@cyanheads/whois-mcp-server 0.1.6 → 0.2.0

package/AGENTS.md

@@ -1,10 +1,10 @@
 # Developer Protocol
 
 **Server:** whois-mcp-server
-**Version:** 0.1.6
-**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.10`
+**Version:** 0.2.0
+**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.15`
 **Engines:** Bun ≥1.4.0, Node ≥24.0.0
-**MCP SDK:** `@modelcontextprotocol/server` ^2.1.0
+**MCP SDK:** `@modelcontextprotocol/server` ^2.3.1
 **Zod:** ^4.6.5
 
 > **Read the framework docs first:** `node_modules/@cyanheads/mcp-ts-core/CLAUDE.md` contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.
@@ -52,7 +52,7 @@ import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
 import { getRdapService } from '@/services/rdap/rdap-service.js';
 
 export const whoisLookupDomain = tool('whois_lookup_domain', {
-  description: 'Look up a domain\'s registration record — registrar, created/expiry dates, nameservers, EPP status codes, DNSSEC flag, and registrant org (where not privacy-redacted). RDAP-first via IANA auto-bootstrap.',
+  description: 'Look up registry registration data with provider DNSSEC and privacy evidence. Public registrant org is independent of contact redaction.',
   annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
   input: z.object({
     domain: z.string().describe('Domain name to look up (e.g. "github.com")'),
@@ -67,8 +67,8 @@ export const whoisLookupDomain = tool('whois_lookup_domain', {
       when: 'TLD has no RDAP server in IANA bootstrap',
       recovery: 'Use whois_check_availability instead or try a different TLD.' },
     { reason: 'domain_not_found', code: JsonRpcErrorCode.NotFound,
-      when: 'RDAP returned 404 — domain not registered',
-      recovery: 'Use whois_check_availability to confirm the domain is available.' },
+      when: 'RDAP returned 404 — no registry object found',
+      recovery: 'Use whois_check_availability for record status; no eligibility guarantee is implied.' },
   ],
   async handler(input, ctx) {
     const rdap = getRdapService();
@@ -110,6 +110,8 @@ export function getServerConfig() {
 
 For env booleans use `z.stringbool()`, never `z.coerce.boolean()` — `Boolean("false")` is `true`, so a coerced flag can't be disabled through the environment. `z.stringbool()` parses `true/false/1/0/yes/no/on/off` and rejects anything else, so `=false` actually disables.
 
+Call `getServerConfig()` in `createApp()`'s `setup()` before initializing services so invalid environment values fail startup before the transport binds.
+
 ### Server identity and instructions
 
 `createApp()` accepts optional identity fields forwarded to the SDK's `initialize` response and the server manifest (`/.well-known/mcp.json`):
@@ -225,16 +227,26 @@ src/
   mcp-server/
     tools/definitions/
       whois-lookup-domain.tool.ts       # Domain registration record via RDAP
-      whois-check-availability.tool.ts  # Domain availability check (RDAP 404 = available)
+      whois-check-availability.tool.ts  # Registry record status; no eligibility guarantee
       whois-get-dns.tool.ts             # DNS records via DoH (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, PTR)
       whois-lookup-ip.tool.ts           # IP/CIDR netblock, org, abuse contact via RIR RDAP
       whois-lookup-asn.tool.ts          # ASN to org/RIR resolution via RIR RDAP
       whois-get-dossier.tool.ts         # One-call domain triage — registration + DNS in parallel
-      _fqdn.ts                          # Shared FQDN validation helper
+      _fqdn.ts                          # Shared registration/DNS/ASN/IP syntax patterns
 ```
 
 ---
 
+## Lookup Contracts
+
+Registry object absence never establishes registration eligibility. `whois_check_availability` reports `registration_status: registered | not_found | unknown`, with `available: false` only for a found record and null otherwise. ICANN-only suffix recognition rejects known subdomains without silently querying their parent; private suffixes do not create registry boundaries.
+
+Registrant org comes from jCard `org`; personal `fn` is not organization data. Explicit registrant redaction and missing evidence yield true and null respectively; public org survives independently. DNSSEC preserves provider `delegationSigned`, with missing/no-coverage evidence null. Domain and dossier formatters render unknown states explicitly. Optional `include_registrar` detail stays nested, never overriding registry authority; one referral, no retry/recursion, five guarded redirects and one total RDAP deadline. Destination checks are best-effort against DNS rebinding.
+
+DNS owner syntax separately permits underscores and one normalized root dot. Failure RCODEs and truncated replies never become empty successes; CAA does not repeat NextDNS as fallback, and cancellation starts no further requests. TXT uses complete literal fences, not an injection boundary. PTR selects only reachable owner-matched records, allows five aliases under one DNS deadline, and discloses found/not_found/failed plus failure detail. IP output retains all ordered `cidrs`, with scalar `cidr` only for one component. A missing IANA route is non-retryable `ip_no_rdap_route`; bootstrap fetch failure stays operational.
+
+Serialized patterns are the syntax gate (`InvalidParams`/`invalid_arguments`); IP/ASN semantic parsing and exclusions retain typed reasons. Preserve existing ASN whitespace/plus/zero-padding and CIDR padding without arbitrary input ceilings. See `docs/design.md` for the domain decisions.
+
 ## Naming
 
 | What | Convention | Example |
@@ -364,7 +376,7 @@ security: false                            # optional — true ONLY for a source
 
 ## Publishing
 
-**Every release goes through a release PR, straight-through** — `git-wrapup`'s "Release PR mode", mode `straight-through`. One run: `git-wrapup` lands the commit stack on `release/<version>`, pushes it, and opens the PR (title = the release commit subject, body = the changelog entry plus a gates section); `release-and-publish` then fast-forwards `main` locally with `git merge --ff-only`, creates the tag on `main`'s tip, pushes `main` and the tag, deletes the branch, and publishes. A caller's brief may run a given release as `gated` instead — a `release-pr-review` pass on the open PR before `release-and-publish`. **Never merge through the GitHub UI or `gh pr merge`**: squash and rebase-merge are disabled in the repo settings because both rewrite the stack (rebase-merge also strips the SSH signatures), and a merge commit breaks the linear history.
+**Every release goes through a release PR, straight-through** — `git-wrapup`'s "Release PR mode", mode `straight-through`. One run: `git-wrapup` lands the commit stack on `release/<version>`, pushes it, and opens the PR (title = the release commit subject, body = the release digest: theme line, `## Changes`, `## Gates`, changelog link last); `release-and-publish` then fast-forwards `main` locally with `git merge --ff-only`, creates the tag on `main`'s tip, pushes `main` and the tag, deletes the branch, and publishes. A caller's brief may run a given release as `gated` instead — a `release-pr-review` pass on the open PR before `release-and-publish`. **Never merge through the GitHub UI or `gh pr merge`**: squash and rebase-merge are disabled in the repo settings because both rewrite the stack (rebase-merge also strips the SSH signatures), and a merge commit breaks the linear history.
 
 ---
 

package/CLAUDE.md

@@ -1,10 +1,10 @@
 # Developer Protocol
 
 **Server:** whois-mcp-server
-**Version:** 0.1.6
-**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.10`
+**Version:** 0.2.0
+**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.15`
 **Engines:** Bun ≥1.4.0, Node ≥24.0.0
-**MCP SDK:** `@modelcontextprotocol/server` ^2.1.0
+**MCP SDK:** `@modelcontextprotocol/server` ^2.3.1
 **Zod:** ^4.6.5
 
 > **Read the framework docs first:** `node_modules/@cyanheads/mcp-ts-core/CLAUDE.md` contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.
@@ -52,7 +52,7 @@ import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
 import { getRdapService } from '@/services/rdap/rdap-service.js';
 
 export const whoisLookupDomain = tool('whois_lookup_domain', {
-  description: 'Look up a domain\'s registration record — registrar, created/expiry dates, nameservers, EPP status codes, DNSSEC flag, and registrant org (where not privacy-redacted). RDAP-first via IANA auto-bootstrap.',
+  description: 'Look up registry registration data with provider DNSSEC and privacy evidence. Public registrant org is independent of contact redaction.',
   annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
   input: z.object({
     domain: z.string().describe('Domain name to look up (e.g. "github.com")'),
@@ -67,8 +67,8 @@ export const whoisLookupDomain = tool('whois_lookup_domain', {
       when: 'TLD has no RDAP server in IANA bootstrap',
       recovery: 'Use whois_check_availability instead or try a different TLD.' },
     { reason: 'domain_not_found', code: JsonRpcErrorCode.NotFound,
-      when: 'RDAP returned 404 — domain not registered',
-      recovery: 'Use whois_check_availability to confirm the domain is available.' },
+      when: 'RDAP returned 404 — no registry object found',
+      recovery: 'Use whois_check_availability for record status; no eligibility guarantee is implied.' },
   ],
   async handler(input, ctx) {
     const rdap = getRdapService();
@@ -110,6 +110,8 @@ export function getServerConfig() {
 
 For env booleans use `z.stringbool()`, never `z.coerce.boolean()` — `Boolean("false")` is `true`, so a coerced flag can't be disabled through the environment. `z.stringbool()` parses `true/false/1/0/yes/no/on/off` and rejects anything else, so `=false` actually disables.
 
+Call `getServerConfig()` in `createApp()`'s `setup()` before initializing services so invalid environment values fail startup before the transport binds.
+
 ### Server identity and instructions
 
 `createApp()` accepts optional identity fields forwarded to the SDK's `initialize` response and the server manifest (`/.well-known/mcp.json`):
@@ -225,16 +227,26 @@ src/
   mcp-server/
     tools/definitions/
       whois-lookup-domain.tool.ts       # Domain registration record via RDAP
-      whois-check-availability.tool.ts  # Domain availability check (RDAP 404 = available)
+      whois-check-availability.tool.ts  # Registry record status; no eligibility guarantee
       whois-get-dns.tool.ts             # DNS records via DoH (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, PTR)
       whois-lookup-ip.tool.ts           # IP/CIDR netblock, org, abuse contact via RIR RDAP
       whois-lookup-asn.tool.ts          # ASN to org/RIR resolution via RIR RDAP
       whois-get-dossier.tool.ts         # One-call domain triage — registration + DNS in parallel
-      _fqdn.ts                          # Shared FQDN validation helper
+      _fqdn.ts                          # Shared registration/DNS/ASN/IP syntax patterns
 ```
 
 ---
 
+## Lookup Contracts
+
+Registry object absence never establishes registration eligibility. `whois_check_availability` reports `registration_status: registered | not_found | unknown`, with `available: false` only for a found record and null otherwise. ICANN-only suffix recognition rejects known subdomains without silently querying their parent; private suffixes do not create registry boundaries.
+
+Registrant org comes from jCard `org`; personal `fn` is not organization data. Explicit registrant redaction and missing evidence yield true and null respectively; public org survives independently. DNSSEC preserves provider `delegationSigned`, with missing/no-coverage evidence null. Domain and dossier formatters render unknown states explicitly. Optional `include_registrar` detail stays nested, never overriding registry authority; one referral, no retry/recursion, five guarded redirects and one total RDAP deadline. Destination checks are best-effort against DNS rebinding.
+
+DNS owner syntax separately permits underscores and one normalized root dot. Failure RCODEs and truncated replies never become empty successes; CAA does not repeat NextDNS as fallback, and cancellation starts no further requests. TXT uses complete literal fences, not an injection boundary. PTR selects only reachable owner-matched records, allows five aliases under one DNS deadline, and discloses found/not_found/failed plus failure detail. IP output retains all ordered `cidrs`, with scalar `cidr` only for one component. A missing IANA route is non-retryable `ip_no_rdap_route`; bootstrap fetch failure stays operational.
+
+Serialized patterns are the syntax gate (`InvalidParams`/`invalid_arguments`); IP/ASN semantic parsing and exclusions retain typed reasons. Preserve existing ASN whitespace/plus/zero-padding and CIDR padding without arbitrary input ceilings. See `docs/design.md` for the domain decisions.
+
 ## Naming
 
 | What | Convention | Example |
@@ -364,7 +376,7 @@ security: false                            # optional — true ONLY for a source
 
 ## Publishing
 
-**Every release goes through a release PR, straight-through** — `git-wrapup`'s "Release PR mode", mode `straight-through`. One run: `git-wrapup` lands the commit stack on `release/<version>`, pushes it, and opens the PR (title = the release commit subject, body = the changelog entry plus a gates section); `release-and-publish` then fast-forwards `main` locally with `git merge --ff-only`, creates the tag on `main`'s tip, pushes `main` and the tag, deletes the branch, and publishes. A caller's brief may run a given release as `gated` instead — a `release-pr-review` pass on the open PR before `release-and-publish`. **Never merge through the GitHub UI or `gh pr merge`**: squash and rebase-merge are disabled in the repo settings because both rewrite the stack (rebase-merge also strips the SSH signatures), and a merge commit breaks the linear history.
+**Every release goes through a release PR, straight-through** — `git-wrapup`'s "Release PR mode", mode `straight-through`. One run: `git-wrapup` lands the commit stack on `release/<version>`, pushes it, and opens the PR (title = the release commit subject, body = the release digest: theme line, `## Changes`, `## Gates`, changelog link last); `release-and-publish` then fast-forwards `main` locally with `git merge --ff-only`, creates the tag on `main`'s tip, pushes `main` and the tag, deletes the branch, and publishes. A caller's brief may run a given release as `gated` instead — a `release-pr-review` pass on the open PR before `release-and-publish`. **Never merge through the GitHub UI or `gh pr merge`**: squash and rebase-merge are disabled in the repo settings because both rewrite the stack (rebase-merge also strips the SSH signatures), and a merge commit breaks the linear history.
 
 ---
 

package/Dockerfile

@@ -4,7 +4,7 @@
 # This stage installs all dependencies (including dev), builds the TypeScript
 # source code into JavaScript, and prepares the production assets.
 # ==============================================================================
-FROM --platform=$BUILDPLATFORM oven/bun:1.4.2 AS build
+FROM --platform=$BUILDPLATFORM oven/bun:1.4.3 AS build
 
 WORKDIR /usr/src/app
 
@@ -29,7 +29,7 @@ RUN bun run build
 # Run the scanner and OTel installer natively, cross-installing dependencies for
 # the target architecture. Only node_modules enters the production image.
 # ==============================================================================
-FROM --platform=$BUILDPLATFORM oven/bun:1.4.2 AS deps
+FROM --platform=$BUILDPLATFORM oven/bun:1.4.3 AS deps
 
 WORKDIR /usr/src/app
 
@@ -59,6 +59,9 @@ RUN --mount=type=cache,target=/root/.bun/install/cache \
       bun scripts/install-otel.ts --os="$TARGETOS" --cpu="$(cat .bun-cpu)"; \
     fi
 
+COPY scripts/prune-musl-packages.ts ./scripts/
+RUN bun scripts/prune-musl-packages.ts
+
 RUN rm -rf node_modules/@socketsecurity/bun-security-scanner
 
 
@@ -69,7 +72,7 @@ RUN rm -rf node_modules/@socketsecurity/bun-security-scanner
 # application. It uses a slim base image and only includes production
 # dependencies and build artifacts.
 # ==============================================================================
-FROM oven/bun:1.4.2-slim AS production
+FROM oven/bun:1.4.3-slim AS production
 
 WORKDIR /usr/src/app
 
@@ -80,7 +83,7 @@ ENV NODE_ENV=production
 # OCI image metadata (https://github.com/opencontainers/image-spec/blob/main/annotations.md)
 ARG APP_VERSION
 LABEL org.opencontainers.image.title="whois-mcp-server"
-LABEL org.opencontainers.image.description="Look up domain registration, check availability, fetch DNS records, and resolve IPs and ASNs via RDAP and DNS-over-HTTPS via MCP. STDIO or Streamable HTTP."
+LABEL org.opencontainers.image.description="Look up domain registration, check registry record status, fetch DNS records, and resolve IPs and ASNs over RDAP and DNS-over-HTTPS via MCP. STDIO or Streamable HTTP."
 LABEL org.opencontainers.image.source="https://github.com/cyanheads/whois-mcp-server"
 LABEL org.opencontainers.image.licenses="Apache-2.0"
 LABEL org.opencontainers.image.version="${APP_VERSION}"

package/README.md

@@ -1,13 +1,13 @@
 <div align="center">
   <h1>@cyanheads/whois-mcp-server</h1>
-  <p><b>Look up domain registration, check availability, fetch DNS records, and resolve IPs and ASNs via RDAP and DNS-over-HTTPS via MCP. STDIO or Streamable HTTP.</b>
+  <p><b>Look up domain registration, check registry record status, fetch DNS records, and resolve IPs and ASNs over RDAP and DNS-over-HTTPS via MCP. STDIO or Streamable HTTP.</b>
   <div>6 Tools</div>
   </p>
 </div>
 
 <div align="center">
 
-[![Version](https://img.shields.io/badge/Version-0.1.6-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/whois-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^2.1.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![npm](https://img.shields.io/npm/v/@cyanheads/whois-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/whois-mcp-server) [![TypeScript](https://img.shields.io/badge/TypeScript-^7.0.2-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.4.2-blueviolet.svg?style=flat-square)](https://bun.sh/)
+[![Version](https://img.shields.io/badge/Version-0.2.0-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/whois-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^2.3.1-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![npm](https://img.shields.io/npm/v/@cyanheads/whois-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/whois-mcp-server) [![TypeScript](https://img.shields.io/badge/TypeScript-^7.0.2-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.4.3-blueviolet.svg?style=flat-square)](https://bun.sh/)
 
 </div>
 
@@ -23,15 +23,15 @@
 
 ## Overview
 
-Domain and network intelligence via RDAP and DNS-over-HTTPS. Look up domain registrations, check availability, fetch DNS records, and resolve IPs and ASNs to their registries — all via public, keyless data sources. Runs as a stdio process or a local Streamable HTTP server.
+Domain and network intelligence via RDAP and DNS-over-HTTPS. Look up domain registrations, check registry record status, fetch DNS records, and resolve IPs and ASNs to their registries — all via public, keyless data sources. Runs as a stdio process or a local Streamable HTTP server.
 
 ### Tools
 
 | Tool | Description |
 |:-----|:------------|
 | `whois_lookup_domain` | Full domain registration record — registrar, created/expiry dates, nameservers, EPP status, DNSSEC, registrant org |
-| `whois_check_availability` | Check whether a domain is registered or available for registration |
-| `whois_get_dns` | DNS records for any hostname via DNS-over-HTTPS (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, PTR) |
+| `whois_check_availability` | Check registry record presence; missing records do not establish registration eligibility |
+| `whois_get_dns` | DNS owner records via DNS-over-HTTPS (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, PTR) |
 | `whois_lookup_ip` | IP or CIDR netblock, org, country, abuse contact, and reverse DNS via RIR RDAP |
 | `whois_lookup_asn` | Resolve an ASN to its org name, country, and RIR source |
 | `whois_get_dossier` | One-call domain triage — registration + DNS in parallel, normalized into a single record with factual signals |
@@ -44,34 +44,40 @@ Domain and network intelligence via RDAP and DNS-over-HTTPS. Look up domain regi
 
 - Accepts a fully qualified domain name and selects the registry RDAP server through IANA bootstrap.
 - Returns registrar, registration dates, nameservers, EPP status, DNSSEC, and `registrant_redacted`; throws `rdap_no_coverage` or `domain_not_found` when no record can be returned.
+- Absent DNSSEC and privacy evidence stay `null`. Public jCard `org` is independent of redacted contact fields; a person's formatted name is not an organization.
+- `include_registrar: true` follows one registrar RDAP referral and returns separate `registrar_detail` with `found`, `no_referral`, or `failed` status and source URL. Registry dates, nameservers, status, and DNSSEC remain authoritative. Default lookups make no registrar request. The optional exchange has no retries, at most five guarded redirects, and one `RDAP_TIMEOUT_MS` deadline; failure retains the registry result, cancellation propagates. Destination checks are best-effort against DNS rebinding.
 
 ---
 
 ### `whois_check_availability` <sub>tool</sub>
 
 - Accepts a fully qualified domain name for a registration check.
-- Returns `available: true` for RDAP 404, `false` with registrar and expiry for a registered domain, or `null` with `rdap_coverage: false` when coverage is absent.
+- Returns `registration_status: registered | not_found | unknown`. `available` is `false` for a found registration and `null` otherwise; it never returns `true`. RDAP 404 establishes record absence, not eligibility to register.
+- Known ICANN subdomains return `non_registrable_domain` with their registrable parent; the query is never silently rewritten. Private suffixes do not create independent registration boundaries, and unlisted suffixes retain IANA coverage handling.
 
 ---
 
 ### `whois_get_dns` <sub>tool</sub>
 
-- Accepts a hostname and optional nonempty `types`: A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, PTR; omission defaults to A, AAAA, MX, TXT, NS. Duplicate types are queried once.
+- Accepts an ASCII DNS owner name, including underscore labels (`_dmarc.example.com`) and one terminal root dot. Names normalize to at most 253 characters, with nonempty 1–63-character labels; spaces, URLs, consecutive dots, and multiple terminal dots are rejected. Optional nonempty `types`: A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, PTR; omission defaults to A, AAAA, MX, TXT, NS. Duplicate types are queried once.
 - Returns records with TTLs and ordered `query_sources: [{type, source}]`, including empty answers and NXDOMAIN. Legacy `source` is `cloudflare` if any query consumed a successful Cloudflare response, otherwise `nextdns`; a nonexistent domain returns `nxdomain: true` as data.
+- NOERROR/NODATA stays empty data; resolver failure codes and truncated responses return errors after retries/fallback. CAA queries use NextDNS once per retry sequence. TXT values, including duplicates, empty strings and newlines, remain complete on both surfaces and use content-sized Markdown fences for literal presentation.
 
 ---
 
 ### `whois_lookup_ip` <sub>tool</sub>
 
 - Accepts a complete IPv4/IPv6 address with at most one decimal CIDR prefix (0–32 / 0–128); no whitespace, zone IDs, or brackets. Queries the base address and echoes the original `ip`. IPv4-mapped IPv6 uses the embedded IPv4 for policy, RDAP, and PTR; other IPv6 uses 32 reversed PTR nibbles.
-- Returns netblock CIDR, organization, country, abuse contact, and best-effort PTR (`null` on failure); throws `invalid_ip` for malformed input or `ip_not_found` on an RIR RDAP 404.
+- Returns every provider CIDR in ordered `cidrs`; `cidr` appears only for exactly one component. Start/end addresses remain authoritative; missing CIDR extensions produce an empty list rather than an inferred prefix.
+- Best-effort PTR uses `ptr_status: found | not_found | failed`; failures include `ptr_source_error` and retain RDAP data. Only reachable owner-matched PTR records are selected, through at most five alias transitions under one `DOH_TIMEOUT_MS` deadline. Cancellation propagates.
+- Semantic input failures return `invalid_ip`; RIR 404 returns `ip_not_found`. A successfully loaded bootstrap with no covering route returns non-retryable `ip_no_rdap_route`, distinct from bootstrap failure.
 - `private_range` enforces an explicit policy: IPv4 `0.0.0.0/8`, `10.0.0.0/8`, `100.64.0.0/10`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, `192.168.0.0/16`, `255.0.0.0/8`; IPv6 `::1/128`, `fc00::/7`, `fe80::/10`. Other special-use addresses remain eligible for registry records or normal no-coverage/not-found outcomes.
 
 ---
 
 ### `whois_lookup_asn` <sub>tool</sub>
 
-- Accepts a decimal ASN from 1 to 4294967295 with an optional case-insensitive `AS` prefix and leading `+` (e.g., `AS15169`, `AS 15169`, `+15169`). Outer whitespace and whitespace after `AS` are allowed; whitespace inside digits or after `+`, suffixes, decimals, and out-of-range values return `invalid_asn`.
+- Accepts a decimal ASN from 1 to 4294967295 with an optional case-insensitive `AS` prefix and leading `+` (e.g., `AS15169`, `AS 15169`, `+15169`). Outer whitespace, whitespace after `AS`, and arbitrary zero-padding are allowed; whitespace inside digits or after `+`, suffixes, and decimals fail syntax validation. Out-of-range numbers retain `invalid_asn`.
 - Returns `name`, `org_name`, `country`, `rir`, `start_autnum`, and `end_autnum`; throws `asn_not_found` when no ASN record exists.
 
 ---
@@ -80,6 +86,9 @@ Domain and network intelligence via RDAP and DNS-over-HTTPS. Look up domain regi
 
 - Accepts a fully qualified domain name for parallel registration and A/MX/NS/TXT lookups.
 - Returns registration, DNS, domain age, privacy status, and inferred NS/MX providers. Individual failures remain partial data in `rdap_source_error` or `dns_source_error`; `both_legs_failed` means neither source succeeded.
+- Missing RDAP evidence, no coverage, and RDAP failure keep DNSSEC/privacy unknown. A registry miss is record absence without an eligibility guarantee; DNS failure codes and truncation populate `dns_source_error`.
+
+Identifier syntax is advertised in JSON Schema and rejected with `InvalidParams` / `invalid_arguments` before network calls. Complete IP parsing, prefix ranges, numeric ASN bounds, and exclusion policy retain typed semantic errors. Registration names use hostname grammar separately from DNS underscore/root-dot names; ASN and CIDR inputs have no arbitrary length ceiling.
 
 ---
 
@@ -97,7 +106,7 @@ RDAP / DNS-specific:
 Agent-friendly output:
 
 - Coverage signaled two ways — `rdap_coverage: false` returned as data by `whois_check_availability` and `whois_get_dossier`, while `whois_lookup_domain` throws `rdap_no_coverage` for the same case
-- Privacy redaction surfaced as a field — `registrant_redacted: true` rather than silently absent contact data
+- Privacy redaction surfaced from explicit registrant evidence — `true` for redaction and `null` when evidence is absent; organization data is independent
 - Partial failure model — `whois_get_dossier` marks individual legs with a `source_error` field and continues; only both-legs-fail escalates to an error
 - Factual signals, not scores — `age_days`, `privacy_redacted`, `ns_provider`, `mx_provider` are real data, not synthesized risk scores
 
@@ -163,7 +172,7 @@ For Streamable HTTP, set the transport and start the server:
 
 ```sh
 MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
-# Server listens at http://localhost:3010/mcp
+# Server listens at http://127.0.0.1:3010/mcp
 ```
 
 ### Prerequisites

package/changelog/0.2.x/0.2.0.md

@@ -0,0 +1,40 @@
+---
+summary: "DNS and RDAP results preserve uncertainty, with optional registrar contact detail."
+breaking: true
+security: false
+---
+
+# 0.2.0 — 2026-10-13
+
+## Added
+
+- **`include_registrar`** opts `whois_lookup_domain` into one bounded registrar referral, returning separate `registrar_detail` without replacing registry fields; failed detail retains the registry record. ([#25](https://github.com/cyanheads/whois-mcp-server/issues/25))
+- **DNS owner names** accept underscore labels and one terminal root dot, normalized before lookup. ([#17](https://github.com/cyanheads/whois-mcp-server/issues/17))
+
+## Changed
+
+- **Registration status** is `registered`, `not_found`, or `unknown`; `available` is now `false` or `null`, never `true`. Migrate eligibility checks to registrar confirmation. Known ICANN subdomains return `non_registrable_domain` with their parent. ([#18](https://github.com/cyanheads/whois-mcp-server/issues/18))
+- **Registrant evidence** reads public jCard `org` independently of contact redaction; personal `fn` is no longer organization data. Missing privacy evidence is `null`, so consumers must handle unknown separately from false. ([#19](https://github.com/cyanheads/whois-mcp-server/issues/19))
+- **DNSSEC evidence** preserves explicit provider booleans and returns `null` when absent, including dossier no-coverage results; handle unknown separately from unsigned. ([#20](https://github.com/cyanheads/whois-mcp-server/issues/20))
+- **IP allocations** expose all ordered `cidrs`; legacy `cidr` is populated only for one component. Read `cidrs` for multi-component allocations. ([#21](https://github.com/cyanheads/whois-mcp-server/issues/21))
+- **Identifier validation** is advertised in JSON Schema on all six tools; syntax failures now return `InvalidParams` / `invalid_arguments`, while semantic IP/ASN errors retain typed reasons. ([#26](https://github.com/cyanheads/whois-mcp-server/issues/26))
+- **Framework tooling** syncs skill mirrors, packaging launch checks, CodeQL categories and configuration examples; Docker uses Bun 1.4.2 → 1.4.3 and prunes unused musl dependencies from glibc images.
+
+## Fixed
+
+- **IP routing** returns non-retryable `ip_no_rdap_route` for a successfully loaded bootstrap without a covering route. ([#15](https://github.com/cyanheads/whois-mcp-server/issues/15))
+- **DNS failures** and truncation return `dns_response_failed` after retries/fallback; CAA avoids duplicate fallback, cancellation stops further requests, and dossiers retain partial data. ([#16](https://github.com/cyanheads/whois-mcp-server/issues/16))
+- **PTR lookup** selects only reachable owner-matched records, follows at most five aliases under one deadline, and reports `ptr_status` as `found`, `not_found`, or `failed` with failure detail. ([#22](https://github.com/cyanheads/whois-mcp-server/issues/22))
+- **TXT presentation** preserves complete, duplicate, empty and multiline values in literal Markdown fences sized for embedded backticks. ([#23](https://github.com/cyanheads/whois-mcp-server/issues/23))
+- **Startup configuration** validates server environment values before opening the transport; MCP Registry entries launch the package bin through `npx` and select HTTP through a fixed environment value.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` ^0.13.10 → ^0.13.15
+- `pino-pretty` ^13.1.3 → ^13.2.0
+- `tldts` added at ^7.4.18
+- `@biomejs/biome` ^2.5.14 → ^2.5.15
+- `@types/node` ^26.6.3 → ^26.6.5
+- `ignore` ^7.0.10 → ^7.0.12
+- `tsc-alias` ^1.9.5 → ^1.9.7
+- `vitest` ^5.0.2 → ^5.0.3

package/dist/app.d.ts

@@ -18,15 +18,21 @@ export declare const appOptions: {
         domain: import("zod").ZodString;
     }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
         domain: import("zod").ZodString;
-        available: import("zod").ZodNullable<import("zod").ZodBoolean>;
+        registration_status: import("zod").ZodEnum<{
+            not_found: "not_found";
+            registered: "registered";
+            unknown: "unknown";
+        }>;
+        available: import("zod").ZodNullable<import("zod").ZodLiteral<false>>;
         rdap_coverage: import("zod").ZodBoolean;
         registrar: import("zod").ZodOptional<import("zod").ZodString>;
         expiry_date: import("zod").ZodOptional<import("zod").ZodString>;
     }, import("zod/v4/core").$strip>, readonly [{
-        readonly reason: "invalid_domain";
+        readonly reason: "non_registrable_domain";
         readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.ValidationError;
-        readonly when: "Input is not a valid FQDN.";
-        readonly recovery: "Provide a valid fully-qualified domain name like \"example.com\" or \"sub.example.org\".";
+        readonly when: "An ICANN-recognized suffix identifies the query as a subdomain.";
+        readonly recovery: "Query the registrable parent named in the error instead; no eligibility is implied.";
+        readonly thrownBy: "service";
     }], undefined> | import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
         domain: import("zod").ZodString;
     }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
@@ -51,18 +57,25 @@ export declare const appOptions: {
         rdap_source_error: import("zod").ZodOptional<import("zod").ZodString>;
         dns_source_error: import("zod").ZodOptional<import("zod").ZodString>;
     }, import("zod/v4/core").$strip>, readonly [{
-        readonly reason: "invalid_domain";
-        readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.ValidationError;
-        readonly when: "Input is not a valid FQDN.";
-        readonly recovery: "Provide a valid fully-qualified domain name like \"example.com\" or \"sub.example.org\".";
-    }, {
         readonly reason: "both_legs_failed";
         readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.ServiceUnavailable;
         readonly when: "Both RDAP and DoH legs failed — no data could be retrieved.";
         readonly recovery: "Both RDAP and DNS services are unavailable. Retry in a few minutes or check network connectivity.";
     }], undefined> | import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
+        include_registrar: import("zod").ZodDefault<import("zod").ZodBoolean>;
         domain: import("zod").ZodString;
     }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        registrar_detail: import("zod").ZodOptional<import("zod").ZodObject<{
+            status: import("zod").ZodEnum<{
+                failed: "failed";
+                found: "found";
+                no_referral: "no_referral";
+            }>;
+            source: import("zod").ZodOptional<import("zod").ZodString>;
+            registrant_org: import("zod").ZodOptional<import("zod").ZodString>;
+            registrant_redacted: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodBoolean>>;
+            source_error: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
         domain: import("zod").ZodString;
         rdap_coverage: import("zod").ZodBoolean;
         handle: import("zod").ZodOptional<import("zod").ZodString>;
@@ -74,15 +87,10 @@ export declare const appOptions: {
         rdap_last_updated: import("zod").ZodOptional<import("zod").ZodString>;
         status: import("zod").ZodArray<import("zod").ZodString>;
         nameservers: import("zod").ZodArray<import("zod").ZodString>;
-        dnssec_signed: import("zod").ZodBoolean;
+        dnssec_signed: import("zod").ZodNullable<import("zod").ZodBoolean>;
         registrant_org: import("zod").ZodOptional<import("zod").ZodString>;
-        registrant_redacted: import("zod").ZodBoolean;
+        registrant_redacted: import("zod").ZodNullable<import("zod").ZodBoolean>;
     }, import("zod/v4/core").$strip>, readonly [{
-        readonly reason: "invalid_domain";
-        readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.ValidationError;
-        readonly when: "Input is not a valid FQDN.";
-        readonly recovery: "Provide a valid fully-qualified domain name like \"example.com\" or \"sub.example.org\".";
-    }, {
         readonly reason: "rdap_no_coverage";
         readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.NotFound;
         readonly when: "TLD has no RDAP server in the IANA bootstrap — cannot perform lookup.";
@@ -90,8 +98,8 @@ export declare const appOptions: {
     }, {
         readonly reason: "domain_not_found";
         readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.NotFound;
-        readonly when: "RDAP server returned 404 — domain is not registered.";
-        readonly recovery: "The domain is not registered. Use whois_check_availability to confirm availability for registration.";
+        readonly when: "RDAP server returned 404 — no domain record found.";
+        readonly recovery: "Use whois_check_availability for record status; a missing record does not establish registration eligibility.";
     }], undefined> | import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
         domain: import("zod").ZodString;
         types: import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodEnum<{
@@ -146,10 +154,12 @@ export declare const appOptions: {
             }>;
         }, import("zod/v4/core").$strip>>;
     }, import("zod/v4/core").$strip>, readonly [{
-        readonly reason: "invalid_domain";
-        readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.ValidationError;
-        readonly when: "Input is not a valid FQDN.";
-        readonly recovery: "Provide a valid fully-qualified domain name like \"example.com\" or \"sub.example.org\".";
+        readonly reason: "dns_response_failed";
+        readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.ServiceUnavailable;
+        readonly when: "Resolvers return a DNS failure status or truncated response after retry and fallback.";
+        readonly recovery: "Retry the DNS query later or choose another record type.";
+        readonly thrownBy: "service";
+        readonly retryable: true;
     }], undefined> | import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
         ip: import("zod").ZodString;
     }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
@@ -158,6 +168,7 @@ export declare const appOptions: {
         start_address: import("zod").ZodOptional<import("zod").ZodString>;
         end_address: import("zod").ZodOptional<import("zod").ZodString>;
         cidr: import("zod").ZodOptional<import("zod").ZodString>;
+        cidrs: import("zod").ZodArray<import("zod").ZodString>;
         ip_version: import("zod").ZodOptional<import("zod").ZodString>;
         name: import("zod").ZodOptional<import("zod").ZodString>;
         type: import("zod").ZodOptional<import("zod").ZodString>;
@@ -165,8 +176,21 @@ export declare const appOptions: {
         org_name: import("zod").ZodOptional<import("zod").ZodString>;
         abuse_email: import("zod").ZodOptional<import("zod").ZodString>;
         ptr: import("zod").ZodNullable<import("zod").ZodString>;
+        ptr_status: import("zod").ZodEnum<{
+            failed: "failed";
+            found: "found";
+            not_found: "not_found";
+        }>;
+        ptr_source_error: import("zod").ZodOptional<import("zod").ZodString>;
         rdap_source: import("zod").ZodOptional<import("zod").ZodString>;
     }, import("zod/v4/core").$strip>, readonly [{
+        readonly reason: "ip_no_rdap_route";
+        readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.NotFound;
+        readonly when: "A successfully loaded IANA bootstrap has no covering RIR route.";
+        readonly recovery: "Try another address; this range has no RDAP route in the IANA bootstrap.";
+        readonly retryable: false;
+        readonly thrownBy: "service";
+    }, {
         readonly reason: "invalid_ip";
         readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.ValidationError;
         readonly when: "Input is not a valid IPv4, IPv6, or CIDR address.";

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,eAAO,MAAM,UAAU;;;IAGrB;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwBuB,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,eAAO,MAAM,UAAU;;;IAGrB;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyBuB,CAAC"}

package/dist/app.js

@@ -3,6 +3,7 @@
  * the entry point starts and tests assert against.
  * @module app
  */
+import { getServerConfig } from './config/server-config.js';
 import { whoisCheckAvailability } from './mcp-server/tools/definitions/whois-check-availability.tool.js';
 import { whoisGetDns } from './mcp-server/tools/definitions/whois-get-dns.tool.js';
 import { whoisGetDossier } from './mcp-server/tools/definitions/whois-get-dossier.tool.js';
@@ -33,13 +34,14 @@ export const appOptions = {
     resources: [],
     prompts: [],
     instructions: 'whois-mcp-server: domain and IP intelligence via RDAP and DNS-over-HTTPS. No API keys required.\n' +
-        '- whois_lookup_domain: full registration record (registrar, dates, status, nameservers)\n' +
-        '- whois_check_availability: is a domain available to register? (RDAP 404 = available)\n' +
-        '- whois_get_dns: DNS records for any hostname (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, PTR)\n' +
-        '- whois_lookup_ip: IP/CIDR netblock, org, abuse contact, and PTR via RIR RDAP\n' +
+        '- whois_lookup_domain: registry record; include_registrar opts into separate registrar contact detail\n' +
+        '- whois_check_availability: registered/not_found/unknown RDAP record status; absence does not establish registration eligibility\n' +
+        '- whois_get_dns: ASCII DNS owner names, including underscores and one root dot (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, PTR)\n' +
+        '- whois_lookup_ip: IP/CIDR netblock CIDRs, org, abuse contact, and found/not_found/failed PTR outcome\n' +
         '- whois_lookup_asn: ASN to org/RIR resolution\n' +
-        '- whois_get_dossier: one-call domain triage — registration + DNS in parallel with inferred signals',
+        '- whois_get_dossier: domain triage with partial source errors; absent DNSSEC/privacy evidence stays unknown',
     setup(core) {
+        getServerConfig();
         initRdapService(core.config, core.storage);
         initDohService(core.config, core.storage);
     },

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,iEAAiE,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,MAAM,sDAAsD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4DAA4D,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,wDAAwD,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,kBAAkB;IACxB,KAAK,EAAE,kBAAkB;IACzB;;;;;;OAMG;IACH,WAAW,EAAE,WAAW;IACxB,KAAK,EAAE;QACL,iBAAiB;QACjB,sBAAsB;QACtB,WAAW;QACX,aAAa;QACb,cAAc;QACd,eAAe;KAChB;IACD,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,YAAY,EACV,mGAAmG;QACnG,2FAA2F;QAC3F,yFAAyF;QACzF,8FAA8F;QAC9F,iFAAiF;QACjF,iDAAiD;QACjD,oGAAoG;IACtG,KAAK,CAAC,IAAI;QACR,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;CACyB,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iEAAiE,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,MAAM,sDAAsD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4DAA4D,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,wDAAwD,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,kBAAkB;IACxB,KAAK,EAAE,kBAAkB;IACzB;;;;;;OAMG;IACH,WAAW,EAAE,WAAW;IACxB,KAAK,EAAE;QACL,iBAAiB;QACjB,sBAAsB;QACtB,WAAW;QACX,aAAa;QACb,cAAc;QACd,eAAe;KAChB;IACD,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,YAAY,EACV,mGAAmG;QACnG,yGAAyG;QACzG,oIAAoI;QACpI,+HAA+H;QAC/H,yGAAyG;QACzG,iDAAiD;QACjD,6GAA6G;IAC/G,KAAK,CAAC,IAAI;QACR,eAAe,EAAE,CAAC;QAClB,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;CACyB,CAAC"}

package/dist/mcp-server/tools/definitions/_fqdn.d.ts

@@ -1,7 +1,13 @@
 /**
- * @fileoverview Shared FQDN validation used across tool handlers.
+ * @fileoverview Serializable identifier grammars shared by lookup schemas.
  * @module mcp-server/tools/definitions/_fqdn
  */
-/** Simple FQDN validation: labels separated by dots, no consecutive dots, length limits */
-export declare function isValidFqdn(domain: string): boolean;
+/** Registration hostname grammar, with exact end-of-input matching. */
+export declare const REGISTRATION_NAME_PATTERN: RegExp;
+/** DNS presentation-name grammar: underscore labels and one optional root dot. */
+export declare const DNS_NAME_PATTERN: RegExp;
+/** Conservative IP/CIDR shape; complete address and prefix validity are semantic. */
+export declare const IP_PATTERN: RegExp;
+/** Accepted ASN spelling, preserving padding, case and surrounding whitespace. */
+export declare const ASN_PATTERN: RegExp;
 //# sourceMappingURL=_fqdn.d.ts.map

package/dist/mcp-server/tools/definitions/_fqdn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_fqdn.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/_fqdn.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQnD"}
+{"version":3,"file":"_fqdn.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/_fqdn.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,QAErC,CAAC;AACF,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,QACwE,CAAC;AACtG,qFAAqF;AACrF,eAAO,MAAM,UAAU,QAA2C,CAAC;AACnE,kFAAkF;AAClF,eAAO,MAAM,WAAW,QAA+C,CAAC"}

package/dist/mcp-server/tools/definitions/_fqdn.js

@@ -1,18 +1,14 @@
 /**
- * @fileoverview Shared FQDN validation used across tool handlers.
+ * @fileoverview Serializable identifier grammars shared by lookup schemas.
  * @module mcp-server/tools/definitions/_fqdn
  */
-/** Simple FQDN validation: labels separated by dots, no consecutive dots, length limits */
-export function isValidFqdn(domain) {
-    if (!domain || domain.length > 253)
-        return false;
-    const labels = domain.split('.');
-    if (labels.length < 2)
-        return false;
-    return labels.every((label) => {
-        if (!label || label.length > 63)
-            return false;
-        return /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$|^[a-zA-Z0-9]$/.test(label);
-    });
-}
+const HOST_LABEL = '[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?';
+/** Registration hostname grammar, with exact end-of-input matching. */
+export const REGISTRATION_NAME_PATTERN = new RegExp(`^${HOST_LABEL}(?:\\.${HOST_LABEL})+(?![\\s\\S])`);
+/** DNS presentation-name grammar: underscore labels and one optional root dot. */
+export const DNS_NAME_PATTERN = /^(?=[A-Za-z0-9_.-]{1,253}\.?(?![\s\S]))[A-Za-z0-9_-]{1,63}(?:\.[A-Za-z0-9_-]{1,63})+\.?(?![\s\S])/;
+/** Conservative IP/CIDR shape; complete address and prefix validity are semantic. */
+export const IP_PATTERN = /^[0-9A-Fa-f:.]+(?:\/[0-9]+)?(?![\s\S])/;
+/** Accepted ASN spelling, preserving padding, case and surrounding whitespace. */
+export const ASN_PATTERN = /^\s*(?:[Aa][Ss]\s*)?\+?[0-9]+\s*(?![\s\S])/;
 //# sourceMappingURL=_fqdn.js.map