTROL_REVIEW_VERSION, MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS, MAX_DOMAIN_CONTROL_REVIEW_SOURCE_LENGTH, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH, } from "../packages/contracts/domain-control-review.mjs";
+import { assertDomainControlManifestByteBudget, buildUnsignedDomainControlManifest, canonicalDomainControlRecordList, normalizeDomainControlManifestDocument, } from "../packages/evidence/domain-control-runtime.mjs";
 import { exactKeys } from "./bounded-contract-normalizers.mjs";
-export const DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA = DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA;
-export const DOMAIN_CONTROL_MANIFEST_SCHEMA = DOMAIN_CONTROL_PASSPORT_SCHEMA;
-export { DOMAIN_CONTROL_MANIFEST_VERSION };
-export const DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA = 'whoisleuth.domain-control-review-input';
-export const DOMAIN_CONTROL_REVIEW_SCHEMA = 'whoisleuth.domain-control-review';
-export const DOMAIN_CONTROL_REVIEW_VERSION = 1;
-export const MAX_DOMAIN_CONTROL_ENTRIES = MAX_DOMAIN_CONTROL_PASSPORT_ENTRIES;
-export const MAX_DOMAIN_CONTROL_RECORDS = 32;
-const REVIEW_INPUT_KEYS = new Set(['schema', 'version', 'manifest', 'observations']);
-const OBSERVATION_KEYS = new Set(['domain', 'fields']);
-const OBSERVATION_FIELDS = new Set(['nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock']);
-const OBSERVATION_FIELD_KEYS = new Set(['state', 'values', 'source', 'observedAt']);
+import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "../packages/evidence/observation.mjs";
+export { DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_SCHEMA, DOMAIN_CONTROL_REVIEW_VERSION, };
+export const MAX_DOMAIN_CONTROL_ENTRIES = MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES;
+export const MAX_DOMAIN_CONTROL_RECORDS = MAX_CANONICAL_DOMAIN_CONTROL_RECORDS;
+const REVIEW_INPUT_KEYS = new Set(DOMAIN_CONTROL_REVIEW_INPUT_KEYS);
+const OBSERVATION_KEYS = new Set(DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS);
+const OBSERVATION_FIELDS = new Set(DOMAIN_CONTROL_REVIEW_FIELDS);
+const OBSERVATION_FIELD_KEYS = new Set(DOMAIN_CONTROL_REVIEW_OBSERVATION_FIELD_KEYS);
+const REVIEW_ROOT_KEYS = new Set(DOMAIN_CONTROL_REVIEW_ROOT_KEYS);
+const REVIEW_MANIFEST_KEYS = new Set(DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS);
+const REVIEW_COUNT_KEYS = new Set(DOMAIN_CONTROL_REVIEW_COUNT_KEYS);
+const REVIEW_DOMAIN_KEYS = new Set(DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS);
+const REVIEW_COMPARISON_KEYS = new Set(DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
         : null;
 }
+function exactReviewRecord(value, keys, label) {
+    try {
+        if (!value || typeof value !== 'object' || Array.isArray(value)) {
+            throw new TypeError(`${label} must be an object.`);
+        }
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw new TypeError(`${label} must be an ordinary object.`);
+        }
+        const ownKeys = Reflect.ownKeys(value);
+        if (ownKeys.length !== keys.size
+            || ownKeys.some((key) => typeof key !== 'string' || !keys.has(key))) {
+            throw new TypeError(`${label} must use its exact registered fields.`);
+        }
+        const result = {};
+        for (const key of keys) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (!descriptor || !descriptor.enumerable || !('value' in descriptor)) {
+                throw new TypeError(`${label}.${key} must be an enumerable data field.`);
+            }
+            result[key] = descriptor.value;
+        }
+        return Object.freeze(result);
+    }
+    catch (cause) {
+        if (cause instanceof TypeError && cause.message.startsWith(label))
+            throw cause;
+        throw new TypeError(`${label} must be an ordinary object.`);
+    }
+}
+function exactReviewText(value, maximum, label) {
+    const normalized = boundedText(value, maximum);
+    if (!normalized || normalized !== value) {
+        throw new TypeError(`${label} must be a canonical bounded string.`);
+    }
+    return normalized;
+}
+function exactReviewTimestamp(value, label) {
+    const normalized = timestamp(value);
+    if (!normalized || normalized !== value)
+        throw new TypeError(`${label} must be a canonical timestamp.`);
+    return normalized;
+}
+function exactReviewInteger(value, maximum, label) {
+    if (!Number.isSafeInteger(value) || Number(value) < 0 || Number(value) > maximum) {
+        throw new TypeError(`${label} must be a bounded non-negative integer.`);
+    }
+    return Number(value);
+}
+function exactReviewStringArray(value, maximumItems, maximumCharacters, label) {
+    const input = boundedDataArray(value, maximumItems);
+    if (!input)
+        throw new TypeError(`${label} must be a bounded array.`);
+    const output = input.map((item, index) => exactReviewText(item, maximumCharacters, `${label}[${index}]`));
+    if (new Set(output).size !== output.length
+        || output.some((item, index) => index > 0 && output[index - 1] >= item)) {
+        throw new TypeError(`${label} must contain unique canonically ordered values.`);
+    }
+    return Object.freeze(output);
+}
 function boundedText(value, maximum = 300) {
-    if (typeof value !== 'string' || value.length > maximum * 4 || /[\u0000-\u001f\u007f]/u.test(value))
+    if (typeof value !== 'string'
+        || value.length > maximum * DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR
+        || /[\u0000-\u001f\u007f]/u.test(value))
         return null;
     return value.replace(/\s+/gu, ' ').trim().slice(0, maximum) || null;
 }
-function timestamp(value) {
-    const text = boundedText(value, 64);
-    if (!text)
+function timestamp(value, legacy = false) {
+    if (typeof value !== 'string'
+        || value.length > MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH * DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR
+        || /[\u0000-\u001f\u007f]/u.test(value))
         return null;
-    const parsed = Date.parse(text);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+    const text = value.replace(/\s+/gu, ' ').trim();
+    if (!text || text.length > MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH)
+        return null;
+    return text
+        ? normalizeExplicitIsoTimestamp(text) ?? (legacy ? normalizeLegacyIsoTimestamp(text) : null)
+        : null;
 }
 function domain(value) {
     const text = boundedText(value, 253)?.toLowerCase().replace(/\.$/u, '');
@@ -43,59 +112,110 @@ function domain(value) {
     return ascii;
 }
 function hostnameList(value) {
-    if (!Array.isArray(value))
-        return [];
-    return [...new Set(value.slice(0, MAX_DOMAIN_CONTROL_RECORDS * 4)
+    return [...new Set(value
             .map(domain)
             .filter((item) => item !== null))]
         .sort()
         .slice(0, MAX_DOMAIN_CONTROL_RECORDS);
 }
 function textList(value, maximum = 300) {
-    if (!Array.isArray(value))
-        return [];
-    return [...new Set(value.slice(0, MAX_DOMAIN_CONTROL_RECORDS * 4)
+    return [...new Set(value
             .map((item) => boundedText(item, maximum)?.toLowerCase() ?? null)
             .filter((item) => item !== null))]
         .sort()
         .slice(0, MAX_DOMAIN_CONTROL_RECORDS);
 }
 function spkiFingerprint(value) {
-    const text = boundedText(value, 64)?.toLowerCase();
+    if (typeof value !== 'string'
+        || value.length > 64 * DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR
+        || /[\u0000-\u001f\u007f]/u.test(value))
+        return null;
+    const text = value.trim().toLowerCase();
     return text && /^[a-f0-9]{64}$/u.test(text) ? text : null;
 }
 export function buildDomainControlManifest(input, generatedAtValue = new Date().toISOString()) {
-    const unsigned = buildUnsignedDomainControlPassport(input, generatedAtValue);
-    return Object.freeze({
+    const unsigned = buildUnsignedDomainControlManifest(input, generatedAtValue);
+    const manifest = Object.freeze({
         ...unsigned,
         integrity: Object.freeze({
             algorithm: 'SHA-256',
-            canonicalization: SORTED_JSON_V2,
-            digestSha256: `sha256:${createHash('sha256').update(canonicalArtifactJsonV2(unsigned)).digest('hex')}`,
+            canonicalization: DOMAIN_CONTROL_MANIFEST_CURRENT_CANONICALIZATION,
+            digestSha256: `sha256:${createHash('sha256').update(canonicalArtifactJsonFor(unsigned, DOMAIN_CONTROL_MANIFEST_CURRENT_CANONICALIZATION)).digest('hex')}`,
         }),
     });
+    assertDomainControlManifestByteBudget(manifest);
+    return manifest;
 }
 export function verifyDomainControlManifest(value) {
-    const normalized = normalizeDomainControlPassportDocument(value);
+    const normalized = normalizeDomainControlManifestDocument(value);
     if (`sha256:${createHash('sha256').update(normalized.canonicalUnsigned).digest('hex')}` !== normalized.manifest.integrity.digestSha256) {
         throw new TypeError('Domain control manifest failed its SHA-256 integrity check.');
     }
     return normalized.manifest;
 }
+function boundedDataArray(value, maximum) {
+    try {
+        if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype)
+            return null;
+        if (Object.getOwnPropertyDescriptor(value, Symbol.iterator)
+            || Object.getOwnPropertyDescriptor(value, 'toJSON'))
+            return null;
+        const lengthDescriptor = Object.getOwnPropertyDescriptor(value, 'length');
+        const length = lengthDescriptor && !lengthDescriptor.enumerable && 'value' in lengthDescriptor
+            ? lengthDescriptor.value
+            : null;
+        if (!Number.isSafeInteger(length)
+            || Number(length) < 0
+            || Number(length) > maximum)
+            return null;
+        const boundedLength = Number(length);
+        const keys = Reflect.ownKeys(value);
+        if (keys.length !== boundedLength + 1 || !keys.includes('length'))
+            return null;
+        const result = [];
+        for (let index = 0; index < boundedLength; index += 1) {
+            const key = String(index);
+            if (!keys.includes(key))
+                return null;
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (!descriptor || !descriptor.enumerable || !('value' in descriptor))
+                return null;
+            result.push(descriptor.value);
+        }
+        return result;
+    }
+    catch {
+        return null;
+    }
+}
 function fieldValues(field, value) {
-    if (field === 'nameservers')
-        return hostnameList(value);
-    if (field === 'mx' || field === 'caa' || field === 'ds')
-        return canonicalDomainControlRecordList(Array.isArray(value) ? value : [value], field);
+    if (field === 'nameservers') {
+        const normalized = value.map(domain);
+        return normalized.some((item) => item === null)
+            ? null
+            : hostnameList(normalized);
+    }
+    if (field === 'mx' || field === 'caa' || field === 'ds') {
+        const normalized = value.flatMap((item) => canonicalDomainControlRecordList([item], field));
+        return normalized.length === value.length
+            ? [...new Set(normalized)].sort().slice(0, MAX_DOMAIN_CONTROL_RECORDS)
+            : null;
+    }
     if (field === 'tlsSpkiSha256') {
-        const normalized = Array.isArray(value) ? value.map(spkiFingerprint).filter(Boolean) : [spkiFingerprint(value)].filter(Boolean);
-        return [...new Set(normalized)].sort().slice(0, MAX_DOMAIN_CONTROL_RECORDS);
+        const normalized = value.map(spkiFingerprint);
+        return normalized.some((item) => item === null)
+            ? null
+            : [...new Set(normalized)].sort().slice(0, MAX_DOMAIN_CONTROL_RECORDS);
     }
     if (field === 'registrarLock') {
-        const values = Array.isArray(value) ? value : [value];
-        return [...new Set(values.filter((item) => item === 'required' || item === 'not_required'))];
+        return value.every((item) => item === 'required' || item === 'not_required')
+            ? [...new Set(value)].sort()
+            : null;
     }
-    return textList(Array.isArray(value) ? value : [value], 500);
+    const normalized = value.map((item) => boundedText(item, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH)?.toLowerCase() ?? null);
+    return normalized.some((item) => item === null)
+        ? null
+        : textList(normalized, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH);
 }
 function normalizeObservation(value) {
     const source = record(value);
@@ -106,22 +226,31 @@ function normalizeObservation(value) {
     exactKeys(source, OBSERVATION_KEYS, 'Domain control observation');
     exactKeys(rawFields, OBSERVATION_FIELDS, 'Domain control observation fields');
     const fields = {};
-    for (const field of ['nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock']) {
+    for (const field of DOMAIN_CONTROL_REVIEW_FIELDS) {
+        if (!Object.hasOwn(rawFields, field))
+            continue;
         const raw = record(rawFields[field]);
         if (!raw)
-            continue;
+            return null;
         exactKeys(raw, OBSERVATION_FIELD_KEYS, `Domain control observation field ${field}`);
+        if (!DOMAIN_CONTROL_REVIEW_OBSERVATION_FIELD_KEYS.every((key) => Object.hasOwn(raw, key)))
+            return null;
         const state = raw.state;
         if (state !== 'observed' && state !== 'partial' && state !== 'unavailable' && state !== 'unsupported')
             return null;
-        const sourceLabel = boundedText(raw.source, 120);
-        if (!sourceLabel)
+        const sourceLabel = boundedText(raw.source, MAX_DOMAIN_CONTROL_REVIEW_SOURCE_LENGTH);
+        const values = boundedDataArray(raw.values, MAX_DOMAIN_CONTROL_INPUT_RECORDS);
+        if (!sourceLabel || !values)
+            return null;
+        const normalizedValues = fieldValues(field, values);
+        const observedAt = raw.observedAt === null ? null : timestamp(raw.observedAt, true);
+        if (!normalizedValues || (raw.observedAt !== null && !observedAt))
             return null;
         fields[field] = Object.freeze({
             state,
-            values: Object.freeze(fieldValues(field, raw.values)),
+            values: Object.freeze(normalizedValues),
             source: sourceLabel,
-            observedAt: timestamp(raw.observedAt),
+            observedAt,
         });
     }
     return Object.freeze({ domain: normalizedDomain, fields: Object.freeze(fields) });
@@ -187,18 +316,19 @@ function renewalComparison(entry, now) {
 }
 export function reviewDomainControlManifest(input, generatedAtValue = new Date().toISOString()) {
     const source = record(input);
-    if (!source || source.schema !== DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA || source.version !== 1) {
-        throw new TypeError(`Domain control review input must use ${DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA} version 1.`);
+    if (!source || source.schema !== DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA || source.version !== DOMAIN_CONTROL_REVIEW_VERSION) {
+        throw new TypeError(`Domain control review input must use ${DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA} version ${DOMAIN_CONTROL_REVIEW_VERSION}.`);
     }
     exactKeys(source, REVIEW_INPUT_KEYS, 'Domain control review input');
     const generatedAt = timestamp(generatedAtValue);
     if (!generatedAt)
-        throw new TypeError('Domain control review time is invalid.');
+        throw new TypeError('Domain control review time must be valid and include an explicit timezone.');
     const manifest = verifyDomainControlManifest(source.manifest);
-    if (!Array.isArray(source.observations) || source.observations.length > MAX_DOMAIN_CONTROL_ENTRIES * 2) {
+    const rawObservations = boundedDataArray(source.observations, MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS);
+    if (!rawObservations) {
         throw new TypeError('Domain control observations must be a bounded array.');
     }
-    const observations = source.observations.map(normalizeObservation);
+    const observations = rawObservations.map(normalizeObservation);
     if (observations.some((item) => item === null))
         throw new TypeError('Domain control review contains an invalid observation.');
     const normalizedObservations = observations;
@@ -206,7 +336,7 @@ export function reviewDomainControlManifest(input, generatedAtValue = new Date()
         throw new TypeError('Domain control observations must use unique domains.');
     }
     const observationMap = new Map(normalizedObservations.map((item) => [item.domain, item]));
-    const fields = ['nameservers', 'ds', 'mx', 'caa', 'tlsIssuer', 'tlsSpkiSha256', 'registrarLock'];
+    const fields = DOMAIN_CONTROL_REVIEW_FIELDS;
     const domains = manifest.entries.map((entry) => {
         const observation = observationMap.get(entry.domain) ?? null;
         const comparisons = [...fields.map((field) => compareField(entry, observation, field)), renewalComparison(entry, generatedAt)];
@@ -235,11 +365,136 @@ export function reviewDomainControlManifest(input, generatedAtValue = new Date()
         counts: Object.freeze(counts),
         domains: Object.freeze(domains),
         ignoredObservationCount: normalizedObservations.filter((item) => !manifest.entries.some((entry) => entry.domain === item.domain)).length,
-        limitations: Object.freeze([
-            'This local review compares analyst-authored desired state with separately supplied observations and performs no collection or configuration change.',
-            'Only complete observations can produce drift. Partial, unavailable, unsupported, or missing evidence remains inconclusive.',
-            'A valid manifest digest or signature establishes file integrity, not the correctness of the desired state or supplied observations.',
-        ]),
+        limitations: DOMAIN_CONTROL_REVIEW_LIMITATIONS,
+    });
+}
+export function validateDomainControlReviewDocument(value) {
+    const root = exactReviewRecord(value, REVIEW_ROOT_KEYS, 'Domain control review document');
+    if (root.schema !== DOMAIN_CONTROL_REVIEW_SCHEMA || root.version !== DOMAIN_CONTROL_REVIEW_VERSION) {
+        throw new TypeError(`Domain control review document must use ${DOMAIN_CONTROL_REVIEW_SCHEMA} version ${DOMAIN_CONTROL_REVIEW_VERSION}.`);
+    }
+    const generatedAt = exactReviewTimestamp(root.generatedAt, 'Domain control review document generatedAt');
+    const manifestInput = exactReviewRecord(root.manifest, REVIEW_MANIFEST_KEYS, 'Domain control review document manifest');
+    const manifestGeneratedAt = exactReviewTimestamp(manifestInput.generatedAt, 'Domain control review document manifest generatedAt');
+    const expiresAt = exactReviewTimestamp(manifestInput.expiresAt, 'Domain control review document manifest expiresAt');
+    if (typeof manifestInput.digestSha256 !== 'string' || !/^sha256:[a-f0-9]{64}$/u.test(manifestInput.digestSha256)) {
+        throw new TypeError('Domain control review document manifest digest is invalid.');
+    }
+    const expired = Date.parse(expiresAt) <= Date.parse(generatedAt);
+    if (manifestInput.expired !== expired) {
+        throw new TypeError('Domain control review document manifest currentness is inconsistent.');
+    }
+    const manifest = Object.freeze({
+        generatedAt: manifestGeneratedAt,
+        expiresAt,
+        digestSha256: manifestInput.digestSha256,
+        expired,
+    });
+    const countInput = exactReviewRecord(root.counts, REVIEW_COUNT_KEYS, 'Domain control review document counts');
+    const maximumComparisons = MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES * (DOMAIN_CONTROL_REVIEW_FIELDS.length + 1);
+    const suppliedCounts = Object.fromEntries(DOMAIN_CONTROL_REVIEW_COUNT_KEYS.map((state) => [
+        state,
+        exactReviewInteger(countInput[state], maximumComparisons, `Domain control review document count ${state}`),
+    ]));
+    const domainInput = boundedDataArray(root.domains, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES);
+    if (!domainInput || domainInput.length < 1) {
+        throw new TypeError('Domain control review document domains must be a bounded non-empty array.');
+    }
+    const comparisonFields = [...DOMAIN_CONTROL_REVIEW_FIELDS, 'renewalReviewAt'];
+    const comparisonStates = new Set(DOMAIN_CONTROL_REVIEW_COUNT_KEYS);
+    const calculatedCounts = Object.fromEntries(DOMAIN_CONTROL_REVIEW_COUNT_KEYS.map((state) => [state, 0]));
+    const domains = domainInput.map((domainValue, domainIndex) => {
+        const item = exactReviewRecord(domainValue, REVIEW_DOMAIN_KEYS, `Domain control review document domain ${domainIndex + 1}`);
+        const normalizedDomain = domain(item.domain);
+        if (!normalizedDomain || normalizedDomain !== item.domain) {
+            throw new TypeError(`Domain control review document domain ${domainIndex + 1} is invalid.`);
+        }
+        const comparisonsInput = boundedDataArray(item.comparisons, comparisonFields.length);
+        if (!comparisonsInput || comparisonsInput.length !== comparisonFields.length) {
+            throw new TypeError(`Domain control review document domain ${domainIndex + 1} comparisons are incomplete.`);
+        }
+        const comparisons = comparisonsInput.map((comparisonValue, comparisonIndex) => {
+            const comparison = exactReviewRecord(comparisonValue, REVIEW_COMPARISON_KEYS, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1}`);
+            const expectedField = comparisonFields[comparisonIndex];
+            if (comparison.field !== expectedField
+                || typeof comparison.state !== 'string'
+                || !comparisonStates.has(comparison.state)) {
+                throw new TypeError(`Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} is unsupported.`);
+            }
+            const state = comparison.state;
+            calculatedCounts[state] += 1;
+            const maximumValueCharacters = expectedField === 'ds'
+                ? MAX_DOMAIN_CONTROL_DS_PRESENTATION_LENGTH
+                : expectedField === 'caa'
+                    ? MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH
+                    : MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH;
+            const desired = exactReviewStringArray(comparison.desired, MAX_DOMAIN_CONTROL_RECORDS, maximumValueCharacters, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} desired values`);
+            const observed = exactReviewStringArray(comparison.observed, MAX_DOMAIN_CONTROL_RECORDS, maximumValueCharacters, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} observed values`);
+            const source = comparison.source === null
+                ? null
+                : exactReviewText(comparison.source, MAX_DOMAIN_CONTROL_REVIEW_SOURCE_LENGTH, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} source`);
+            const observedAt = comparison.observedAt === null
+                ? null
+                : exactReviewTimestamp(comparison.observedAt, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} observedAt`);
+            if (expectedField === 'renewalReviewAt' && (observed.length || source !== null || observedAt !== null)) {
+                throw new TypeError(`Domain control review document domain ${domainIndex + 1} renewal comparison is inconsistent.`);
+            }
+            return Object.freeze({
+                field: expectedField,
+                state,
+                desired,
+                observed,
+                source,
+                observedAt,
+                explanation: exactReviewText(comparison.explanation, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} explanation`),
+            });
+        });
+        const expectedState = comparisons.some((comparison) => comparison.state === 'drift' || comparison.state === 'due')
+            ? 'drift'
+            : comparisons.some((comparison) => comparison.state === 'partial'
+                || comparison.state === 'unavailable'
+                || comparison.state === 'unsupported')
+                ? 'partial'
+                : 'aligned';
+        if (item.state !== expectedState) {
+            throw new TypeError(`Domain control review document domain ${domainIndex + 1} state is inconsistent.`);
+        }
+        return Object.freeze({ domain: normalizedDomain, state: expectedState, comparisons: Object.freeze(comparisons) });
+    });
+    if (new Set(domains.map((item) => item.domain)).size !== domains.length) {
+        throw new TypeError('Domain control review document domains must be unique.');
+    }
+    for (const state of DOMAIN_CONTROL_REVIEW_COUNT_KEYS) {
+        if (suppliedCounts[state] !== calculatedCounts[state]) {
+            throw new TypeError('Domain control review document counts are inconsistent.');
+        }
+    }
+    const expectedState = expired
+        ? 'expired'
+        : domains.some((item) => item.state === 'drift')
+            ? 'drift'
+            : domains.some((item) => item.state === 'partial')
+                ? 'partial'
+                : 'aligned';
+    if (root.state !== expectedState)
+        throw new TypeError('Domain control review document state is inconsistent.');
+    const ignoredObservationCount = exactReviewInteger(root.ignoredObservationCount, MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS, 'Domain control review document ignored observation count');
+    const limitationsInput = boundedDataArray(root.limitations, DOMAIN_CONTROL_REVIEW_LIMITATIONS.length);
+    if (!limitationsInput
+        || limitationsInput.length !== DOMAIN_CONTROL_REVIEW_LIMITATIONS.length
+        || limitationsInput.some((item, index) => item !== DOMAIN_CONTROL_REVIEW_LIMITATIONS[index])) {
+        throw new TypeError('Domain control review document limitations are invalid.');
+    }
+    return Object.freeze({
+        schema: DOMAIN_CONTROL_REVIEW_SCHEMA,
+        version: DOMAIN_CONTROL_REVIEW_VERSION,
+        generatedAt,
+        state: expectedState,
+        manifest,
+        counts: Object.freeze(suppliedCounts),
+        domains: Object.freeze(domains),
+        ignoredObservationCount,
+        limitations: DOMAIN_CONTROL_REVIEW_LIMITATIONS,
     });
 }
 export function formatDomainControlResult(value) {

package/lib/domain-posture-analysis.mjs

@@ -10,10 +10,13 @@ const SPF_MAX_BRANCHES = 32;
 const MAX_DMARC_DESTINATIONS = 10;
 const MAX_DEPENDENCIES = 64;
 function strictHostname(value) {
-    const raw = String(value || '').trim().toLowerCase().replace(/\.+$/u, '');
+    const input = String(value || '').trim().replace(/\.+$/u, '');
+    if (/[^\x00-\x7f]/u.test(input))
+        return null;
+    const raw = input.toLowerCase();
     if (!raw || raw.length > 253 || raw.includes('%'))
         return null;
-    if (!raw.split('.').every((label) => /^(?:_?[a-z0-9](?:[a-z0-9_-]{0,61}[a-z0-9])?)$/iu.test(label)))
+    if (!raw.split('.').every((label) => /^(?:_?[a-z0-9](?:[a-z0-9_-]{0,61}[a-z0-9])?)$/u.test(label)))
         return null;
     return raw.includes('.') ? raw : null;
 }

package/lib/encrypted-dns-contract.mjs

@@ -1,3 +1,4 @@
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 const ENCRYPTED_DNS_CONTRACT_SCHEMA = 'whoisleuth.encrypted-dns-adapter';
 const ENCRYPTED_DNS_CONTRACT_VERSION = 1;
 const DNS_TYPES = new Set(['A', 'AAAA', 'CAA', 'CNAME', 'DNSKEY', 'DS', 'HTTPS', 'MX', 'NS', 'RRSIG', 'SOA', 'SVCB', 'TLSA', 'TXT']);
@@ -28,9 +29,7 @@ function normalizeEncryptedDnsAdapter(value) {
     const endpoint = httpsUrl(source.endpoint);
     const termsUrl = httpsUrl(source.termsUrl);
     const privacyUrl = httpsUrl(source.privacyUrl);
-    const reviewedAt = typeof source.reviewedAt === 'string' && Number.isFinite(Date.parse(source.reviewedAt))
-        ? new Date(source.reviewedAt).toISOString()
-        : null;
+    const reviewedAt = normalizeExplicitIsoTimestamp(source.reviewedAt);
     const method = source.method === 'GET' || source.method === 'POST' ? source.method : null;
     const representation = source.representation === 'dns-json' || source.representation === 'dns-wire'
         ? source.representation