@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/lib/cryptographic-assurance.mjs

@@ -0,0 +1,173 @@
+import { validateDnssecEvidence } from "./dnssec-evidence-validation.mjs";
+import { reviewRpkiRoute } from "./rpki-evidence.mjs";
+import { analyzeTlsaEvidence } from "./tlsa-evidence.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
+const CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA = 'whoisleuth.cryptographic-assurance.input';
+const CRYPTOGRAPHIC_ASSURANCE_SCHEMA = 'whoisleuth.cryptographic-assurance.review';
+const CRYPTOGRAPHIC_ASSURANCE_INPUT_VERSION = 1;
+const CRYPTOGRAPHIC_ASSURANCE_REVIEW_VERSION = 2;
+function exactRecord(value, keys, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new TypeError(`${label} must be one object.`);
+    const record = value;
+    const unexpected = Object.keys(record).find((key) => !keys.has(key));
+    if (unexpected)
+        throw new TypeError(`${label} contains unsupported field "${unexpected}".`);
+    return record;
+}
+function sourceLabel(value, label) {
+    if (typeof value !== 'string')
+        throw new TypeError(`${label}.source must be text.`);
+    const normalized = value.replace(/[\u0000-\u001f\u007f]+/gu, ' ').replace(/\s+/gu, ' ').trim();
+    if (!normalized || normalized.length > 160)
+        throw new TypeError(`${label}.source must contain from 1 to 160 characters.`);
+    return normalized;
+}
+function observationTime(value, label) {
+    const normalized = normalizeExplicitIsoTimestamp(value);
+    if (!normalized) {
+        throw new TypeError(`${label}.observedAt must be one ISO-compatible timestamp.`);
+    }
+    return normalized;
+}
+function suppliedEvidence(value, label) {
+    if (value === null || value === undefined)
+        return null;
+    const wrapper = exactRecord(value, new Set(['source', 'observedAt', 'evidence']), label);
+    if (!wrapper.evidence || typeof wrapper.evidence !== 'object' || Array.isArray(wrapper.evidence)) {
+        throw new TypeError(`${label}.evidence must be one object.`);
+    }
+    return {
+        source: sourceLabel(wrapper.source, label),
+        observedAt: observationTime(wrapper.observedAt, label),
+        evidence: wrapper.evidence,
+    };
+}
+function unavailableCard(family, label, authority) {
+    return Object.freeze({
+        family,
+        label,
+        authority,
+        source: null,
+        observedAt: null,
+        state: 'unavailable',
+        completeness: 'unavailable',
+        result: null,
+        limitations: Object.freeze([`No ${label.toLowerCase()} evidence was supplied. No state was inferred from another assurance family.`]),
+    });
+}
+function dnssecCompleteness(report) {
+    return report.state === 'consistent' || report.state === 'conflict' || report.state === 'unsigned'
+        ? 'complete'
+        : report.state === 'invalid' ? 'unavailable' : 'partial';
+}
+function rpkiCompleteness(report) {
+    return report.state === 'invalid_input' ? 'unavailable' : 'partial';
+}
+function rpkiCardState(report) {
+    if (report.state === 'valid')
+        return 'matches_supplied_rows';
+    if (report.state === 'invalid')
+        return 'differs_from_supplied_rows';
+    if (report.state === 'not_found')
+        return 'not_found_in_supplied_rows';
+    return report.state;
+}
+function tlsaCompleteness(report) {
+    const comparisonMaterialComplete = !report.truncated
+        && report.rejectedCount === 0
+        && !report.authorityMaterialTruncated
+        && report.authorityMaterialRejectedCount === 0
+        && report.records.every((record) => record.state !== 'unavailable');
+    return comparisonMaterialComplete
+        && (report.state === 'matched' || report.state === 'different' || report.state === 'untrusted')
+        ? 'complete'
+        : report.state === 'invalid' || report.state === 'unavailable' ? 'unavailable' : 'partial';
+}
+function buildCryptographicAssuranceReview(inputValue, generatedAt = new Date().toISOString()) {
+    const input = exactRecord(inputValue, new Set(['schema', 'version', 'dnssec', 'routeOrigin', 'tlsa']), 'Cryptographic assurance input');
+    if (input.schema !== CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA || input.version !== CRYPTOGRAPHIC_ASSURANCE_INPUT_VERSION) {
+        throw new TypeError(`Cryptographic assurance input must use ${CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA} version ${CRYPTOGRAPHIC_ASSURANCE_INPUT_VERSION}.`);
+    }
+    const dnssecInput = suppliedEvidence(input.dnssec, 'dnssec');
+    const routeInput = suppliedEvidence(input.routeOrigin, 'routeOrigin');
+    const tlsaInput = suppliedEvidence(input.tlsa, 'tlsa');
+    if (!dnssecInput && !routeInput && !tlsaInput)
+        throw new TypeError('Cryptographic assurance input must supply at least one evidence family.');
+    const dnssec = dnssecInput ? validateDnssecEvidence({
+        ownerName: dnssecInput.evidence.ownerName,
+        delegationSigned: dnssecInput.evidence.delegationSigned,
+        dsRecords: dnssecInput.evidence.dsRecords,
+        dnskeyRecords: dnssecInput.evidence.dnskeyRecords,
+        rrSigRecords: dnssecInput.evidence.rrSigRecords,
+        observedAt: dnssecInput.evidence.observedAt ?? dnssecInput.observedAt,
+    }) : null;
+    const routeOrigin = routeInput ? reviewRpkiRoute({
+        routePrefix: routeInput.evidence.routePrefix,
+        originAsn: routeInput.evidence.originAsn,
+        authorizations: routeInput.evidence.authorizations,
+    }) : null;
+    const tlsa = tlsaInput ? analyzeTlsaEvidence({
+        serviceName: tlsaInput.evidence.serviceName,
+        dnssecState: 'unavailable',
+        pkixValidationState: 'unavailable',
+        records: tlsaInput.evidence.records,
+        certificateDerBase64: tlsaInput.evidence.certificateDerBase64,
+        spkiDerBase64: tlsaInput.evidence.spkiDerBase64,
+        authorityMaterials: tlsaInput.evidence.authorityMaterials,
+    }) : null;
+    const cards = [
+        dnssec && dnssecInput ? Object.freeze({
+            family: 'dnssec_validation',
+            label: 'DNSSEC evidence review',
+            authority: 'Supplied delegation, DS, DNSKEY, and signature-time evidence',
+            source: dnssecInput.source,
+            observedAt: dnssecInput.observedAt,
+            state: dnssec.state,
+            completeness: dnssecCompleteness(dnssec),
+            result: dnssec,
+            limitations: dnssec.limitations,
+        }) : unavailableCard('dnssec_validation', 'DNSSEC evidence review', 'Supplied delegation, DS, DNSKEY, and signature-time evidence'),
+        routeOrigin && routeInput ? Object.freeze({
+            family: 'route_origin_authorisation',
+            label: 'Route-origin authorisation',
+            authority: 'Analyst-supplied route-origin rows',
+            source: routeInput.source,
+            observedAt: routeInput.observedAt,
+            state: rpkiCardState(routeOrigin),
+            completeness: rpkiCompleteness(routeOrigin),
+            result: routeOrigin,
+            limitations: Object.freeze([
+                ...routeOrigin.limitations,
+                'The supplied rows do not include bounded validator provenance, implementation identity, validation time, or a complete authenticated snapshot, so this card reports only their local comparison and remains partial.',
+            ]),
+        }) : unavailableCard('route_origin_authorisation', 'Route-origin authorisation', 'Analyst-supplied route-origin rows'),
+        tlsa && tlsaInput ? Object.freeze({
+            family: 'dane_tlsa',
+            label: 'DANE and TLSA evidence review',
+            authority: 'Supplied TLSA and certificate association material',
+            source: tlsaInput.source,
+            observedAt: tlsaInput.observedAt,
+            state: tlsa.state,
+            completeness: tlsaCompleteness(tlsa),
+            result: tlsa,
+            limitations: Object.freeze([
+                ...tlsa.limitations,
+                'Caller-provided DNSSEC and PKIX state labels are not accepted as validator evidence. Positive DANE state requires separately validated prerequisite artefacts from an explicit collector.',
+            ]),
+        }) : unavailableCard('dane_tlsa', 'DANE and TLSA evidence review', 'Supplied TLSA and certificate association material'),
+    ];
+    return Object.freeze({
+        schema: CRYPTOGRAPHIC_ASSURANCE_SCHEMA,
+        version: CRYPTOGRAPHIC_ASSURANCE_REVIEW_VERSION,
+        generatedAt: observationTime(generatedAt, 'generatedAt'),
+        cards: Object.freeze(cards),
+        combinedState: null,
+        limitations: Object.freeze([
+            'DNSSEC, route-origin authorisation, and DANE or TLSA remain independently sourced evidence families with separate states, observation times, completeness, and limitations.',
+            'No scalar score or combined verdict is produced. A missing, failed, partial, or unsupported family is never inferred from another family.',
+            'These reviews do not establish ownership, availability, activity, safety, or maliciousness.',
+        ]),
+    });
+}
+export { CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA, CRYPTOGRAPHIC_ASSURANCE_INPUT_VERSION, CRYPTOGRAPHIC_ASSURANCE_REVIEW_VERSION, CRYPTOGRAPHIC_ASSURANCE_SCHEMA, buildCryptographicAssuranceReview, };

package/lib/ct-query.mjs

@@ -1,7 +1,7 @@
 const MAX_CT_QUERY_LENGTH = 200;
 const CT_QUERY_ERROR_CODE = 'INVALID_CT_QUERY';
-const CT_QUERY_ERROR_MESSAGE = `Certificate Transparency query must be at most ${MAX_CT_QUERY_LENGTH} characters and contain no control characters.`;
-const CONTROL_CHARACTER_RE = /[\u0000-\u001f\u007f]/u;
+const CT_QUERY_ERROR_MESSAGE = `Certificate Transparency query must be at most ${MAX_CT_QUERY_LENGTH} characters and contain no control or invisible formatting characters.`;
+const UNSAFE_QUERY_CHARACTER_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/u;
 class CtQueryError extends Error {
     code = CT_QUERY_ERROR_CODE;
     constructor() {
@@ -14,7 +14,7 @@ function normalizeCtQuery(value) {
         return '';
     if (typeof value !== 'string'
         || value.length > MAX_CT_QUERY_LENGTH
-        || CONTROL_CHARACTER_RE.test(value)) {
+        || UNSAFE_QUERY_CHARACTER_RE.test(value)) {
         throw new CtQueryError();
     }
     return value.trim();

package/lib/ct-search.mjs

@@ -10,7 +10,9 @@ import { parse } from 'tldts';
 import { normalizeCtQuery } from "./ct-query.mjs";
 import { safeFetch, readTextCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
+import { isValidAsciiHostname } from "./hostname.mjs";
+import { normalizeCtTimestamp } from "../packages/evidence/observation.mjs";
 import { MAX_CT_RESPONSE_CERTIFICATE_GROUPS, MAX_CT_RESPONSE_DOMAINS_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH, MAX_CT_RESPONSE_RESULTS, MAX_CT_RESPONSE_TIMESTAMP_LENGTH, } from "./ct-response-bounds.mjs";
 const CRT_SH_TIMEOUT_MS = 20000;
 const MAX_RESULTS = MAX_CT_RESPONSE_RESULTS;
@@ -40,6 +42,12 @@ const MAX_TIMEOUT_RETRIES = 1;
 // iteration/set overhead after parsing. Legitimate responses under the byte
 // cap stay well within this limit.
 const MAX_CT_ROWS = 50_000;
+// crt.sh joins SAN values with newlines. Bound the amount of per-row and
+// whole-response hostname work independently of the JSON byte and row caps so
+// a small number of newline-dense strings cannot drive unbounded PSL parsing,
+// Set growth, or sorting before the result projection is truncated.
+const MAX_CT_NAMES_PER_ROW = 1_000;
+const MAX_CT_NAMES_EXAMINED = 100_000;
 // Structured-match bounds.
 const MAX_MATCHES = MAX_RESULTS; // 500
 const MAX_HOSTNAMES_PER_MATCH = MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH;
@@ -56,10 +64,12 @@ const MAX_SERIAL_LENGTH = 128;
 // Maximum length for an entry_timestamp string before it is rejected.
 const MAX_TIMESTAMP_LENGTH = MAX_CT_RESPONSE_TIMESTAMP_LENGTH;
 function normalizeHostname(raw) {
+    if (raw.length > 255)
+        return null;
     let h = raw.trim().toLowerCase();
     if (h.startsWith('*.'))
         h = h.slice(2);
-    return HOSTNAME_RE.test(h) ? h : null;
+    return HOSTNAME_RE.test(h) && isValidAsciiHostname(h, { requireLowercase: true }) ? h : null;
 }
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
@@ -75,7 +85,7 @@ async function fetchCrtSh(keyword, attempt = 0, dependencies = {}) {
             res = await fetcher(`https://crt.sh/?q=${encodeURIComponent(keyword)}&output=json`, {
                 headers: whoisleuthRequestHeaders({ Accept: 'application/json' }),
                 signal: controller.signal,
-            });
+            }, 0);
         }
         catch (err) {
             if (!(err instanceof Error) || err.name !== 'AbortError')
@@ -98,7 +108,7 @@ async function fetchCrtSh(keyword, attempt = 0, dependencies = {}) {
                 ? `crt.sh is temporarily overloaded (${res.status} after ${attempt + 1} attempts) - it's a free public service that intermittently struggles under load; try again in a moment.`
                 : `crt.sh returned ${res.status}`);
         }
-        const { text, truncated } = await readTextCapped(res, CRT_SH_MAX_BYTES);
+        const { text, truncated } = await readTextCapped(res, CRT_SH_MAX_BYTES, { fatalUtf8: true });
         if (truncated) {
             throw new Error(`crt.sh returned more than ${CRT_SH_MAX_BYTES / (1024 * 1024)}MB of results for "${keyword}" - try a narrower/more specific keyword.`);
         }
@@ -146,6 +156,16 @@ function resolveCertId(row, index) {
     }
     return `row:${index}`;
 }
+function suppliedCertificateIdentityMalformed(row) {
+    const hasId = Object.hasOwn(row, 'id') && row.id !== null && row.id !== undefined;
+    if (hasId)
+        return canonicalCertId(row.id) === null;
+    const hasIssuer = Object.hasOwn(row, 'issuer_ca_id') && row.issuer_ca_id !== null && row.issuer_ca_id !== undefined;
+    const hasSerial = Object.hasOwn(row, 'serial_number') && row.serial_number !== null && row.serial_number !== undefined;
+    return hasIssuer || hasSerial
+        ? canonicalCertId(row.issuer_ca_id) === null || normalizeSerial(row.serial_number) === null
+        : false;
+}
 /**
  * Canonicalises a crt.sh certificate ID field for use in identity comparison.
  * Accepts only safe positive integers or digit-only strings that can be
@@ -221,20 +241,9 @@ function normalizeSerial(value) {
  * @returns {string | null}
  */
 function validateEntryTimestamp(value) {
-    if (typeof value !== 'string')
-        return null;
-    if (value.length === 0 || value.length > MAX_TIMESTAMP_LENGTH)
-        return null;
-    // Reject control characters and overlong strings before any parsing.
-    if (/[\x00-\x1f\x7f]/.test(value))
-        return null;
-    const trimmed = value.trim();
-    if (trimmed.length === 0)
-        return null;
-    const parsed = new Date(trimmed);
-    if (Number.isNaN(parsed.getTime()))
-        return null;
-    return parsed.toISOString();
+    return typeof value === 'string' && value.length <= MAX_TIMESTAMP_LENGTH
+        ? normalizeCtTimestamp(value)
+        : null;
 }
 // ---------------------------------------------------------------------------
 // Pure summarizer
@@ -255,6 +264,8 @@ function validateEntryTimestamp(value) {
  *     certificateCount: number
  *   }>,
  *   certificateGroups: CtCertificateGroup[],
+ *   namesExamined: number,
+ *   workTruncated: boolean,
  *   truncated: boolean
  * }}
  */
@@ -275,14 +286,34 @@ function summarizeCtResults(rows) {
     // firstObservedAt: string|null, lastObservedAt: string|null }>
     const groupMap = new Map();
     const certificateMap = new Map();
-    for (let i = 0; i < rows.length; i++) {
+    let namesExamined = 0;
+    let workTruncated = false;
+    let rejectedRows = 0;
+    rowLoop: for (let i = 0; i < rows.length; i++) {
         const row = rows[i];
-        if (!row || typeof row !== 'object')
+        if (!row || typeof row !== 'object' || Array.isArray(row)) {
+            rejectedRows += 1;
             continue;
+        }
+        const missingNameFields = ![row.name_value, row.common_name]
+            .some((value) => typeof value === 'string'
+            && /[^\p{White_Space}\p{Default_Ignorable_Code_Point}\u0000-\u001f\u007f-\u009f]/u.test(value));
+        const malformedNameField = ['name_value', 'common_name'].some((field) => (Object.hasOwn(row, field) && typeof row[field] !== 'string'));
+        const malformedTimestamp = Object.hasOwn(row, 'entry_timestamp')
+            && row.entry_timestamp !== null
+            && row.entry_timestamp !== undefined
+            && validateEntryTimestamp(row.entry_timestamp) === null;
+        if (missingNameFields || malformedNameField || malformedTimestamp || suppliedCertificateIdentityMalformed(row)) {
+            rejectedRows += 1;
+        }
         const certId = resolveCertId(row, i);
-        // Collect hostnames from name_value and common_name.
-        const rawBlob = `${row.name_value || ''}\n${row.common_name || ''}`;
-        const blob = rawBlob;
+        // Collect only direct string fields. Implicitly stringifying a nested
+        // array or object would traverse attacker-controlled structure before any
+        // hostname bound could take effect.
+        const nameFields = [
+            typeof row.name_value === 'string' ? row.name_value : '',
+            typeof row.common_name === 'string' ? row.common_name : '',
+        ];
         const ts = validateEntryTimestamp(row.entry_timestamp);
         let certificate = certificateMap.get(certId);
         if (!certificate) {
@@ -297,46 +328,65 @@ function summarizeCtResults(rows) {
         else if (ts !== null && (certificate.observedAt === null || ts > certificate.observedAt)) {
             certificate.observedAt = ts;
         }
-        if (rawBlob.split('\n').some((line) => line.trim().startsWith('*.')))
-            certificate.wildcardObserved = true;
-        for (const line of blob.split('\n')) {
-            const host = normalizeHostname(line);
-            if (!host)
-                continue;
-            // Legacy: always add if valid hostname.
-            legacyDomains.add(host);
-            // Structured: resolve registrable domain.
-            let regDomain;
-            if (registrableDomainByHostname.has(host)) {
-                regDomain = registrableDomainByHostname.get(host);
-            }
-            else {
-                regDomain = parse(host).domain || null;
-                registrableDomainByHostname.set(host, regDomain);
-            }
-            if (!regDomain)
-                continue;
-            certificate.hostnames.add(host);
-            certificate.domains.add(regDomain);
-            let group = groupMap.get(regDomain);
-            if (!group) {
-                group = {
-                    hostnames: new Set(),
-                    certIds: new Set(),
-                    firstObservedAt: null,
-                    lastObservedAt: null,
-                };
-                groupMap.set(regDomain, group);
-            }
-            group.hostnames.add(host);
-            group.certIds.add(certId);
-            if (ts !== null) {
-                if (group.firstObservedAt === null || ts < group.firstObservedAt) {
-                    group.firstObservedAt = ts;
+        let rowNamesExamined = 0;
+        for (const field of nameFields) {
+            let offset = 0;
+            while (offset <= field.length) {
+                if (namesExamined >= MAX_CT_NAMES_EXAMINED) {
+                    workTruncated = true;
+                    break rowLoop;
+                }
+                if (rowNamesExamined >= MAX_CT_NAMES_PER_ROW) {
+                    workTruncated = true;
+                    continue rowLoop;
                 }
-                if (group.lastObservedAt === null || ts > group.lastObservedAt) {
-                    group.lastObservedAt = ts;
+                const newline = field.indexOf('\n', offset);
+                const line = newline === -1 ? field.slice(offset) : field.slice(offset, newline);
+                namesExamined += 1;
+                rowNamesExamined += 1;
+                if (line.trim().startsWith('*.'))
+                    certificate.wildcardObserved = true;
+                const host = normalizeHostname(line);
+                if (host) {
+                    // Legacy: always add if valid hostname.
+                    legacyDomains.add(host);
+                    // Structured: resolve registrable domain.
+                    let regDomain;
+                    if (registrableDomainByHostname.has(host)) {
+                        regDomain = registrableDomainByHostname.get(host);
+                    }
+                    else {
+                        regDomain = parse(host).domain || null;
+                        registrableDomainByHostname.set(host, regDomain);
+                    }
+                    if (regDomain) {
+                        certificate.hostnames.add(host);
+                        certificate.domains.add(regDomain);
+                        let group = groupMap.get(regDomain);
+                        if (!group) {
+                            group = {
+                                hostnames: new Set(),
+                                certIds: new Set(),
+                                firstObservedAt: null,
+                                lastObservedAt: null,
+                            };
+                            groupMap.set(regDomain, group);
+                        }
+                        group.hostnames.add(host);
+                        group.certIds.add(certId);
+                        if (ts !== null) {
+                            if (group.firstObservedAt === null || ts < group.firstObservedAt) {
+                                group.firstObservedAt = ts;
+                            }
+                            if (group.lastObservedAt === null || ts > group.lastObservedAt) {
+                                group.lastObservedAt = ts;
+                            }
+                        }
+                    }
                 }
+                if (newline === -1)
+                    break;
+                offset = newline + 1;
             }
         }
     }
@@ -404,7 +454,10 @@ function summarizeCtResults(rows) {
             wildcardObserved: group.wildcardObserved,
         })),
         certificateGroupsTruncated,
-        truncated: legacyTruncated || matchTruncated || perMatchTruncated,
+        namesExamined,
+        workTruncated,
+        rejectedRows,
+        truncated: rejectedRows > 0 || workTruncated || legacyTruncated || matchTruncated || perMatchTruncated,
     };
 }
 // ---------------------------------------------------------------------------
@@ -416,11 +469,12 @@ async function searchCertificateTransparency(keyword, dependencies = {}) {
     if (!trimmed) {
         return {
             domains: [], certCount: 0, truncated: false, matches: [], certificateGroups: [], certificateGroupsTruncated: false,
+            namesExamined: 0, workTruncated: false, rejectedRows: 0,
             observation: createObservation({
                 status: 'success', observedAt: new Date().toISOString(), source: 'certificate_transparency',
                 durationMs: Date.now() - startedAt, complete: true, truncated: false,
                 limitations: ['Certificate Transparency observations indicate public certificate logging, not current site activity or maliciousness.'],
-                diagnostics: { certificateRows: 0, matches: 0, certificateGroups: 0 },
+                diagnostics: { certificateRows: 0, rejectedRows: 0, namesExamined: 0, workTruncated: false, matches: 0, certificateGroups: 0 },
             }),
         };
     }
@@ -438,9 +492,11 @@ async function searchCertificateTransparency(keyword, dependencies = {}) {
             truncated: summary.truncated || summary.certificateGroupsTruncated,
             limitations: [
                 'Certificate Transparency observations indicate public certificate logging, not current site activity or maliciousness.',
+                ...(summary.rejectedRows ? [`${summary.rejectedRows} certificate row${summary.rejectedRows === 1 ? '' : 's'} contained rejected content; unusable rows or malformed fields were excluded, so retained results are partial.`] : []),
+                ...(summary.workTruncated ? ['The response contained more hostname entries than the bounded local analysis could examine; retained results are partial.'] : []),
                 ...(summary.certificateGroupsTruncated ? ['The optional certificate-group projection was capped independently of the registrable-domain result set.'] : []),
             ],
-            diagnostics: { certificateRows: data.length, matches: summary.matches.length, certificateGroups: summary.certificateGroups.length, certificateGroupsTruncated: summary.certificateGroupsTruncated },
+            diagnostics: { certificateRows: data.length, rejectedRows: summary.rejectedRows, namesExamined: summary.namesExamined, workTruncated: summary.workTruncated, matches: summary.matches.length, certificateGroups: summary.certificateGroups.length, certificateGroupsTruncated: summary.certificateGroupsTruncated },
         }),
     };
 }

package/lib/distributed-operation-budget.mjs

@@ -8,6 +8,8 @@ import crypto from 'node:crypto';
 import { safeFetch, readTextCapped } from "./safe-fetch.mjs";
 const DEFAULT_NAMESPACE = 'whoisleuth:operation-budget:v1';
 const DEFAULT_LEASE_TTL_MS = 5 * 60 * 1000;
+const MIN_LEASE_TTL_MS = 30_000;
+const MAX_LEASE_TTL_MS = 15 * 60 * 1000;
 const REQUEST_TIMEOUT_MS = 4_000;
 const MAX_RESPONSE_BYTES = 16 * 1024;
 const PROVIDER_RETRY_AFTER_SECONDS = 5;
@@ -150,7 +152,7 @@ function normalizedNamespace(value = DEFAULT_NAMESPACE) {
 }
 function normalizedLeaseTtl(value = DEFAULT_LEASE_TTL_MS) {
     const ttl = Number(value);
-    if (!Number.isSafeInteger(ttl) || ttl < 30_000 || ttl > 15 * 60 * 1000) {
+    if (!Number.isSafeInteger(ttl) || ttl < MIN_LEASE_TTL_MS || ttl > MAX_LEASE_TTL_MS) {
         throw new Error('The distributed-budget lease TTL must be between 30 seconds and 15 minutes');
     }
     return ttl;
@@ -458,4 +460,4 @@ function createDistributedOperationBudget(config, dependencies = {}) {
         status,
     };
 }
-export { DEFAULT_NAMESPACE, DEFAULT_LEASE_TTL_MS, PROVIDER_RETRY_AFTER_SECONDS, DAY_WINDOW_MS, THIRTY_DAY_WINDOW_MS, ACQUIRE_SCRIPT, ACQUIRE_WITH_USAGE_SCRIPT, RELEASE_SCRIPT, STATUS_SCRIPT, normalizedRestUrl, normalizedToken, normalizedNamespace, normalizedLimits, normalizedUsageLimits, normalizedOperationFeature, createRestCommandClient, createDistributedOperationBudget, };
+export { DEFAULT_NAMESPACE, DEFAULT_LEASE_TTL_MS, MIN_LEASE_TTL_MS, MAX_LEASE_TTL_MS, REQUEST_TIMEOUT_MS, MAX_RESPONSE_BYTES, PROVIDER_RETRY_AFTER_SECONDS, MAX_USAGE_LIMIT, DAY_WINDOW_MS, THIRTY_DAY_WINDOW_MS, ACQUIRE_SCRIPT, ACQUIRE_WITH_USAGE_SCRIPT, RELEASE_SCRIPT, STATUS_SCRIPT, normalizedRestUrl, normalizedToken, normalizedNamespace, normalizedLimits, normalizedUsageLimits, normalizedOperationFeature, createRestCommandClient, createDistributedOperationBudget, };

package/lib/dns-delegation-health.mjs

@@ -4,7 +4,8 @@
 // availability and never treats a failed query as record absence.
 import { promises as dns } from 'node:dns';
 import * as net from 'node:net';
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
+import { isValidAsciiHostname } from "./hostname.mjs";
 import { isPrivateAddress } from "./safe-fetch.mjs";
 const DNS_DELEGATION_HEALTH_VERSION = 1;
 const MAX_AUTHORITIES = 4;
@@ -26,10 +27,8 @@ function boundedText(value, maximum) {
     return value.replace(/\s+/gu, ' ').trim() || null;
 }
 function hostname(value) {
-    const normalized = boundedText(value, 253)?.toLowerCase().replace(/\.+$/u, '') ?? '';
-    if (!normalized || !normalized.includes('.'))
-        return null;
-    return normalized.split('.').every((label) => (/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/iu.test(label))) ? normalized : null;
+    const candidate = boundedText(value, 253)?.replace(/\.+$/u, '') ?? '';
+    return isValidAsciiHostname(candidate) ? candidate.toLowerCase() : null;
 }
 function hostnames(value, maximum = MAX_NAMESERVERS) {
     const output = new Set();
@@ -529,7 +528,8 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                         ? 'Fewer than two complete authority observations were available for one or more record types'
                         : 'Observed A, AAAA, CAA, and MX answers agree across selected authorities', recordMatrix.map((row) => `${row.type}: ${row.state}`).join(' · '), 'Review propagation timing and the intended zone values before relying on a DNS change.')] : []),
     ];
-    const collectionIncomplete = parentStatus === 'error'
+    const collectionIncomplete = parentStatus !== 'success'
+        || candidates.length === 0
         || parentQuery.truncated === true
         || registry.truncated
         || authorities.some((authority) => authority.state !== 'success')
@@ -557,6 +557,9 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 'A direct answer does not prove global reachability, and a failed query is not evidence that the record is absent.',
                 'DNS health does not decide registration availability, ownership, control, intent, safety, or maliciousness.',
                 'The DNSSEC check compares bounded registry publication fields; it does not validate the full cryptographic chain.',
+                ...(!candidates.length
+                    ? ['No eligible authority was identified, so the delegation-health observation is incomplete.']
+                    : []),
             ],
             diagnostics: {
                 authorityCount: authorities.length,

package/lib/dns-intelligence.mjs

@@ -6,12 +6,13 @@ import { promises as dns } from 'node:dns';
 import * as net from 'node:net';
 import { classifyMxRecords } from "./dns-mx.mjs";
 import { collectDnsDelegationHealth, skippedDnsDelegationHealth, } from "./dns-delegation-health.mjs";
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
+import { MAX_LOOKUP_DNS_RECORDS_PER_TYPE, MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS, } from "./lookup-network-evidence-bounds.mjs";
 import { isPrivateAddress } from "./safe-fetch.mjs";
 import { resolveServiceBindingRecords } from "./service-binding-dns.mjs";
 const DNS_TIMEOUT_MS = 5000;
-const MAX_RECORDS_PER_TYPE = 16;
-const MAX_PTR_RECORDS = 8;
+const MAX_RECORDS_PER_TYPE = MAX_LOOKUP_DNS_RECORDS_PER_TYPE;
+const MAX_PTR_RECORDS = MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS;
 const MAX_HOSTNAME_LENGTH = 253;
 const MAX_POLICY_LENGTH = 1024;
 const MAX_ERROR_LENGTH = 180;

package/lib/dns-resolver-selection.mjs

@@ -1,5 +1,6 @@
 import { Resolver } from 'node:dns/promises';
 import { isIP } from 'node:net';
+import { isPrivateAddress } from "./safe-fetch.mjs";
 const MAX_SELECTED_DNS_RESOLVERS = 3;
 const MAX_SELECTED_DNS_RESOLVER_TEXT = 256;
 function normalizeSelectedDnsResolvers(value) {
@@ -7,15 +8,16 @@ function normalizeSelectedDnsResolvers(value) {
         throw new TypeError(`DNS resolver selection must contain at most ${MAX_SELECTED_DNS_RESOLVER_TEXT} characters.`);
     }
     const values = [...new Set(value.split(',').map((item) => item.trim()).filter(Boolean))];
-    if (!values.length || values.length > MAX_SELECTED_DNS_RESOLVERS || values.some((item) => isIP(item) === 0)) {
-        throw new TypeError(`DNS resolver selection requires 1 to ${MAX_SELECTED_DNS_RESOLVERS} literal IPv4 or IPv6 addresses.`);
+    if (!values.length || values.length > MAX_SELECTED_DNS_RESOLVERS
+        || values.some((item) => isIP(item) === 0 || isPrivateAddress(item))) {
+        throw new TypeError(`DNS resolver selection requires 1 to ${MAX_SELECTED_DNS_RESOLVERS} publicly routable literal IPv4 or IPv6 addresses.`);
     }
     return values;
 }
 function createSelectedDnsResolvers(servers) {
     if (!Array.isArray(servers) || !servers.length || servers.length > MAX_SELECTED_DNS_RESOLVERS
-        || servers.some((item) => typeof item !== 'string' || isIP(item) === 0)) {
-        throw new TypeError('Validated DNS resolver addresses are required.');
+        || servers.some((item) => typeof item !== 'string' || isIP(item) === 0 || isPrivateAddress(item))) {
+        throw new TypeError('Validated publicly routable DNS resolver addresses are required.');
     }
     const resolver = new Resolver();
     resolver.setServers([...servers]);