@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/lib/domain-change-packet.mjs

@@ -1,11 +1,16 @@
 import { exactKeys, requireBoundedString, requireDomainName, requireIsoTimestamp, requireRecord, } from "./bounded-contract-normalizers.mjs";
 import { DOMAIN_ASSURANCE_INPUT_SCHEMA, buildDomainAssurance, } from "./domain-assurance.mjs";
-import { DOMAIN_CHANGE_INPUT_SCHEMA, reviewDomainChange, } from "./domain-change-review.mjs";
+import { DOMAIN_CHANGE_INPUT_SCHEMA, DOMAIN_CHANGE_REVIEW_VERSION, reviewDomainChange, } from "./domain-change-review.mjs";
 import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../packages/evidence/artifact-integrity.mjs";
 export const DOMAIN_CHANGE_PACKET_INPUT_SCHEMA = 'whoisleuth.domain-change-packet.input';
 export const DOMAIN_CHANGE_PACKET_SCHEMA = 'whoisleuth.domain-change-packet';
 export const DOMAIN_CHANGE_PACKET_INPUT_VERSION = 1;
-export const DOMAIN_CHANGE_PACKET_VERSION = 2;
+export const DOMAIN_CHANGE_PACKET_VERSION = 3;
+export const DOMAIN_CHANGE_PACKET_REVIEW_VERSIONS = Object.freeze({
+    2: 1,
+    [DOMAIN_CHANGE_PACKET_VERSION]: DOMAIN_CHANGE_REVIEW_VERSION,
+});
+export const SUPPORTED_DOMAIN_CHANGE_PACKET_VERSIONS = Object.freeze(Object.keys(DOMAIN_CHANGE_PACKET_REVIEW_VERSIONS).map(Number));
 export const MAX_DOMAIN_CHANGE_PACKET_INPUT_BYTES = 6 * 1024 * 1024;
 const ROOT_KEYS = new Set([
     'schema',
@@ -38,23 +43,50 @@ function changeSummary(before, after) {
     const beforeRows = rows(before);
     const afterRows = rows(after);
     const keys = [...new Set([...beforeRows.keys(), ...afterRows.keys()])].sort();
-    return Object.freeze(keys.slice(0, 500).flatMap((key) => {
+    const authorityCollectionComplete = (review) => {
+        const representative = review.authoritativeRecordMatrix[0];
+        return Boolean(representative
+            && representative.observations.length >= 2
+            && representative.observations.every((item) => item.state === 'observed'));
+    };
+    const rowEvidence = (review, row) => {
+        if (!row)
+            return Object.freeze({
+                state: authorityCollectionComplete(review) ? 'complete' : 'unavailable',
+                values: Object.freeze([]),
+            });
+        if (row.observations.some((item) => item.state !== 'observed')) {
+            return Object.freeze({ state: 'partial', values: Object.freeze([]) });
+        }
+        if (row.state === 'different')
+            return Object.freeze({ state: 'inconsistent', values: Object.freeze([]) });
+        if (row.state !== 'aligned')
+            return Object.freeze({ state: 'insufficient', values: Object.freeze([]) });
+        return Object.freeze({
+            state: 'complete',
+            values: Object.freeze([...new Set(row.observations.flatMap((item) => item.values))].sort()),
+        });
+    };
+    const changed = [];
+    for (const key of keys.slice(0, 500)) {
         const left = beforeRows.get(key);
         const right = afterRows.get(key);
-        const leftValues = left?.observations.flatMap((item) => item.values) ?? [];
-        const rightValues = right?.observations.flatMap((item) => item.values) ?? [];
-        const beforeValues = [...new Set(leftValues)].sort();
-        const afterValues = [...new Set(rightValues)].sort();
-        if (JSON.stringify(beforeValues) === JSON.stringify(afterValues))
-            return [];
         const [owner, type] = key.split('\u0000');
-        return [Object.freeze({
-                owner: owner ?? '',
-                type: type ?? '',
-                beforeValues: Object.freeze(beforeValues),
-                afterValues: Object.freeze(afterValues),
-            })];
-    }));
+        const beforeEvidence = rowEvidence(before, left);
+        const afterEvidence = rowEvidence(after, right);
+        if (beforeEvidence.state !== 'complete' || afterEvidence.state !== 'complete') {
+            continue;
+        }
+        if (JSON.stringify(beforeEvidence.values) === JSON.stringify(afterEvidence.values))
+            continue;
+        changed.push(Object.freeze({
+            owner: owner ?? '',
+            type: type ?? '',
+            beforeValues: beforeEvidence.values,
+            afterValues: afterEvidence.values,
+        }));
+    }
+    return Object.freeze(changed);
 }
 export async function buildDomainChangePacket(inputRaw, generatedAtValue = new Date().toISOString()) {
     const input = record(inputRaw, 'Domain change packet input');
@@ -99,6 +131,7 @@ export async function buildDomainChangePacket(inputRaw, generatedAtValue = new D
         limitations: Object.freeze([
             'This packet is assembled only from analyst-supplied observations and planning metadata and makes no network request or configuration change.',
             'A ready result means the supplied bounded checks passed; it does not prove control, propagation completion, successful recovery, or absence of unobserved dependencies.',
+            'Authoritative record-set changes are reported only when both sides contain complete consistent observations; gate reasons describe incomplete comparisons.',
             'The integrity digest detects later changes to this packet but does not authenticate its author. Use a separately managed signing key when signer authentication is required.',
         ]),
     });

package/lib/domain-change-review.mjs

@@ -1,8 +1,9 @@
 import { exactKeys, requireBoundedString, requireDomainName, requireIsoTimestamp, requireRecord, } from "./bounded-contract-normalizers.mjs";
 import { normaliseRdata } from "./zone-intent-review.mjs";
 export const DOMAIN_CHANGE_INPUT_SCHEMA = 'whoisleuth.domain-change.input';
+export const DOMAIN_CHANGE_INPUT_VERSION = 1;
 export const DOMAIN_CHANGE_REVIEW_SCHEMA = 'whoisleuth.domain-change.review';
-export const DOMAIN_CHANGE_REVIEW_VERSION = 1;
+export const DOMAIN_CHANGE_REVIEW_VERSION = 2;
 export const MAX_DOMAIN_CHANGE_VANTAGES = 16;
 export const MAX_DOMAIN_CHANGE_RECORDS = 500;
 const ROOT_KEYS = new Set(['schema', 'version', 'domain', 'authoritySnapshots', 'resolverSnapshots', 'acmeDependencies', 'certificate', 'hsts']);
@@ -89,6 +90,9 @@ function normaliseSnapshots(value, apex, label) {
         throw new TypeError(`${label} labels must be unique.`);
     return Object.freeze(snapshots);
 }
+function snapshotProvenance(snapshot) {
+    return Object.freeze({ label: snapshot.label, source: snapshot.source, state: snapshot.state, observedAt: snapshot.observedAt });
+}
 function recordMatrix(snapshots) {
     const keys = [...new Set(snapshots.flatMap((snapshot) => snapshot.records.map((item) => `${item.owner}\u0000${item.type}`)))].sort();
     return Object.freeze(keys.map((key) => {
@@ -97,9 +101,7 @@ function recordMatrix(snapshots) {
             const matches = snapshot.records.filter((item) => item.owner === recordOwner && item.type === type);
             const ttls = matches.map((item) => item.ttl).filter((ttl) => ttl !== null);
             return Object.freeze({
-                label: snapshot.label,
-                source: snapshot.source,
-                state: snapshot.state,
+                ...snapshotProvenance(snapshot),
                 values: Object.freeze([...new Set(matches.map((item) => item.value))].sort()),
                 ttlRange: ttls.length ? Object.freeze({
                     minimum: Math.min(...ttls),
@@ -200,7 +202,7 @@ function normaliseCertificate(value) {
 }
 function reviewCertificate(certificate) {
     if (!certificate)
-        return Object.freeze({ state: 'not_supplied', continuity: 'unknown', findings: Object.freeze([]) });
+        return Object.freeze({ state: 'not_supplied', observedAt: null, continuity: 'unknown', findings: Object.freeze([]) });
     const continuity = !certificate.currentSpkiSha256 || !certificate.plannedSpkiSha256
         ? 'unknown'
         : certificate.currentSpkiSha256 === certificate.plannedSpkiSha256 ? 'retained' : 'changes';
@@ -210,7 +212,7 @@ function reviewCertificate(certificate) {
         ...(certificate.embeddedSctCount === 0
             ? ['No embedded certificate-transparency timestamp was observed; this does not establish that the certificate was not logged by another mechanism.'] : []),
     ];
-    return Object.freeze({ state: certificate.state, continuity, findings: Object.freeze(findings) });
+    return Object.freeze({ state: certificate.state, observedAt: certificate.observedAt, continuity, findings: Object.freeze(findings) });
 }
 function normaliseHsts(value) {
     if (value === null || value === undefined)
@@ -236,8 +238,8 @@ function serviceInventory(snapshots) {
 }
 export function reviewDomainChange(inputRaw, generatedAtValue = new Date().toISOString()) {
     const input = requireRecord(inputRaw, 'Domain change input');
-    if (input.schema !== DOMAIN_CHANGE_INPUT_SCHEMA || input.version !== 1)
-        throw new TypeError(`Domain change input must use ${DOMAIN_CHANGE_INPUT_SCHEMA} version 1.`);
+    if (input.schema !== DOMAIN_CHANGE_INPUT_SCHEMA || input.version !== DOMAIN_CHANGE_INPUT_VERSION)
+        throw new TypeError(`Domain change input must use ${DOMAIN_CHANGE_INPUT_SCHEMA} version ${DOMAIN_CHANGE_INPUT_VERSION}.`);
     exactKeys(input, ROOT_KEYS, 'Domain change input');
     const apex = domain(input.domain, 'domain');
     const authoritySnapshots = normaliseSnapshots(input.authoritySnapshots ?? [], apex, 'authoritySnapshots');
@@ -285,6 +287,10 @@ export function reviewDomainChange(inputRaw, generatedAtValue = new Date().toISO
         generatedAt: timestamp(generatedAtValue, 'generatedAt'),
         domain: apex,
         state: reviewRequired ? 'review' : 'ready',
+        sourceObservations: Object.freeze({
+            authorities: Object.freeze(authoritySnapshots.map(snapshotProvenance)),
+            resolvers: Object.freeze(resolverSnapshots.map(snapshotProvenance)),
+        }),
         authoritativeRecordMatrix: authorityMatrix,
         resolverDivergenceMatrix: resolverMatrix,
         dnssecAutomation: reviewDnssecAutomation(authorityMatrix),