@cyanheads/whois-mcp-server 0.1.5 → 0.2.0

package/dist/services/rdap/rdap-service.d.ts

@@ -7,12 +7,18 @@ import type { Context } from '@cyanheads/mcp-ts-core';
 import type { AppConfig } from '@cyanheads/mcp-ts-core/config';
 import type { StorageService } from '@cyanheads/mcp-ts-core/storage';
 import type { NormalizedAsn, NormalizedDomain, NormalizedIpNetwork } from './types.js';
-/** Validate an IP address or CIDR notation */
-export declare function validateIp(ip: string): {
-    valid: boolean;
+/** Parsed lookup address; mapped IPv6 resolves through its embedded IPv4 address. */
+type ParsedIp = {
+    valid: true;
+    base: string;
+    value: bigint;
     isIpv6: boolean;
     hasCidr: boolean;
 };
+/** Parse a complete IP/CIDR token, retaining base-address lookup semantics. */
+export declare function validateIp(ip: string): ParsedIp | {
+    valid: false;
+};
 /** Build reverse PTR query name from an IPv4 address */
 export declare function ipv4ToPtr(ip: string): string;
 /** Build reverse PTR query name from an IPv6 address */
@@ -28,19 +34,24 @@ export declare class RdapService {
     /** Find the RDAP server URL for an ASN via IANA bootstrap */
     findAsnRdapServer(asnNum: number, ctx: Context): Promise<string | null>;
     /** Look up a domain registration record via RDAP */
-    lookupDomain(domain: string, ctx: Context): Promise<NormalizedDomain>;
+    lookupDomain(domain: string, ctx: Context, includeRegistrar?: boolean): Promise<NormalizedDomain>;
+    /** One optional registrar exchange, with guarded redirects and a total deadline. */
+    private registrarDetail;
     /**
-     * Check domain availability via RDAP.
-     * Returns `{ available: true }` on 404, normalized record on 200,
-     * or `{ available: null }` when TLD has no RDAP coverage.
+     * Check registry record presence; a miss never establishes registration eligibility.
+     * Recognized ICANN subdomains are rejected without querying their parent.
      */
     checkAvailability(domain: string, ctx: Context): Promise<{
-        available: true;
+        available: null;
+        registration_status: 'not_found';
+        rdap_coverage: true;
     } | {
         available: false;
+        registration_status: 'registered';
         record: NormalizedDomain;
     } | {
         available: null;
+        registration_status: 'unknown';
         rdap_coverage: false;
     }>;
     /** Look up an IP address or CIDR via RIR RDAP */
@@ -50,4 +61,5 @@ export declare class RdapService {
 }
 export declare function initRdapService(_config: AppConfig, _storage: StorageService): void;
 export declare function getRdapService(): RdapService;
+export {};
 //# sourceMappingURL=rdap-service.d.ts.map

package/dist/services/rdap/rdap-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rdap-service.d.ts","sourceRoot":"","sources":["../../../src/services/rdap/rdap-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAO/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAGrE,OAAO,KAAK,EAEV,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EAMpB,MAAM,YAAY,CAAC;AA+DpB,8CAA8C;AAC9C,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAoB5F;AAED,wDAAwD;AACxD,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE5C;AAiBD,wDAAwD;AACxD,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAiB5C;AAuLD,qBAAa,WAAW;IACtB,OAAO,CAAC,cAAc,CAAsE;IAE5F,iDAAiD;YACnC,cAAc;IAgB5B,qEAAqE;IAC/D,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAe/E;IAED,oEAAoE;IAC9D,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiDxF;IAED,6DAA6D;IACvD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAe5E;IAED,oDAAoD;IAC9C,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgD1E;IAED;;;;OAIG;IACG,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,OAAO,GACX,OAAO,CACN;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,GACnB;QAAE,SAAS,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,GAC9C;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,aAAa,EAAE,KAAK,CAAA;KAAE,CAC5C,CAwCA;IAED,iDAAiD;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8DrE;IAED,kCAAkC;IAC5B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAwDjE;CACF;AAMD,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAElF;AAED,wBAAgB,cAAc,IAAI,WAAW,CAK5C"}
+{"version":3,"file":"rdap-service.d.ts","sourceRoot":"","sources":["../../../src/services/rdap/rdap-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAO/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,KAAK,EAEV,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EAMpB,MAAM,YAAY,CAAC;AAUpB,qFAAqF;AACrF,KAAK,QAAQ,GAAG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEhG,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,CAuBlE;AAuBD,wDAAwD;AACxD,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE5C;AAsBD,wDAAwD;AACxD,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAG5C;AA0ND,qBAAa,WAAW;IACtB,OAAO,CAAC,cAAc,CAAsE;IAE5F,iDAAiD;YACnC,cAAc;IAgB5B,qEAAqE;IAC/D,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAe/E;IAED,oEAAoE;IAC9D,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiDxF;IAED,6DAA6D;IACvD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAe5E;IAED,oDAAoD;IAC9C,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,OAAO,EACZ,gBAAgB,UAAQ,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAoD3B;IAED,oFAAoF;YACtE,eAAe;IAqE7B;;;OAGG;IACG,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,OAAO,GACX,OAAO,CACN;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,mBAAmB,EAAE,WAAW,CAAC;QAAC,aAAa,EAAE,IAAI,CAAA;KAAE,GAC1E;QAAE,SAAS,EAAE,KAAK,CAAC;QAAC,mBAAmB,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,GACjF;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,mBAAmB,EAAE,SAAS,CAAC;QAAC,aAAa,EAAE,KAAK,CAAA;KAAE,CAC5E,CAkDA;IAED,iDAAiD;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiErE;IAED,kCAAkC;IAC5B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAwDjE;CACF;AAMD,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAElF;AAED,wBAAgB,cAAc,IAAI,WAAW,CAK5C"}

package/dist/services/rdap/rdap-service.js

@@ -3,8 +3,10 @@
  * Caches the IANA bootstrap JSON for 24 hours to avoid a bootstrap hop on every query.
  * @module services/rdap/rdap-service
  */
+import { isIP } from 'node:net';
 import { McpError, notFound, serviceUnavailable, validationError, } from '@cyanheads/mcp-ts-core/errors';
 import { fetchWithTimeout, withRetry } from '@cyanheads/mcp-ts-core/utils';
+import { parse } from 'tldts';
 import { getServerConfig } from '../../config/server-config.js';
 // IANA bootstrap endpoints
 const IANA_DNS_BOOTSTRAP = 'https://data.iana.org/rdap/dns.json';
@@ -12,75 +14,46 @@ const IANA_IPV4_BOOTSTRAP = 'https://data.iana.org/rdap/ipv4.json';
 const IANA_IPV6_BOOTSTRAP = 'https://data.iana.org/rdap/ipv6.json';
 const IANA_ASN_BOOTSTRAP = 'https://data.iana.org/rdap/asn.json';
 const BOOTSTRAP_TTL_MS = 24 * 60 * 60 * 1000; // 24h
-// Private/reserved IPv4 ranges
-const PRIVATE_IPV4_RANGES = [
-    /^10\./,
-    /^172\.(1[6-9]|2\d|3[01])\./,
-    /^192\.168\./,
-    /^127\./,
-    /^169\.254\./,
-    /^100\.(6[4-9]|[7-9]\d|1([01]\d|2[0-7]))\./, // CGNAT 100.64-100.127
-    /^0\./,
-    /^255\./,
-];
-// Private/reserved IPv6 ranges (string prefix checks)
-const PRIVATE_IPV6_PREFIXES = [
-    '::1', // loopback
-    'fc', // ULA fc00::/7
-    'fd', // ULA fd00::/7
-    'fe80', // link-local fe80::/10
-];
-function isPrivateIpv4(ip) {
-    return PRIVATE_IPV4_RANGES.some((r) => r.test(ip));
-}
-function isPrivateIpv6(ip) {
-    const lower = ip.toLowerCase();
-    return PRIVATE_IPV6_PREFIXES.some((p) => lower.startsWith(p));
-}
-/** Check if an IP or CIDR base is private/reserved. */
-function isPrivateIp(ip) {
-    const base = ip.split('/')[0] ?? '';
-    if (base.includes(':'))
-        return isPrivateIpv6(base);
-    return isPrivateIpv4(base);
-}
-/** Simple IPv4 validation */
-function isValidIpv4(ip) {
-    const parts = ip.split('.');
-    if (parts.length !== 4)
-        return false;
-    return parts.every((p) => {
-        const n = parseInt(p, 10);
-        return !Number.isNaN(n) && n >= 0 && n <= 255 && String(n) === p;
-    });
-}
-/** Simple IPv6 validation — accepts compressed forms */
-function isValidIpv6(ip) {
-    if (!ip.includes(':'))
-        return false;
-    if (ip.split(':').length > 8)
-        return false;
-    return /^[0-9a-fA-F:]+$/.test(ip);
-}
-/** Validate an IP address or CIDR notation */
+/** Parse a complete IP/CIDR token, retaining base-address lookup semantics. */
 export function validateIp(ip) {
-    const parts = ip.split('/');
-    const base = parts[0] ?? '';
-    const hasCidr = parts.length === 2;
-    if (hasCidr) {
-        const prefix = parseInt(parts[1] ?? '', 10);
-        if (Number.isNaN(prefix) || prefix < 0)
-            return { valid: false, isIpv6: false, hasCidr: true };
+    const [base = '', prefix, ...extra] = ip.split('/');
+    const family = isIP(base);
+    if (!family || base.includes('%') || extra.length > 0)
+        return { valid: false };
+    if (prefix !== undefined &&
+        (!/^\d+$/.test(prefix) || Number(prefix) > (family === 6 ? 128 : 32))) {
+        return { valid: false };
     }
-    const isIpv6 = base.includes(':');
-    if (isIpv6) {
-        if (hasCidr && parseInt(parts[1] ?? '129', 10) > 128)
-            return { valid: false, isIpv6: true, hasCidr: true };
-        return { valid: isValidIpv6(base), isIpv6: true, hasCidr };
+    const value = family === 6 ? ipv6ToBigInt(base) : ipv4ToBigInt(base);
+    const mapped = family === 6 && value >> 32n === 0xffffn;
+    const lookupValue = mapped ? value & 0xffffffffn : value;
+    const lookupBase = mapped
+        ? [24n, 16n, 8n, 0n].map((shift) => Number((lookupValue >> shift) & 255n)).join('.')
+        : base;
+    return {
+        valid: true,
+        base: lookupBase,
+        value: lookupValue,
+        isIpv6: family === 6 && !mapped,
+        hasCidr: prefix !== undefined,
+    };
+}
+/** Apply the server's explicit exclusions, not a blanket special-use policy. */
+function isPrivateIp(ip) {
+    if (ip.isIpv6) {
+        return ip.value === 1n || ip.value >> 121n === 0x7en || ip.value >> 118n === 0x3fan;
     }
-    if (hasCidr && parseInt(parts[1] ?? '33', 10) > 32)
-        return { valid: false, isIpv6: false, hasCidr: true };
-    return { valid: isValidIpv4(base), isIpv6: false, hasCidr };
+    const first = Number(ip.value >> 24n);
+    const second = Number((ip.value >> 16n) & 255n);
+    return ([0, 10, 127, 255].includes(first) ||
+        (first === 100 && second >= 64 && second <= 127) ||
+        (first === 169 && second === 254) ||
+        (first === 172 && second >= 16 && second <= 31) ||
+        (first === 192 && second === 168));
+}
+/** Convert a validated IPv4 address to its numeric value. */
+function ipv4ToBigInt(ip) {
+    return ip.split('.').reduce((value, octet) => (value << 8n) | BigInt(octet), 0n);
 }
 /** Build reverse PTR query name from an IPv4 address */
 export function ipv4ToPtr(ip) {
@@ -88,6 +61,11 @@ export function ipv4ToPtr(ip) {
 }
 /** Expand a compressed IPv6 address to a full 128-bit BigInt */
 function ipv6ToBigInt(ip) {
+    if (ip.includes('.')) {
+        const lastColon = ip.lastIndexOf(':');
+        const tail = ipv4ToBigInt(ip.slice(lastColon + 1));
+        ip = `${ip.slice(0, lastColon + 1)}${(tail >> 16n).toString(16)}:${(tail & 0xffffn).toString(16)}`;
+    }
     let groups;
     if (ip.includes('::')) {
         const parts = ip.split('::');
@@ -103,22 +81,7 @@ function ipv6ToBigInt(ip) {
 }
 /** Build reverse PTR query name from an IPv6 address */
 export function ipv6ToPtr(ip) {
-    let hex;
-    // Handle :: compression
-    if (ip.includes('::')) {
-        const parts = ip.split('::');
-        const left = parts[0] ? parts[0].split(':') : [];
-        const right = parts[1] ? parts[1].split(':') : [];
-        const missing = 8 - left.length - right.length;
-        const full = [...left, ...Array(missing).fill('0'), ...right];
-        hex = full.map((g) => g.padStart(4, '0')).join('');
-    }
-    else {
-        hex = ip
-            .split(':')
-            .map((g) => g.padStart(4, '0'))
-            .join('');
-    }
+    const hex = ipv6ToBigInt(ip).toString(16).padStart(32, '0');
     return `${hex.split('').reverse().join('.')}.ip6.arpa`;
 }
 /** Extract top-level TLD (last label) */
@@ -134,17 +97,15 @@ function extractTwoLabelSuffix(domain) {
     return labels.slice(-2).join('.');
 }
 /** Identify RIR from an RDAP self-link URL */
-function ririFromSelfLink(selfLink) {
-    if (selfLink.includes('arin.net'))
-        return 'ARIN';
-    if (selfLink.includes('ripe.net'))
-        return 'RIPE';
-    if (selfLink.includes('apnic.net'))
-        return 'APNIC';
-    if (selfLink.includes('lacnic.net'))
-        return 'LACNIC';
-    if (selfLink.includes('afrinic.net'))
-        return 'AFRINIC';
+function rirFromSelfLink(selfLink) {
+    const url = URL.parse(selfLink);
+    if (!url)
+        return;
+    const hostname = url.hostname.toLowerCase().replace(/\.$/, '');
+    for (const rir of ['arin', 'ripe', 'apnic', 'lacnic', 'afrinic']) {
+        if (hostname === `${rir}.net` || hostname.endsWith(`.${rir}.net`))
+            return rir.toUpperCase();
+    }
     return;
 }
 /** Extract vCard field value by field name */
@@ -191,6 +152,29 @@ function findEntityByRole(entities, role) {
 function registrarIanaId(entity) {
     return entity.publicIds?.find((p) => p.type === 'IANA Registrar ID')?.identifier;
 }
+const REDACTED_VALUES = new Set([
+    'REDACTED FOR PRIVACY',
+    'REDACTED REGISTRANT',
+    'REDACTED',
+    'DATA REDACTED',
+    'NOT DISCLOSED',
+]);
+/** Registrant organization and explicit, scoped privacy evidence; absence stays unknown. */
+function registrantEvidence(raw) {
+    const registrant = findEntityByRole(raw.entities ?? [], 'registrant');
+    const org = registrant?.vcardArray ? vcardField(registrant.vcardArray[1], 'org') : undefined;
+    const placeholder = (value) => value !== undefined && REDACTED_VALUES.has(value.trim().toUpperCase());
+    const entityRedaction = registrant &&
+        (placeholder(entityName(registrant)) ||
+            placeholder(org) ||
+            (registrant.redacted?.length ?? 0) > 0 ||
+            registrant.remarks?.some((remark) => /redact|privacy/i.test([remark.title, ...(remark.description ?? [])].join(' '))));
+    const scopedRedaction = raw.redacted?.some((entry) => /registrant/i.test([entry.name?.type, entry.name?.description, entry.prePath, entry.postPath].join(' ')));
+    return {
+        ...(org && !placeholder(org) ? { registrant_org: org } : {}),
+        registrant_redacted: entityRedaction || scopedRedaction ? true : null,
+    };
+}
 /** Normalize RDAP domain response to our output shape */
 function normalizeDomain(raw) {
     const events = raw.events ?? [];
@@ -202,9 +186,7 @@ function normalizeDomain(raw) {
     const registrarEntity = findEntityByRole(entities, 'registrar');
     const registrar = registrarEntity ? entityName(registrarEntity) : undefined;
     const registrarIanaIdVal = registrarEntity ? registrarIanaId(registrarEntity) : undefined;
-    const registrantEntity = findEntityByRole(entities, 'registrant');
-    const registrantOrg = registrantEntity ? entityName(registrantEntity) : undefined;
-    const registrantRedacted = !registrantOrg;
+    const evidence = registrantEvidence(raw);
     const rdapLastUpdated = getDate('last update of RDAP database');
     const createdDate = getDate('registration');
     const updatedDate = getDate('last changed');
@@ -216,8 +198,8 @@ function normalizeDomain(raw) {
         rdap_coverage: true,
         status: raw.status ?? [],
         nameservers,
-        dnssec_signed: raw.secureDNS?.delegationSigned ?? false,
-        registrant_redacted: registrantRedacted,
+        dnssec_signed: raw.secureDNS?.delegationSigned ?? null,
+        ...evidence,
     };
     if (raw.handle !== undefined)
         result.handle = raw.handle;
@@ -233,8 +215,6 @@ function normalizeDomain(raw) {
         result.expiry_date = expiryDate;
     if (rdapLastUpdated !== undefined)
         result.rdap_last_updated = rdapLastUpdated;
-    if (registrantOrg !== undefined)
-        result.registrant_org = registrantOrg;
     return result;
 }
 /** Normalize RDAP IP network response */
@@ -244,27 +224,27 @@ function normalizeIpNetwork(raw, ip) {
     const abuse = findEntityByRole(entities, 'abuse');
     const orgName = registrant ? entityName(registrant) : undefined;
     const abuseEmail = abuse ? entityEmail(abuse) : undefined;
-    let cidr;
-    if (raw.cidr0_cidrs && raw.cidr0_cidrs.length > 0) {
-        const c = raw.cidr0_cidrs[0];
-        if (c) {
-            if (c.v4prefix !== undefined && c.length !== undefined)
-                cidr = `${c.v4prefix}/${c.length}`;
-            else if (c.v6prefix !== undefined && c.length !== undefined)
-                cidr = `${c.v6prefix}/${c.length}`;
-        }
-    }
+    const cidrs = (raw.cidr0_cidrs ?? []).flatMap((component) => {
+        const prefix = component.v4prefix ?? component.v6prefix;
+        return prefix !== undefined && component.length !== undefined
+            ? [`${prefix}/${component.length}`]
+            : [];
+    });
     const selfLink = raw.links?.find((l) => l.rel === 'self')?.href ?? '';
-    const rdapSource = ririFromSelfLink(selfLink);
-    const result = { ip, ptr: null };
+    const rdapSource = rirFromSelfLink(selfLink);
+    const result = {
+        ip,
+        cidrs,
+        ...(cidrs.length === 1 ? { cidr: cidrs.join() } : {}),
+        ptr: null,
+        ptr_status: 'not_found',
+    };
     if (raw.handle !== undefined)
         result.handle = raw.handle;
     if (raw.startAddress !== undefined)
         result.start_address = raw.startAddress;
     if (raw.endAddress !== undefined)
         result.end_address = raw.endAddress;
-    if (cidr !== undefined)
-        result.cidr = cidr;
     if (raw.ipVersion !== undefined)
         result.ip_version = raw.ipVersion;
     if (raw.name !== undefined)
@@ -287,7 +267,7 @@ function normalizeAutnum(raw, asn) {
     const registrant = findEntityByRole(entities, 'registrant');
     const orgName = registrant ? entityName(registrant) : undefined;
     const selfLink = raw.links?.find((l) => l.rel === 'self')?.href ?? '';
-    const rir = ririFromSelfLink(selfLink);
+    const rir = rirFromSelfLink(selfLink);
     const result = { asn };
     if (raw.handle !== undefined)
         result.handle = raw.handle;
@@ -383,7 +363,7 @@ export class RdapService {
                 const netParts = net.split('.').map(Number);
                 if (netParts.length !== 4 || parts.length !== 4)
                     continue;
-                const mask = ~((1 << (32 - prefixLen)) - 1);
+                const mask = prefixLen === 0 ? 0 : ~((1 << (32 - prefixLen)) - 1);
                 const [n0, n1, n2, n3] = netParts;
                 const [p0, p1, p2, p3] = parts;
                 const netNum = (n0 << 24) | (n1 << 16) | (n2 << 8) | n3;
@@ -413,7 +393,8 @@ export class RdapService {
         return null;
     }
     /** Look up a domain registration record via RDAP */
-    async lookupDomain(domain, ctx) {
+    async lookupDomain(domain, ctx, includeRegistrar = false) {
+        ctx.signal.throwIfAborted();
         const rdapServer = await this.findDomainRdapServer(domain, ctx);
         if (!rdapServer) {
             return {
@@ -421,8 +402,8 @@ export class RdapService {
                 rdap_coverage: false,
                 status: [],
                 nameservers: [],
-                dnssec_signed: false,
-                registrant_redacted: false,
+                dnssec_signed: null,
+                registrant_redacted: null,
             };
         }
         const config = getServerConfig();
@@ -441,15 +422,19 @@ export class RdapService {
                 maxRetries: config.rdapMaxRetries,
                 baseDelayMs: 1000,
                 signal: ctx.signal,
-                // 404 is NOT transient — domain is not registered; don't retry
+                // A missing registry object is terminal, not an eligibility statement.
                 isTransient: (err) => !isRdapNotFound(err),
             });
-            return normalizeDomain(raw);
+            const record = normalizeDomain(raw);
+            ctx.signal.throwIfAborted();
+            if (includeRegistrar)
+                record.registrar_detail = await this.registrarDetail(raw, domain, ctx);
+            return record;
         }
         catch (err) {
-            // RDAP 404 on a domain lookup means the domain is not registered
+            // RDAP 404 establishes record absence only.
             if (isRdapNotFound(err)) {
-                throw notFound(`Domain "${domain}" is not registered (RDAP 404).`, {
+                throw notFound(`No RDAP domain record found for "${domain}" (404).`, {
                     reason: 'domain_not_found',
                     domain: domain.toLowerCase(),
                 });
@@ -457,15 +442,82 @@ export class RdapService {
             throw err;
         }
     }
+    /** One optional registrar exchange, with guarded redirects and a total deadline. */
+    async registrarDetail(raw, domain, ctx) {
+        const referral = raw.links?.find((link) => link.rel === 'related' && link.type?.toLowerCase() === 'application/rdap+json' && link.href)?.href;
+        if (!referral)
+            return { status: 'no_referral' };
+        try {
+            const url = new URL(referral);
+            if (url.protocol !== 'https:' || url.username || url.password)
+                throw validationError('Registrar referral must use HTTPS without credentials.');
+            const signal = AbortSignal.any([
+                ctx.signal,
+                AbortSignal.timeout(getServerConfig().rdapTimeoutMs),
+            ]);
+            signal.throwIfAborted();
+            const aborted = Promise.withResolvers();
+            const onAbort = () => aborted.reject(signal.reason);
+            signal.addEventListener('abort', onAbort, { once: true });
+            let response;
+            try {
+                // The guard's DNS preflight precedes its fetch timer; bound that await as well.
+                response = await Promise.race([
+                    fetchWithTimeout(url, getServerConfig().rdapTimeoutMs, ctx, {
+                        headers: { Accept: 'application/rdap+json' },
+                        signal,
+                        rejectPrivateIPs: true,
+                    }),
+                    aborted.promise,
+                ]);
+            }
+            finally {
+                signal.removeEventListener('abort', onAbort);
+            }
+            if (!response.headers
+                .get('content-type')
+                ?.toLowerCase()
+                .split(';')[0]
+                ?.trim()
+                .match(/^application\/(?:rdap\+json|json)$/))
+                throw serviceUnavailable('Registrar response is not RDAP JSON.');
+            const detail = await response.json();
+            signal.throwIfAborted();
+            if (!detail ||
+                typeof detail !== 'object' ||
+                !('objectClassName' in detail) ||
+                detail.objectClassName !== 'domain' ||
+                !('ldhName' in detail) ||
+                typeof detail.ldhName !== 'string' ||
+                detail.ldhName.toLowerCase() !== domain.toLowerCase())
+                throw serviceUnavailable('Registrar response does not contain the matching domain object.');
+            const evidence = registrantEvidence(detail);
+            return { status: 'found', source: response.url || url.href, ...evidence };
+        }
+        catch (error) {
+            ctx.signal.throwIfAborted();
+            return {
+                status: 'failed',
+                source: referral,
+                source_error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
     /**
-     * Check domain availability via RDAP.
-     * Returns `{ available: true }` on 404, normalized record on 200,
-     * or `{ available: null }` when TLD has no RDAP coverage.
+     * Check registry record presence; a miss never establishes registration eligibility.
+     * Recognized ICANN subdomains are rejected without querying their parent.
      */
     async checkAvailability(domain, ctx) {
+        const suffix = parse(domain, { allowPrivateDomains: false });
+        if (suffix.isIcann && suffix.domain && suffix.subdomain) {
+            throw validationError(`"${domain}" is a subdomain; its registrable parent is "${suffix.domain}".`, {
+                reason: 'non_registrable_domain',
+                registrable_parent: suffix.domain,
+            });
+        }
         const rdapServer = await this.findDomainRdapServer(domain, ctx);
         if (!rdapServer) {
-            return { available: null, rdap_coverage: false };
+            return { available: null, registration_status: 'unknown', rdap_coverage: false };
         }
         const config = getServerConfig();
         const url = `${rdapServer}/domain/${encodeURIComponent(domain.toLowerCase())}`;
@@ -483,39 +535,42 @@ export class RdapService {
                 maxRetries: config.rdapMaxRetries,
                 baseDelayMs: 1000,
                 signal: ctx.signal,
-                // 404 is NOT transient — it's the availability signal
+                // A registry miss is terminal record-status data.
                 isTransient: (err) => !isRdapNotFound(err),
             });
             const record = normalizeDomain(raw);
-            return { available: false, record };
+            return { available: false, registration_status: 'registered', record };
         }
         catch (err) {
-            // A 404 from the RDAP server means the domain is available (not registered)
+            // Preserve record absence independently of registration eligibility.
             if (isRdapNotFound(err)) {
-                return { available: true };
+                return { available: null, registration_status: 'not_found', rdap_coverage: true };
             }
             throw err;
         }
     }
     /** Look up an IP address or CIDR via RIR RDAP */
     async lookupIp(ip, ctx) {
-        const { valid, isIpv6 } = validateIp(ip);
-        if (!valid) {
+        const parsed = validateIp(ip);
+        if (!parsed.valid) {
             throw validationError(`"${ip}" is not a valid IPv4, IPv6, or CIDR address.`, {
                 reason: 'invalid_ip',
-                ...ctx.recoveryFor('invalid_ip'),
             });
         }
-        const base = ip.split('/')[0] ?? '';
-        if (isPrivateIp(base)) {
-            throw validationError(`"${base}" is a private or reserved IP address — no RIR RDAP record exists for it.`, {
+        const { base, isIpv6 } = parsed;
+        if (isPrivateIp(parsed)) {
+            throw validationError(`"${base}" is in an address range excluded by this server's lookup policy.`, {
                 reason: 'private_range',
-                ...ctx.recoveryFor('private_range'),
             });
         }
-        const rdapServer = await this.findIpRdapServer(ip, isIpv6, ctx);
+        const rdapServer = await this.findIpRdapServer(base, isIpv6, ctx);
         if (!rdapServer) {
-            throw serviceUnavailable('No RIR RDAP server found for this IP address range.', { ip });
+            throw notFound('No RIR RDAP route covers this IP address in the IANA bootstrap.', {
+                ip,
+                reason: 'ip_no_rdap_route',
+                retryable: false,
+                ...ctx.recoveryFor('ip_no_rdap_route'),
+            });
         }
         const config = getServerConfig();
         // IPv6 addresses contain colons which must NOT be percent-encoded in the RDAP path.
@@ -553,12 +608,12 @@ export class RdapService {
     }
     /** Look up an ASN via RIR RDAP */
     async lookupAsn(asn, ctx) {
-        const asnClean = asn.toUpperCase().replace(/^AS/, '');
-        const asnNum = parseInt(asnClean, 10);
-        if (Number.isNaN(asnNum) || asnNum <= 0) {
-            throw validationError(`"${asn}" is not a valid ASN. Expected AS<number> or bare integer (e.g., AS15169 or 15169).`, {
+        const token = asn.trim();
+        const match = /^(?:AS\s*)?\+?(\d+)$/i.exec(token);
+        const asnNum = match ? Number(match[1]) : NaN;
+        if (!Number.isInteger(asnNum) || asnNum < 1 || asnNum > 4294967295) {
+            throw validationError(`"${asn}" is not a valid ASN. Expected a decimal integer from 1 to 4294967295, optionally prefixed with AS and a leading + (e.g., AS15169 or +15169).`, {
                 reason: 'invalid_asn',
-                ...ctx.recoveryFor('invalid_asn'),
             });
         }
         const rdapServer = await this.findAsnRdapServer(asnNum, ctx);