@slicedearth/whoisleuth-cli 2.5.1 → 2.6.0

package/docs/offline-intake-context.md

@@ -0,0 +1,213 @@
+# Selected-input indicators and internal containment
+
+Message intake remains local and inert. It does not resolve indicators, open
+links, consult reputation services, execute attachments or apply controls.
+
+## Source-linked indicator review
+
+Version 2 of `whoisleuth.message-intake` adds literal IPv4/IPv6 observations and
+explicitly labelled MD5, SHA-1 and SHA-256 strings from selected plain text,
+message body text, supported calendar fields and extracted document text.
+Private and reserved addresses are valid textual observations, not permission
+to contact them. A labelled hash string is a supplied claim, not proof that a
+file has that digest. Bare opaque hexadecimal values are not interpreted.
+
+Each indicator identifies its input/message/document part and page when known.
+The review retains the source-byte and part digests separately. Identical values
+from different parts remain separately attributed; repeated identical values
+within one part are deduplicated. The UI can copy a source citation. Indicators
+are not added to Lookup targets and do not become a risk score or finding.
+
+Complete URL spans, address local parts, recognised credential-bearing lines,
+message headers and QR payloads are not scanned for indicators. MIME HTML
+extraction also excludes script and style nodes. Explicit plaintext is literal
+supplied text: an IP inside a pasted code snippet can be an inert observation;
+the code is never executed. Phone candidates have their own stricter markup
+exclusions. HAR and identity-event imports keep their existing restricted
+projections: no broad scan of their original fields occurs. Extraction is
+limited to 512 observations, 4,096 candidate checks and 2,097,152 text code
+units across an input. Reached bounds are partial coverage, never proof that
+no further indicators exist.
+
+Version-1 reports remain readable without invented indicator coverage. Their
+original source digests do not acquire new observations retrospectively.
+
+### Supplied phone candidates
+
+Plain-text intake can also identify possible telephone numbers, including a
+support number in a supplied snippet with no link. Candidates are review leads:
+they do not authenticate a caller, identify an operator or establish wrongdoing.
+No number is dialled, resolved or checked against a reputation service.
+
+Review and select each observation deliberately before including it in a saved
+review. Unselected candidates remain transient. The selected observation keeps
+its original spelling, source digest and exact text range, not the surrounding
+snippet. Text ranges use zero-based, end-exclusive UTF-16 code-unit offsets;
+supplementary characters occupy two units. A declared source time is separate
+from the local review time. Identify manual transcription or OCR-derived text
+when that is how the supplied text was obtained.
+
+The browser provides a shared declaration for selected occurrences. Open
+**Declaration for candidate** to override a source label, role, observation time
+or text basis for one occurrence. Apply or clear edits before saving or
+downloading; only equivalent numbers with equivalent declarations share a group.
+
+An advertised support contact and a sender or caller-ID claim describe different
+roles; neither verifies ownership. International formatting can be compared only
+where its prefix and supported separators permit a defensible normalisation.
+National-format numbers, conflicting country context and unsupported characters
+remain uncertain. Extensions are separate, not appended to the destination.
+Dates, identifiers and unsupported forms must not be treated as verified numbers.
+
+Selected numbers can still be private contacts. Review the selected content
+before saving or sharing it. Ordinary public/trusted Case projections do not
+include the private intake attachment; domain-focused interchange does not invent
+a telephone mapping. A missing exported phone observation is not evidence that
+none was supplied.
+
+### Compare a displayed claim with a supplied destination
+
+Use the intake's manual destination comparison when supplied ad, search or
+screenshot material shows one destination and a separate source supplies another.
+Identify each source, any known observation time, and whether its text is a claim,
+transcription or supplied observation. The comparison uses the same safe hostname
+parsing as an HTML link's displayed-host comparison.
+
+Review the exact hostname and registrable boundary. A hostname such as
+`store.example.test.attacker.invalid` is not `store.example.test`. Legitimate
+tracking destinations can also differ. Missing, malformed or credential-bearing
+input leaves insufficient evidence rather than inventing a redirect chain.
+
+Exact entered URLs stay in the private transient view. Retained output uses the
+minimised hostname/origin projection and supplied qualifications, not private
+paths, query values or fragments. Comparing the pair never follows either URL
+and does not establish that a redirect occurred.
+
+## Optional distribution declarations
+
+After reviewing input in Lookup or a Case, open **Declare distribution
+context**. Supply a channel, non-sensitive source label and optional declared
+time, reference, observer and vantage labels. Apply or clear changed declarations
+before saving or downloading. These are analyst claims, not verified delivery,
+capture conditions, network location or independent collection. The local review
+time remains separate from a declared observation time.
+
+The CLI accepts the same explicit declaration:
+
+```sh
+whoisleuth intake text selected.txt --intake-context context.json --json
+```
+
+```json
+{
+  "schema": "whoisleuth.intake-context",
+  "version": 1,
+  "context": {
+    "channel": "sms",
+    "observedAt": "2026-01-02T03:04:05.000Z",
+    "sourceLabel": "Reported message",
+    "reference": "CASE-17",
+    "observerLabel": "Reviewer A",
+    "vantageLabel": "Selected device"
+  }
+}
+```
+
+The separate context file is limited to 8 KiB; stdin is not accepted for it.
+Use `null` for unknown optional values. Channels are `email`, `sms`, `messaging`,
+`social`, `advertisement`, `website`, `document`, `other` and `unknown`.
+Do not supply credentials, recipients, personal account identifiers or exact
+URLs in labels. All declarations are included in the downloaded or deliberately
+retained review. The Case summary pin contains counts and the report identity,
+not the indicator values or declaration text. Retaining original input remains
+a separate choice.
+
+### Select phone observations in the CLI
+
+First run `whoisleuth intake text selected.txt --json`. Standard error shows a
+candidate count, the full source digest, UTF-16 ranges and uncertainty, but not
+the numbers themselves. JSON output excludes unselected candidates. `--quiet`
+suppresses this discovery guidance. Inspect the corresponding text in your
+selected file before choosing a range.
+
+A version-2 context file binds selections to those exact input bytes. For
+example, a file containing `Support: +1 202 555 0107` followed by one LF newline
+has this selection:
+
+```json
+{
+  "schema": "whoisleuth.intake-context",
+  "version": 2,
+  "context": null,
+  "review": {
+    "sourceDigestSha256": "sha256:4ff4224ff4ed496fb67fa2ccb25f87b284d1d291f8e79b57646d6c32700eeb52",
+    "phones": [{
+      "start": 9,
+      "end": 24,
+      "declaration": {
+        "sourceLabel": "Selected support snippet",
+        "observedAt": null,
+        "basis": "supplied_text",
+        "role": "advertised_support_contact",
+        "countryCallingCode": null
+      }
+    }],
+    "destinationPair": null
+  }
+}
+```
+
+Run the earlier `--intake-context context.json` command to include that selected
+observation. A changed file or incorrect range is rejected; obtain its current
+digest and review it again. `context` can also carry the existing distribution
+declaration. Version-1 context files remain supported.
+
+## Selected internal containment handoff
+
+In **Case → Response → Account and device recovery**, open **Prepare an internal
+containment handoff**. Select retained next-step assertions and, independently,
+their linked evidence pins. Choose security operations, identity response,
+endpoint response or network response for tailored review guidance.
+
+The preview displays the selected statements, rationale, recorded state,
+times, pin values and source metadata. **Exact JSON disclosure** exposes the
+complete download, including selected pin scope, provenance and recheck fields.
+Supports, contradicts, unresolved and
+unrecorded relationships remain distinct. A linked pin that is not selected is
+not silently included; an unavailable referenced pin remains unavailable.
+The handoff is limited to 20 requests, 40 pins and 128 KiB, with no silent
+truncation. No original file bytes or unrelated Case notes, title, contacts,
+recipient values, assertions or pins are included.
+
+Review the audience disclosure before copy, download or explicit retention.
+Internal and trusted audiences use the existing Case disclosure policy. Public
+preview excludes internal requests and supporting pins and cannot produce a
+containment export. Selected analyst text may still be sensitive: minimisation
+does not provide anonymisation. Saving uses an ordinary retained Case file and
+a source-hashed summary pin, not another task or state store.
+
+The existing `review-evidence` CLI command accepts an equivalent selected input:
+
+```json
+{
+  "schema": "whoisleuth.internal-containment.input",
+  "version": 1,
+  "caseExport": { "version": 18, "cases": [] },
+  "caseId": "selected-case-id",
+  "selection": {
+    "audience": "internal",
+    "recipientRole": "identity_response",
+    "assertionIds": ["selected-next-step-id"],
+    "evidencePinIds": ["selected-linked-pin-id"]
+  },
+  "disclosureReviewed": true
+}
+```
+
+Replace the empty example with a supported ordinary Case export and exact
+retained IDs after reviewing its selected content. The CLI does not write the
+Case; `--strict-exit` returns 4 when selected supporting context is incomplete.
+Output uses `whoisleuth.internal-containment` version 1 inside the existing
+offline-review envelope. Neither external resolution nor a resolved Case closes
+an open internal request. The handoff performs no assignment, notification,
+blocking, credential change, isolation or other containment action.

package/lib/credential-form-attribution.mjs

@@ -0,0 +1,136 @@
+import { classifyStaticCredentialInput, staticControlDisabled, MAX_STATIC_FORMS, MAX_STATIC_INPUTS, } from "./static-html-analysis.mjs";
+import { CREDENTIAL_CATEGORY_NAMES, MAX_FORM_DESTINATIONS, } from "../packages/evidence/credential-form-attribution.mjs";
+const attribute = (element, name) => element.attributes.find(item => item.name === name)?.value;
+/** HTML Auto buttons submit only without command attributes or a select parent. */
+export function staticControlIsSubmitter(element, parent) {
+    const type = (attribute(element, 'type') ?? '').toLowerCase();
+    if (element.name === 'input')
+        return type === 'submit' || type === 'image';
+    if (element.name !== 'button')
+        return false;
+    if (type === 'submit')
+        return true;
+    if (type === 'button' || type === 'reset')
+        return false;
+    return attribute(element, 'command') === undefined && attribute(element, 'commandfor') === undefined
+        && !(parent?.html && parent.name === 'select');
+}
+// Uses the existing bounded, inert-template-free tree. IDs and control values
+// are transient association inputs; only ordinal forms and fixed categories
+// leave this projection.
+export function attributeCredentialForms(analysis, documentUrl, sourceTruncated = false) {
+    const elements = analysis.elements;
+    const firstId = new Map();
+    const firstLegends = new Map();
+    let firstUncertainId = Number.POSITIVE_INFINITY;
+    const formIndices = [];
+    let complete = !sourceTruncated && !analysis.inputLimitReached && !analysis.tagLimitReached && !analysis.forms.truncated;
+    for (const [index, element] of elements.entries()) {
+        if (element.attributesTruncated && attribute(element, 'id') === undefined)
+            firstUncertainId = Math.min(firstUncertainId, index);
+        const id = attribute(element, 'id');
+        if (id !== undefined && id.length <= 4096 && !firstId.has(id))
+            firstId.set(id, index);
+        if (element.html && element.name === 'form') {
+            if (formIndices.length < MAX_STATIC_FORMS)
+                formIndices.push(index);
+            else
+                complete = false;
+        }
+        if (element.html && element.name === 'legend' && element.parent !== null && !firstLegends.has(element.parent))
+            firstLegends.set(element.parent, index);
+    }
+    const ancestor = (index, name) => {
+        for (let parent = elements[index]?.parent ?? null; parent !== null; parent = elements[parent]?.parent ?? null) {
+            const element = elements[parent];
+            if (element.html && element.name === name)
+                return parent;
+        }
+        return null;
+    };
+    const owner = (index) => {
+        const element = elements[index];
+        if (element.attributesTruncated)
+            return null;
+        for (let parent = element.parent; parent !== null; parent = elements[parent]?.parent ?? null) {
+            if (elements[parent]?.name === 'fieldset' && elements[parent]?.attributesTruncated)
+                return null;
+        }
+        const explicit = attribute(element, 'form');
+        if (explicit !== undefined) {
+            const selected = firstId.get(explicit);
+            // A clipped earlier ID could shadow this form in the browser's first-ID
+            // lookup. Do not attribute its controls to the later retained match.
+            return selected !== undefined && selected < firstUncertainId && elements[selected]?.html && elements[selected]?.name === 'form' ? selected : null;
+        }
+        return ancestor(index, 'form');
+    };
+    const destination = (form, submitter) => {
+        const method = (submitter && attribute(submitter, 'formmethod')) ?? attribute(form, 'method') ?? 'get';
+        if (method.toLowerCase() === 'dialog')
+            return { relationship: 'no_submission', origin: null };
+        if (form.attributesTruncated || submitter?.attributesTruncated)
+            return { relationship: 'unknown', origin: null };
+        const action = (submitter && attribute(submitter, 'formaction')) ?? attribute(form, 'action');
+        if (action !== undefined && (action.length > 4096 || /[\u0000-\u001f\u007f]/u.test(action)))
+            return { relationship: 'unknown', origin: null };
+        try {
+            const source = new URL(documentUrl);
+            // Missing/empty actions use the document URL, not the <base> URL.
+            if (action?.trim() && analysis.baseHrefState === 'invalid')
+                return { relationship: 'unknown', origin: null };
+            const target = new URL(action?.trim() || documentUrl, analysis.effectiveBaseUrl ?? documentUrl);
+            if (!['http:', 'https:'].includes(target.protocol) || target.username || target.password || target.origin.length > 320)
+                return { relationship: 'unknown', origin: null };
+            return { relationship: target.origin === source.origin ? 'same_origin' : 'external', origin: target.origin };
+        }
+        catch {
+            return { relationship: 'unknown', origin: null };
+        }
+    };
+    const forms = formIndices.map((index, ordinal) => ({
+        index: ordinal + 1,
+        categories: Object.fromEntries(CREDENTIAL_CATEGORY_NAMES.map(name => [name, 0])),
+        destinations: [destination(elements[index])],
+    }));
+    const formRows = new Map(formIndices.map((index, ordinal) => [index, forms[ordinal]]));
+    let unassociatedInputs = 0;
+    let controls = 0;
+    for (const [index, element] of elements.entries()) {
+        if (!element.html || !['input', 'button'].includes(element.name))
+            continue;
+        if (++controls > MAX_STATIC_INPUTS) {
+            complete = false;
+            break;
+        }
+        if (staticControlDisabled(elements, index, firstLegends))
+            continue;
+        const categories = element.name === 'input' ? classifyStaticCredentialInput(element.attributes) : { values: [], truncated: false };
+        if (categories.truncated || element.attributesTruncated)
+            complete = false;
+        const ownerIndex = owner(index);
+        const row = ownerIndex === null ? undefined : formRows.get(ownerIndex);
+        if (categories.values.length) {
+            if (!row) {
+                unassociatedInputs++;
+                complete = false;
+            }
+            else
+                for (const category of categories.values)
+                    row.categories[category]++;
+        }
+        const submitter = staticControlIsSubmitter(element, element.parent === null ? undefined : elements[element.parent]);
+        if (row && ownerIndex !== null && submitter && (attribute(element, 'formaction') !== undefined || attribute(element, 'formmethod') !== undefined)) {
+            const next = destination(elements[ownerIndex], element);
+            if (!row.destinations.some(value => value.relationship === next.relationship && value.origin === next.origin)) {
+                if (row.destinations.length >= MAX_FORM_DESTINATIONS)
+                    complete = false;
+                else
+                    row.destinations.push(next);
+            }
+        }
+    }
+    if (forms.some(form => form.destinations.some(value => value.relationship === 'unknown')))
+        complete = false;
+    return { forms, unassociatedInputs, complete };
+}

package/lib/credential-surface-profile.mjs

@@ -5,22 +5,25 @@
 // never enter this profile.
 import { createObservation } from "../packages/evidence/observation.mjs";
 import { CREDENTIAL_SURFACE_PROFILE_VERSION } from "./lookup-child-profile-contract.mjs";
+import { attributeCredentialForms } from "./credential-form-attribution.mjs";
 import { MAX_STATIC_FORMS, MAX_STATIC_INPUTS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 function analyzeCredentialSurfaceProfile(input = {}) {
     const htmlAnalysis = input.htmlAnalysis ?? analyzeStaticHtml(input.html, { baseUrl: input.baseUrl });
     const forms = htmlAnalysis.forms;
+    const formAttribution = input.formAttribution ?? attributeCredentialForms(htmlAnalysis, typeof input.baseUrl === 'string' ? input.baseUrl : '', input.sourceTruncated === true);
     const sourceTruncated = input.sourceTruncated === true;
     const truncated = sourceTruncated
         || htmlAnalysis.inputLimitReached
         || htmlAnalysis.tagLimitReached
         || forms.truncated;
     const unclassifiedActions = forms.actions.unclassified;
-    const partial = truncated || unclassifiedActions > 0;
+    const partial = truncated || unclassifiedActions > 0 || !formAttribution.complete;
     const limitations = [
         'Static input categories use only bounded type and autocomplete declarations; JavaScript-rendered, non-semantic, disabled, and hidden controls are not classified.',
         'Category counts can overlap when one input declares more than one recognised purpose.',
         'External submission can be legitimate and does not establish phishing, unsafe handling, ownership, intent, or maliciousness.',
-        'No field names, values, labels, placeholders, complete action URLs, paths, queries, fragments, or arbitrary attributes are retained.',
+        'Only form ordinals, input-purpose counts and declared destination origins are retained; no field names, values, labels, placeholders, URL paths, queries or fragments.',
+        'Declared destinations, including submitter overrides, are not observed submissions. Script-created or changed forms are not evaluated.',
     ];
     if (sourceTruncated || htmlAnalysis.inputLimitReached) {
         limitations.push('The captured homepage body was truncated, so credential-surface evidence may be incomplete.');
@@ -36,6 +39,7 @@ function analyzeCredentialSurfaceProfile(input = {}) {
     }
     return {
         credentialSurfaceVersion: CREDENTIAL_SURFACE_PROFILE_VERSION,
+        formAttribution,
         ...createObservation({
             status: partial ? 'partial' : 'success',
             observedAt: input.observedAt,

package/lib/dns-delegation-health.mjs

@@ -99,15 +99,19 @@ function withTimeout(promise, timeoutMs) {
     });
 }
 async function defaultAuthorityQuery(input) {
+    input.signal?.throwIfAborted();
     const resolver = new dns.Resolver({
         timeout: Math.max(250, Math.min(input.timeoutMs, DNS_DELEGATION_TIMEOUT_MS)),
         tries: 1,
     });
     resolver.setServers([net.isIP(input.address) === 6 ? `[${input.address}]:53` : input.address]);
+    const cancelled = () => resolver.cancel();
+    input.signal?.addEventListener('abort', cancelled, { once: true });
     const [nameservers, soa] = await Promise.allSettled([
         resolver.resolveNs(input.domain),
         resolver.resolveSoa(input.domain),
-    ]);
+    ]).finally(() => { input.signal?.removeEventListener('abort', cancelled); resolver.cancel(); });
+    input.signal?.throwIfAborted();
     const reason = nameservers.status === 'rejected'
         ? nameservers.reason
         : soa.status === 'rejected'
@@ -188,18 +192,21 @@ function normaliseAuthorityValues(type, value) {
     return normaliseAuthorityValueSet(type, value).values;
 }
 async function defaultAuthorityRecordQuery(input) {
+    input.signal?.throwIfAborted();
     const resolver = new dns.Resolver({
         timeout: Math.max(250, Math.min(input.timeoutMs, DNS_DELEGATION_TIMEOUT_MS)),
         tries: 1,
     });
     resolver.setServers([net.isIP(input.address) === 6 ? `[${input.address}]:53` : input.address]);
+    const cancelled = () => resolver.cancel();
+    input.signal?.addEventListener('abort', cancelled, { once: true });
     const queries = [
         ['A', resolver.resolve4(input.domain)],
         ['AAAA', resolver.resolve6(input.domain)],
         ['CAA', resolver.resolveCaa(input.domain)],
         ['MX', resolver.resolveMx(input.domain)],
     ];
-    return Promise.all(queries.map(async ([type, promise]) => {
+    const result = await Promise.all(queries.map(async ([type, promise]) => {
         try {
             const response = await withTimeout(promise, input.timeoutMs);
             const normalised = normaliseAuthorityValueSet(type, response);
@@ -224,7 +231,9 @@ async function defaultAuthorityRecordQuery(input) {
                 discarded: 0,
             };
         }
-    }));
+    })).finally(() => { input.signal?.removeEventListener('abort', cancelled); resolver.cancel(); });
+    input.signal?.throwIfAborted();
+    return result;
 }
 function authorityRecordMatrix(authorities) {
     const types = ['A', 'AAAA', 'CAA', 'MX'];
@@ -318,6 +327,7 @@ function skippedDnsDelegationHealth(detail = 'Authoritative delegation checks we
     };
 }
 async function collectDnsDelegationHealth(domainValue, parentQueryValue, options = {}) {
+    options.signal?.throwIfAborted();
     const domain = hostname(domainValue);
     if (!domain)
         return skippedDnsDelegationHealth('The domain was not eligible for authoritative delegation checks.');
@@ -338,7 +348,8 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
     const timeoutMs = Math.max(250, Math.min(5000, Number(options.timeoutMs) || DNS_DELEGATION_TIMEOUT_MS));
     const now = options.now || Date.now;
     const started = now();
-    const authorities = await Promise.all(candidates.map(async (nameserver) => {
+    const pending = candidates.map(async (nameserver) => {
+        options.signal?.throwIfAborted();
         const glue = registry.nameserverDetails.find((item) => item.name === nameserver)?.addresses ?? [];
         const resolved = glue.length
             ? glue
@@ -350,10 +361,11 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 : [])
                 .map(publicAddress)
                 .filter((address) => address !== null);
+        options.signal?.throwIfAborted();
         const addresses = [...new Set(resolved)].slice(0, MAX_AUTHORITY_ADDRESSES);
         const attempts = await Promise.all(addresses.map(async (address) => {
             try {
-                const raw = await withTimeout(queryAuthority({ domain, nameserver, address, timeoutMs }), timeoutMs);
+                const raw = await withTimeout(queryAuthority({ domain, nameserver, address, timeoutMs, ...(options.signal ? { signal: options.signal } : {}) }), timeoutMs);
                 const query = record(raw);
                 const code = boundedText(query.errorCode, 40);
                 const error = boundedText(query.error, MAX_ERROR_LENGTH);
@@ -384,6 +396,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 };
             }
         }));
+        options.signal?.throwIfAborted();
         const successful = attempts.find((attempt) => attempt.state === 'success');
         const partial = attempts.find((attempt) => attempt.state === 'partial');
         const retained = successful ?? partial;
@@ -391,7 +404,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
         const recordAddress = retained?.address ?? addresses[0];
         if (queryAuthorityRecords && recordAddress) {
             try {
-                recordSets = (await withTimeout(queryAuthorityRecords({ domain, nameserver, address: recordAddress, timeoutMs }), timeoutMs))
+                recordSets = (await withTimeout(queryAuthorityRecords({ domain, nameserver, address: recordAddress, timeoutMs, ...(options.signal ? { signal: options.signal } : {}) }), timeoutMs))
                     .filter((item) => ['A', 'AAAA', 'CAA', 'MX'].includes(item.type))
                     .slice(0, 4)
                     .map((item) => {
@@ -428,6 +441,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 }));
             }
         }
+        options.signal?.throwIfAborted();
         return {
             nameserver,
             addressSource: glue.length ? 'registry_glue' : 'recursive_address',
@@ -445,7 +459,9 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             recordSets,
             attempts,
         };
-    }));
+    });
+    const authorities = await Promise.all(pending).finally(() => Promise.allSettled(pending));
+    options.signal?.throwIfAborted();
     const successfulAuthorities = authorities.filter((authority) => authority.state === 'success');
     const partialAuthorities = authorities.filter((authority) => authority.state === 'partial');
     const lameAuthorities = authorities.filter((authority) => authority.state === 'lame');

package/lib/dns-intelligence.mjs

@@ -416,6 +416,7 @@ function observedPresence(result) {
     return result.records.length > 0 ? true : completeQuery(result) ? false : null;
 }
 async function collectEffectiveCaaPolicy(domain, options = {}) {
+    options.signal?.throwIfAborted();
     const normalizedDomain = normalizeHostname(domain);
     const queryLimit = Math.max(1, Math.min(MAX_CAA_TREE_QUERIES, Math.floor(options.queryLimit || MAX_CAA_TREE_QUERIES)));
     const now = options.now || Date.now;
@@ -455,9 +456,11 @@ async function collectEffectiveCaaPolicy(domain, options = {}) {
     const timeoutMs = options.timeoutMs || DNS_TIMEOUT_MS;
     const queries = [];
     for (const [index, owner] of owners.entries()) {
+        options.signal?.throwIfAborted();
         const result = index === 0 && options.directResult
             ? options.directResult
             : await query(() => resolver(owner), normalizeCaa, timeoutMs);
+        options.signal?.throwIfAborted();
         queries.push({
             owner,
             status: result.status,
@@ -582,6 +585,7 @@ async function collectEffectiveCaaPolicy(domain, options = {}) {
     };
 }
 async function collectDnsIntelligence(domain, options = {}) {
+    options.signal?.throwIfAborted();
     const registrationDomain = options.registrationDomain ?? domain;
     if (options.registrationDomain !== undefined && canonicalRegistrableDomain(domain) !== registrationDomain) {
         throw new TypeError('DNS registration context must match the hostname being observed.');
@@ -592,7 +596,10 @@ async function collectDnsIntelligence(domain, options = {}) {
     const timeoutMs = options.timeoutMs || DNS_TIMEOUT_MS;
     const now = options.now || Date.now;
     const started = now();
-    const invoke = (name, fallback, value = domain) => () => (resolvers[name] || fallback)(value);
+    const invoke = (name, fallback, value = domain) => () => {
+        options.signal?.throwIfAborted();
+        return (resolvers[name] || fallback)(value);
+    };
     const aPromise = query(invoke('resolve4', dns.resolve4), (records) => normalizeAddresses(records, 4), timeoutMs);
     const aaaaPromise = query(invoke('resolve6', dns.resolve6), (records) => normalizeAddresses(records, 6), timeoutMs);
     const cnamePromise = query(invoke('resolveCname', dns.resolveCname), normalizeHostnames, timeoutMs);
@@ -607,6 +614,7 @@ async function collectDnsIntelligence(domain, options = {}) {
             directResult,
             timeoutMs,
             now,
+            ...(options.signal ? { signal: options.signal } : {}),
             ...(options.observedAt ? { observedAt: options.observedAt } : {}),
         }))
         : Promise.resolve(null);
@@ -614,7 +622,7 @@ async function collectDnsIntelligence(domain, options = {}) {
         ? query(invoke('resolveSoa', dns.resolveSoa), normalizeSoa, timeoutMs)
         : Promise.resolve(null);
     const httpsPromise = includeExtendedContext
-        ? query(invoke('resolveHttps', (value) => resolveServiceBindingRecords(value, 'HTTPS', { timeoutMs })), normalizeServiceBindings, timeoutMs)
+        ? query(invoke('resolveHttps', (value) => resolveServiceBindingRecords(value, 'HTTPS', { timeoutMs, ...(options.signal ? { signal: options.signal } : {}) })), normalizeServiceBindings, timeoutMs)
         : Promise.resolve(null);
     const registrationNsPromise = includeExtendedContext && registrationDomain !== domain
         ? query(invoke('resolveNs', dns.resolveNs, registrationDomain), normalizeHostnames, timeoutMs)
@@ -627,10 +635,11 @@ async function collectDnsIntelligence(domain, options = {}) {
             ...(options.queryAuthority ? { queryAuthority: options.queryAuthority } : {}),
             timeoutMs,
             now,
+            ...(options.signal ? { signal: options.signal } : {}),
             ...(options.observedAt ? { observedAt: options.observedAt } : {}),
         }))
         : Promise.resolve(null);
-    const [a, aaaa, cname, ns, mx, spf, dmarc, caa, caaPolicy, soa, https, delegation] = await Promise.all([
+    const pending = [
         aPromise,
         aaaaPromise,
         cnamePromise,
@@ -643,7 +652,12 @@ async function collectDnsIntelligence(domain, options = {}) {
         soaPromise,
         httpsPromise,
         delegationPromise,
-    ]);
+    ];
+    // A rejected continuation must not release the lookup while sibling queries
+    // are still running. Their existing bounded resolver deadlines remain active.
+    const [a, aaaa, cname, ns, mx, spf, dmarc, caa, caaPolicy, soa, https, delegation] = await Promise.all(pending)
+        .finally(() => Promise.allSettled(pending));
+    options.signal?.throwIfAborted();
     const queries = {
         a, aaaa, cname, ns, mx, spf, dmarc, caa,
         ...(soa ? { soa } : {}),