@slicedearth/whoisleuth-cli 1.32.2 → 1.36.1

package/frontend/src/lib/analysis/website-snapshot-model.js

@@ -1,6 +1,6 @@
 import { normalizeDomain } from "./case-model.js";
 export const WEBSITE_SNAPSHOT_SCHEMA = 'whoisleuth.website-profile-snapshots';
-export const WEBSITE_SNAPSHOT_SCHEMA_VERSION = 3;
+export const WEBSITE_SNAPSHOT_SCHEMA_VERSION = 4;
 export const MAX_WEBSITE_SNAPSHOTS = 60;
 export const MAX_WEBSITE_SNAPSHOTS_PER_DOMAIN = 12;
 export const MAX_WEBSITE_SNAPSHOT_STORE_BYTES = 512 * 1024;
@@ -65,6 +65,23 @@ function source(value) {
     const state = text(item?.state, 40);
     return sourceName && state ? { source: sourceName, state } : null;
 }
+function dependency(value) {
+    const item = record(value);
+    const recordType = text(item?.recordType, 10);
+    const target = normalizeDomain(item?.target);
+    const state = text(item?.state, 40);
+    if (!target
+        || !['CNAME', 'HTTPS', 'NS', 'MX', 'HTTP'].includes(recordType)
+        || !['candidate', 'unresolved', 'active', 'unsupported', 'false_positive'].includes(state))
+        return null;
+    return {
+        recordType: recordType,
+        target,
+        state: state,
+        qualification: text(item?.qualification, 80) || 'inconclusive',
+        serviceFamily: nullableText(item?.serviceFamily, 120),
+    };
+}
 function nullableBoolean(value) {
     return typeof value === 'boolean' ? value : null;
 }
@@ -161,6 +178,7 @@ export function normalizeWebsiteProfileSnapshot(raw) {
         identity: identity(value?.identity),
         identityValues: identityValues(value?.identityValues),
         sources: values(value?.sources, 16, source),
+        dependencies: values(value?.dependencies, 20, dependency),
         certificate: certificate(value?.certificate),
     };
 }
@@ -242,13 +260,49 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
     const before = normalizeWebsiteProfileSnapshot(beforeRaw);
     const after = normalizeWebsiteProfileSnapshot(afterRaw);
     if (!before || !after || before.domain !== after.domain) {
-        return { compatible: false, changes: [{ field: 'snapshot', state: 'incomparable', before: before?.domain ?? null, after: after?.domain ?? null }] };
+        return {
+            compatible: false,
+            changes: [{ field: 'snapshot', state: 'incomparable', before: before?.domain ?? null, after: after?.domain ?? null }],
+            dependencyTransitions: [],
+        };
     }
     const changes = [
         ...compareMap('technology', new Map(before.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}`])), new Map(after.technologies.map((item) => [item.id, `${item.name}|${item.category}|${item.confidence}`]))),
         ...compareMap('posture', new Map(before.posture.map((item) => [item.id, item.state])), new Map(after.posture.map((item) => [item.id, item.state]))),
         ...compareMap('source', new Map(before.sources.map((item) => [item.source, item.state])), new Map(after.sources.map((item) => [item.source, item.state]))),
+        ...compareMap('dependency', new Map(before.dependencies.map((item) => [`${item.recordType}:${item.target}`, `${item.state}|${item.qualification}`])), new Map(after.dependencies.map((item) => [`${item.recordType}:${item.target}`, `${item.state}|${item.qualification}`]))),
     ];
+    const dependencyTransitions = [];
+    const beforeDependencies = new Map(before.dependencies.map((item) => [`${item.recordType}:${item.target}`, item]));
+    const afterDependencies = new Map(after.dependencies.map((item) => [`${item.recordType}:${item.target}`, item]));
+    for (const key of [...new Set([...beforeDependencies.keys(), ...afterDependencies.keys()])].sort()) {
+        const left = beforeDependencies.get(key);
+        const right = afterDependencies.get(key);
+        if (left?.state === 'active' && right?.qualification === 'known_deprovision_pattern') {
+            dependencyTransitions.push({
+                target: right.target,
+                recordType: right.recordType,
+                state: 'active_to_deprovision_cue',
+                detail: 'An earlier active navigation target now matches a reviewed passive deprovision-page cue. Verify the service account and DNS manually; this does not establish claimability.',
+            });
+        }
+        else if (left?.state === 'active' && right?.state === 'unresolved') {
+            dependencyTransitions.push({
+                target: right.target,
+                recordType: right.recordType,
+                state: 'active_to_unresolved',
+                detail: 'An earlier active dependency is unresolved in the later retained observation. Resolver or collection failure remains possible.',
+            });
+        }
+        else if (!left && right) {
+            dependencyTransitions.push({ target: right.target, recordType: right.recordType, state: 'added', detail: 'This dependency first appears in the later retained snapshot.' });
+        }
+        else if (left && !right && after.complete) {
+            dependencyTransitions.push({ target: left.target, recordType: left.recordType, state: 'removed', detail: 'This dependency is not represented in the later complete snapshot. It may have been intentionally removed or replaced.' });
+        }
+        if (dependencyTransitions.length >= 20)
+            break;
+    }
     for (const key of Object.keys(before.identity)) {
         const left = before.identity[key];
         const right = after.identity[key];
@@ -298,5 +352,5 @@ export function compareWebsiteSnapshots(beforeRaw, afterRaw) {
     if (before.complete !== after.complete || before.truncated !== after.truncated) {
         changes.push({ field: 'completeness', state: 'incomparable', before: `${before.complete}/${before.truncated}`, after: `${after.complete}/${after.truncated}` });
     }
-    return { compatible: true, changes };
+    return { compatible: true, changes, dependencyTransitions };
 }

package/lib/availability.mjs

@@ -11,6 +11,7 @@ import { promises as dns } from 'node:dns';
 import { fetchRdapRecord } from "./rdap.mjs";
 import { buildWhoisChain, parseWhoisChain } from "./whois.mjs";
 import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
+import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
 import { collectDnsIntelligence, skippedDnsIntelligence } from "./dns-intelligence.mjs";
 import { fetchFaviconHash } from "./favicon.mjs";
 import { extractHtmlSignals } from "./html-signals.mjs";
@@ -19,9 +20,10 @@ import { buildHttpObservation, failedHttpObservation, skippedHttpObservation } f
 import { collectTlsIntelligence, skippedTlsObservation } from "./tls-intelligence.mjs";
 import { parseRegistryDate, registryDateIso } from "./registry-dates.mjs";
 import { analyzeWebsiteSecurityPosture } from "./website-security-posture.mjs";
-import { analyzeResponsePolicyHeaders } from "./response-policy.mjs";
+import { analyzeResponsePolicyHeaders, qualifyResponsePolicyWithCspMeta, } from "./response-policy.mjs";
 import { nonEmptyErrorMessage } from "./error-detail.mjs";
-const MAX_HOMEPAGE_BYTES = 300000;
+import { registryServiceAdmissionFor } from "./registry-capabilities.mjs";
+import { HOMEPAGE_FETCH_TIMEOUT_MS, MAX_HOMEPAGE_BYTES, } from "./outbound-request-bounds.mjs";
 const DNS_DELEGATION_TIMEOUT_MS = 4000;
 const MAX_DELEGATION_NAMESERVERS = 50;
 const MISSING_DNS_CODES = new Set(['ENODATA', 'ENOTFOUND', 'ENONAME', 'NXDOMAIN']);
@@ -196,14 +198,14 @@ async function checkDnsDelegation(domain, { resolver = dns.resolveNs } = {}) {
 // an HTTP error can all produce the same null body. Keeping that distinction
 // avoids turning an inconclusive probe into a false inactivity claim.
 async function fetchHomepage(domain, { fetcher = safeFetchDetailed } = {}) {
-    const headers = { 'User-Agent': 'Mozilla/5.0 (compatible; DomainStatusChecker/1.0)' };
+    const headers = whoisleuthRequestHeaders();
     const failures = [];
     const probeStartedAt = Date.now();
     for (const scheme of ['https', 'http']) {
         const requestUrl = `${scheme}://${domain}`;
         const attemptStartedAt = Date.now();
         const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), 6000);
+        const timeout = setTimeout(() => controller.abort(), HOMEPAGE_FETCH_TIMEOUT_MS);
         try {
             const fetched = await fetcher(requestUrl, { signal: controller.signal, headers });
             const fetchedResponse = fetched instanceof Response ? fetched : fetched.response;
@@ -298,6 +300,20 @@ function deriveWebsiteActivity(homepageStatus, hasFavicon, alreadyParked = false
         return 'active';
     return 'unreachable';
 }
+function registryPolicyDetail(domain, fast) {
+    const details = [];
+    const rdapAdmission = registryServiceAdmissionFor(domain, 'rdap');
+    if (rdapAdmission && !rdapAdmission.allowed) {
+        details.push('RDAP was not queried because the registry capability profile records no IANA-published RDAP service for this suffix.');
+    }
+    const whoisAdmission = fast ? null : registryServiceAdmissionFor(domain, 'whois');
+    if (whoisAdmission && !whoisAdmission.allowed) {
+        details.push(whoisAdmission.state === 'permission_required'
+            ? 'WHOIS was not queried because registry permission or source authorization is required.'
+            : 'WHOIS was not queried because IANA publishes no domain WHOIS service for this suffix.');
+    }
+    return details.length ? ` ${details.join(' ')}` : '';
+}
 // fast: true skips the WHOIS fallback (no TCP:43 chain) and the homepage
 // fetch (no for-sale/parking detection) - just RDAP plus the signals
 // derivable from it (age, expiry proximity, privacy). Meant for scanning
@@ -497,14 +513,15 @@ async function checkDomainAvailability(domain, options = {}) {
         const disabledDetail = disabledSources.length
             ? ` ${disabledSources.join(', ')} ${disabledSources.length === 1 ? 'is' : 'are'} disabled by deployment policy.`
             : '';
+        const policyDetail = registryPolicyDetail(domain, fast);
         return {
             state: 'unknown',
             confidence: 'low',
             detail: fast
-                ? `No enabled registration source produced a record or authoritative delegation. A fast scan cannot determine registration status.${disabledDetail}`
+                ? `No enabled registration source produced a record or authoritative delegation. A fast scan cannot determine registration status.${disabledDetail}${policyDetail}`
                 : whoisParsed && whoisParsed.failedHop
-                    ? `WHOIS was inconclusive - a referral hop did not answer conclusively (${whoisParsed.failedHop}).`
-                    : `No enabled registration source returned conclusive data or an authoritative DNS delegation.${disabledDetail}`,
+                    ? `WHOIS was inconclusive - a referral hop did not answer conclusively (${whoisParsed.failedHop}).${policyDetail}`
+                    : `No enabled registration source returned conclusive data or an authoritative DNS delegation.${disabledDetail}${policyDetail}`,
             ...(!fast && whoisEnabled ? { source: 'whois' } : {}),
         };
     }
@@ -601,6 +618,7 @@ async function checkDomainAvailability(domain, options = {}) {
         phishingLanguageMatch: null,
         hasExternalFormAction: null,
         externalAssetHosts: [],
+        cspMetaPolicy: null,
         pageIdentity: null,
         credentialSurfaceProfile: null,
         structuredDataIdentity: null,
@@ -640,9 +658,11 @@ async function checkDomainAvailability(domain, options = {}) {
             });
         }
     }
+    const responsePolicy = qualifyResponsePolicyWithCspMeta(homepage.responsePolicy, htmlSignals.cspMetaPolicy);
+    const { cspMetaPolicy: _cspMetaPolicy, ...retainedHtmlSignals } = htmlSignals;
     const securityPosture = options.includeSecurityPosture === false ? null : analyzeWebsiteSecurityPosture({
         http: homepage.http,
-        responsePolicy: homepage.responsePolicy,
+        responsePolicy,
         pageIdentity: htmlSignals.pageIdentity,
         tls: tlsIntelligence,
         dns: dnsIntelligence,
@@ -676,7 +696,7 @@ async function checkDomainAvailability(domain, options = {}) {
             deepScanComplete,
             faviconHash,
             faviconPHash,
-            ...htmlSignals,
+            ...retainedHtmlSignals,
             securityPosture,
             ...baseInfo,
             nameservers: nameservers.length ? nameservers : dnsIntelligence.records.ns,
@@ -700,7 +720,7 @@ async function checkDomainAvailability(domain, options = {}) {
         deepScanComplete,
         faviconHash,
         faviconPHash,
-        ...htmlSignals,
+        ...retainedHtmlSignals,
         securityPosture,
         ...baseInfo,
         nameservers: nameservers.length ? nameservers : dnsIntelligence.records.ns,

package/lib/bulk-limits.mjs

@@ -0,0 +1,13 @@
+// Shared collection ceilings for both the browser and local CLI. These limits
+// bound one analyst-triggered job; deployment rate and operation budgets remain
+// separate controls around the individual lookup requests.
+export const MAX_FAST_BULK_QUERIES = 500;
+export const MAX_DEEP_BULK_QUERIES = 50;
+export const MAX_FAST_BULK_CONCURRENCY = 8;
+export const MAX_DEEP_BULK_CONCURRENCY = 3;
+export function bulkQueryLimit(mode) {
+    return mode === 'deep' ? MAX_DEEP_BULK_QUERIES : MAX_FAST_BULK_QUERIES;
+}
+export function bulkConcurrencyLimit(mode) {
+    return mode === 'deep' ? MAX_DEEP_BULK_CONCURRENCY : MAX_FAST_BULK_CONCURRENCY;
+}

package/lib/csv.mjs

@@ -1,7 +1,7 @@
 // Shared bounded CSV serialization for browser and CLI exports. Values can
 // contain upstream evidence, so normalize controls and prevent spreadsheet
 // formula execution before applying ordinary CSV quoting.
-const CSV_FORMULA_TRIGGER_RE = /^(?:[\t\r\n ]*[=+\-@]|[\t\r\n])/u;
+const CSV_FORMULA_TRIGGER_RE = /^[=+\-@]/u;
 export const MAX_CSV_CELL_LENGTH = 32_768;
 function csvText(value) {
     const raw = Array.isArray(value)

package/lib/ct-response-bounds.mjs

@@ -0,0 +1,9 @@
+// Shared response-contract bounds for certificate-log search. The collector
+// and browser normalizer import these values so a valid backend response is
+// not accidentally clipped by a stale client-side mirror.
+export const MAX_CT_RESPONSE_RESULTS = 500;
+export const MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH = 50;
+export const MAX_CT_RESPONSE_TIMESTAMP_LENGTH = 64;
+export const MAX_CT_RESPONSE_CERTIFICATE_GROUPS = 100;
+export const MAX_CT_RESPONSE_DOMAINS_PER_GROUP = 20;
+export const MAX_CT_RESPONSE_HOSTNAMES_PER_GROUP = 30;

package/lib/ct-search.mjs

@@ -9,9 +9,11 @@
 import { parse } from 'tldts';
 import { normalizeCtQuery } from "./ct-query.mjs";
 import { safeFetch, readTextCapped } from "./safe-fetch.mjs";
+import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
 import { createObservation } from "./observation.mjs";
+import { MAX_CT_RESPONSE_CERTIFICATE_GROUPS, MAX_CT_RESPONSE_DOMAINS_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH, MAX_CT_RESPONSE_RESULTS, MAX_CT_RESPONSE_TIMESTAMP_LENGTH, } from "./ct-response-bounds.mjs";
 const CRT_SH_TIMEOUT_MS = 20000;
-const MAX_RESULTS = 500;
+const MAX_RESULTS = MAX_CT_RESPONSE_RESULTS;
 // crt.sh's response size scales with how many certificates ever matched the
 // keyword, not with MAX_RESULTS - a broad single-word keyword can have
 // millions of matching certificates, and unlike the domain-homepage fetch in
@@ -40,7 +42,10 @@ const MAX_TIMEOUT_RETRIES = 1;
 const MAX_CT_ROWS = 50_000;
 // Structured-match bounds.
 const MAX_MATCHES = MAX_RESULTS; // 500
-const MAX_HOSTNAMES_PER_MATCH = 50;
+const MAX_HOSTNAMES_PER_MATCH = MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH;
+const MAX_CERTIFICATE_GROUPS = MAX_CT_RESPONSE_CERTIFICATE_GROUPS;
+const MAX_DOMAINS_PER_CERTIFICATE_GROUP = MAX_CT_RESPONSE_DOMAINS_PER_GROUP;
+const MAX_HOSTNAMES_PER_CERTIFICATE_GROUP = MAX_CT_RESPONSE_HOSTNAMES_PER_GROUP;
 const HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
 // Maximum length for a digit-only certificate ID string before it is
 // rejected as overlong. Bounds decimal crt.sh record identifiers before
@@ -49,7 +54,7 @@ const MAX_ID_DIGITS = 32;
 // Maximum length for a serial_number string before it is rejected.
 const MAX_SERIAL_LENGTH = 128;
 // Maximum length for an entry_timestamp string before it is rejected.
-const MAX_TIMESTAMP_LENGTH = 64;
+const MAX_TIMESTAMP_LENGTH = MAX_CT_RESPONSE_TIMESTAMP_LENGTH;
 function normalizeHostname(raw) {
     let h = raw.trim().toLowerCase();
     if (h.startsWith('*.'))
@@ -68,7 +73,7 @@ async function fetchCrtSh(keyword, attempt = 0, dependencies = {}) {
         let res;
         try {
             res = await fetcher(`https://crt.sh/?q=${encodeURIComponent(keyword)}&output=json`, {
-                headers: { Accept: 'application/json', 'User-Agent': 'Mozilla/5.0 (compatible; DomainStatusChecker/1.0)' },
+                headers: whoisleuthRequestHeaders({ Accept: 'application/json' }),
                 signal: controller.signal,
             });
         }
@@ -249,6 +254,7 @@ function validateEntryTimestamp(value) {
  *     lastObservedAt: string | null,
  *     certificateCount: number
  *   }>,
+ *   certificateGroups: CtCertificateGroup[],
  *   truncated: boolean
  * }}
  */
@@ -268,14 +274,31 @@ function summarizeCtResults(rows) {
     // Map<registrableDomain, { hostnames: Set, certIds: Set,
     // firstObservedAt: string|null, lastObservedAt: string|null }>
     const groupMap = new Map();
+    const certificateMap = new Map();
     for (let i = 0; i < rows.length; i++) {
         const row = rows[i];
         if (!row || typeof row !== 'object')
             continue;
         const certId = resolveCertId(row, i);
         // Collect hostnames from name_value and common_name.
-        const blob = `${row.name_value || ''}\n${row.common_name || ''}`;
+        const rawBlob = `${row.name_value || ''}\n${row.common_name || ''}`;
+        const blob = rawBlob;
         const ts = validateEntryTimestamp(row.entry_timestamp);
+        let certificate = certificateMap.get(certId);
+        if (!certificate) {
+            certificate = {
+                domains: new Set(),
+                hostnames: new Set(),
+                observedAt: ts,
+                wildcardObserved: false,
+            };
+            certificateMap.set(certId, certificate);
+        }
+        else if (ts !== null && (certificate.observedAt === null || ts > certificate.observedAt)) {
+            certificate.observedAt = ts;
+        }
+        if (rawBlob.split('\n').some((line) => line.trim().startsWith('*.')))
+            certificate.wildcardObserved = true;
         for (const line of blob.split('\n')) {
             const host = normalizeHostname(line);
             if (!host)
@@ -293,6 +316,8 @@ function summarizeCtResults(rows) {
             }
             if (!regDomain)
                 continue;
+            certificate.hostnames.add(host);
+            certificate.domains.add(regDomain);
             let group = groupMap.get(regDomain);
             if (!group) {
                 group = {
@@ -348,11 +373,37 @@ function summarizeCtResults(rows) {
         }
         return a.domain.localeCompare(b.domain);
     });
+    const certificateGroups = [...certificateMap.entries()]
+        .map(([certificateKey, group]) => ({
+        certificateKey: certificateKey.slice(0, 180),
+        domains: [...group.domains].sort().slice(0, MAX_DOMAINS_PER_CERTIFICATE_GROUP),
+        hostnames: [...group.hostnames].sort().slice(0, MAX_HOSTNAMES_PER_CERTIFICATE_GROUP),
+        observedAt: group.observedAt,
+        wildcardObserved: group.wildcardObserved,
+        domainCount: group.domains.size,
+        hostnameCount: group.hostnames.size,
+    }))
+        .filter((group) => group.domains.length > 0)
+        .sort((left, right) => (right.domainCount - left.domainCount
+        || right.hostnameCount - left.hostnameCount
+        || (right.observedAt ?? '').localeCompare(left.observedAt ?? '')
+        || left.certificateKey.localeCompare(right.certificateKey)));
+    const certificateGroupsTruncated = certificateGroups.length > MAX_CERTIFICATE_GROUPS
+        || certificateGroups.some((group) => (group.domainCount > MAX_DOMAINS_PER_CERTIFICATE_GROUP
+            || group.hostnameCount > MAX_HOSTNAMES_PER_CERTIFICATE_GROUP));
     const matchTruncated = matches.length > MAX_MATCHES;
     const perMatchTruncated = matches.some((m) => (groupMap.get(m.domain)?.hostnames.size || 0) > MAX_HOSTNAMES_PER_MATCH);
     return {
         domains: sortedLegacy.slice(0, MAX_RESULTS),
         matches: matches.slice(0, MAX_MATCHES),
+        certificateGroups: certificateGroups.slice(0, MAX_CERTIFICATE_GROUPS).map((group) => ({
+            certificateKey: group.certificateKey,
+            domains: group.domains,
+            hostnames: group.hostnames,
+            observedAt: group.observedAt,
+            wildcardObserved: group.wildcardObserved,
+        })),
+        certificateGroupsTruncated,
         truncated: legacyTruncated || matchTruncated || perMatchTruncated,
     };
 }
@@ -364,12 +415,12 @@ async function searchCertificateTransparency(keyword, dependencies = {}) {
     const trimmed = normalizeCtQuery(keyword);
     if (!trimmed) {
         return {
-            domains: [], certCount: 0, truncated: false, matches: [],
+            domains: [], certCount: 0, truncated: false, matches: [], certificateGroups: [], certificateGroupsTruncated: false,
             observation: createObservation({
                 status: 'success', observedAt: new Date().toISOString(), source: 'certificate_transparency',
                 durationMs: Date.now() - startedAt, complete: true, truncated: false,
                 limitations: ['Certificate Transparency observations indicate public certificate logging, not current site activity or maliciousness.'],
-                diagnostics: { certificateRows: 0, matches: 0 },
+                diagnostics: { certificateRows: 0, matches: 0, certificateGroups: 0 },
             }),
         };
     }
@@ -379,14 +430,17 @@ async function searchCertificateTransparency(keyword, dependencies = {}) {
         certCount: data.length,
         ...summary,
         observation: createObservation({
-            status: summary.truncated ? 'partial' : 'success',
+            status: summary.truncated || summary.certificateGroupsTruncated ? 'partial' : 'success',
             observedAt: new Date().toISOString(),
             source: 'certificate_transparency',
             durationMs: Date.now() - startedAt,
-            complete: !summary.truncated,
-            truncated: summary.truncated,
-            limitations: ['Certificate Transparency observations indicate public certificate logging, not current site activity or maliciousness.'],
-            diagnostics: { certificateRows: data.length, matches: summary.matches.length },
+            complete: !summary.truncated && !summary.certificateGroupsTruncated,
+            truncated: summary.truncated || summary.certificateGroupsTruncated,
+            limitations: [
+                'Certificate Transparency observations indicate public certificate logging, not current site activity or maliciousness.',
+                ...(summary.certificateGroupsTruncated ? ['The optional certificate-group projection was capped independently of the registrable-domain result set.'] : []),
+            ],
+            diagnostics: { certificateRows: data.length, matches: summary.matches.length, certificateGroups: summary.certificateGroups.length, certificateGroupsTruncated: summary.certificateGroupsTruncated },
         }),
     };
 }

package/lib/dns-delegation-health.mjs

@@ -13,6 +13,7 @@ const MAX_NAMESERVERS = 16;
 const MAX_ERROR_LENGTH = 180;
 const DNS_DELEGATION_TIMEOUT_MS = 2200;
 const LAME_CODES = new Set(['ENOTAUTH', 'EREFUSED']);
+const MAX_SOA_VALUE = 0xffff_ffff;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -57,6 +58,27 @@ function errorDetail(error) {
         .trim()
         .slice(0, MAX_ERROR_LENGTH) || 'DNS query failed';
 }
+function soaProjection(value) {
+    const source = record(value);
+    const nsname = hostname(source.nsname);
+    const hostmaster = hostname(source.hostmaster);
+    const number = (field) => (typeof field === 'number'
+        && Number.isSafeInteger(field)
+        && field >= 0
+        && field <= MAX_SOA_VALUE
+        ? field
+        : null);
+    const projection = {
+        nsname,
+        hostmaster,
+        serial: number(source.serial),
+        refresh: number(source.refresh),
+        retry: number(source.retry),
+        expire: number(source.expire),
+        minttl: number(source.minttl),
+    };
+    return Object.values(projection).every((field) => field === null) ? null : projection;
+}
 function withTimeout(promise, timeoutMs) {
     return new Promise((resolve, reject) => {
         const timer = setTimeout(() => reject(Object.assign(new Error('DNS query timed out'), { code: 'ETIMEOUT' })), timeoutMs);
@@ -85,16 +107,20 @@ async function defaultAuthorityQuery(input) {
             ? soa.reason
             : null;
     if (reason !== null) {
+        const soaValue = soa.status === 'fulfilled' ? soaProjection(soa.value) : null;
         return {
             nameservers: nameservers.status === 'fulfilled' ? nameservers.value : [],
-            soaPrimary: soa.status === 'fulfilled' ? soa.value.nsname : null,
+            soaPrimary: soaValue?.nsname ?? null,
+            soa: soaValue,
             errorCode: errorCode(reason),
             error: errorDetail(reason),
         };
     }
+    const soaValue = soa.status === 'fulfilled' ? soaProjection(soa.value) : null;
     return {
         nameservers: nameservers.status === 'fulfilled' ? nameservers.value : [],
-        soaPrimary: soa.status === 'fulfilled' ? soa.value.nsname : null,
+        soaPrimary: soaValue?.nsname ?? null,
+        soa: soaValue,
         errorCode: null,
         error: null,
     };
@@ -201,8 +227,10 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 const code = boundedText(query.errorCode, 40);
                 const error = boundedText(query.error, MAX_ERROR_LENGTH);
                 const nameservers = hostnames(query.nameservers);
-                const soaPrimary = hostname(query.soaPrimary);
-                const hasAnswer = nameservers.length > 0 || soaPrimary !== null;
+                const soa = soaProjection(query.soa)
+                    ?? soaProjection({ nsname: query.soaPrimary });
+                const soaPrimary = soa?.nsname ?? hostname(query.soaPrimary);
+                const hasAnswer = nameservers.length > 0 || soaPrimary !== null || soa !== null;
                 const state = error && hasAnswer
                     ? 'partial'
                     : code && LAME_CODES.has(code)
@@ -210,7 +238,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                         : error || !hasAnswer
                             ? 'unreachable'
                             : 'success';
-                return { address, state, nameservers, soaPrimary, errorCode: code, error };
+                return { address, state, nameservers, soaPrimary, soa, errorCode: code, error };
             }
             catch (error) {
                 const code = errorCode(error);
@@ -219,6 +247,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                     state: LAME_CODES.has(code) ? 'lame' : 'unreachable',
                     nameservers: [],
                     soaPrimary: null,
+                    soa: null,
                     errorCode: code || null,
                     error: errorDetail(error),
                 };
@@ -240,6 +269,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                         : 'unreachable',
             nameservers: retained?.nameservers ?? [],
             soaPrimary: retained?.soaPrimary ?? null,
+            soa: retained?.soa ?? null,
             attempts,
         };
     }));
@@ -250,6 +280,18 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
     const authoritySets = successfulAuthorities.map((authority) => authority.nameservers);
     const inconsistentAuthoritySets = authoritySets.some((set) => (!sameSet(set, authoritySets[0] ?? [])
         || (parentNameservers.length > 0 && !sameSet(set, parentNameservers))));
+    const retainedSoa = authorities
+        .filter((authority) => authority.state === 'success' || authority.state === 'partial')
+        .map((authority) => ({ nameserver: authority.nameserver, soa: authority.soa }))
+        .filter((entry) => entry.soa !== null);
+    const soaSerials = [...new Set(retainedSoa
+            .map((entry) => entry.soa.serial)
+            .filter((serial) => serial !== null))];
+    const soaPrimaries = [...new Set(retainedSoa
+            .map((entry) => entry.soa.nsname)
+            .filter((primary) => primary !== null))];
+    const soaSerialConflict = soaSerials.length > 1;
+    const soaPrimaryConflict = soaPrimaries.length > 1;
     const inBailiwick = candidates.filter((nameserver) => (nameserver === domain || nameserver.endsWith(`.${domain}`)));
     const missingGlue = inBailiwick.filter((nameserver) => (!(registry.nameserverDetails.find((item) => item.name === nameserver)?.addresses.length)));
     const dnssecMismatch = (registry.delegationSigned === true && registry.dsRecordCount === 0) || (registry.delegationSigned === false && registry.dsRecordCount > 0);
@@ -278,6 +320,15 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             : inconsistentAuthoritySets
                 ? 'Direct nameserver answers are inconsistent'
                 : 'Direct nameserver answers agree with the observed parent view', successfulAuthorities.map((authority) => `${authority.nameserver}: ${authority.nameservers.join(', ') || 'no NS answer'}`).join(' | ') || 'No direct answers.', 'Align the NS set served by every authority with the intended parent delegation before cutover.'),
+        finding('authority_soa_consistency', 'Authoritative SOA consistency', retainedSoa.length < 2 || soaSerials.length < 1 || soaPrimaries.length < 1
+            ? 'unknown'
+            : soaSerialConflict || soaPrimaryConflict ? 'warning' : 'healthy', retainedSoa.length < 2
+            ? 'Fewer than two authority SOA observations were available'
+            : soaSerialConflict
+                ? 'Authoritative servers published different SOA serials'
+                : soaPrimaryConflict
+                    ? 'Authoritative servers published different SOA primary nameservers'
+                    : 'Observed authority SOA serials and primary nameservers agree', retainedSoa.map((entry) => (`${entry.nameserver}: serial ${entry.soa.serial ?? 'unavailable'}, primary ${entry.soa.nsname ?? 'unavailable'}, refresh ${entry.soa.refresh ?? 'unavailable'}, retry ${entry.soa.retry ?? 'unavailable'}, expire ${entry.soa.expire ?? 'unavailable'}`)).join(' | ') || 'No complete SOA observation was available.', 'Confirm zone propagation and the intended SOA primary before relying on a DNS change or secondary-server state.'),
         finding('in_bailiwick_glue', 'In-bailiwick glue', !inBailiwick.length ? 'healthy' : missingGlue.length ? 'warning' : 'healthy', !inBailiwick.length
             ? 'No in-bailiwick nameserver requires registry glue'
             : missingGlue.length