@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/lib/ct-search.mjs

@@ -7,13 +7,14 @@
 // earliest public signal a new lookalike exists at all. Shared by the
 // Express server and the Netlify Functions.
 import { parse } from 'tldts';
-import { normalizeCtQuery } from "./ct-query.mjs";
+import { setTimeout as sleep } from 'node:timers/promises';
+import { normalizeCtQuery } from "../packages/analysis/ct-query.mjs";
 import { safeFetch, readTextCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
 import { createObservation } from "../packages/evidence/observation.mjs";
-import { isValidAsciiHostname } from "./hostname.mjs";
+import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { normalizeCtTimestamp } from "../packages/evidence/observation.mjs";
-import { MAX_CT_RESPONSE_CERTIFICATE_GROUPS, MAX_CT_RESPONSE_DOMAINS_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH, MAX_CT_RESPONSE_RESULTS, MAX_CT_RESPONSE_TIMESTAMP_LENGTH, } from "./ct-response-bounds.mjs";
+import { MAX_CT_RESPONSE_CERTIFICATE_GROUPS, MAX_CT_RESPONSE_DOMAINS_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH, MAX_CT_RESPONSE_RESULTS, MAX_CT_RESPONSE_TIMESTAMP_LENGTH, } from "../packages/analysis/ct-response-bounds.mjs";
 const CRT_SH_TIMEOUT_MS = 20000;
 const MAX_RESULTS = MAX_CT_RESPONSE_RESULTS;
 // crt.sh's response size scales with how many certificates ever matched the
@@ -37,6 +38,27 @@ const RETRY_DELAY_MS = 1500;
 // delay before a status-code retry above), so this caps the worst case at
 // two attempts (~40s) instead of stacking on top of MAX_RETRIES.
 const MAX_TIMEOUT_RETRIES = 1;
+const COLLECTION_ERRORS = {
+    CT_TIMEOUT: [504, 'Certificate search timed out. Try a narrower keyword or try again later.'],
+    CT_OVERLOADED: [503, 'Certificate search is temporarily overloaded. Try again later.'],
+    CT_QUERY_TOO_BROAD: [422, 'Certificate search returned too many results. Try a narrower keyword.'],
+    CT_INVALID_RESPONSE: [502, 'Certificate search returned invalid UTF-8 or an unexpected response format (expected a JSON array). Try again later.'],
+    CT_UPSTREAM_ERROR: [502, 'Certificate search could not retrieve a response from its source. Try again later.'],
+};
+export class CtCollectionError extends Error {
+    code;
+    constructor(code) {
+        super(COLLECTION_ERRORS[code][1]);
+        this.code = code;
+        this.name = 'CtCollectionError';
+    }
+}
+/** Only this finite collection vocabulary may cross an HTTP error boundary. */
+export function ctCollectionErrorResponse(error) {
+    return error instanceof CtCollectionError
+        ? { statusCode: COLLECTION_ERRORS[error.code][0], body: { error: COLLECTION_ERRORS[error.code][1], errorCode: error.code } }
+        : null;
+}
 // Row-count defense: a hostile or malformed response could fit a very large
 // number of tiny rows into the 5 MB byte cap and impose excessive
 // iteration/set overhead after parsing. Legitimate responses under the byte
@@ -71,59 +93,79 @@ function normalizeHostname(raw) {
         h = h.slice(2);
     return HOSTNAME_RE.test(h) && isValidAsciiHostname(h, { requireLowercase: true }) ? h : null;
 }
-function delay(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+function delay(ms, signal) {
+    return sleep(ms, undefined, signal ? { signal } : {});
 }
-async function fetchCrtSh(keyword, attempt = 0, dependencies = {}) {
+async function fetchCrtSh(keyword, dependencies = {}) {
+    dependencies.signal?.throwIfAborted();
     const fetcher = dependencies.fetcher || safeFetch;
     const wait = dependencies.delay || delay;
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), CRT_SH_TIMEOUT_MS);
-    try {
-        let res;
+    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+        dependencies.signal?.throwIfAborted();
+        const controller = new AbortController();
+        const signal = dependencies.signal ? AbortSignal.any([dependencies.signal, controller.signal]) : controller.signal;
+        const timeout = setTimeout(() => controller.abort(), CRT_SH_TIMEOUT_MS);
+        let retryDelay = 0;
         try {
-            res = await fetcher(`https://crt.sh/?q=${encodeURIComponent(keyword)}&output=json`, {
+            const res = await fetcher(`https://crt.sh/?q=${encodeURIComponent(keyword)}&output=json`, {
                 headers: whoisleuthRequestHeaders({ Accept: 'application/json' }),
-                signal: controller.signal,
+                signal,
             }, 0);
-        }
-        catch (err) {
-            if (!(err instanceof Error) || err.name !== 'AbortError')
-                throw err;
-            if (attempt < MAX_TIMEOUT_RETRIES)
-                return fetchCrtSh(keyword, attempt + 1, dependencies);
-            throw new Error(`crt.sh took too long to respond (>${CRT_SH_TIMEOUT_MS / 1000}s per attempt, ${attempt + 1} attempts) - ` +
-                "it can be slow for broad search terms or under heavy load; try a narrower keyword or try again shortly.");
-        }
-        if (!res.ok) {
-            // Not reading this body - release it explicitly instead of leaving an
-            // unconsumed stream (and the connection it's tied to) open until
-            // undici's own idle-timeout eventually notices.
-            await res.body?.cancel().catch(() => { });
-            if (RETRYABLE_STATUSES.has(res.status) && attempt < MAX_RETRIES) {
-                await wait(RETRY_DELAY_MS * (attempt + 1));
-                return fetchCrtSh(keyword, attempt + 1, dependencies);
+            if (!res.ok) {
+                await res.body?.cancel().catch(() => { });
+                if (RETRYABLE_STATUSES.has(res.status) && attempt < MAX_RETRIES) {
+                    retryDelay = RETRY_DELAY_MS * (attempt + 1);
+                }
+                else {
+                    throw new CtCollectionError(RETRYABLE_STATUSES.has(res.status) || res.status === 429 ? 'CT_OVERLOADED' : 'CT_UPSTREAM_ERROR');
+                }
+            }
+            else {
+                let text;
+                try {
+                    const body = await readTextCapped(res, CRT_SH_MAX_BYTES, { fatalUtf8: true });
+                    signal.throwIfAborted();
+                    if (body.truncated)
+                        throw new CtCollectionError('CT_QUERY_TOO_BROAD');
+                    text = body.text;
+                }
+                catch (error) {
+                    // Preserve transport/deadline failures for the attempt retry below.
+                    if (error instanceof TypeError && !signal.aborted) {
+                        throw new CtCollectionError('CT_INVALID_RESPONSE');
+                    }
+                    throw error;
+                }
+                let data;
+                try {
+                    data = JSON.parse(text);
+                }
+                catch {
+                    throw new CtCollectionError('CT_INVALID_RESPONSE');
+                }
+                if (!Array.isArray(data))
+                    throw new CtCollectionError('CT_INVALID_RESPONSE');
+                if (data.length > MAX_CT_ROWS)
+                    throw new CtCollectionError('CT_QUERY_TOO_BROAD');
+                return data;
             }
-            throw new Error(RETRYABLE_STATUSES.has(res.status)
-                ? `crt.sh is temporarily overloaded (${res.status} after ${attempt + 1} attempts) - it's a free public service that intermittently struggles under load; try again in a moment.`
-                : `crt.sh returned ${res.status}`);
-        }
-        const { text, truncated } = await readTextCapped(res, CRT_SH_MAX_BYTES, { fatalUtf8: true });
-        if (truncated) {
-            throw new Error(`crt.sh returned more than ${CRT_SH_MAX_BYTES / (1024 * 1024)}MB of results for "${keyword}" - try a narrower/more specific keyword.`);
         }
-        const data = JSON.parse(text);
-        if (!Array.isArray(data)) {
-            throw new Error('crt.sh returned an unexpected response format (expected a JSON array).');
+        catch (error) {
+            dependencies.signal?.throwIfAborted();
+            if (!controller.signal.aborted && (!(error instanceof Error) || error.name !== 'AbortError'))
+                throw error;
+            if (attempt >= MAX_TIMEOUT_RETRIES)
+                throw new CtCollectionError('CT_TIMEOUT');
         }
-        if (data.length > MAX_CT_ROWS) {
-            throw new Error(`crt.sh returned too many rows (${data.length}) for "${keyword}" - try a narrower keyword.`);
+        finally {
+            // End this attempt before delay/retry: body reads share the same deadline
+            // as headers, and earlier timers cannot fire during a later attempt.
+            clearTimeout(timeout);
         }
-        return data;
-    }
-    finally {
-        clearTimeout(timeout);
+        if (retryDelay)
+            await wait(retryDelay, dependencies.signal);
     }
+    throw new CtCollectionError('CT_UPSTREAM_ERROR');
 }
 // ---------------------------------------------------------------------------
 // Certificate identity
@@ -464,6 +506,7 @@ function summarizeCtResults(rows) {
 // Production search
 // ---------------------------------------------------------------------------
 async function searchCertificateTransparency(keyword, dependencies = {}) {
+    dependencies.signal?.throwIfAborted();
     const startedAt = Date.now();
     const trimmed = normalizeCtQuery(keyword);
     if (!trimmed) {
@@ -478,7 +521,7 @@ async function searchCertificateTransparency(keyword, dependencies = {}) {
             }),
         };
     }
-    const data = await fetchCrtSh(trimmed, 0, dependencies);
+    const data = await fetchCrtSh(trimmed, dependencies);
     const summary = summarizeCtResults(data);
     return {
         certCount: data.length,

package/lib/dmarc-discovery.mjs

@@ -0,0 +1,62 @@
+import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
+import { parseDmarcRecords } from "./domain-posture-parsers.mjs";
+export function requireDmarcDomain(domain) {
+    if (typeof domain !== 'string' || domain.length > 253 || !isValidAsciiHostname(domain) || domain !== domain.toLowerCase()) {
+        throw new TypeError('The additional DNS review requires a normalised domain.');
+    }
+}
+export function dmarcPolicyObservation(owner, observation) {
+    const records = observation.records;
+    let bytes = 0;
+    const admitted = Array.isArray(records) && records.length <= 64 && records.every(raw => {
+        const parts = typeof raw === 'string' ? [raw] : raw;
+        return Array.isArray(parts) && parts.length <= 256 && parts.every(part => {
+            if (typeof part !== 'string' || part.length > 4096)
+                return false;
+            bytes += Buffer.byteLength(part, 'utf8');
+            return bytes <= 65_536;
+        });
+    });
+    const parsed = parseDmarcRecords(admitted ? records : []);
+    const unavailable = Boolean(observation.error) || !admitted;
+    const psd = parsed.tags.psd?.toLowerCase() ?? 'u';
+    const valid = !unavailable && parsed.valid && ['u', 'n', 'y'].includes(psd);
+    const incomplete = unavailable || (!valid && parsed.records.length === 1);
+    const state = unavailable ? 'unavailable' : valid ? 'observed' : parsed.records.length ? 'invalid' : 'not found';
+    const description = valid
+        ? `p=${parsed.policy}; sp=${parsed.subdomainPolicy}; np=${parsed.nonexistentSubdomainPolicy}; psd=${psd}; test=${parsed.testMode ? 'yes' : 'no'}`
+        : state;
+    const time = typeof observation.observedAt === 'string' && observation.observedAt.length <= 64
+        ? normalizeExplicitIsoTimestamp(observation.observedAt) : null;
+    return { owner, parsed, psd, valid, unavailable, incomplete,
+        record: `Recursive DNS TXT _dmarc.${owner} · ${time ?? 'time unavailable'} · ${description}` };
+}
+/** RFC 9989 sections 4.10–4.10.2: at most eight owners, never PSL inference. */
+export async function walkDmarcTree(domain, exact, resolve, purpose) {
+    requireDmarcDomain(domain);
+    const rows = [dmarcPolicyObservation(domain, exact)];
+    const first = rows[0];
+    const labels = domain.split('.');
+    let next = labels.length >= 8 ? labels.slice(-7) : labels.slice(1);
+    const policyOnly = purpose === 'policy' && first.valid;
+    if (!policyOnly && !first.unavailable && !(first.valid && ['n', 'y'].includes(first.psd))) {
+        while (next.length) {
+            const owner = next.join('.');
+            const row = dmarcPolicyObservation(owner, await resolve(`_dmarc.${owner}`));
+            rows.push(row);
+            if (row.unavailable || (row.valid && ['n', 'y'].includes(row.psd)))
+                break;
+            next = next.slice(1);
+        }
+    }
+    const available = rows.filter(row => row.valid);
+    const boundary = available.find(row => row.psd === 'n' || (row.psd === 'y' && row.owner !== domain));
+    const incomplete = rows.some(row => row.incomplete);
+    // An exact policy alone does not establish the organisational boundary.
+    const organisationalDomain = incomplete || (policyOnly && !['n', 'y'].includes(first.psd)) ? null
+        : boundary?.psd === 'y'
+            ? labels.slice(-(boundary.owner.split('.').length + 1)).join('.')
+            : boundary?.owner ?? available.at(-1)?.owner ?? domain;
+    return { rows, available, boundary, incomplete, organisationalDomain };
+}

package/lib/dns-convergence-review.mjs

@@ -1,14 +1,18 @@
 import { exactKeys, requireBoundedString, requireDomainName, requireIsoTimestamp, requireRecord, } from "./bounded-contract-normalizers.mjs";
 import { normaliseRdata } from "./zone-intent-review.mjs";
+import { dnsQueryState, normaliseDnsQueryCoverage } from "./dns-query-coverage.mjs";
 export const DNS_CONVERGENCE_INPUT_SCHEMA = 'whoisleuth.dns-convergence.input';
 export const DNS_CONVERGENCE_REVIEW_SCHEMA = 'whoisleuth.dns-convergence.review';
-export const DNS_CONVERGENCE_REVIEW_VERSION = 1;
+export const DNS_CONVERGENCE_INPUT_VERSION = 2;
+export const SUPPORTED_DNS_CONVERGENCE_INPUT_VERSIONS = Object.freeze([1, DNS_CONVERGENCE_INPUT_VERSION]);
+export const DNS_CONVERGENCE_REVIEW_VERSION = 2;
 export const MAX_DNS_CONVERGENCE_SNAPSHOTS = 100;
 export const MAX_DNS_CONVERGENCE_RECORDS = 2_000;
 const RECORD_TYPES = new Set(['A', 'AAAA', 'CAA', 'CNAME', 'MX', 'NS', 'SOA', 'SRV', 'SVCB', 'HTTPS', 'TLSA', 'TXT']);
 const ROOT_KEYS = new Set(['schema', 'version', 'domain', 'expected', 'snapshots']);
 const EXPECTED_KEYS = new Set(['owner', 'type', 'values']);
 const SNAPSHOT_KEYS = new Set(['observer', 'source', 'observedAt', 'state', 'records']);
+const COVERED_SNAPSHOT_KEYS = new Set([...SNAPSHOT_KEYS, 'queries']);
 const RECORD_KEYS = new Set(['owner', 'type', 'value', 'ttl']);
 function type(value, label) {
     const candidate = requireBoundedString(value, label, 16).toUpperCase();
@@ -83,8 +87,8 @@ function expectedRows(value, apex) {
 }
 export function reviewDnsConvergence(inputRaw, generatedAtValue = new Date().toISOString()) {
     const input = requireRecord(inputRaw, 'DNS convergence input');
-    if (input.schema !== DNS_CONVERGENCE_INPUT_SCHEMA || input.version !== 1) {
-        throw new TypeError(`DNS convergence input must use ${DNS_CONVERGENCE_INPUT_SCHEMA} version 1.`);
+    if (input.schema !== DNS_CONVERGENCE_INPUT_SCHEMA || !SUPPORTED_DNS_CONVERGENCE_INPUT_VERSIONS.includes(input.version)) {
+        throw new TypeError(`DNS convergence input must use ${DNS_CONVERGENCE_INPUT_SCHEMA} version 1 or ${DNS_CONVERGENCE_INPUT_VERSION}.`);
     }
     exactKeys(input, ROOT_KEYS, 'DNS convergence input');
     const apex = requireDomainName(input.domain, 'domain');
@@ -93,9 +97,10 @@ export function reviewDnsConvergence(inputRaw, generatedAtValue = new Date().toI
         throw new TypeError(`snapshots must contain between 2 and ${MAX_DNS_CONVERGENCE_SNAPSHOTS} entries.`);
     }
     let recordCount = 0;
+    let queryCount = 0;
     const snapshots = input.snapshots.map((raw, index) => {
         const item = requireRecord(raw, `snapshots[${index}]`);
-        exactKeys(item, SNAPSHOT_KEYS, `snapshots[${index}]`);
+        exactKeys(item, input.version === 1 ? SNAPSHOT_KEYS : COVERED_SNAPSHOT_KEYS, `snapshots[${index}]`);
         if (!Array.isArray(item.records))
             throw new TypeError(`snapshots[${index}].records must be an array.`);
         recordCount += item.records.length;
@@ -104,12 +109,20 @@ export function reviewDnsConvergence(inputRaw, generatedAtValue = new Date().toI
         const observationState = state(item.state, `snapshots[${index}].state`);
         if (observationState === 'unavailable' && item.records.length)
             throw new TypeError(`snapshots[${index}] cannot contain records when unavailable.`);
+        const records = Object.freeze(item.records.map((entry, recordIndex) => record(entry, apex, `snapshots[${index}].records[${recordIndex}]`)));
+        const queries = normaliseDnsQueryCoverage(item.queries, {
+            legacy: input.version === 1, label: `snapshots[${index}].queries`,
+            maximum: MAX_DNS_CONVERGENCE_RECORDS - queryCount, state: observationState, records,
+            owner: (value, label) => owner(value, apex, label), type,
+        });
+        queryCount += queries.length;
         return Object.freeze({
             observer: requireBoundedString(item.observer, `snapshots[${index}].observer`, 120),
             source: requireBoundedString(item.source, `snapshots[${index}].source`, 240),
             observedAt: requireIsoTimestamp(item.observedAt, `snapshots[${index}].observedAt`),
             state: observationState,
-            records: Object.freeze(item.records.map((entry, recordIndex) => record(entry, apex, `snapshots[${index}].records[${recordIndex}]`))),
+            records,
+            queries,
         });
     }).sort((left, right) => left.observedAt.localeCompare(right.observedAt) || left.observer.localeCompare(right.observer));
     const observers = [...new Set(snapshots.map((item) => item.observer))];
@@ -118,7 +131,7 @@ export function reviewDnsConvergence(inputRaw, generatedAtValue = new Date().toI
     const latestByObserver = observers.map((observer) => snapshots.filter((item) => item.observer === observer).at(-1));
     const keys = [...new Set([
             ...expected.map((item) => `${item.owner}\u0000${item.type}`),
-            ...snapshots.flatMap((item) => item.records.map((entry) => `${entry.owner}\u0000${entry.type}`)),
+            ...snapshots.flatMap((item) => item.queries.map((entry) => `${entry.owner}\u0000${entry.type}`)),
         ])].sort();
     const rows = keys.map((key) => {
         const [recordOwner = '', recordType = ''] = key.split('\u0000');
@@ -134,7 +147,7 @@ export function reviewDnsConvergence(inputRaw, generatedAtValue = new Date().toI
                 observer: snapshot.observer,
                 source: snapshot.source,
                 observedAt: snapshot.observedAt,
-                state: snapshot.state,
+                state: dnsQueryState(snapshot.queries, recordOwner, recordType),
                 values: Object.freeze(values),
                 cacheUntil,
             });
@@ -178,7 +191,7 @@ export function reviewDnsConvergence(inputRaw, generatedAtValue = new Date().toI
             'This local workbench compares only supplied observations and makes no DNS request.',
             'Resolver differences can reflect caches, split-horizon policy, interception, collection timing, or propagation; they do not establish which value is authoritative.',
             'Cache-until times are simple observation-time plus supplied TTL projections and do not reveal actual cache age, refresh behaviour, or resolver policy.',
-            'Partial and unavailable snapshots remain incomplete and are never interpreted as record absence.',
+            'Only an explicitly observed query can establish an empty answer. Unqueried, partial and unavailable record types are never interpreted as absence; legacy inputs establish scope only for their supplied records.',
         ]),
     });
 }

package/lib/dns-delegation-health.mjs

@@ -1,11 +1,12 @@
 // Bounded delegation-health evidence for deep single-domain Lookup. Registry
-// publication, recursive parent-view answers, and direct nameserver queries
+// publication, recursive resolver answers, and direct nameserver queries
 // remain separately attributed. The result never participates in registration
 // availability and never treats a failed query as record absence.
 import { promises as dns } from 'node:dns';
 import * as net from 'node:net';
 import { createObservation } from "../packages/evidence/observation.mjs";
-import { isValidAsciiHostname } from "./hostname.mjs";
+import { normalizeResolverMxRecord } from "../packages/evidence/domain-control-runtime.mjs";
+import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { isPrivateAddress } from "./safe-fetch.mjs";
 const DNS_DELEGATION_HEALTH_VERSION = 1;
 const MAX_AUTHORITIES = 4;
@@ -148,10 +149,9 @@ function normaliseAuthorityValueSet(type, value) {
         }
         const source = record(item);
         if (type === 'MX') {
-            const exchange = hostname(source.exchange);
-            const priority = Number(source.priority);
-            if (exchange && Number.isSafeInteger(priority) && priority >= 0 && priority <= 65_535)
-                return [`${priority} ${exchange}`];
+            const mx = normalizeResolverMxRecord(item);
+            if (mx)
+                return [`${mx.priority} ${mx.exchange}`];
             rejected += 1;
             return [];
         }
@@ -291,6 +291,7 @@ function finding(id, label, state, summary, detail, remediation) {
 function skippedDnsDelegationHealth(detail = 'Authoritative delegation checks were not collected for this lookup.') {
     return {
         delegationHealthVersion: DNS_DELEGATION_HEALTH_VERSION,
+        domain: null,
         ...createObservation({
             status: 'skipped',
             scanMode: 'deep',
@@ -326,9 +327,9 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
         ? parentQuery.status
         : 'error';
     const parentNameservers = hostnames(parentQuery.records);
-    const candidates = [...new Set([...parentNameservers, ...registry.nameservers])]
-        .sort()
-        .slice(0, MAX_AUTHORITIES);
+    const eligibleAuthorities = [...new Set([...parentNameservers, ...registry.nameservers])].sort();
+    const candidates = eligibleAuthorities.slice(0, MAX_AUTHORITIES);
+    const omittedAuthorityCount = eligibleAuthorities.length - candidates.length;
     const resolve4 = options.resolve4 || dns.resolve4;
     const resolve6 = options.resolve6 || dns.resolve6;
     const queryAuthority = options.queryAuthority || defaultAuthorityQuery;
@@ -464,8 +465,10 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             .filter((primary) => primary !== null))];
     const soaSerialConflict = soaSerials.length > 1;
     const soaPrimaryConflict = soaPrimaries.length > 1;
-    const inBailiwick = candidates.filter((nameserver) => (nameserver === domain || nameserver.endsWith(`.${domain}`)));
-    const missingGlue = inBailiwick.filter((nameserver) => (!(registry.nameserverDetails.find((item) => item.name === nameserver)?.addresses.length)));
+    const glueInventoryComplete = (parentStatus === 'success' && parentNameservers.length > 0 && parentQuery.truncated !== true)
+        || (registry.nameservers.length > 0 && !registry.truncated);
+    const inBailiwick = eligibleAuthorities.filter((nameserver) => (nameserver === domain || nameserver.endsWith(`.${domain}`)));
+    const unobservedGlue = inBailiwick.filter((nameserver) => (!(registry.nameserverDetails.find((item) => item.name === nameserver)?.addresses.length)));
     const dnssecMismatch = (registry.delegationSigned === true && registry.dsRecordCount === 0) || (registry.delegationSigned === false && registry.dsRecordCount > 0);
     const recordMatrix = authorityRecordMatrix(authorities);
     const recordCollectionAttempted = authorities.some((authority) => authority.recordSets.length > 0);
@@ -473,13 +476,13 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
     const recordPartial = recordMatrix.filter((row) => row.state === 'partial');
     const recordInsufficient = recordMatrix.filter((row) => row.state === 'insufficient');
     const findings = [
-        finding('parent_registry_ns', 'Parent and registry nameservers', !parentNameservers.length || !registry.nameservers.length
+        finding('parent_registry_ns', 'Recursive and registry nameservers', !parentNameservers.length || !registry.nameservers.length
             ? 'unknown'
             : sameSet(parentNameservers, registry.nameservers) ? 'healthy' : 'warning', !parentNameservers.length || !registry.nameservers.length
             ? 'Comparison is incomplete'
             : sameSet(parentNameservers, registry.nameservers)
-                ? 'Parent view and registry publication agree'
-                : 'Parent view and registry publication differ', `Parent view: ${parentNameservers.join(', ') || 'unavailable'}. Registry publication: ${registry.nameservers.join(', ') || 'unavailable'}.`, 'Confirm the intended delegation with the registry and DNS operator before changing nameservers.'),
+                ? 'Recursive observation and registry publication agree'
+                : 'Recursive observation and registry publication differ', `Recursive resolver: ${parentNameservers.join(', ') || 'unavailable'}. Registry publication: ${registry.nameservers.join(', ') || 'unavailable'}.`, 'Confirm the intended delegation with the registry and DNS operator before changing nameservers.'),
         finding('authority_reachability', 'Direct nameserver reachability', lameAuthorities.length ? 'danger'
             : partialAuthorities.length || unreachableAuthorities.length ? 'warning'
                 : successfulAuthorities.length ? 'healthy' : 'unknown', lameAuthorities.length
@@ -496,7 +499,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             ? 'No direct authority answer was available'
             : inconsistentAuthoritySets
                 ? 'Direct nameserver answers are inconsistent'
-                : 'Direct nameserver answers agree with the observed parent view', successfulAuthorities.map((authority) => `${authority.nameserver}: ${authority.nameservers.join(', ') || 'no NS answer'}`).join(' | ') || 'No direct answers.', 'Align the NS set served by every authority with the intended parent delegation before cutover.'),
+                : 'Direct nameserver answers agree with the recursive observation', successfulAuthorities.map((authority) => `${authority.nameserver}: ${authority.nameservers.join(', ') || 'no NS answer'}`).join(' | ') || 'No direct answers.', 'Align the NS set served by every authority with the intended parent delegation before cutover.'),
         finding('authority_soa_consistency', 'Authoritative SOA consistency', retainedSoa.length < 2 || soaSerials.length < 1 || soaPrimaries.length < 1
             ? 'unknown'
             : soaSerialConflict || soaPrimaryConflict ? 'warning' : 'healthy', retainedSoa.length < 2
@@ -506,11 +509,13 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 : soaPrimaryConflict
                     ? 'Authoritative servers published different SOA primary nameservers'
                     : 'Observed authority SOA serials and primary nameservers agree', retainedSoa.map((entry) => (`${entry.nameserver}: serial ${entry.soa.serial ?? 'unavailable'}, primary ${entry.soa.nsname ?? 'unavailable'}, refresh ${entry.soa.refresh ?? 'unavailable'}, retry ${entry.soa.retry ?? 'unavailable'}, expire ${entry.soa.expire ?? 'unavailable'}`)).join(' | ') || 'No complete SOA observation was available.', 'Confirm zone propagation and the intended SOA primary before relying on a DNS change or secondary-server state.'),
-        finding('in_bailiwick_glue', 'In-bailiwick glue', !inBailiwick.length ? 'healthy' : missingGlue.length ? 'warning' : 'healthy', !inBailiwick.length
-            ? 'No in-bailiwick nameserver requires registry glue'
-            : missingGlue.length
-                ? 'Registry glue was not observed for every in-bailiwick nameserver'
-                : 'Registry publication includes observed glue for each in-bailiwick nameserver', missingGlue.length ? `Missing observed glue: ${missingGlue.join(', ')}.` : `In-bailiwick nameservers: ${inBailiwick.join(', ') || 'none'}.`, 'Publish current A and AAAA glue at the registry for every in-bailiwick nameserver.'),
+        finding('in_bailiwick_glue', 'In-bailiwick glue', !glueInventoryComplete || unobservedGlue.length ? 'unknown' : 'healthy', !glueInventoryComplete
+            ? 'The delegated nameserver inventory is unavailable or incomplete'
+            : !inBailiwick.length
+                ? 'No in-bailiwick nameserver requires registry glue'
+                : unobservedGlue.length
+                    ? 'Registry address publication does not establish glue for every in-bailiwick nameserver'
+                    : 'Registry publication includes observed glue for each in-bailiwick nameserver', unobservedGlue.length ? `No address publication retained for: ${unobservedGlue.join(', ')}. Optional RDAP address fields and recursive NS answers do not establish that parent-zone glue is absent.` : `In-bailiwick nameservers: ${inBailiwick.join(', ') || 'none'}.`, 'Verify parent-zone glue with the registry or DNS operator before deciding whether an update is needed.'),
         finding('dnssec_delegation', 'DNSSEC delegation publication', dnssecMismatch ? 'warning'
             : registry.delegationSigned === null && registry.dsRecordCount === 0 ? 'unknown' : 'healthy', dnssecMismatch
             ? 'Registry DNSSEC fields are internally inconsistent'
@@ -530,6 +535,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
     ];
     const collectionIncomplete = parentStatus !== 'success'
         || candidates.length === 0
+        || omittedAuthorityCount > 0
         || parentQuery.truncated === true
         || registry.truncated
         || authorities.some((authority) => authority.state !== 'success')
@@ -540,6 +546,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
     const observedAt = (options.observedAt || (() => new Date().toISOString()))();
     return {
         delegationHealthVersion: DNS_DELEGATION_HEALTH_VERSION,
+        domain,
         ...createObservation({
             status,
             observedAt,
@@ -549,9 +556,13 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             complete: !collectionIncomplete,
             truncated: parentQuery.truncated === true
                 || registry.truncated
+                || omittedAuthorityCount > 0
                 || (recordCollectionAttempted && recordMatrix.some((row) => row.observations.some((item) => item.truncated))),
             limitations: [
-                'The parent nameserver set is a point-in-time recursive resolver view; registry nameservers and glue come from the separately attributed RDAP publication.',
+                'The initial nameserver set comes from a recursive resolver, not a direct parent-server query; registry nameservers and glue come from the separately attributed RDAP publication.',
+                ...(omittedAuthorityCount > 0
+                    ? [`${candidates.length} of ${eligibleAuthorities.length} eligible nameservers were selected; ${omittedAuthorityCount} were not queried.`]
+                    : []),
                 'Direct queries use at most four selected nameservers and two validated public addresses per nameserver.',
                 'Extended A, AAAA, CAA, and MX comparison uses only one selected validated public address per nameserver and caps each record set at sixteen values.',
                 'A direct answer does not prove global reachability, and a failed query is not evidence that the record is absent.',
@@ -563,6 +574,9 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             ],
             diagnostics: {
                 authorityCount: authorities.length,
+                eligibleAuthorityCount: eligibleAuthorities.length,
+                queriedAuthorityCount: authorities.filter((authority) => authority.attempts.length > 0).length,
+                omittedAuthorityCount,
                 queriedAddressCount: authorities.reduce((sum, authority) => sum + authority.attempts.length, 0),
                 successfulAuthorityCount: successfulAuthorities.length,
                 partialAuthorityCount: partialAuthorities.length,
@@ -576,7 +590,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             ? 'The bounded delegation-health collection completed.'
             : status === 'partial'
                 ? 'The delegation-health collection is partial; review each source state before changing DNS.'
-                : 'The delegation-health collection could not confirm a parent or direct authority view.',
+                : 'The delegation-health collection could not confirm a recursive or direct authority observation.',
         parent: {
             state: parentStatus,
             nameservers: parentNameservers,