@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/lib/domain-control-manifest.mjs

@@ -1,21 +1,20 @@
 import { createHash } from 'node:crypto';
 import { domainToASCII } from 'node:url';
 import { canonicalArtifactJsonFor, } from "../packages/evidence/artifact-integrity.mjs";
-import { DOMAIN_CONTROL_MANIFEST_CURRENT_CANONICALIZATION, DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_MANIFEST_SCHEMA, DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_DS_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_INPUT_RECORDS, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH, } from "../packages/contracts/domain-control-manifest.mjs";
-import { DOMAIN_CONTROL_REVIEW_FIELDS, DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, DOMAIN_CONTROL_REVIEW_COUNT_KEYS, DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS, DOMAIN_CONTROL_REVIEW_INPUT_KEYS, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_LIMITATIONS, DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS, DOMAIN_CONTROL_REVIEW_OBSERVATION_FIELD_KEYS, DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS, DOMAIN_CONTROL_REVIEW_ROOT_KEYS, DOMAIN_CONTROL_REVIEW_SCHEMA, DOMAIN_CONTROL_REVIEW_VERSION, MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS, MAX_DOMAIN_CONTROL_REVIEW_SOURCE_LENGTH, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH, } from "../packages/contracts/domain-control-review.mjs";
-import { assertDomainControlManifestByteBudget, buildUnsignedDomainControlManifest, canonicalDomainControlRecordList, normalizeDomainControlManifestDocument, } from "../packages/evidence/domain-control-runtime.mjs";
+import { DOMAIN_CONTROL_MANIFEST_CURRENT_CANONICALIZATION, DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_MANIFEST_SCHEMA, DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_CURRENT_DOMAIN_CONTROL_RECORDS, DOMAIN_CONTROL_RECORD_LIST_FIELDS, DOMAIN_CONTROL_RECORD_MODE_OPTIONS, PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION, MAX_DOMAIN_CONTROL_DS_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_INPUT_RECORDS, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH, } from "../packages/contracts/domain-control-manifest.mjs";
+import { DOMAIN_CONTROL_REVIEW_FIELDS, DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, DOMAIN_CONTROL_REVIEW_COUNT_KEYS, DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS, DOMAIN_CONTROL_REVIEW_INPUT_KEYS, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_LIMITATIONS, domainControlReviewCountKeys, domainControlReviewLimitations, DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS, DOMAIN_CONTROL_REVIEW_OBSERVATION_FIELD_KEYS, DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS, DOMAIN_CONTROL_REVIEW_ROOT_KEYS, DOMAIN_CONTROL_REVIEW_SCHEMA, DOMAIN_CONTROL_REVIEW_VERSION, PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION, SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS, PUBLIC_DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS, MAX_DOMAIN_CONTROL_REVIEW_SOURCE_LENGTH, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH, } from "../packages/contracts/domain-control-review.mjs";
+import { assertDomainControlManifestByteBudget, buildUnsignedDomainControlManifest, canonicalDomainControlRecordList, domainControlRecordMode, domainControlEvidenceAdmission, normalizeDomainControlManifestDocument, } from "../packages/evidence/domain-control-runtime.mjs";
 import { exactKeys } from "./bounded-contract-normalizers.mjs";
 import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "../packages/evidence/observation.mjs";
 export { DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_SCHEMA, DOMAIN_CONTROL_REVIEW_VERSION, };
 export const MAX_DOMAIN_CONTROL_ENTRIES = MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES;
-export const MAX_DOMAIN_CONTROL_RECORDS = MAX_CANONICAL_DOMAIN_CONTROL_RECORDS;
+export const MAX_DOMAIN_CONTROL_RECORDS = MAX_CURRENT_DOMAIN_CONTROL_RECORDS;
 const REVIEW_INPUT_KEYS = new Set(DOMAIN_CONTROL_REVIEW_INPUT_KEYS);
 const OBSERVATION_KEYS = new Set(DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS);
 const OBSERVATION_FIELDS = new Set(DOMAIN_CONTROL_REVIEW_FIELDS);
 const OBSERVATION_FIELD_KEYS = new Set(DOMAIN_CONTROL_REVIEW_OBSERVATION_FIELD_KEYS);
 const REVIEW_ROOT_KEYS = new Set(DOMAIN_CONTROL_REVIEW_ROOT_KEYS);
 const REVIEW_MANIFEST_KEYS = new Set(DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS);
-const REVIEW_COUNT_KEYS = new Set(DOMAIN_CONTROL_REVIEW_COUNT_KEYS);
 const REVIEW_DOMAIN_KEYS = new Set(DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS);
 const REVIEW_COMPARISON_KEYS = new Set(DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS);
 function record(value) {
@@ -186,25 +185,25 @@ function boundedDataArray(value, maximum) {
         return null;
     }
 }
-function fieldValues(field, value) {
+function fieldValues(field, value, maximum) {
     if (field === 'nameservers') {
         const normalized = value.map(domain);
         if (normalized.some((item) => item === null))
             return null;
         const values = hostnameList(normalized);
-        return values.length <= MAX_DOMAIN_CONTROL_RECORDS ? values : null;
+        return values.length <= maximum ? values : null;
     }
     if (field === 'mx' || field === 'caa' || field === 'ds') {
         const normalized = value.flatMap((item) => canonicalDomainControlRecordList([item], field));
         const values = [...new Set(normalized)].sort();
-        return normalized.length === value.length && values.length <= MAX_DOMAIN_CONTROL_RECORDS ? values : null;
+        return normalized.length === value.length && values.length <= maximum ? values : null;
     }
     if (field === 'tlsSpkiSha256') {
         const normalized = value.map(spkiFingerprint);
         if (normalized.some((item) => item === null))
             return null;
         const values = [...new Set(normalized)].sort();
-        return values.length <= MAX_DOMAIN_CONTROL_RECORDS ? values : null;
+        return values.length <= maximum ? values : null;
     }
     if (field === 'registrarLock') {
         return value.every((item) => item === 'required' || item === 'not_required')
@@ -215,9 +214,9 @@ function fieldValues(field, value) {
     if (normalized.some((item) => item === null))
         return null;
     const values = textList(normalized, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH);
-    return values.length <= MAX_DOMAIN_CONTROL_RECORDS ? values : null;
+    return values.length <= maximum ? values : null;
 }
-function normalizeObservation(value) {
+function normalizeObservation(value, legacy) {
     const source = record(value);
     const normalizedDomain = domain(source?.domain);
     const rawFields = record(source?.fields);
@@ -242,12 +241,12 @@ function normalizeObservation(value) {
         const values = boundedDataArray(raw.values, MAX_DOMAIN_CONTROL_INPUT_RECORDS);
         if (!sourceLabel || !values)
             return null;
-        const normalizedValues = fieldValues(field, values);
-        const observedAt = raw.observedAt === null ? null : timestamp(raw.observedAt, true);
+        const normalizedValues = fieldValues(field, values, legacy ? MAX_CANONICAL_DOMAIN_CONTROL_RECORDS : MAX_DOMAIN_CONTROL_RECORDS);
+        const observedAt = raw.observedAt === null ? null : timestamp(raw.observedAt, legacy);
         if (!normalizedValues || (raw.observedAt !== null && !observedAt))
             return null;
         fields[field] = Object.freeze({
-            state,
+            state: field === 'registrarLock' && state === 'observed' && normalizedValues.length !== 1 ? 'partial' : state,
             values: Object.freeze(normalizedValues),
             source: sourceLabel,
             observedAt,
@@ -264,18 +263,22 @@ function desiredValues(entry, field) {
         return entry.registrarLock ? [entry.registrarLock] : [];
     return [...entry[field]];
 }
-function compareField(entry, observation, field) {
+function compareField(entry, observation, field, now) {
     const desired = desiredValues(entry, field);
-    if (!desired.length)
+    const expectation = DOMAIN_CONTROL_RECORD_LIST_FIELDS.includes(field)
+        ? domainControlRecordMode(entry, field) : desired.length ? 'expect_records' : 'unconfigured';
+    if (expectation === 'unconfigured')
         return Object.freeze({
             field, state: 'not_configured', desired: Object.freeze([]), observed: Object.freeze([]), source: null, observedAt: null,
             explanation: 'No desired value was configured for this field.',
+            expectation,
         });
     const evidence = observation?.fields[field];
     if (!evidence)
         return Object.freeze({
             field, state: 'unavailable', desired: Object.freeze(desired), observed: Object.freeze([]), source: null, observedAt: null,
             explanation: 'No separately attributed observation was supplied for this field.',
+            expectation,
         });
     if (evidence.state !== 'observed')
         return Object.freeze({
@@ -288,7 +291,13 @@ function compareField(entry, observation, field) {
             explanation: evidence.state === 'partial'
                 ? 'The supplied observation was partial, so a difference is inconclusive.'
                 : `The supplied source reported this field as ${evidence.state}.`,
+            expectation,
         });
+    const limitation = domainControlEvidenceAdmission(evidence.observedAt, now);
+    if (limitation)
+        return Object.freeze({ field, state: 'partial', desired: Object.freeze(desired), observed: evidence.values, source: evidence.source, observedAt: evidence.observedAt, explanation: limitation, expectation });
+    if (expectation === 'observe_only')
+        return Object.freeze({ field, state: 'observed', desired: Object.freeze([]), observed: evidence.values, source: evidence.source, observedAt: evidence.observedAt, explanation: 'Observation only: no required record set is compared.', expectation });
     const aligned = desired.length === evidence.values.length && desired.every((item, index) => item === evidence.values[index]);
     return Object.freeze({
         field,
@@ -297,9 +306,12 @@ function compareField(entry, observation, field) {
         observed: evidence.values,
         source: evidence.source,
         observedAt: evidence.observedAt,
-        explanation: aligned
-            ? 'The complete supplied observation matches the desired value.'
-            : 'The complete supplied observation differs from the desired value.',
+        explanation: expectation === 'expect_none'
+            ? aligned ? 'The complete source observation contains no records, as expected.' : 'The complete source observation contains records where none are expected.'
+            : aligned
+                ? 'The complete supplied observation matches the desired value.'
+                : 'The complete supplied observation differs from the desired value.',
+        expectation,
     });
 }
 function renewalComparison(entry, now) {
@@ -307,16 +319,44 @@ function renewalComparison(entry, now) {
         return Object.freeze({
             field: 'renewalReviewAt', state: 'not_configured', desired: Object.freeze([]), observed: Object.freeze([]), source: null, observedAt: null,
             explanation: 'No renewal review date was configured.',
+            expectation: 'unconfigured',
         });
     const due = Date.parse(entry.renewalReviewAt) <= Date.parse(now);
     return Object.freeze({
-        field: 'renewalReviewAt', state: due ? 'due' : 'aligned', desired: Object.freeze([entry.renewalReviewAt]), observed: Object.freeze([]), source: null, observedAt: null,
+        field: 'renewalReviewAt', state: due ? 'due' : 'not_due', desired: Object.freeze([entry.renewalReviewAt]), observed: Object.freeze([]), source: null, observedAt: null,
         explanation: due ? 'The configured renewal review date is due.' : 'The configured renewal review date is still in the future.',
+        expectation: 'expect_records',
     });
 }
+function aggregateComparisonState(comparisons, version = DOMAIN_CONTROL_REVIEW_VERSION) {
+    if (comparisons.some((item) => item.state === 'drift' || (version < 3 && item.state === 'due')))
+        return 'drift';
+    if (comparisons.some((item) => ['partial', 'unavailable', 'unsupported'].includes(item.state)))
+        return 'partial';
+    if (comparisons.some((item) => item.state === 'due'))
+        return 'due';
+    if (version === 1 || comparisons.some((item) => item.state === 'aligned'))
+        return 'aligned';
+    if (comparisons.some((item) => item.state === 'observed'))
+        return 'observed';
+    return comparisons.some((item) => item.state === 'not_due') ? 'not_due' : 'not_configured';
+}
+function aggregateDomainState(domains, version = DOMAIN_CONTROL_REVIEW_VERSION) {
+    if (domains.some((item) => item.state === 'drift'))
+        return 'drift';
+    if (domains.some((item) => item.state === 'partial'))
+        return 'partial';
+    if (domains.some((item) => item.state === 'due'))
+        return 'due';
+    if (version === 1 || domains.some((item) => item.state === 'aligned'))
+        return 'aligned';
+    if (domains.some((item) => item.state === 'observed'))
+        return 'observed';
+    return domains.some((item) => item.state === 'not_due') ? 'not_due' : 'not_configured';
+}
 export function reviewDomainControlManifest(input, generatedAtValue = new Date().toISOString()) {
     const source = record(input);
-    if (!source || source.schema !== DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA || source.version !== DOMAIN_CONTROL_REVIEW_VERSION) {
+    if (!source || source.schema !== DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA || !SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS.includes(source.version)) {
         throw new TypeError(`Domain control review input must use ${DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA} version ${DOMAIN_CONTROL_REVIEW_VERSION}.`);
     }
     exactKeys(source, REVIEW_INPUT_KEYS, 'Domain control review input');
@@ -324,11 +364,14 @@ export function reviewDomainControlManifest(input, generatedAtValue = new Date()
     if (!generatedAt)
         throw new TypeError('Domain control review time must be valid and include an explicit timezone.');
     const manifest = verifyDomainControlManifest(source.manifest);
+    const legacy = source.version === PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION;
+    if (legacy && manifest.version !== PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION)
+        throw new TypeError('Public review input requires its published manifest contract; use the current review input version for explicit expectations.');
     const rawObservations = boundedDataArray(source.observations, MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS);
     if (!rawObservations) {
         throw new TypeError('Domain control observations must be a bounded array.');
     }
-    const observations = rawObservations.map(normalizeObservation);
+    const observations = rawObservations.map((value) => normalizeObservation(value, legacy));
     if (observations.some((item) => item === null))
         throw new TypeError('Domain control review contains an invalid observation.');
     const normalizedObservations = observations;
@@ -339,23 +382,19 @@ export function reviewDomainControlManifest(input, generatedAtValue = new Date()
     const fields = DOMAIN_CONTROL_REVIEW_FIELDS;
     const domains = manifest.entries.map((entry) => {
         const observation = observationMap.get(entry.domain) ?? null;
-        const comparisons = [...fields.map((field) => compareField(entry, observation, field)), renewalComparison(entry, generatedAt)];
-        const state = comparisons.some((item) => item.state === 'drift' || item.state === 'due')
-            ? 'drift'
-            : comparisons.some((item) => item.state === 'partial' || item.state === 'unavailable' || item.state === 'unsupported')
-                ? 'partial'
-                : 'aligned';
+        const comparisons = [...fields.map((field) => compareField(entry, observation, field, generatedAt)), renewalComparison(entry, generatedAt)];
+        const state = aggregateComparisonState(comparisons);
         return Object.freeze({ domain: entry.domain, state, comparisons: Object.freeze(comparisons) });
     });
     const comparisons = domains.flatMap((item) => item.comparisons);
-    const counts = Object.fromEntries(['aligned', 'drift', 'partial', 'unavailable', 'unsupported', 'not_configured', 'due']
+    const counts = Object.fromEntries(DOMAIN_CONTROL_REVIEW_COUNT_KEYS
         .map((state) => [state, comparisons.filter((item) => item.state === state).length]));
     const expired = Date.parse(manifest.expiresAt) <= Date.parse(generatedAt);
     return Object.freeze({
         schema: DOMAIN_CONTROL_REVIEW_SCHEMA,
         version: DOMAIN_CONTROL_REVIEW_VERSION,
         generatedAt,
-        state: expired ? 'expired' : domains.some((item) => item.state === 'drift') ? 'drift' : domains.some((item) => item.state === 'partial') ? 'partial' : 'aligned',
+        state: expired ? 'expired' : aggregateDomainState(domains),
         manifest: Object.freeze({
             generatedAt: manifest.generatedAt,
             expiresAt: manifest.expiresAt,
@@ -370,9 +409,14 @@ export function reviewDomainControlManifest(input, generatedAtValue = new Date()
 }
 export function validateDomainControlReviewDocument(value) {
     const root = exactReviewRecord(value, REVIEW_ROOT_KEYS, 'Domain control review document');
-    if (root.schema !== DOMAIN_CONTROL_REVIEW_SCHEMA || root.version !== DOMAIN_CONTROL_REVIEW_VERSION) {
+    if (root.schema !== DOMAIN_CONTROL_REVIEW_SCHEMA || !SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS.includes(root.version)) {
         throw new TypeError(`Domain control review document must use ${DOMAIN_CONTROL_REVIEW_SCHEMA} version ${DOMAIN_CONTROL_REVIEW_VERSION}.`);
     }
+    const legacy = root.version === PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION;
+    const countKeys = domainControlReviewCountKeys(root.version);
+    const comparisonKeys = legacy ? new Set(PUBLIC_DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS) : REVIEW_COMPARISON_KEYS;
+    const recordMaximum = legacy ? MAX_CANONICAL_DOMAIN_CONTROL_RECORDS : MAX_DOMAIN_CONTROL_RECORDS;
+    const limitations = domainControlReviewLimitations(root.version);
     const generatedAt = exactReviewTimestamp(root.generatedAt, 'Domain control review document generatedAt');
     const manifestInput = exactReviewRecord(root.manifest, REVIEW_MANIFEST_KEYS, 'Domain control review document manifest');
     const manifestGeneratedAt = exactReviewTimestamp(manifestInput.generatedAt, 'Domain control review document manifest generatedAt');
@@ -390,9 +434,9 @@ export function validateDomainControlReviewDocument(value) {
         digestSha256: manifestInput.digestSha256,
         expired,
     });
-    const countInput = exactReviewRecord(root.counts, REVIEW_COUNT_KEYS, 'Domain control review document counts');
+    const countInput = exactReviewRecord(root.counts, new Set(countKeys), 'Domain control review document counts');
     const maximumComparisons = MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES * (DOMAIN_CONTROL_REVIEW_FIELDS.length + 1);
-    const suppliedCounts = Object.fromEntries(DOMAIN_CONTROL_REVIEW_COUNT_KEYS.map((state) => [
+    const suppliedCounts = Object.fromEntries(countKeys.map((state) => [
         state,
         exactReviewInteger(countInput[state], maximumComparisons, `Domain control review document count ${state}`),
     ]));
@@ -401,8 +445,8 @@ export function validateDomainControlReviewDocument(value) {
         throw new TypeError('Domain control review document domains must be a bounded non-empty array.');
     }
     const comparisonFields = [...DOMAIN_CONTROL_REVIEW_FIELDS, 'renewalReviewAt'];
-    const comparisonStates = new Set(DOMAIN_CONTROL_REVIEW_COUNT_KEYS);
-    const calculatedCounts = Object.fromEntries(DOMAIN_CONTROL_REVIEW_COUNT_KEYS.map((state) => [state, 0]));
+    const comparisonStates = new Set(countKeys);
+    const calculatedCounts = Object.fromEntries(countKeys.map((state) => [state, 0]));
     const domains = domainInput.map((domainValue, domainIndex) => {
         const item = exactReviewRecord(domainValue, REVIEW_DOMAIN_KEYS, `Domain control review document domain ${domainIndex + 1}`);
         const normalizedDomain = domain(item.domain);
@@ -414,7 +458,7 @@ export function validateDomainControlReviewDocument(value) {
             throw new TypeError(`Domain control review document domain ${domainIndex + 1} comparisons are incomplete.`);
         }
         const comparisons = comparisonsInput.map((comparisonValue, comparisonIndex) => {
-            const comparison = exactReviewRecord(comparisonValue, REVIEW_COMPARISON_KEYS, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1}`);
+            const comparison = exactReviewRecord(comparisonValue, comparisonKeys, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1}`);
             const expectedField = comparisonFields[comparisonIndex];
             if (comparison.field !== expectedField
                 || typeof comparison.state !== 'string'
@@ -428,8 +472,8 @@ export function validateDomainControlReviewDocument(value) {
                 : expectedField === 'caa'
                     ? MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH
                     : MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH;
-            const desired = exactReviewStringArray(comparison.desired, MAX_DOMAIN_CONTROL_RECORDS, maximumValueCharacters, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} desired values`);
-            const observed = exactReviewStringArray(comparison.observed, MAX_DOMAIN_CONTROL_RECORDS, maximumValueCharacters, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} observed values`);
+            const desired = exactReviewStringArray(comparison.desired, recordMaximum, maximumValueCharacters, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} desired values`);
+            const observed = exactReviewStringArray(comparison.observed, recordMaximum, maximumValueCharacters, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} observed values`);
             const source = comparison.source === null
                 ? null
                 : exactReviewText(comparison.source, MAX_DOMAIN_CONTROL_REVIEW_SOURCE_LENGTH, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} source`);
@@ -439,6 +483,41 @@ export function validateDomainControlReviewDocument(value) {
             if (expectedField === 'renewalReviewAt' && (observed.length || source !== null || observedAt !== null)) {
                 throw new TypeError(`Domain control review document domain ${domainIndex + 1} renewal comparison is inconsistent.`);
             }
+            let expectation;
+            if (!legacy) {
+                if (expectedField !== 'renewalReviewAt') {
+                    for (const values of [desired, observed]) {
+                        const canonical = fieldValues(expectedField, values, recordMaximum);
+                        if (!canonical || canonical.length !== values.length || canonical.some((value, index) => value !== values[index]))
+                            throw new TypeError('Domain control review values are not canonical for their field.');
+                    }
+                }
+                if (!DOMAIN_CONTROL_RECORD_MODE_OPTIONS.some((mode) => mode.value === comparison.expectation))
+                    throw new TypeError('Domain control review comparison expectation is invalid.');
+                expectation = comparison.expectation;
+                if ((expectation === 'expect_records') !== (desired.length > 0)
+                    || (!DOMAIN_CONTROL_RECORD_LIST_FIELDS.includes(expectedField) && !['unconfigured', 'expect_records'].includes(expectation))
+                    || (expectation === 'unconfigured' && (state !== 'not_configured' || observed.length || source !== null || observedAt !== null))
+                    || (state === 'not_configured' && expectation !== 'unconfigured')
+                    || (state === 'observed' && expectation !== 'observe_only')
+                    || (['aligned', 'drift', 'due', 'not_due'].includes(state) && ['unconfigured', 'observe_only'].includes(expectation))) {
+                    throw new TypeError('Domain control review comparison expectation is inconsistent.');
+                }
+                if (expectedField === 'renewalReviewAt' && expectation === 'expect_records') {
+                    if (desired.length !== 1 || normalizeExplicitIsoTimestamp(desired[0]) !== desired[0]
+                        || state !== (Date.parse(desired[0]) <= Date.parse(generatedAt) ? 'due' : root.version === 2 ? 'aligned' : 'not_due'))
+                        throw new TypeError('Domain control renewal review state is inconsistent.');
+                }
+                else if (state === 'due' || state === 'not_due')
+                    throw new TypeError('Only renewal review dates can be due or not due.');
+                if (expectedField !== 'renewalReviewAt' && ['aligned', 'drift', 'observed'].includes(state)) {
+                    if (!source || domainControlEvidenceAdmission(observedAt, generatedAt))
+                        throw new TypeError('Domain control review requires current source timing for a conclusive comparison.');
+                    const equal = desired.length === observed.length && desired.every((value, index) => value === observed[index]);
+                    if ((state === 'aligned' && !equal) || (state === 'drift' && equal))
+                        throw new TypeError('Domain control review comparison result does not match its records.');
+                }
+            }
             return Object.freeze({
                 field: expectedField,
                 state,
@@ -447,15 +526,10 @@ export function validateDomainControlReviewDocument(value) {
                 source,
                 observedAt,
                 explanation: exactReviewText(comparison.explanation, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH, `Domain control review document domain ${domainIndex + 1} comparison ${comparisonIndex + 1} explanation`),
+                ...(expectation !== undefined ? { expectation } : {}),
             });
         });
-        const expectedState = comparisons.some((comparison) => comparison.state === 'drift' || comparison.state === 'due')
-            ? 'drift'
-            : comparisons.some((comparison) => comparison.state === 'partial'
-                || comparison.state === 'unavailable'
-                || comparison.state === 'unsupported')
-                ? 'partial'
-                : 'aligned';
+        const expectedState = aggregateComparisonState(comparisons, root.version);
         if (item.state !== expectedState) {
             throw new TypeError(`Domain control review document domain ${domainIndex + 1} state is inconsistent.`);
         }
@@ -464,37 +538,31 @@ export function validateDomainControlReviewDocument(value) {
     if (new Set(domains.map((item) => item.domain)).size !== domains.length) {
         throw new TypeError('Domain control review document domains must be unique.');
     }
-    for (const state of DOMAIN_CONTROL_REVIEW_COUNT_KEYS) {
+    for (const state of countKeys) {
         if (suppliedCounts[state] !== calculatedCounts[state]) {
             throw new TypeError('Domain control review document counts are inconsistent.');
         }
     }
-    const expectedState = expired
-        ? 'expired'
-        : domains.some((item) => item.state === 'drift')
-            ? 'drift'
-            : domains.some((item) => item.state === 'partial')
-                ? 'partial'
-                : 'aligned';
+    const expectedState = expired ? 'expired' : aggregateDomainState(domains, root.version);
     if (root.state !== expectedState)
         throw new TypeError('Domain control review document state is inconsistent.');
     const ignoredObservationCount = exactReviewInteger(root.ignoredObservationCount, MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS, 'Domain control review document ignored observation count');
-    const limitationsInput = boundedDataArray(root.limitations, DOMAIN_CONTROL_REVIEW_LIMITATIONS.length);
+    const limitationsInput = boundedDataArray(root.limitations, limitations.length);
     if (!limitationsInput
-        || limitationsInput.length !== DOMAIN_CONTROL_REVIEW_LIMITATIONS.length
-        || limitationsInput.some((item, index) => item !== DOMAIN_CONTROL_REVIEW_LIMITATIONS[index])) {
+        || limitationsInput.length !== limitations.length
+        || limitationsInput.some((item, index) => item !== limitations[index])) {
         throw new TypeError('Domain control review document limitations are invalid.');
     }
     return Object.freeze({
         schema: DOMAIN_CONTROL_REVIEW_SCHEMA,
-        version: DOMAIN_CONTROL_REVIEW_VERSION,
+        version: root.version,
         generatedAt,
         state: expectedState,
         manifest,
         counts: Object.freeze(suppliedCounts),
         domains: Object.freeze(domains),
         ignoredObservationCount,
-        limitations: DOMAIN_CONTROL_REVIEW_LIMITATIONS,
+        limitations,
     });
 }
 export function formatDomainControlResult(value) {

package/lib/domain-posture-analysis.mjs

@@ -2,7 +2,8 @@
 // injected so every traversal can be fixture-tested and the caller retains the
 // existing DNS timeout and missing/error semantics.
 import { parse as parseDomain } from 'tldts';
-import { parseDmarcRecords, parseSpfRecords } from "./domain-posture-parsers.mjs";
+import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
+import { parseDmarcRecords, parseDmarcReportingAuthorization, parseReportingDestination, parseSpfRecords } from "./domain-posture-parsers.mjs";
 const SPF_LOOKUP_LIMIT = 10;
 const SPF_VOID_LOOKUP_LIMIT = 2;
 const SPF_MAX_DEPTH = 5;
@@ -158,14 +159,18 @@ async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
     };
 }
 function reportDestinationDomain(value) {
-    const raw = String(value || '').trim();
-    if (!/^mailto:/iu.test(raw))
+    if (typeof value !== 'string')
         return null;
-    const address = raw.slice(7).split('!')[0] || '';
-    const at = address.lastIndexOf('@');
-    return at > 0 ? strictHostname(address.slice(at + 1)) : null;
+    // The obsolete DMARC report-size suffix remains readable, but arbitrary
+    // text after an exclamation mark must not repair a malformed destination.
+    const uri = value.trim().replace(/![0-9]+[kmgt]?$/iu, '');
+    if (/[!,;]/u.test(uri))
+        return null;
+    const destination = parseReportingDestination(uri);
+    const domain = destination?.scheme === 'mailto' ? strictHostname(destination.host) : null;
+    return domain && isValidAsciiHostname(domain) ? domain : null;
 }
-async function validateDmarcExternalReporting(ownerDomain, dmarcQuery, resolveTxt) {
+async function validateDmarcExternalReporting(ownerDomain, dmarcQuery, resolveTxt, resolveOrganisationalDomain) {
     if (dmarcQuery.error)
         return [];
     const parsed = parseDmarcRecords(dmarcQuery.records);
@@ -189,7 +194,7 @@ async function validateDmarcExternalReporting(ownerDomain, dmarcQuery, resolveTx
             });
             continue;
         }
-        if (destinationDomain === ownerDomain || destinationDomain.endsWith(`.${ownerDomain}`)) {
+        if (destinationDomain === ownerDomain) {
             results.push({
                 destination: destinationDomain,
                 reportType: item.reportType,
@@ -199,19 +204,44 @@ async function validateDmarcExternalReporting(ownerDomain, dmarcQuery, resolveTx
             });
             continue;
         }
+        const ownerOrganisation = resolveOrganisationalDomain ? await resolveOrganisationalDomain(ownerDomain) : null;
+        const recipientOrganisation = ownerOrganisation && resolveOrganisationalDomain ? await resolveOrganisationalDomain(destinationDomain) : null;
+        if (ownerOrganisation && ownerOrganisation === recipientOrganisation) {
+            results.push({ destination: destinationDomain, reportType: item.reportType, recordName: null, state: 'self', error: null });
+            continue;
+        }
+        const externalConfirmed = Boolean(ownerOrganisation && recipientOrganisation);
+        // Descendant reporting previously made no authorisation request. Do not
+        // broaden default collection to resolve its unknown organisational scope.
+        if (!resolveOrganisationalDomain && destinationDomain.endsWith(`.${ownerDomain}`)) {
+            results.push({ destination: destinationDomain, reportType: item.reportType, recordName: null, state: 'unavailable',
+                error: 'The organisational boundary was not checked. Select the additional DNS review to determine whether external reporting authorisation is required.' });
+            continue;
+        }
         const recordName = `${ownerDomain}._report._dmarc.${destinationDomain}`;
+        if (recordName.length > 253) {
+            results.push({ destination: destinationDomain, reportType: item.reportType, recordName: null, state: 'unavailable', error: 'The reporting authorisation query exceeds the DNS name limit.' });
+            continue;
+        }
         let query = cache.get(recordName);
         if (!query) {
             query = await resolveTxt(recordName);
             cache.set(recordName, query);
         }
-        const authorized = query.records.some((record) => (String(Array.isArray(record) ? record.join('') : record || '').trim().toUpperCase().startsWith('V=DMARC1')));
+        const authorized = query.records.some((record) => {
+            const tags = parseDmarcReportingAuthorization(record);
+            if (!tags)
+                return false;
+            // A recipient override cannot redirect authorisation to another host.
+            return tags.rua === undefined || tags.rua.split(',').every((destination) => reportDestinationDomain(destination) === destinationDomain);
+        });
         results.push({
             destination: destinationDomain,
             reportType: item.reportType,
             recordName,
-            state: query.error ? 'unavailable' : authorized ? 'authorized' : 'not_found',
-            error: query.error,
+            state: query.error ? 'unavailable' : authorized ? 'authorized' : externalConfirmed ? 'not_found' : 'unavailable',
+            error: query.error ?? (!authorized && !externalConfirmed
+                ? 'The organisational boundary is unknown; no authorisation requirement can be inferred from the missing record.' : null),
         });
     }
     return results;

package/lib/domain-posture-parsers.mjs

@@ -3,6 +3,7 @@
 // synthetic records and the Express/Netlify paths share identical behavior.
 import { createPublicKey } from 'node:crypto';
 import { isIP } from 'node:net';
+import { domainToASCII } from 'node:url';
 function joinTxtRecords(records) {
     if (!Array.isArray(records))
         return [];
@@ -76,8 +77,9 @@ function parseSpfRecords(records) {
             return true;
         }
         const hostname = value.toLowerCase().replace(/\.$/u, '');
-        if (hostname.length > 253 || !hostname.includes('.') || !hostname.split('.').every((part) => /^[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?$/u.test(part))) {
+        if (/[^\x00-\x7f]/u.test(value) || hostname.length > 253 || !hostname.includes('.') || !hostname.split('.').every((part) => /^[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?$/u.test(part))) {
             result.issues.push(`${label} has an invalid literal domain-spec.`);
+            invalidSyntax = true;
             return false;
         }
         return true;
@@ -195,9 +197,73 @@ function parseSpfRecords(records) {
     result.valid = !invalidSyntax;
     return result;
 }
+function hasDmarcVersion(record) {
+    return /^[vV][ \t]*=[ \t]*DMARC1(?:[ \t]*;|[ \t]*$)/u.test(record);
+}
+function parseDmarcReportingAuthorization(record) {
+    const text = joinTxtRecords([record])[0] || '';
+    if (!hasDmarcVersion(text))
+        return null;
+    const fields = text.split(';');
+    if (!fields[fields.length - 1]?.trim())
+        fields.pop();
+    // RFC 9990 section 4 requires a complete tag list, not a version prefix.
+    if (fields.some((field) => !/^[ \t]*[a-zA-Z]+[ \t]*=[ \t]*[\x20-\x3a\x3c-\x7e]+[ \t]*$/u.test(field)))
+        return null;
+    const parsed = parseTagList(text);
+    return parsed.duplicates.length || parsed.malformed.length ? null : parsed.tags;
+}
+function parseReportingDestination(value) {
+    // Validate URI spelling before URL parsing can repair whitespace, escapes or
+    // missing authority delimiters. DNS collection already bounds the input.
+    if (!value || /[^a-zA-Z0-9._~:/?#\[\]@!$&'()*+,;=%-]/u.test(value) || /%(?![a-fA-F0-9]{2})/u.test(value))
+        return null;
+    if (/^mailto:/iu.test(value)) {
+        const parts = value.slice(7).split('?');
+        if (parts.length > 2 || value.includes('#'))
+            return null;
+        const headers = parts[1];
+        if (headers !== undefined && !headers.split('&').every((field) => /^[a-zA-Z0-9._~!$'()*+,:@%\-]*=[a-zA-Z0-9._~!$'()*+,:@%\-]*$/u.test(field)))
+            return null;
+        let address;
+        try {
+            address = decodeURIComponent(parts[0] || '');
+        }
+        catch {
+            return null;
+        }
+        const at = address.lastIndexOf('@');
+        if (at <= 0)
+            return null;
+        const local = address.slice(0, at);
+        const dotAtom = /^[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+)*$/u;
+        const quoted = /^"(?:[\x20-\x21\x23-\x5b\x5d-\x7e]|\\[\x20-\x7e])*"$/u;
+        if (!dotAtom.test(local) && !quoted.test(local))
+            return null;
+        const domain = address.slice(at + 1);
+        if (domain.startsWith('[') && domain.endsWith(']')) {
+            const literal = domain.slice(1, -1);
+            return isIP(literal.replace(/^IPv6:/iu, '')) ? { scheme: 'mailto', host: domain } : null;
+        }
+        const host = domainToASCII(domain).toLowerCase();
+        if (!host || host.length > 253 || !host.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label)))
+            return null;
+        return { scheme: 'mailto', host };
+    }
+    const authority = /^https:\/\/([^/?#]+)/iu.exec(value)?.[1];
+    if (!authority || authority.includes('@') || value.includes('#'))
+        return null;
+    try {
+        const uri = new URL(value);
+        return uri.hostname && !uri.username && !uri.password && !uri.hash ? { scheme: 'https', host: uri.hostname } : null;
+    }
+    catch {
+        return null;
+    }
+}
 function parseDmarcRecords(records) {
     const allRecords = joinTxtRecords(records);
-    const dmarcRecords = allRecords.filter((record) => /^v\s*=\s*dmarc1(?:\s*;|$)/i.test(record));
+    const dmarcRecords = allRecords.filter(hasDmarcVersion);
     const result = {
         records: dmarcRecords,
         valid: false,
@@ -255,8 +321,12 @@ function parseDmarcRecords(records) {
     result.failureReporting = Boolean(parsed.tags.ruf);
     result.aggregateDestinations = (parsed.tags.rua || '').split(',').map((value) => value.trim()).filter(Boolean);
     result.failureDestinations = (parsed.tags.ruf || '').split(',').map((value) => value.trim()).filter(Boolean);
+    const emptyDestination = [parsed.tags.rua, parsed.tags.ruf].some((value) => value !== undefined && value.split(',').some((destination) => !destination.trim()));
+    if (emptyDestination)
+        result.issues.push('A DMARC reporting URI list contains an empty destination.');
     result.valid = parsed.duplicates.length === 0
         && parsed.malformed.length === 0
+        && !emptyDestination
         && Boolean(result.policy && result.subdomainPolicy && result.nonexistentSubdomainPolicy)
         && (!parsed.tags.t || /^[yn]$/i.test(parsed.tags.t));
     return result;
@@ -333,7 +403,7 @@ function parseMtaStsPolicy(text) {
 }
 function parseTlsRptRecords(records) {
     const allRecords = joinTxtRecords(records);
-    const policyRecords = allRecords.filter((record) => /^v\s*=\s*tlsrptv1(?:\s*;|$)/i.test(record));
+    const policyRecords = allRecords.filter((record) => /^v=TLSRPTv1(?:[ \t]*;|$)/u.test(record));
     const result = { records: policyRecords, valid: false, record: policyRecords[0] || null, rua: [], issues: [] };
     if (policyRecords.length === 0) {
         result.issues.push('No TLS-RPT policy record was found.');
@@ -344,14 +414,26 @@ function parseTlsRptRecords(records) {
         return result;
     }
     const parsed = parseTagList(policyRecords[0]);
-    result.rua = (parsed.tags.rua || '').split(',').map((value) => value.trim()).filter(Boolean);
+    const destinations = (parsed.tags.rua || '').split(',').map((value) => value.trim());
+    result.rua = destinations.filter(Boolean);
     if (result.rua.length === 0)
         result.issues.push('The TLS-RPT record has no aggregate report destination.');
+    if (destinations.some((destination) => /[!,;]/u.test(destination) || !parseReportingDestination(destination))) {
+        result.issues.push('TLS-RPT destinations must be complete supported mailto or HTTPS URIs; reserved reporting delimiters must be percent-encoded.');
+    }
+    const fields = (policyRecords[0] || '').split(';');
+    if (!fields[fields.length - 1]?.trim())
+        fields.pop();
+    if (fields.slice(1).some((field) => {
+        const text = field.trim();
+        return text.startsWith('rua=') ? false : !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,31}=[\x21-\x3a\x3c\x3e-\x7e]+$/u.test(text) || /^rua=/iu.test(text);
+    }))
+        result.issues.push('The TLS-RPT record contains an invalid field name or value.');
     if (parsed.duplicates.length)
         result.issues.push(`Duplicate TLS-RPT tag${parsed.duplicates.length === 1 ? '' : 's'}: ${parsed.duplicates.join(', ')}.`);
     if (parsed.malformed.length)
         result.issues.push(`Malformed TLS-RPT field${parsed.malformed.length === 1 ? '' : 's'}: ${parsed.malformed.join(', ')}.`);
-    result.valid = result.rua.length > 0 && parsed.duplicates.length === 0 && parsed.malformed.length === 0;
+    result.valid = result.issues.length === 0;
     return result;
 }
 function parseBimiRecords(records) {
@@ -466,4 +548,4 @@ function parseDkimRecords(selector, records) {
     result.valid = result.issues.length === 0;
     return result;
 }
-export { joinTxtRecords, parseTagList, parseSpfRecords, parseDmarcRecords, parseMtaStsDnsRecords, parseMtaStsPolicy, parseTlsRptRecords, parseBimiRecords, parseDkimRecords, };
+export { joinTxtRecords, parseTagList, parseSpfRecords, parseDmarcRecords, parseDmarcReportingAuthorization, parseReportingDestination, parseMtaStsDnsRecords, parseMtaStsPolicy, parseTlsRptRecords, parseBimiRecords, parseDkimRecords, };