@slicedearth/whoisleuth-cli 2.1.0 → 2.3.0

package/packages/contracts/cli-command-semantics.mjs

@@ -0,0 +1,93 @@
+export const CAPABILITY_IDS = Object.freeze({
+    LOOKUP: 'lookup',
+    RDAP: 'rdap',
+    RDAP_NAMESERVER_SEARCH: 'rdap_nameserver_search',
+    WHOIS: 'whois',
+    AVAILABILITY: 'availability',
+    DOMAIN_EVIDENCE: 'domain_evidence',
+    DNS_INTELLIGENCE: 'dns_intelligence',
+    WEBSITE_PROBE: 'website_probe',
+    TLS_INTELLIGENCE: 'tls_intelligence',
+    CERTIFICATE_TRANSPARENCY: 'certificate_transparency',
+    SECURITY_TXT: 'security_txt',
+    EXTERNAL_INTELLIGENCE: 'external_intelligence',
+    URLSCAN_SEARCH: 'urlscan_search',
+    URLHAUS_HOST: 'urlhaus_host',
+    THREATFOX_DOMAIN_IOC: 'threatfox_domain_ioc',
+    REGISTRAR_RDAP: 'registrar_rdap',
+    NETWORK_CONTEXT: 'network_context',
+    REVERSE_DNS: 'reverse_dns',
+    DOMAIN_POSTURE: 'domain_posture',
+    DNSSEC_VALIDATION: 'dnssec_validation',
+    MAIL_TRANSPORT_REVIEW: 'mail_transport_review',
+    RENDERED_WEB_CAPTURE: 'rendered_web_capture',
+    RENDERED_CAPTURE_COMPARISON: 'rendered_capture_comparison',
+    IDN_CONFUSABLES: 'idn_confusables',
+    ANALYST_CASES: 'analyst_cases',
+    WATCHLISTS: 'watchlists',
+    OFFLINE_REVIEW: 'offline_review',
+    PORTABLE_EVIDENCE: 'portable_evidence',
+    RUNTIME_DIAGNOSTICS: 'runtime_diagnostics',
+    WORKFLOW_EXECUTION: 'workflow_execution',
+    SCHEDULED_MONITORING: 'scheduled_monitoring',
+    DISTRIBUTED_BUDGETS: 'distributed_budgets',
+});
+export const CLI_HELP_GROUP_ORDER = Object.freeze([
+    'investigate',
+    'respond',
+    'assure',
+    'utilities',
+]);
+function semantic(group, capabilityFamilyId) {
+    return Object.freeze({ group, capabilityFamilyId });
+}
+export const CLI_COMMAND_SEMANTICS = Object.freeze({
+    completion: semantic('utilities', CAPABILITY_IDS.OFFLINE_REVIEW),
+    doctor: semantic('utilities', CAPABILITY_IDS.RUNTIME_DIAGNOSTICS),
+    commands: semantic('utilities', CAPABILITY_IDS.OFFLINE_REVIEW),
+    manual: semantic('utilities', CAPABILITY_IDS.OFFLINE_REVIEW),
+    manifest: semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'map-observations': semantic('respond', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'oam-export': semantic('respond', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    lookup: semantic('investigate', CAPABILITY_IDS.LOOKUP),
+    bulk: semantic('investigate', CAPABILITY_IDS.LOOKUP),
+    'ct-search': semantic('investigate', CAPABILITY_IDS.CERTIFICATE_TRANSPARENCY),
+    'ct-intake': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    discover: semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'discover-scan': semantic('investigate', CAPABILITY_IDS.LOOKUP),
+    posture: semantic('investigate', CAPABILITY_IDS.DOMAIN_POSTURE),
+    http: semantic('investigate', CAPABILITY_IDS.WEBSITE_PROBE),
+    tls: semantic('investigate', CAPABILITY_IDS.TLS_INTELLIGENCE),
+    'dnssec-validate': semantic('assure', CAPABILITY_IDS.DNSSEC_VALIDATION),
+    'mail-transport': semantic('assure', CAPABILITY_IDS.MAIL_TRANSPORT_REVIEW),
+    'registry-support': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'registry-doctor': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'registry-cohort': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'registry-scaffold': semantic('utilities', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'risk-calibrate': semantic('assure', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'lookalike-calibrate': semantic('assure', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'verify-artifact': semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'interchange-report': semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'inspect-archive': semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'sign-artifact': semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'verify-signature': semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'source-report': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    compare: semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'page-compare': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'mail-review': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'mail-headers': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'review-evidence': semantic('investigate', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    brief: semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'case-pack': semantic('respond', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'domain-control': semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'monitor-once': semantic('assure', CAPABILITY_IDS.LOOKUP),
+    assurance: semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'change-packet': semantic('respond', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'sharing-review': semantic('respond', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'workflow-plan': semantic('assure', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'workflow-run': semantic('assure', CAPABILITY_IDS.WORKFLOW_EXECUTION),
+    diff: semantic('assure', CAPABILITY_IDS.OFFLINE_REVIEW),
+    reconcile: semantic('assure', CAPABILITY_IDS.OFFLINE_REVIEW),
+    timeline: semantic('assure', CAPABILITY_IDS.OFFLINE_REVIEW),
+    export: semantic('respond', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+});

package/packages/contracts/risk-calibration.mjs

@@ -158,6 +158,15 @@ export const RISK_CALIBRATION_REPORT_PRIVACY_KEYS = Object.freeze([
 export const RISK_CALIBRATION_REPORT_INTERPRETATION_KEYS = Object.freeze([
     'authority', 'statement', 'automaticTuning', 'networkRequests', 'persisted',
 ]);
+/** Stable disposition identities admitted by the versioned calibration schema. */
+export const RISK_CALIBRATION_DISPOSITIONS = Object.freeze([
+    'unreviewed',
+    'suspicious',
+    'confirmed_abuse',
+    'false_positive',
+    'expected',
+    'closed_no_action',
+]);
 export const RISK_CALIBRATION_DATASET_COMPATIBILITY = defineSchemaCompatibility({
     id: 'cli.risk-calibration-dataset',
     kind: 'cli_document',
@@ -337,8 +346,8 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
         {
             id: 'risk-calibration-report-v3-detailed',
             path: 'test/fixtures/risk-calibration-report-v3-detailed.json',
-            bytes: 7_026,
-            sha256: '5c0c435e81478e90bc0b64aa7c20fd82d131b5261a57d9550df3f03334bc20e1',
+            bytes: 7_020,
+            sha256: 'a5cba1681c170c79f8891037f47efc93e0ae6ce5d247418ff3f1c9a81a352922',
             contentDigestSha256: null,
             schema: RISK_CALIBRATION_REPORT_SCHEMA,
             version: RISK_CALIBRATION_REPORT_VERSION,
@@ -351,8 +360,8 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
         {
             id: 'risk-calibration-report-v3-summary',
             path: 'test/fixtures/risk-calibration-report-v3-summary.json',
-            bytes: 5_486,
-            sha256: 'b06c312eed14680ce30fd58a84a93908d29ea9e71bfee8174b90df286b730549',
+            bytes: 5_480,
+            sha256: '71b7fe1ee613b2ab32bd1f5646ee765985022c904224e1a08f4577c1d1d06240',
             contentDigestSha256: null,
             schema: RISK_CALIBRATION_REPORT_SCHEMA,
             version: RISK_CALIBRATION_REPORT_VERSION,
@@ -1110,9 +1119,7 @@ const FACTOR_SPEC = objectOf([
 const REPORT_RECORD_SPEC = objectOf([
     { key: 'id', value: boundedText(MAX_RISK_CALIBRATION_RECORD_ID_LENGTH) },
     { key: 'domain', value: boundedText(MAX_RISK_CALIBRATION_DOMAIN_LENGTH) },
-    { key: 'analystDisposition', value: boundedText(MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, [
-            'unreviewed', 'suspicious', 'confirmed_abuse', 'false_positive', 'expected', 'closed_no_action',
-        ]) },
+    { key: 'analystDisposition', value: boundedText(MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, RISK_CALIBRATION_DISPOSITIONS) },
     { key: 'reviewReasonCode', value: nullable(boundedText(MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH)) },
     { key: 'interoperabilityTags', value: arrayOf(boundedText(MAX_RISK_CALIBRATION_STRING_LENGTH), 0, 32) },
     { key: 'metricClass', value: boundedText(16, ['positive', 'negative', 'excluded']) },
@@ -1179,9 +1186,7 @@ const DATASET_EVIDENCE_SPEC = objectOf([
 const DATASET_RECORD_SPEC = objectOf([
     { key: 'id', value: boundedText(MAX_RISK_CALIBRATION_RECORD_ID_LENGTH, null, 1, canonicalRiskCalibrationIdentifier) },
     { key: 'domain', value: boundedText(MAX_RISK_CALIBRATION_DOMAIN_LENGTH, null, 1, validRiskCalibrationDomain) },
-    { key: 'analystDisposition', value: boundedText(MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, [
-            'unreviewed', 'suspicious', 'confirmed_abuse', 'false_positive', 'expected', 'closed_no_action',
-        ]) },
+    { key: 'analystDisposition', value: boundedText(MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, RISK_CALIBRATION_DISPOSITIONS) },
     { key: 'reviewReasonCode', value: boundedText(MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH, RISK_CALIBRATION_REVIEW_REASON_VALUES), optional: true },
     { key: 'evidence', value: DATASET_EVIDENCE_SPEC },
 ]);

package/packages/contracts/workspace-portability.mjs

@@ -4,8 +4,13 @@ import { defineSchemaLifecycleFamily, } from "./schema-lifecycle.mjs";
 export const WORKSPACE_CONTRACT_OWNER = 'packages/contracts/workspace-portability.mts';
 export const BRAND_PROFILE_SCHEMA = 'whoisleuth.brand-profiles';
 export const PUBLIC_BRAND_PROFILE_SCHEMA_VERSION = 6;
-export const BRAND_PROFILE_SCHEMA_VERSION = 7;
-export const BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS = Object.freeze([PUBLIC_BRAND_PROFILE_SCHEMA_VERSION, BRAND_PROFILE_SCHEMA_VERSION]);
+export const LATEST_PUBLIC_BRAND_PROFILE_SCHEMA_VERSION = 7;
+export const BRAND_PROFILE_SCHEMA_VERSION = 8;
+export const BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS = Object.freeze([
+    PUBLIC_BRAND_PROFILE_SCHEMA_VERSION,
+    LATEST_PUBLIC_BRAND_PROFILE_SCHEMA_VERSION,
+    BRAND_PROFILE_SCHEMA_VERSION,
+]);
 export const SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS = BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS;
 export const MAX_PROFILES = 100;
 export const MAX_PROFILE_VALUES = 200;
@@ -15,7 +20,10 @@ export const MAX_PROFILE_IMPORT_BYTES = 2 * 1024 * 1024;
 export const MAX_PROFILE_NAME_LENGTH = 100;
 export const MAX_PROFILE_TEXT_LENGTH = 200;
 export const MAX_PROFILE_DOMAIN_LENGTH = 253;
+export const MAX_PROFILE_URL_LENGTH = 2_048;
 export const MAX_PROFILE_TLD_LENGTH = 63;
+export const MAX_OFFICIAL_CHANNELS = 30;
+export const MAX_RIGHTS_REFERENCES = 30;
 export const MAX_DKIM_SELECTOR_LENGTH = 253;
 export const MAX_DKIM_SELECTORS = 10;
 export const MAX_PROTECTION_ATTESTATIONS = 6;
@@ -151,7 +159,7 @@ export const BULK_SESSION_BROWSER_STORE_LIFECYCLE_SCHEMA = 'whoisleuth.browser.b
 export const INVESTIGATION_TEMPLATE_BROWSER_STORE_LIFECYCLE_SCHEMA = 'whoisleuth.browser.investigation-template-store';
 export const BULK_REVIEW_BROWSER_STORE_LIFECYCLE_SCHEMA = 'whoisleuth.browser.bulk-review-store';
 export const WORKSPACE_PORTABILITY_IDENTITY_CONSTANTS = Object.freeze([
-    'BRAND_PROFILE_SCHEMA', 'BRAND_PROFILE_SCHEMA_VERSION', 'BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS', 'SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS',
+    'BRAND_PROFILE_SCHEMA', 'PUBLIC_BRAND_PROFILE_SCHEMA_VERSION', 'LATEST_PUBLIC_BRAND_PROFILE_SCHEMA_VERSION', 'BRAND_PROFILE_SCHEMA_VERSION', 'BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS', 'SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS',
     'CAMPAIGN_SCHEMA', 'CAMPAIGN_SCHEMA_VERSION', 'CAMPAIGN_BROWSER_SUPPORTED_VERSIONS', 'CAMPAIGN_EXPORT_SUPPORTED_VERSIONS',
     'WATCHLIST_SCHEMA', 'WATCHLIST_SCHEMA_VERSION', 'WATCHLIST_BROWSER_SUPPORTED_VERSIONS', 'WATCHLIST_EXPORT_SUPPORTED_VERSIONS',
     'SHORTLIST_SCHEMA', 'SHORTLIST_SCHEMA_VERSION', 'SHORTLIST_BROWSER_SUPPORTED_VERSIONS', 'SUPPORTED_SHORTLIST_SCHEMA_VERSIONS',
@@ -169,7 +177,8 @@ export const WORKSPACE_PORTABILITY_IDENTITY_CONSTANTS = Object.freeze([
 ]);
 export const WORKSPACE_PORTABILITY_BOUND_CONSTANTS = Object.freeze([
     'MAX_PROFILES', 'MAX_PROFILE_VALUES', 'MAX_PROFILE_VALUE_INPUTS', 'MAX_PROFILE_STORE_BYTES', 'MAX_PROFILE_IMPORT_BYTES',
-    'MAX_PROFILE_NAME_LENGTH', 'MAX_PROFILE_TEXT_LENGTH', 'MAX_PROFILE_DOMAIN_LENGTH', 'MAX_PROFILE_TLD_LENGTH', 'MAX_DKIM_SELECTOR_LENGTH',
+    'MAX_PROFILE_NAME_LENGTH', 'MAX_PROFILE_TEXT_LENGTH', 'MAX_PROFILE_DOMAIN_LENGTH', 'MAX_PROFILE_URL_LENGTH', 'MAX_PROFILE_TLD_LENGTH',
+    'MAX_OFFICIAL_CHANNELS', 'MAX_RIGHTS_REFERENCES', 'MAX_DKIM_SELECTOR_LENGTH',
     'MAX_DKIM_SELECTORS', 'MAX_PROTECTION_ATTESTATIONS', 'MAX_DESIRED_POSTURE_BASELINES', 'MAX_DESIRED_POSTURE_RECORDS',
     'MAX_DESIRED_POSTURE_SUPPRESSIONS', 'MAX_DESIRED_POSTURE_OBSERVATIONS', 'MAX_DESIRED_POSTURE_CHANGE_WINDOWS',
     'MAX_CAMPAIGNS', 'MAX_CAMPAIGN_DOMAINS', 'MAX_CAMPAIGN_NAME_LENGTH', 'MAX_CAMPAIGN_DESCRIPTION_LENGTH',
@@ -218,7 +227,7 @@ export const BRAND_PROFILE_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     supportedVersions: BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current', writeSemantics: 'normalized_rewrite',
     byteBudget: MAX_PROFILE_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Exact public version 6 profiles migrate directly to version 7, which gives each approved change window a durable opaque identity; other historical stores are outside the compatibility boundary.',
+    note: 'Supported version 6 and 7 profiles migrate directly to version 8. Version 7 gives each approved change window a durable opaque identity; version 8 adds bounded official-channel and rights-reference records.',
 });
 export const CAMPAIGN_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.campaigns', kind: 'browser_store', schema: null, currentVersion: CAMPAIGN_SCHEMA_VERSION,
@@ -648,7 +657,7 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "version": 6,
         "role": "historical",
         "expectation": "normalises_to_current_output",
-        "expectedOutputFixtureId": "workspace.browser.brand.v7",
+        "expectedOutputFixtureId": "workspace.browser.brand.v8",
         "scope": "repository",
         "shapeId": "workspace.browser.brand.shape"
     },
@@ -660,6 +669,20 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "contentDigestSha256": null,
         "schema": "whoisleuth.browser.brand-profile-store",
         "version": 7,
+        "role": "historical",
+        "expectation": "normalises_to_current_output",
+        "expectedOutputFixtureId": "workspace.browser.brand.v8",
+        "scope": "repository",
+        "shapeId": "workspace.browser.brand.shape"
+    },
+    {
+        "id": "workspace.browser.brand.v8",
+        "path": "test/fixtures/workspace-lifecycle/browser-brand-v8.json",
+        "bytes": 37,
+        "sha256": "6c2310d9da626cb8acd88a47ccb60fa46051a63b23675cdc4801794ec5cc52e3",
+        "contentDigestSha256": null,
+        "schema": "whoisleuth.browser.brand-profile-store",
+        "version": 8,
         "role": "current",
         "expectation": "accepted_exact",
         "expectedOutputFixtureId": null,
@@ -830,7 +853,7 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "version": 6,
         "role": "historical",
         "expectation": "normalises_to_current_output",
-        "expectedOutputFixtureId": "workspace.portable.brand.v7",
+        "expectedOutputFixtureId": "workspace.portable.brand.v8",
         "scope": "repository",
         "shapeId": "workspace.portable.brand.shape"
     },
@@ -842,6 +865,20 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "contentDigestSha256": null,
         "schema": "whoisleuth.brand-profiles",
         "version": 7,
+        "role": "historical",
+        "expectation": "normalises_to_current_output",
+        "expectedOutputFixtureId": "workspace.portable.brand.v8",
+        "scope": "repository",
+        "shapeId": "workspace.portable.brand.shape"
+    },
+    {
+        "id": "workspace.portable.brand.v8",
+        "path": "test/fixtures/workspace-lifecycle/portable-brand-v8.json",
+        "bytes": 122,
+        "sha256": "4e4af17a0e19cb841ea50fe150caa3de79b978311b51a334ed7f6f3d2e1c6a1c",
+        "contentDigestSha256": null,
+        "schema": "whoisleuth.brand-profiles",
+        "version": 8,
         "role": "current",
         "expectation": "accepted_exact",
         "expectedOutputFixtureId": null,

package/packages/evidence/domain-control-runtime.mjs

@@ -171,15 +171,47 @@ export function canonicalMxRecord(value) {
     }
     return exchange(candidate);
 }
-function caaValue(value) {
-    return recordText(value, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH).replace(/^(?:"([\s\S]*)"|'([\s\S]*)')$/u, '$1$2').trim().toLowerCase();
+function caaValue(value, tag) {
+    const candidate = recordText(value, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH)
+        .replace(/^(?:"([\s\S]*)"|'([\s\S]*)')$/u, '$1$2').trim();
+    if (!candidate)
+        return '';
+    if (tag === 'issue' || tag === 'issuewild') {
+        const [issuer = '', ...parameters] = candidate.split(';');
+        const normalizedIssuer = issuer.trim().toLowerCase().replace(/\.$/u, '');
+        return [normalizedIssuer, ...parameters.map((parameter) => parameter.trim())].join('; ');
+    }
+    const scheme = /^([a-z][a-z0-9+.-]*):(.*)$/isu.exec(candidate);
+    if (!scheme)
+        return candidate;
+    const normalizedScheme = scheme[1].toLowerCase();
+    if (normalizedScheme === 'http' || normalizedScheme === 'https') {
+        try {
+            const url = new URL(candidate);
+            url.protocol = normalizedScheme;
+            url.hostname = url.hostname.toLowerCase();
+            return url.toString();
+        }
+        catch {
+            return candidate;
+        }
+    }
+    if (normalizedScheme === 'mailto') {
+        const [address = '', ...query] = scheme[2].split('?');
+        const at = address.lastIndexOf('@');
+        const normalizedAddress = at > 0
+            ? `${address.slice(0, at)}@${address.slice(at + 1).toLowerCase()}`
+            : address;
+        return `${normalizedScheme}:${normalizedAddress}${query.length ? `?${query.join('?')}` : ''}`;
+    }
+    return `${normalizedScheme}:${scheme[2]}`;
 }
 export function canonicalCaaRecord(value) {
     const item = structuredRecord(value, CAA_RECORD_KEYS, 'Domain control CAA record');
     if (item) {
         const flags = canonicalIntegerAlias(item, ['critical', 'flags'], MAX_DOMAIN_CONTROL_CAA_FLAGS, 'Domain control CAA flags', 0);
         const tag = recordText(item.tag, MAX_DOMAIN_CONTROL_CAA_TAG_LENGTH).toLowerCase();
-        const payload = caaValue(item.value);
+        const payload = caaValue(item.value, tag);
         return flags !== null && /^(?:issue|issuewild|iodef)$/u.test(tag) && payload
             ? `${flags} ${tag} ${payload}`
             : '';
@@ -190,7 +222,7 @@ export function canonicalCaaRecord(value) {
         return '';
     const flags = recordInteger(match[1], MAX_DOMAIN_CONTROL_CAA_FLAGS);
     const tag = match[2]?.toLowerCase() ?? '';
-    const payload = caaValue(match[3]);
+    const payload = caaValue(match[3], tag);
     return flags !== null && payload ? `${flags} ${tag} ${payload}` : '';
 }
 export function canonicalDsRecord(value) {
@@ -405,7 +437,9 @@ function hostnames(value) {
     return [...new Set(names)].sort(compareCodeUnits).slice(0, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS);
 }
 function digest(value) {
-    const candidate = text(value, DOMAIN_CONTROL_SPKI_SHA256_HEX_LENGTH)?.toLowerCase() ?? '';
+    if (typeof value !== 'string' || CONTROL_RE.test(value))
+        return null;
+    const candidate = value.trim().toLowerCase();
     return SPKI_DIGEST_PATTERN.test(candidate) ? candidate : null;
 }
 function normalizeEntry(value) {
@@ -415,6 +449,12 @@ function normalizeEntry(value) {
     const domain = domainControlName(source.domain);
     if (!domain)
         return null;
+    const tlsSpkiSha256 = digest(source.tlsSpkiSha256);
+    if (source.tlsSpkiSha256 !== undefined && source.tlsSpkiSha256 !== null
+        && (typeof source.tlsSpkiSha256 !== 'string' || source.tlsSpkiSha256.trim())
+        && !tlsSpkiSha256) {
+        throw new TypeError('Domain control TLS public-key fingerprint must be exactly 64 hexadecimal characters.');
+    }
     return Object.freeze({
         domain,
         nameservers: Object.freeze(hostnames(source.nameservers)),
@@ -422,7 +462,7 @@ function normalizeEntry(value) {
         mx: Object.freeze(canonicalDomainControlRecordList(source.mx, 'mx')),
         caa: Object.freeze(canonicalDomainControlRecordList(source.caa, 'caa')),
         tlsIssuer: text(source.tlsIssuer, MAX_DOMAIN_CONTROL_TEXT_LENGTH)?.toLowerCase() ?? null,
-        tlsSpkiSha256: digest(source.tlsSpkiSha256),
+        tlsSpkiSha256,
         registrarLock: source.registrarLock === 'required' || source.registrarLock === 'not_required'
             ? source.registrarLock
             : null,

package/packages/interchange/external-findings-import.mjs

@@ -1,4 +1,5 @@
 import { normalizeDomain, openOrCreateCase, updateCase, } from "../cases/case-model.mjs";
+import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, } from "../contracts/external-observation-interchange.mjs";
 import { hasUnsafeRetainedText } from "./retained-text.mjs";
@@ -13,6 +14,7 @@ export const EXTERNAL_FINDING_CATEGORIES = [
     'registration',
     'reputation',
 ];
+export const MAX_EXTERNAL_FINDING_SUMMARY_LENGTH = 900;
 const CATEGORIES = new Set(EXTERNAL_FINDING_CATEGORIES);
 const COMPLETENESS = new Set(['complete', 'inconclusive', 'partial', 'unknown']);
 const ROOT_KEYS = new Set(['schema', 'schemaVersion', 'source', 'findings']);
@@ -218,7 +220,7 @@ export function parseExternalFindingsDocument(value) {
             domain,
             category: item.category,
             evidenceClass,
-            summary: requiredText(item.summary, 900, `Finding ${index + 1} summary`),
+            summary: requiredText(item.summary, MAX_EXTERNAL_FINDING_SUMMARY_LENGTH, `Finding ${index + 1} summary`),
             observedAt: iso(item.observedAt, `Finding ${index + 1} observation time`),
             completeness: item.completeness,
             limitations: limitations(item.limitations, index),
@@ -311,6 +313,58 @@ function structuredPinFields(finding) {
         certificateObservation,
     };
 }
+function mergeExternalFindingIntoCase(current, caseId, finding, source, now) {
+    const target = current.find((candidate) => candidate.id === caseId) ?? null;
+    if (!target)
+        throw new Error('The selected Case is unavailable for this finding.');
+    if (existingPinKey(target, finding, source.name)) {
+        return { cases: [...current], record: target, added: false };
+    }
+    const sourceLimitations = [
+        finding.evidenceClass === 'deployment_observation'
+            ? `Imported as an observation made by ${source.name}; this browser session did not collect or independently verify it.`
+            : `Reported by ${source.name}; WHOISleuth did not collect or independently verify this provider finding.`,
+        ...(source.reference ? [`Source reference: ${source.reference}`] : []),
+        ...finding.limitations,
+    ];
+    const existingPinIds = new Set(target.evidencePins.map((pin) => pin.id));
+    let updated = updateCase([...current], target.id, {
+        evidencePin: {
+            ...structuredPinFields(finding),
+            label: `External ${finding.category} finding`,
+            value: finding.structuredObservation?.value ?? pinValue(finding),
+            source: importedSourceLabel(finding, source.name),
+            observedAt: finding.observedAt,
+            completeness: finding.completeness,
+            limitations: sourceLimitations,
+        },
+    }, now);
+    const addedPin = updated.record.evidencePins.find((pin) => !existingPinIds.has(pin.id)) ?? null;
+    if (!addedPin)
+        throw new Error('The imported finding could not be retained as Case evidence.');
+    updated = updateCase(updated.cases, target.id, {
+        sighting: {
+            state: finding.evidenceClass === 'deployment_observation'
+                ? 'observed_by_deployment'
+                : 'reported_by_provider',
+            category: finding.category === 'dns'
+                ? 'delegation'
+                : finding.category === 'certificate'
+                    ? 'certificate'
+                    : finding.category === 'registration'
+                        ? 'registration'
+                        : finding.category === 'http' || finding.category === 'page'
+                            ? 'website'
+                            : 'other',
+            source: source.name,
+            observedAt: finding.observedAt,
+            completeness: finding.completeness,
+            evidencePinId: addedPin.id,
+            limitations: sourceLimitations,
+        },
+    }, now);
+    return { cases: updated.cases, record: updated.record, added: true };
+}
 export function mergeExternalFindingsIntoCases(current, document, now = new Date().toISOString()) {
     let cases = [...current];
     const createdDomains = new Set();
@@ -322,54 +376,12 @@ export function mergeExternalFindingsIntoCases(current, document, now = new Date
         const opened = openOrCreateCase(cases, { domain: finding.domain, source: 'import' }, now);
         cases = opened.cases;
         const target = cases.find((candidate) => candidate.id === opened.record.id) ?? opened.record;
-        if (existingPinKey(target, finding, document.source.name)) {
+        const merged = mergeExternalFindingIntoCase(cases, target.id, finding, document.source, now);
+        cases = merged.cases;
+        if (!merged.added) {
             duplicatesSkipped += 1;
             continue;
         }
-        const sourceLimitations = [
-            finding.evidenceClass === 'deployment_observation'
-                ? `Imported as an observation made by ${document.source.name}; this browser session did not collect or independently verify it.`
-                : `Reported by ${document.source.name}; WHOISleuth did not collect or independently verify this provider finding.`,
-            ...(document.source.reference ? [`Source reference: ${document.source.reference}`] : []),
-            ...finding.limitations,
-        ];
-        const existingPinIds = new Set(target.evidencePins.map((pin) => pin.id));
-        const updated = updateCase(cases, target.id, {
-            evidencePin: {
-                ...structuredPinFields(finding),
-                label: `External ${finding.category} finding`,
-                value: finding.structuredObservation?.value ?? pinValue(finding),
-                source: importedSourceLabel(finding, document.source.name),
-                observedAt: finding.observedAt,
-                completeness: finding.completeness,
-                limitations: sourceLimitations,
-            },
-        }, now);
-        cases = updated.cases;
-        const addedPin = updated.record.evidencePins.find((pin) => !existingPinIds.has(pin.id)) ?? null;
-        if (addedPin) {
-            cases = updateCase(cases, updated.record.id, {
-                sighting: {
-                    state: finding.evidenceClass === 'deployment_observation'
-                        ? 'observed_by_deployment'
-                        : 'reported_by_provider',
-                    category: finding.category === 'dns'
-                        ? 'delegation'
-                        : finding.category === 'certificate'
-                            ? 'certificate'
-                            : finding.category === 'registration'
-                                ? 'registration'
-                                : finding.category === 'http' || finding.category === 'page'
-                                    ? 'website'
-                                    : 'other',
-                    source: document.source.name,
-                    observedAt: finding.observedAt,
-                    completeness: finding.completeness,
-                    evidencePinId: addedPin.id,
-                    limitations: sourceLimitations,
-                },
-            }, now).cases;
-        }
         findingsAdded += 1;
         if (existing)
             updatedDomains.add(finding.domain);
@@ -384,3 +396,60 @@ export function mergeExternalFindingsIntoCases(current, document, now = new Date
         duplicatesSkipped,
     };
 }
+function targetedFinding(finding, caseDomain) {
+    if (finding.domain === caseDomain)
+        return finding;
+    const prefix = `Captured hostname ${finding.domain}. `;
+    const maximumSummaryLength = MAX_EXTERNAL_FINDING_SUMMARY_LENGTH;
+    const remaining = maximumSummaryLength - prefix.length;
+    const summary = remaining > 1 && finding.summary.length > remaining
+        ? `${prefix}${finding.summary.slice(0, remaining - 1).trimEnd()}…`
+        : `${prefix}${finding.summary}`;
+    return { ...finding, domain: caseDomain, summary };
+}
+export function externalFindingsCaseTargets(document, caseDomain) {
+    if (canonicalRegistrableDomain(caseDomain) !== caseDomain) {
+        throw new Error('The selected Case does not have a canonical registrable-domain identity.');
+    }
+    const targets = new Set();
+    for (const finding of document.findings) {
+        if (canonicalRegistrableDomain(finding.domain) !== caseDomain) {
+            throw new Error(`The imported finding for ${finding.domain} does not belong to the selected Case for ${caseDomain}.`);
+        }
+        targets.add(finding.domain);
+    }
+    return Object.freeze([...targets]);
+}
+/**
+ * Merges already-validated external findings into one selected Case. A Case is
+ * keyed to its registrable domain, while rendered captures may retain an exact
+ * hostname. Only same-domain findings are accepted, the exact hostname remains
+ * explicit in the retained evidence, and this operation can never open another
+ * Case as a side effect.
+ */
+export function mergeExternalFindingsIntoCase(current, caseId, document, now = new Date().toISOString()) {
+    const selected = current.find((candidate) => candidate.id === caseId) ?? null;
+    if (!selected)
+        throw new Error('Select an existing Case before importing rendered-capture evidence.');
+    externalFindingsCaseTargets(document, selected.domain);
+    let cases = [...current];
+    let record = selected;
+    let findingsAdded = 0;
+    let duplicatesSkipped = 0;
+    for (const original of document.findings) {
+        const finding = targetedFinding(original, selected.domain);
+        const merged = mergeExternalFindingIntoCase(cases, selected.id, finding, document.source, now);
+        cases = merged.cases;
+        record = merged.record;
+        if (merged.added)
+            findingsAdded += 1;
+        else
+            duplicatesSkipped += 1;
+    }
+    return {
+        cases,
+        record,
+        findingsAdded,
+        duplicatesSkipped,
+    };
+}