@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/lib/domain-posture-parsers.mjs

@@ -2,6 +2,8 @@
 // Kept separate from DNS/network I/O so policy edge cases can be tested with
 // synthetic records and the Express/Netlify paths share identical behavior.
 import { createPublicKey } from 'node:crypto';
+import { isIP } from 'node:net';
+import { domainToASCII } from 'node:url';
 function joinTxtRecords(records) {
     if (!Array.isArray(records))
         return [];
@@ -46,6 +48,7 @@ function parseSpfRecords(records) {
         terminalPolicy: null,
         redirect: null,
         includes: [],
+        authorizingTerms: [],
         dnsLookupTerms: 0,
         issues: [],
     };
@@ -61,6 +64,108 @@ function parseSpfRecords(records) {
     if (!record)
         return result;
     const terms = record.split(/\s+/).slice(1).filter(Boolean);
+    let invalidSyntax = false;
+    const modifierNames = new Set();
+    const literalDomain = (value, label) => {
+        if (!value) {
+            result.issues.push(`${label} requires a domain-spec.`);
+            invalidSyntax = true;
+            return false;
+        }
+        if (value.includes('%')) {
+            result.issues.push(`${label} uses SPF macros that this bounded audit does not evaluate.`);
+            return true;
+        }
+        const hostname = value.toLowerCase().replace(/\.$/u, '');
+        if (/[^\x00-\x7f]/u.test(value) || hostname.length > 253 || !hostname.includes('.') || !hostname.split('.').every((part) => /^[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?$/u.test(part))) {
+            result.issues.push(`${label} has an invalid literal domain-spec.`);
+            invalidSyntax = true;
+            return false;
+        }
+        return true;
+    };
+    for (const term of terms) {
+        const qualifier = /^[+?~-]/u.test(term) ? term[0] : '+';
+        const body = qualifier === '+' && term[0] !== '+' ? term : term.slice(1);
+        const lower = body.toLowerCase();
+        const modifier = body.match(/^([a-z][a-z0-9_.-]*)=(.*)$/iu);
+        if (modifier) {
+            const name = modifier[1].toLowerCase();
+            const value = modifier[2];
+            if (modifierNames.has(name)) {
+                result.issues.push(`Duplicate SPF modifier: ${name}.`);
+                invalidSyntax = true;
+            }
+            modifierNames.add(name);
+            if (name === 'redirect') {
+                literalDomain(value, 'The redirect modifier');
+                if (qualifier !== '+') {
+                    result.issues.push('SPF modifiers cannot have a qualifier.');
+                    invalidSyntax = true;
+                }
+                result.authorizingTerms.push(term);
+            }
+            else if (name === 'exp') {
+                literalDomain(value, 'The exp modifier');
+            }
+            else {
+                result.issues.push(`The ${name} SPF modifier is not evaluated by this bounded audit.`);
+            }
+            continue;
+        }
+        if (lower === 'all')
+            continue;
+        const include = body.match(/^include:(.*)$/iu);
+        if (include) {
+            literalDomain(include[1], 'The include mechanism');
+            if (qualifier !== '-')
+                result.authorizingTerms.push(term);
+            continue;
+        }
+        const exists = body.match(/^exists:(.*)$/iu);
+        if (exists) {
+            literalDomain(exists[1], 'The exists mechanism');
+            if (qualifier !== '-')
+                result.authorizingTerms.push(term);
+            continue;
+        }
+        const ptr = body.match(/^ptr(?::(.*))?$/iu);
+        if (ptr) {
+            if (ptr[1] !== undefined)
+                literalDomain(ptr[1], 'The ptr mechanism');
+            if (qualifier !== '-')
+                result.authorizingTerms.push(term);
+            continue;
+        }
+        const address = body.match(/^(ip4|ip6):(.*)$/iu);
+        if (address) {
+            const family = address[1].toLowerCase() === 'ip4' ? 4 : 6;
+            const [literal, prefix, ...extra] = address[2].split('/');
+            const maximumPrefix = family === 4 ? 32 : 128;
+            if (extra.length || isIP(literal || '') !== family || (prefix !== undefined && (!/^\d+$/u.test(prefix) || Number(prefix) > maximumPrefix))) {
+                result.issues.push(`The ${address[1].toLowerCase()} mechanism has an invalid address or prefix length.`);
+                invalidSyntax = true;
+            }
+            if (qualifier !== '-')
+                result.authorizingTerms.push(term);
+            continue;
+        }
+        const hostMechanism = body.match(/^(a|mx)(?::([^/]+))?(?:\/(\d+))?(?:\/\/(\d+))?$/iu);
+        if (hostMechanism) {
+            if (hostMechanism[2] !== undefined)
+                literalDomain(hostMechanism[2], `The ${hostMechanism[1].toLowerCase()} mechanism`);
+            if ((hostMechanism[3] !== undefined && Number(hostMechanism[3]) > 32)
+                || (hostMechanism[4] !== undefined && Number(hostMechanism[4]) > 128)) {
+                result.issues.push(`The ${hostMechanism[1].toLowerCase()} mechanism has an invalid prefix length.`);
+                invalidSyntax = true;
+            }
+            if (qualifier !== '-')
+                result.authorizingTerms.push(term);
+            continue;
+        }
+        result.issues.push(`Unsupported or malformed SPF term: ${term}.`);
+        invalidSyntax = true;
+    }
     const allIndex = terms.findIndex((term) => /^[+?~-]?all$/i.test(term));
     const allTerm = allIndex === -1 ? null : terms[allIndex];
     const redirectTerm = terms.find((term) => /^redirect=/i.test(term));
@@ -89,12 +194,76 @@ function parseSpfRecords(records) {
         result.terminalPolicy = 'none';
         result.issues.push('No all mechanism or redirect modifier defines a terminal policy.');
     }
-    result.valid = true;
+    result.valid = !invalidSyntax;
     return result;
 }
+function hasDmarcVersion(record) {
+    return /^[vV][ \t]*=[ \t]*DMARC1(?:[ \t]*;|[ \t]*$)/u.test(record);
+}
+function parseDmarcReportingAuthorization(record) {
+    const text = joinTxtRecords([record])[0] || '';
+    if (!hasDmarcVersion(text))
+        return null;
+    const fields = text.split(';');
+    if (!fields[fields.length - 1]?.trim())
+        fields.pop();
+    // RFC 9990 section 4 requires a complete tag list, not a version prefix.
+    if (fields.some((field) => !/^[ \t]*[a-zA-Z]+[ \t]*=[ \t]*[\x20-\x3a\x3c-\x7e]+[ \t]*$/u.test(field)))
+        return null;
+    const parsed = parseTagList(text);
+    return parsed.duplicates.length || parsed.malformed.length ? null : parsed.tags;
+}
+function parseReportingDestination(value) {
+    // Validate URI spelling before URL parsing can repair whitespace, escapes or
+    // missing authority delimiters. DNS collection already bounds the input.
+    if (!value || /[^a-zA-Z0-9._~:/?#\[\]@!$&'()*+,;=%-]/u.test(value) || /%(?![a-fA-F0-9]{2})/u.test(value))
+        return null;
+    if (/^mailto:/iu.test(value)) {
+        const parts = value.slice(7).split('?');
+        if (parts.length > 2 || value.includes('#'))
+            return null;
+        const headers = parts[1];
+        if (headers !== undefined && !headers.split('&').every((field) => /^[a-zA-Z0-9._~!$'()*+,:@%\-]*=[a-zA-Z0-9._~!$'()*+,:@%\-]*$/u.test(field)))
+            return null;
+        let address;
+        try {
+            address = decodeURIComponent(parts[0] || '');
+        }
+        catch {
+            return null;
+        }
+        const at = address.lastIndexOf('@');
+        if (at <= 0)
+            return null;
+        const local = address.slice(0, at);
+        const dotAtom = /^[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+)*$/u;
+        const quoted = /^"(?:[\x20-\x21\x23-\x5b\x5d-\x7e]|\\[\x20-\x7e])*"$/u;
+        if (!dotAtom.test(local) && !quoted.test(local))
+            return null;
+        const domain = address.slice(at + 1);
+        if (domain.startsWith('[') && domain.endsWith(']')) {
+            const literal = domain.slice(1, -1);
+            return isIP(literal.replace(/^IPv6:/iu, '')) ? { scheme: 'mailto', host: domain } : null;
+        }
+        const host = domainToASCII(domain).toLowerCase();
+        if (!host || host.length > 253 || !host.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label)))
+            return null;
+        return { scheme: 'mailto', host };
+    }
+    const authority = /^https:\/\/([^/?#]+)/iu.exec(value)?.[1];
+    if (!authority || authority.includes('@') || value.includes('#'))
+        return null;
+    try {
+        const uri = new URL(value);
+        return uri.hostname && !uri.username && !uri.password && !uri.hash ? { scheme: 'https', host: uri.hostname } : null;
+    }
+    catch {
+        return null;
+    }
+}
 function parseDmarcRecords(records) {
     const allRecords = joinTxtRecords(records);
-    const dmarcRecords = allRecords.filter((record) => /^v\s*=\s*dmarc1(?:\s*;|$)/i.test(record));
+    const dmarcRecords = allRecords.filter(hasDmarcVersion);
     const result = {
         records: dmarcRecords,
         valid: false,
@@ -152,8 +321,12 @@ function parseDmarcRecords(records) {
     result.failureReporting = Boolean(parsed.tags.ruf);
     result.aggregateDestinations = (parsed.tags.rua || '').split(',').map((value) => value.trim()).filter(Boolean);
     result.failureDestinations = (parsed.tags.ruf || '').split(',').map((value) => value.trim()).filter(Boolean);
+    const emptyDestination = [parsed.tags.rua, parsed.tags.ruf].some((value) => value !== undefined && value.split(',').some((destination) => !destination.trim()));
+    if (emptyDestination)
+        result.issues.push('A DMARC reporting URI list contains an empty destination.');
     result.valid = parsed.duplicates.length === 0
         && parsed.malformed.length === 0
+        && !emptyDestination
         && Boolean(result.policy && result.subdomainPolicy && result.nonexistentSubdomainPolicy)
         && (!parsed.tags.t || /^[yn]$/i.test(parsed.tags.t));
     return result;
@@ -230,7 +403,7 @@ function parseMtaStsPolicy(text) {
 }
 function parseTlsRptRecords(records) {
     const allRecords = joinTxtRecords(records);
-    const policyRecords = allRecords.filter((record) => /^v\s*=\s*tlsrptv1(?:\s*;|$)/i.test(record));
+    const policyRecords = allRecords.filter((record) => /^v=TLSRPTv1(?:[ \t]*;|$)/u.test(record));
     const result = { records: policyRecords, valid: false, record: policyRecords[0] || null, rua: [], issues: [] };
     if (policyRecords.length === 0) {
         result.issues.push('No TLS-RPT policy record was found.');
@@ -241,14 +414,26 @@ function parseTlsRptRecords(records) {
         return result;
     }
     const parsed = parseTagList(policyRecords[0]);
-    result.rua = (parsed.tags.rua || '').split(',').map((value) => value.trim()).filter(Boolean);
+    const destinations = (parsed.tags.rua || '').split(',').map((value) => value.trim());
+    result.rua = destinations.filter(Boolean);
     if (result.rua.length === 0)
         result.issues.push('The TLS-RPT record has no aggregate report destination.');
+    if (destinations.some((destination) => /[!,;]/u.test(destination) || !parseReportingDestination(destination))) {
+        result.issues.push('TLS-RPT destinations must be complete supported mailto or HTTPS URIs; reserved reporting delimiters must be percent-encoded.');
+    }
+    const fields = (policyRecords[0] || '').split(';');
+    if (!fields[fields.length - 1]?.trim())
+        fields.pop();
+    if (fields.slice(1).some((field) => {
+        const text = field.trim();
+        return text.startsWith('rua=') ? false : !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,31}=[\x21-\x3a\x3c\x3e-\x7e]+$/u.test(text) || /^rua=/iu.test(text);
+    }))
+        result.issues.push('The TLS-RPT record contains an invalid field name or value.');
     if (parsed.duplicates.length)
         result.issues.push(`Duplicate TLS-RPT tag${parsed.duplicates.length === 1 ? '' : 's'}: ${parsed.duplicates.join(', ')}.`);
     if (parsed.malformed.length)
         result.issues.push(`Malformed TLS-RPT field${parsed.malformed.length === 1 ? '' : 's'}: ${parsed.malformed.join(', ')}.`);
-    result.valid = result.rua.length > 0 && parsed.duplicates.length === 0 && parsed.malformed.length === 0;
+    result.valid = result.issues.length === 0;
     return result;
 }
 function parseBimiRecords(records) {
@@ -321,8 +506,14 @@ function parseDkimRecords(selector, records) {
         }
         else {
             try {
+                const decodedKey = Buffer.from(encodedKey, 'base64');
+                if (result.keyType === 'ed25519' && decodedKey.length !== 32) {
+                    throw new Error('Ed25519 DKIM keys use an exact 32-byte raw public key.');
+                }
                 const key = createPublicKey({
-                    key: Buffer.from(encodedKey, 'base64'),
+                    key: result.keyType === 'ed25519'
+                        ? Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), decodedKey])
+                        : decodedKey,
                     format: 'der',
                     type: 'spki',
                 });
@@ -341,7 +532,9 @@ function parseDkimRecords(selector, records) {
             }
             catch {
                 result.keyParseState = 'invalid';
-                result.issues.push('The DKIM public key could not be parsed as SubjectPublicKeyInfo.');
+                result.issues.push(result.keyType === 'ed25519'
+                    ? 'The Ed25519 DKIM public key must be exactly 32 raw bytes.'
+                    : 'The DKIM public key could not be parsed as SubjectPublicKeyInfo.');
             }
         }
     }
@@ -355,4 +548,4 @@ function parseDkimRecords(selector, records) {
     result.valid = result.issues.length === 0;
     return result;
 }
-export { joinTxtRecords, parseTagList, parseSpfRecords, parseDmarcRecords, parseMtaStsDnsRecords, parseMtaStsPolicy, parseTlsRptRecords, parseBimiRecords, parseDkimRecords, };
+export { joinTxtRecords, parseTagList, parseSpfRecords, parseDmarcRecords, parseDmarcReportingAuthorization, parseReportingDestination, parseMtaStsDnsRecords, parseMtaStsPolicy, parseTlsRptRecords, parseBimiRecords, parseDkimRecords, };

package/lib/domain-posture.mjs

@@ -7,6 +7,10 @@ import { nonEmptyErrorMessage } from "./error-detail.mjs";
 import { safeFetch, readTextCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
 import { classifyMxRecords } from "./dns-mx.mjs";
+import { collectDnsInheritanceChecks } from "./dns-inheritance-review.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
+import { DOMAIN_POSTURE_COMPARISON_VERSION, MAX_POSTURE_CHECK_RECORDS, POSTURE_CHECK_SOURCES } from "../packages/evidence/domain-posture-context.mjs";
+import { canonicalPostureRecords } from "../packages/evidence/domain-control-runtime.mjs";
 import { parseSpfRecords, parseDmarcRecords, parseMtaStsDnsRecords, parseMtaStsPolicy, parseTlsRptRecords, parseBimiRecords, parseDkimRecords, } from "./domain-posture-parsers.mjs";
 import { buildExternalDependencies, expandSpfPolicy, validateDmarcExternalReporting, } from "./domain-posture-analysis.mjs";
 const DNS_TIMEOUT_MS = 6000;
@@ -23,6 +27,22 @@ function errorRecord(value) {
 function asMxRecords(records) {
     return records;
 }
+function completeMxRecords(records) {
+    const normalized = [];
+    for (const raw of records) {
+        if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+            return null;
+        const value = raw;
+        const exchange = typeof value.exchange === 'string' ? value.exchange.trim().toLowerCase().replace(/\.+$/u, '') : null;
+        const priority = Number(value.priority);
+        if (exchange === null || !Number.isInteger(priority) || priority < 0 || priority > 65_535)
+            return null;
+        if (exchange && !normalizeAuditDomain(exchange))
+            return null;
+        normalized.push({ exchange, priority });
+    }
+    return normalized;
+}
 function trimTerminalDots(value) {
     let end = value.length;
     while (end > 0 && value.charCodeAt(end - 1) === 46)
@@ -72,14 +92,23 @@ function withTimeout(promise, label, timeoutMs = DNS_TIMEOUT_MS, timers = {
     });
 }
 async function resolveDns(label, factory, timeoutMs = DNS_TIMEOUT_MS, timers) {
+    const completed = (result) => {
+        let observedAt = null;
+        try {
+            const at = timers?.now?.();
+            observedAt = at instanceof Date && Number.isFinite(at.getTime()) ? at.toISOString() : null;
+        }
+        catch { /* Unknown source time remains explicit. */ }
+        return { ...result, observedAt };
+    };
     try {
-        return { records: await withTimeout(factory(), label, timeoutMs, timers), error: null };
+        return completed({ records: await withTimeout(factory(), label, timeoutMs, timers), error: null });
     }
     catch (err) {
         const error = errorRecord(err);
         if (typeof error.code === 'string' && MISSING_DNS_CODES.has(error.code))
-            return { records: [], error: null };
-        return { records: [], error: nonEmptyErrorMessage(err, String(err)) };
+            return completed({ records: [], error: null });
+        return completed({ records: [], error: nonEmptyErrorMessage(err, String(err)) });
     }
 }
 function check(id, label, status, summary, { detail = '', records = [], remediation = '' } = {}) {
@@ -175,6 +204,11 @@ function dmarcCheck(query, authorizations = []) {
     ];
     const external = authorizations.filter((authorization) => authorization.state !== 'self');
     const unresolvedExternal = external.filter((authorization) => authorization.state !== 'authorized');
+    const intendedDestinations = parsed.aggregateDestinations.length + parsed.failureDestinations.length;
+    const omittedDestinations = Math.max(0, intendedDestinations - authorizations.length);
+    if (omittedDestinations) {
+        details.push(`Reporting authorisation coverage: ${authorizations.length} of ${intendedDestinations} destinations reviewed; ${omittedDestinations} not checked within the bounded collection. Omitted destinations are not assumed authorised.`);
+    }
     if (external.length > 0) {
         details.push(`${external.length} external reporting destination${external.length === 1 ? '' : 's'} checked; `
             + `${unresolvedExternal.length} could not be authorized.`);
@@ -197,11 +231,13 @@ function dmarcCheck(query, authorizations = []) {
             remediation: 'Set sp and np to quarantine or reject unless weaker subdomain treatment is intentional.',
         });
     }
-    if (unresolvedExternal.length > 0) {
-        return check('dmarc', 'DMARC', 'warning', `Enforced at p=${parsed.policy}; external reporting authorization is incomplete`, {
+    if (unresolvedExternal.length > 0 || omittedDestinations > 0) {
+        return check('dmarc', 'DMARC', 'warning', `Enforced at p=${parsed.policy}; reporting authorisation is incomplete`, {
             detail: `${details.join(' ')} ${unresolvedExternal.map((authorization) => `${authorization.destination}: ${authorization.state}.`).join(' ')}`,
             records: parsed.records,
-            remediation: 'Publish the required external reporting authorisation record or remove the unavailable destination.',
+            remediation: omittedDestinations > 0
+                ? 'Review the unchecked destinations and confirm any required external reporting authorisation before relying on delivery.'
+                : 'Publish the required external reporting authorisation record or remove the unavailable destination.',
         });
     }
     if (!parsed.aggregateReporting) {
@@ -316,7 +352,11 @@ function matchesMtaPattern(host, pattern) {
     const normalizedPattern = String(pattern || '').toLowerCase().replace(/\.+$/, '');
     if (normalizedPattern.startsWith('*.')) {
         const suffix = normalizedPattern.slice(1);
-        return normalizedHost.endsWith(suffix) && normalizedHost.length > suffix.length;
+        if (!normalizedHost.endsWith(suffix))
+            return false;
+        const label = normalizedHost.slice(0, -suffix.length);
+        // MTA-STS permits a wildcard for exactly one leftmost DNS label.
+        return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label);
     }
     return normalizedHost === normalizedPattern;
 }
@@ -356,7 +396,22 @@ function mtaStsCheck(dnsQuery, policyFetch, mxQuery) {
             remediation: 'Configure the policy host to return Content-Type: text/plain.',
         });
     }
-    const mxHosts = mxQuery.error ? [] : classifyMxRecords(asMxRecords(mxQuery.records)).mxHosts;
+    if (mxQuery.error) {
+        return check('mta_sts', 'MTA-STS', 'info', 'Policy is valid but MX coverage could not be evaluated', {
+            detail: mxQuery.error,
+            records,
+            remediation: 'Retry the MX lookup before concluding that the policy covers every current mail exchanger.',
+        });
+    }
+    const reviewedMx = completeMxRecords(mxQuery.records);
+    if (!reviewedMx) {
+        return check('mta_sts', 'MTA-STS', 'info', 'Policy is valid but MX coverage is incomplete', {
+            detail: 'One or more MX records were malformed or outside the bounded hostname and priority contract.',
+            records,
+            remediation: 'Retry and review the MX evidence before concluding that the policy covers every current mail exchanger.',
+        });
+    }
+    const mxHosts = classifyMxRecords(reviewedMx).mxHosts;
     const unmatched = mxHosts.filter((host) => !policy.mx.some((pattern) => matchesMtaPattern(host, pattern)));
     if (unmatched.length) {
         return check('mta_sts', 'MTA-STS', 'danger', 'Policy does not cover every published MX host', {
@@ -507,7 +562,7 @@ function defensiveMailProfileCheck(profile, input) {
     const mx = input.mx.error ? null : classifyMxRecords(asMxRecords(input.mx.records));
     const requirements = {
         nullMx: mx?.hasNullMx === true,
-        restrictiveSpf: spf?.valid === true && spf.terminalPolicy === 'fail' && spf.dnsLookupTerms === 0,
+        restrictiveSpf: spf?.valid === true && spf.terminalPolicy === 'fail' && spf.authorizingTerms.length === 0,
         rejectingDmarc: dmarc?.valid === true
             && dmarc.policy === 'reject'
             && dmarc.subdomainPolicy === 'reject'
@@ -534,10 +589,11 @@ function defensiveMailProfileCheck(profile, input) {
 function registrationLockCheck(registry) {
     if (registry.error)
         return queryFailureCheck('registration_lock', 'Registration controls', registry.error);
-    const statuses = registry.statuses.map((status) => status.toLowerCase().replace(/[^a-z]/gu, ''));
+    const statuses = canonicalPostureRecords('registration_lock', registry.statuses) ?? [];
     if (statuses.length === 0) {
         return check('registration_lock', 'Registration controls', 'info', 'Registry lock state is unavailable', {
             detail: 'No normalised EPP status was returned. This does not describe registrar account security.',
+            records: registry.statuses,
         });
     }
     const transferLocks = statuses.filter((status) => ['clienttransferprohibited', 'servertransferprohibited'].includes(status));
@@ -604,11 +660,36 @@ function buildPostureReport(domain, input) {
         ...(input.registry && input.nameservers ? [nameserverCheck(input.nameservers, input.registry)] : []),
     ];
     const summary = { pass: 0, warning: 0, danger: 0, info: 0 };
-    for (const item of checks)
+    for (const item of checks) {
         summary[item.status] += 1;
+        const source = POSTURE_CHECK_SOURCES[item.id];
+        const query = item.id === 'nameservers' ? input.nameservers : item.id === 'mx' ? input.mx : item.id === 'caa' ? input.caa : undefined;
+        const registry = item.id === 'registration_lock' ? input.registry : undefined;
+        if (!source || (!query && !registry))
+            continue;
+        const omittedRecords = Math.max(0, item.records.length - MAX_POSTURE_CHECK_RECORDS);
+        const records = item.records.slice(0, MAX_POSTURE_CHECK_RECORDS);
+        const error = query?.error ?? registry?.error;
+        const retained = canonicalPostureRecords(item.id, records);
+        const rawRecords = query?.records ?? registry?.statuses ?? [];
+        const raw = item.id === 'caa'
+            ? canonicalPostureRecords(item.id, rawRecords.map((record) => record && typeof record === 'object' ? caaDisplay(record) : record))
+            : canonicalPostureRecords(item.id, rawRecords);
+        const complete = !error && omittedRecords === 0 && retained !== null && raw !== null
+            && retained.length === raw.length && retained.every((value, index) => value === raw[index])
+            && (!registry || (registry.statusesComplete === true && records.length > 0));
+        item.sourceContext = {
+            version: DOMAIN_POSTURE_COMPARISON_VERSION, source,
+            observedAt: normalizeExplicitIsoTimestamp(query?.observedAt ?? registry?.observedAt),
+            state: error ? 'unavailable' : complete ? 'complete' : 'partial',
+            omittedRecords: complete ? 0 : omittedRecords || null,
+        };
+        item.records = records;
+    }
     return { domain, summary, checks };
 }
-async function fetchMtaStsPolicy(domain, fetcher = safeFetch) {
+async function fetchMtaStsPolicy(domain, fetcher = safeFetch, signal) {
+    signal?.throwIfAborted();
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), POLICY_TIMEOUT_MS);
     try {
@@ -617,10 +698,10 @@ async function fetchMtaStsPolicy(domain, fetcher = safeFetch) {
         // following HTTP redirects for policy discovery. A zero-hop safe fetch
         // also keeps the returned body bound to the required policy host/path.
         const res = await fetcher(url, {
-            signal: controller.signal,
+            signal: signal ? AbortSignal.any([signal, controller.signal]) : controller.signal,
             headers: whoisleuthRequestHeaders({ Accept: 'text/plain' }),
         }, 0);
-        if (!res.ok) {
+        if (res.status !== 200) {
             // Not reading this body - release it explicitly instead of leaving an
             // unconsumed stream (and the connection it's tied to) open until
             // undici's own idle-timeout eventually notices.
@@ -628,11 +709,13 @@ async function fetchMtaStsPolicy(domain, fetcher = safeFetch) {
             return { text: '', contentType: res.headers.get('content-type'), error: `Policy endpoint returned HTTP ${res.status}.` };
         }
         const body = await readTextCapped(res, MAX_POLICY_BYTES);
+        signal?.throwIfAborted();
         if (body.truncated)
             return { text: '', contentType: res.headers.get('content-type'), error: `Policy exceeds ${MAX_POLICY_BYTES} bytes.` };
         return { text: body.text, contentType: res.headers.get('content-type'), error: null };
     }
     catch (err) {
+        signal?.throwIfAborted();
         return {
             text: '',
             contentType: null,
@@ -645,17 +728,8 @@ async function fetchMtaStsPolicy(domain, fetcher = safeFetch) {
         clearTimeout(timeout);
     }
 }
-async function checkDomainPosture(domain, { dkimSelectors = [], retiredDkimSelectors = [], mailProtectionProfile = 'standard', } = {}, dependencies = {
-    resolveTxt: (name) => dns.resolveTxt(name),
-    resolveMx: (name) => dns.resolveMx(name),
-    resolveNs: (name) => dns.resolveNs(name),
-    resolveCaa: (name) => dns.resolveCaa(name),
-    fetchRdapRecord,
-    fetchMtaStsPolicy: (name) => fetchMtaStsPolicy(name),
-    now: () => new Date(),
-    setTimer: (callback, milliseconds) => setTimeout(callback, milliseconds),
-    clearTimer: (handle) => clearTimeout(handle),
-}) {
+async function collectDomainPosture(domain, { dkimSelectors = [], retiredDkimSelectors = [], mailProtectionProfile = 'standard', includeInheritedDns, signal, }, dependencies) {
+    signal?.throwIfAborted();
     const normalizedDomain = normalizeAuditDomain(domain);
     if (!normalizedDomain)
         throw new Error('Invalid domain name for posture audit.');
@@ -686,10 +760,11 @@ async function checkDomainPosture(domain, { dkimSelectors = [], retiredDkimSelec
                 ...await resolveDns(`TXT ${selector}._domainkey.${domain}`, () => dependencies.resolveTxt(`${selector}._domainkey.${domain}`), DNS_TIMEOUT_MS, dependencies),
             })),
         ]),
-        dependencies.fetchRdapRecord('domain', domain).catch((err) => ({
+        dependencies.fetchRdapRecord('domain', domain, signal ? { signal } : {}).catch((err) => ({
             error: nonEmptyErrorMessage(err, String(err)),
         })),
     ]);
+    signal?.throwIfAborted();
     const parsedMtaDns = mtaStsDns.error ? null : parseMtaStsDnsRecords(mtaStsDns.records);
     const enrichmentStartedAt = dependencies.now();
     if (!(enrichmentStartedAt instanceof Date) || !Number.isFinite(enrichmentStartedAt.getTime())) {
@@ -697,6 +772,7 @@ async function checkDomainPosture(domain, { dkimSelectors = [], retiredDkimSelec
     }
     const enrichmentDeadline = enrichmentStartedAt.getTime() + POSTURE_ENRICHMENT_DEADLINE_MS;
     const resolveEnrichmentTxt = (name) => {
+        signal?.throwIfAborted();
         const observedAt = dependencies.now();
         if (!(observedAt instanceof Date) || !Number.isFinite(observedAt.getTime())) {
             return Promise.resolve({ records: [], error: 'The bounded posture-enrichment clock was unavailable.' });
@@ -706,11 +782,21 @@ async function checkDomainPosture(domain, { dkimSelectors = [], retiredDkimSelec
             return Promise.resolve({ records: [], error: 'The bounded posture-enrichment deadline was reached.' });
         return resolveDns(`TXT ${name}`, () => dependencies.resolveTxt(name), Math.min(DNS_TIMEOUT_MS, remaining), dependencies);
     };
-    const [mtaStsPolicy, spfExpansion, dmarcAuthorizations] = await Promise.all([
-        parsedMtaDns?.valid ? dependencies.fetchMtaStsPolicy(domain) : Promise.resolve(null),
+    const enrichment = [
+        parsedMtaDns?.valid ? dependencies.fetchMtaStsPolicy(domain, signal) : Promise.resolve(null),
         expandSpfPolicy(domain, spf, resolveEnrichmentTxt),
         validateDmarcExternalReporting(domain, dmarc, resolveEnrichmentTxt),
-    ]);
+        includeInheritedDns === true
+            ? (dependencies.collectDnsInheritanceChecks
+                ? dependencies.collectDnsInheritanceChecks(domain, dmarc, nameservers, signal ? { signal } : {})
+                : Promise.reject(new TypeError('The explicit DNS review collector is unavailable.')))
+            : Promise.resolve([]),
+    ];
+    // A rejected policy request must not release the operation's capacity while
+    // other started enrichment collectors are still settling.
+    const [mtaStsPolicy, spfExpansion, dmarcAuthorizations, inheritanceChecks] = await Promise.all(enrichment)
+        .finally(() => Promise.allSettled(enrichment));
+    signal?.throwIfAborted();
     const dnssec = !rdap
         ? { value: null, error: 'RDAP did not return a domain record.' }
         : 'error' in rdap
@@ -727,6 +813,8 @@ async function checkDomainPosture(domain, { dkimSelectors = [], retiredDkimSelec
             dsRecordCount: parsedDomain.dsData.length,
             dsDataTruncated: parsedDomain.dsDataTruncated,
             error: null,
+            observedAt: normalizeExplicitIsoTimestamp(rdap && !('error' in rdap) ? rdap.fetchedAt : null),
+            statusesComplete: parsedDomain.statusesTruncated === false && parsedDomain.serverTruncated === false,
         }
         : {
             statuses: [],
@@ -763,6 +851,10 @@ async function checkDomainPosture(domain, { dkimSelectors = [], retiredDkimSelec
     if (!(checkedAt instanceof Date) || !Number.isFinite(checkedAt.getTime())) {
         throw new TypeError('Domain-posture completion time must be valid.');
     }
+    for (const item of inheritanceChecks) {
+        report.checks.push(item);
+        report.summary[item.status] += 1;
+    }
     return {
         ...report,
         checkedAt: checkedAt.toISOString(),
@@ -774,4 +866,30 @@ async function checkDomainPosture(domain, { dkimSelectors = [], retiredDkimSelec
         externalDependencies,
     };
 }
+async function checkDomainPosture(domain, options = {}, dependencies) {
+    options.signal?.throwIfAborted();
+    // Cancelling one audit must never cancel another audit's resolver.
+    const resolver = dependencies ? null : new dns.Resolver();
+    const cancel = () => resolver?.cancel();
+    options.signal?.addEventListener('abort', cancel, { once: true });
+    try {
+        options.signal?.throwIfAborted();
+        return await collectDomainPosture(domain, options, dependencies ?? {
+            resolveTxt: name => resolver.resolveTxt(name),
+            resolveMx: name => resolver.resolveMx(name),
+            resolveNs: name => resolver.resolveNs(name),
+            resolveCaa: name => resolver.resolveCaa(name),
+            fetchRdapRecord,
+            fetchMtaStsPolicy: (name, signal) => fetchMtaStsPolicy(name, safeFetch, signal),
+            now: () => new Date(),
+            setTimer: (callback, milliseconds) => setTimeout(callback, milliseconds),
+            clearTimer: handle => clearTimeout(handle),
+            collectDnsInheritanceChecks,
+        });
+    }
+    finally {
+        options.signal?.removeEventListener('abort', cancel);
+        cancel();
+    }
+}
 export { normalizeAuditDomain, normalizeDkimSelectors, normalizeMailProtectionProfile, matchesMtaPattern, fetchMtaStsPolicy, buildPostureReport, checkDomainPosture, };