@slicedearth/whoisleuth-cli 1.32.0

package/lib/whois-chain.mjs

@@ -0,0 +1,261 @@
+// WHOIS referral-chain orchestration. Transport remains isolated in
+// whois-transport.mts; this module applies registry query profiles, follows
+// bounded referrals, and adapts the registry-web fallback into WHOIS text.
+import { domainToUnicode } from 'node:url';
+import { cached } from "./lookup-cache.mjs";
+import { registryCapabilityFor } from "./registry-capabilities.mjs";
+import { readTextCapped, safeFetch } from "./safe-fetch.mjs";
+import { whoisQuery } from "./whois-transport.mjs";
+const IANA_WHOIS = 'whois.iana.org';
+const WHOIS_HOP_DEADLINE_MS = 12_000;
+const WHOIS_CHAIN_DEADLINE_MS = 25_000;
+const MAX_GT_REGISTRY_HTML_BYTES = 500_000;
+const WHOIS_QUERY_FORMATTERS = {
+    'plain-domain': (domain) => domain,
+    'denic-domain-ace': (domain) => `-T dn,ace ${domain}`,
+    'jprs-domain-english': (domain) => `${domain}/e`,
+    'registry-domain-unicode': (domain) => domainToUnicode(domain),
+};
+function whoisTransportForHop(domain, hop) {
+    const capability = registryCapabilityFor(domain);
+    const queryProfile = hop === 1 && capability?.whoisQueryScope === 'first-referral'
+        ? capability.whoisQueryProfile
+        : 'plain-domain';
+    return {
+        query: WHOIS_QUERY_FORMATTERS[queryProfile](domain),
+        queryProfile,
+        responseEncoding: capability?.whoisEncodingProfile || 'utf-8',
+    };
+}
+function errorMessage(value, fallback) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return fallback;
+    const message = value.message;
+    return message ? String(message) : fallback;
+}
+function extractReferral(whoisText) {
+    // Horizontal whitespace is intentional. `\s*` can cross a blank line and
+    // misread the next field label when a registry publishes an empty referral.
+    const patterns = [
+        /^[ \t]*refer:[ \t]*([a-zA-Z0-9.\-]+)/mi,
+        /^[ \t]*ReferralServer:[ \t]*whois:\/\/([a-zA-Z0-9.\-]+)/mi,
+        /^[ \t]*whois:[ \t]*([a-zA-Z0-9.\-]+)/mi,
+    ];
+    for (const pattern of patterns) {
+        const referral = whoisText.match(pattern)?.[1]?.trim();
+        if (referral)
+            return referral;
+    }
+    return null;
+}
+function stripTags(html) {
+    return html
+        .replace(/<[^>]+>/g, ' ')
+        .replace(/&nbsp;/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+function sectionBetween(html, startRe, endRes) {
+    const startMatch = html.match(startRe);
+    if (!startMatch)
+        return '';
+    const rest = html.slice((startMatch.index ?? 0) + startMatch[0].length);
+    let endIndex = rest.length;
+    for (const endRe of endRes) {
+        const match = rest.match(endRe);
+        if (!match)
+            continue;
+        const matchIndex = match.index ?? 0;
+        const index = match[0].startsWith('>') ? matchIndex + 1 : matchIndex;
+        if (index < endIndex)
+            endIndex = index;
+    }
+    return rest.slice(0, endIndex);
+}
+function extractIconFields(html, iconMap) {
+    let marked = html;
+    for (const [icon, key] of Object.entries(iconMap)) {
+        marked = marked.replace(new RegExp(`<i[^>]*\\b${icon}\\b[^>]*></i>`, 'gi'), `\n@@${key}@@\n`);
+    }
+    const parts = stripTags(marked).split(/@@(\w+)@@/);
+    const fields = {};
+    for (let index = 1; index < parts.length; index += 2) {
+        const value = (parts[index + 1] || '').trim();
+        const key = parts[index];
+        if (key && value && !fields[key])
+            fields[key] = value;
+    }
+    return fields;
+}
+export async function fetchGtRegistryWhois(domain, { fetcher = safeFetch, } = {}) {
+    const url = `https://www.gt/sitio/whois.php?dn=${encodeURIComponent(domain)}.&lang=en`;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 8_000);
+    try {
+        const response = await fetcher(url, {
+            headers: { 'User-Agent': 'Mozilla/5.0 (compatible; DomainStatusChecker/1.0)' },
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            await response.body?.cancel().catch(() => { });
+            return null;
+        }
+        const body = await readTextCapped(response, MAX_GT_REGISTRY_HTML_BYTES);
+        if (body.truncated)
+            return null;
+        const html = body.text;
+        if (/is not registered/i.test(html))
+            return { registered: false };
+        const statusMatch = html.match(/<i class="fas fa-bell fa-fw"><\/i>\s*([A-Za-z]+)/i);
+        const expiryMatch = html.match(/Expiration:\s*([0-9]{4}-[A-Za-z]{3}-[0-9]{2}[^<]*)/i);
+        const orgSection = sectionBetween(html, /Entitled Organization/i, [/Servers\s*<\/h4>/i]);
+        const org = extractIconFields(orgSection, {
+            'fa-building': 'org',
+            'fa-address-card': 'address',
+            'fa-phone': 'phone',
+        });
+        const adminSection = sectionBetween(html, />\s*ADMINISTRATIVE\s*</i, [/>\s*TECHNICAL\s*</i, />\s*BILLING\s*</i]);
+        const admin = extractIconFields(adminSection, {
+            'fa-user': 'name',
+            'fa-envelope': 'email',
+            'fa-address-card': 'address',
+            'fa-building': 'org',
+        });
+        const serversSection = sectionBetween(html, /Servers\s*<\/h4>/i, [
+            /<div class="span6">/i,
+        ]);
+        const nameservers = [
+            ...serversSection.matchAll(/<strong>\s*([a-zA-Z0-9.\-]+)\.?\s*<\/strong>/gi),
+        ]
+            .map((match) => match[1]?.trim())
+            .filter((value) => Boolean(value));
+        return {
+            registered: true,
+            status: statusMatch?.[1]?.trim() || null,
+            expiryDate: expiryMatch?.[1]?.trim() || null,
+            registrantOrg: org.org || null,
+            registrantAddress: org.address || null,
+            registrantPhone: org.phone || null,
+            adminName: admin.name || null,
+            adminOrg: admin.org || null,
+            adminEmail: admin.email || null,
+            nameservers,
+        };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function formatGtResultAsText(domain, result) {
+    if (!result.registered)
+        return `No match for domain ${domain.toUpperCase()}.`;
+    const lines = [`Domain Name: ${domain.toUpperCase()}`];
+    if (result.status)
+        lines.push(`Domain Status: ${result.status}`);
+    if (result.expiryDate)
+        lines.push(`Registry Expiry Date: ${result.expiryDate}`);
+    if (result.registrantOrg)
+        lines.push(`Registrant Organization: ${result.registrantOrg}`);
+    if (result.registrantAddress)
+        lines.push(`Registrant Address: ${result.registrantAddress}`);
+    if (result.registrantPhone)
+        lines.push(`Registrant Phone: ${result.registrantPhone}`);
+    if (result.adminName)
+        lines.push(`Admin Name: ${result.adminName}`);
+    if (result.adminOrg)
+        lines.push(`Admin Organization: ${result.adminOrg}`);
+    if (result.adminEmail)
+        lines.push(`Admin Email: ${result.adminEmail}`);
+    for (const nameserver of result.nameservers)
+        lines.push(`Name Server: ${nameserver}`);
+    return lines.join('\n');
+}
+export async function buildWhoisChainUncached(query, options = {}) {
+    const queryWhois = options.whoisQuery || whoisQuery;
+    const fetchGtWhois = options.fetchGtRegistryWhois || fetchGtRegistryWhois;
+    const now = options.now || Date.now;
+    const chainDeadlineMs = options.chainDeadlineMs || WHOIS_CHAIN_DEADLINE_MS;
+    const chain = [];
+    const visited = new Set();
+    let currentServer = IANA_WHOIS;
+    const startedAt = now();
+    for (let hop = 0; hop < 6; hop += 1) {
+        if (visited.has(currentServer.toLowerCase()))
+            break;
+        visited.add(currentServer.toLowerCase());
+        const transport = whoisTransportForHop(query, hop);
+        const remainingMs = chainDeadlineMs - (now() - startedAt);
+        if (remainingMs <= 0) {
+            chain.push({
+                server: currentServer,
+                queriedAt: new Date().toISOString(),
+                queryProfile: transport.queryProfile,
+                responseEncoding: transport.responseEncoding,
+                error: 'WHOIS referral chain exceeded the total time limit',
+            });
+            break;
+        }
+        let responseText;
+        let address = null;
+        const queriedAt = new Date().toISOString();
+        try {
+            responseText = await queryWhois(currentServer, transport.query, {
+                timeoutMs: Math.min(10_000, remainingMs),
+                totalDeadlineMs: Math.min(WHOIS_HOP_DEADLINE_MS, remainingMs),
+                onAddressSelected: (selected) => {
+                    address = selected;
+                },
+            });
+        }
+        catch (cause) {
+            chain.push({
+                server: currentServer,
+                queriedAt,
+                queryProfile: transport.queryProfile,
+                responseEncoding: transport.responseEncoding,
+                error: errorMessage(cause, 'WHOIS request failed'),
+            });
+            break;
+        }
+        chain.push({
+            server: currentServer,
+            address,
+            queriedAt,
+            queryProfile: transport.queryProfile,
+            responseEncoding: transport.responseEncoding,
+            response: responseText,
+        });
+        const referral = extractReferral(responseText);
+        if (!referral || referral.toLowerCase() === currentServer.toLowerCase())
+            break;
+        currentServer = referral;
+    }
+    const firstHop = chain[0];
+    if (query.toLowerCase().endsWith('.gt') &&
+        chain.length === 1 &&
+        firstHop &&
+        !('error' in firstHop)) {
+        try {
+            const result = await fetchGtWhois(query);
+            if (result) {
+                chain.push({
+                    server: 'www.gt (registry website - .gt has no WHOIS:43 server)',
+                    queriedAt: new Date().toISOString(),
+                    queryProfile: 'gt-registry-web',
+                    responseEncoding: 'utf-8',
+                    response: formatGtResultAsText(query, result),
+                });
+            }
+        }
+        catch {
+            // Best-effort registry fallback. The IANA hop remains explicit on failure.
+        }
+    }
+    return chain;
+}
+export async function buildWhoisChain(query) {
+    return cached(`whois:${query.toLowerCase()}`, () => buildWhoisChainUncached(query));
+}

package/lib/whois-contacts.mjs

@@ -0,0 +1,163 @@
+// Registry-specific contact block resolvers. These helpers only interpret
+// formats after their exact marker or handle relationship has been proven.
+import { boundedWhoisValue } from "./whois-values.mjs";
+export function resolveFredContact(text, handle) {
+    if (!handle)
+        return null;
+    const escaped = handle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const headerMatch = text.match(new RegExp(`^[ \\t]*contact:[ \\t]*${escaped}[ \\t]*$`, 'im'));
+    if (!headerMatch)
+        return null;
+    const rest = text.slice((headerMatch.index ?? 0) + headerMatch[0].length);
+    const endMatch = rest.match(/\n[ \t]*\n|^[ \t]*(?:domain|nsset|contact):/im);
+    const block = endMatch ? rest.slice(0, endMatch.index) : rest;
+    const get = (pattern) => {
+        const match = block.match(pattern);
+        return match?.[1]?.trim() || null;
+    };
+    const addresses = [...block.matchAll(/^[ \t]*address:[ \t]*(.+)$/gim)]
+        .map((match) => match[1]?.trim())
+        .filter((value) => Boolean(value));
+    return {
+        name: get(/^[ \t]*name:[ \t]*(.+)$/im),
+        org: get(/^[ \t]*org:[ \t]*(.+)$/im),
+        email: get(/^[ \t]*e-?mail:[ \t]*(.+)$/im),
+        phone: get(/^[ \t]*phone:[ \t]*(.+)$/im),
+        address: addresses.length ? addresses.join(', ') : null,
+    };
+}
+export function resolveIsnicRole(text, handle) {
+    if (!handle)
+        return null;
+    const escaped = handle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const headerMatch = text.match(new RegExp(`^[ \\t]*role:[ \\t]*(.+)\\r?\\n[ \\t]*nic-hdl:[ \\t]*${escaped}[ \\t]*$`, 'im'));
+    if (!headerMatch)
+        return null;
+    const lines = text
+        .slice((headerMatch.index ?? 0) + headerMatch[0].length)
+        .split('\n', 22);
+    const block = [];
+    for (const line of lines) {
+        if (!line.trim()) {
+            if (block.length)
+                break;
+            continue;
+        }
+        if (/^[ \t]*(?:role|person|domain):/i.test(line))
+            break;
+        if (block.length >= 20)
+            break;
+        block.push(line);
+    }
+    const blockText = block.join('\n');
+    const get = (pattern, maxLength) => {
+        const match = blockText.match(pattern);
+        return match
+            ? boundedWhoisValue(match[1], maxLength)
+            : { value: null, truncated: false };
+    };
+    const rawAddresses = [
+        ...blockText.matchAll(/^[ \t]*address:[ \t]*(.+)$/gim),
+    ];
+    const addresses = rawAddresses
+        .slice(0, 4)
+        .map((match) => boundedWhoisValue(match[1], 300))
+        .filter((entry) => entry.value);
+    const address = boundedWhoisValue(addresses.map((entry) => entry.value).join(', '), 1000);
+    return {
+        org: boundedWhoisValue(headerMatch[1], 300),
+        email: get(/^[ \t]*e-?mail:[ \t]*(.+)$/im, 320),
+        phone: get(/^[ \t]*phone:[ \t]*(.+)$/im, 100),
+        address,
+        truncated: block.length >= 20
+            || rawAddresses.length > addresses.length
+            || addresses.some((entry) => entry.truncated),
+    };
+}
+export function resolveIrnicContact(text, handle) {
+    if (!handle)
+        return null;
+    const escaped = handle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const headerMatch = text.match(new RegExp(`^[ \\t]*nic-hdl:[ \\t]*${escaped}[ \\t]*$`, 'im'));
+    if (!headerMatch)
+        return null;
+    const lines = text
+        .slice((headerMatch.index ?? 0) + headerMatch[0].length)
+        .split('\n', 22);
+    const block = [];
+    for (const line of lines) {
+        if (!line.trim()) {
+            if (block.length)
+                break;
+            continue;
+        }
+        if (/^[ \t]*(?:domain|nic-hdl):/i.test(line))
+            break;
+        if (block.length >= 20)
+            break;
+        block.push(line);
+    }
+    const blockText = block.join('\n');
+    if (!/^[ \t]*source[ \t]*:[ \t]*IRNIC(?:\s|$)/im.test(blockText)) {
+        return null;
+    }
+    const get = (pattern, maxLength) => {
+        const match = blockText.match(pattern);
+        return match
+            ? boundedWhoisValue(match[1], maxLength)
+            : { value: null, truncated: false };
+    };
+    const rawAddresses = [
+        ...blockText.matchAll(/^[ \t]*address[ \t]*:[ \t]*(.+)$/gim),
+    ];
+    const addresses = rawAddresses
+        .slice(0, 4)
+        .map((match) => boundedWhoisValue(match[1], 300))
+        .filter((entry) => entry.value);
+    const address = boundedWhoisValue(addresses.map((entry) => entry.value).join(', '), 1000);
+    return {
+        name: get(/^[ \t]*person[ \t]*:[ \t]*(.+)$/im, 300),
+        org: get(/^[ \t]*org[ \t]*:[ \t]*(.+)$/im, 300),
+        email: get(/^[ \t]*e-?mail[ \t]*:[ \t]*(.+)$/im, 320),
+        phone: get(/^[ \t]*phone[ \t]*:[ \t]*(.+)$/im, 100),
+        address,
+        truncated: block.length >= 20
+            || rawAddresses.length > addresses.length
+            || addresses.some((entry) => entry.truncated),
+    };
+}
+export function parseIndentedContactBlock(text, headerRe) {
+    const headerMatch = text.match(headerRe);
+    if (!headerMatch)
+        return null;
+    const rest = text.slice((headerMatch.index ?? 0) + headerMatch[0].length);
+    const blankLineMatch = rest.match(/\n[ \t]*\n/);
+    const blockText = blankLineMatch
+        ? rest.slice(0, blankLineMatch.index)
+        : rest;
+    const allLines = blockText
+        .split('\n')
+        .map((line) => line.trim())
+        .filter(Boolean);
+    const lines = allLines.slice(0, 20);
+    if (lines.length === 0)
+        return null;
+    const remaining = [...lines];
+    const emailIndex = remaining.findIndex((line) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(line));
+    const email = emailIndex !== -1
+        ? remaining.splice(emailIndex, 1)[0]
+        : null;
+    const phoneIndex = remaining.findIndex((line) => /^[+\d][\d.\-() ]{6,}$/.test(line));
+    const phone = phoneIndex !== -1
+        ? remaining.splice(phoneIndex, 1)[0]
+        : null;
+    const name = remaining.shift() || null;
+    const address = remaining.length ? remaining.join(', ') : null;
+    return {
+        name,
+        address,
+        phone,
+        email,
+        truncated: allLines.length > lines.length,
+    };
+}

package/lib/whois-contracts.mjs

@@ -0,0 +1,3 @@
+// Stable normalized WHOIS contracts. Parsing and transport remain separate so
+// consumers can depend on the record shape without importing network code.
+export {};

package/lib/whois-normalization.mjs

@@ -0,0 +1,27 @@
+// Bounded normalization for imported and collected WHOIS referral chains.
+// Keeping this separate lets authority analysis and field parsing share the
+// exact same defensive input boundary.
+import { MAX_WHOIS_BYTES } from "./whois-transport.mjs";
+const MAX_WHOIS_HOPS = 6;
+export function normalizeWhoisChain(value) {
+    if (!Array.isArray(value))
+        return [];
+    const normalized = [];
+    for (const hopValue of value.slice(0, MAX_WHOIS_HOPS)) {
+        if (!hopValue || typeof hopValue !== 'object' || Array.isArray(hopValue))
+            continue;
+        const hop = hopValue;
+        if (typeof hop.server !== 'string' || !hop.server.trim())
+            continue;
+        normalized.push({
+            server: hop.server.slice(0, 300),
+            ...(typeof hop.address === 'string' || hop.address === null ? { address: hop.address } : {}),
+            ...(typeof hop.queriedAt === 'string' ? { queriedAt: hop.queriedAt.slice(0, 64) } : {}),
+            ...(typeof hop.queryProfile === 'string' ? { queryProfile: hop.queryProfile.slice(0, 80) } : {}),
+            ...(typeof hop.responseEncoding === 'string' ? { responseEncoding: hop.responseEncoding.slice(0, 40) } : {}),
+            ...(typeof hop.response === 'string' ? { response: hop.response.slice(0, MAX_WHOIS_BYTES) } : {}),
+            ...(typeof hop.error === 'string' ? { error: hop.error.slice(0, 1000) } : {}),
+        });
+    }
+    return normalized;
+}

package/lib/whois-transport.mjs

@@ -0,0 +1,100 @@
+// Bounded WHOIS port-43 transport with public-address validation and
+// connection pinning. Referral orchestration and response parsing remain in
+// lib/whois.mts so this module has one responsibility: safely query one
+// validated WHOIS server.
+import net from 'node:net';
+import { resolvePublicAddresses } from "./safe-fetch.mjs";
+const MAX_WHOIS_BYTES = 200000;
+const WHOIS_HOP_DEADLINE_MS = 12000;
+const MAX_WHOIS_ADDRESSES = 3;
+function errorMessage(value, fallback) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return fallback;
+    const message = value.message;
+    return message ? String(message) : fallback;
+}
+// A referral hostname is upstream-controlled, so resolve and validate its
+// addresses before connecting. Connect to the selected address directly to
+// prevent a second DNS lookup from bypassing the public-address decision.
+function queryWhoisAddress(address, server, query, { port = 43, timeoutMs = 10000, totalDeadlineMs = WHOIS_HOP_DEADLINE_MS, createConnection = net.createConnection, } = {}) {
+    return new Promise((resolve, reject) => {
+        const socket = createConnection({ host: address, port }, () => {
+            socket.write(query + '\r\n');
+        });
+        const chunks = [];
+        let totalBytes = 0;
+        let settled = false;
+        const deadline = setTimeout(() => {
+            settled = true;
+            socket.destroy();
+            reject(new Error(`WHOIS request to ${server} exceeded the total time limit`));
+        }, totalDeadlineMs);
+        function settle(fn, value) {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(deadline);
+            fn(value);
+        }
+        socket.setTimeout(Math.min(timeoutMs, totalDeadlineMs));
+        socket.on('data', (chunk) => {
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            totalBytes += buffer.length;
+            if (totalBytes > MAX_WHOIS_BYTES) {
+                socket.destroy();
+                settle(reject, new Error(`WHOIS response from ${server} exceeded ${MAX_WHOIS_BYTES} bytes`));
+                return;
+            }
+            chunks.push(buffer);
+        });
+        const responseText = () => Buffer.concat(chunks, totalBytes).toString('utf8');
+        socket.on('end', () => settle(resolve, responseText()));
+        socket.on('close', () => settle(resolve, responseText()));
+        socket.on('timeout', () => {
+            socket.destroy();
+            settle(reject, new Error(`WHOIS request to ${server} timed out`));
+        });
+        socket.on('error', (error) => settle(reject, error));
+    });
+}
+async function whoisQuery(server, query, { port = 43, timeoutMs = 10000, totalDeadlineMs = WHOIS_HOP_DEADLINE_MS, resolveAddresses = resolvePublicAddresses, queryAddress = queryWhoisAddress, now = Date.now, onAddressSelected = (_address) => { }, } = {}) {
+    const startedAt = now();
+    let resolutionTimer;
+    const records = await Promise.race([
+        resolveAddresses(server),
+        new Promise((_, reject) => {
+            resolutionTimer = setTimeout(() => reject(new Error(`WHOIS request to ${server} timed out during DNS resolution`)), totalDeadlineMs);
+        }),
+    ]).finally(() => clearTimeout(resolutionTimer));
+    const candidates = records.slice(0, MAX_WHOIS_ADDRESSES);
+    const failures = [];
+    let attempts = 0;
+    for (const { address } of candidates) {
+        const remainingMs = totalDeadlineMs - (now() - startedAt);
+        if (remainingMs <= 0)
+            break;
+        attempts += 1;
+        try {
+            const response = await queryAddress(address, server, query, {
+                port,
+                timeoutMs: Math.min(timeoutMs, remainingMs),
+                totalDeadlineMs: remainingMs,
+            });
+            try {
+                onAddressSelected(address);
+            }
+            catch {
+                // Diagnostics must not break a successful lookup.
+            }
+            return response;
+        }
+        catch (error) {
+            failures.push(errorMessage(error, 'connection failed').slice(0, 200));
+        }
+    }
+    const detail = failures.length
+        ? `: ${failures.join('; ')}`
+        : ' because the total time limit expired';
+    throw new Error(`WHOIS request to ${server} failed after ${attempts} of ${candidates.length} validated address(es)${detail}`);
+}
+export { MAX_WHOIS_BYTES, queryWhoisAddress, whoisQuery, };

package/lib/whois-values.mjs

@@ -0,0 +1,92 @@
+// Shared bounded scalar and section helpers for WHOIS parsers. Registry
+// branches may interpret different labels, but they all use the same control
+// character, size, indentation, and section traversal rules.
+export const MAX_WHOIS_FIELD_LENGTH = 1000;
+export function boundedWhoisValue(value, maxLength = MAX_WHOIS_FIELD_LENGTH) {
+    if (typeof value !== 'string'
+        || /[\u0000-\u0008\u000a-\u001f\u007f]/.test(value)) {
+        return { value: null, truncated: false };
+    }
+    const normalized = value.replace(/\s+/g, ' ').trim();
+    if (!normalized)
+        return { value: null, truncated: false };
+    return {
+        value: normalized.slice(0, maxLength).trim() || null,
+        truncated: normalized.length > maxLength,
+    };
+}
+export function parseIndentedWhoisValue(text, headerRe, maxLength) {
+    const headerMatch = text.match(headerRe);
+    if (!headerMatch)
+        return null;
+    const lines = text
+        .slice((headerMatch.index ?? 0) + headerMatch[0].length)
+        .split('\n')
+        .slice(0, 8);
+    for (const line of lines) {
+        if (!line.trim())
+            continue;
+        if (!/^[ \t]/.test(line))
+            return null;
+        return boundedWhoisValue(line, maxLength);
+    }
+    return null;
+}
+export function parseIndentedWhoisSubfield(text, headerRe, subfieldRe, maxLength) {
+    const headerMatch = text.match(headerRe);
+    if (!headerMatch)
+        return null;
+    const lines = text
+        .slice((headerMatch.index ?? 0) + headerMatch[0].length)
+        .split('\n')
+        .slice(0, 8);
+    for (const line of lines) {
+        if (!line.trim())
+            continue;
+        if (!/^[ \t]/.test(line))
+            return null;
+        const match = line.match(subfieldRe);
+        if (match)
+            return boundedWhoisValue(match[1], maxLength);
+    }
+    return null;
+}
+export function parseBoundedWhoisSection(text, headerRe, maxLines = 20) {
+    const headerMatch = text.match(headerRe);
+    if (!headerMatch)
+        return '';
+    const lines = text
+        .slice((headerMatch.index ?? 0) + headerMatch[0].length)
+        .split('\n', maxLines + 2);
+    const section = [];
+    for (const line of lines) {
+        if (!line.trim()) {
+            if (section.length)
+                break;
+            continue;
+        }
+        if (/^[ \t]*\[[^\]]+\][ \t]*$/.test(line))
+            break;
+        if (section.length >= maxLines)
+            break;
+        section.push(line);
+    }
+    return section.join('\n');
+}
+export function whoisFieldLimit(key) {
+    if (/Email$/i.test(key))
+        return 320;
+    if (/Phone$/i.test(key))
+        return 100;
+    if (/Date$/i.test(key))
+        return 100;
+    if (/Url$/i.test(key))
+        return 2048;
+    if (/domainName/i.test(key))
+        return 253;
+    if (/Address/i.test(key))
+        return 1000;
+    if (/Street/i.test(key))
+        return 1000;
+    return 300;
+}