@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/packages/evidence/artifact-integrity.mjs

@@ -39,7 +39,13 @@ function canonicalArtifactJsonV2(value) {
 }
 async function sha256ArtifactDigestV2(value) {
     const bytes = new TextEncoder().encode(canonicalArtifactJsonV2(value));
-    const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes);
+    return sha256ArtifactBytes(bytes);
+}
+async function sha256ArtifactBytes(bytes) {
+    const buffer = bytes.buffer;
+    if (!(buffer instanceof ArrayBuffer))
+        throw new TypeError('Artefact digests require non-shared bytes.');
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', new Uint8Array(buffer, bytes.byteOffset, bytes.byteLength));
     return `sha256:${[...new Uint8Array(digest)]
         .map((byte) => byte.toString(16).padStart(2, '0'))
         .join('')}`;
@@ -62,4 +68,4 @@ function sha256ArtifactDigestFor(value, canonicalization) {
         ? sha256ArtifactDigest(value)
         : sha256ArtifactDigestV2(value);
 }
-export { SORTED_JSON_V1, SORTED_JSON_V2, canonicalArtifactJson, canonicalArtifactJsonFor, canonicalArtifactJsonV2, resolveArtifactCanonicalization, sha256ArtifactDigest, sha256ArtifactDigestFor, sha256ArtifactDigestV2, };
+export { SORTED_JSON_V1, SORTED_JSON_V2, canonicalArtifactJson, canonicalArtifactJsonFor, canonicalArtifactJsonV2, resolveArtifactCanonicalization, sha256ArtifactDigest, sha256ArtifactDigestFor, sha256ArtifactDigestV2, sha256ArtifactBytes, };

package/packages/evidence/artifact-structure.mjs

@@ -0,0 +1,105 @@
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+const DIGEST_RE = /^sha256:[a-f0-9]{64}$/u;
+const DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
+export const HEX_DIGEST_RE = /^[a-f0-9]{64}$/u;
+export const SEMANTIC_VERSION_RE = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
+export function fail(label) {
+    throw new TypeError(`${label} has an unsupported or malformed structure.`);
+}
+export function record(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail(label);
+    return value;
+}
+export function exact(value, keys, label) {
+    const source = record(value, label);
+    const actual = Object.keys(source);
+    if (actual.length !== keys.length || actual.some((key) => !keys.includes(key)))
+        fail(label);
+    return source;
+}
+export function exactOptional(value, required, optional, label) {
+    const source = record(value, label);
+    const actual = Object.keys(source);
+    if (required.some((key) => !actual.includes(key))
+        || actual.some((key) => !required.includes(key) && !optional.includes(key)))
+        fail(label);
+    return source;
+}
+export function text(value, label, maximum = 2_000, allowEmpty = false) {
+    if (typeof value !== 'string' || value.length > maximum || CONTROL_RE.test(value) || (!allowEmpty && !value))
+        fail(label);
+    return value;
+}
+export function optionalText(value, label, maximum = 2_000) {
+    if (value !== null)
+        text(value, label, maximum);
+}
+export function iso(value, label, nullable = false) {
+    if (nullable && value === null)
+        return;
+    const candidate = text(value, label, 64);
+    const parsed = Date.parse(candidate);
+    if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== candidate)
+        fail(label);
+}
+export function integer(value, label, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) {
+    if (!Number.isSafeInteger(value) || Number(value) < minimum || Number(value) > maximum)
+        fail(label);
+    return Number(value);
+}
+export function boolean(value, label) {
+    if (typeof value !== 'boolean')
+        fail(label);
+}
+export function enumeration(value, allowed, label) {
+    if (typeof value !== 'string' || !allowed.includes(value))
+        fail(label);
+    return value;
+}
+export function array(value, label, maximum, minimum = 0) {
+    if (!Array.isArray(value) || value.length < minimum || value.length > maximum)
+        fail(label);
+    return value;
+}
+export function strings(value, label, maximum, textMaximum = 2_000) {
+    const values = array(value, label, maximum);
+    for (const item of values)
+        text(item, label, textMaximum);
+    return values;
+}
+export function digest(value, label) {
+    if (typeof value !== 'string' || !DIGEST_RE.test(value))
+        fail(label);
+}
+export function sameValues(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+export function domain(value, label) {
+    if (typeof value !== 'string' || !DOMAIN_RE.test(value))
+        fail(label);
+}
+export function absoluteUrl(value, label, protocols) {
+    const candidate = text(value, label, 2_048);
+    try {
+        const parsed = new URL(candidate);
+        if (!protocols.includes(parsed.protocol) || parsed.username || parsed.password || parsed.search || parsed.hash)
+            fail(label);
+        return parsed;
+    }
+    catch {
+        return fail(label);
+    }
+}
+export function nullableRecord(value, label) {
+    if (value !== null)
+        record(value, label);
+}
+export function validateIntegrity(value, label, version, currentVersion) {
+    if (version !== currentVersion)
+        fail(label);
+    const integrity = exact(value, ['algorithm', 'canonicalization', 'digestSha256'], label);
+    if (integrity.algorithm !== 'SHA-256' || integrity.canonicalization !== 'sorted-json-v2')
+        fail(label);
+    digest(integrity.digestSha256, label);
+}

package/packages/evidence/decision-fact.mjs

@@ -352,7 +352,10 @@ function boundedDataArray(value, maximum, label) {
         || Number(length) < 0) {
         throw new TypeError(`${label} must have a stable non-negative length.`);
     }
-    const retainedLength = Math.min(Number(length), maximum);
+    if (Number(length) > maximum) {
+        throw new TypeError(`${label} exceeds its ${maximum}-item admission bound; no partial fact was retained.`);
+    }
+    const retainedLength = Number(length);
     const output = [];
     for (let index = 0; index < retainedLength; index += 1) {
         const descriptor = stableOwnDescriptor(value, String(index), label);

package/packages/evidence/domain-control-runtime.mjs

@@ -1,7 +1,9 @@
+import { analystReviewAgeAt, ANALYST_REVIEW_STALE_AFTER_DAYS } from "./review-age.mjs";
 import { canonicalArtifactJsonFor, resolveArtifactCanonicalization, } from "./artifact-integrity.mjs";
 import { normalizeDomain } from "./domain-name.mjs";
 import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "./observation.mjs";
-import { DOMAIN_CONTROL_CAA_RECORD_KEYS, DOMAIN_CONTROL_DIGEST_SHA256_HEX_LENGTH, DOMAIN_CONTROL_DS_RECORD_KEYS, DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA as DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_INPUT_KEYS, DOMAIN_CONTROL_MANIFEST_INPUT_VERSION, DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS, DOMAIN_CONTROL_MANIFEST_LIMITATIONS, DOMAIN_CONTROL_MANIFEST_ROOT_KEYS, DOMAIN_CONTROL_MANIFEST_SCHEMA as DOMAIN_CONTROL_PASSPORT_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_MX_RECORD_KEYS, DOMAIN_CONTROL_RECORD_LIST_FIELDS, DOMAIN_CONTROL_SPKI_SHA256_HEX_LENGTH, DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_CAA_FLAGS, MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_CAA_TAG_LENGTH, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH, MAX_DOMAIN_CONTROL_DOMAIN_LENGTH, MAX_DOMAIN_CONTROL_DS_ALGORITHM, MAX_DOMAIN_CONTROL_DS_DIGEST_LENGTH, MAX_DOMAIN_CONTROL_DS_DIGEST_TYPE, MAX_DOMAIN_CONTROL_DS_KEY_TAG, MAX_DOMAIN_CONTROL_DS_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_INPUT_RECORDS, MAX_DOMAIN_CONTROL_JSON_DEPTH, MAX_DOMAIN_CONTROL_JSON_VALUES, MAX_DOMAIN_CONTROL_MANIFEST_BYTES, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_MX_PRIORITY, MAX_DOMAIN_CONTROL_MX_TEXT_LENGTH, MAX_DOMAIN_CONTROL_NAME_INPUT_LENGTH, MAX_DOMAIN_CONTROL_NOTE_LENGTH, MAX_DOMAIN_CONTROL_RECORD_INTEGER_TEXT_LENGTH, MAX_DOMAIN_CONTROL_TEXT_LENGTH, MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH, MIN_DOMAIN_CONTROL_DS_DIGEST_LENGTH, MIN_DOMAIN_CONTROL_MANIFEST_ENTRIES, MIN_DOMAIN_CONTROL_RECORDS, } from "../contracts/domain-control-manifest.mjs";
+import { MAX_POSTURE_CHECK_RECORDS } from "./domain-posture-context.mjs";
+import { DOMAIN_CONTROL_CAA_RECORD_KEYS, DOMAIN_CONTROL_DIGEST_SHA256_HEX_LENGTH, DOMAIN_CONTROL_DS_RECORD_KEYS, DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA as DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_INPUT_KEYS, DOMAIN_CONTROL_MANIFEST_INPUT_VERSION, DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS, DOMAIN_CONTROL_MANIFEST_LIMITATIONS, DOMAIN_CONTROL_MANIFEST_ROOT_KEYS, DOMAIN_CONTROL_MANIFEST_SCHEMA as DOMAIN_CONTROL_PASSPORT_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_MX_RECORD_KEYS, DOMAIN_CONTROL_RECORD_LIST_FIELDS, DOMAIN_CONTROL_RECORD_MODE_OPTIONS, DOMAIN_CONTROL_SPKI_SHA256_HEX_LENGTH, DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_CURRENT_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_CAA_FLAGS, MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_CAA_TAG_LENGTH, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH, MAX_DOMAIN_CONTROL_DOMAIN_LENGTH, MAX_DOMAIN_CONTROL_DS_ALGORITHM, MAX_DOMAIN_CONTROL_DS_DIGEST_LENGTH, MAX_DOMAIN_CONTROL_DS_DIGEST_TYPE, MAX_DOMAIN_CONTROL_DS_KEY_TAG, MAX_DOMAIN_CONTROL_DS_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_INPUT_RECORDS, MAX_DOMAIN_CONTROL_JSON_DEPTH, MAX_DOMAIN_CONTROL_JSON_VALUES, MAX_DOMAIN_CONTROL_MANIFEST_BYTES, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_MX_PRIORITY, MAX_DOMAIN_CONTROL_MX_TEXT_LENGTH, MAX_DOMAIN_CONTROL_NAME_INPUT_LENGTH, MAX_DOMAIN_CONTROL_NOTE_LENGTH, MAX_DOMAIN_CONTROL_RECORD_INTEGER_TEXT_LENGTH, MAX_DOMAIN_CONTROL_TEXT_LENGTH, MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH, MIN_DOMAIN_CONTROL_DS_DIGEST_LENGTH, MIN_DOMAIN_CONTROL_MANIFEST_ENTRIES, MIN_DOMAIN_CONTROL_RECORDS, PUBLIC_DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, PUBLIC_DOMAIN_CONTROL_MANIFEST_INPUT_VERSION, PUBLIC_DOMAIN_CONTROL_MANIFEST_LIMITATIONS, PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION, SUPPORTED_DOMAIN_CONTROL_MANIFEST_INPUT_VERSIONS, } from "../contracts/domain-control-manifest.mjs";
 const DOMAIN_CONTROL_PASSPORT_VERSION = DOMAIN_CONTROL_MANIFEST_INPUT_VERSION;
 export { DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA, DOMAIN_CONTROL_PASSPORT_SCHEMA, DOMAIN_CONTROL_PASSPORT_VERSION, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_MANIFEST_BYTES, };
 export const MAX_DOMAIN_CONTROL_PASSPORT_BYTES = MAX_DOMAIN_CONTROL_MANIFEST_BYTES;
@@ -10,6 +12,8 @@ export const DOMAIN_CONTROL_PASSPORT_LIMITATIONS = DOMAIN_CONTROL_MANIFEST_LIMIT
 const INPUT_KEYS = new Set(DOMAIN_CONTROL_MANIFEST_INPUT_KEYS);
 const MANIFEST_KEYS = new Set(DOMAIN_CONTROL_MANIFEST_ROOT_KEYS);
 const ENTRY_KEYS = new Set(DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS);
+const PUBLIC_ENTRY_KEYS = new Set(PUBLIC_DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS);
+const RECORD_MODE_KEYS = new Set(DOMAIN_CONTROL_RECORD_LIST_FIELDS);
 const INTEGRITY_KEYS = new Set(DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS);
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const RECORD_LIST_FIELDS = DOMAIN_CONTROL_RECORD_LIST_FIELDS;
@@ -82,6 +86,7 @@ function boundedDataArray(value, label, minimum, maximum, maximumMessage) {
     return result;
 }
 const MX_RECORD_KEYS = new Set(DOMAIN_CONTROL_MX_RECORD_KEYS);
+const RESOLVER_MX_RECORD_KEYS = new Set([...MX_RECORD_KEYS, 'type']);
 const CAA_RECORD_KEYS = new Set(DOMAIN_CONTROL_CAA_RECORD_KEYS);
 const DS_RECORD_KEYS = new Set(DOMAIN_CONTROL_DS_RECORD_KEYS);
 const DS_DIGEST_PATTERN = new RegExp(`^[a-f0-9]{${MIN_DOMAIN_CONTROL_DS_DIGEST_LENGTH},${MAX_DOMAIN_CONTROL_DS_DIGEST_LENGTH}}$`, 'u');
@@ -155,21 +160,48 @@ function canonicalIntegerAlias(source, keys, maximum, label, fallback = null) {
     }
     return normalised[0] ?? null;
 }
-export function canonicalMxRecord(value) {
-    const item = structuredRecord(value, MX_RECORD_KEYS, 'Domain control MX record');
+function mxRecordParts(value, resolverRecord = false) {
+    const item = structuredRecord(value, resolverRecord ? RESOLVER_MX_RECORD_KEYS : MX_RECORD_KEYS, 'Domain control MX record');
     if (item) {
-        const host = canonicalStringAlias(item, ['exchange', 'host', 'value'], exchange, 'Domain control MX host');
+        if (resolverRecord && Object.hasOwn(item, 'type') && item.type !== 'MX')
+            return null;
+        const host = canonicalStringAlias(item, ['exchange', 'host', 'value'], (value) => value === '' ? '.' : exchange(value), 'Domain control MX host');
         const priority = canonicalIntegerAlias(item, ['priority', 'preference'], MAX_DOMAIN_CONTROL_MX_PRIORITY, 'Domain control MX priority');
-        return host && priority !== null ? `${priority} ${host}` : '';
+        return host && priority !== null ? { priority, exchange: host } : null;
     }
     const candidate = recordText(value, MAX_DOMAIN_CONTROL_MX_TEXT_LENGTH).toLowerCase();
     const match = /^(\d{1,5})\s+(.+)$/u.exec(candidate);
     if (match) {
         const priority = recordInteger(match[1], MAX_DOMAIN_CONTROL_MX_PRIORITY);
         const host = exchange(match[2]);
-        return priority !== null && host ? `${priority} ${host}` : '';
+        return priority !== null && host ? { priority, exchange: host } : null;
+    }
+    const host = exchange(candidate);
+    return host ? { priority: null, exchange: host } : null;
+}
+export function canonicalMxRecord(value) {
+    const parts = mxRecordParts(value);
+    return !parts ? '' : parts.priority === null ? parts.exchange : `${parts.priority} ${parts.exchange}`;
+}
+function completeMxRecord(value, resolverRecord) {
+    try {
+        const parts = mxRecordParts(value, resolverRecord);
+        return parts && parts.priority !== null
+            ? { priority: parts.priority, exchange: parts.exchange } : null;
+    }
+    catch (error) {
+        if (!(error instanceof TypeError))
+            throw error;
+        return null;
     }
-    return exchange(candidate);
+}
+/** Complete canonical records require a preference and retain the root exchange as '.'. */
+export function normalizeMxRecord(value) {
+    return completeMxRecord(value, false);
+}
+/** Accept the native resolver's optional record type without broadening import shapes. */
+export function normalizeResolverMxRecord(value) {
+    return completeMxRecord(value, true);
 }
 function caaValue(value, tag) {
     const candidate = recordText(value, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH)
@@ -265,6 +297,88 @@ export function canonicalDomainControlRecordList(value, kind) {
         .sort(compareCodeUnits)
         .slice(0, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS);
 }
+/** Complete field values for posture review; an invalid value never becomes an absent record. */
+export function canonicalPostureRecords(checkId, values) {
+    if (values.length > MAX_POSTURE_CHECK_RECORDS)
+        return null;
+    const normalise = checkId === 'nameservers' ? domainControlName
+        : checkId === 'mx' ? canonicalMxRecord : checkId === 'caa' ? canonicalCaaRecord
+            : checkId === 'registration_lock'
+                ? (value) => typeof value === 'string' && value.length <= 120 && !/[\u0000-\u001f\u007f]/u.test(value)
+                    ? value.trim().toLowerCase().replace(/[\s_-]+/gu, '') : ''
+                : null;
+    if (!normalise)
+        return null;
+    try {
+        const records = values.map(normalise);
+        if (records.some((value) => !value))
+            return null;
+        return [...new Set(records)].sort(compareCodeUnits);
+    }
+    catch {
+        return null;
+    }
+}
+/** Complete current record inputs are rejected, not shortened, when invalid or over capacity. */
+export function canonicalDomainControlRecords(value, field) {
+    if (value === undefined)
+        return [];
+    const rows = boundedDataArray(value, `Domain control ${field}`, 0, MAX_DOMAIN_CONTROL_INPUT_RECORDS);
+    const normalise = field === 'nameservers' ? domainControlName : field === 'ds' ? canonicalDsRecord
+        : field === 'mx' ? canonicalMxRecord : canonicalCaaRecord;
+    const values = rows.map(normalise);
+    if (values.some((item) => !item))
+        throw new TypeError(`Domain control ${field} contains an invalid record.`);
+    const records = [...new Set(values)].sort(compareCodeUnits);
+    if (records.length > MAX_CURRENT_DOMAIN_CONTROL_RECORDS)
+        throw new TypeError(`Domain control ${field} exceeds ${MAX_CURRENT_DOMAIN_CONTROL_RECORDS} records.`);
+    return records;
+}
+export function domainControlRecordMode(entry, field) {
+    return entry.recordModes?.[field] ?? (entry[field].length ? 'expect_records' : 'unconfigured');
+}
+export function normalizeDomainControlRecordModes(value, records) {
+    const source = normalizeDeclaredDomainControlRecordModes(value);
+    return Object.freeze(Object.fromEntries(DOMAIN_CONTROL_RECORD_LIST_FIELDS.map((field) => {
+        const mode = Object.hasOwn(source, field) ? source[field] : (records[field].length ? 'expect_records' : 'unconfigured');
+        if ((mode === 'expect_records') !== (records[field].length > 0)) {
+            throw new TypeError(`Domain control ${field} requires records only in the specified-records mode.`);
+        }
+        return [field, mode];
+    })));
+}
+export function normalizeDeclaredDomainControlRecordModes(value) {
+    const source = value === undefined ? {} : boundedDataRecord(value, RECORD_MODE_KEYS, 'Domain control record modes');
+    if (!source)
+        throw new TypeError('Domain control record modes must be an ordinary object.');
+    const modes = {};
+    for (const field of DOMAIN_CONTROL_RECORD_LIST_FIELDS) {
+        if (!Object.hasOwn(source, field))
+            continue;
+        const mode = source[field];
+        if (!DOMAIN_CONTROL_RECORD_MODE_OPTIONS.some((option) => option.value === mode))
+            throw new TypeError(`Domain control ${field} has an unsupported record mode.`);
+        modes[field] = mode;
+    }
+    return Object.freeze(modes);
+}
+export function normalizeDomainControlRecordSettings(value) {
+    const records = {
+        nameservers: canonicalDomainControlRecords(value.nameservers, 'nameservers'),
+        ds: canonicalDomainControlRecords(value.ds, 'ds'),
+        mx: canonicalDomainControlRecords(value.mx, 'mx'),
+        caa: canonicalDomainControlRecords(value.caa, 'caa'),
+    };
+    return { ...records, recordModes: normalizeDomainControlRecordModes(value.recordModes, records) };
+}
+export function domainControlEvidenceAdmission(observedAt, now) {
+    const age = analystReviewAgeAt(observedAt, now);
+    if (age === 'unknown')
+        return 'A valid source observation time at or before the review is required.';
+    if (age === 'stale')
+        return `The source observation is more than ${ANALYST_REVIEW_STALE_AFTER_DAYS} days old; collect a current observation before comparing expected settings.`;
+    return null;
+}
 class DomainControlJsonBudgetError extends Error {
 }
 class DomainControlJsonStructureError extends Error {
@@ -397,10 +511,10 @@ export function domainControlPassportSerialisedBytes(value, label = 'Domain cont
 export function assertDomainControlPassportByteBudget(value, label = 'Domain control manifest') {
     domainControlPassportSerialisedBytes(value, label);
 }
-function boundedDomainControlPassportEntries(value, label) {
+function boundedDomainControlPassportEntries(value, label, legacy = false) {
     const entries = boundedDataArray(value, label, MIN_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES);
     return entries.map((entry) => {
-        const source = boundedDataRecord(entry, ENTRY_KEYS, `${label} entry`);
+        const source = boundedDataRecord(entry, legacy ? PUBLIC_ENTRY_KEYS : ENTRY_KEYS, `${label} entry`);
         if (!source)
             return entry;
         for (const field of RECORD_LIST_FIELDS) {
@@ -408,6 +522,11 @@ function boundedDomainControlPassportEntries(value, label) {
                 continue;
             source[field] = boundedDataArray(source[field], `${label} entry ${field}`, MIN_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_INPUT_RECORDS, `${label} entry ${field} exceeds ${MAX_DOMAIN_CONTROL_INPUT_RECORDS} input records.`);
         }
+        if (Object.hasOwn(source, 'recordModes')) {
+            source.recordModes = boundedDataRecord(source.recordModes, RECORD_MODE_KEYS, `${label} entry record modes`);
+            if (!source.recordModes)
+                throw new TypeError(`${label} entry record modes must be an ordinary object.`);
+        }
         return source;
     });
 }
@@ -442,7 +561,7 @@ function digest(value) {
     const candidate = value.trim().toLowerCase();
     return SPKI_DIGEST_PATTERN.test(candidate) ? candidate : null;
 }
-function normalizeEntry(value) {
+function normalizeEntry(value, legacyRecords, includeModes) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return null;
     const source = value;
@@ -455,38 +574,44 @@ function normalizeEntry(value) {
         && !tlsSpkiSha256) {
         throw new TypeError('Domain control TLS public-key fingerprint must be exactly 64 hexadecimal characters.');
     }
+    const records = {
+        nameservers: Object.freeze(legacyRecords ? hostnames(source.nameservers) : canonicalDomainControlRecords(source.nameservers, 'nameservers')),
+        ds: Object.freeze(legacyRecords ? canonicalDomainControlRecordList(source.ds, 'ds') : canonicalDomainControlRecords(source.ds, 'ds')),
+        mx: Object.freeze(legacyRecords ? canonicalDomainControlRecordList(source.mx, 'mx') : canonicalDomainControlRecords(source.mx, 'mx')),
+        caa: Object.freeze(legacyRecords ? canonicalDomainControlRecordList(source.caa, 'caa') : canonicalDomainControlRecords(source.caa, 'caa')),
+    };
     return Object.freeze({
         domain,
-        nameservers: Object.freeze(hostnames(source.nameservers)),
-        ds: Object.freeze(canonicalDomainControlRecordList(source.ds, 'ds')),
-        mx: Object.freeze(canonicalDomainControlRecordList(source.mx, 'mx')),
-        caa: Object.freeze(canonicalDomainControlRecordList(source.caa, 'caa')),
+        ...records,
+        ...(includeModes ? { recordModes: normalizeDomainControlRecordModes(source.recordModes, records) } : {}),
         tlsIssuer: text(source.tlsIssuer, MAX_DOMAIN_CONTROL_TEXT_LENGTH)?.toLowerCase() ?? null,
         tlsSpkiSha256,
         registrarLock: source.registrarLock === 'required' || source.registrarLock === 'not_required'
             ? source.registrarLock
             : null,
-        renewalReviewAt: timestamp(source.renewalReviewAt, true),
+        renewalReviewAt: timestamp(source.renewalReviewAt, legacyRecords),
         note: text(source.note, MAX_DOMAIN_CONTROL_NOTE_LENGTH),
     });
 }
 function buildUnsignedDomainControlPassportInternal(input, generatedAtValue, options = {}) {
     const source = boundedDataRecord(input, INPUT_KEYS, 'Domain control manifest input');
-    if (!source || source.schema !== DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA || source.version !== DOMAIN_CONTROL_MANIFEST_INPUT_VERSION) {
-        throw new TypeError(`Domain control manifest input must use ${DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA} version ${DOMAIN_CONTROL_MANIFEST_INPUT_VERSION}.`);
+    if (!source || source.schema !== DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA || !SUPPORTED_DOMAIN_CONTROL_MANIFEST_INPUT_VERSIONS.some((version) => version === source.version)) {
+        throw new TypeError(`Domain control manifest input must use ${DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA} version ${SUPPORTED_DOMAIN_CONTROL_MANIFEST_INPUT_VERSIONS.join(' or ')}.`);
     }
-    const inputEntries = boundedDomainControlPassportEntries(source.entries, 'Domain control manifest input');
+    const legacy = source.version === PUBLIC_DOMAIN_CONTROL_MANIFEST_INPUT_VERSION;
+    const version = options.manifestVersion ?? DOMAIN_CONTROL_MANIFEST_VERSION;
+    const inputEntries = boundedDomainControlPassportEntries(source.entries, 'Domain control manifest input', legacy);
     source.entries = inputEntries;
     assertDomainControlPassportByteBudget(source, 'Domain control manifest input');
     const generatedAt = timestamp(generatedAtValue, options.legacyGeneratedAt === true);
-    const expiresAt = timestamp(source.expiresAt, true);
+    const expiresAt = timestamp(source.expiresAt, legacy);
     if (!generatedAt) {
         throw new TypeError('Domain control manifest generation time must be valid and include an explicit timezone.');
     }
     if (!expiresAt || Date.parse(expiresAt) <= Date.parse(generatedAt)) {
         throw new TypeError('Domain control manifest expiry must be a valid time after generation.');
     }
-    const entries = inputEntries.map(normalizeEntry);
+    const entries = inputEntries.map((entry) => normalizeEntry(entry, legacy, version === DOMAIN_CONTROL_MANIFEST_VERSION));
     if (entries.some((entry) => entry === null))
         throw new TypeError('Domain control manifest contains an invalid entry.');
     const normalizedEntries = entries;
@@ -498,11 +623,11 @@ function buildUnsignedDomainControlPassportInternal(input, generatedAtValue, opt
         : [...normalizedEntries].sort((left, right) => compareCodeUnits(left.domain, right.domain));
     return Object.freeze({
         schema: DOMAIN_CONTROL_PASSPORT_SCHEMA,
-        version: DOMAIN_CONTROL_MANIFEST_VERSION,
+        version,
         generatedAt,
         expiresAt,
         entries: Object.freeze(orderedEntries),
-        limitations: DOMAIN_CONTROL_PASSPORT_LIMITATIONS,
+        limitations: version === PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION ? PUBLIC_DOMAIN_CONTROL_MANIFEST_LIMITATIONS : DOMAIN_CONTROL_PASSPORT_LIMITATIONS,
     });
 }
 export function buildUnsignedDomainControlPassport(input, generatedAtValue, options = {}) {
@@ -519,29 +644,32 @@ function normalizeDomainControlPassportDocumentInternal(value) {
         || !MANIFEST_DIGEST_PATTERN.test(integrity.digestSha256)) {
         throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
     }
+    const canonicalization = resolveArtifactCanonicalization(source.version, integrity.canonicalization, DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, 'Domain control manifest');
+    const legacy = source.version === PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION;
+    const expectedLimitations = legacy ? PUBLIC_DOMAIN_CONTROL_MANIFEST_LIMITATIONS : DOMAIN_CONTROL_PASSPORT_LIMITATIONS;
     let limitations;
     try {
-        limitations = boundedDataArray(source.limitations, 'Domain control manifest limitations', DOMAIN_CONTROL_PASSPORT_LIMITATIONS.length, DOMAIN_CONTROL_PASSPORT_LIMITATIONS.length);
+        limitations = boundedDataArray(source.limitations, 'Domain control manifest limitations', expectedLimitations.length, expectedLimitations.length);
     }
     catch {
         throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
     }
-    if (limitations.some((item, index) => item !== DOMAIN_CONTROL_PASSPORT_LIMITATIONS[index])) {
+    if (limitations.some((item, index) => item !== expectedLimitations[index])) {
         throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
     }
     source.limitations = limitations;
-    const manifestEntries = boundedDomainControlPassportEntries(source.entries, 'Domain control manifest');
+    const manifestEntries = boundedDomainControlPassportEntries(source.entries, 'Domain control manifest', legacy);
     source.entries = manifestEntries;
     source.integrity = integrity;
     assertDomainControlPassportByteBudget(source);
-    const canonicalization = resolveArtifactCanonicalization(source.version, integrity.canonicalization, DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, 'Domain control manifest');
     const baseUnsigned = buildUnsignedDomainControlPassportInternal({
         schema: DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA,
-        version: DOMAIN_CONTROL_MANIFEST_INPUT_VERSION,
+        version: legacy ? PUBLIC_DOMAIN_CONTROL_MANIFEST_INPUT_VERSION : DOMAIN_CONTROL_MANIFEST_INPUT_VERSION,
         expiresAt: source.expiresAt,
         entries: manifestEntries,
     }, source.generatedAt, {
         preserveEntryOrder: true,
+        manifestVersion: legacy ? PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION : DOMAIN_CONTROL_MANIFEST_VERSION,
     });
     const unsigned = baseUnsigned;
     const { integrity: _integrity, ...suppliedUnsigned } = source;

package/packages/evidence/domain-posture-context.mjs

@@ -0,0 +1,79 @@
+import { normalizeExplicitIsoTimestamp } from "./observation.mjs";
+import { normalizeDomain } from "./domain-name.mjs";
+export const DOMAIN_POSTURE_COMPARISON_VERSION = 1;
+export const MAX_POSTURE_CHECKS = 32;
+export const MAX_POSTURE_CHECK_RECORDS = 64;
+export const MAX_POSTURE_RECORD_LENGTH = 4096;
+function contextRecord(value, keys, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)
+        || ![Object.prototype, null].includes(Object.getPrototypeOf(value))
+        || Reflect.ownKeys(value).length !== keys.length)
+        throw new TypeError(`${label} has an invalid structure.`);
+    const result = {};
+    for (const key of keys) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor?.enumerable || !('value' in descriptor))
+            throw new TypeError(`${label} requires ordinary data fields.`);
+        result[key] = descriptor.value;
+    }
+    if (result.version !== DOMAIN_POSTURE_COMPARISON_VERSION)
+        throw new TypeError(`${label} has an unsupported comparison version.`);
+    return result;
+}
+/** Missing legacy provenance stays missing; declared malformed or future context is rejected. */
+export function normalizeDomainPostureSourceContext(value) {
+    if (value === undefined)
+        return undefined;
+    const source = contextRecord(value, ['version', 'source', 'observedAt', 'state', 'omittedRecords'], 'Posture source context');
+    const observedAt = normalizeExplicitIsoTimestamp(source.observedAt);
+    if (typeof source.source !== 'string' || !['dns_ns', 'dns_mx', 'dns_caa', 'registry_rdap'].includes(source.source)
+        || typeof source.state !== 'string' || !['complete', 'partial', 'unavailable'].includes(source.state)
+        || (source.observedAt !== null && observedAt === null)
+        || (source.omittedRecords !== null && (!Number.isSafeInteger(source.omittedRecords) || Number(source.omittedRecords) < 0))
+        || (source.state === 'complete' && source.omittedRecords !== 0)) {
+        throw new TypeError('Posture source context has invalid provenance or omission counts.');
+    }
+    return Object.freeze({ ...source, observedAt });
+}
+export function normalizeDomainPostureProfileContext(value) {
+    if (value === undefined)
+        return undefined;
+    const source = contextRecord(value, ['version', 'domain', 'profileId', 'profileFingerprint'], 'Posture profile context');
+    const domain = typeof source.domain === 'string' ? normalizeDomain(source.domain) : '';
+    if (!domain || domain !== source.domain || typeof source.profileId !== 'string'
+        || !source.profileId.trim() || source.profileId.length > 200 || /[\u0000-\u001f\u007f]/u.test(source.profileId)
+        || typeof source.profileFingerprint !== 'string' || !/^[a-f0-9]{64}$/u.test(source.profileFingerprint)) {
+        throw new TypeError('Posture profile context has an invalid target or collection identity.');
+    }
+    return Object.freeze(source);
+}
+export const POSTURE_CHECK_SOURCES = Object.freeze({
+    nameservers: 'dns_ns', mx: 'dns_mx', caa: 'dns_caa', registration_lock: 'registry_rdap',
+});
+export const POSTURE_SOURCE_LABELS = Object.freeze({
+    dns_ns: 'DNS NS', dns_mx: 'DNS MX', dns_caa: 'DNS CAA', registry_rdap: 'Registry RDAP',
+});
+export function postureTransferRestriction(records) {
+    if (!records.length)
+        return null;
+    return records.some((value) => value === 'clienttransferprohibited' || value === 'servertransferprohibited')
+        ? 'required' : 'not_required';
+}
+export function postureSourceAdmission(check, capturedAt, now) {
+    if (!check?.sourceContext)
+        return 'Source comparison context is unavailable for this retained check.';
+    const context = check.sourceContext;
+    const expected = POSTURE_CHECK_SOURCES[check.id];
+    if (context.version !== DOMAIN_POSTURE_COMPARISON_VERSION || !expected || expected !== context.source)
+        return 'The source or comparison version does not match this field.';
+    const captured = normalizeExplicitIsoTimestamp(capturedAt);
+    const observed = normalizeExplicitIsoTimestamp(context.observedAt);
+    const reviewed = normalizeExplicitIsoTimestamp(now);
+    if (!captured || !observed || !reviewed)
+        return 'A source, capture or review time is unavailable.';
+    if (Date.parse(observed) > Date.parse(captured) || Date.parse(captured) > Date.parse(reviewed))
+        return 'The source or capture time is later than its review.';
+    if (context.state !== 'complete' || context.omittedRecords !== 0)
+        return 'The source observation is incomplete; retained values cannot establish alignment or drift.';
+    return null;
+}

package/packages/evidence/image-regions.mjs

@@ -0,0 +1,56 @@
+import { array, enumeration, exact, integer, text } from "./artifact-structure.mjs";
+import { readRetainedFileReference } from "./retained-file.mjs";
+// The decoded RGBA surface is bounded independently of compressed file bytes.
+export const MAX_EVIDENCE_IMAGE_PIXELS = 16 * 1024 * 1024;
+export const MAX_EVIDENCE_IMAGE_DIMENSION = 10_000;
+// Each selected region emits at most four solid rectangles; no nested effects.
+export const MAX_EVIDENCE_IMAGE_REGIONS = 64;
+export function readEvidenceImageDimensions(width, height) {
+    const result = {
+        width: integer(width, 'Image width', 1, MAX_EVIDENCE_IMAGE_DIMENSION),
+        height: integer(height, 'Image height', 1, MAX_EVIDENCE_IMAGE_DIMENSION),
+    };
+    if (result.width * result.height > MAX_EVIDENCE_IMAGE_PIXELS)
+        throw new TypeError('This image exceeds the decoded-image pixel bound. Its original bytes are unchanged.');
+    return Object.freeze(result);
+}
+/** Pixel coordinates are integers, remain inside the source, and are never clipped silently. */
+export function readImageRegionPlan(raw) {
+    const value = exact(raw, ['width', 'height', 'regions'], 'Image region plan');
+    const dimensions = readEvidenceImageDimensions(value.width, value.height);
+    const regions = Array.from(array(value.regions, 'Image regions', MAX_EVIDENCE_IMAGE_REGIONS, 1), candidate => {
+        const region = exact(candidate, ['kind', 'x', 'y', 'width', 'height'], 'Image region');
+        const kind = enumeration(region.kind, ['redact', 'outline'], 'Image region kind');
+        const x = integer(region.x, 'Region left coordinate', 0, dimensions.width - 1);
+        const y = integer(region.y, 'Region top coordinate', 0, dimensions.height - 1);
+        const width = integer(region.width, 'Region width', 1, dimensions.width - x);
+        const height = integer(region.height, 'Region height', 1, dimensions.height - y);
+        return Object.freeze({ kind, x, y, width, height });
+    });
+    return Object.freeze({ ...dimensions, regions: Object.freeze(regions) });
+}
+export function readImageDerivation(raw) {
+    const value = exact(raw, ['method', 'sourceAttachmentId', 'source', 'plan'], 'Image derivation');
+    if (value.method !== 'png-regions-v1')
+        throw new TypeError('This image derivation method is unsupported.');
+    return Object.freeze({
+        method: value.method,
+        sourceAttachmentId: text(value.sourceAttachmentId, 'Source attachment ID', 128),
+        source: readRetainedFileReference(value.source),
+        plan: readImageRegionPlan(value.plan),
+    });
+}
+/** Opaque redactions are always last, including where annotations overlap them. */
+export function imageRegionPaintRectangles(raw) {
+    const plan = readImageRegionPlan(raw);
+    const result = [];
+    for (const region of plan.regions.filter(region => region.kind === 'outline')) {
+        const thickness = Math.min(3, region.width, region.height);
+        const { x, y, width, height } = region;
+        result.push({ x, y, width, height: thickness, colour: '#ffbf00' }, { x, y: y + height - thickness, width, height: thickness, colour: '#ffbf00' }, { x, y, width: thickness, height, colour: '#ffbf00' }, { x: x + width - thickness, y, width: thickness, height, colour: '#ffbf00' });
+    }
+    for (const region of plan.regions.filter(region => region.kind === 'redact')) {
+        result.push({ x: region.x, y: region.y, width: region.width, height: region.height, colour: '#000000' });
+    }
+    return result;
+}

package/packages/evidence/latest-observations.mjs

@@ -0,0 +1,28 @@
+import { normalizeExplicitIsoTimestamp } from "./observation.mjs";
+/** Select a time cohort from an already bounded source; never rank undated evidence as older. */
+export function latestObservationCohort(values, observedAt) {
+    let latestTime = null;
+    let latestMillis = -Infinity;
+    let latest = [];
+    const undated = [];
+    let superseded = 0;
+    for (const value of values) {
+        const time = normalizeExplicitIsoTimestamp(observedAt(value));
+        if (time === null) {
+            undated.push(value);
+            continue;
+        }
+        const millis = Date.parse(time);
+        if (millis > latestMillis) {
+            superseded += latest.length;
+            latestTime = time;
+            latestMillis = millis;
+            latest = [value];
+        }
+        else if (millis === latestMillis)
+            latest.push(value);
+        else
+            superseded += 1;
+    }
+    return { observedAt: latestTime, latest, undated, superseded };
+}