@push.rocks/smartnetwork 4.9.0 → 4.10.1

package/readme.md

@@ -16,7 +16,7 @@ pnpm add @push.rocks/smartnetwork
 
 **@push.rocks/smartnetwork** is your Swiss Army knife for network diagnostics in Node.js. Whether you're building monitoring dashboards, investigating IP/domain ownership, or debugging connectivity — this library has you covered with a clean, async API and zero-config setup.
 
-Under the hood, system-level operations (ICMP ping, traceroute, raw-socket port checks, gateway detection) are powered by a bundled **Rust binary** for maximum performance and cross-platform reliability. Everything else — speed tests, DNS, public IP discovery, IP & domain intelligence, HTTP health checks — runs in pure TypeScript.
+Under the hood, system-level operations (ICMP ping, traceroute, raw-socket port checks, gateway detection) are powered by a bundled **Rust binary** for maximum performance and cross-platform reliability. The remaining orchestration runs in TypeScript, while DNS and intelligence lookups can invoke smartdns's bundled Rust client for UDP or DoH fallback.
 
 ### ✨ Key Features
 
@@ -47,7 +47,7 @@ await network.start();
 
 // ... use the network instance ...
 
-// Clean up when done — tears down both the Rust bridge and the smartdns backend
+// Clean up when done. This confirms DNS cleanup and releases the shared Rust bridge.
 await network.stop();
 ```
 
@@ -61,9 +61,9 @@ const network = new SmartNetwork({ cacheTtl: 60000 }); // 60s TTL
 
 ### 🕵️ IP Intelligence
 
-Get ASN, organization, geolocation, and RDAP registration data for any IPv4 address. Combines three free public data sources in parallel:
+Get ASN, organization, geolocation, and RDAP registration data for any IPv4 address (RDAP registration data also works for IPv6). Combines three free public data sources in parallel:
 
-- **RDAP** — direct queries to RIRs (RIPE, ARIN, APNIC, LACNIC, AFRINIC) for authoritative registration data
+- **RDAP** — direct queries to RIRs (RIPE, ARIN, APNIC, LACNIC, AFRINIC) for authoritative registration data, via [`@push.rocks/smartwhois`](https://code.foss.global/push.rocks/smartwhois)
 - **Team Cymru DNS** — fast ASN resolution via DNS TXT records
 - **MaxMind GeoLite2** — in-memory MMDB databases (auto-downloaded from CDN, periodically refreshed)
 
@@ -133,7 +133,7 @@ interface IIpIntelligenceResult {
 
 Get comprehensive domain registration and DNS data. Runs an **RDAP layer** and a **DNS layer** in parallel, then merges results:
 
-- **RDAP** — queries the correct registry RDAP server (discovered via the [IANA DNS bootstrap](https://data.iana.org/rdap/dns.json)) for registrar, registrant, events, status flags, DNSSEC, and abuse contacts
+- **RDAP** — queries the correct registry RDAP server (discovered via the [IANA DNS bootstrap](https://data.iana.org/rdap/dns.json)) for registrar, registrant, events, status flags, DNSSEC, and abuse contacts, via [`@push.rocks/smartwhois`](https://code.foss.global/push.rocks/smartwhois)
 - **DNS** — queries A, AAAA, NS, MX, TXT, and SOA records via `@push.rocks/smartdns` (system resolver first, DoH fallback)
 
 For gTLDs (`.com`, `.org`, `.net`, etc.) you get the full picture from both layers. For ccTLDs without RDAP support (`.de`, `.fr`, `.nl`, etc.), the DNS layer fills in nameservers, resolved IPs, MX, TXT, and SOA — so you still get useful intelligence even when RDAP isn't available.
@@ -225,6 +225,20 @@ interface IDomainIntelligenceResult {
 
 > 💡 **RDAP vs DNS nameservers**: When RDAP is available (most gTLDs), `nameservers` comes from the registry's authoritative parent-zone delegation (`nameserversSource: 'rdap'`). When RDAP is unavailable (many ccTLDs), the DNS layer fills in nameservers via NS record resolution (`nameserversSource: 'dns'`). The `nameserversSource` field tells you which source won.
 
+When using `IpIntelligence` or `DomainIntelligence` directly without injecting a smartdns client, await `stop()` after the final lookup. A failed confirmed shutdown rejects and retains the client, so call `stop()` again to retry cleanup:
+
+```typescript
+import { DomainIntelligence } from '@push.rocks/smartnetwork';
+
+const intelligence = new DomainIntelligence();
+try {
+  const result = await intelligence.getIntelligence('example.com');
+  console.log(result.registrarName);
+} finally {
+  await intelligence.stop();
+}
+```
+
 ---
 
 ### 🏎️ Speed Testing
@@ -474,7 +488,7 @@ const monitor = async () => {
 
 | Method | Description | Requires Rust |
 |--------|-------------|:---:|
-| `start()` / `stop()` | Start/stop the Rust bridge and smartdns backend | — |
+| `start()` / `stop()` | Acquire/release the shared Rust bridge and confirm smartdns cleanup. Retry `stop()` if cleanup rejects | Lifecycle |
 | `getSpeed(opts?)` | Cloudflare speed test (download + upload) | No |
 | `ping(host, opts?)` | ICMP ping with optional multi-ping stats | Yes |
 | `traceroute(host, opts?)` | Hop-by-hop network path analysis | Yes |
@@ -484,10 +498,10 @@ const monitor = async () => {
 | `getGateways()` | List all network interfaces | No |
 | `getDefaultGateway()` | Get default gateway info | Yes |
 | `getPublicIps()` | Discover public IPv4/IPv6 (4 fallback services) | No |
-| `resolveDns(host)` | Resolve A, AAAA, MX records | No |
+| `resolveDns(host)` | Resolve A, AAAA, MX records | SmartDNS fallback |
 | `checkEndpoint(url, opts?)` | HTTP/HTTPS health check with RTT | No |
-| `getIpIntelligence(ip)` | ASN + org + geo + RDAP registration | No |
-| `getDomainIntelligence(domain)` | Registrar, nameservers, events, DNS records, DNSSEC | No |
+| `getIpIntelligence(ip)` | ASN + org + geo + RDAP registration | SmartDNS fallback |
+| `getDomainIntelligence(domain)` | Registrar, nameservers, events, DNS records, DNSSEC | SmartDNS fallback |
 
 ### Standalone helpers
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartnetwork',
-  version: '4.9.0',
+  version: '4.10.1',
   description: 'A toolkit for network diagnostics including speed tests, port availability checks, and more.'
 }

package/ts/smartnetwork.classes.domainintelligence.ts

@@ -63,15 +63,13 @@ export interface IDomainIntelligenceOptions {
   timeout?: number;
   /**
    * Optional injected smartdns client. When provided, DomainIntelligence
-   * will not create or destroy its own client (the owner — typically
+   * will not create or terminate its own client (the owner — typically
    * SmartNetwork — manages lifecycle). When omitted, a short-lived client
-   * is created per DNS-layer query and destroyed in finally.
+   * is created per DNS-layer query and terminated in finally.
    */
   dnsClient?: TSmartdnsClient;
 }
 
-// IANA bootstrap for domain RDAP
-const IANA_BOOTSTRAP_DNS_URL = 'https://data.iana.org/rdap/dns.json';
 const DEFAULT_TIMEOUT = 5000;
 
 /**
@@ -103,23 +101,30 @@ function emptyResult(domain: string | null = null): IDomainIntelligenceResult {
 }
 
 /**
- * DomainIntelligence performs RDAP lookups for domain names using the
- * IANA DNS bootstrap to discover the correct registry RDAP endpoint per TLD.
+ * DomainIntelligence performs RDAP lookups for domain names via
+ * @push.rocks/smartwhois, which resolves the correct registry RDAP endpoint
+ * per TLD through the IANA DNS bootstrap.
  */
 export class DomainIntelligence {
   private readonly logger = getLogger();
   private readonly timeout: number;
 
-  // Bootstrap cache: tld (lowercased) -> RDAP base URL (without trailing slash)
-  private bootstrapEntries: Map<string, string> | null = null;
-  private bootstrapPromise: Promise<void> | null = null;
+  // RDAP client from smartwhois (owns bootstrap caching and registry failover)
+  private readonly rdapClient: plugins.smartwhois.RdapClient;
 
   // Optional injected smartdns client (shared by SmartNetwork)
   private readonly sharedDnsClient: TSmartdnsClient | null;
+  private ownedDnsClient: TSmartdnsClient | null = null;
+  private dnsLifecycleQueue: Promise<void> = Promise.resolve();
 
   constructor(options?: IDomainIntelligenceOptions) {
     this.timeout = options?.timeout ?? DEFAULT_TIMEOUT;
     this.sharedDnsClient = options?.dnsClient ?? null;
+    this.rdapClient = new plugins.smartwhois.RdapClient({
+      requestTimeoutMs: this.timeout,
+      totalTimeoutMs: this.timeout,
+      userAgent: '@push.rocks/smartnetwork',
+    });
   }
 
   /**
@@ -166,29 +171,62 @@ export class DomainIntelligence {
       }
     }
 
+    if (dnsSettled.status === 'rejected') {
+      throw dnsSettled.reason;
+    }
+
     return result;
   }
 
-  // ─── RDAP Layer (existing logic, wrapped) ───────────────────────────
+  /** Retry and confirm cleanup of a standalone DNS client, if one is retained. */
+  public stop(): Promise<void> {
+    if (this.sharedDnsClient) return Promise.resolve();
+    return this.enqueueDnsLifecycle(() => this.terminateOwnedDnsClient());
+  }
+
+  // ─── RDAP Layer (delegated to @push.rocks/smartwhois) ───────────────
 
   /**
-   * Run the full RDAP lookup flow for a pre-normalized domain: extract TLD,
-   * load bootstrap, match registry, query, and parse. Returns the parsed
-   * RDAP fields (as a full IDomainIntelligenceResult) or null if any step
-   * fails or the TLD has no RDAP support.
+   * Run the full RDAP lookup flow for a pre-normalized domain via the
+   * smartwhois RdapClient. Returns the parsed RDAP fields (as a full
+   * IDomainIntelligenceResult) or null if any step fails, the TLD has no
+   * RDAP support, or the registry reports the domain as not registered.
    */
   private async queryRdapLayer(domain: string): Promise<IDomainIntelligenceResult | null> {
-    const tld = this.extractTld(domain);
-    if (!tld) return null;
-
-    await this.ensureBootstrap();
-    const baseUrl = this.matchTld(tld);
-    if (!baseUrl) return null;
-
-    const rdapData = await this.queryRdap(domain, baseUrl);
-    if (!rdapData) return null;
+    try {
+      const rdapRecord = await this.rdapClient.lookupDomain(domain);
+      if (!rdapRecord || !rdapRecord.isRegistered) return null;
+      return this.mapRdapRecord(domain, rdapRecord);
+    } catch (err: any) {
+      this.logger.debug?.(`RDAP query failed for ${domain}: ${err.message}`);
+      return null;
+    }
+  }
 
-    return this.parseRdapResponse(domain, rdapData);
+  /**
+   * Map a smartwhois RDAP domain record onto the IDomainIntelligenceResult
+   * shape (RDAP fields only; DNS enrichment fields stay null here).
+   */
+  private mapRdapRecord(
+    domain: string,
+    record: plugins.smartwhois.IRdapDomainRecord,
+  ): IDomainIntelligenceResult {
+    const result = emptyResult(domain);
+    result.handle = record.handle ?? null;
+    result.status = record.statuses && record.statuses.length > 0 ? record.statuses : null;
+    result.registrationDate = record.createdDate ?? null;
+    result.expirationDate = record.expiryDate ?? null;
+    result.lastChangedDate = record.updatedDate ?? null;
+    result.registrarName = record.registrar ?? null;
+    result.registrarIanaId = record.registrarIanaId ?? null;
+    result.registrantOrg = record.registrantOrg ?? null;
+    result.registrantCountry = record.registrantCountry ?? null;
+    result.abuseEmail = record.abuseEmail ?? null;
+    result.abusePhone = record.abusePhone ?? null;
+    result.nameservers =
+      record.nameservers && record.nameservers.length > 0 ? record.nameservers : null;
+    result.dnssec = record.dnssec ?? null;
+    return result;
   }
 
   // ─── Normalization & TLD extraction ─────────────────────────────────
@@ -217,244 +255,6 @@ export class DomainIntelligence {
     return ascii;
   }
 
-  /**
-   * Extract the TLD as the last dot-separated label.
-   */
-  private extractTld(domain: string): string | null {
-    const idx = domain.lastIndexOf('.');
-    if (idx < 0 || idx === domain.length - 1) return null;
-    return domain.slice(idx + 1);
-  }
-
-  // ─── Bootstrap Subsystem ────────────────────────────────────────────
-
-  /**
-   * Load and cache the IANA DNS bootstrap file.
-   */
-  private async ensureBootstrap(): Promise<void> {
-    if (this.bootstrapEntries) return;
-    if (this.bootstrapPromise) {
-      await this.bootstrapPromise;
-      return;
-    }
-
-    this.bootstrapPromise = (async () => {
-      try {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), this.timeout);
-        try {
-          const response = await fetch(IANA_BOOTSTRAP_DNS_URL, {
-            signal: controller.signal,
-            headers: { 'User-Agent': '@push.rocks/smartnetwork' },
-          });
-          if (!response.ok) throw new Error(`HTTP ${response.status}`);
-          const data = (await response.json()) as { services: [string[], string[]][] };
-
-          const entries = new Map<string, string>();
-          for (const [tlds, urls] of data.services) {
-            const baseUrl = urls[0]; // first URL is preferred
-            if (!baseUrl) continue;
-            const cleanBase = baseUrl.replace(/\/$/, ''); // strip trailing slash
-            for (const tld of tlds) {
-              entries.set(tld.toLowerCase(), cleanBase);
-            }
-          }
-          this.bootstrapEntries = entries;
-        } finally {
-          clearTimeout(timeoutId);
-        }
-      } catch (err: any) {
-        this.logger.debug?.(`Failed to load DNS RDAP bootstrap: ${err.message}`);
-        this.bootstrapEntries = new Map(); // empty = all RDAP lookups will skip
-      }
-    })();
-
-    await this.bootstrapPromise;
-    this.bootstrapPromise = null;
-  }
-
-  /**
-   * Find the RDAP base URL for a given TLD via direct lookup.
-   */
-  private matchTld(tld: string): string | null {
-    if (!this.bootstrapEntries || this.bootstrapEntries.size === 0) return null;
-    return this.bootstrapEntries.get(tld.toLowerCase()) ?? null;
-  }
-
-  // ─── RDAP Query ─────────────────────────────────────────────────────
-
-  /**
-   * Perform the RDAP HTTP query for a domain.
-   */
-  private async queryRdap(domain: string, baseUrl: string): Promise<any | null> {
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), this.timeout);
-    try {
-      const response = await fetch(`${baseUrl}/domain/${encodeURIComponent(domain)}`, {
-        signal: controller.signal,
-        headers: {
-          'Accept': 'application/rdap+json',
-          'User-Agent': '@push.rocks/smartnetwork',
-        },
-      });
-      if (!response.ok) return null;
-      return await response.json();
-    } catch (err: any) {
-      this.logger.debug?.(`RDAP query failed for ${domain}: ${err.message}`);
-      return null;
-    } finally {
-      clearTimeout(timeoutId);
-    }
-  }
-
-  // ─── RDAP Response Parsing ──────────────────────────────────────────
-
-  private parseRdapResponse(domain: string, data: any): IDomainIntelligenceResult {
-    const result = emptyResult(domain);
-
-    if (typeof data.handle === 'string') result.handle = data.handle;
-
-    if (Array.isArray(data.status) && data.status.length > 0) {
-      result.status = data.status.filter((s: any): s is string => typeof s === 'string');
-    }
-
-    // Events: registration / expiration / last changed
-    if (Array.isArray(data.events)) {
-      const events = this.extractEvents(data.events);
-      result.registrationDate = events.registration;
-      result.expirationDate = events.expiration;
-      result.lastChangedDate = events.lastChanged;
-    }
-
-    // Registrar (sponsor) and registrant from entities
-    if (Array.isArray(data.entities)) {
-      const registrar = this.extractRegistrar(data.entities);
-      result.registrarName = registrar.name;
-      result.registrarIanaId = registrar.ianaId;
-      result.abuseEmail = registrar.abuseEmail;
-      result.abusePhone = registrar.abusePhone;
-
-      const registrant = this.extractRegistrant(data.entities);
-      result.registrantOrg = registrant.org;
-      result.registrantCountry = registrant.country;
-    }
-
-    // Nameservers
-    if (Array.isArray(data.nameservers)) {
-      result.nameservers = this.extractNameservers(data.nameservers);
-    }
-
-    // DNSSEC: secureDNS.delegationSigned
-    if (data.secureDNS && typeof data.secureDNS.delegationSigned === 'boolean') {
-      result.dnssec = data.secureDNS.delegationSigned;
-    }
-
-    return result;
-  }
-
-  /**
-   * Pull registration / expiration / last changed timestamps from an
-   * RDAP `events` array.
-   */
-  private extractEvents(events: any[]): {
-    registration: string | null;
-    expiration: string | null;
-    lastChanged: string | null;
-  } {
-    let registration: string | null = null;
-    let expiration: string | null = null;
-    let lastChanged: string | null = null;
-
-    for (const ev of events) {
-      const action = typeof ev?.eventAction === 'string' ? ev.eventAction.toLowerCase() : '';
-      const date = typeof ev?.eventDate === 'string' ? ev.eventDate : null;
-      if (!date) continue;
-      if (action === 'registration') registration = date;
-      else if (action === 'expiration') expiration = date;
-      else if (action === 'last changed') lastChanged = date;
-    }
-
-    return { registration, expiration, lastChanged };
-  }
-
-  /**
-   * Extract registrar identity (name, IANA ID) and a nested abuse contact.
-   */
-  private extractRegistrar(entities: any[]): {
-    name: string | null;
-    ianaId: number | null;
-    abuseEmail: string | null;
-    abusePhone: string | null;
-  } {
-    let name: string | null = null;
-    let ianaId: number | null = null;
-    let abuseEmail: string | null = null;
-    let abusePhone: string | null = null;
-
-    for (const entity of entities) {
-      const roles: string[] = Array.isArray(entity?.roles) ? entity.roles : [];
-      if (!roles.includes('registrar')) continue;
-
-      name = this.extractVcardFn(entity);
-
-      // IANA Registrar ID lives in publicIds[]
-      if (Array.isArray(entity.publicIds)) {
-        for (const pid of entity.publicIds) {
-          if (pid && typeof pid === 'object' && pid.type === 'IANA Registrar ID') {
-            const parsed = parseInt(String(pid.identifier), 10);
-            if (!isNaN(parsed)) ianaId = parsed;
-          }
-        }
-      }
-
-      // Abuse contact: nested entity with role "abuse"
-      if (Array.isArray(entity.entities)) {
-        for (const sub of entity.entities) {
-          const subRoles: string[] = Array.isArray(sub?.roles) ? sub.roles : [];
-          if (subRoles.includes('abuse')) {
-            if (!abuseEmail) abuseEmail = this.extractVcardEmail(sub);
-            if (!abusePhone) abusePhone = this.extractVcardTel(sub);
-          }
-        }
-      }
-
-      break; // first registrar wins
-    }
-
-    return { name, ianaId, abuseEmail, abusePhone };
-  }
-
-  /**
-   * Extract registrant org/country from entities array.
-   */
-  private extractRegistrant(entities: any[]): {
-    org: string | null;
-    country: string | null;
-  } {
-    for (const entity of entities) {
-      const roles: string[] = Array.isArray(entity?.roles) ? entity.roles : [];
-      if (!roles.includes('registrant')) continue;
-      const org = this.extractVcardFn(entity);
-      const country = this.extractVcardCountry(entity);
-      return { org, country };
-    }
-    return { org: null, country: null };
-  }
-
-  /**
-   * Map an RDAP nameservers[] array to a list of lowercased ldhName strings.
-   */
-  private extractNameservers(nameservers: any[]): string[] | null {
-    const out: string[] = [];
-    for (const ns of nameservers) {
-      const ldh = ns?.ldhName;
-      if (typeof ldh === 'string' && ldh.length > 0) {
-        out.push(ldh.toLowerCase());
-      }
-    }
-    return out.length > 0 ? out : null;
-  }
-
   // ─── DNS Layer ──────────────────────────────────────────────────────
 
   /**
@@ -464,8 +264,8 @@ export class DomainIntelligence {
    * field either populated or null.
    *
    * If a shared dnsClient was injected via constructor options, it is
-   * reused and NOT destroyed (ownership stays with the injector). Otherwise
-   * a short-lived client is created and destroyed in finally.
+   * reused and NOT terminated (ownership stays with the injector). Otherwise
+   * a short-lived client is created and terminated in finally.
    */
   private async queryDnsLayer(domain: string): Promise<{
     nameservers: string[] | null;
@@ -475,45 +275,66 @@ export class DomainIntelligence {
     txtRecords: string[] | null;
     soaRecord: string | null;
   } | null> {
-    const external = this.sharedDnsClient !== null;
-    let dnsClient: TSmartdnsClient | null = this.sharedDnsClient;
-    try {
-      if (!dnsClient) {
-        dnsClient = new plugins.smartdns.dnsClientMod.Smartdns({
-          strategy: 'prefer-system',
-          allowDohFallback: true,
-          timeoutMs: this.timeout,
-        });
+    const query = async (dnsClientArg: TSmartdnsClient) => {
+      try {
+        const [nsRes, aRes, aaaaRes, mxRes, txtRes, soaRes] = await Promise.allSettled([
+          dnsClientArg.getNameServers(domain),
+          dnsClientArg.getRecordsA(domain),
+          dnsClientArg.getRecordsAAAA(domain),
+          dnsClientArg.getRecords(domain, 'MX'),
+          dnsClientArg.getRecordsTxt(domain),
+          // 'SOA' is in smartdns's runtime dnsTypeMap but missing from the
+          // TDnsRecordType union in @tsclass/tsclass — cast to bypass the
+          // stale type definition.
+          dnsClientArg.getRecords(domain, 'SOA' as any),
+        ]);
+
+        return {
+          nameservers: this.parseNsResult(nsRes),
+          resolvedIpv4: this.dnsValuesOrNull(aRes),
+          resolvedIpv6: this.dnsValuesOrNull(aaaaRes),
+          mxRecords: this.parseMxRecords(mxRes),
+          txtRecords: this.dnsValuesOrNull(txtRes),
+          soaRecord: this.dnsFirstValueOrNull(soaRes),
+        };
+      } catch (err: any) {
+        this.logger.debug?.(`DNS layer failed for ${domain}: ${err.message}`);
+        return null;
       }
+    };
 
-      const [nsRes, aRes, aaaaRes, mxRes, txtRes, soaRes] = await Promise.allSettled([
-        dnsClient.getNameServers(domain),
-        dnsClient.getRecordsA(domain),
-        dnsClient.getRecordsAAAA(domain),
-        dnsClient.getRecords(domain, 'MX'),
-        dnsClient.getRecordsTxt(domain),
-        // 'SOA' is in smartdns's runtime dnsTypeMap but missing from the
-        // TDnsRecordType union in @tsclass/tsclass — cast to bypass the
-        // stale type definition.
-        dnsClient.getRecords(domain, 'SOA' as any),
-      ]);
-
-      return {
-        nameservers: this.parseNsResult(nsRes),
-        resolvedIpv4: this.dnsValuesOrNull(aRes),
-        resolvedIpv6: this.dnsValuesOrNull(aaaaRes),
-        mxRecords: this.parseMxRecords(mxRes),
-        txtRecords: this.dnsValuesOrNull(txtRes),
-        soaRecord: this.dnsFirstValueOrNull(soaRes),
-      };
-    } catch (err: any) {
-      this.logger.debug?.(`DNS layer failed for ${domain}: ${err.message}`);
-      return null;
-    } finally {
-      // Only destroy clients we created ourselves; leave injected ones alone.
-      if (!external && dnsClient) {
-        dnsClient.destroy();
+    if (this.sharedDnsClient) {
+      return query(this.sharedDnsClient);
+    }
+
+    return this.enqueueDnsLifecycle(async () => {
+      await this.terminateOwnedDnsClient();
+      const dnsClient = new plugins.smartdns.dnsClientMod.Smartdns({
+        strategy: 'prefer-system',
+        allowDohFallback: true,
+        timeoutMs: this.timeout,
+      });
+      this.ownedDnsClient = dnsClient;
+      try {
+        return await query(dnsClient);
+      } finally {
+        await this.terminateOwnedDnsClient();
       }
+    });
+  }
+
+  private enqueueDnsLifecycle<T>(operationArg: () => Promise<T>): Promise<T> {
+    const result = this.dnsLifecycleQueue.then(operationArg);
+    this.dnsLifecycleQueue = result.then(() => {}, () => {});
+    return result;
+  }
+
+  private async terminateOwnedDnsClient(): Promise<void> {
+    const dnsClient = this.ownedDnsClient;
+    if (!dnsClient) return;
+    await dnsClient.terminate();
+    if (this.ownedDnsClient === dnsClient) {
+      this.ownedDnsClient = null;
     }
   }
 
@@ -575,85 +396,4 @@ export class DomainIntelligence {
     }
     return out.length > 0 ? out : null;
   }
-
-  // ─── vCard helpers (duplicated from IpIntelligence) ─────────────────
-
-  /**
-   * Extract the 'fn' (formatted name) from an entity's vcardArray
-   */
-  private extractVcardFn(entity: any): string | null {
-    if (!entity?.vcardArray || !Array.isArray(entity.vcardArray)) return null;
-    const properties = entity.vcardArray[1];
-    if (!Array.isArray(properties)) return null;
-
-    for (const prop of properties) {
-      if (Array.isArray(prop) && prop[0] === 'fn') {
-        return prop[3] || null;
-      }
-    }
-    return null;
-  }
-
-  /**
-   * Extract email from an entity's vcardArray
-   */
-  private extractVcardEmail(entity: any): string | null {
-    if (!entity?.vcardArray || !Array.isArray(entity.vcardArray)) return null;
-    const properties = entity.vcardArray[1];
-    if (!Array.isArray(properties)) return null;
-
-    for (const prop of properties) {
-      if (Array.isArray(prop) && prop[0] === 'email') {
-        return prop[3] || null;
-      }
-    }
-    return null;
-  }
-
-  /**
-   * Extract telephone number from an entity's vcardArray
-   */
-  private extractVcardTel(entity: any): string | null {
-    if (!entity?.vcardArray || !Array.isArray(entity.vcardArray)) return null;
-    const properties = entity.vcardArray[1];
-    if (!Array.isArray(properties)) return null;
-
-    for (const prop of properties) {
-      if (Array.isArray(prop) && prop[0] === 'tel') {
-        // tel value can be a string or a uri like "tel:+1.5555555555"
-        const value = prop[3];
-        if (typeof value === 'string') {
-          return value.startsWith('tel:') ? value.slice(4) : value;
-        }
-      }
-    }
-    return null;
-  }
-
-  /**
-   * Extract country from an entity's vcardArray address field
-   */
-  private extractVcardCountry(entity: any): string | null {
-    if (!entity?.vcardArray || !Array.isArray(entity.vcardArray)) return null;
-    const properties = entity.vcardArray[1];
-    if (!Array.isArray(properties)) return null;
-
-    for (const prop of properties) {
-      if (Array.isArray(prop) && prop[0] === 'adr') {
-        // The label parameter often contains the full address with country at the end
-        const label = prop[1]?.label;
-        if (typeof label === 'string') {
-          const lines = label.split('\n');
-          const lastLine = lines[lines.length - 1]?.trim();
-          if (lastLine && lastLine.length > 1) return lastLine;
-        }
-        // Also check the structured value (7-element array, last element is country)
-        const value = prop[3];
-        if (Array.isArray(value) && value.length >= 7 && value[6]) {
-          return value[6];
-        }
-      }
-    }
-    return null;
-  }
 }