@slicedearth/whoisleuth-cli 2.2.0 → 2.3.0

package/packages/contracts/cli-command-semantics.mjs

@@ -0,0 +1,93 @@
+export const CAPABILITY_IDS = Object.freeze({
+    LOOKUP: 'lookup',
+    RDAP: 'rdap',
+    RDAP_NAMESERVER_SEARCH: 'rdap_nameserver_search',
+    WHOIS: 'whois',
+    AVAILABILITY: 'availability',
+    DOMAIN_EVIDENCE: 'domain_evidence',
+    DNS_INTELLIGENCE: 'dns_intelligence',
+    WEBSITE_PROBE: 'website_probe',
+    TLS_INTELLIGENCE: 'tls_intelligence',
+    CERTIFICATE_TRANSPARENCY: 'certificate_transparency',
+    SECURITY_TXT: 'security_txt',
+    EXTERNAL_INTELLIGENCE: 'external_intelligence',
+    URLSCAN_SEARCH: 'urlscan_search',
+    URLHAUS_HOST: 'urlhaus_host',
+    THREATFOX_DOMAIN_IOC: 'threatfox_domain_ioc',
+    REGISTRAR_RDAP: 'registrar_rdap',
+    NETWORK_CONTEXT: 'network_context',
+    REVERSE_DNS: 'reverse_dns',
+    DOMAIN_POSTURE: 'domain_posture',
+    DNSSEC_VALIDATION: 'dnssec_validation',
+    MAIL_TRANSPORT_REVIEW: 'mail_transport_review',
+    RENDERED_WEB_CAPTURE: 'rendered_web_capture',
+    RENDERED_CAPTURE_COMPARISON: 'rendered_capture_comparison',
+    IDN_CONFUSABLES: 'idn_confusables',
+    ANALYST_CASES: 'analyst_cases',
+    WATCHLISTS: 'watchlists',
+    OFFLINE_REVIEW: 'offline_review',
+    PORTABLE_EVIDENCE: 'portable_evidence',
+    RUNTIME_DIAGNOSTICS: 'runtime_diagnostics',
+    WORKFLOW_EXECUTION: 'workflow_execution',
+    SCHEDULED_MONITORING: 'scheduled_monitoring',
+    DISTRIBUTED_BUDGETS: 'distributed_budgets',
+});
+export const CLI_HELP_GROUP_ORDER = Object.freeze([
+    'investigate',
+    'respond',
+    'assure',
+    'utilities',
+]);
+function semantic(group, capabilityFamilyId) {
+    return Object.freeze({ group, capabilityFamilyId });
+}
+export const CLI_COMMAND_SEMANTICS = Object.freeze({
+    completion: semantic('utilities', CAPABILITY_IDS.OFFLINE_REVIEW),
+    doctor: semantic('utilities', CAPABILITY_IDS.RUNTIME_DIAGNOSTICS),
+    commands: semantic('utilities', CAPABILITY_IDS.OFFLINE_REVIEW),
+    manual: semantic('utilities', CAPABILITY_IDS.OFFLINE_REVIEW),
+    manifest: semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'map-observations': semantic('respond', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'oam-export': semantic('respond', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    lookup: semantic('investigate', CAPABILITY_IDS.LOOKUP),
+    bulk: semantic('investigate', CAPABILITY_IDS.LOOKUP),
+    'ct-search': semantic('investigate', CAPABILITY_IDS.CERTIFICATE_TRANSPARENCY),
+    'ct-intake': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    discover: semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'discover-scan': semantic('investigate', CAPABILITY_IDS.LOOKUP),
+    posture: semantic('investigate', CAPABILITY_IDS.DOMAIN_POSTURE),
+    http: semantic('investigate', CAPABILITY_IDS.WEBSITE_PROBE),
+    tls: semantic('investigate', CAPABILITY_IDS.TLS_INTELLIGENCE),
+    'dnssec-validate': semantic('assure', CAPABILITY_IDS.DNSSEC_VALIDATION),
+    'mail-transport': semantic('assure', CAPABILITY_IDS.MAIL_TRANSPORT_REVIEW),
+    'registry-support': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'registry-doctor': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'registry-cohort': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'registry-scaffold': semantic('utilities', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'risk-calibrate': semantic('assure', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'lookalike-calibrate': semantic('assure', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'verify-artifact': semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'interchange-report': semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'inspect-archive': semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'sign-artifact': semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'verify-signature': semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'source-report': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    compare: semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'page-compare': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'mail-review': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'mail-headers': semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'review-evidence': semantic('investigate', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    brief: semantic('investigate', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'case-pack': semantic('respond', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'domain-control': semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'monitor-once': semantic('assure', CAPABILITY_IDS.LOOKUP),
+    assurance: semantic('assure', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'change-packet': semantic('respond', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'sharing-review': semantic('respond', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+    'workflow-plan': semantic('assure', CAPABILITY_IDS.OFFLINE_REVIEW),
+    'workflow-run': semantic('assure', CAPABILITY_IDS.WORKFLOW_EXECUTION),
+    diff: semantic('assure', CAPABILITY_IDS.OFFLINE_REVIEW),
+    reconcile: semantic('assure', CAPABILITY_IDS.OFFLINE_REVIEW),
+    timeline: semantic('assure', CAPABILITY_IDS.OFFLINE_REVIEW),
+    export: semantic('respond', CAPABILITY_IDS.PORTABLE_EVIDENCE),
+});

package/packages/contracts/risk-calibration.mjs

@@ -158,6 +158,15 @@ export const RISK_CALIBRATION_REPORT_PRIVACY_KEYS = Object.freeze([
 export const RISK_CALIBRATION_REPORT_INTERPRETATION_KEYS = Object.freeze([
     'authority', 'statement', 'automaticTuning', 'networkRequests', 'persisted',
 ]);
+/** Stable disposition identities admitted by the versioned calibration schema. */
+export const RISK_CALIBRATION_DISPOSITIONS = Object.freeze([
+    'unreviewed',
+    'suspicious',
+    'confirmed_abuse',
+    'false_positive',
+    'expected',
+    'closed_no_action',
+]);
 export const RISK_CALIBRATION_DATASET_COMPATIBILITY = defineSchemaCompatibility({
     id: 'cli.risk-calibration-dataset',
     kind: 'cli_document',
@@ -337,8 +346,8 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
         {
             id: 'risk-calibration-report-v3-detailed',
             path: 'test/fixtures/risk-calibration-report-v3-detailed.json',
-            bytes: 7_026,
-            sha256: '5c0c435e81478e90bc0b64aa7c20fd82d131b5261a57d9550df3f03334bc20e1',
+            bytes: 7_020,
+            sha256: 'a5cba1681c170c79f8891037f47efc93e0ae6ce5d247418ff3f1c9a81a352922',
             contentDigestSha256: null,
             schema: RISK_CALIBRATION_REPORT_SCHEMA,
             version: RISK_CALIBRATION_REPORT_VERSION,
@@ -351,8 +360,8 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
         {
             id: 'risk-calibration-report-v3-summary',
             path: 'test/fixtures/risk-calibration-report-v3-summary.json',
-            bytes: 5_486,
-            sha256: 'b06c312eed14680ce30fd58a84a93908d29ea9e71bfee8174b90df286b730549',
+            bytes: 5_480,
+            sha256: '71b7fe1ee613b2ab32bd1f5646ee765985022c904224e1a08f4577c1d1d06240',
             contentDigestSha256: null,
             schema: RISK_CALIBRATION_REPORT_SCHEMA,
             version: RISK_CALIBRATION_REPORT_VERSION,
@@ -1110,9 +1119,7 @@ const FACTOR_SPEC = objectOf([
 const REPORT_RECORD_SPEC = objectOf([
     { key: 'id', value: boundedText(MAX_RISK_CALIBRATION_RECORD_ID_LENGTH) },
     { key: 'domain', value: boundedText(MAX_RISK_CALIBRATION_DOMAIN_LENGTH) },
-    { key: 'analystDisposition', value: boundedText(MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, [
-            'unreviewed', 'suspicious', 'confirmed_abuse', 'false_positive', 'expected', 'closed_no_action',
-        ]) },
+    { key: 'analystDisposition', value: boundedText(MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, RISK_CALIBRATION_DISPOSITIONS) },
     { key: 'reviewReasonCode', value: nullable(boundedText(MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH)) },
     { key: 'interoperabilityTags', value: arrayOf(boundedText(MAX_RISK_CALIBRATION_STRING_LENGTH), 0, 32) },
     { key: 'metricClass', value: boundedText(16, ['positive', 'negative', 'excluded']) },
@@ -1179,9 +1186,7 @@ const DATASET_EVIDENCE_SPEC = objectOf([
 const DATASET_RECORD_SPEC = objectOf([
     { key: 'id', value: boundedText(MAX_RISK_CALIBRATION_RECORD_ID_LENGTH, null, 1, canonicalRiskCalibrationIdentifier) },
     { key: 'domain', value: boundedText(MAX_RISK_CALIBRATION_DOMAIN_LENGTH, null, 1, validRiskCalibrationDomain) },
-    { key: 'analystDisposition', value: boundedText(MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, [
-            'unreviewed', 'suspicious', 'confirmed_abuse', 'false_positive', 'expected', 'closed_no_action',
-        ]) },
+    { key: 'analystDisposition', value: boundedText(MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, RISK_CALIBRATION_DISPOSITIONS) },
     { key: 'reviewReasonCode', value: boundedText(MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH, RISK_CALIBRATION_REVIEW_REASON_VALUES), optional: true },
     { key: 'evidence', value: DATASET_EVIDENCE_SPEC },
 ]);

package/packages/contracts/workspace-portability.mjs

@@ -4,8 +4,13 @@ import { defineSchemaLifecycleFamily, } from "./schema-lifecycle.mjs";
 export const WORKSPACE_CONTRACT_OWNER = 'packages/contracts/workspace-portability.mts';
 export const BRAND_PROFILE_SCHEMA = 'whoisleuth.brand-profiles';
 export const PUBLIC_BRAND_PROFILE_SCHEMA_VERSION = 6;
-export const BRAND_PROFILE_SCHEMA_VERSION = 7;
-export const BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS = Object.freeze([PUBLIC_BRAND_PROFILE_SCHEMA_VERSION, BRAND_PROFILE_SCHEMA_VERSION]);
+export const LATEST_PUBLIC_BRAND_PROFILE_SCHEMA_VERSION = 7;
+export const BRAND_PROFILE_SCHEMA_VERSION = 8;
+export const BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS = Object.freeze([
+    PUBLIC_BRAND_PROFILE_SCHEMA_VERSION,
+    LATEST_PUBLIC_BRAND_PROFILE_SCHEMA_VERSION,
+    BRAND_PROFILE_SCHEMA_VERSION,
+]);
 export const SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS = BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS;
 export const MAX_PROFILES = 100;
 export const MAX_PROFILE_VALUES = 200;
@@ -15,7 +20,10 @@ export const MAX_PROFILE_IMPORT_BYTES = 2 * 1024 * 1024;
 export const MAX_PROFILE_NAME_LENGTH = 100;
 export const MAX_PROFILE_TEXT_LENGTH = 200;
 export const MAX_PROFILE_DOMAIN_LENGTH = 253;
+export const MAX_PROFILE_URL_LENGTH = 2_048;
 export const MAX_PROFILE_TLD_LENGTH = 63;
+export const MAX_OFFICIAL_CHANNELS = 30;
+export const MAX_RIGHTS_REFERENCES = 30;
 export const MAX_DKIM_SELECTOR_LENGTH = 253;
 export const MAX_DKIM_SELECTORS = 10;
 export const MAX_PROTECTION_ATTESTATIONS = 6;
@@ -151,7 +159,7 @@ export const BULK_SESSION_BROWSER_STORE_LIFECYCLE_SCHEMA = 'whoisleuth.browser.b
 export const INVESTIGATION_TEMPLATE_BROWSER_STORE_LIFECYCLE_SCHEMA = 'whoisleuth.browser.investigation-template-store';
 export const BULK_REVIEW_BROWSER_STORE_LIFECYCLE_SCHEMA = 'whoisleuth.browser.bulk-review-store';
 export const WORKSPACE_PORTABILITY_IDENTITY_CONSTANTS = Object.freeze([
-    'BRAND_PROFILE_SCHEMA', 'BRAND_PROFILE_SCHEMA_VERSION', 'BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS', 'SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS',
+    'BRAND_PROFILE_SCHEMA', 'PUBLIC_BRAND_PROFILE_SCHEMA_VERSION', 'LATEST_PUBLIC_BRAND_PROFILE_SCHEMA_VERSION', 'BRAND_PROFILE_SCHEMA_VERSION', 'BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS', 'SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS',
     'CAMPAIGN_SCHEMA', 'CAMPAIGN_SCHEMA_VERSION', 'CAMPAIGN_BROWSER_SUPPORTED_VERSIONS', 'CAMPAIGN_EXPORT_SUPPORTED_VERSIONS',
     'WATCHLIST_SCHEMA', 'WATCHLIST_SCHEMA_VERSION', 'WATCHLIST_BROWSER_SUPPORTED_VERSIONS', 'WATCHLIST_EXPORT_SUPPORTED_VERSIONS',
     'SHORTLIST_SCHEMA', 'SHORTLIST_SCHEMA_VERSION', 'SHORTLIST_BROWSER_SUPPORTED_VERSIONS', 'SUPPORTED_SHORTLIST_SCHEMA_VERSIONS',
@@ -169,7 +177,8 @@ export const WORKSPACE_PORTABILITY_IDENTITY_CONSTANTS = Object.freeze([
 ]);
 export const WORKSPACE_PORTABILITY_BOUND_CONSTANTS = Object.freeze([
     'MAX_PROFILES', 'MAX_PROFILE_VALUES', 'MAX_PROFILE_VALUE_INPUTS', 'MAX_PROFILE_STORE_BYTES', 'MAX_PROFILE_IMPORT_BYTES',
-    'MAX_PROFILE_NAME_LENGTH', 'MAX_PROFILE_TEXT_LENGTH', 'MAX_PROFILE_DOMAIN_LENGTH', 'MAX_PROFILE_TLD_LENGTH', 'MAX_DKIM_SELECTOR_LENGTH',
+    'MAX_PROFILE_NAME_LENGTH', 'MAX_PROFILE_TEXT_LENGTH', 'MAX_PROFILE_DOMAIN_LENGTH', 'MAX_PROFILE_URL_LENGTH', 'MAX_PROFILE_TLD_LENGTH',
+    'MAX_OFFICIAL_CHANNELS', 'MAX_RIGHTS_REFERENCES', 'MAX_DKIM_SELECTOR_LENGTH',
     'MAX_DKIM_SELECTORS', 'MAX_PROTECTION_ATTESTATIONS', 'MAX_DESIRED_POSTURE_BASELINES', 'MAX_DESIRED_POSTURE_RECORDS',
     'MAX_DESIRED_POSTURE_SUPPRESSIONS', 'MAX_DESIRED_POSTURE_OBSERVATIONS', 'MAX_DESIRED_POSTURE_CHANGE_WINDOWS',
     'MAX_CAMPAIGNS', 'MAX_CAMPAIGN_DOMAINS', 'MAX_CAMPAIGN_NAME_LENGTH', 'MAX_CAMPAIGN_DESCRIPTION_LENGTH',
@@ -218,7 +227,7 @@ export const BRAND_PROFILE_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     supportedVersions: BRAND_PROFILE_BROWSER_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
     futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current', writeSemantics: 'normalized_rewrite',
     byteBudget: MAX_PROFILE_STORE_BYTES, owner: WORKSPACE_CONTRACT_OWNER,
-    note: 'Exact public version 6 profiles migrate directly to version 7, which gives each approved change window a durable opaque identity; other historical stores are outside the compatibility boundary.',
+    note: 'Supported version 6 and 7 profiles migrate directly to version 8. Version 7 gives each approved change window a durable opaque identity; version 8 adds bounded official-channel and rights-reference records.',
 });
 export const CAMPAIGN_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
     id: 'browser.campaigns', kind: 'browser_store', schema: null, currentVersion: CAMPAIGN_SCHEMA_VERSION,
@@ -648,7 +657,7 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "version": 6,
         "role": "historical",
         "expectation": "normalises_to_current_output",
-        "expectedOutputFixtureId": "workspace.browser.brand.v7",
+        "expectedOutputFixtureId": "workspace.browser.brand.v8",
         "scope": "repository",
         "shapeId": "workspace.browser.brand.shape"
     },
@@ -660,6 +669,20 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "contentDigestSha256": null,
         "schema": "whoisleuth.browser.brand-profile-store",
         "version": 7,
+        "role": "historical",
+        "expectation": "normalises_to_current_output",
+        "expectedOutputFixtureId": "workspace.browser.brand.v8",
+        "scope": "repository",
+        "shapeId": "workspace.browser.brand.shape"
+    },
+    {
+        "id": "workspace.browser.brand.v8",
+        "path": "test/fixtures/workspace-lifecycle/browser-brand-v8.json",
+        "bytes": 37,
+        "sha256": "6c2310d9da626cb8acd88a47ccb60fa46051a63b23675cdc4801794ec5cc52e3",
+        "contentDigestSha256": null,
+        "schema": "whoisleuth.browser.brand-profile-store",
+        "version": 8,
         "role": "current",
         "expectation": "accepted_exact",
         "expectedOutputFixtureId": null,
@@ -830,7 +853,7 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "version": 6,
         "role": "historical",
         "expectation": "normalises_to_current_output",
-        "expectedOutputFixtureId": "workspace.portable.brand.v7",
+        "expectedOutputFixtureId": "workspace.portable.brand.v8",
         "scope": "repository",
         "shapeId": "workspace.portable.brand.shape"
     },
@@ -842,6 +865,20 @@ const WORKSPACE_LIFECYCLE_FIXTURE_SOURCE = Object.freeze([
         "contentDigestSha256": null,
         "schema": "whoisleuth.brand-profiles",
         "version": 7,
+        "role": "historical",
+        "expectation": "normalises_to_current_output",
+        "expectedOutputFixtureId": "workspace.portable.brand.v8",
+        "scope": "repository",
+        "shapeId": "workspace.portable.brand.shape"
+    },
+    {
+        "id": "workspace.portable.brand.v8",
+        "path": "test/fixtures/workspace-lifecycle/portable-brand-v8.json",
+        "bytes": 122,
+        "sha256": "4e4af17a0e19cb841ea50fe150caa3de79b978311b51a334ed7f6f3d2e1c6a1c",
+        "contentDigestSha256": null,
+        "schema": "whoisleuth.brand-profiles",
+        "version": 8,
         "role": "current",
         "expectation": "accepted_exact",
         "expectedOutputFixtureId": null,

package/packages/evidence/domain-control-runtime.mjs

@@ -171,15 +171,47 @@ export function canonicalMxRecord(value) {
     }
     return exchange(candidate);
 }
-function caaValue(value) {
-    return recordText(value, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH).replace(/^(?:"([\s\S]*)"|'([\s\S]*)')$/u, '$1$2').trim().toLowerCase();
+function caaValue(value, tag) {
+    const candidate = recordText(value, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH)
+        .replace(/^(?:"([\s\S]*)"|'([\s\S]*)')$/u, '$1$2').trim();
+    if (!candidate)
+        return '';
+    if (tag === 'issue' || tag === 'issuewild') {
+        const [issuer = '', ...parameters] = candidate.split(';');
+        const normalizedIssuer = issuer.trim().toLowerCase().replace(/\.$/u, '');
+        return [normalizedIssuer, ...parameters.map((parameter) => parameter.trim())].join('; ');
+    }
+    const scheme = /^([a-z][a-z0-9+.-]*):(.*)$/isu.exec(candidate);
+    if (!scheme)
+        return candidate;
+    const normalizedScheme = scheme[1].toLowerCase();
+    if (normalizedScheme === 'http' || normalizedScheme === 'https') {
+        try {
+            const url = new URL(candidate);
+            url.protocol = normalizedScheme;
+            url.hostname = url.hostname.toLowerCase();
+            return url.toString();
+        }
+        catch {
+            return candidate;
+        }
+    }
+    if (normalizedScheme === 'mailto') {
+        const [address = '', ...query] = scheme[2].split('?');
+        const at = address.lastIndexOf('@');
+        const normalizedAddress = at > 0
+            ? `${address.slice(0, at)}@${address.slice(at + 1).toLowerCase()}`
+            : address;
+        return `${normalizedScheme}:${normalizedAddress}${query.length ? `?${query.join('?')}` : ''}`;
+    }
+    return `${normalizedScheme}:${scheme[2]}`;
 }
 export function canonicalCaaRecord(value) {
     const item = structuredRecord(value, CAA_RECORD_KEYS, 'Domain control CAA record');
     if (item) {
         const flags = canonicalIntegerAlias(item, ['critical', 'flags'], MAX_DOMAIN_CONTROL_CAA_FLAGS, 'Domain control CAA flags', 0);
         const tag = recordText(item.tag, MAX_DOMAIN_CONTROL_CAA_TAG_LENGTH).toLowerCase();
-        const payload = caaValue(item.value);
+        const payload = caaValue(item.value, tag);
         return flags !== null && /^(?:issue|issuewild|iodef)$/u.test(tag) && payload
             ? `${flags} ${tag} ${payload}`
             : '';
@@ -190,7 +222,7 @@ export function canonicalCaaRecord(value) {
         return '';
     const flags = recordInteger(match[1], MAX_DOMAIN_CONTROL_CAA_FLAGS);
     const tag = match[2]?.toLowerCase() ?? '';
-    const payload = caaValue(match[3]);
+    const payload = caaValue(match[3], tag);
     return flags !== null && payload ? `${flags} ${tag} ${payload}` : '';
 }
 export function canonicalDsRecord(value) {
@@ -405,7 +437,9 @@ function hostnames(value) {
     return [...new Set(names)].sort(compareCodeUnits).slice(0, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS);
 }
 function digest(value) {
-    const candidate = text(value, DOMAIN_CONTROL_SPKI_SHA256_HEX_LENGTH)?.toLowerCase() ?? '';
+    if (typeof value !== 'string' || CONTROL_RE.test(value))
+        return null;
+    const candidate = value.trim().toLowerCase();
     return SPKI_DIGEST_PATTERN.test(candidate) ? candidate : null;
 }
 function normalizeEntry(value) {
@@ -415,6 +449,12 @@ function normalizeEntry(value) {
     const domain = domainControlName(source.domain);
     if (!domain)
         return null;
+    const tlsSpkiSha256 = digest(source.tlsSpkiSha256);
+    if (source.tlsSpkiSha256 !== undefined && source.tlsSpkiSha256 !== null
+        && (typeof source.tlsSpkiSha256 !== 'string' || source.tlsSpkiSha256.trim())
+        && !tlsSpkiSha256) {
+        throw new TypeError('Domain control TLS public-key fingerprint must be exactly 64 hexadecimal characters.');
+    }
     return Object.freeze({
         domain,
         nameservers: Object.freeze(hostnames(source.nameservers)),
@@ -422,7 +462,7 @@ function normalizeEntry(value) {
         mx: Object.freeze(canonicalDomainControlRecordList(source.mx, 'mx')),
         caa: Object.freeze(canonicalDomainControlRecordList(source.caa, 'caa')),
         tlsIssuer: text(source.tlsIssuer, MAX_DOMAIN_CONTROL_TEXT_LENGTH)?.toLowerCase() ?? null,
-        tlsSpkiSha256: digest(source.tlsSpkiSha256),
+        tlsSpkiSha256,
         registrarLock: source.registrarLock === 'required' || source.registrarLock === 'not_required'
             ? source.registrarLock
             : null,

package/packages/interchange/external-findings-import.mjs

@@ -14,6 +14,7 @@ export const EXTERNAL_FINDING_CATEGORIES = [
     'registration',
     'reputation',
 ];
+export const MAX_EXTERNAL_FINDING_SUMMARY_LENGTH = 900;
 const CATEGORIES = new Set(EXTERNAL_FINDING_CATEGORIES);
 const COMPLETENESS = new Set(['complete', 'inconclusive', 'partial', 'unknown']);
 const ROOT_KEYS = new Set(['schema', 'schemaVersion', 'source', 'findings']);
@@ -219,7 +220,7 @@ export function parseExternalFindingsDocument(value) {
             domain,
             category: item.category,
             evidenceClass,
-            summary: requiredText(item.summary, 900, `Finding ${index + 1} summary`),
+            summary: requiredText(item.summary, MAX_EXTERNAL_FINDING_SUMMARY_LENGTH, `Finding ${index + 1} summary`),
             observedAt: iso(item.observedAt, `Finding ${index + 1} observation time`),
             completeness: item.completeness,
             limitations: limitations(item.limitations, index),
@@ -399,7 +400,7 @@ function targetedFinding(finding, caseDomain) {
     if (finding.domain === caseDomain)
         return finding;
     const prefix = `Captured hostname ${finding.domain}. `;
-    const maximumSummaryLength = 900;
+    const maximumSummaryLength = MAX_EXTERNAL_FINDING_SUMMARY_LENGTH;
     const remaining = maximumSummaryLength - prefix.length;
     const summary = remaining > 1 && finding.summary.length > remaining
         ? `${prefix}${finding.summary.slice(0, remaining - 1).trimEnd()}…`

package/packages/investigation/lookup-asset-graph.mjs

@@ -130,13 +130,16 @@ function hostname(value) {
         return null;
     return candidate;
 }
-function urlHost(value) {
+function webOrigin(value) {
     const candidate = text(value, 2_048);
     if (!candidate)
         return null;
     try {
-        return new URL(/^[a-z][a-z\d+.-]*:\/\//iu.test(candidate) ? candidate : `https://${candidate}`)
-            .hostname.toLowerCase().replace(/\.$/u, '');
+        const parsed = new URL(/^[a-z][a-z\d+.-]*:\/\//iu.test(candidate) ? candidate : `https://${candidate}`);
+        const parsedHostname = hostname(parsed.hostname);
+        return parsedHostname && parsed.origin !== 'null'
+            ? Object.freeze({ origin: parsed.origin, hostname: parsedHostname })
+            : null;
     }
     catch {
         return null;
@@ -233,12 +236,12 @@ export function buildLookupAssetGraph(input) {
         ...textList(input.profileDomains?.partner, 32),
         ...textList(input.profileDomains?.allowlisted, 32),
     ].map((value) => value.toLowerCase().replace(/\.$/u, '')));
-    const trustBoundary = (candidate, sourceHost = target) => {
+    const trustBoundary = (candidate, sourceHost = target, candidateOrigin = null, sourceOrigin = null) => {
         if (!candidate)
             return 'unresolved';
-        if (candidate === sourceHost)
+        if (candidateOrigin && sourceOrigin && candidateOrigin === sourceOrigin)
             return 'same_origin';
-        if (candidate === target || candidate.endsWith(`.${target}`))
+        if (candidate === sourceHost || candidate === target || candidate.endsWith(`.${target}`))
             return 'same_registrable_domain';
         if (reviewedProfileDomains.has(candidate))
             return 'reviewed_profile';
@@ -414,7 +417,8 @@ export function buildLookupAssetGraph(input) {
         }
     }
     const httpEvidence = record(input.httpEvidence);
-    const finalHost = urlHost(httpEvidence.finalUrl);
+    const finalOrigin = webOrigin(httpEvidence.finalUrl);
+    const finalHost = finalOrigin?.hostname ?? null;
     const finalHostId = finalHost
         ? connect('hostname', finalHost, {
             kind: 'redirects-to',
@@ -429,9 +433,9 @@ export function buildLookupAssetGraph(input) {
         }, 'Observed final website origin')
         : null;
     const identitySource = finalHostId || targetId;
-    const canonicalHost = urlHost(record(input.pageCanonical).url);
-    if (canonicalHost) {
-        connect('origin', canonicalHost, {
+    const canonicalOrigin = webOrigin(record(input.pageCanonical).url);
+    if (canonicalOrigin) {
+        connect('origin', canonicalOrigin.origin, {
             kind: 'declares-canonical',
             label: 'declares canonical origin',
             sourceLabel: 'HTML canonical metadata',
@@ -440,12 +444,12 @@ export function buildLookupAssetGraph(input) {
             limitations: limitations(record(input.pageIdentity).limitations),
             lenses: ['identity'],
             href: '#evidence-page',
-            boundary: trustBoundary(canonicalHost, finalHost || target),
+            boundary: trustBoundary(canonicalOrigin.hostname, finalHost || target, canonicalOrigin.origin, finalOrigin?.origin ?? null),
         }, 'Publisher-declared canonical origin', identitySource);
     }
-    const openGraphHost = urlHost(record(input.pageOpenGraphUrl).url);
-    if (openGraphHost) {
-        connect('origin', openGraphHost, {
+    const openGraphOrigin = webOrigin(record(input.pageOpenGraphUrl).url);
+    if (openGraphOrigin) {
+        connect('origin', openGraphOrigin.origin, {
             kind: 'declares-open-graph',
             label: 'declares Open Graph origin',
             sourceLabel: 'Open Graph metadata',
@@ -454,13 +458,13 @@ export function buildLookupAssetGraph(input) {
             limitations: limitations(record(input.pageIdentity).limitations),
             lenses: ['identity'],
             href: '#evidence-page',
-            boundary: trustBoundary(openGraphHost, finalHost || target),
+            boundary: trustBoundary(openGraphOrigin.hostname, finalHost || target, openGraphOrigin.origin, finalOrigin?.origin ?? null),
         }, 'Publisher-declared Open Graph origin', identitySource);
     }
     for (const origin of textList(record(input.pageForms).externalActionOrigins)) {
-        const host = urlHost(origin);
-        if (host) {
-            connect('origin', host, {
+        const destination = webOrigin(origin);
+        if (destination) {
+            connect('origin', destination.origin, {
                 kind: 'form-destination',
                 label: 'form may submit to',
                 sourceLabel: 'Static HTML form',
@@ -469,14 +473,14 @@ export function buildLookupAssetGraph(input) {
                 limitations: ['A declared form action does not prove that a user submitted data or that the endpoint received it.'],
                 lenses: ['identity'],
                 href: '#evidence-page',
-                boundary: trustBoundary(host, finalHost || target),
+                boundary: trustBoundary(destination.hostname, finalHost || target, destination.origin, finalOrigin?.origin ?? null),
             }, 'External form-action origin', identitySource);
         }
     }
     for (const origin of textList(record(input.pageResources).externalOrigins)) {
-        const host = urlHost(origin);
-        if (host) {
-            connect('hostname', host, {
+        const resource = webOrigin(origin);
+        if (resource) {
+            connect('origin', resource.origin, {
                 kind: 'loads-from',
                 label: 'references resources from',
                 sourceLabel: 'Static HTML resources',
@@ -485,7 +489,7 @@ export function buildLookupAssetGraph(input) {
                 limitations: ['A static resource reference does not prove that a browser loaded the resource or disclosed data to it.'],
                 lenses: ['identity'],
                 href: '#evidence-page',
-                boundary: trustBoundary(host, finalHost || target),
+                boundary: trustBoundary(resource.hostname, finalHost || target, resource.origin, finalOrigin?.origin ?? null),
             }, 'External resource origin', identitySource);
         }
     }
@@ -507,7 +511,7 @@ export function buildLookupAssetGraph(input) {
     const structuredIdentity = record(input.structuredDataIdentity);
     for (const entity of records(structuredIdentity.entities, 12)) {
         const entityLabel = text(entity.name, 180);
-        const declaredOrigin = urlHost(entity.declaredOrigin);
+        const declaredOrigin = webOrigin(entity.declaredOrigin);
         const entityId = entityLabel
             ? connect('identity', entityLabel, {
                 kind: 'declares-publisher',
@@ -524,7 +528,7 @@ export function buildLookupAssetGraph(input) {
             }, textList(entity.types, 5).join(', ') || 'Publisher-declared entity', identitySource)
             : identitySource;
         if (declaredOrigin) {
-            connect('origin', declaredOrigin, {
+            connect('origin', declaredOrigin.origin, {
                 kind: 'declares-origin',
                 label: 'declares origin',
                 sourceLabel: 'Structured identity metadata',
@@ -533,7 +537,7 @@ export function buildLookupAssetGraph(input) {
                 limitations: limitations(structuredIdentity.limitations),
                 lenses: ['identity'],
                 href: '#evidence-structured-identity',
-                boundary: trustBoundary(declaredOrigin, finalHost || target),
+                boundary: trustBoundary(declaredOrigin.hostname, finalHost || target, declaredOrigin.origin, finalOrigin?.origin ?? null),
             }, 'Publisher-declared structured-data origin', entityId || identitySource);
         }
         for (const sameAsHost of textList(entity.sameAsHosts, 12)) {
@@ -666,7 +670,11 @@ export function buildLookupAssetGraph(input) {
             }
         }
         const issuer = record(input.tlsIssuer);
-        const issuerLabel = text(issuer.organization || issuer.commonName || issuer.CN, 180);
+        const issuerOrganizations = textList(issuer.organizations, 8);
+        const issuerCommonNames = textList(issuer.commonNames, 8);
+        const issuerLabel = issuerOrganizations[0]
+            || issuerCommonNames[0]
+            || text(issuer.organization || issuer.commonName || issuer.CN, 180);
         if (issuerLabel) {
             const issuerId = addNode('issuer', issuerLabel, 'Certificate issuer');
             if (issuerId) {