@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/packages/evidence/artifact-integrity.mjs

@@ -39,7 +39,13 @@ function canonicalArtifactJsonV2(value) {
 }
 async function sha256ArtifactDigestV2(value) {
     const bytes = new TextEncoder().encode(canonicalArtifactJsonV2(value));
-    const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes);
+    return sha256ArtifactBytes(bytes);
+}
+async function sha256ArtifactBytes(bytes) {
+    const buffer = bytes.buffer;
+    if (!(buffer instanceof ArrayBuffer))
+        throw new TypeError('Artefact digests require non-shared bytes.');
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', new Uint8Array(buffer, bytes.byteOffset, bytes.byteLength));
     return `sha256:${[...new Uint8Array(digest)]
         .map((byte) => byte.toString(16).padStart(2, '0'))
         .join('')}`;
@@ -62,4 +68,4 @@ function sha256ArtifactDigestFor(value, canonicalization) {
         ? sha256ArtifactDigest(value)
         : sha256ArtifactDigestV2(value);
 }
-export { SORTED_JSON_V1, SORTED_JSON_V2, canonicalArtifactJson, canonicalArtifactJsonFor, canonicalArtifactJsonV2, resolveArtifactCanonicalization, sha256ArtifactDigest, sha256ArtifactDigestFor, sha256ArtifactDigestV2, };
+export { SORTED_JSON_V1, SORTED_JSON_V2, canonicalArtifactJson, canonicalArtifactJsonFor, canonicalArtifactJsonV2, resolveArtifactCanonicalization, sha256ArtifactDigest, sha256ArtifactDigestFor, sha256ArtifactDigestV2, sha256ArtifactBytes, };

package/packages/evidence/artifact-structure.mjs

@@ -0,0 +1,105 @@
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+const DIGEST_RE = /^sha256:[a-f0-9]{64}$/u;
+const DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
+export const HEX_DIGEST_RE = /^[a-f0-9]{64}$/u;
+export const SEMANTIC_VERSION_RE = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
+export function fail(label) {
+    throw new TypeError(`${label} has an unsupported or malformed structure.`);
+}
+export function record(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail(label);
+    return value;
+}
+export function exact(value, keys, label) {
+    const source = record(value, label);
+    const actual = Object.keys(source);
+    if (actual.length !== keys.length || actual.some((key) => !keys.includes(key)))
+        fail(label);
+    return source;
+}
+export function exactOptional(value, required, optional, label) {
+    const source = record(value, label);
+    const actual = Object.keys(source);
+    if (required.some((key) => !actual.includes(key))
+        || actual.some((key) => !required.includes(key) && !optional.includes(key)))
+        fail(label);
+    return source;
+}
+export function text(value, label, maximum = 2_000, allowEmpty = false) {
+    if (typeof value !== 'string' || value.length > maximum || CONTROL_RE.test(value) || (!allowEmpty && !value))
+        fail(label);
+    return value;
+}
+export function optionalText(value, label, maximum = 2_000) {
+    if (value !== null)
+        text(value, label, maximum);
+}
+export function iso(value, label, nullable = false) {
+    if (nullable && value === null)
+        return;
+    const candidate = text(value, label, 64);
+    const parsed = Date.parse(candidate);
+    if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== candidate)
+        fail(label);
+}
+export function integer(value, label, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) {
+    if (!Number.isSafeInteger(value) || Number(value) < minimum || Number(value) > maximum)
+        fail(label);
+    return Number(value);
+}
+export function boolean(value, label) {
+    if (typeof value !== 'boolean')
+        fail(label);
+}
+export function enumeration(value, allowed, label) {
+    if (typeof value !== 'string' || !allowed.includes(value))
+        fail(label);
+    return value;
+}
+export function array(value, label, maximum, minimum = 0) {
+    if (!Array.isArray(value) || value.length < minimum || value.length > maximum)
+        fail(label);
+    return value;
+}
+export function strings(value, label, maximum, textMaximum = 2_000) {
+    const values = array(value, label, maximum);
+    for (const item of values)
+        text(item, label, textMaximum);
+    return values;
+}
+export function digest(value, label) {
+    if (typeof value !== 'string' || !DIGEST_RE.test(value))
+        fail(label);
+}
+export function sameValues(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+export function domain(value, label) {
+    if (typeof value !== 'string' || !DOMAIN_RE.test(value))
+        fail(label);
+}
+export function absoluteUrl(value, label, protocols) {
+    const candidate = text(value, label, 2_048);
+    try {
+        const parsed = new URL(candidate);
+        if (!protocols.includes(parsed.protocol) || parsed.username || parsed.password || parsed.search || parsed.hash)
+            fail(label);
+        return parsed;
+    }
+    catch {
+        return fail(label);
+    }
+}
+export function nullableRecord(value, label) {
+    if (value !== null)
+        record(value, label);
+}
+export function validateIntegrity(value, label, version, currentVersion) {
+    if (version !== currentVersion)
+        fail(label);
+    const integrity = exact(value, ['algorithm', 'canonicalization', 'digestSha256'], label);
+    if (integrity.algorithm !== 'SHA-256' || integrity.canonicalization !== 'sorted-json-v2')
+        fail(label);
+    digest(integrity.digestSha256, label);
+}

package/packages/evidence/collection-quality.mjs

@@ -0,0 +1,67 @@
+const STATES = new Set(['complete', 'partial', 'unavailable', 'not_collected', 'unknown']);
+export function isWebCollectionQuality(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return false;
+    const record = value;
+    const keys = Object.keys(record);
+    if (keys.length !== 4 || keys.some(key => !['version', 'page', 'favicon', 'combined'].includes(key)
+        || !Object.hasOwn(Object.getOwnPropertyDescriptor(record, key) ?? {}, 'value')))
+        return false;
+    return record.version === 1
+        && typeof record.page === 'string' && STATES.has(record.page)
+        && typeof record.favicon === 'string' && STATES.has(record.favicon)
+        && typeof record.combined === 'string' && STATES.has(record.combined)
+        && (record.combined !== 'complete' || (record.page === 'complete' && record.favicon === 'complete'));
+}
+export function normalizeWebCollectionQuality(value, depth) {
+    if (value === undefined)
+        return undefined;
+    if (!isWebCollectionQuality(value))
+        throw new TypeError('Unsupported or invalid web collection quality.');
+    if (depth === 'fast')
+        return capturedWebCollectionQuality('not_collected', 'not_collected');
+    return { version: 1, page: value.page, favicon: value.favicon, combined: value.combined };
+}
+export function capturedWebCollectionQuality(page, favicon) {
+    const combined = page === 'complete' && favicon === 'complete' ? 'complete'
+        : page === favicon ? page : 'partial';
+    return { version: 1, page, favicon, combined };
+}
+export function webCollectionQualityForCapture(value, depth) {
+    if (depth !== 'deep')
+        return capturedWebCollectionQuality('not_collected', 'not_collected');
+    return normalizeWebCollectionQuality(value) ?? capturedWebCollectionQuality('unknown', 'unknown');
+}
+const PAGE_FIELDS = new Set(['activityStatus', 'pageTitle', 'hasPasswordField', 'hasExternalFormAction', 'phishingLanguageMatch', 'pageBaselineMatch']);
+const FAVICON_FIELDS = new Set(['faviconHash', 'faviconPHash', 'faviconMatch', 'faviconNearMatch']);
+const COMBINED_FIELDS = new Set(['riskScore', 'riskFactors', 'riskModelVersion', 'opportunityScore', 'opportunityFactors', 'reusesOfficialAssets']);
+/** Missing historical quality never proves that a false/null value was observed. */
+export function webCollectionAllowsComparison(field, quality, depth) {
+    if (PAGE_FIELDS.has(field))
+        return quality?.page === 'complete';
+    if (FAVICON_FIELDS.has(field))
+        return quality?.favicon === 'complete';
+    if (COMBINED_FIELDS.has(field) && depth === 'deep')
+        return quality?.combined === 'complete';
+    return true;
+}
+/** Retain the measured score while qualifying incomplete inputs at presentation. */
+export function webCollectionScoreLimitation(quality, depth) {
+    if (depth === 'unknown')
+        return 'Collection depth is unknown; score is not comparable.';
+    return webCollectionAllowsComparison('riskScore', quality, depth)
+        ? null : 'Incomplete or unknown web collection; score is not comparable.';
+}
+/** An incomplete current attempt cannot erase the last comparable baseline. */
+export function mergeWebCollectionQuality(previous, current) {
+    if (!previous && !current)
+        return undefined;
+    return { version: 1,
+        page: current?.page === 'complete' ? 'complete' : previous?.page ?? current?.page ?? 'unknown',
+        favicon: current?.favicon === 'complete' ? 'complete' : previous?.favicon ?? current?.favicon ?? 'unknown',
+        combined: current?.combined === 'complete' ? 'complete' : previous?.combined ?? current?.combined ?? 'unknown',
+    };
+}

package/packages/evidence/decision-fact.mjs

@@ -352,7 +352,10 @@ function boundedDataArray(value, maximum, label) {
         || Number(length) < 0) {
         throw new TypeError(`${label} must have a stable non-negative length.`);
     }
-    const retainedLength = Math.min(Number(length), maximum);
+    if (Number(length) > maximum) {
+        throw new TypeError(`${label} exceeds its ${maximum}-item admission bound; no partial fact was retained.`);
+    }
+    const retainedLength = Number(length);
     const output = [];
     for (let index = 0; index < retainedLength; index += 1) {
         const descriptor = stableOwnDescriptor(value, String(index), label);

package/packages/evidence/dns-query-outcome.mjs

@@ -0,0 +1,72 @@
+import { MAX_LOOKUP_DNS_RECORDS_PER_TYPE } from "../analysis/lookup-network-evidence-bounds.mjs";
+import { addressValue, canonicalIpAddress } from "../contracts/ip-address.mjs";
+/** Fixed values retained in Observation v1's existing diagnostic detail slot. */
+export const DNS_QUERY_OUTCOMES = Object.freeze({
+    records: { status: 'success', label: 'Records returned' },
+    empty_answer: { status: 'not_found', label: 'No records returned' },
+    no_data: { status: 'not_found', label: 'No data for this record type (NODATA)' },
+    name_not_found: { status: 'not_found', label: 'Name not found by resolver' },
+    timeout: { status: 'error', label: 'DNS query timed out' },
+    server_failure: { status: 'error', label: 'DNS server failed to answer (SERVFAIL)' },
+    refused: { status: 'error', label: 'DNS query refused' },
+    invalid_response: { status: 'error', label: 'DNS answer could not be read completely' },
+    error: { status: 'error', label: 'DNS query failed' },
+    skipped: { status: 'skipped', label: 'Not queried' },
+});
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value : {};
+}
+/** Legacy not_found diagnostics do not identify which negative answer occurred. */
+export function readDnsQueryOutcome(value) {
+    const diagnostic = record(value);
+    const detail = diagnostic.detail;
+    return typeof detail === 'string' && Object.hasOwn(DNS_QUERY_OUTCOMES, detail)
+        && DNS_QUERY_OUTCOMES[detail].status === diagnostic.status
+        ? detail : null;
+}
+export function dnsQueryFailureOutcome(code) {
+    switch (code) {
+        case 'ENODATA': return 'no_data';
+        case 'ENOTFOUND': return 'name_not_found';
+        case 'ETIMEOUT': return 'timeout';
+        case 'ESERVFAIL': return 'server_failure';
+        case 'EREFUSED': return 'refused';
+        case 'EBADRESP': return 'invalid_response';
+        default: return 'error';
+    }
+}
+/** One family, one source state. Unrelated mail/delegation failures cannot erase it. */
+export function dnsAddressFamilyEvidence(dnsValue, family) {
+    const dns = record(dnsValue);
+    const diagnostic = record(record(dns.diagnostics)[family]);
+    const raw = record(dns.records)[family];
+    const candidates = Array.isArray(raw) ? raw.slice(0, MAX_LOOKUP_DNS_RECORDS_PER_TYPE) : [];
+    const addresses = candidates.flatMap(value => {
+        const address = canonicalIpAddress(value);
+        return address && addressValue(address)?.family === (family === 'a' ? 4 : 6) ? [address] : [];
+    });
+    const malformed = raw !== undefined && !Array.isArray(raw)
+        || candidates.length !== addresses.length;
+    const truncated = diagnostic.truncated === true
+        || typeof diagnostic.discarded === 'number' && diagnostic.discarded > 0
+        || Array.isArray(raw) && raw.length > candidates.length;
+    const outcome = readDnsQueryOutcome(diagnostic);
+    const inconsistent = outcome === 'records' && !addresses.length
+        || outcome !== null && outcome !== 'records' && addresses.length > 0;
+    const complete = !malformed && !truncated && !inconsistent && Array.isArray(raw)
+        && outcome !== null && DNS_QUERY_OUTCOMES[outcome].status !== 'error' && outcome !== 'skipped';
+    const state = malformed || inconsistent ? 'error'
+        : truncated ? 'partial'
+            : outcome ? DNS_QUERY_OUTCOMES[outcome].status
+                : diagnostic.status === 'error' ? 'error'
+                    : diagnostic.status === 'skipped' || dns.status === 'skipped' ? 'skipped' : 'unknown';
+    const value = addresses.length ? [...new Set(addresses)].sort().join(' · ')
+        : malformed || inconsistent ? DNS_QUERY_OUTCOMES.invalid_response.label
+            : truncated ? 'DNS answer incomplete'
+                : outcome ? DNS_QUERY_OUTCOMES[outcome].label
+                    : state === 'error' ? DNS_QUERY_OUTCOMES.error.label
+                        : state === 'skipped' ? DNS_QUERY_OUTCOMES.skipped.label
+                            : diagnostic.status === 'not_found' ? 'Negative DNS outcome not recorded' : null;
+    return { outcome, value, state, complete, truncated };
+}

package/packages/evidence/domain-control-runtime.mjs

@@ -1,7 +1,9 @@
+import { analystReviewAgeAt, ANALYST_REVIEW_STALE_AFTER_DAYS } from "./review-age.mjs";
 import { canonicalArtifactJsonFor, resolveArtifactCanonicalization, } from "./artifact-integrity.mjs";
 import { normalizeDomain } from "./domain-name.mjs";
 import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "./observation.mjs";
-import { DOMAIN_CONTROL_CAA_RECORD_KEYS, DOMAIN_CONTROL_DIGEST_SHA256_HEX_LENGTH, DOMAIN_CONTROL_DS_RECORD_KEYS, DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA as DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_INPUT_KEYS, DOMAIN_CONTROL_MANIFEST_INPUT_VERSION, DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS, DOMAIN_CONTROL_MANIFEST_LIMITATIONS, DOMAIN_CONTROL_MANIFEST_ROOT_KEYS, DOMAIN_CONTROL_MANIFEST_SCHEMA as DOMAIN_CONTROL_PASSPORT_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_MX_RECORD_KEYS, DOMAIN_CONTROL_RECORD_LIST_FIELDS, DOMAIN_CONTROL_SPKI_SHA256_HEX_LENGTH, DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_CAA_FLAGS, MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_CAA_TAG_LENGTH, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH, MAX_DOMAIN_CONTROL_DOMAIN_LENGTH, MAX_DOMAIN_CONTROL_DS_ALGORITHM, MAX_DOMAIN_CONTROL_DS_DIGEST_LENGTH, MAX_DOMAIN_CONTROL_DS_DIGEST_TYPE, MAX_DOMAIN_CONTROL_DS_KEY_TAG, MAX_DOMAIN_CONTROL_DS_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_INPUT_RECORDS, MAX_DOMAIN_CONTROL_JSON_DEPTH, MAX_DOMAIN_CONTROL_JSON_VALUES, MAX_DOMAIN_CONTROL_MANIFEST_BYTES, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_MX_PRIORITY, MAX_DOMAIN_CONTROL_MX_TEXT_LENGTH, MAX_DOMAIN_CONTROL_NAME_INPUT_LENGTH, MAX_DOMAIN_CONTROL_NOTE_LENGTH, MAX_DOMAIN_CONTROL_RECORD_INTEGER_TEXT_LENGTH, MAX_DOMAIN_CONTROL_TEXT_LENGTH, MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH, MIN_DOMAIN_CONTROL_DS_DIGEST_LENGTH, MIN_DOMAIN_CONTROL_MANIFEST_ENTRIES, MIN_DOMAIN_CONTROL_RECORDS, } from "../contracts/domain-control-manifest.mjs";
+import { MAX_POSTURE_CHECK_RECORDS } from "./domain-posture-context.mjs";
+import { DOMAIN_CONTROL_CAA_RECORD_KEYS, DOMAIN_CONTROL_DIGEST_SHA256_HEX_LENGTH, DOMAIN_CONTROL_DS_RECORD_KEYS, DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA as DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_INPUT_KEYS, DOMAIN_CONTROL_MANIFEST_INPUT_VERSION, DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS, DOMAIN_CONTROL_MANIFEST_LIMITATIONS, DOMAIN_CONTROL_MANIFEST_ROOT_KEYS, DOMAIN_CONTROL_MANIFEST_SCHEMA as DOMAIN_CONTROL_PASSPORT_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_MX_RECORD_KEYS, DOMAIN_CONTROL_RECORD_LIST_FIELDS, DOMAIN_CONTROL_RECORD_MODE_OPTIONS, DOMAIN_CONTROL_SPKI_SHA256_HEX_LENGTH, DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_CURRENT_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_CAA_FLAGS, MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_CAA_TAG_LENGTH, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH, MAX_DOMAIN_CONTROL_DOMAIN_LENGTH, MAX_DOMAIN_CONTROL_DS_ALGORITHM, MAX_DOMAIN_CONTROL_DS_DIGEST_LENGTH, MAX_DOMAIN_CONTROL_DS_DIGEST_TYPE, MAX_DOMAIN_CONTROL_DS_KEY_TAG, MAX_DOMAIN_CONTROL_DS_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_INPUT_RECORDS, MAX_DOMAIN_CONTROL_JSON_DEPTH, MAX_DOMAIN_CONTROL_JSON_VALUES, MAX_DOMAIN_CONTROL_MANIFEST_BYTES, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_MX_PRIORITY, MAX_DOMAIN_CONTROL_MX_TEXT_LENGTH, MAX_DOMAIN_CONTROL_NAME_INPUT_LENGTH, MAX_DOMAIN_CONTROL_NOTE_LENGTH, MAX_DOMAIN_CONTROL_RECORD_INTEGER_TEXT_LENGTH, MAX_DOMAIN_CONTROL_TEXT_LENGTH, MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH, MIN_DOMAIN_CONTROL_DS_DIGEST_LENGTH, MIN_DOMAIN_CONTROL_MANIFEST_ENTRIES, MIN_DOMAIN_CONTROL_RECORDS, PUBLIC_DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS, PUBLIC_DOMAIN_CONTROL_MANIFEST_INPUT_VERSION, PUBLIC_DOMAIN_CONTROL_MANIFEST_LIMITATIONS, PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION, SUPPORTED_DOMAIN_CONTROL_MANIFEST_INPUT_VERSIONS, } from "../contracts/domain-control-manifest.mjs";
 const DOMAIN_CONTROL_PASSPORT_VERSION = DOMAIN_CONTROL_MANIFEST_INPUT_VERSION;
 export { DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA, DOMAIN_CONTROL_PASSPORT_SCHEMA, DOMAIN_CONTROL_PASSPORT_VERSION, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_MANIFEST_BYTES, };
 export const MAX_DOMAIN_CONTROL_PASSPORT_BYTES = MAX_DOMAIN_CONTROL_MANIFEST_BYTES;
@@ -10,6 +12,8 @@ export const DOMAIN_CONTROL_PASSPORT_LIMITATIONS = DOMAIN_CONTROL_MANIFEST_LIMIT
 const INPUT_KEYS = new Set(DOMAIN_CONTROL_MANIFEST_INPUT_KEYS);
 const MANIFEST_KEYS = new Set(DOMAIN_CONTROL_MANIFEST_ROOT_KEYS);
 const ENTRY_KEYS = new Set(DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS);
+const PUBLIC_ENTRY_KEYS = new Set(PUBLIC_DOMAIN_CONTROL_MANIFEST_ENTRY_KEYS);
+const RECORD_MODE_KEYS = new Set(DOMAIN_CONTROL_RECORD_LIST_FIELDS);
 const INTEGRITY_KEYS = new Set(DOMAIN_CONTROL_MANIFEST_INTEGRITY_KEYS);
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const RECORD_LIST_FIELDS = DOMAIN_CONTROL_RECORD_LIST_FIELDS;
@@ -82,6 +86,7 @@ function boundedDataArray(value, label, minimum, maximum, maximumMessage) {
     return result;
 }
 const MX_RECORD_KEYS = new Set(DOMAIN_CONTROL_MX_RECORD_KEYS);
+const RESOLVER_MX_RECORD_KEYS = new Set([...MX_RECORD_KEYS, 'type']);
 const CAA_RECORD_KEYS = new Set(DOMAIN_CONTROL_CAA_RECORD_KEYS);
 const DS_RECORD_KEYS = new Set(DOMAIN_CONTROL_DS_RECORD_KEYS);
 const DS_DIGEST_PATTERN = new RegExp(`^[a-f0-9]{${MIN_DOMAIN_CONTROL_DS_DIGEST_LENGTH},${MAX_DOMAIN_CONTROL_DS_DIGEST_LENGTH}}$`, 'u');
@@ -155,21 +160,48 @@ function canonicalIntegerAlias(source, keys, maximum, label, fallback = null) {
     }
     return normalised[0] ?? null;
 }
-export function canonicalMxRecord(value) {
-    const item = structuredRecord(value, MX_RECORD_KEYS, 'Domain control MX record');
+function mxRecordParts(value, resolverRecord = false) {
+    const item = structuredRecord(value, resolverRecord ? RESOLVER_MX_RECORD_KEYS : MX_RECORD_KEYS, 'Domain control MX record');
     if (item) {
-        const host = canonicalStringAlias(item, ['exchange', 'host', 'value'], exchange, 'Domain control MX host');
+        if (resolverRecord && Object.hasOwn(item, 'type') && item.type !== 'MX')
+            return null;
+        const host = canonicalStringAlias(item, ['exchange', 'host', 'value'], (value) => value === '' ? '.' : exchange(value), 'Domain control MX host');
         const priority = canonicalIntegerAlias(item, ['priority', 'preference'], MAX_DOMAIN_CONTROL_MX_PRIORITY, 'Domain control MX priority');
-        return host && priority !== null ? `${priority} ${host}` : '';
+        return host && priority !== null ? { priority, exchange: host } : null;
     }
     const candidate = recordText(value, MAX_DOMAIN_CONTROL_MX_TEXT_LENGTH).toLowerCase();
     const match = /^(\d{1,5})\s+(.+)$/u.exec(candidate);
     if (match) {
         const priority = recordInteger(match[1], MAX_DOMAIN_CONTROL_MX_PRIORITY);
         const host = exchange(match[2]);
-        return priority !== null && host ? `${priority} ${host}` : '';
+        return priority !== null && host ? { priority, exchange: host } : null;
+    }
+    const host = exchange(candidate);
+    return host ? { priority: null, exchange: host } : null;
+}
+export function canonicalMxRecord(value) {
+    const parts = mxRecordParts(value);
+    return !parts ? '' : parts.priority === null ? parts.exchange : `${parts.priority} ${parts.exchange}`;
+}
+function completeMxRecord(value, resolverRecord) {
+    try {
+        const parts = mxRecordParts(value, resolverRecord);
+        return parts && parts.priority !== null
+            ? { priority: parts.priority, exchange: parts.exchange } : null;
+    }
+    catch (error) {
+        if (!(error instanceof TypeError))
+            throw error;
+        return null;
     }
-    return exchange(candidate);
+}
+/** Complete canonical records require a preference and retain the root exchange as '.'. */
+export function normalizeMxRecord(value) {
+    return completeMxRecord(value, false);
+}
+/** Accept the native resolver's optional record type without broadening import shapes. */
+export function normalizeResolverMxRecord(value) {
+    return completeMxRecord(value, true);
 }
 function caaValue(value, tag) {
     const candidate = recordText(value, MAX_DOMAIN_CONTROL_CAA_VALUE_LENGTH)
@@ -265,6 +297,88 @@ export function canonicalDomainControlRecordList(value, kind) {
         .sort(compareCodeUnits)
         .slice(0, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS);
 }
+/** Complete field values for posture review; an invalid value never becomes an absent record. */
+export function canonicalPostureRecords(checkId, values) {
+    if (values.length > MAX_POSTURE_CHECK_RECORDS)
+        return null;
+    const normalise = checkId === 'nameservers' ? domainControlName
+        : checkId === 'mx' ? canonicalMxRecord : checkId === 'caa' ? canonicalCaaRecord
+            : checkId === 'registration_lock'
+                ? (value) => typeof value === 'string' && value.length <= 120 && !/[\u0000-\u001f\u007f]/u.test(value)
+                    ? value.trim().toLowerCase().replace(/[\s_-]+/gu, '') : ''
+                : null;
+    if (!normalise)
+        return null;
+    try {
+        const records = values.map(normalise);
+        if (records.some((value) => !value))
+            return null;
+        return [...new Set(records)].sort(compareCodeUnits);
+    }
+    catch {
+        return null;
+    }
+}
+/** Complete current record inputs are rejected, not shortened, when invalid or over capacity. */
+export function canonicalDomainControlRecords(value, field) {
+    if (value === undefined)
+        return [];
+    const rows = boundedDataArray(value, `Domain control ${field}`, 0, MAX_DOMAIN_CONTROL_INPUT_RECORDS);
+    const normalise = field === 'nameservers' ? domainControlName : field === 'ds' ? canonicalDsRecord
+        : field === 'mx' ? canonicalMxRecord : canonicalCaaRecord;
+    const values = rows.map(normalise);
+    if (values.some((item) => !item))
+        throw new TypeError(`Domain control ${field} contains an invalid record.`);
+    const records = [...new Set(values)].sort(compareCodeUnits);
+    if (records.length > MAX_CURRENT_DOMAIN_CONTROL_RECORDS)
+        throw new TypeError(`Domain control ${field} exceeds ${MAX_CURRENT_DOMAIN_CONTROL_RECORDS} records.`);
+    return records;
+}
+export function domainControlRecordMode(entry, field) {
+    return entry.recordModes?.[field] ?? (entry[field].length ? 'expect_records' : 'unconfigured');
+}
+export function normalizeDomainControlRecordModes(value, records) {
+    const source = normalizeDeclaredDomainControlRecordModes(value);
+    return Object.freeze(Object.fromEntries(DOMAIN_CONTROL_RECORD_LIST_FIELDS.map((field) => {
+        const mode = Object.hasOwn(source, field) ? source[field] : (records[field].length ? 'expect_records' : 'unconfigured');
+        if ((mode === 'expect_records') !== (records[field].length > 0)) {
+            throw new TypeError(`Domain control ${field} requires records only in the specified-records mode.`);
+        }
+        return [field, mode];
+    })));
+}
+export function normalizeDeclaredDomainControlRecordModes(value) {
+    const source = value === undefined ? {} : boundedDataRecord(value, RECORD_MODE_KEYS, 'Domain control record modes');
+    if (!source)
+        throw new TypeError('Domain control record modes must be an ordinary object.');
+    const modes = {};
+    for (const field of DOMAIN_CONTROL_RECORD_LIST_FIELDS) {
+        if (!Object.hasOwn(source, field))
+            continue;
+        const mode = source[field];
+        if (!DOMAIN_CONTROL_RECORD_MODE_OPTIONS.some((option) => option.value === mode))
+            throw new TypeError(`Domain control ${field} has an unsupported record mode.`);
+        modes[field] = mode;
+    }
+    return Object.freeze(modes);
+}
+export function normalizeDomainControlRecordSettings(value) {
+    const records = {
+        nameservers: canonicalDomainControlRecords(value.nameservers, 'nameservers'),
+        ds: canonicalDomainControlRecords(value.ds, 'ds'),
+        mx: canonicalDomainControlRecords(value.mx, 'mx'),
+        caa: canonicalDomainControlRecords(value.caa, 'caa'),
+    };
+    return { ...records, recordModes: normalizeDomainControlRecordModes(value.recordModes, records) };
+}
+export function domainControlEvidenceAdmission(observedAt, now) {
+    const age = analystReviewAgeAt(observedAt, now);
+    if (age === 'unknown')
+        return 'A valid source observation time at or before the review is required.';
+    if (age === 'stale')
+        return `The source observation is more than ${ANALYST_REVIEW_STALE_AFTER_DAYS} days old; collect a current observation before comparing expected settings.`;
+    return null;
+}
 class DomainControlJsonBudgetError extends Error {
 }
 class DomainControlJsonStructureError extends Error {
@@ -397,10 +511,10 @@ export function domainControlPassportSerialisedBytes(value, label = 'Domain cont
 export function assertDomainControlPassportByteBudget(value, label = 'Domain control manifest') {
     domainControlPassportSerialisedBytes(value, label);
 }
-function boundedDomainControlPassportEntries(value, label) {
+function boundedDomainControlPassportEntries(value, label, legacy = false) {
     const entries = boundedDataArray(value, label, MIN_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES);
     return entries.map((entry) => {
-        const source = boundedDataRecord(entry, ENTRY_KEYS, `${label} entry`);
+        const source = boundedDataRecord(entry, legacy ? PUBLIC_ENTRY_KEYS : ENTRY_KEYS, `${label} entry`);
         if (!source)
             return entry;
         for (const field of RECORD_LIST_FIELDS) {
@@ -408,6 +522,11 @@ function boundedDomainControlPassportEntries(value, label) {
                 continue;
             source[field] = boundedDataArray(source[field], `${label} entry ${field}`, MIN_DOMAIN_CONTROL_RECORDS, MAX_DOMAIN_CONTROL_INPUT_RECORDS, `${label} entry ${field} exceeds ${MAX_DOMAIN_CONTROL_INPUT_RECORDS} input records.`);
         }
+        if (Object.hasOwn(source, 'recordModes')) {
+            source.recordModes = boundedDataRecord(source.recordModes, RECORD_MODE_KEYS, `${label} entry record modes`);
+            if (!source.recordModes)
+                throw new TypeError(`${label} entry record modes must be an ordinary object.`);
+        }
         return source;
     });
 }
@@ -442,7 +561,7 @@ function digest(value) {
     const candidate = value.trim().toLowerCase();
     return SPKI_DIGEST_PATTERN.test(candidate) ? candidate : null;
 }
-function normalizeEntry(value) {
+function normalizeEntry(value, legacyRecords, includeModes) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return null;
     const source = value;
@@ -455,38 +574,44 @@ function normalizeEntry(value) {
         && !tlsSpkiSha256) {
         throw new TypeError('Domain control TLS public-key fingerprint must be exactly 64 hexadecimal characters.');
     }
+    const records = {
+        nameservers: Object.freeze(legacyRecords ? hostnames(source.nameservers) : canonicalDomainControlRecords(source.nameservers, 'nameservers')),
+        ds: Object.freeze(legacyRecords ? canonicalDomainControlRecordList(source.ds, 'ds') : canonicalDomainControlRecords(source.ds, 'ds')),
+        mx: Object.freeze(legacyRecords ? canonicalDomainControlRecordList(source.mx, 'mx') : canonicalDomainControlRecords(source.mx, 'mx')),
+        caa: Object.freeze(legacyRecords ? canonicalDomainControlRecordList(source.caa, 'caa') : canonicalDomainControlRecords(source.caa, 'caa')),
+    };
     return Object.freeze({
         domain,
-        nameservers: Object.freeze(hostnames(source.nameservers)),
-        ds: Object.freeze(canonicalDomainControlRecordList(source.ds, 'ds')),
-        mx: Object.freeze(canonicalDomainControlRecordList(source.mx, 'mx')),
-        caa: Object.freeze(canonicalDomainControlRecordList(source.caa, 'caa')),
+        ...records,
+        ...(includeModes ? { recordModes: normalizeDomainControlRecordModes(source.recordModes, records) } : {}),
         tlsIssuer: text(source.tlsIssuer, MAX_DOMAIN_CONTROL_TEXT_LENGTH)?.toLowerCase() ?? null,
         tlsSpkiSha256,
         registrarLock: source.registrarLock === 'required' || source.registrarLock === 'not_required'
             ? source.registrarLock
             : null,
-        renewalReviewAt: timestamp(source.renewalReviewAt, true),
+        renewalReviewAt: timestamp(source.renewalReviewAt, legacyRecords),
         note: text(source.note, MAX_DOMAIN_CONTROL_NOTE_LENGTH),
     });
 }
 function buildUnsignedDomainControlPassportInternal(input, generatedAtValue, options = {}) {
     const source = boundedDataRecord(input, INPUT_KEYS, 'Domain control manifest input');
-    if (!source || source.schema !== DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA || source.version !== DOMAIN_CONTROL_MANIFEST_INPUT_VERSION) {
-        throw new TypeError(`Domain control manifest input must use ${DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA} version ${DOMAIN_CONTROL_MANIFEST_INPUT_VERSION}.`);
+    if (!source || source.schema !== DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA || !SUPPORTED_DOMAIN_CONTROL_MANIFEST_INPUT_VERSIONS.some((version) => version === source.version)) {
+        throw new TypeError(`Domain control manifest input must use ${DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA} version ${SUPPORTED_DOMAIN_CONTROL_MANIFEST_INPUT_VERSIONS.join(' or ')}.`);
     }
-    const inputEntries = boundedDomainControlPassportEntries(source.entries, 'Domain control manifest input');
+    const legacy = source.version === PUBLIC_DOMAIN_CONTROL_MANIFEST_INPUT_VERSION;
+    const version = options.manifestVersion ?? DOMAIN_CONTROL_MANIFEST_VERSION;
+    const inputEntries = boundedDomainControlPassportEntries(source.entries, 'Domain control manifest input', legacy);
     source.entries = inputEntries;
     assertDomainControlPassportByteBudget(source, 'Domain control manifest input');
     const generatedAt = timestamp(generatedAtValue, options.legacyGeneratedAt === true);
-    const expiresAt = timestamp(source.expiresAt, true);
+    const expiresAt = timestamp(source.expiresAt, legacy);
     if (!generatedAt) {
         throw new TypeError('Domain control manifest generation time must be valid and include an explicit timezone.');
     }
     if (!expiresAt || Date.parse(expiresAt) <= Date.parse(generatedAt)) {
         throw new TypeError('Domain control manifest expiry must be a valid time after generation.');
     }
-    const entries = inputEntries.map(normalizeEntry);
+    const entries = inputEntries.map((entry) => normalizeEntry(entry, legacy, version === DOMAIN_CONTROL_MANIFEST_VERSION));
     if (entries.some((entry) => entry === null))
         throw new TypeError('Domain control manifest contains an invalid entry.');
     const normalizedEntries = entries;
@@ -498,11 +623,11 @@ function buildUnsignedDomainControlPassportInternal(input, generatedAtValue, opt
         : [...normalizedEntries].sort((left, right) => compareCodeUnits(left.domain, right.domain));
     return Object.freeze({
         schema: DOMAIN_CONTROL_PASSPORT_SCHEMA,
-        version: DOMAIN_CONTROL_MANIFEST_VERSION,
+        version,
         generatedAt,
         expiresAt,
         entries: Object.freeze(orderedEntries),
-        limitations: DOMAIN_CONTROL_PASSPORT_LIMITATIONS,
+        limitations: version === PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION ? PUBLIC_DOMAIN_CONTROL_MANIFEST_LIMITATIONS : DOMAIN_CONTROL_PASSPORT_LIMITATIONS,
     });
 }
 export function buildUnsignedDomainControlPassport(input, generatedAtValue, options = {}) {
@@ -519,29 +644,32 @@ function normalizeDomainControlPassportDocumentInternal(value) {
         || !MANIFEST_DIGEST_PATTERN.test(integrity.digestSha256)) {
         throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
     }
+    const canonicalization = resolveArtifactCanonicalization(source.version, integrity.canonicalization, DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, 'Domain control manifest');
+    const legacy = source.version === PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION;
+    const expectedLimitations = legacy ? PUBLIC_DOMAIN_CONTROL_MANIFEST_LIMITATIONS : DOMAIN_CONTROL_PASSPORT_LIMITATIONS;
     let limitations;
     try {
-        limitations = boundedDataArray(source.limitations, 'Domain control manifest limitations', DOMAIN_CONTROL_PASSPORT_LIMITATIONS.length, DOMAIN_CONTROL_PASSPORT_LIMITATIONS.length);
+        limitations = boundedDataArray(source.limitations, 'Domain control manifest limitations', expectedLimitations.length, expectedLimitations.length);
     }
     catch {
         throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
     }
-    if (limitations.some((item, index) => item !== DOMAIN_CONTROL_PASSPORT_LIMITATIONS[index])) {
+    if (limitations.some((item, index) => item !== expectedLimitations[index])) {
         throw new TypeError('Domain control manifest has an unsupported or malformed structure.');
     }
     source.limitations = limitations;
-    const manifestEntries = boundedDomainControlPassportEntries(source.entries, 'Domain control manifest');
+    const manifestEntries = boundedDomainControlPassportEntries(source.entries, 'Domain control manifest', legacy);
     source.entries = manifestEntries;
     source.integrity = integrity;
     assertDomainControlPassportByteBudget(source);
-    const canonicalization = resolveArtifactCanonicalization(source.version, integrity.canonicalization, DOMAIN_CONTROL_MANIFEST_CANONICALIZATION_ROUTES, 'Domain control manifest');
     const baseUnsigned = buildUnsignedDomainControlPassportInternal({
         schema: DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA,
-        version: DOMAIN_CONTROL_MANIFEST_INPUT_VERSION,
+        version: legacy ? PUBLIC_DOMAIN_CONTROL_MANIFEST_INPUT_VERSION : DOMAIN_CONTROL_MANIFEST_INPUT_VERSION,
         expiresAt: source.expiresAt,
         entries: manifestEntries,
     }, source.generatedAt, {
         preserveEntryOrder: true,
+        manifestVersion: legacy ? PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION : DOMAIN_CONTROL_MANIFEST_VERSION,
     });
     const unsigned = baseUnsigned;
     const { integrity: _integrity, ...suppliedUnsigned } = source;