@slicedearth/whoisleuth-cli 1.32.0

package/lib/registry-comparison.mjs

@@ -0,0 +1,318 @@
+// Normalized comparison of the domain fields published by RDAP and WHOIS.
+// Registries routinely express the same value with different punctuation,
+// casing, ordering, or timestamp precision, so comparisons happen on a
+// canonical form while consumers retain the original source values.
+const REDACTION_MARKERS = [
+    /redacted/i,
+    /data protected/i,
+    /privacy protect/i,
+    /not disclosed/i,
+    /not published/i,
+    /masked/i,
+];
+function isRedacted(value) {
+    if (typeof value !== 'string')
+        return false;
+    return REDACTION_MARKERS.some((re) => re.test(value));
+}
+function publishedState(value) {
+    if (value === null || value === undefined || value === '')
+        return 'absent';
+    if (Array.isArray(value) && value.length === 0)
+        return 'absent';
+    if (isRedacted(value))
+        return 'redacted';
+    return 'value';
+}
+function sourceCondition(status) {
+    if (status === 'partial')
+        return 'incomplete';
+    if (typeof status === 'string' && ['error', 'unsupported', 'not_found', 'skipped', 'disabled'].includes(status))
+        return 'unavailable';
+    return 'complete';
+}
+function fieldState(value, condition) {
+    const state = publishedState(value);
+    return state === 'absent' && condition !== 'complete' ? condition : state;
+}
+function registrarValue(value) {
+    if (!value || typeof value !== 'object')
+        return value || null;
+    const record = value;
+    return record.name || record.org || record.handle || null;
+}
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function normalizeText(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value
+        .normalize('NFKC')
+        .trim()
+        .toLowerCase()
+        .replace(/&/g, ' and ')
+        .replace(/[^\p{L}\p{N}]+/gu, ' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+    return normalized || null;
+}
+function normalizeDomain(value) {
+    return typeof value === 'string' ? value.trim().toLowerCase().replace(/\.+$/, '') : null;
+}
+// Registry timestamps may be a date, an ISO timestamp, or a timestamp with
+// different precision. Registration lifecycle comparisons only need the UTC
+// calendar date; comparing milliseconds would turn equivalent publication
+// formats into false conflicts.
+function normalizeDate(value) {
+    if (typeof value !== 'string' || !value.trim())
+        return null;
+    const trimmed = value.trim();
+    const ymd = trimmed.match(/^(\d{4})[-/.](\d{2})[-/.](\d{2})/);
+    if (ymd)
+        return `${ymd[1]}-${ymd[2]}-${ymd[3]}`;
+    const parsed = new Date(trimmed);
+    if (!Number.isNaN(parsed.getTime()))
+        return parsed.toISOString().slice(0, 10);
+    return normalizeText(trimmed);
+}
+function normalizeDnssec(value) {
+    const normalized = normalizeText(value);
+    if (!normalized)
+        return null;
+    if (/unsigned|not signed|insecure/.test(normalized))
+        return 'unsigned';
+    if (/signed|secure/.test(normalized))
+        return 'signed';
+    return normalized;
+}
+function normalizeStatus(value) {
+    return typeof value === 'string'
+        ? value.normalize('NFKC').toLowerCase().replace(/[^\p{L}\p{N}]+/gu, '')
+        : null;
+}
+// Some registrar RDAP services publish the portable RDAP status vocabulary
+// (for example "transfer prohibited") while the registry publishes the
+// corresponding client-set EPP status ("client transfer prohibited"). Treat
+// those client-set forms as equivalent across RDAP publications, but retain
+// the server prefix because a registry-set lock is materially different.
+function normalizeRdapPublicationStatus(value) {
+    const normalized = normalizeStatus(value);
+    if (!normalized)
+        return null;
+    return normalized.replace(/^client(?=(?:delete|renew|transfer|update)prohibited$)/, '');
+}
+function normalizeNameserver(value) {
+    return normalizeDomain(value);
+}
+function normalizeSet(values, normalizeItem) {
+    if (!Array.isArray(values))
+        return [];
+    return [...new Set(values.map(normalizeItem).filter((value) => Boolean(value)))].sort();
+}
+function sameNormalizedValue(left, right) {
+    if (Array.isArray(left) || Array.isArray(right)) {
+        if (!Array.isArray(left) || !Array.isArray(right) || left.length !== right.length)
+            return false;
+        return left.every((value, index) => value === right[index]);
+    }
+    return left === right;
+}
+function displayValue(value, state, status) {
+    if (state === 'absent')
+        return 'Not published';
+    if (state === 'redacted')
+        return 'Redacted by source';
+    if (state === 'incomplete')
+        return 'Not observed (partial source)';
+    if (state === 'unavailable') {
+        if (status === 'unsupported')
+            return 'Unsupported by source';
+        if (status === 'not_found')
+            return 'No matching registry object';
+        if (status === 'skipped')
+            return 'Source skipped';
+        if (status === 'disabled')
+            return 'Disabled by deployment policy';
+        return 'Source unavailable';
+    }
+    if (Array.isArray(value))
+        return value.join(', ');
+    return String(value);
+}
+function findRdapEvent(rdap, action) {
+    if (!Array.isArray(rdap.events))
+        return null;
+    const event = rdap.events.map(record).find((item) => item.action === action);
+    return event?.date || null;
+}
+function rdapLifecycleDate(rdap, field, fallbackAction) {
+    const value = record(rdap.lifecycle)[field];
+    return typeof value === 'string' && value ? value : findRdapEvent(rdap, fallbackAction);
+}
+// Conflict and equivalence require values from both sources. Missing fields
+// in a failed, unsupported, skipped, not-found, or partial source are not
+// publication differences: preserving that source health prevents a lookup
+// failure from being presented as an RDAP/WHOIS disagreement.
+function classifyFieldStatus(rdapState, whoisState, rdapValue, whoisValue, normalize) {
+    if (rdapState === 'value' && whoisState === 'value') {
+        return sameNormalizedValue(normalize(rdapValue), normalize(whoisValue)) ? 'equivalent' : 'conflict';
+    }
+    if (rdapState === 'redacted' && whoisState === 'redacted')
+        return 'equivalent';
+    if (rdapState === 'unavailable')
+        return 'rdap_unavailable';
+    if (whoisState === 'unavailable')
+        return 'whois_unavailable';
+    if (rdapState === 'incomplete')
+        return 'rdap_incomplete';
+    if (whoisState === 'incomplete')
+        return 'whois_incomplete';
+    if (rdapState === 'value' && whoisState === 'absent')
+        return 'rdap_only';
+    if (whoisState === 'value' && rdapState === 'absent')
+        return 'whois_only';
+    if (rdapState === 'redacted')
+        return 'rdap_redacted';
+    return 'whois_redacted';
+}
+function compareField(label, rdapValue, whoisValue, normalize, sourceHealth, comparisonValues = {}) {
+    const rdapPublishedState = publishedState(rdapValue);
+    const whoisPublishedState = publishedState(whoisValue);
+    if (rdapPublishedState === 'absent' && whoisPublishedState === 'absent')
+        return null;
+    const rdapState = fieldState(rdapValue, sourceHealth.rdapCondition);
+    const whoisState = fieldState(whoisValue, sourceHealth.whoisCondition);
+    return {
+        label,
+        status: classifyFieldStatus(rdapState, whoisState, comparisonValues.rdap ?? rdapValue, comparisonValues.whois ?? whoisValue, normalize),
+        rdapState,
+        whoisState,
+        rdapDisplay: displayValue(rdapValue, rdapState, sourceHealth.rdapStatus),
+        whoisDisplay: displayValue(whoisValue, whoisState, sourceHealth.whoisStatus),
+    };
+}
+export function compareRegistrySources(rdapParsed, whoisParsed, options = {}) {
+    const rdap = record(rdapParsed);
+    const whois = record(whoisParsed);
+    const sourceHealth = {
+        rdapStatus: options.rdapStatus || null,
+        whoisStatus: options.whoisStatus || null,
+        rdapCondition: sourceCondition(options.rdapStatus),
+        whoisCondition: sourceCondition(options.whoisStatus),
+    };
+    const statusNormalizer = options.statusNormalizer || normalizeStatus;
+    const dateField = (label, field, fallbackAction) => {
+        const rdapLifecycle = record(rdap.lifecycle);
+        const whoisLifecycle = record(whois.lifecycle);
+        const rdapValue = rdapLifecycleDate(rdap, field, fallbackAction);
+        const whoisValue = whois[field] || whoisLifecycle[field] || null;
+        return compareField(label, rdapValue, whoisValue, normalizeDate, sourceHealth, {
+            rdap: rdapLifecycle[`${field}Iso`] || rdapValue,
+            whois: whois[`${field}Iso`] || whoisLifecycle[`${field}Iso`] || whoisValue,
+        });
+    };
+    const fields = [
+        compareField('Domain', rdap.domain, whois.domainName, normalizeDomain, sourceHealth),
+        compareField('Registry object ID', rdap.handle, whois.registryDomainId, normalizeText, sourceHealth),
+        compareField('Registrar', registrarValue(rdap.registrar), whois.registrar, normalizeText, sourceHealth),
+        compareField('Registrar IANA ID', rdap.registrarIanaId, whois.registrarIanaId, normalizeText, sourceHealth),
+        dateField('Created', 'createdDate', 'registration'),
+        dateField('Expires', 'expiryDate', 'expiration'),
+        dateField('Last updated', 'updatedDate', 'last changed'),
+        compareField('DNSSEC', rdap.dnssec, whois.dnssec, normalizeDnssec, sourceHealth),
+        compareField('Statuses', rdap.statuses, whois.statuses, (values) => normalizeSet(values, statusNormalizer), sourceHealth),
+        compareField('Name servers', rdap.nameservers, whois.nameservers, (values) => normalizeSet(values, normalizeNameserver), sourceHealth),
+    ].filter((field) => field !== null);
+    const counts = {
+        equivalent: 0, conflict: 0, rdap_only: 0, whois_only: 0,
+        rdap_redacted: 0, whois_redacted: 0,
+        rdap_unavailable: 0, whois_unavailable: 0,
+        rdap_incomplete: 0, whois_incomplete: 0,
+    };
+    for (const field of fields)
+        counts[field.status] += 1;
+    return {
+        fields,
+        counts,
+        sourceHealth: {
+            rdap: { status: sourceHealth.rdapStatus, condition: sourceHealth.rdapCondition },
+            whois: { status: sourceHealth.whoisStatus, condition: sourceHealth.whoisCondition },
+        },
+    };
+}
+const RDAP_PUBLICATION_STATUS = {
+    equivalent: 'equivalent',
+    conflict: 'conflict',
+    rdap_only: 'registry_only',
+    whois_only: 'registrar_only',
+    rdap_redacted: 'registry_redacted',
+    whois_redacted: 'registrar_redacted',
+    rdap_unavailable: 'registry_unavailable',
+    whois_unavailable: 'registrar_unavailable',
+    rdap_incomplete: 'registry_incomplete',
+    whois_incomplete: 'registrar_incomplete',
+};
+// Registrar RDAP is a separately attributed publication, not a replacement
+// for the registry object. Reuse the established pairwise normalization while
+// adapting only fields with portable semantics across both RDAP publishers.
+// Source-specific object handles and contact inventories stay out of conflict
+// classification because different identifiers and disclosure policies are
+// expected at each layer.
+export function compareRdapPublications(registryParsed, registrarParsed, options = {}) {
+    const registry = record(registryParsed);
+    const registrar = record(registrarParsed);
+    const registrarLifecycle = record(registrar.lifecycle);
+    const comparison = compareRegistrySources({ ...registry, handle: null }, {
+        domainName: registrar.domain,
+        registrar: registrarValue(registrar.registrar),
+        registrarIanaId: registrar.registrarIanaId,
+        createdDate: registrarLifecycle.createdDate,
+        createdDateIso: registrarLifecycle.createdDateIso,
+        expiryDate: registrarLifecycle.expiryDate,
+        expiryDateIso: registrarLifecycle.expiryDateIso,
+        updatedDate: registrarLifecycle.updatedDate,
+        updatedDateIso: registrarLifecycle.updatedDateIso,
+        dnssec: registrar.dnssec,
+        statuses: registrar.statuses,
+        nameservers: registrar.nameservers,
+    }, {
+        rdapStatus: options.registryStatus,
+        whoisStatus: options.registrarStatus,
+        statusNormalizer: normalizeRdapPublicationStatus,
+    });
+    const counts = {
+        equivalent: 0,
+        conflict: 0,
+        registry_only: 0,
+        registrar_only: 0,
+        registry_redacted: 0,
+        registrar_redacted: 0,
+        registry_unavailable: 0,
+        registrar_unavailable: 0,
+        registry_incomplete: 0,
+        registrar_incomplete: 0,
+    };
+    const fields = comparison.fields.map((field) => {
+        const status = RDAP_PUBLICATION_STATUS[field.status];
+        counts[status] += 1;
+        return {
+            label: field.label,
+            status,
+            registryState: field.rdapState,
+            registrarState: field.whoisState,
+            registryDisplay: field.rdapDisplay,
+            registrarDisplay: field.whoisDisplay,
+        };
+    });
+    return {
+        fields,
+        counts,
+        sourceHealth: {
+            registry: comparison.sourceHealth.rdap,
+            registrar: comparison.sourceHealth.whois,
+        },
+    };
+}

package/lib/registry-dates.mjs

@@ -0,0 +1,190 @@
+// Deterministic normalization for lifecycle dates published by RDAP and
+// WHOIS services. Raw upstream strings remain the provenance source; these
+// helpers only produce additive Date/ISO companions for comparison, storage,
+// and presentation.
+const REGISTRY_MONTHS = Object.freeze({
+    jan: 1, feb: 2, mar: 3, apr: 4, may: 5, jun: 6,
+    jul: 7, aug: 8, sep: 9, oct: 10, nov: 11, dec: 12,
+});
+const REGISTRY_MONTH_NAMES = Object.freeze({
+    january: 1, february: 2, march: 3, april: 4, may: 5, june: 6,
+    july: 7, august: 8, september: 9, october: 10, november: 11, december: 12,
+});
+function utcDateFromParts(year, month, day, hour = 0, minute = 0, second = 0, millisecond = 0) {
+    if (![year, month, day, hour, minute, second, millisecond].every(Number.isInteger))
+        return null;
+    if (year < 1000 || year > 9999 || month < 1 || month > 12 || day < 1
+        || hour < 0 || hour > 23 || minute < 0 || minute > 59
+        || second < 0 || second > 59 || millisecond < 0 || millisecond > 999)
+        return null;
+    const date = new Date(Date.UTC(year, month - 1, day, hour, minute, second, millisecond));
+    if (date.getUTCFullYear() !== year || date.getUTCMonth() !== month - 1 || date.getUTCDate() !== day
+        || date.getUTCHours() !== hour || date.getUTCMinutes() !== minute
+        || date.getUTCSeconds() !== second || date.getUTCMilliseconds() !== millisecond)
+        return null;
+    return date;
+}
+// Parse the explicit non-ISO formats observed across supported ccTLD WHOIS
+// services before considering ISO-shaped input. Runtime Date parsing treats
+// dotted dates ambiguously and timezone-less timestamps in the host's local
+// timezone, so every accepted shape is validated and normalized through UTC.
+function parseRegistryDate(input) {
+    if (typeof input !== 'string')
+        return null;
+    // The documented .nz WHOIS examples place one space before the RFC3339
+    // `T` separator. Canonicalize that registry-specific presentation quirk
+    // before applying the existing strict ISO-shaped parser.
+    const value = input.trim()
+        .replace(/^(\d{4}-\d{2}-\d{2})[ ]+[Tt](?=\d{2}:)/, '$1T')
+        // The .ee WHOIS service separates an otherwise ISO-shaped numeric
+        // timezone from its clock with one space.
+        .replace(/^(\d{4}-\d{2}-\d{2}[Tt ]\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?)[ ]+([+-]\d{2}:?\d{2})$/, '$1$2');
+    if (!value)
+        return null;
+    // DD.MM.YYYY[ HH:MM:SS] - e.g. 14.03.2024 10:46:48
+    let match = value.match(/^(\d{1,2})\.(\d{1,2})\.(\d{4})(?:\s+(\d{1,2}):(\d{2}):(\d{2}))?$/);
+    if (match) {
+        const [, day = '', month = '', year = '', hour = '0', minute = '0', second = '0'] = match;
+        return utcDateFromParts(+year, +month, +day, +(hour || 0), +(minute || 0), +(second || 0));
+    }
+    // YYYY. MM. DD. - e.g. 2006. 09. 18.
+    match = value.match(/^(\d{4})\.\s*(\d{1,2})\.\s*(\d{1,2})\.?$/);
+    if (match) {
+        const [, year = '', month = '', day = ''] = match;
+        return utcDateFromParts(+year, +month, +day);
+    }
+    // YYYY.MM.DD HH:MM:SS - used by NASK's .pl WHOIS service.
+    match = value.match(/^(\d{4})\.(\d{1,2})\.(\d{1,2})\s+(\d{1,2}):(\d{2}):(\d{2})$/);
+    if (match) {
+        const [, year = '', month = '', day = '', hour = '', minute = '', second = ''] = match;
+        return utcDateFromParts(+year, +month, +day, +hour, +minute, +second);
+    }
+    // YYYY/MM/DD - an unambiguous year-first form used by CIRA WHOIS.
+    match = value.match(/^(\d{4})\/(\d{1,2})\/(\d{1,2})$/);
+    if (match) {
+        const [, year = '', month = '', day = ''] = match;
+        return utcDateFromParts(+year, +month, +day);
+    }
+    // YYYYMMDD with an optional time or Registro.br contact-reference suffix.
+    // The raw value remains available as provenance while the validated date
+    // and optional clock time are projected into the additive ISO companion.
+    match = value.match(/^(\d{4})(\d{2})(\d{2})(?:\s+(\d{1,2}):(\d{2}):(\d{2})|\s+#[0-9]{1,20})?$/);
+    if (match) {
+        const [, year = '', month = '', day = '', hour = '0', minute = '0', second = '0'] = match;
+        return utcDateFromParts(+year, +month, +day, +(hour || 0), +(minute || 0), +(second || 0));
+    }
+    // YYYY-Mon-DD. - e.g. 1999-Feb-16.
+    match = value.match(/^(\d{4})-([A-Za-z]{3})-(\d{1,2})\.?$/);
+    if (match) {
+        const month = REGISTRY_MONTHS[(match[2] ?? '').toLowerCase()];
+        return month ? utcDateFromParts(+(match[1] ?? ''), month, +(match[3] ?? '')) : null;
+    }
+    // DD-Mon-YYYY[ HH:MM:SS] - used by several ICANN-style ccTLD services.
+    match = value.match(/^(\d{1,2})-([A-Za-z]{3})-(\d{4})(?:\s+(\d{1,2}):(\d{2}):(\d{2}))?$/);
+    if (match) {
+        const month = REGISTRY_MONTHS[(match[2] ?? '').toLowerCase()];
+        return month
+            ? utcDateFromParts(+(match[3] ?? ''), month, +(match[1] ?? ''), +(match[4] || 0), +(match[5] || 0), +(match[6] || 0))
+            : null;
+    }
+    // DD-MM-YYYY - the day-first form published by the currently profiled
+    // registries that use bare numeric hyphen dates. A future month-first
+    // source must receive its own marker-gated parser rather than reusing this
+    // global shape. The four-digit final year remains distinct from ISO below.
+    match = value.match(/^(\d{1,2})-(\d{1,2})-(\d{4})$/);
+    if (match) {
+        const [, day = '', month = '', year = ''] = match;
+        return utcDateFromParts(+year, +month, +day);
+    }
+    // YYYY-MM-DD HH:MM:SS (GMT+H:MM) - the explicit offset form published by
+    // the Kazakhstan registry. Parentheses and the GMT marker are required so
+    // unrelated prose is not accepted as a lifecycle timestamp.
+    match = value.match(/^(\d{4})-(\d{2})-(\d{2})\s+(\d{2}):(\d{2}):(\d{2})\s+\(GMT([+-])(\d{1,2}):(\d{2})\)$/i);
+    if (match) {
+        const [, year = '', month = '', day = '', hour = '', minute = '', second = '', sign = '', offsetHours = '', offsetMinutes = '',] = match;
+        const local = utcDateFromParts(+year, +month, +day, +hour, +minute, +second);
+        if (!local || +offsetHours > 23 || +offsetMinutes > 59)
+            return null;
+        const offsetMs = (+offsetHours * 60 + +offsetMinutes) * 60000;
+        return new Date(local.getTime() + (sign === '+' ? -offsetMs : offsetMs));
+    }
+    // DD-MM-YYYY HH:MM:SS GMT+H - the Tunisian registry's bounded local-time
+    // presentation. Accept an optional minute component but require the GMT
+    // marker and validate the calendar and offset before normalization.
+    match = value.match(/^(\d{1,2})-(\d{1,2})-(\d{4})\s+(\d{2}):(\d{2}):(\d{2})\s+GMT([+-])(\d{1,2})(?::(\d{2}))?$/i);
+    if (match) {
+        const [, day = '', month = '', year = '', hour = '', minute = '', second = '', sign = '', offsetHours = '', offsetMinutes = '0',] = match;
+        const local = utcDateFromParts(+year, +month, +day, +hour, +minute, +second);
+        if (!local || +offsetHours > 23 || +offsetMinutes > 59)
+            return null;
+        const offsetMs = (+offsetHours * 60 + +offsetMinutes) * 60000;
+        return new Date(local.getTime() + (sign === '+' ? -offsetMs : offsetMs));
+    }
+    // DD Mon YYYY - the compact English month form published by THNIC.
+    match = value.match(/^(\d{1,2})\s+([A-Za-z]{3})\s+(\d{4})$/);
+    if (match) {
+        const month = REGISTRY_MONTHS[(match[2] ?? '').toLowerCase()];
+        return month ? utcDateFromParts(+(match[3] ?? ''), month, +(match[1] ?? '')) : null;
+    }
+    // Ordinal-day Month YYYY[ at HH:MM:SS.sss] - the English form published
+    // by the Channel Islands registry. The suffix and `at` token are required
+    // so ordinary prose containing a month name is not accepted as lifecycle
+    // evidence.
+    match = value.match(/^(\d{1,2})(st|nd|rd|th)\s+([A-Za-z]{3,9})\s+(\d{4})(?:\s+at\s+(\d{1,2}):(\d{2}):(\d{2})(?:\.(\d{1,3}))?)?$/i);
+    if (match) {
+        const day = +(match[1] ?? '');
+        const suffix = (match[2] ?? '').toLowerCase();
+        const expectedSuffix = day % 100 >= 11 && day % 100 <= 13
+            ? 'th'
+            : ({ 1: 'st', 2: 'nd', 3: 'rd' }[day % 10] || 'th');
+        if (suffix !== expectedSuffix)
+            return null;
+        const monthText = (match[3] ?? '').toLowerCase();
+        const month = REGISTRY_MONTH_NAMES[monthText] || REGISTRY_MONTHS[monthText];
+        const millisecond = match[8] ? Number(`${match[8]}00`.slice(0, 3)) : 0;
+        return month
+            ? utcDateFromParts(+(match[4] ?? ''), month, day, +(match[5] || 0), +(match[6] || 0), +(match[7] || 0), millisecond)
+            : null;
+    }
+    // Ddd Mon DD YYYY[ HH:MM:SS] - the English textual form used by the
+    // Belgian registry. Weekday text is presentation-only; the validated
+    // calendar components determine the canonical UTC companion.
+    match = value.match(/^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s+([A-Za-z]{3})\s+(\d{1,2})\s+(\d{4})(?:\s+(\d{1,2}):(\d{2}):(\d{2}))?$/i);
+    if (match) {
+        const month = REGISTRY_MONTHS[(match[1] ?? '').toLowerCase()];
+        return month
+            ? utcDateFromParts(+(match[3] ?? ''), month, +(match[2] ?? ''), +(match[4] || 0), +(match[5] || 0), +(match[6] || 0))
+            : null;
+    }
+    // Month DD YYYY - ISNIC publishes English month names with variable
+    // spacing and no timezone. Keep the accepted shape narrow and accept only
+    // the twelve exact English names from a fixed table.
+    match = value.match(/^([A-Za-z]{3,9})\s+(\d{1,2})\s+(\d{4})$/);
+    if (match) {
+        const month = REGISTRY_MONTH_NAMES[(match[1] ?? '').toLowerCase()];
+        return month ? utcDateFromParts(+(match[3] ?? ''), month, +(match[2] ?? '')) : null;
+    }
+    // ISO 8601-shaped dates and timestamps. A missing timezone is deliberately
+    // interpreted as UTC so Express and function deployments agree.
+    match = value.match(/^(\d{4})-(\d{2})-(\d{2})(?:[Tt ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(?:([Zz])|([+-])(\d{2}):?(\d{2}))?)?$/);
+    if (!match)
+        return null;
+    const [, year = '', month = '', day = '', hour = '0', minute = '0', second = '0', fraction, zulu, offsetSign, offsetHours = '0', offsetMinutes = '0',] = match;
+    const millisecond = fraction ? Number(`${fraction}000`.slice(0, 3)) : 0;
+    const local = utcDateFromParts(+year, +month, +day, +(hour || 0), +(minute || 0), +(second || 0), millisecond);
+    if (!local)
+        return null;
+    if (!offsetSign || zulu)
+        return local;
+    const offsetHour = +offsetHours;
+    const offsetMinute = +offsetMinutes;
+    if (offsetHour > 23 || offsetMinute > 59)
+        return null;
+    const offsetMs = (offsetHour * 60 + offsetMinute) * 60000;
+    return new Date(local.getTime() + (offsetSign === '+' ? -offsetMs : offsetMs));
+}
+function registryDateIso(value) {
+    const date = parseRegistryDate(value);
+    return date ? date.toISOString() : null;
+}
+export { parseRegistryDate, registryDateIso };