@slicedearth/whoisleuth-cli 1.32.2 → 1.36.1

package/cli/lookup-plan.mjs

@@ -0,0 +1,99 @@
+export const CLI_LOOKUP_PLAN_SCHEMA = 'whoisleuth.cli.lookup-plan';
+export const CLI_LOOKUP_PLAN_VERSION = 1;
+const RDAP = Object.freeze({
+    source: 'rdap',
+    purpose: 'Collect authoritative registration or allocation evidence where supported.',
+    disclosure: 'The normalized target is sent to the applicable RDAP bootstrap and service endpoints.',
+    conditional: false,
+});
+const WHOIS = Object.freeze({
+    source: 'whois',
+    purpose: 'Collect separately attributed registry and referral publications.',
+    disclosure: 'The normalized target is sent over bounded TCP connections to applicable WHOIS services.',
+    conditional: false,
+});
+const FAST_DOMAIN_EVIDENCE = Object.freeze({
+    source: 'domain_evidence',
+    purpose: 'Derive a registration state from RDAP, with bounded DNS delegation fallback when needed.',
+    disclosure: 'DNS resolvers may receive the registrable domain when RDAP does not provide a usable record.',
+    conditional: true,
+});
+const DEEP_DOMAIN_EVIDENCE = Object.freeze({
+    source: 'domain_evidence',
+    purpose: 'Collect bounded DNS, HTTP, TLS, page-identity, technology, and security-posture evidence.',
+    disclosure: 'DNS resolvers and the target website infrastructure receive the hostname through bounded probes.',
+    conditional: false,
+});
+const REGISTRAR_RDAP = Object.freeze({
+    source: 'registrar_rdap',
+    purpose: 'Collect a separately attributed registrar RDAP publication when registry evidence advertises one.',
+    disclosure: 'The registrable domain is sent to the advertised registrar RDAP service.',
+    conditional: true,
+});
+const NETWORK_CONTEXT = Object.freeze({
+    source: 'network_context',
+    purpose: 'Add allocation and routing context for public addresses observed during domain collection.',
+    disclosure: 'Observed public addresses may be sent to applicable RDAP services.',
+    conditional: true,
+});
+const REVERSE_DNS = Object.freeze({
+    source: 'reverse_dns',
+    purpose: 'Collect operator-published reverse-DNS context for a public IP address.',
+    disclosure: 'A DNS resolver receives the reverse lookup for the normalized IP address.',
+    conditional: false,
+});
+function plannedSources(classified, deep) {
+    if (!deep) {
+        return Object.freeze(classified.type === 'domain' ? [RDAP, FAST_DOMAIN_EVIDENCE] : [RDAP]);
+    }
+    if (classified.type === 'domain') {
+        return Object.freeze([RDAP, WHOIS, DEEP_DOMAIN_EVIDENCE, REGISTRAR_RDAP, NETWORK_CONTEXT]);
+    }
+    if (classified.type === 'ipv4' || classified.type === 'ipv6') {
+        return Object.freeze([RDAP, WHOIS, REVERSE_DNS]);
+    }
+    return Object.freeze([RDAP, WHOIS]);
+}
+function buildCliLookupPlan(query, classified, deep) {
+    return Object.freeze({
+        schema: CLI_LOOKUP_PLAN_SCHEMA,
+        version: CLI_LOOKUP_PLAN_VERSION,
+        mode: deep ? 'deep' : 'fast',
+        target: Object.freeze({
+            query,
+            type: classified.type,
+            normalized: classified.value,
+            ...(classified.inputHostname ? { inputHostname: classified.inputHostname } : {}),
+            ...(classified.registrableDomain ? { registrableDomain: classified.registrableDomain } : {}),
+        }),
+        planning: Object.freeze({
+            networkRequestsMade: false,
+            collectionRequiresNetwork: true,
+            sources: plannedSources(classified, deep),
+        }),
+        limitations: Object.freeze([
+            'This is a local preflight. It does not test source availability, feature configuration, cache state, redirects, referrals, or the exact number of requests a completed lookup may require.',
+            'Conditional sources may be skipped when prerequisite evidence is absent, unsupported, disabled, or unavailable.',
+        ]),
+    });
+}
+function formatCliLookupPlan(plan) {
+    const lines = [
+        'WHOISleuth lookup preflight',
+        `Target: ${plan.target.normalized}`,
+        `Type: ${plan.target.type}`,
+        `Mode: ${plan.mode}`,
+        'Network requests made: no',
+        '',
+        'Planned collection:',
+    ];
+    for (const source of plan.planning.sources) {
+        lines.push(`  ${source.source}${source.conditional ? ' (conditional)' : ''}`);
+        lines.push(`    ${source.purpose}`);
+        lines.push(`    Disclosure: ${source.disclosure}`);
+    }
+    for (const limitation of plan.limitations)
+        lines.push('', `Limitation: ${limitation}`);
+    return `${lines.join('\n')}\n`;
+}
+export { buildCliLookupPlan, formatCliLookupPlan };

package/cli/lookup-timeline.mjs

@@ -0,0 +1,123 @@
+import { Buffer } from 'node:buffer';
+import { CliUsageError } from "./errors.mjs";
+import { buildCliLookupDiff } from "./lookup-diff.mjs";
+import { parseSavedLookupDocument } from "./saved-lookup.mjs";
+export const CLI_LOOKUP_TIMELINE_SCHEMA = 'whoisleuth.cli.lookup-timeline';
+export const CLI_LOOKUP_TIMELINE_VERSION = 1;
+export const MAX_LOOKUP_TIMELINE_OBSERVATIONS = 20;
+export const MAX_LOOKUP_TIMELINE_INPUT_BYTES = 32 * 1024 * 1024;
+function buildCliLookupTimeline(inputs, generatedAt = new Date().toISOString()) {
+    if (inputs.length < 2 || inputs.length > MAX_LOOKUP_TIMELINE_OBSERVATIONS) {
+        throw new CliUsageError(`Lookup timeline requires from 2 to ${MAX_LOOKUP_TIMELINE_OBSERVATIONS} saved Lookup documents.`);
+    }
+    const totalBytes = inputs.reduce((total, input) => total + Buffer.byteLength(input, 'utf8'), 0);
+    if (totalBytes > MAX_LOOKUP_TIMELINE_INPUT_BYTES) {
+        throw new CliUsageError(`Lookup timeline input is limited to ${MAX_LOOKUP_TIMELINE_INPUT_BYTES} bytes in total.`);
+    }
+    const normalized = inputs.map((input, index) => ({
+        input,
+        document: parseSavedLookupDocument(input, { label: `Lookup timeline input ${index + 1}` }),
+        inputIndex: index,
+    }));
+    const domain = normalized[0]?.document.registrableDomain;
+    if (!domain || normalized.some((item) => item.document.registrableDomain !== domain)) {
+        throw new CliUsageError('Lookup timeline requires observations for exactly one domain.');
+    }
+    normalized.sort((left, right) => (Date.parse(left.document.generatedAt) - Date.parse(right.document.generatedAt)
+        || left.inputIndex - right.inputIndex));
+    for (let index = 1; index < normalized.length; index++) {
+        if (normalized[index - 1]?.document.generatedAt === normalized[index]?.document.generatedAt) {
+            throw new CliUsageError('Lookup timeline observation times must be unique.');
+        }
+    }
+    const observations = normalized.map((item, index) => ({
+        index,
+        generatedAt: item.document.generatedAt,
+        mode: item.document.mode,
+    }));
+    const transitions = normalized.slice(1).map((current, index) => {
+        const previous = normalized[index];
+        if (!previous)
+            throw new TypeError('Lookup timeline ordering failed.');
+        const diff = buildCliLookupDiff(previous.input, current.input, generatedAt, { domainMode: 'same' });
+        return {
+            index,
+            fromObservation: index,
+            toObservation: index + 1,
+            comparison: diff.comparison,
+        };
+    });
+    const fields = {
+        conflicting: 0,
+        different: 0,
+        equal: 0,
+        missing: 0,
+        notRecorded: 0,
+        unavailable: 0,
+    };
+    let transitionsWithObservedChanges = 0;
+    for (const transition of transitions) {
+        const counts = transition.comparison.counts;
+        fields.conflicting += counts.conflicting;
+        fields.different += counts.different;
+        fields.equal += counts.equal;
+        fields.missing += counts.missing;
+        fields.notRecorded += counts.not_recorded;
+        fields.unavailable += counts.unavailable;
+        if (counts.conflicting + counts.different > 0)
+            transitionsWithObservedChanges += 1;
+    }
+    return {
+        schema: CLI_LOOKUP_TIMELINE_SCHEMA,
+        version: CLI_LOOKUP_TIMELINE_VERSION,
+        generatedAt,
+        domain,
+        observations,
+        transitions,
+        summary: {
+            observationCount: observations.length,
+            transitionCount: transitions.length,
+            transitionsWithObservedChanges,
+            fields,
+        },
+        privacy: {
+            filenamesRetained: 0,
+            rawRegistryPayloadsCopied: 0,
+        },
+        limitations: [
+            'The timeline compares only bounded normalized fields already present in the selected saved Lookup documents and makes no network request.',
+            'Input filenames and raw registry payloads are not copied into the timeline output.',
+            'Missing, unavailable, and not-recorded evidence remain separate from an observed difference.',
+            'A difference can reflect a domain change or changed collection conditions and does not by itself establish current state, ownership, intent, safety, or maliciousness.',
+        ],
+    };
+}
+function formatCliLookupTimeline(document) {
+    const output = [
+        'Same-domain observation timeline',
+        `Domain             ${document.domain}`,
+        `Observations       ${document.summary.observationCount}`,
+        `First observed     ${document.observations[0]?.generatedAt || 'Unavailable'}`,
+        `Last observed      ${document.observations.at(-1)?.generatedAt || 'Unavailable'}`,
+        `Changed transitions ${document.summary.transitionsWithObservedChanges}`,
+    ];
+    for (const transition of document.transitions) {
+        const from = document.observations[transition.fromObservation];
+        const to = document.observations[transition.toObservation];
+        const counts = transition.comparison.counts;
+        const changedRows = transition.comparison.rows.filter((row) => (row.state === 'conflicting' || row.state === 'different' || row.state === 'missing'));
+        output.push('', `${from?.generatedAt || 'Unavailable'} to ${to?.generatedAt || 'Unavailable'}`, `  Observed changes ${counts.conflicting + counts.different}`, `  One-sided fields ${counts.missing}`, `  Unavailable      ${counts.unavailable + counts.not_recorded}`);
+        if (!changedRows.length)
+            output.push('  No observed field changes in comparable evidence.');
+        for (const row of changedRows.slice(0, 10)) {
+            output.push(`  ${row.label} [${row.state.replaceAll('_', ' ')}]: ${row.left} -> ${row.right}`);
+        }
+        if (changedRows.length > 10)
+            output.push(`  ${changedRows.length - 10} additional changed fields omitted; use --json for the complete bounded comparison.`);
+    }
+    output.push('', 'Limitations:');
+    for (const limitation of document.limitations)
+        output.push(`  - ${limitation}`);
+    return `${output.join('\n')}\n`;
+}
+export { buildCliLookupTimeline, formatCliLookupTimeline };

package/cli/mail-review.mjs

@@ -1,8 +1,9 @@
 import { Buffer } from 'node:buffer';
 import { getDomain } from 'tldts';
+import { analyzeTlsaEvidence } from "../lib/tlsa-evidence.mjs";
 import { CliUsageError } from "./errors.mjs";
 export const CLI_MAIL_REVIEW_SCHEMA = 'whoisleuth.cli.mail-review';
-export const CLI_MAIL_REVIEW_VERSION = 1;
+export const CLI_MAIL_REVIEW_VERSION = 2;
 export const MAX_MAIL_REVIEW_INPUT_BYTES = 16 * 1024 * 1024;
 export const MAX_MAIL_REVIEW_ROWS = 500;
 function record(value) {
@@ -53,6 +54,21 @@ function mailState(input) {
         return 'no_explicit_mx';
     return 'evidence_incomplete';
 }
+function alignMailDaneEvidence(report, hosts) {
+    const aligned = report.service?.transport === 'tcp'
+        && report.service.port === 25
+        && hosts.includes(report.service.hostname);
+    if (aligned || report.state === 'invalid')
+        return report;
+    return Object.freeze({
+        ...report,
+        state: 'invalid',
+        limitations: Object.freeze([
+            ...report.limitations,
+            'The TLSA service name did not identify port 25 on an MX hostname retained for this domain.',
+        ]),
+    });
+}
 function normalizeMailRow(value) {
     const item = record(value);
     if (item.ok !== true)
@@ -70,6 +86,18 @@ function normalizeMailRow(value) {
     const hasSpf = boolean(availability.hasSpf) ?? boolean(summary.hasSpf);
     const hasDmarc = boolean(availability.hasDmarc) ?? boolean(summary.hasDmarc);
     const state = mailState({ dnsStatus, hasMx, hasNullMx, hasSpf, hasDmarc });
+    const tlsaInput = record(item.tlsaEvidence);
+    const dane = Object.keys(tlsaInput).length
+        ? alignMailDaneEvidence(analyzeTlsaEvidence({
+            serviceName: tlsaInput.serviceName,
+            dnssecState: tlsaInput.dnssecState,
+            pkixValidationState: tlsaInput.pkixValidationState,
+            records: tlsaInput.records,
+            certificateDerBase64: tlsaInput.certificateDerBase64,
+            spkiDerBase64: tlsaInput.spkiDerBase64,
+            authorityMaterials: tlsaInput.authorityMaterials,
+        }), hosts)
+        : null;
     return {
         domain,
         state,
@@ -80,9 +108,11 @@ function normalizeMailRow(value) {
         hasDmarc,
         mxHosts: hosts,
         providerDomains: providerDomains(hosts),
+        dane,
         limitations: [
             ...(dnsStatus === 'partial' ? ['DNS evidence was partial.'] : []),
             ...(state === 'no_explicit_mx' ? ['No explicit MX is not equivalent to a null MX or proof that delivery is impossible.'] : []),
+            ...(dane?.state === 'matched' ? [] : dane ? ['Supplied TLSA evidence did not establish one complete DNSSEC-validated match.'] : ['No TLSA evidence was supplied for offline DANE comparison.']),
             'Mail configuration does not establish use, control, intent, safety, or maliciousness.',
         ],
     };
@@ -142,6 +172,17 @@ function buildCliMailReview(textValue, generatedAt = new Date().toISOString()) {
     };
     for (const row of rows)
         counts[row.state] += 1;
+    const daneCounts = {
+        matched: 0,
+        different: 0,
+        partial: 0,
+        untrusted: 0,
+        unavailable: 0,
+        invalid: 0,
+        not_supplied: 0,
+    };
+    for (const row of rows)
+        daneCounts[row.dane?.state ?? 'not_supplied'] += 1;
     const providerMap = new Map();
     for (const row of rows) {
         for (const provider of row.providerDomains) {
@@ -165,11 +206,13 @@ function buildCliMailReview(textValue, generatedAt = new Date().toISOString()) {
         version: CLI_MAIL_REVIEW_VERSION,
         generatedAt,
         counts,
+        daneCounts,
         rows,
         providerRelationships,
         limitations: [
             'This review is passive and uses DNS evidence already retained in a WHOISleuth Bulk result; it makes no network request.',
             'Null MX, no explicit MX, receiving mail, authentication gaps, and incomplete evidence remain separate states.',
+            'Optional TLSA evidence is compared offline. A DANE match requires separately validated DNSSEC evidence from the same observation.',
             'SMTP delivery, mailbox existence, catch-all behavior, banner collection, and message acceptance were not tested.',
         ],
     };
@@ -183,12 +226,14 @@ function formatCliMailReview(document) {
         `Null MX          ${document.counts.null_mx}`,
         `No explicit MX   ${document.counts.no_explicit_mx}`,
         `Incomplete       ${document.counts.evidence_incomplete + document.counts.mail_auth_incomplete}`,
+        `DANE matched     ${document.daneCounts.matched}`,
         '',
     ];
     for (const row of document.rows) {
         lines.push(`${row.domain}  ${row.state.replaceAll('_', ' ')}`);
         lines.push(`  MX providers  ${row.providerDomains.join(', ') || 'None observed'}`);
         lines.push(`  SPF / DMARC   ${row.hasSpf === null ? 'unknown' : row.hasSpf ? 'observed' : 'not observed'} / ${row.hasDmarc === null ? 'unknown' : row.hasDmarc ? 'observed' : 'not observed'}`);
+        lines.push(`  DANE / TLSA   ${row.dane?.state ?? 'not supplied'}`);
     }
     if (document.providerRelationships.length) {
         lines.push('', 'Shared mail-provider relationships');
@@ -201,4 +246,4 @@ function formatCliMailReview(document) {
         lines.push(`  - ${limitation}`);
     return `${lines.join('\n')}\n`;
 }
-export { buildCliMailReview, formatCliMailReview, mailState, normalizeMailRow };
+export { alignMailDaneEvidence, buildCliMailReview, formatCliMailReview, mailState, normalizeMailRow };

package/cli/manual.mjs

@@ -7,7 +7,8 @@ function roffText(value) {
 function buildCliManual(options) {
     const commands = options.commands.map((command) => {
         const detail = options.details[command];
-        return `.SS ${roffText(command)}\n${roffText(detail.description)}\n.PP\n.B ${roffText(options.usage[command])}\n.PP\nExample: ${roffText(detail.example)}\n.PP\nBoundary: ${roffText(detail.boundary)}`;
+        const collection = options.collections[command];
+        return `.SS ${roffText(command)}\n${roffText(detail.description)}\n.PP\n.B ${roffText(options.usage[command])}\n.PP\nExample: ${roffText(detail.example)}\n.PP\nCollection: ${roffText(collection.mode)}. ${roffText(collection.scope)}\n.PP\nBoundary: ${roffText(detail.boundary)}`;
     }).join('\n');
     return `.TH WHOISLEUTH 1 "" "WHOISleuth ${roffText(options.version)}" "User Commands"
 .SH NAME

package/cli/offline-evidence-review.mjs

@@ -0,0 +1,141 @@
+import { Buffer } from 'node:buffer';
+import { normalizeEncryptedDnsAdapter, planEncryptedDnsQuery, } from "../lib/encrypted-dns-contract.mjs";
+import { validateDnssecEvidence } from "../lib/dnssec-evidence-validation.mjs";
+import { buildLocalGeoIpDatabase, lookupLocalGeoIp, } from "../lib/local-geoip-evidence.mjs";
+import { normalizeRdapSearchHelp, planRdapReverseSearch, } from "../lib/rdap-search-workbench.mjs";
+import { reviewRpkiRoute } from "../lib/rpki-evidence.mjs";
+import { analyzeTlsaEvidence } from "../lib/tlsa-evidence.mjs";
+import { CliUsageError } from "./errors.mjs";
+const OFFLINE_EVIDENCE_REVIEW_SCHEMA = 'whoisleuth.cli.offline-evidence-review';
+const OFFLINE_EVIDENCE_REVIEW_VERSION = 1;
+const MAX_OFFLINE_EVIDENCE_INPUT_BYTES = 16 * 1024 * 1024;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function parseInput(value) {
+    if (typeof value !== 'string' || Buffer.byteLength(value, 'utf8') > MAX_OFFLINE_EVIDENCE_INPUT_BYTES) {
+        throw new CliUsageError(`Offline evidence input is limited to ${MAX_OFFLINE_EVIDENCE_INPUT_BYTES} bytes.`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(value.replace(/^\uFEFF/u, ''));
+    }
+    catch {
+        throw new CliUsageError('Offline evidence review requires one valid JSON document.');
+    }
+    const document = record(parsed);
+    if (document.version !== 1 || typeof document.schema !== 'string') {
+        throw new CliUsageError('Offline evidence review requires a supported versioned input schema.');
+    }
+    return document;
+}
+function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString()) {
+    const input = parseInput(value);
+    let kind;
+    let result;
+    if (input.schema === 'whoisleuth.rdap-search-input') {
+        kind = 'rdap_search';
+        const request = record(input.request);
+        const help = normalizeRdapSearchHelp(input.help);
+        result = Object.freeze({
+            help,
+            plan: planRdapReverseSearch(help, {
+                searchableResourceType: String(request.searchableResourceType ?? ''),
+                relatedResourceType: String(request.relatedResourceType ?? ''),
+                property: String(request.property ?? ''),
+                value: request.value,
+            }),
+        });
+    }
+    else if (input.schema === 'whoisleuth.dnssec-evidence-input') {
+        kind = 'dnssec';
+        result = validateDnssecEvidence({
+            ownerName: input.ownerName,
+            delegationSigned: input.delegationSigned,
+            dsRecords: input.dsRecords,
+            dnskeyRecords: input.dnskeyRecords,
+            rrSigRecords: input.rrSigRecords,
+            observedAt: input.observedAt,
+        });
+    }
+    else if (input.schema === 'whoisleuth.tlsa-evidence-input') {
+        kind = 'tlsa';
+        result = analyzeTlsaEvidence({
+            serviceName: input.serviceName,
+            dnssecState: input.dnssecState,
+            pkixValidationState: input.pkixValidationState,
+            records: input.records,
+            certificateDerBase64: input.certificateDerBase64,
+            spkiDerBase64: input.spkiDerBase64,
+            authorityMaterials: input.authorityMaterials,
+        });
+    }
+    else if (input.schema === 'whoisleuth.rpki-route-input') {
+        kind = 'rpki';
+        result = reviewRpkiRoute({
+            routePrefix: input.routePrefix,
+            originAsn: input.originAsn,
+            authorizations: input.authorizations,
+        });
+    }
+    else if (input.schema === 'whoisleuth.local-geoip-query') {
+        kind = 'geoip';
+        result = lookupLocalGeoIp(buildLocalGeoIpDatabase(input.database), input.address);
+    }
+    else if (input.schema === 'whoisleuth.encrypted-dns-plan-input') {
+        kind = 'encrypted_dns';
+        const query = record(input.query);
+        result = planEncryptedDnsQuery(normalizeEncryptedDnsAdapter(input.adapter), { name: query.name, type: query.type });
+    }
+    else {
+        throw new CliUsageError('Offline evidence review does not recognize this input schema.');
+    }
+    return Object.freeze({
+        schema: OFFLINE_EVIDENCE_REVIEW_SCHEMA,
+        version: OFFLINE_EVIDENCE_REVIEW_VERSION,
+        generatedAt,
+        kind,
+        result,
+        limitations: Object.freeze([
+            'The review is local and uses only the supplied document. It does not refresh, transmit, or independently establish the current completeness of the evidence.',
+        ]),
+    });
+}
+function formatOfflineEvidenceReview(document) {
+    const result = record(document.result);
+    const state = typeof result.state === 'string' ? result.state : 'reviewed';
+    const lines = [
+        'Offline evidence review',
+        `Kind   ${document.kind.replaceAll('_', ' ')}`,
+        `State  ${state.replaceAll('_', ' ')}`,
+    ];
+    if (document.kind === 'rdap_search') {
+        const help = record(result.help);
+        const plan = record(result.plan);
+        lines.push(`Help   ${String(help.state ?? 'unavailable').replaceAll('_', ' ')}`);
+        lines.push(`Plan   ${String(plan.state ?? 'unavailable').replaceAll('_', ' ')}`);
+    }
+    else {
+        for (const [label, key] of [
+            ['Records', 'records'],
+            ['Rejected', 'rejectedCount'],
+            ['Matches', 'matchingAuthorizationCount'],
+        ]) {
+            const candidate = result[key];
+            if (Array.isArray(candidate))
+                lines.push(`${label.padEnd(7)}${candidate.length}`);
+            else if (typeof candidate === 'number')
+                lines.push(`${label.padEnd(7)}${candidate}`);
+        }
+    }
+    lines.push('', 'Limitations:');
+    for (const limitation of document.limitations)
+        lines.push(`  - ${limitation}`);
+    const nestedLimitations = Array.isArray(result.limitations) ? result.limitations : [];
+    for (const limitation of nestedLimitations) {
+        if (typeof limitation === 'string')
+            lines.push(`  - ${limitation}`);
+    }
+    return `${lines.join('\n')}\n`;
+}
+export { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, OFFLINE_EVIDENCE_REVIEW_SCHEMA, OFFLINE_EVIDENCE_REVIEW_VERSION, buildOfflineEvidenceReview, formatOfflineEvidenceReview, };

package/cli/registry-support.mjs

@@ -1,6 +1,6 @@
 import { registryStandardsCoverageSnapshot, } from "../lib/registry-capabilities.mjs";
 const REGISTRY_SUPPORT_SCHEMA = 'whoisleuth.cli.registry-support';
-const REGISTRY_SUPPORT_SCHEMA_VERSION = 2;
+const REGISTRY_SUPPORT_SCHEMA_VERSION = 3;
 const REGISTRY_STANDARDS_COVERAGE_SCHEMA = 'whoisleuth.registry-standards-coverage';
 const MAX_REGISTRY_SUPPORT_TEXT_LENGTH = 2048;
 const MAX_REGISTRY_SUPPORT_REFERENCES = 20;
@@ -100,9 +100,6 @@ function buildRegistrySupportDocument(requestedInput, capability, catalogueVersi
                 encodingProfile: boundedText(capability.whoisEncodingProfile, 'unknown', 64),
                 parserProfile: boundedText(capability.whoisParserProfile, 'unknown', 128),
             },
-            fallbackProfile: capability.fallbackProfile
-                ? boundedText(capability.fallbackProfile, 'unknown', 128)
-                : null,
         },
         verification: {
             fixtureScenarios: boundedList(capability.fixtureScenarios, 'token'),