dns-security-mcp 0.1.0

package/dist/dnssec/index.js

@@ -0,0 +1,1377 @@
+import { z } from "zod";
+import { text } from "../types/index.js";
+import { queryRaw } from "../utils/dns-client.js";
+// ─── Constants ───
+const DEFAULT_RESOLVER = "8.8.8.8";
+const ALGORITHM_NAMES = {
+    1: "RSA/MD5",
+    3: "DSA",
+    5: "RSASHA1",
+    6: "DSA-NSEC3-SHA1",
+    7: "RSASHA1-NSEC3-SHA1",
+    8: "RSASHA256",
+    10: "RSASHA512",
+    12: "ECC-GOST",
+    13: "ECDSAP256SHA256",
+    14: "ECDSAP384SHA384",
+    15: "ED25519",
+    16: "ED448",
+};
+const DEPRECATED_ALGORITHMS = new Set([1, 3, 5]);
+const WEAK_ALGORITHMS = new Set([1, 3, 5, 6, 7]);
+const STRONG_ALGORITHMS = new Set([13, 14, 15, 16]);
+const DIGEST_TYPE_NAMES = {
+    1: "SHA-1",
+    2: "SHA-256",
+    3: "GOST R 34.11-94",
+    4: "SHA-384",
+};
+const WEAK_DIGEST_TYPES = new Set([1]); // SHA-1
+const STRONG_DIGEST_TYPES = new Set([2, 4]); // SHA-256, SHA-384
+// ─── Helpers ───
+function getAlgorithmName(alg) {
+    return ALGORITHM_NAMES[alg] ?? `UNKNOWN(${alg})`;
+}
+function getDigestTypeName(dt) {
+    return DIGEST_TYPE_NAMES[dt] ?? `UNKNOWN(${dt})`;
+}
+function getParentZone(domain) {
+    const parts = domain.split(".");
+    if (parts.length <= 1)
+        return ".";
+    return parts.slice(1).join(".");
+}
+function getTldZone(domain) {
+    const parts = domain.split(".");
+    if (parts.length <= 1)
+        return domain;
+    return parts[parts.length - 1];
+}
+function severityScore(severity) {
+    const scores = {
+        critical: 5,
+        high: 4,
+        medium: 3,
+        low: 2,
+        info: 1,
+    };
+    return scores[severity] ?? 0;
+}
+// ─── Core Logic Functions ───
+async function queryDnskeys(domain) {
+    const result = await queryRaw(domain, "DNSKEY", DEFAULT_RESOLVER, 53, { dnssec: true });
+    const keys = [];
+    for (const answer of result.answers) {
+        if (answer.type !== "DNSKEY")
+            continue;
+        const data = answer.data;
+        const flags = data.flags;
+        const protocol = data.protocol;
+        const algorithm = data.algorithm;
+        keys.push({
+            flags,
+            protocol,
+            algorithm,
+            algorithmName: getAlgorithmName(algorithm),
+            keyType: flags === 257 ? "KSK" : flags === 256 ? "ZSK" : `OTHER(${flags})`,
+            key: data.key ? Buffer.from(data.key).toString("base64") : "",
+        });
+    }
+    return keys;
+}
+async function queryDsRecords(domain) {
+    const result = await queryRaw(domain, "DS", DEFAULT_RESOLVER, 53, { dnssec: true });
+    const records = [];
+    for (const answer of result.answers) {
+        if (answer.type !== "DS")
+            continue;
+        const data = answer.data;
+        records.push({
+            keyTag: data.keyTag,
+            algorithm: data.algorithm,
+            algorithmName: getAlgorithmName(data.algorithm),
+            digestType: data.digestType,
+            digestTypeName: getDigestTypeName(data.digestType),
+            digest: data.digest ? Buffer.from(data.digest).toString("hex") : "",
+        });
+    }
+    return records;
+}
+async function queryRrsigs(domain) {
+    const result = await queryRaw(domain, "A", DEFAULT_RESOLVER, 53, { dnssec: true });
+    const sigs = [];
+    const now = Math.floor(Date.now() / 1000);
+    const allRecords = [...result.answers, ...result.authorities, ...result.additionals];
+    for (const answer of allRecords) {
+        if (answer.type !== "RRSIG")
+            continue;
+        const data = answer.data;
+        const expiration = data.expiration;
+        const inception = data.inception;
+        const daysUntilExpiry = Math.floor((expiration - now) / 86400);
+        sigs.push({
+            typeCovered: data.typeCovered,
+            algorithm: data.algorithm,
+            algorithmName: getAlgorithmName(data.algorithm),
+            labels: data.labels,
+            originalTtl: data.originalTTL,
+            expiration,
+            inception,
+            keyTag: data.keyTag,
+            signerName: data.signerName,
+            daysUntilExpiry,
+            expiringWithin7Days: daysUntilExpiry >= 0 && daysUntilExpiry <= 7,
+            expired: daysUntilExpiry < 0,
+        });
+    }
+    return sigs;
+}
+async function queryNsecRecords(domain) {
+    // Query for a non-existent subdomain to trigger NSEC/NSEC3 in authorities
+    const nxName = `_dnssec-probe-${Date.now()}.${domain}`;
+    const result = await queryRaw(nxName, "A", DEFAULT_RESOLVER, 53, { dnssec: true, cd: true });
+    const nsecRecords = [];
+    let foundType = "NONE";
+    let nsec3params;
+    const allRecords = [...result.authorities, ...result.additionals];
+    for (const record of allRecords) {
+        if (record.type === "NSEC") {
+            foundType = "NSEC";
+            nsecRecords.push({
+                name: record.name,
+                type: "NSEC",
+                data: record.data,
+            });
+        }
+        else if (record.type === "NSEC3") {
+            foundType = "NSEC3";
+            const data = record.data;
+            nsecRecords.push({
+                name: record.name,
+                type: "NSEC3",
+                data,
+            });
+            if (!nsec3params) {
+                nsec3params = {
+                    hashAlgorithm: data.algorithm ?? data.hashAlgorithm ?? 1,
+                    iterations: data.iterations ?? 0,
+                    salt: data.salt ? Buffer.from(data.salt).toString("hex") : "(empty)",
+                };
+            }
+        }
+        else if (record.type === "NSEC3PARAM") {
+            const data = record.data;
+            nsec3params = {
+                hashAlgorithm: data.algorithm ?? data.hashAlgorithm ?? 1,
+                iterations: data.iterations ?? 0,
+                salt: data.salt ? Buffer.from(data.salt).toString("hex") : "(empty)",
+            };
+        }
+    }
+    // Also try querying NSEC3PARAM directly for the zone
+    if (foundType === "NONE") {
+        try {
+            const nsec3Result = await queryRaw(domain, "NSEC3PARAM", DEFAULT_RESOLVER, 53, { dnssec: true });
+            for (const record of nsec3Result.answers) {
+                if (record.type === "NSEC3PARAM") {
+                    foundType = "NSEC3";
+                    const data = record.data;
+                    nsec3params = {
+                        hashAlgorithm: data.algorithm ?? data.hashAlgorithm ?? 1,
+                        iterations: data.iterations ?? 0,
+                        salt: data.salt ? Buffer.from(data.salt).toString("hex") : "(empty)",
+                    };
+                }
+            }
+        }
+        catch {
+            // NSEC3PARAM query failed, continue
+        }
+    }
+    return { type: foundType, records: nsecRecords, nsec3params };
+}
+async function performChainOfTrustValidation(domain) {
+    const parts = domain.split(".");
+    const levels = [];
+    // Check root -> TLD -> domain
+    const zones = [
+        domain,
+        parts.length > 1 ? parts.slice(1).join(".") : null, // TLD or parent
+        ".",
+    ].filter(Boolean);
+    // Reverse to go root -> TLD -> domain
+    zones.reverse();
+    let chainIntact = true;
+    let domainSigned = false;
+    for (const zone of zones) {
+        const zoneResult = {
+            zone,
+            hasDnskey: false,
+            hasDs: false,
+            hasRrsig: false,
+            authenticatedData: false,
+            issues: [],
+        };
+        try {
+            // Check DNSKEY
+            const dnskeyResult = await queryRaw(zone, "DNSKEY", DEFAULT_RESOLVER, 53, { dnssec: true });
+            const dnskeys = dnskeyResult.answers.filter((a) => a.type === "DNSKEY");
+            zoneResult.hasDnskey = dnskeys.length > 0;
+            zoneResult.authenticatedData = dnskeyResult.flags.authenticatedData;
+            if (!zoneResult.hasDnskey && zone !== ".") {
+                zoneResult.issues.push("No DNSKEY records found");
+                chainIntact = false;
+            }
+            // Check for RRSIG on DNSKEY
+            const rrsigs = dnskeyResult.answers.filter((a) => a.type === "RRSIG");
+            zoneResult.hasRrsig = rrsigs.length > 0;
+            if (zoneResult.hasDnskey && !zoneResult.hasRrsig) {
+                zoneResult.issues.push("DNSKEY present but no RRSIG covering it");
+                chainIntact = false;
+            }
+        }
+        catch {
+            zoneResult.issues.push("Failed to query DNSKEY");
+            chainIntact = false;
+        }
+        // Check DS record (not for root)
+        if (zone !== "." && zone !== domain) {
+            try {
+                // DS for the next zone down
+                const nextZoneIndex = zones.indexOf(zone) + 1;
+                if (nextZoneIndex < zones.length) {
+                    const childZone = zones[nextZoneIndex];
+                    const dsResult = await queryRaw(childZone, "DS", DEFAULT_RESOLVER, 53, { dnssec: true });
+                    const dsRecords = dsResult.answers.filter((a) => a.type === "DS");
+                    zoneResult.hasDs = dsRecords.length > 0;
+                }
+            }
+            catch {
+                zoneResult.issues.push("Failed to query DS");
+            }
+        }
+        if (zone === domain) {
+            domainSigned = zoneResult.hasDnskey;
+        }
+        levels.push(zoneResult);
+    }
+    // Also check DS for the domain itself at the parent
+    try {
+        const dsResult = await queryRaw(domain, "DS", DEFAULT_RESOLVER, 53, { dnssec: true });
+        const dsRecords = dsResult.answers.filter((a) => a.type === "DS");
+        if (dsRecords.length > 0) {
+            const domainLevel = levels.find((l) => l.zone === domain);
+            if (domainLevel)
+                domainLevel.hasDs = true;
+        }
+        else if (domainSigned) {
+            const domainLevel = levels.find((l) => l.zone === domain);
+            if (domainLevel) {
+                domainLevel.issues.push("DNSKEY present but no DS record at parent zone");
+                chainIntact = false;
+            }
+        }
+    }
+    catch {
+        // DS query failed
+    }
+    let status;
+    if (!domainSigned) {
+        status = "not_signed";
+    }
+    else if (chainIntact) {
+        status = "valid";
+    }
+    else {
+        status = "broken";
+    }
+    return { status, levels };
+}
+async function performAlgorithmAudit(domain) {
+    const algorithms = [];
+    const findings = [];
+    const seenAlgorithms = new Set();
+    function classifyAlgorithm(alg) {
+        if (DEPRECATED_ALGORITHMS.has(alg))
+            return "deprecated";
+        if (WEAK_ALGORITHMS.has(alg))
+            return "weak";
+        if (STRONG_ALGORITHMS.has(alg))
+            return "strong";
+        return "acceptable";
+    }
+    // Check DNSKEY algorithms
+    try {
+        const keys = await queryDnskeys(domain);
+        for (const key of keys) {
+            seenAlgorithms.add(key.algorithm);
+            algorithms.push({
+                source: `DNSKEY (${key.keyType})`,
+                algorithmNumber: key.algorithm,
+                algorithmName: key.algorithmName,
+                strength: classifyAlgorithm(key.algorithm),
+            });
+        }
+    }
+    catch {
+        findings.push({
+            severity: "info",
+            title: "DNSKEY query failed",
+            description: "Could not retrieve DNSKEY records for algorithm audit.",
+        });
+    }
+    // Check DS algorithms
+    try {
+        const dsRecords = await queryDsRecords(domain);
+        for (const ds of dsRecords) {
+            seenAlgorithms.add(ds.algorithm);
+            algorithms.push({
+                source: "DS",
+                algorithmNumber: ds.algorithm,
+                algorithmName: ds.algorithmName,
+                strength: classifyAlgorithm(ds.algorithm),
+            });
+        }
+    }
+    catch {
+        findings.push({
+            severity: "info",
+            title: "DS query failed",
+            description: "Could not retrieve DS records for algorithm audit.",
+        });
+    }
+    // Check RRSIG algorithms
+    try {
+        const rrsigs = await queryRrsigs(domain);
+        for (const sig of rrsigs) {
+            seenAlgorithms.add(sig.algorithm);
+            algorithms.push({
+                source: `RRSIG (covers ${sig.typeCovered})`,
+                algorithmNumber: sig.algorithm,
+                algorithmName: sig.algorithmName,
+                strength: classifyAlgorithm(sig.algorithm),
+            });
+        }
+    }
+    catch {
+        findings.push({
+            severity: "info",
+            title: "RRSIG query failed",
+            description: "Could not retrieve RRSIG records for algorithm audit.",
+        });
+    }
+    // Generate findings for deprecated/weak algorithms
+    for (const alg of seenAlgorithms) {
+        if (DEPRECATED_ALGORITHMS.has(alg)) {
+            findings.push({
+                severity: "critical",
+                title: `Deprecated DNSSEC algorithm: ${getAlgorithmName(alg)} (${alg})`,
+                description: `Algorithm ${getAlgorithmName(alg)} is deprecated and considered insecure. It should be replaced immediately.`,
+                remediation: `Migrate to ECDSAP256SHA256 (13) or ED25519 (15).`,
+            });
+        }
+        else if (WEAK_ALGORITHMS.has(alg)) {
+            findings.push({
+                severity: "high",
+                title: `Weak DNSSEC algorithm: ${getAlgorithmName(alg)} (${alg})`,
+                description: `Algorithm ${getAlgorithmName(alg)} is considered weak and may be vulnerable.`,
+                remediation: `Consider migrating to ECDSAP256SHA256 (13) or ED25519 (15).`,
+            });
+        }
+    }
+    if (seenAlgorithms.size > 0 && ![...seenAlgorithms].some((a) => STRONG_ALGORITHMS.has(a))) {
+        findings.push({
+            severity: "medium",
+            title: "No strong DNSSEC algorithms in use",
+            description: "The domain does not use any of the recommended strong algorithms (ECDSAP256SHA256, ECDSAP384SHA384, ED25519, ED448).",
+            remediation: "Consider migrating to ECDSAP256SHA256 (13) or ED25519 (15) for improved security and performance.",
+        });
+    }
+    return { algorithms, findings };
+}
+async function performKeyRolloverCheck(domain) {
+    const findings = [];
+    let keys = [];
+    let dsRecords = [];
+    try {
+        keys = await queryDnskeys(domain);
+    }
+    catch {
+        findings.push({
+            severity: "info",
+            title: "DNSKEY query failed",
+            description: "Could not retrieve DNSKEY records for key rollover check.",
+        });
+        return { rolloverDetected: false, method: "unknown", keys, dsRecords, findings };
+    }
+    try {
+        dsRecords = await queryDsRecords(domain);
+    }
+    catch {
+        findings.push({
+            severity: "info",
+            title: "DS query failed",
+            description: "Could not retrieve DS records for key rollover check.",
+        });
+    }
+    const ksks = keys.filter((k) => k.keyType === "KSK");
+    const zsks = keys.filter((k) => k.keyType === "ZSK");
+    let rolloverDetected = false;
+    let method = "none";
+    // Multiple KSKs indicate KSK rollover
+    if (ksks.length > 1) {
+        rolloverDetected = true;
+        // Check if DS records match all KSKs
+        // If DS count < KSK count, it's likely pre-publish method
+        // If DS count >= KSK count, it's likely double-signature method
+        if (dsRecords.length > 0 && dsRecords.length < ksks.length) {
+            method = "pre-publish";
+            findings.push({
+                severity: "info",
+                title: "KSK rollover in progress (pre-publish method)",
+                description: `Detected ${ksks.length} KSKs but only ${dsRecords.length} DS record(s). The new KSK is published in the zone but not yet in the parent DS. This is consistent with pre-publish key rollover.`,
+            });
+        }
+        else if (dsRecords.length >= ksks.length) {
+            method = "double-signature";
+            findings.push({
+                severity: "info",
+                title: "KSK rollover in progress (double-signature method)",
+                description: `Detected ${ksks.length} KSKs with ${dsRecords.length} DS record(s). Both old and new keys have corresponding DS records. This is consistent with double-signature key rollover.`,
+            });
+        }
+        else {
+            method = "ksk-rollover-detected";
+            findings.push({
+                severity: "medium",
+                title: "Multiple KSKs without matching DS",
+                description: `Detected ${ksks.length} KSKs but no DS records at parent. This may indicate a misconfigured KSK rollover or the domain's parent has not published the DS record.`,
+                remediation: "Ensure the parent zone has the correct DS record(s) for the active KSK(s).",
+            });
+        }
+    }
+    // Multiple ZSKs indicate ZSK rollover
+    if (zsks.length > 1) {
+        rolloverDetected = true;
+        if (method === "none")
+            method = "zsk-pre-publish";
+        findings.push({
+            severity: "info",
+            title: "ZSK rollover in progress",
+            description: `Detected ${zsks.length} ZSKs. This is typical of a pre-publish ZSK rollover where both old and new ZSK are published simultaneously.`,
+        });
+    }
+    // Check for algorithm mismatch between KSKs
+    if (ksks.length > 1) {
+        const algorithms = new Set(ksks.map((k) => k.algorithm));
+        if (algorithms.size > 1) {
+            findings.push({
+                severity: "medium",
+                title: "Algorithm rollover detected",
+                description: `KSKs use different algorithms: ${[...algorithms].map((a) => `${getAlgorithmName(a)} (${a})`).join(", ")}. This may indicate an algorithm rollover.`,
+                remediation: "Ensure the algorithm rollover completes properly and old algorithms are retired.",
+            });
+        }
+    }
+    if (!rolloverDetected) {
+        findings.push({
+            severity: "info",
+            title: "No key rollover detected",
+            description: `Found ${ksks.length} KSK(s) and ${zsks.length} ZSK(s). No active key rollover detected.`,
+        });
+    }
+    return { rolloverDetected, method, keys, dsRecords, findings };
+}
+// ─── Tool 1: dnssec_validate ───
+const dnssecValidate = {
+    name: "dnssec_validate",
+    description: "Full DNSSEC chain of trust validation from root to TLD to domain. Queries DNSKEY, DS, and RRSIG records at each level. Reports whether the chain is valid, broken, or the domain is not signed.",
+    schema: {
+        domain: z
+            .string()
+            .describe("The domain name to validate DNSSEC chain of trust for (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        try {
+            const result = await performChainOfTrustValidation(domain);
+            const lines = [
+                `DNSSEC Chain of Trust Validation: ${domain}`,
+                `${"=".repeat(60)}`,
+                `Status: ${result.status.toUpperCase()}`,
+                "",
+            ];
+            if (result.status === "valid") {
+                lines.push("The DNSSEC chain of trust is intact from root to this domain.");
+            }
+            else if (result.status === "broken") {
+                lines.push("WARNING: The DNSSEC chain of trust is BROKEN. DNS responses may not be authenticated.");
+            }
+            else {
+                lines.push("This domain is NOT signed with DNSSEC. DNS responses are not authenticated.");
+            }
+            lines.push("");
+            lines.push("Chain Details:");
+            lines.push("-".repeat(40));
+            for (const level of result.levels) {
+                lines.push(`\nZone: ${level.zone}`);
+                lines.push(`  DNSKEY: ${level.hasDnskey ? "YES" : "NO"}`);
+                lines.push(`  DS:     ${level.hasDs ? "YES" : "NO"}`);
+                lines.push(`  RRSIG:  ${level.hasRrsig ? "YES" : "NO"}`);
+                lines.push(`  AD bit: ${level.authenticatedData ? "SET" : "NOT SET"}`);
+                if (level.issues.length > 0) {
+                    lines.push(`  Issues:`);
+                    for (const issue of level.issues) {
+                        lines.push(`    - ${issue}`);
+                    }
+                }
+            }
+            return text(lines.join("\n"));
+        }
+        catch (err) {
+            return text(`Error validating DNSSEC for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 2: dnssec_check_ds ───
+const dnssecCheckDs = {
+    name: "dnssec_check_ds",
+    description: "Check DS (Delegation Signer) records for a domain. Queries DS from parent zone and DNSKEY from child zone. Verifies DS existence and reports algorithm strength and digest type.",
+    schema: {
+        domain: z
+            .string()
+            .describe("The domain name to check DS records for (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        try {
+            const dsRecords = await queryDsRecords(domain);
+            let dnskeys = [];
+            try {
+                dnskeys = await queryDnskeys(domain);
+            }
+            catch {
+                // DNSKEY query may fail
+            }
+            const lines = [
+                `DS Record Check: ${domain}`,
+                `${"=".repeat(60)}`,
+                "",
+            ];
+            if (dsRecords.length === 0) {
+                lines.push("No DS records found at parent zone.");
+                lines.push("This domain either does not use DNSSEC or the parent zone has not published the DS record.");
+                return text(lines.join("\n"));
+            }
+            lines.push(`Found ${dsRecords.length} DS record(s):`);
+            lines.push("");
+            for (const ds of dsRecords) {
+                lines.push(`  Key Tag: ${ds.keyTag}`);
+                lines.push(`  Algorithm: ${ds.algorithmName} (${ds.algorithm})`);
+                // Algorithm strength assessment
+                if (DEPRECATED_ALGORITHMS.has(ds.algorithm)) {
+                    lines.push(`  Algorithm Strength: DEPRECATED - INSECURE`);
+                }
+                else if (WEAK_ALGORITHMS.has(ds.algorithm)) {
+                    lines.push(`  Algorithm Strength: WEAK`);
+                }
+                else if (STRONG_ALGORITHMS.has(ds.algorithm)) {
+                    lines.push(`  Algorithm Strength: STRONG`);
+                }
+                else {
+                    lines.push(`  Algorithm Strength: ACCEPTABLE`);
+                }
+                lines.push(`  Digest Type: ${ds.digestTypeName} (${ds.digestType})`);
+                if (WEAK_DIGEST_TYPES.has(ds.digestType)) {
+                    lines.push(`  Digest Strength: WEAK - SHA-1 is deprecated for DNSSEC`);
+                }
+                else if (STRONG_DIGEST_TYPES.has(ds.digestType)) {
+                    lines.push(`  Digest Strength: STRONG`);
+                }
+                else {
+                    lines.push(`  Digest Strength: ACCEPTABLE`);
+                }
+                lines.push(`  Digest: ${ds.digest}`);
+                lines.push("");
+            }
+            // Cross-reference with DNSKEY
+            if (dnskeys.length > 0) {
+                const ksks = dnskeys.filter((k) => k.keyType === "KSK");
+                lines.push(`Child zone has ${dnskeys.length} DNSKEY(s) (${ksks.length} KSK, ${dnskeys.length - ksks.length} ZSK).`);
+                if (ksks.length === 0) {
+                    lines.push("WARNING: No KSK found in child zone. DS record may reference a missing key.");
+                }
+            }
+            else {
+                lines.push("WARNING: Could not retrieve DNSKEY records from child zone for cross-reference.");
+            }
+            return text(lines.join("\n"));
+        }
+        catch (err) {
+            return text(`Error checking DS for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 3: dnssec_check_dnskey ───
+const dnssecCheckDnskey = {
+    name: "dnssec_check_dnskey",
+    description: "List all DNSKEY records for a domain. Distinguishes KSK (flag 257) vs ZSK (flag 256), reports algorithm and protocol. Flags weak algorithms and identifies strong ones.",
+    schema: {
+        domain: z
+            .string()
+            .describe("The domain name to check DNSKEY records for (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        try {
+            const keys = await queryDnskeys(domain);
+            const lines = [
+                `DNSKEY Record Check: ${domain}`,
+                `${"=".repeat(60)}`,
+                "",
+            ];
+            if (keys.length === 0) {
+                lines.push("No DNSKEY records found. This domain does not appear to use DNSSEC.");
+                return text(lines.join("\n"));
+            }
+            const ksks = keys.filter((k) => k.keyType === "KSK");
+            const zsks = keys.filter((k) => k.keyType === "ZSK");
+            const others = keys.filter((k) => k.keyType !== "KSK" && k.keyType !== "ZSK");
+            lines.push(`Found ${keys.length} DNSKEY(s): ${ksks.length} KSK, ${zsks.length} ZSK${others.length > 0 ? `, ${others.length} other` : ""}`);
+            lines.push("");
+            for (const key of keys) {
+                lines.push(`  Type: ${key.keyType} (flags=${key.flags})`);
+                lines.push(`  Algorithm: ${key.algorithmName} (${key.algorithm})`);
+                lines.push(`  Protocol: ${key.protocol}`);
+                if (DEPRECATED_ALGORITHMS.has(key.algorithm)) {
+                    lines.push(`  ** CRITICAL: Deprecated algorithm. ${key.algorithmName} is insecure and should be replaced immediately.`);
+                }
+                else if (WEAK_ALGORITHMS.has(key.algorithm)) {
+                    lines.push(`  ** WARNING: Weak algorithm. ${key.algorithmName} is considered weak.`);
+                }
+                else if (STRONG_ALGORITHMS.has(key.algorithm)) {
+                    lines.push(`  Strength: STRONG - ${key.algorithmName} is a recommended algorithm.`);
+                }
+                else {
+                    lines.push(`  Strength: ACCEPTABLE`);
+                }
+                lines.push(`  Key (base64): ${key.key.substring(0, 40)}${key.key.length > 40 ? "..." : ""}`);
+                lines.push("");
+            }
+            // Summary recommendations
+            const allAlgorithms = new Set(keys.map((k) => k.algorithm));
+            if ([...allAlgorithms].some((a) => DEPRECATED_ALGORITHMS.has(a))) {
+                lines.push("RECOMMENDATION: Replace deprecated algorithms with ECDSAP256SHA256 (13) or ED25519 (15).");
+            }
+            else if (![...allAlgorithms].some((a) => STRONG_ALGORITHMS.has(a))) {
+                lines.push("RECOMMENDATION: Consider upgrading to ECDSAP256SHA256 (13) or ED25519 (15) for better security and smaller key sizes.");
+            }
+            return text(lines.join("\n"));
+        }
+        catch (err) {
+            return text(`Error checking DNSKEY for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 4: dnssec_check_rrsig ───
+const dnssecCheckRrsig = {
+    name: "dnssec_check_rrsig",
+    description: "Check RRSIG (Resource Record Signature) records for a domain. Extracts type covered, algorithm, labels, original TTL, signature expiry/inception, key tag, and signer. Reports days until expiry and flags signatures expiring within 7 days.",
+    schema: {
+        domain: z
+            .string()
+            .describe("The domain name to check RRSIG records for (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        try {
+            // Query multiple record types to get more RRSIGs
+            const rrsigsByType = [];
+            const seenKeys = new Set();
+            const typesToQuery = ["A", "AAAA", "MX", "NS", "SOA", "DNSKEY"];
+            for (const qtype of typesToQuery) {
+                try {
+                    const result = await queryRaw(domain, qtype, DEFAULT_RESOLVER, 53, { dnssec: true });
+                    const allRecords = [...result.answers, ...result.authorities, ...result.additionals];
+                    const now = Math.floor(Date.now() / 1000);
+                    for (const answer of allRecords) {
+                        if (answer.type !== "RRSIG")
+                            continue;
+                        const data = answer.data;
+                        const typeCovered = data.typeCovered;
+                        const keyTag = data.keyTag;
+                        const uniqueKey = `${typeCovered}:${keyTag}:${data.expiration}`;
+                        if (seenKeys.has(uniqueKey))
+                            continue;
+                        seenKeys.add(uniqueKey);
+                        const expiration = data.expiration;
+                        const inception = data.inception;
+                        const daysUntilExpiry = Math.floor((expiration - now) / 86400);
+                        rrsigsByType.push({
+                            typeCovered,
+                            algorithm: data.algorithm,
+                            algorithmName: getAlgorithmName(data.algorithm),
+                            labels: data.labels,
+                            originalTtl: data.originalTTL,
+                            expiration,
+                            inception,
+                            keyTag,
+                            signerName: data.signerName,
+                            daysUntilExpiry,
+                            expiringWithin7Days: daysUntilExpiry >= 0 && daysUntilExpiry <= 7,
+                            expired: daysUntilExpiry < 0,
+                        });
+                    }
+                }
+                catch {
+                    // Some query types may fail, continue
+                }
+            }
+            const lines = [
+                `RRSIG Record Check: ${domain}`,
+                `${"=".repeat(60)}`,
+                "",
+            ];
+            if (rrsigsByType.length === 0) {
+                lines.push("No RRSIG records found. This domain does not appear to use DNSSEC.");
+                return text(lines.join("\n"));
+            }
+            lines.push(`Found ${rrsigsByType.length} unique RRSIG(s):`);
+            lines.push("");
+            const expiredSigs = [];
+            const expiringSoonSigs = [];
+            for (const sig of rrsigsByType) {
+                lines.push(`  Type Covered: ${sig.typeCovered}`);
+                lines.push(`  Algorithm: ${sig.algorithmName} (${sig.algorithm})`);
+                lines.push(`  Labels: ${sig.labels}`);
+                lines.push(`  Original TTL: ${sig.originalTtl}`);
+                lines.push(`  Expiration: ${new Date(sig.expiration * 1000).toISOString()}`);
+                lines.push(`  Inception: ${new Date(sig.inception * 1000).toISOString()}`);
+                lines.push(`  Key Tag: ${sig.keyTag}`);
+                lines.push(`  Signer: ${sig.signerName}`);
+                if (sig.expired) {
+                    lines.push(`  ** EXPIRED: Signature expired ${Math.abs(sig.daysUntilExpiry)} day(s) ago!`);
+                    expiredSigs.push(sig);
+                }
+                else if (sig.expiringWithin7Days) {
+                    lines.push(`  ** WARNING: Expires in ${sig.daysUntilExpiry} day(s)!`);
+                    expiringSoonSigs.push(sig);
+                }
+                else {
+                    lines.push(`  Days until expiry: ${sig.daysUntilExpiry}`);
+                }
+                lines.push("");
+            }
+            // Summary
+            lines.push("-".repeat(40));
+            lines.push("Summary:");
+            if (expiredSigs.length > 0) {
+                lines.push(`  CRITICAL: ${expiredSigs.length} expired signature(s) found. DNSSEC validation will fail.`);
+            }
+            if (expiringSoonSigs.length > 0) {
+                lines.push(`  WARNING: ${expiringSoonSigs.length} signature(s) expiring within 7 days. Ensure re-signing is scheduled.`);
+            }
+            if (expiredSigs.length === 0 && expiringSoonSigs.length === 0) {
+                lines.push("  All signatures are valid and not expiring soon.");
+            }
+            return text(lines.join("\n"));
+        }
+        catch (err) {
+            return text(`Error checking RRSIG for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 5: dnssec_check_nsec ───
+const dnssecCheckNsec = {
+    name: "dnssec_check_nsec",
+    description: "Check NSEC/NSEC3 records for a domain. Determines if the zone uses NSEC (enumerable via zone walking) or NSEC3 (hashed names). For NSEC3, reports hash algorithm, iterations, and salt. Flags NSEC as informational risk allowing zone walking.",
+    schema: {
+        domain: z
+            .string()
+            .describe("The domain name to check NSEC/NSEC3 records for (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        try {
+            const nsecResult = await queryNsecRecords(domain);
+            const lines = [
+                `NSEC/NSEC3 Record Check: ${domain}`,
+                `${"=".repeat(60)}`,
+                "",
+            ];
+            if (nsecResult.type === "NONE") {
+                lines.push("No NSEC or NSEC3 records detected.");
+                lines.push("The zone may not use DNSSEC, or the resolver may not return denial-of-existence records.");
+                return text(lines.join("\n"));
+            }
+            lines.push(`Denial of Existence: ${nsecResult.type}`);
+            lines.push("");
+            if (nsecResult.type === "NSEC") {
+                lines.push("Type: NSEC (plain)");
+                lines.push("");
+                lines.push("** INFORMATIONAL RISK: NSEC allows zone walking.");
+                lines.push("   An attacker can enumerate all record names in the zone by");
+                lines.push("   following NSEC next-name chains. This reveals the full zone contents.");
+                lines.push("");
+                lines.push("   Remediation: Consider migrating to NSEC3 to prevent zone enumeration.");
+                lines.push("");
+                lines.push(`Found ${nsecResult.records.length} NSEC record(s):`);
+                for (const record of nsecResult.records) {
+                    lines.push(`  Name: ${record.name}`);
+                    const data = record.data;
+                    if (data.nextDomain) {
+                        lines.push(`  Next Domain: ${data.nextDomain}`);
+                    }
+                    if (data.rrtypes) {
+                        lines.push(`  RR Types: ${data.rrtypes.join(", ")}`);
+                    }
+                    lines.push("");
+                }
+            }
+            else if (nsecResult.type === "NSEC3") {
+                lines.push("Type: NSEC3 (hashed)");
+                lines.push("Zone names are hashed, preventing direct zone walking.");
+                lines.push("");
+                if (nsecResult.nsec3params) {
+                    lines.push("NSEC3 Parameters:");
+                    lines.push(`  Hash Algorithm: ${nsecResult.nsec3params.hashAlgorithm} (${nsecResult.nsec3params.hashAlgorithm === 1 ? "SHA-1" : "UNKNOWN"})`);
+                    lines.push(`  Iterations: ${nsecResult.nsec3params.iterations}`);
+                    lines.push(`  Salt: ${nsecResult.nsec3params.salt}`);
+                    lines.push("");
+                    // Check iteration count
+                    if (nsecResult.nsec3params.iterations > 100) {
+                        lines.push("** WARNING: High iteration count (>100).");
+                        lines.push("   RFC 9276 recommends 0 iterations. High iterations increase CPU cost");
+                        lines.push("   for resolvers without significantly improving security.");
+                    }
+                    else if (nsecResult.nsec3params.iterations > 0) {
+                        lines.push("** NOTE: RFC 9276 recommends 0 iterations for best performance.");
+                    }
+                    else {
+                        lines.push("Iterations: 0 (optimal per RFC 9276).");
+                    }
+                    lines.push("");
+                    // Check salt
+                    if (nsecResult.nsec3params.salt === "(empty)" || nsecResult.nsec3params.salt === "") {
+                        lines.push("Salt: Empty (recommended per RFC 9276 for simplified key rollover).");
+                    }
+                    else {
+                        lines.push("** NOTE: RFC 9276 recommends an empty salt for simplified key rollover.");
+                    }
+                }
+                if (nsecResult.records.length > 0) {
+                    lines.push("");
+                    lines.push(`Found ${nsecResult.records.length} NSEC3 record(s).`);
+                }
+            }
+            return text(lines.join("\n"));
+        }
+        catch (err) {
+            return text(`Error checking NSEC/NSEC3 for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 6: dnssec_algorithm_audit ───
+const dnssecAlgorithmAudit = {
+    name: "dnssec_algorithm_audit",
+    description: "Inventory all DNSSEC algorithms used in DS, DNSKEY, and RRSIG records. Maps algorithm numbers to names. Flags deprecated algorithms (RSA/MD5, DSA, RSASHA1) and recommends ECDSAP256SHA256 or ED25519.",
+    schema: {
+        domain: z
+            .string()
+            .describe("The domain name to audit DNSSEC algorithms for (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        try {
+            const audit = await performAlgorithmAudit(domain);
+            const lines = [
+                `DNSSEC Algorithm Audit: ${domain}`,
+                `${"=".repeat(60)}`,
+                "",
+            ];
+            if (audit.algorithms.length === 0) {
+                lines.push("No DNSSEC algorithms found. The domain may not use DNSSEC.");
+                return text(lines.join("\n"));
+            }
+            lines.push("Algorithm Inventory:");
+            lines.push("-".repeat(40));
+            for (const alg of audit.algorithms) {
+                lines.push(`  Source: ${alg.source}`);
+                lines.push(`  Algorithm: ${alg.algorithmName} (${alg.algorithmNumber})`);
+                lines.push(`  Strength: ${alg.strength.toUpperCase()}`);
+                lines.push("");
+            }
+            // Unique algorithms summary
+            const unique = new Map();
+            for (const alg of audit.algorithms) {
+                unique.set(alg.algorithmNumber, alg.algorithmName);
+            }
+            lines.push("Unique Algorithms:");
+            lines.push("-".repeat(40));
+            for (const [num, name] of unique) {
+                const strength = DEPRECATED_ALGORITHMS.has(num)
+                    ? "DEPRECATED"
+                    : WEAK_ALGORITHMS.has(num)
+                        ? "WEAK"
+                        : STRONG_ALGORITHMS.has(num)
+                            ? "STRONG"
+                            : "ACCEPTABLE";
+                lines.push(`  ${name} (${num}): ${strength}`);
+            }
+            lines.push("");
+            // Algorithm reference table
+            lines.push("Algorithm Reference:");
+            lines.push("-".repeat(40));
+            for (const [num, name] of Object.entries(ALGORITHM_NAMES)) {
+                const status = DEPRECATED_ALGORITHMS.has(Number(num))
+                    ? "DEPRECATED"
+                    : WEAK_ALGORITHMS.has(Number(num))
+                        ? "WEAK"
+                        : STRONG_ALGORITHMS.has(Number(num))
+                            ? "STRONG"
+                            : "ACCEPTABLE";
+                const inUse = unique.has(Number(num)) ? " [IN USE]" : "";
+                lines.push(`  ${num}: ${name} - ${status}${inUse}`);
+            }
+            lines.push("");
+            // Findings
+            if (audit.findings.length > 0) {
+                lines.push("Findings:");
+                lines.push("-".repeat(40));
+                for (const finding of audit.findings) {
+                    lines.push(`  [${finding.severity.toUpperCase()}] ${finding.title}`);
+                    lines.push(`    ${finding.description}`);
+                    if (finding.remediation) {
+                        lines.push(`    Remediation: ${finding.remediation}`);
+                    }
+                    lines.push("");
+                }
+            }
+            return text(lines.join("\n"));
+        }
+        catch (err) {
+            return text(`Error auditing algorithms for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 7: dnssec_key_rollover ───
+const dnssecKeyRollover = {
+    name: "dnssec_key_rollover",
+    description: "Check for DNSSEC key rollover. Detects multiple DNSKEYs indicating rollover in progress. Reports pre-publish vs double-signature rollover method. Flags if both old and new KSK present without matching DS.",
+    schema: {
+        domain: z
+            .string()
+            .describe("The domain name to check key rollover for (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        try {
+            const result = await performKeyRolloverCheck(domain);
+            const lines = [
+                `DNSSEC Key Rollover Check: ${domain}`,
+                `${"=".repeat(60)}`,
+                "",
+            ];
+            lines.push(`Rollover Detected: ${result.rolloverDetected ? "YES" : "NO"}`);
+            if (result.rolloverDetected) {
+                lines.push(`Method: ${result.method}`);
+            }
+            lines.push("");
+            // DNSKEY listing
+            lines.push("DNSKEY Records:");
+            lines.push("-".repeat(40));
+            if (result.keys.length === 0) {
+                lines.push("  No DNSKEY records found.");
+            }
+            else {
+                for (const key of result.keys) {
+                    lines.push(`  ${key.keyType} (flags=${key.flags}): ${key.algorithmName} (${key.algorithm})`);
+                }
+            }
+            lines.push("");
+            // DS listing
+            lines.push("DS Records (at parent):");
+            lines.push("-".repeat(40));
+            if (result.dsRecords.length === 0) {
+                lines.push("  No DS records found.");
+            }
+            else {
+                for (const ds of result.dsRecords) {
+                    lines.push(`  Key Tag ${ds.keyTag}: ${ds.algorithmName} (${ds.algorithm}), Digest: ${ds.digestTypeName} (${ds.digestType})`);
+                }
+            }
+            lines.push("");
+            // Findings
+            if (result.findings.length > 0) {
+                lines.push("Analysis:");
+                lines.push("-".repeat(40));
+                for (const finding of result.findings) {
+                    lines.push(`  [${finding.severity.toUpperCase()}] ${finding.title}`);
+                    lines.push(`    ${finding.description}`);
+                    if (finding.remediation) {
+                        lines.push(`    Remediation: ${finding.remediation}`);
+                    }
+                    lines.push("");
+                }
+            }
+            return text(lines.join("\n"));
+        }
+        catch (err) {
+            return text(`Error checking key rollover for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 8: dnssec_full_audit ───
+const dnssecFullAudit = {
+    name: "dnssec_full_audit",
+    description: "Comprehensive DNSSEC audit that runs all 7 DNSSEC checks: chain of trust validation, DS verification, DNSKEY analysis, RRSIG expiry check, NSEC/NSEC3 analysis, algorithm audit, and key rollover detection. Aggregates findings into a severity-scored report with remediation guidance.",
+    schema: {
+        domain: z
+            .string()
+            .describe("The domain name to perform a full DNSSEC audit on (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const allFindings = [];
+        const sections = [];
+        sections.push(`DNSSEC Full Audit Report: ${domain}`);
+        sections.push(`${"=".repeat(60)}`);
+        sections.push(`Audit Date: ${new Date().toISOString()}`);
+        sections.push("");
+        // ── 1. Chain of Trust Validation ──
+        sections.push("1. Chain of Trust Validation");
+        sections.push("-".repeat(40));
+        try {
+            const chainResult = await performChainOfTrustValidation(domain);
+            sections.push(`Status: ${chainResult.status.toUpperCase()}`);
+            if (chainResult.status === "not_signed") {
+                allFindings.push({
+                    severity: "high",
+                    title: "Domain is not DNSSEC signed",
+                    description: "No DNSKEY records found. DNS responses are not cryptographically authenticated, making the domain vulnerable to DNS spoofing and cache poisoning.",
+                    remediation: "Enable DNSSEC signing for this domain at your DNS provider or registrar.",
+                });
+                sections.push("Domain is NOT signed with DNSSEC.");
+            }
+            else if (chainResult.status === "broken") {
+                allFindings.push({
+                    severity: "critical",
+                    title: "DNSSEC chain of trust is broken",
+                    description: "The chain of trust from root to this domain is broken. DNSSEC-validating resolvers may reject responses for this domain.",
+                    remediation: "Investigate and fix the broken link in the DNSSEC chain. Ensure DS records at parent match DNSKEY at child.",
+                });
+                sections.push("Chain of trust is BROKEN.");
+            }
+            else {
+                sections.push("Chain of trust is VALID.");
+            }
+            for (const level of chainResult.levels) {
+                if (level.issues.length > 0) {
+                    sections.push(`  Zone ${level.zone}: ${level.issues.join("; ")}`);
+                }
+            }
+        }
+        catch (err) {
+            sections.push(`  Error: ${err.message}`);
+            allFindings.push({
+                severity: "info",
+                title: "Chain of trust validation failed",
+                description: `Could not complete chain validation: ${err.message}`,
+            });
+        }
+        sections.push("");
+        // ── 2. DS Record Check ──
+        sections.push("2. DS Record Check");
+        sections.push("-".repeat(40));
+        try {
+            const dsRecords = await queryDsRecords(domain);
+            if (dsRecords.length === 0) {
+                sections.push("No DS records found at parent zone.");
+            }
+            else {
+                sections.push(`Found ${dsRecords.length} DS record(s).`);
+                for (const ds of dsRecords) {
+                    sections.push(`  Key Tag ${ds.keyTag}: ${ds.algorithmName} (${ds.algorithm}), Digest: ${ds.digestTypeName} (${ds.digestType})`);
+                    if (WEAK_DIGEST_TYPES.has(ds.digestType)) {
+                        allFindings.push({
+                            severity: "medium",
+                            title: `Weak DS digest type: ${ds.digestTypeName}`,
+                            description: `DS record for key tag ${ds.keyTag} uses ${ds.digestTypeName} which is deprecated.`,
+                            remediation: "Add a DS record with SHA-256 (digest type 2) or SHA-384 (digest type 4).",
+                        });
+                    }
+                    if (DEPRECATED_ALGORITHMS.has(ds.algorithm)) {
+                        allFindings.push({
+                            severity: "critical",
+                            title: `Deprecated algorithm in DS: ${ds.algorithmName}`,
+                            description: `DS record for key tag ${ds.keyTag} uses deprecated algorithm ${ds.algorithmName} (${ds.algorithm}).`,
+                            remediation: "Generate new keys using ECDSAP256SHA256 (13) or ED25519 (15) and update DS at parent.",
+                        });
+                    }
+                }
+            }
+        }
+        catch (err) {
+            sections.push(`  Error: ${err.message}`);
+        }
+        sections.push("");
+        // ── 3. DNSKEY Check ──
+        sections.push("3. DNSKEY Check");
+        sections.push("-".repeat(40));
+        try {
+            const keys = await queryDnskeys(domain);
+            if (keys.length === 0) {
+                sections.push("No DNSKEY records found.");
+            }
+            else {
+                const ksks = keys.filter((k) => k.keyType === "KSK");
+                const zsks = keys.filter((k) => k.keyType === "ZSK");
+                sections.push(`Found ${keys.length} DNSKEY(s): ${ksks.length} KSK, ${zsks.length} ZSK`);
+                for (const key of keys) {
+                    sections.push(`  ${key.keyType}: ${key.algorithmName} (${key.algorithm})`);
+                    if (DEPRECATED_ALGORITHMS.has(key.algorithm)) {
+                        allFindings.push({
+                            severity: "critical",
+                            title: `Deprecated DNSKEY algorithm: ${key.algorithmName} (${key.keyType})`,
+                            description: `${key.keyType} uses deprecated algorithm ${key.algorithmName}. This is insecure.`,
+                            remediation: "Replace with ECDSAP256SHA256 (13) or ED25519 (15).",
+                        });
+                    }
+                    else if (WEAK_ALGORITHMS.has(key.algorithm)) {
+                        allFindings.push({
+                            severity: "high",
+                            title: `Weak DNSKEY algorithm: ${key.algorithmName} (${key.keyType})`,
+                            description: `${key.keyType} uses weak algorithm ${key.algorithmName}.`,
+                            remediation: "Consider migrating to ECDSAP256SHA256 (13) or ED25519 (15).",
+                        });
+                    }
+                }
+                if (ksks.length === 0 && keys.length > 0) {
+                    allFindings.push({
+                        severity: "medium",
+                        title: "No KSK found",
+                        description: "DNSKEY records exist but no Key Signing Key (flag 257) was found. This is unusual and may indicate a configuration issue.",
+                        remediation: "Verify DNSSEC configuration includes a proper KSK.",
+                    });
+                }
+            }
+        }
+        catch (err) {
+            sections.push(`  Error: ${err.message}`);
+        }
+        sections.push("");
+        // ── 4. RRSIG Check ──
+        sections.push("4. RRSIG Expiry Check");
+        sections.push("-".repeat(40));
+        try {
+            const rrsigs = await queryRrsigs(domain);
+            if (rrsigs.length === 0) {
+                sections.push("No RRSIG records found.");
+            }
+            else {
+                sections.push(`Found ${rrsigs.length} RRSIG(s).`);
+                const expired = rrsigs.filter((r) => r.expired);
+                const expiringSoon = rrsigs.filter((r) => r.expiringWithin7Days);
+                if (expired.length > 0) {
+                    sections.push(`  CRITICAL: ${expired.length} expired signature(s)!`);
+                    for (const sig of expired) {
+                        sections.push(`    - ${sig.typeCovered} (key tag ${sig.keyTag}): expired ${Math.abs(sig.daysUntilExpiry)} day(s) ago`);
+                    }
+                    allFindings.push({
+                        severity: "critical",
+                        title: `${expired.length} expired RRSIG signature(s)`,
+                        description: "Expired signatures will cause DNSSEC validation failures. DNSSEC-validating resolvers will return SERVFAIL.",
+                        remediation: "Immediately re-sign the zone. Check that automatic re-signing is configured and functioning.",
+                    });
+                }
+                if (expiringSoon.length > 0) {
+                    sections.push(`  WARNING: ${expiringSoon.length} signature(s) expiring within 7 days.`);
+                    for (const sig of expiringSoon) {
+                        sections.push(`    - ${sig.typeCovered} (key tag ${sig.keyTag}): ${sig.daysUntilExpiry} day(s) remaining`);
+                    }
+                    allFindings.push({
+                        severity: "high",
+                        title: `${expiringSoon.length} RRSIG signature(s) expiring within 7 days`,
+                        description: "Signatures approaching expiration. If not re-signed in time, DNSSEC validation will fail.",
+                        remediation: "Verify that automatic zone re-signing is scheduled and operational.",
+                    });
+                }
+                if (expired.length === 0 && expiringSoon.length === 0) {
+                    sections.push("  All signatures are valid and not expiring soon.");
+                }
+            }
+        }
+        catch (err) {
+            sections.push(`  Error: ${err.message}`);
+        }
+        sections.push("");
+        // ── 5. NSEC/NSEC3 Check ──
+        sections.push("5. NSEC/NSEC3 Analysis");
+        sections.push("-".repeat(40));
+        try {
+            const nsecResult = await queryNsecRecords(domain);
+            if (nsecResult.type === "NONE") {
+                sections.push("No NSEC or NSEC3 records detected.");
+            }
+            else if (nsecResult.type === "NSEC") {
+                sections.push("Uses: NSEC (plain)");
+                allFindings.push({
+                    severity: "low",
+                    title: "Zone uses NSEC (allows zone walking)",
+                    description: "NSEC records allow an attacker to enumerate all names in the zone by following the chain of next-domain-name fields.",
+                    remediation: "Consider migrating to NSEC3 to prevent zone enumeration. Note: NSEC3 has its own trade-offs (CPU cost, complexity).",
+                });
+            }
+            else if (nsecResult.type === "NSEC3") {
+                sections.push("Uses: NSEC3 (hashed names)");
+                if (nsecResult.nsec3params) {
+                    sections.push(`  Hash Algorithm: ${nsecResult.nsec3params.hashAlgorithm}`);
+                    sections.push(`  Iterations: ${nsecResult.nsec3params.iterations}`);
+                    sections.push(`  Salt: ${nsecResult.nsec3params.salt}`);
+                    if (nsecResult.nsec3params.iterations > 100) {
+                        allFindings.push({
+                            severity: "medium",
+                            title: "High NSEC3 iteration count",
+                            description: `NSEC3 iterations set to ${nsecResult.nsec3params.iterations}. RFC 9276 recommends 0 iterations.`,
+                            remediation: "Reduce NSEC3 iterations to 0 per RFC 9276 for optimal performance.",
+                        });
+                    }
+                    else if (nsecResult.nsec3params.iterations > 0) {
+                        allFindings.push({
+                            severity: "low",
+                            title: "Non-zero NSEC3 iterations",
+                            description: `NSEC3 iterations set to ${nsecResult.nsec3params.iterations}. RFC 9276 recommends 0.`,
+                            remediation: "Consider reducing iterations to 0 per RFC 9276.",
+                        });
+                    }
+                }
+            }
+        }
+        catch (err) {
+            sections.push(`  Error: ${err.message}`);
+        }
+        sections.push("");
+        // ── 6. Algorithm Audit ──
+        sections.push("6. Algorithm Audit");
+        sections.push("-".repeat(40));
+        try {
+            const audit = await performAlgorithmAudit(domain);
+            if (audit.algorithms.length === 0) {
+                sections.push("No DNSSEC algorithms found.");
+            }
+            else {
+                const unique = new Map();
+                for (const alg of audit.algorithms) {
+                    unique.set(alg.algorithmNumber, alg.algorithmName);
+                }
+                for (const [num, name] of unique) {
+                    const strength = DEPRECATED_ALGORITHMS.has(num)
+                        ? "DEPRECATED"
+                        : WEAK_ALGORITHMS.has(num)
+                            ? "WEAK"
+                            : STRONG_ALGORITHMS.has(num)
+                                ? "STRONG"
+                                : "ACCEPTABLE";
+                    sections.push(`  ${name} (${num}): ${strength}`);
+                }
+                // Add algorithm findings (deduplicate with existing findings by title)
+                const existingTitles = new Set(allFindings.map((f) => f.title));
+                for (const finding of audit.findings) {
+                    if (!existingTitles.has(finding.title)) {
+                        allFindings.push(finding);
+                    }
+                }
+            }
+        }
+        catch (err) {
+            sections.push(`  Error: ${err.message}`);
+        }
+        sections.push("");
+        // ── 7. Key Rollover Detection ──
+        sections.push("7. Key Rollover Detection");
+        sections.push("-".repeat(40));
+        try {
+            const rollover = await performKeyRolloverCheck(domain);
+            if (rollover.rolloverDetected) {
+                sections.push(`Rollover detected: ${rollover.method}`);
+            }
+            else {
+                sections.push("No key rollover in progress.");
+            }
+            // Add rollover findings (deduplicate)
+            const existingTitles = new Set(allFindings.map((f) => f.title));
+            for (const finding of rollover.findings) {
+                if (!existingTitles.has(finding.title)) {
+                    allFindings.push(finding);
+                }
+            }
+        }
+        catch (err) {
+            sections.push(`  Error: ${err.message}`);
+        }
+        sections.push("");
+        // ── Aggregated Findings Report ──
+        sections.push("=".repeat(60));
+        sections.push("FINDINGS SUMMARY");
+        sections.push("=".repeat(60));
+        sections.push("");
+        // Sort findings by severity
+        allFindings.sort((a, b) => severityScore(b.severity) - severityScore(a.severity));
+        const countBySeverity = {
+            critical: 0,
+            high: 0,
+            medium: 0,
+            low: 0,
+            info: 0,
+        };
+        for (const finding of allFindings) {
+            countBySeverity[finding.severity]++;
+        }
+        sections.push(`Total Findings: ${allFindings.length}`);
+        sections.push(`  Critical: ${countBySeverity.critical}`);
+        sections.push(`  High:     ${countBySeverity.high}`);
+        sections.push(`  Medium:   ${countBySeverity.medium}`);
+        sections.push(`  Low:      ${countBySeverity.low}`);
+        sections.push(`  Info:     ${countBySeverity.info}`);
+        sections.push("");
+        // Overall score (0-100, higher is better)
+        const maxPenalty = allFindings.length * 5; // worst case all critical
+        const actualPenalty = allFindings.reduce((sum, f) => sum + severityScore(f.severity), 0);
+        const score = maxPenalty > 0 ? Math.max(0, Math.round(100 - (actualPenalty / maxPenalty) * 100)) : 100;
+        // Adjust score: if not signed, cap at 20
+        const isNotSigned = allFindings.some((f) => f.title.includes("not DNSSEC signed"));
+        const finalScore = isNotSigned ? Math.min(score, 20) : score;
+        sections.push(`DNSSEC Security Score: ${finalScore}/100`);
+        sections.push("");
+        // Detailed findings
+        if (allFindings.length > 0) {
+            sections.push("Detailed Findings:");
+            sections.push("-".repeat(40));
+            for (let i = 0; i < allFindings.length; i++) {
+                const f = allFindings[i];
+                sections.push(`${i + 1}. [${f.severity.toUpperCase()}] ${f.title}`);
+                sections.push(`   ${f.description}`);
+                if (f.remediation) {
+                    sections.push(`   Remediation: ${f.remediation}`);
+                }
+                sections.push("");
+            }
+        }
+        else {
+            sections.push("No issues found. DNSSEC configuration appears healthy.");
+        }
+        return text(sections.join("\n"));
+    },
+};
+// ─── Export ───
+export const dnssecTools = [
+    dnssecValidate,
+    dnssecCheckDs,
+    dnssecCheckDnskey,
+    dnssecCheckRrsig,
+    dnssecCheckNsec,
+    dnssecAlgorithmAudit,
+    dnssecKeyRollover,
+    dnssecFullAudit,
+];
+//# sourceMappingURL=index.js.map