@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/packages/evidence/artifact-integrity.mjs

@@ -39,7 +39,13 @@ function canonicalArtifactJsonV2(value) {
 }
 async function sha256ArtifactDigestV2(value) {
     const bytes = new TextEncoder().encode(canonicalArtifactJsonV2(value));
-    const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes);
+    return sha256ArtifactBytes(bytes);
+}
+async function sha256ArtifactBytes(bytes) {
+    const buffer = bytes.buffer;
+    if (!(buffer instanceof ArrayBuffer))
+        throw new TypeError('Artefact digests require non-shared bytes.');
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', new Uint8Array(buffer, bytes.byteOffset, bytes.byteLength));
     return `sha256:${[...new Uint8Array(digest)]
         .map((byte) => byte.toString(16).padStart(2, '0'))
         .join('')}`;
@@ -62,4 +68,4 @@ function sha256ArtifactDigestFor(value, canonicalization) {
         ? sha256ArtifactDigest(value)
         : sha256ArtifactDigestV2(value);
 }
-export { SORTED_JSON_V1, SORTED_JSON_V2, canonicalArtifactJson, canonicalArtifactJsonFor, canonicalArtifactJsonV2, resolveArtifactCanonicalization, sha256ArtifactDigest, sha256ArtifactDigestFor, sha256ArtifactDigestV2, };
+export { SORTED_JSON_V1, SORTED_JSON_V2, canonicalArtifactJson, canonicalArtifactJsonFor, canonicalArtifactJsonV2, resolveArtifactCanonicalization, sha256ArtifactDigest, sha256ArtifactDigestFor, sha256ArtifactDigestV2, sha256ArtifactBytes, };

package/packages/evidence/artifact-structure.mjs

@@ -0,0 +1,105 @@
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+const DIGEST_RE = /^sha256:[a-f0-9]{64}$/u;
+const DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
+export const HEX_DIGEST_RE = /^[a-f0-9]{64}$/u;
+export const SEMANTIC_VERSION_RE = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
+export function fail(label) {
+    throw new TypeError(`${label} has an unsupported or malformed structure.`);
+}
+export function record(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail(label);
+    return value;
+}
+export function exact(value, keys, label) {
+    const source = record(value, label);
+    const actual = Object.keys(source);
+    if (actual.length !== keys.length || actual.some((key) => !keys.includes(key)))
+        fail(label);
+    return source;
+}
+export function exactOptional(value, required, optional, label) {
+    const source = record(value, label);
+    const actual = Object.keys(source);
+    if (required.some((key) => !actual.includes(key))
+        || actual.some((key) => !required.includes(key) && !optional.includes(key)))
+        fail(label);
+    return source;
+}
+export function text(value, label, maximum = 2_000, allowEmpty = false) {
+    if (typeof value !== 'string' || value.length > maximum || CONTROL_RE.test(value) || (!allowEmpty && !value))
+        fail(label);
+    return value;
+}
+export function optionalText(value, label, maximum = 2_000) {
+    if (value !== null)
+        text(value, label, maximum);
+}
+export function iso(value, label, nullable = false) {
+    if (nullable && value === null)
+        return;
+    const candidate = text(value, label, 64);
+    const parsed = Date.parse(candidate);
+    if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== candidate)
+        fail(label);
+}
+export function integer(value, label, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) {
+    if (!Number.isSafeInteger(value) || Number(value) < minimum || Number(value) > maximum)
+        fail(label);
+    return Number(value);
+}
+export function boolean(value, label) {
+    if (typeof value !== 'boolean')
+        fail(label);
+}
+export function enumeration(value, allowed, label) {
+    if (typeof value !== 'string' || !allowed.includes(value))
+        fail(label);
+    return value;
+}
+export function array(value, label, maximum, minimum = 0) {
+    if (!Array.isArray(value) || value.length < minimum || value.length > maximum)
+        fail(label);
+    return value;
+}
+export function strings(value, label, maximum, textMaximum = 2_000) {
+    const values = array(value, label, maximum);
+    for (const item of values)
+        text(item, label, textMaximum);
+    return values;
+}
+export function digest(value, label) {
+    if (typeof value !== 'string' || !DIGEST_RE.test(value))
+        fail(label);
+}
+export function sameValues(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+export function domain(value, label) {
+    if (typeof value !== 'string' || !DOMAIN_RE.test(value))
+        fail(label);
+}
+export function absoluteUrl(value, label, protocols) {
+    const candidate = text(value, label, 2_048);
+    try {
+        const parsed = new URL(candidate);
+        if (!protocols.includes(parsed.protocol) || parsed.username || parsed.password || parsed.search || parsed.hash)
+            fail(label);
+        return parsed;
+    }
+    catch {
+        return fail(label);
+    }
+}
+export function nullableRecord(value, label) {
+    if (value !== null)
+        record(value, label);
+}
+export function validateIntegrity(value, label, version, currentVersion) {
+    if (version !== currentVersion)
+        fail(label);
+    const integrity = exact(value, ['algorithm', 'canonicalization', 'digestSha256'], label);
+    if (integrity.algorithm !== 'SHA-256' || integrity.canonicalization !== 'sorted-json-v2')
+        fail(label);
+    digest(integrity.digestSha256, label);
+}

package/packages/evidence/decision-fact.mjs

@@ -352,7 +352,10 @@ function boundedDataArray(value, maximum, label) {
         || Number(length) < 0) {
         throw new TypeError(`${label} must have a stable non-negative length.`);
     }
-    const retainedLength = Math.min(Number(length), maximum);
+    if (Number(length) > maximum) {
+        throw new TypeError(`${label} exceeds its ${maximum}-item admission bound; no partial fact was retained.`);
+    }
+    const retainedLength = Number(length);
     const output = [];
     for (let index = 0; index < retainedLength; index += 1) {
         const descriptor = stableOwnDescriptor(value, String(index), label);

package/packages/evidence/domain-control-runtime.mjs

@@ -1,7 +1,9 @@
+import { analystReviewAgeAt, ANALYST_REVIEW_STALE_AFTER_DAYS } from "./review-age.mjs";
 import { canonicalArtifactJsonFor, resolveArtifactCanonicalization, } from "./artifact-integrity.mjs";
 import { normalizeDomain } from "./domain-name.mjs";
 import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "./observation.mjs";
-import { DOMAIN_CONTROL_CAA_RECORD_KEYS, DOMAIN_CONTROL_DIGEST_SHA256_HEX_LENGTH, DOMAIN_CONTROL_DS_RECORD_KEYS, DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA as DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_INPUT_KEYS, DOMAIN_CONTROL_MANIFEST_INPUT_VERSION, DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS, DOMAIN_CONTROL_MANIFEST_LIMITATIONS, DOMAIN_CONTROL_MANIFEST_ROOT_KEYS, DOMAIN_CONTROL_MANIFEST_SCHEMA as DOMAIN_CONTROL_PASSPORT_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_MX_RECORD_KEYS, DOMAIN_CONTROL_RECORD_LIST_FIELDS, DOMAIN_CONTROL_SPKI_SHA256_HEX_LENGTH, DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_CAA_FLAGS, MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_CAA_TAG_LENGTH, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH, MAX_DOMAIN_CONTROL_DOMAIN_LENGTH, MAX_DOMAIN_CONTROL_DS_ALGORITHM, MAX_DOMAIN_CONTROL_DS_DIGEST_LENGTH, MAX_DOMAIN_CONTROL_DS_DIGEST_TYPE, MAX_DOMAIN_CONTROL_DS_KEY_TAG, MAX_DOMAIN_CONTROL_DS_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_INPUT_RECORDS, MAX_DOMAIN_CONTROL_JSON_DEPTH, MAX_DOMAIN_CONTROL_JSON_VALUES, MAX_DOMAIN_CONTROL_MANIFEST_BYTES, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_MX_PRIORITY, MAX_DOMAIN_CONTROL_MX_TEXT_LENGTH, MAX_DOMAIN_CONTROL_NAME_INPUT_LENGTH, MAX_DOMAIN_CONTROL_NOTE_LENGTH, MAX_DOMAIN_CONTROL_RECORD_INTEGER_TEXT_LENGTH, MAX_DOMAIN_CONTROL_TEXT_LENGTH, MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH, MIN_DOMAIN_CONTROL_DS_DIGEST_LENGTH, MIN_DOMAIN_CONTROL_MANIFEST_ENTRIES, MIN_DOMAIN_CONTROL_RECORDS, } from "../contracts/domain-control-manifest.mjs";
+import { MAX_POSTURE_CHECK_RECORDS } from "./domain-posture-context.mjs";
+import { DOMAIN_CONTROL_CAA_RECORD_KEYS, DOMAIN_CONTROL_DIGEST_SHA256_HEX_LENGTH, DOMAIN_CONTROL_DS_RECORD_KEYS, DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA as DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_INPUT_KEYS, DOMAIN_CONTROL_MANIFEST_INPUT_VERSION, DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS, DOMAIN_CONTROL_MANIFEST_LIMITATIONS, DOMAIN_CONTROL_MANIFEST_ROOT_KEYS, DOMAIN_CONTROL_MANIFEST_SCHEMA as DOMAIN_CONTROL_PASSPORT_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_MX_RECORD_KEYS, DOMAIN_CONTROL_RECORD_LIST_FIELDS, DOMAIN_CONTROL_RECORD_MODE_OPTIONS, DOMAIN_CONTROL_SPKI_SHA256_HEX_LENGTH, DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_CURRENT_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_CAA_FLAGS, MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_CAA_TAG_LENGTH, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH, MAX_DOMAIN_CONTROL_DOMAIN_LENGTH, MAX_DOMAIN_CONTROL_DS_ALGORITHM, MAX_DOMAIN_CONTROL_DS_DIGEST_LENGTH, MAX_DOMAIN_CONTROL_DS_DIGEST_TYPE, MAX_DOMAIN_CONTROL_DS_KEY_TAG, MAX_DOMAIN_CONTROL_DS_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_INPUT_RECORDS, MAX_DOMAIN_CONTROL_JSON_DEPTH, MAX_DOMAIN_CONTROL_JSON_VALUES, MAX_DOMAIN_CONTROL_MANIFEST_BYTES, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_MX_PRIORITY, MAX_DOMAIN_CONTROL_MX_TEXT_LENGTH, MAX_DOMAIN_CONTROL_NAME_INPUT_LENGTH, MAX_DOMAIN_CONTROL_NOTE_LENGTH, MAX_DOMAIN_CONTROL_RECORD_INTEGER_TEXT_LENGTH, MAX_DOMAIN_CONTROL_TEXT_LENGTH, MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH, MIN_DOMAIN_CONTROL_DS_DIGEST_LENGTH, MIN_DOMAIN_CONTROL_MANIFEST_ENTRIES, MIN_DOMAIN_CONTROL_RECORDS, PUBLIC_DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, PUBLIC_DOMAIN_CONTROL_MANIFEST_INPUT_VERSION, PUBLIC_DOMAIN_CONTROL_MANIFEST_LIMITATIONS, PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION, SUPPORTED_DOMAIN_CONTROL_MANIFEST_INPUT_VERSIONS, } from "../contracts/domain-control-manifest.mjs";
 const DOMAIN_CONTROL_PASSPORT_VERSION = DOMAIN_CONTROL_MANIFEST_INPUT_VERSION;
 export { DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA, DOMAIN_CONTROL_PASSPORT_SCHEMA, DOMAIN_CONTROL_PASSPORT_VERSION, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_MANIFEST_BYTES, };
 export const MAX_DOMAIN_CONTROL_PASSPORT_BYTES = MAX_DOMAIN_CONTROL_MANIFEST_BYTES;
@@ -10,6 +12,8 @@ export const DOMAIN_CONTROL_PASSPORT_LIMITATIONS = DOMAIN_CONTROL_MANIFEST_LIMIT
 const INPUT_KEYS = new Set(DOMAIN_CONTROL_MANIFEST_INPUT_KEYS);
 const MANIFEST_KEYS = new Set(DOMAIN_CONTROL_MANIFEST_ROOT_KEYS);
 const ENTRY_KEYS = new Set(DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS);
+const PUBLIC_ENTRY_KEYS = new Set(PUBLIC_DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS);
+const RECORD_MODE_KEYS = new Set(DOMAIN_CONTROL_RECORD_LIST_FIELDS);
 const INTEGRITY_KEYS = new Set(DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS);
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const RECORD_LIST_FIELDS = DOMAIN_CONTROL_RECORD_LIST_FIELDS;
@@ -82,6 +86,7 @@ function boundedDataArray(value, label, minimum, maximum, maximumMessage) {
     return result;
 }
 const MX_RECORD_KEYS = new Set(DOMAIN_CONTROL_MX_RECORD_KEYS);
+const RESOLVER_MX_RECORD_KEYS = new Set([...MX_RECORD_KEYS, 'type']);
 const CAA_RECORD_KEYS = new Set(DOMAIN_CONTROL_CAA_RECORD_KEYS);
 const DS_RECORD_KEYS = new Set(DOMAIN_CONTROL_DS_RECORD_KEYS);
 const DS_DIGEST_PATTERN = new RegExp(`^[a-f0-9]{${MIN_DOMAIN_CONTROL_DS_DIGEST_LENGTH},${MAX_DOMAIN_CONTROL_DS_DIGEST_LENGTH}}$`, 'u');
@@ -155,31 +160,90 @@ function canonicalIntegerAlias(source, keys, maximum, label, fallback = null) {
     }
     return normalised[0] ?? null;
 }
-export function canonicalMxRecord(value) {
-    const item = structuredRecord(value, MX_RECORD_KEYS, 'Domain control MX record');
+function mxRecordParts(value, resolverRecord = false) {
+    const item = structuredRecord(value, resolverRecord ? RESOLVER_MX_RECORD_KEYS : MX_RECORD_KEYS, 'Domain control MX record');
     if (item) {
-        const host = canonicalStringAlias(item, ['exchange', 'host', 'value'], exchange, 'Domain control MX host');
+        if (resolverRecord && Object.hasOwn(item, 'type') && item.type !== 'MX')
+            return null;
+        const host = canonicalStringAlias(item, ['exchange', 'host', 'value'], (value) => value === '' ? '.' : exchange(value), 'Domain control MX host');
         const priority = canonicalIntegerAlias(item, ['priority', 'preference'], MAX_DOMAIN_CONTROL_MX_PRIORITY, 'Domain control MX priority');
-        return host && priority !== null ? `${priority} ${host}` : '';
+        return host && priority !== null ? { priority, exchange: host } : null;
     }
     const candidate = recordText(value, MAX_DOMAIN_CONTROL_MX_TEXT_LENGTH).toLowerCase();
     const match = /^(\d{1,5})\s+(.+)$/u.exec(candidate);
     if (match) {
         const priority = recordInteger(match[1], MAX_DOMAIN_CONTROL_MX_PRIORITY);
         const host = exchange(match[2]);
-        return priority !== null && host ? `${priority} ${host}` : '';
+        return priority !== null && host ? { priority, exchange: host } : null;
+    }
+    const host = exchange(candidate);
+    return host ? { priority: null, exchange: host } : null;
+}
+export function canonicalMxRecord(value) {
+    const parts = mxRecordParts(value);
+    return !parts ? '' : parts.priority === null ? parts.exchange : `${parts.priority} ${parts.exchange}`;
+}
+function completeMxRecord(value, resolverRecord) {
+    try {
+        const parts = mxRecordParts(value, resolverRecord);
+        return parts && parts.priority !== null
+            ? { priority: parts.priority, exchange: parts.exchange } : null;
+    }
+    catch (error) {
+        if (!(error instanceof TypeError))
+            throw error;
+        return null;
     }
-    return exchange(candidate);
 }
-function caaValue(value) {
-    return recordText(value, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH).replace(/^(?:"([\s\S]*)"|'([\s\S]*)')$/u, '$1$2').trim().toLowerCase();
+/** Complete canonical records require a preference and retain the root exchange as '.'. */
+export function normalizeMxRecord(value) {
+    return completeMxRecord(value, false);
+}
+/** Accept the native resolver's optional record type without broadening import shapes. */
+export function normalizeResolverMxRecord(value) {
+    return completeMxRecord(value, true);
+}
+function caaValue(value, tag) {
+    const candidate = recordText(value, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH)
+        .replace(/^(?:"([\s\S]*)"|'([\s\S]*)')$/u, '$1$2').trim();
+    if (!candidate)
+        return '';
+    if (tag === 'issue' || tag === 'issuewild') {
+        const [issuer = '', ...parameters] = candidate.split(';');
+        const normalizedIssuer = issuer.trim().toLowerCase().replace(/\.$/u, '');
+        return [normalizedIssuer, ...parameters.map((parameter) => parameter.trim())].join('; ');
+    }
+    const scheme = /^([a-z][a-z0-9+.-]*):(.*)$/isu.exec(candidate);
+    if (!scheme)
+        return candidate;
+    const normalizedScheme = scheme[1].toLowerCase();
+    if (normalizedScheme === 'http' || normalizedScheme === 'https') {
+        try {
+            const url = new URL(candidate);
+            url.protocol = normalizedScheme;
+            url.hostname = url.hostname.toLowerCase();
+            return url.toString();
+        }
+        catch {
+            return candidate;
+        }
+    }
+    if (normalizedScheme === 'mailto') {
+        const [address = '', ...query] = scheme[2].split('?');
+        const at = address.lastIndexOf('@');
+        const normalizedAddress = at > 0
+            ? `${address.slice(0, at)}@${address.slice(at + 1).toLowerCase()}`
+            : address;
+        return `${normalizedScheme}:${normalizedAddress}${query.length ? `?${query.join('?')}` : ''}`;
+    }
+    return `${normalizedScheme}:${scheme[2]}`;
 }
 export function canonicalCaaRecord(value) {
     const item = structuredRecord(value, CAA_RECORD_KEYS, 'Domain control CAA record');
     if (item) {
         const flags = canonicalIntegerAlias(item, ['critical', 'flags'], MAX_DOMAIN_CONTROL_CAA_FLAGS, 'Domain control CAA flags', 0);
         const tag = recordText(item.tag, MAX_DOMAIN_CONTROL_CAA_TAG_LENGTH).toLowerCase();
-        const payload = caaValue(item.value);
+        const payload = caaValue(item.value, tag);
         return flags !== null && /^(?:issue|issuewild|iodef)$/u.test(tag) && payload
             ? `${flags} ${tag} ${payload}`
             : '';
@@ -190,7 +254,7 @@ export function canonicalCaaRecord(value) {
         return '';
     const flags = recordInteger(match[1], MAX_DOMAIN_CONTROL_CAA_FLAGS);
     const tag = match[2]?.toLowerCase() ?? '';
-    const payload = caaValue(match[3]);
+    const payload = caaValue(match[3], tag);
     return flags !== null && payload ? `${flags} ${tag} ${payload}` : '';
 }
 export function canonicalDsRecord(value) {
@@ -233,6 +297,88 @@ export function canonicalDomainControlRecordList(value, kind) {
         .sort(compareCodeUnits)
         .slice(0, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS);
 }
+/** Complete field values for posture review; an invalid value never becomes an absent record. */
+export function canonicalPostureRecords(checkId, values) {
+    if (values.length > MAX_POSTURE_CHECK_RECORDS)
+        return null;
+    const normalise = checkId === 'nameservers' ? domainControlName
+        : checkId === 'mx' ? canonicalMxRecord : checkId === 'caa' ? canonicalCaaRecord
+            : checkId === 'registration_lock'
+                ? (value) => typeof value === 'string' && value.length <= 120 && !/[\u0000-\u001f\u007f]/u.test(value)
+                    ? value.trim().toLowerCase().replace(/[\s_-]+/gu, '') : ''
+                : null;
+    if (!normalise)
+        return null;
+    try {
+        const records = values.map(normalise);
+        if (records.some((value) => !value))
+            return null;
+        return [...new Set(records)].sort(compareCodeUnits);
+    }
+    catch {
+        return null;
+    }
+}
+/** Complete current record inputs are rejected, not shortened, when invalid or over capacity. */
+export function canonicalDomainControlRecords(value, field) {
+    if (value === undefined)
+        return [];
+    const rows = boundedDataArray(value, `Domain control ${field}`, 0, MAX_DOMAIN_CONTROL_INPUT_RECORDS);
+    const normalise = field === 'nameservers' ? domainControlName : field === 'ds' ? canonicalDsRecord
+        : field === 'mx' ? canonicalMxRecord : canonicalCaaRecord;
+    const values = rows.map(normalise);
+    if (values.some((item) => !item))
+        throw new TypeError(`Domain control ${field} contains an invalid record.`);
+    const records = [...new Set(values)].sort(compareCodeUnits);
+    if (records.length > MAX_CURRENT_DOMAIN_CONTROL_RECORDS)
+        throw new TypeError(`Domain control ${field} exceeds ${MAX_CURRENT_DOMAIN_CONTROL_RECORDS} records.`);
+    return records;
+}
+export function domainControlRecordMode(entry, field) {
+    return entry.recordModes?.[field] ?? (entry[field].length ? 'expect_records' : 'unconfigured');
+}
+export function normalizeDomainControlRecordModes(value, records) {
+    const source = normalizeDeclaredDomainControlRecordModes(value);
+    return Object.freeze(Object.fromEntries(DOMAIN_CONTROL_RECORD_LIST_FIELDS.map((field) => {
+        const mode = Object.hasOwn(source, field) ? source[field] : (records[field].length ? 'expect_records' : 'unconfigured');
+        if ((mode === 'expect_records') !== (records[field].length > 0)) {
+            throw new TypeError(`Domain control ${field} requires records only in the specified-records mode.`);
+        }
+        return [field, mode];
+    })));
+}
+export function normalizeDeclaredDomainControlRecordModes(value) {
+    const source = value === undefined ? {} : boundedDataRecord(value, RECORD_MODE_KEYS, 'Domain control record modes');
+    if (!source)
+        throw new TypeError('Domain control record modes must be an ordinary object.');
+    const modes = {};
+    for (const field of DOMAIN_CONTROL_RECORD_LIST_FIELDS) {
+        if (!Object.hasOwn(source, field))
+            continue;
+        const mode = source[field];
+        if (!DOMAIN_CONTROL_RECORD_MODE_OPTIONS.some((option) => option.value === mode))
+            throw new TypeError(`Domain control ${field} has an unsupported record mode.`);
+        modes[field] = mode;
+    }
+    return Object.freeze(modes);
+}
+export function normalizeDomainControlRecordSettings(value) {
+    const records = {
+        nameservers: canonicalDomainControlRecords(value.nameservers, 'nameservers'),
+        ds: canonicalDomainControlRecords(value.ds, 'ds'),
+        mx: canonicalDomainControlRecords(value.mx, 'mx'),
+        caa: canonicalDomainControlRecords(value.caa, 'caa'),
+    };
+    return { ...records, recordModes: normalizeDomainControlRecordModes(value.recordModes, records) };
+}
+export function domainControlEvidenceAdmission(observedAt, now) {
+    const age = analystReviewAgeAt(observedAt, now);
+    if (age === 'unknown')
+        return 'A valid source observation time at or before the review is required.';
+    if (age === 'stale')
+        return `The source observation is more than ${ANALYST_REVIEW_STALE_AFTER_DAYS} days old; collect a current observation before comparing expected settings.`;
+    return null;
+}
 class DomainControlJsonBudgetError extends Error {
 }
 class DomainControlJsonStructureError extends Error {
@@ -365,10 +511,10 @@ export function domainControlPassportSerialisedBytes(value, label = 'Domain cont
 export function assertDomainControlPassportByteBudget(value, label = 'Domain control manifest') {
     domainControlPassportSerialisedBytes(value, label);
 }
-function boundedDomainControlPassportEntries(value, label) {
+function boundedDomainControlPassportEntries(value, label, legacy = false) {
     const entries = boundedDataArray(value, label, MIN_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES);
     return entries.map((entry) => {
-        const source = boundedDataRecord(entry, ENTRY_KEYS, `${label} entry`);
+        const source = boundedDataRecord(entry, legacy ? PUBLIC_ENTRY_KEYS : ENTRY_KEYS, `${label} entry`);
         if (!source)
             return entry;
         for (const field of RECORD_LIST_FIELDS) {
@@ -376,6 +522,11 @@ function boundedDomainControlPassportEntries(value, label) {
                 continue;
             source[field] = boundedDataArray(source[field], `${label} entry ${field}`, MIN_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_INPUT_RECORDS, `${label} entry ${field} exceeds ${MAX_DOMAIN_CONTROL_INPUT_RECORDS} input records.`);
         }
+        if (Object.hasOwn(source, 'recordModes')) {
+            source.recordModes = boundedDataRecord(source.recordModes, RECORD_MODE_KEYS, `${label} entry record modes`);
+            if (!source.recordModes)
+                throw new TypeError(`${label} entry record modes must be an ordinary object.`);
+        }
         return source;
     });
 }
@@ -405,48 +556,62 @@ function hostnames(value) {
     return [...new Set(names)].sort(compareCodeUnits).slice(0, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS);
 }
 function digest(value) {
-    const candidate = text(value, DOMAIN_CONTROL_SPKI_SHA256_HEX_LENGTH)?.toLowerCase() ?? '';
+    if (typeof value !== 'string' || CONTROL_RE.test(value))
+        return null;
+    const candidate = value.trim().toLowerCase();
     return SPKI_DIGEST_PATTERN.test(candidate) ? candidate : null;
 }
-function normalizeEntry(value) {
+function normalizeEntry(value, legacyRecords, includeModes) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return null;
     const source = value;
     const domain = domainControlName(source.domain);
     if (!domain)
         return null;
+    const tlsSpkiSha256 = digest(source.tlsSpkiSha256);
+    if (source.tlsSpkiSha256 !== undefined && source.tlsSpkiSha256 !== null
+        && (typeof source.tlsSpkiSha256 !== 'string' || source.tlsSpkiSha256.trim())
+        && !tlsSpkiSha256) {
+        throw new TypeError('Domain control TLS public-key fingerprint must be exactly 64 hexadecimal characters.');
+    }
+    const records = {
+        nameservers: Object.freeze(legacyRecords ? hostnames(source.nameservers) : canonicalDomainControlRecords(source.nameservers, 'nameservers')),
+        ds: Object.freeze(legacyRecords ? canonicalDomainControlRecordList(source.ds, 'ds') : canonicalDomainControlRecords(source.ds, 'ds')),
+        mx: Object.freeze(legacyRecords ? canonicalDomainControlRecordList(source.mx, 'mx') : canonicalDomainControlRecords(source.mx, 'mx')),
+        caa: Object.freeze(legacyRecords ? canonicalDomainControlRecordList(source.caa, 'caa') : canonicalDomainControlRecords(source.caa, 'caa')),
+    };
     return Object.freeze({
         domain,
-        nameservers: Object.freeze(hostnames(source.nameservers)),
-        ds: Object.freeze(canonicalDomainControlRecordList(source.ds, 'ds')),
-        mx: Object.freeze(canonicalDomainControlRecordList(source.mx, 'mx')),
-        caa: Object.freeze(canonicalDomainControlRecordList(source.caa, 'caa')),
+        ...records,
+        ...(includeModes ? { recordModes: normalizeDomainControlRecordModes(source.recordModes, records) } : {}),
         tlsIssuer: text(source.tlsIssuer, MAX_DOMAIN_CONTROL_TEXT_LENGTH)?.toLowerCase() ?? null,
-        tlsSpkiSha256: digest(source.tlsSpkiSha256),
+        tlsSpkiSha256,
         registrarLock: source.registrarLock === 'required' || source.registrarLock === 'not_required'
             ? source.registrarLock
             : null,
-        renewalReviewAt: timestamp(source.renewalReviewAt, true),
+        renewalReviewAt: timestamp(source.renewalReviewAt, legacyRecords),
         note: text(source.note, MAX_DOMAIN_CONTROL_NOTE_LENGTH),
     });
 }
 function buildUnsignedDomainControlPassportInternal(input, generatedAtValue, options = {}) {
     const source = boundedDataRecord(input, INPUT_KEYS, 'Domain control manifest input');
-    if (!source || source.schema !== DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA || source.version !== DOMAIN_CONTROL_MANIFEST_INPUT_VERSION) {
-        throw new TypeError(`Domain control manifest input must use ${DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA} version ${DOMAIN_CONTROL_MANIFEST_INPUT_VERSION}.`);
+    if (!source || source.schema !== DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA || !SUPPORTED_DOMAIN_CONTROL_MANIFEST_INPUT_VERSIONS.some((version) => version === source.version)) {
+        throw new TypeError(`Domain control manifest input must use ${DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA} version ${SUPPORTED_DOMAIN_CONTROL_MANIFEST_INPUT_VERSIONS.join(' or ')}.`);
     }
-    const inputEntries = boundedDomainControlPassportEntries(source.entries, 'Domain control manifest input');
+    const legacy = source.version === PUBLIC_DOMAIN_CONTROL_MANIFEST_INPUT_VERSION;
+    const version = options.manifestVersion ?? DOMAIN_CONTROL_MANIFEST_VERSION;
+    const inputEntries = boundedDomainControlPassportEntries(source.entries, 'Domain control manifest input', legacy);
     source.entries = inputEntries;
     assertDomainControlPassportByteBudget(source, 'Domain control manifest input');
     const generatedAt = timestamp(generatedAtValue, options.legacyGeneratedAt === true);
-    const expiresAt = timestamp(source.expiresAt, true);
+    const expiresAt = timestamp(source.expiresAt, legacy);
     if (!generatedAt) {
         throw new TypeError('Domain control manifest generation time must be valid and include an explicit timezone.');
     }
     if (!expiresAt || Date.parse(expiresAt) <= Date.parse(generatedAt)) {
         throw new TypeError('Domain control manifest expiry must be a valid time after generation.');
     }
-    const entries = inputEntries.map(normalizeEntry);
+    const entries = inputEntries.map((entry) => normalizeEntry(entry, legacy, version === DOMAIN_CONTROL_MANIFEST_VERSION));
     if (entries.some((entry) => entry === null))
         throw new TypeError('Domain control manifest contains an invalid entry.');
     const normalizedEntries = entries;
@@ -458,11 +623,11 @@ function buildUnsignedDomainControlPassportInternal(input, generatedAtValue, opt
         : [...normalizedEntries].sort((left, right) => compareCodeUnits(left.domain, right.domain));
     return Object.freeze({
         schema: DOMAIN_CONTROL_PASSPORT_SCHEMA,
-        version: DOMAIN_CONTROL_MANIFEST_VERSION,
+        version,
         generatedAt,
         expiresAt,
         entries: Object.freeze(orderedEntries),
-        limitations: DOMAIN_CONTROL_PASSPORT_LIMITATIONS,
+        limitations: version === PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION ? PUBLIC_DOMAIN_CONTROL_MANIFEST_LIMITATIONS : DOMAIN_CONTROL_PASSPORT_LIMITATIONS,
     });
 }
 export function buildUnsignedDomainControlPassport(input, generatedAtValue, options = {}) {
@@ -479,29 +644,32 @@ function normalizeDomainControlPassportDocumentInternal(value) {
         || !MANIFEST_DIGEST_PATTERN.test(integrity.digestSha256)) {
         throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
     }
+    const canonicalization = resolveArtifactCanonicalization(source.version, integrity.canonicalization, DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, 'Domain control manifest');
+    const legacy = source.version === PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION;
+    const expectedLimitations = legacy ? PUBLIC_DOMAIN_CONTROL_MANIFEST_LIMITATIONS : DOMAIN_CONTROL_PASSPORT_LIMITATIONS;
     let limitations;
     try {
-        limitations = boundedDataArray(source.limitations, 'Domain control manifest limitations', DOMAIN_CONTROL_PASSPORT_LIMITATIONS.length, DOMAIN_CONTROL_PASSPORT_LIMITATIONS.length);
+        limitations = boundedDataArray(source.limitations, 'Domain control manifest limitations', expectedLimitations.length, expectedLimitations.length);
     }
     catch {
         throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
     }
-    if (limitations.some((item, index) => item !== DOMAIN_CONTROL_PASSPORT_LIMITATIONS[index])) {
+    if (limitations.some((item, index) => item !== expectedLimitations[index])) {
         throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
     }
     source.limitations = limitations;
-    const manifestEntries = boundedDomainControlPassportEntries(source.entries, 'Domain control manifest');
+    const manifestEntries = boundedDomainControlPassportEntries(source.entries, 'Domain control manifest', legacy);
     source.entries = manifestEntries;
     source.integrity = integrity;
     assertDomainControlPassportByteBudget(source);
-    const canonicalization = resolveArtifactCanonicalization(source.version, integrity.canonicalization, DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, 'Domain control manifest');
     const baseUnsigned = buildUnsignedDomainControlPassportInternal({
         schema: DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA,
-        version: DOMAIN_CONTROL_MANIFEST_INPUT_VERSION,
+        version: legacy ? PUBLIC_DOMAIN_CONTROL_MANIFEST_INPUT_VERSION : DOMAIN_CONTROL_MANIFEST_INPUT_VERSION,
         expiresAt: source.expiresAt,
         entries: manifestEntries,
     }, source.generatedAt, {
         preserveEntryOrder: true,
+        manifestVersion: legacy ? PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION : DOMAIN_CONTROL_MANIFEST_VERSION,
     });
     const unsigned = baseUnsigned;
     const { integrity: _integrity, ...suppliedUnsigned } = source;

package/packages/evidence/domain-posture-context.mjs

@@ -0,0 +1,79 @@
+import { normalizeExplicitIsoTimestamp } from "./observation.mjs";
+import { normalizeDomain } from "./domain-name.mjs";
+export const DOMAIN_POSTURE_COMPARISON_VERSION = 1;
+export const MAX_POSTURE_CHECKS = 32;
+export const MAX_POSTURE_CHECK_RECORDS = 64;
+export const MAX_POSTURE_RECORD_LENGTH = 4096;
+function contextRecord(value, keys, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)
+        || ![Object.prototype, null].includes(Object.getPrototypeOf(value))
+        || Reflect.ownKeys(value).length !== keys.length)
+        throw new TypeError(`${label} has an invalid structure.`);
+    const result = {};
+    for (const key of keys) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor?.enumerable || !('value' in descriptor))
+            throw new TypeError(`${label} requires ordinary data fields.`);
+        result[key] = descriptor.value;
+    }
+    if (result.version !== DOMAIN_POSTURE_COMPARISON_VERSION)
+        throw new TypeError(`${label} has an unsupported comparison version.`);
+    return result;
+}
+/** Missing legacy provenance stays missing; declared malformed or future context is rejected. */
+export function normalizeDomainPostureSourceContext(value) {
+    if (value === undefined)
+        return undefined;
+    const source = contextRecord(value, ['version', 'source', 'observedAt', 'state', 'omittedRecords'], 'Posture source context');
+    const observedAt = normalizeExplicitIsoTimestamp(source.observedAt);
+    if (typeof source.source !== 'string' || !['dns_ns', 'dns_mx', 'dns_caa', 'registry_rdap'].includes(source.source)
+        || typeof source.state !== 'string' || !['complete', 'partial', 'unavailable'].includes(source.state)
+        || (source.observedAt !== null && observedAt === null)
+        || (source.omittedRecords !== null && (!Number.isSafeInteger(source.omittedRecords) || Number(source.omittedRecords) < 0))
+        || (source.state === 'complete' && source.omittedRecords !== 0)) {
+        throw new TypeError('Posture source context has invalid provenance or omission counts.');
+    }
+    return Object.freeze({ ...source, observedAt });
+}
+export function normalizeDomainPostureProfileContext(value) {
+    if (value === undefined)
+        return undefined;
+    const source = contextRecord(value, ['version', 'domain', 'profileId', 'profileFingerprint'], 'Posture profile context');
+    const domain = typeof source.domain === 'string' ? normalizeDomain(source.domain) : '';
+    if (!domain || domain !== source.domain || typeof source.profileId !== 'string'
+        || !source.profileId.trim() || source.profileId.length > 200 || /[\u0000-\u001f\u007f]/u.test(source.profileId)
+        || typeof source.profileFingerprint !== 'string' || !/^[a-f0-9]{64}$/u.test(source.profileFingerprint)) {
+        throw new TypeError('Posture profile context has an invalid target or collection identity.');
+    }
+    return Object.freeze(source);
+}
+export const POSTURE_CHECK_SOURCES = Object.freeze({
+    nameservers: 'dns_ns', mx: 'dns_mx', caa: 'dns_caa', registration_lock: 'registry_rdap',
+});
+export const POSTURE_SOURCE_LABELS = Object.freeze({
+    dns_ns: 'DNS NS', dns_mx: 'DNS MX', dns_caa: 'DNS CAA', registry_rdap: 'Registry RDAP',
+});
+export function postureTransferRestriction(records) {
+    if (!records.length)
+        return null;
+    return records.some((value) => value === 'clienttransferprohibited' || value === 'servertransferprohibited')
+        ? 'required' : 'not_required';
+}
+export function postureSourceAdmission(check, capturedAt, now) {
+    if (!check?.sourceContext)
+        return 'Source comparison context is unavailable for this retained check.';
+    const context = check.sourceContext;
+    const expected = POSTURE_CHECK_SOURCES[check.id];
+    if (context.version !== DOMAIN_POSTURE_COMPARISON_VERSION || !expected || expected !== context.source)
+        return 'The source or comparison version does not match this field.';
+    const captured = normalizeExplicitIsoTimestamp(capturedAt);
+    const observed = normalizeExplicitIsoTimestamp(context.observedAt);
+    const reviewed = normalizeExplicitIsoTimestamp(now);
+    if (!captured || !observed || !reviewed)
+        return 'A source, capture or review time is unavailable.';
+    if (Date.parse(observed) > Date.parse(captured) || Date.parse(captured) > Date.parse(reviewed))
+        return 'The source or capture time is later than its review.';
+    if (context.state !== 'complete' || context.omittedRecords !== 0)
+        return 'The source observation is incomplete; retained values cannot establish alignment or drift.';
+    return null;
+}