@slicedearth/whoisleuth-cli 1.34.0 → 1.39.1

package/lib/outbound-identity.mjs

@@ -0,0 +1,9 @@
+import packageDocument from '../package.json' with { type: 'json' };
+import { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL, } from "./project-metadata.mjs";
+import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
+export { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL };
+export const WHOISLEUTH_USER_AGENT_VERSION = normalizeBoundedSemanticVersion(packageDocument.version, 'Application manifest');
+export const WHOISLEUTH_USER_AGENT = `WHOISleuth/${WHOISLEUTH_USER_AGENT_VERSION} (+${WHOISLEUTH_REQUEST_POLICY_URL})`;
+export function whoisleuthRequestHeaders(headers = {}) {
+    return { ...headers, 'User-Agent': WHOISLEUTH_USER_AGENT };
+}

package/lib/outbound-request-bounds.mjs

@@ -0,0 +1,9 @@
+// Shared declarative limits for direct website observation. Runtime collectors
+// and the public request-policy page import these values so operator-facing
+// disclosures cannot drift from the enforced request boundaries.
+export const MAX_OUTBOUND_REDIRECTS = 5;
+export const HOMEPAGE_FETCH_TIMEOUT_MS = 6_000;
+export const MAX_HOMEPAGE_BYTES = 300_000;
+export const FAVICON_FETCH_TIMEOUT_MS = 5_000;
+export const MAX_FAVICON_BYTES = 200_000;
+export const MAX_FAVICON_CANDIDATES = 4;

package/lib/page-fingerprints.mjs

@@ -430,7 +430,7 @@ function createPageFingerprints(html, options = {}) {
         || parsedStructure.structureLimitReached || text?.truncated === true || forms?.truncated === true
         || resourceHosts.truncated || identifiers.truncated;
     const limitations = [
-        'Fingerprints summarize capped static HTML and are comparison aids, not cryptographic proof of page authorship or intent.',
+        'Fingerprints summarise capped static HTML and are comparison aids, not cryptographic proof of page authorship or intent.',
         'Visible-text SimHash is a fuzzy similarity fingerprint and must not be treated as a cryptographic digest.',
         'DOM-structure SimHash is derived from a standards-compliant static token stream and is a review aid, not proof that two pages share an author or template.',
     ];

package/lib/perceptual-hash-comparison.mjs

@@ -0,0 +1,34 @@
+// Browser-safe comparison contract for the 64-bit perceptual hashes produced
+// by the bounded image decoder. Keeping comparison and informativeness here
+// prevents Node and browser consumers from drifting into different matches.
+export const PERCEPTUAL_HASH_HEX_RE = /^[0-9a-f]{16}$/u;
+export const MIN_INFORMATIVE_HASH_BITS = 10;
+const POPCOUNT = new Uint8Array(16);
+for (let index = 0; index < POPCOUNT.length; index += 1) {
+    POPCOUNT[index] = (index & 1) + ((index >> 1) & 1) + ((index >> 2) & 1) + ((index >> 3) & 1);
+}
+export function isPerceptualHash(value) {
+    return typeof value === 'string' && PERCEPTUAL_HASH_HEX_RE.test(value);
+}
+function popcountHex(hex) {
+    let bits = 0;
+    for (let index = 0; index < hex.length; index += 1) {
+        bits += POPCOUNT[parseInt(hex.charAt(index), 16)] ?? 0;
+    }
+    return bits;
+}
+export function isInformativePerceptualHash(value) {
+    if (!isPerceptualHash(value))
+        return false;
+    const bits = popcountHex(value);
+    return bits >= MIN_INFORMATIVE_HASH_BITS && bits <= 64 - MIN_INFORMATIVE_HASH_BITS;
+}
+export function hammingDistanceHex(left, right) {
+    if (!isPerceptualHash(left) || !isPerceptualHash(right))
+        return null;
+    let distance = 0;
+    for (let index = 0; index < 16; index += 1) {
+        distance += POPCOUNT[parseInt(left.charAt(index), 16) ^ parseInt(right.charAt(index), 16)] ?? 0;
+    }
+    return distance;
+}

package/lib/perceptual-hash.mjs

@@ -21,6 +21,7 @@
 // case, while staying cheap (no DCT). Output is 16 lowercase hex chars;
 // similarity is the Hamming distance between two such strings.
 import * as zlib from 'node:zlib';
+import { hammingDistanceHex, isInformativePerceptualHash, } from "./perceptual-hash-comparison.mjs";
 // Bound the decode work on attacker-controlled image bytes. Real favicons top
 // out around 256x256; anything claiming to be larger is refused rather than
 // decoded (it would also never be a legitimate favicon to compare against).
@@ -371,21 +372,11 @@ function grayscaleGrid(image, cols, rows) {
 // (callers fall back to the exact hash) rather than a collision-prone one.
 // isInformativeHash re-checks this at comparison time too, since a Brand
 // Profile saved before this guard existed may already hold a degenerate hash.
-const MIN_INFORMATIVE_BITS = 10;
-function popcountHex(hex) {
-    let bits = 0;
-    for (let i = 0; i < hex.length; i += 1)
-        bits += POPCOUNT[parseInt(hex.charAt(i), 16)] ?? 0;
-    return bits;
-}
 function isInformativeHash(hex) {
-    if (typeof hex !== 'string' || !HEX_HASH_RE.test(hex))
-        return false;
-    const bits = popcountHex(hex);
-    return bits >= MIN_INFORMATIVE_BITS && bits <= 64 - MIN_INFORMATIVE_BITS;
+    return isInformativePerceptualHash(hex);
 }
 // 64-bit dHash over a 9x8 grid -> 16 hex chars, or null when the resulting
-// hash is degenerate (see MIN_INFORMATIVE_BITS). Each row contributes 8 bits:
+// hash is degenerate (see the shared comparison contract). Each row contributes 8 bits:
 // bit set when a cell is brighter than its right-hand neighbour.
 function dHash(image) {
     const cols = 9;
@@ -429,23 +420,4 @@ function faviconPerceptualHash(buf) {
 // produced by the optional local capture package. Keep the generic name as an
 // alias so the evidence contract does not imply that a screenshot is a favicon.
 const imagePerceptualHash = faviconPerceptualHash;
-const HEX_HASH_RE = /^[0-9a-f]{16}$/;
-const POPCOUNT = new Uint8Array(16);
-for (let i = 0; i < 16; i += 1)
-    POPCOUNT[i] = (i & 1) + ((i >> 1) & 1) + ((i >> 2) & 1) + ((i >> 3) & 1);
-/**
- * Hamming distance (0-64) between two 16-hex dHash strings, or null if either
- * isn't a well-formed hash. Smaller = more visually similar.
- */
-function hammingDistanceHex(a, b) {
-    if (typeof a !== 'string' || typeof b !== 'string')
-        return null;
-    if (!HEX_HASH_RE.test(a) || !HEX_HASH_RE.test(b))
-        return null;
-    let distance = 0;
-    for (let i = 0; i < 16; i += 1) {
-        distance += POPCOUNT[parseInt(a.charAt(i), 16) ^ parseInt(b.charAt(i), 16)] ?? 0;
-    }
-    return distance;
-}
 export { faviconPerceptualHash, hammingDistanceHex, imagePerceptualHash };

package/lib/project-metadata.mjs

@@ -0,0 +1,8 @@
+// Browser-safe public project metadata shared by request identity, package
+// verification, canonical URLs, structured data, and public policy pages.
+export const WHOISLEUTH_SITE_ORIGIN = 'https://whoisleuth.com';
+export const WHOISLEUTH_PROJECT_URL = `${WHOISLEUTH_SITE_ORIGIN}/`;
+export const WHOISLEUTH_REQUEST_POLICY_URL = `${WHOISLEUTH_SITE_ORIGIN}/request-policy`;
+export const WHOISLEUTH_SOURCE_REPOSITORY_URL = 'https://github.com/slicedearth/whoisleuth';
+export const WHOISLEUTH_SOURCE_REPOSITORY_GIT_URL = `git+${WHOISLEUTH_SOURCE_REPOSITORY_URL}.git`;
+export const WHOISLEUTH_SOURCE_ISSUES_URL = `${WHOISLEUTH_SOURCE_REPOSITORY_URL}/issues`;

package/lib/provider-policy-admission.mjs

@@ -0,0 +1,49 @@
+export const PROVIDER_POLICY_MAX_REVIEW_AGE_DAYS = 180;
+export const DEPLOYMENT_PURPOSES = ['personal', 'internal', 'commercial'];
+function deploymentPurpose(value) {
+    const normalized = String(value ?? '').trim().toLowerCase();
+    return DEPLOYMENT_PURPOSES.includes(normalized)
+        ? normalized
+        : null;
+}
+export function providerPolicyAdmission(terms, env = process.env, now = Date.now()) {
+    const source = env && typeof env === 'object' ? env : {};
+    const purpose = deploymentPurpose(source.WHOISLEUTH_DEPLOYMENT_PURPOSE);
+    const reviewedAt = Date.parse(terms.reviewedAt);
+    const reviewAgeDays = Number.isFinite(reviewedAt)
+        ? Math.max(0, Math.floor((now - reviewedAt) / 86_400_000))
+        : null;
+    if (!purpose) {
+        return {
+            allowed: false,
+            purpose: null,
+            reviewAgeDays,
+            reason: 'Optional intelligence requires WHOISLEUTH_DEPLOYMENT_PURPOSE=personal, internal, or commercial.',
+        };
+    }
+    if (reviewAgeDays === null || reviewAgeDays > PROVIDER_POLICY_MAX_REVIEW_AGE_DAYS) {
+        return {
+            allowed: false,
+            purpose,
+            reviewAgeDays,
+            reason: `Optional intelligence provider policy review is older than ${PROVIDER_POLICY_MAX_REVIEW_AGE_DAYS} days or invalid.`,
+        };
+    }
+    if (terms.commercialUse === 'unknown') {
+        return {
+            allowed: false,
+            purpose,
+            reviewAgeDays,
+            reason: 'Optional intelligence commercial-use permission is unknown.',
+        };
+    }
+    if (terms.commercialUse === 'restricted' && purpose !== 'personal') {
+        return {
+            allowed: false,
+            purpose,
+            reviewAgeDays,
+            reason: `Optional intelligence is classified as restricted for the declared ${purpose} deployment purpose.`,
+        };
+    }
+    return { allowed: true, purpose, reviewAgeDays, reason: null };
+}

package/lib/rdap-capabilities.mjs

@@ -44,7 +44,7 @@ const EXTENSION_CATALOG = Object.freeze({
     farv1: {
         label: 'Federated authentication',
         category: 'standard',
-        capability: 'Federated authorization profile declaration.',
+        capability: 'Federated authorisation profile declaration.',
     },
     fred: {
         label: 'Registry-system extension',
@@ -111,7 +111,7 @@ const EXTENSION_CATALOG = Object.freeze({
     paging: {
         label: 'Result paging',
         category: 'standard',
-        capability: 'Paged search-result behavior.',
+        capability: 'Paged search-result behaviour.',
     },
     platformns: {
         label: 'Nameserver platform extension',
@@ -146,17 +146,17 @@ const EXTENSION_CATALOG = Object.freeze({
     rirsearch1: {
         label: 'Address-registry search',
         category: 'standard',
-        capability: 'Versioned network and autonomous-system search behavior.',
+        capability: 'Versioned network and autonomous-system search behaviour.',
     },
     sorting: {
         label: 'Result sorting',
         category: 'standard',
-        capability: 'Sorted search-result behavior.',
+        capability: 'Sorted search-result behaviour.',
     },
     subsetting: {
         label: 'Partial response',
         category: 'standard',
-        capability: 'Field-subset response behavior.',
+        capability: 'Field-subset response behaviour.',
     },
     ttl0: {
         label: 'DNS TTL extension',
@@ -270,7 +270,7 @@ export function inspectRdapCapabilities(parsedValue, status) {
         .map((entry) => entry.identifier)
         .slice(0, MAX_RDAP_UNKNOWN_CAPABILITIES);
     const limitations = [
-        'Declarations describe what the server claims for this response; they do not prove that an operation is authorized, implemented correctly, complete, or available anonymously.',
+        'Declarations describe what the server claims for this response; they do not prove that an operation is authorised, implemented correctly, complete, or available anonymously.',
         'Unknown identifiers remain visible and neutral. Catalogue recognition never affects availability or Risk scoring.',
     ];
     if (state === 'unavailable') {

package/lib/rdap-search-workbench.mjs

@@ -0,0 +1,247 @@
+const RDAP_SEARCH_WORKBENCH_SCHEMA = 'whoisleuth.rdap-search-workbench';
+const RDAP_SEARCH_WORKBENCH_VERSION = 1;
+const MAX_HELP_ENTRIES = 64;
+const MAX_QUERY_VALUE_LENGTH = 254;
+const SEARCHABLE_RESOURCE_TYPES = new Set(['domains', 'nameservers', 'entities']);
+const RELATED_RESOURCE_TYPES = new Set(['entity']);
+const RECOGNIZED_PROPERTIES = new Set(['handle', 'fn', 'email', 'role']);
+const SENSITIVE_PROPERTIES = new Set(['fn', 'email']);
+const REGISTERED_PROPERTY_PATHS = Object.freeze({
+    email: Object.freeze(["$.entities[*].vcardArray[1][?(@[0]=='email')][3]"]),
+    fn: Object.freeze(["$.entities[*].vcardArray[1][?(@[0]=='fn')][3]"]),
+    handle: Object.freeze(['$.entities[*].handle']),
+    role: Object.freeze(['$.entities[*].roles']),
+});
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function boundedToken(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.trim().toLowerCase();
+    if (!normalized || normalized.length > 48 || !/^[a-z][a-z0-9_-]*$/u.test(normalized))
+        return null;
+    return normalized;
+}
+function declarationKey(value) {
+    return `${value.searchableResourceType}:${value.relatedResourceType}:${value.property}`;
+}
+function emptySummary(state, limitation, rejectedCount = 0) {
+    return Object.freeze({
+        schema: RDAP_SEARCH_WORKBENCH_SCHEMA,
+        version: RDAP_SEARCH_WORKBENCH_VERSION,
+        state,
+        capabilities: Object.freeze([]),
+        rejectedCount,
+        truncated: false,
+        limitations: Object.freeze([limitation]),
+    });
+}
+function normalizeRdapSearchHelp(value) {
+    const document = record(value);
+    if (!document)
+        return emptySummary('invalid', 'The RDAP help response was not an object.');
+    const raw = document.reverse_search_properties;
+    if (raw === undefined) {
+        return emptySummary('unsupported', 'The help response did not advertise reverse-search properties.');
+    }
+    if (!Array.isArray(raw)) {
+        return emptySummary('invalid', 'The advertised reverse-search properties were malformed.', 1);
+    }
+    const capabilities = [];
+    const seen = new Set();
+    let rejectedCount = 0;
+    const truncated = raw.length > MAX_HELP_ENTRIES;
+    for (const entry of raw.slice(0, MAX_HELP_ENTRIES)) {
+        const candidate = record(entry);
+        const searchableResourceType = boundedToken(candidate?.searchableResourceType);
+        const relatedResourceType = boundedToken(candidate?.relatedResourceType);
+        const property = boundedToken(candidate?.property);
+        if (!searchableResourceType || !relatedResourceType || !property) {
+            rejectedCount += 1;
+            continue;
+        }
+        const declaration = { searchableResourceType, relatedResourceType, property };
+        const key = declarationKey(declaration);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        const supported = SEARCHABLE_RESOURCE_TYPES.has(searchableResourceType)
+            && RELATED_RESOURCE_TYPES.has(relatedResourceType)
+            && RECOGNIZED_PROPERTIES.has(property);
+        capabilities.push(Object.freeze({
+            ...declaration,
+            state: supported ? 'supported' : 'unsupported',
+            disclosure: SENSITIVE_PROPERTIES.has(property) ? 'contact' : 'identifier',
+            limitation: supported ? null : 'The server advertised a tuple that this release does not construct.',
+        }));
+    }
+    if (truncated)
+        rejectedCount += raw.length - MAX_HELP_ENTRIES;
+    const supportedCount = capabilities.filter((entry) => entry.state === 'supported').length;
+    const limitations = [];
+    if (truncated)
+        limitations.push(`Only the first ${MAX_HELP_ENTRIES} advertised properties were reviewed.`);
+    if (rejectedCount > 0)
+        limitations.push(`${rejectedCount} malformed or excess properties were not used.`);
+    if (capabilities.some((entry) => entry.state === 'unsupported')) {
+        limitations.push('Unrecognized advertised tuples remain visible but cannot be planned by this release.');
+    }
+    if (supportedCount === 0)
+        limitations.push('No supported reverse-search tuple was advertised.');
+    return Object.freeze({
+        schema: RDAP_SEARCH_WORKBENCH_SCHEMA,
+        version: RDAP_SEARCH_WORKBENCH_VERSION,
+        state: supportedCount === 0 ? 'unsupported' : limitations.length > 0 ? 'partial' : 'supported',
+        capabilities: Object.freeze(capabilities),
+        rejectedCount,
+        truncated,
+        limitations: Object.freeze(limitations),
+    });
+}
+function normalizeQueryValue(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.trim();
+    if (!normalized || normalized.length > MAX_QUERY_VALUE_LENGTH)
+        return null;
+    if (/[\x00-\x1f\x7f]/u.test(normalized))
+        return null;
+    return normalized;
+}
+function planRdapReverseSearch(help, requested) {
+    const searchableResourceType = boundedToken(requested.searchableResourceType);
+    const relatedResourceType = boundedToken(requested.relatedResourceType);
+    const property = boundedToken(requested.property);
+    const value = normalizeQueryValue(requested.value);
+    if (!searchableResourceType || !relatedResourceType || !property || !value) {
+        return Object.freeze({
+            schema: RDAP_SEARCH_WORKBENCH_SCHEMA,
+            version: RDAP_SEARCH_WORKBENCH_VERSION,
+            state: 'invalid',
+            requestPath: null,
+            query: null,
+            disclosure: null,
+            limitation: 'The requested resource types, property, or value were invalid or outside the supported bounds.',
+        });
+    }
+    const capability = help.capabilities.find((entry) => (entry.state === 'supported'
+        && entry.searchableResourceType === searchableResourceType
+        && entry.relatedResourceType === relatedResourceType
+        && entry.property === property));
+    if (!capability) {
+        return Object.freeze({
+            schema: RDAP_SEARCH_WORKBENCH_SCHEMA,
+            version: RDAP_SEARCH_WORKBENCH_VERSION,
+            state: 'unsupported',
+            requestPath: null,
+            query: null,
+            disclosure: null,
+            limitation: 'The supplied help response did not advertise this exact reverse-search tuple.',
+        });
+    }
+    const contactDisclosure = capability.disclosure === 'contact';
+    return Object.freeze({
+        schema: RDAP_SEARCH_WORKBENCH_SCHEMA,
+        version: RDAP_SEARCH_WORKBENCH_VERSION,
+        state: 'ready',
+        requestPath: `/${searchableResourceType}/reverse_search/${relatedResourceType}`,
+        query: Object.freeze({ [property]: value }),
+        disclosure: Object.freeze({
+            class: capability.disclosure,
+            summary: contactDisclosure
+                ? `Would disclose the supplied ${property} contact value to the selected RDAP server.`
+                : `Would disclose the supplied ${property} identifier to the selected RDAP server.`,
+            requiresApproval: true,
+        }),
+        limitation: 'This is an offline request plan. It neither sends the query nor establishes result authority, completeness, or currentness.',
+    });
+}
+function inspectRdapReverseSearchResponse(value, requestedProperties = []) {
+    const document = record(value);
+    if (!document) {
+        return Object.freeze({
+            schema: RDAP_SEARCH_WORKBENCH_SCHEMA,
+            version: RDAP_SEARCH_WORKBENCH_VERSION,
+            state: 'invalid',
+            mappings: Object.freeze([]),
+            missingProperties: Object.freeze([]),
+            rejectedCount: 0,
+            truncated: false,
+            limitations: Object.freeze(['The reverse-search response was not an object.']),
+        });
+    }
+    const requested = [...new Set(requestedProperties
+            .map(boundedToken)
+            .filter((property) => Boolean(property)))]
+        .slice(0, RECOGNIZED_PROPERTIES.size);
+    const raw = document.reverse_search_properties_mapping;
+    if (!Array.isArray(raw)) {
+        return Object.freeze({
+            schema: RDAP_SEARCH_WORKBENCH_SCHEMA,
+            version: RDAP_SEARCH_WORKBENCH_VERSION,
+            state: 'invalid',
+            mappings: Object.freeze([]),
+            missingProperties: Object.freeze(requested),
+            rejectedCount: raw === undefined ? 0 : 1,
+            truncated: false,
+            limitations: Object.freeze([
+                'The response did not provide a valid reverse-search property mapping, so its result fields cannot be reconciled with the requested predicates.',
+            ]),
+        });
+    }
+    const mappings = [];
+    const seen = new Set();
+    let rejectedCount = 0;
+    const truncated = raw.length > MAX_HELP_ENTRIES;
+    for (const entry of raw.slice(0, MAX_HELP_ENTRIES)) {
+        const candidate = record(entry);
+        const property = boundedToken(candidate?.property);
+        const propertyPath = typeof candidate?.propertyPath === 'string'
+            ? candidate.propertyPath.trim().slice(0, 512)
+            : '';
+        if (!property || !propertyPath || /[\x00-\x1f\x7f]/u.test(propertyPath)) {
+            rejectedCount += 1;
+            continue;
+        }
+        const key = `${property}\u0000${propertyPath}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        mappings.push(Object.freeze({
+            property,
+            propertyPath,
+            state: REGISTERED_PROPERTY_PATHS[property]?.includes(propertyPath)
+                ? 'registered'
+                : 'unrecognized',
+        }));
+    }
+    if (truncated)
+        rejectedCount += raw.length - MAX_HELP_ENTRIES;
+    const mappedProperties = new Set(mappings.map((mapping) => mapping.property));
+    const missingProperties = requested.filter((property) => !mappedProperties.has(property));
+    const limitations = [];
+    if (missingProperties.length) {
+        limitations.push(`The response omitted mappings for requested properties: ${missingProperties.join(', ')}.`);
+    }
+    if (mappings.some((mapping) => mapping.state === 'unrecognized')) {
+        limitations.push('At least one mapping differs from the locally reviewed IANA registration and requires manual specification review.');
+    }
+    if (rejectedCount)
+        limitations.push(`${rejectedCount} malformed or excess mapping entr${rejectedCount === 1 ? 'y was' : 'ies were'} not used.`);
+    if (!mappings.length)
+        limitations.push('No usable reverse-search property mapping was retained.');
+    return Object.freeze({
+        schema: RDAP_SEARCH_WORKBENCH_SCHEMA,
+        version: RDAP_SEARCH_WORKBENCH_VERSION,
+        state: mappings.length && !limitations.length ? 'complete' : mappings.length ? 'partial' : 'invalid',
+        mappings: Object.freeze(mappings),
+        missingProperties: Object.freeze(missingProperties),
+        rejectedCount,
+        truncated,
+        limitations: Object.freeze(limitations),
+    });
+}
+export { MAX_HELP_ENTRIES, MAX_QUERY_VALUE_LENGTH, RDAP_SEARCH_WORKBENCH_SCHEMA, RDAP_SEARCH_WORKBENCH_VERSION, normalizeRdapSearchHelp, planRdapReverseSearch, inspectRdapReverseSearchResponse, };

package/lib/rdap.mjs

@@ -4,11 +4,16 @@ import { fetchRdapFromBasesWithParser, fetchRdapRecordWithParser, } from "./rdap
 import { normalizeRdapEvents, parseRdap, summarizeLifecycle, } from "./rdap-normalization.mjs";
 import { fetchRegistrarRdapRecordWithParser, selectRegistrarRdapLink, } from "./rdap-registrar.mjs";
 import { fetchRdapWithTimeout, } from "./rdap-transport.mjs";
+import { registryServiceAdmissionFor } from "./registry-capabilities.mjs";
 async function fetchRdapFromBases(type, value, bases, fetchUpstream = fetchRdapWithTimeout) {
     return fetchRdapFromBasesWithParser(type, value, bases, parseRdap, fetchUpstream);
 }
-async function fetchRdapRecord(type, value) {
-    return fetchRdapRecordWithParser(type, value, parseRdap);
+async function fetchRdapRecord(type, value, options = {}) {
+    if (type === 'domain' && registryServiceAdmissionFor(value, 'rdap')?.allowed === false) {
+        return null;
+    }
+    const fetchRecord = options.fetchRecord ?? fetchRdapRecordWithParser;
+    return fetchRecord(type, value, parseRdap);
 }
 async function fetchRegistrarRdapRecord(domain, registryRecord, options = {}) {
     return fetchRegistrarRdapRecordWithParser(domain, registryRecord, parseRdap, options);

package/lib/registry-access.mjs

@@ -3,7 +3,7 @@ const REGISTRY_ACCESS_PROFILE_LABELS = Object.freeze({
     'iana-referral': 'IANA referral discovery',
     'no-iana-service': 'No service published by IANA',
     'registry-policy-restricted': 'Registry policy restricted',
-    'source-ip-authorization-required': 'Source-IP authorization required',
+    'source-ip-authorization-required': 'Source-IP authorisation required',
 });
 const WHOIS_REGISTRY_ACCESS_PROFILES = new Set([
     'iana-referral',

package/lib/registry-capabilities.mjs

@@ -90,6 +90,36 @@ function registryAccessDiagnosticFor(value) {
         authority: 'context_only',
     };
 }
+function registryServiceAdmissionFor(value, service) {
+    const capability = registryCapabilityFor(value);
+    if (!capability || (service !== 'rdap' && service !== 'whois'))
+        return null;
+    if (service === 'rdap') {
+        const allowed = capability.rdapAccessProfile === 'iana-bootstrap';
+        return {
+            service,
+            state: allowed ? 'allowed' : 'unsupported',
+            allowed,
+            limitation: capability.limitation,
+        };
+    }
+    if (capability.whoisAccessProfile === 'iana-referral') {
+        return {
+            service,
+            state: 'allowed',
+            allowed: true,
+            limitation: capability.limitation,
+        };
+    }
+    const permissionRequired = capability.whoisAccessProfile === 'registry-policy-restricted'
+        || capability.whoisAccessProfile === 'source-ip-authorization-required';
+    return {
+        service,
+        state: permissionRequired ? 'permission_required' : 'unsupported',
+        allowed: false,
+        limitation: capability.limitation,
+    };
+}
 function listRegistryCapabilities() {
     return EXPLICIT_CAPABILITIES.map((capability) => cloneCapability(capability));
 }
@@ -114,4 +144,4 @@ function registryCompatibilityMatrix() {
     })))
         .sort((left, right) => (left.suffixes[0] ?? '').localeCompare(right.suffixes[0] ?? ''));
 }
-export { REGISTRY_CAPABILITIES_VERSION, VERSION_26_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, registryCapabilityFor, registryCompatibilityMatrix, listRegistryCapabilities, registryAccessDiagnosticFor, registryStandardsCoverageSnapshot, };
+export { REGISTRY_CAPABILITIES_VERSION, VERSION_26_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, registryCapabilityFor, registryCompatibilityMatrix, listRegistryCapabilities, registryAccessDiagnosticFor, registryServiceAdmissionFor, registryStandardsCoverageSnapshot, };

package/lib/registry-capability-catalogue.mjs

@@ -1,15 +1,16 @@
 // Registry compatibility metadata. IANA bootstrap and referral discovery
 // remain authoritative. Explicit query profiles may alter only the first
 // referred registry query after a fixture-backed adapter is integrated.
-const REGISTRY_CAPABILITIES_VERSION = 27;
+const REGISTRY_CAPABILITIES_VERSION = 28;
 const MAX_CAPABILITY_INPUT_LENGTH = 253;
 const REGISTRY_STANDARDS_COVERAGE_SNAPSHOT = Object.freeze({
     schema: 'whoisleuth.registry-standards-coverage',
     version: 1,
-    verifiedAt: '2026-08-01',
+    verifiedAt: '2026-08-03',
     sources: Object.freeze({
-        rootZoneVersion: '2026073100',
-        rootZoneLastUpdatedAt: '2026-07-31T07:07:01.000Z',
+        rootZoneVersion: '2026080200',
+        rootZoneLastUpdatedAt: '2026-08-02T07:07:01.000Z',
+        rootZoneTldSetSha256: 'aa0a75a9860b2cba07d7fe8172f4546d981be3674bf6764fb0d5f39a45940d25',
         rdapBootstrapPublication: '2026-07-23T02:00:03.000Z',
         rdapBootstrapVersion: '1.0',
         urls: Object.freeze([
@@ -50,9 +51,9 @@ const REGISTRY_STANDARDS_COVERAGE_SNAPSHOT = Object.freeze({
     ]),
     interpretation: 'This official-source snapshot describes published service coverage at the verification date. It does not test current reachability or decide registration, availability, ownership, safety, or maliciousness.',
 });
-const DISCOVERY_LIMITATION = 'IANA discovery is available, but no suffix-specific query, encoding, or parser behavior is fixture-verified.';
+const DISCOVERY_LIMITATION = 'IANA discovery is available, but no suffix-specific query, encoding, or parser behaviour is fixture-verified.';
 const FIXTURE_LIMITATION = 'Synthetic fixtures verify the current parser profile; they do not prove current live-registry reachability, policy, or field publication.';
-const ES_ACCESS_LIMITATION = 'The registry WHOIS service requires advance source-IP authorization. A failed or unavailable query is not evidence that the domain is unregistered.';
+const ES_ACCESS_LIMITATION = 'The registry WHOIS service requires advance source-IP authorisation. A failed or unavailable query is not evidence that the domain is unregistered.';
 const SWITCH_ACCESS_LIMITATION = 'The registry directs public domain searches to its official lookup. Its non-standard-port Domain Check is not integrated, and IANA publishes no RDAP service. Missing registry data is not evidence that the domain is unregistered.';
 const VN_ACCESS_LIMITATION = 'IANA publishes no domain WHOIS or RDAP service for this suffix. The official browser lookup is not integrated, and missing registry data is not evidence that the domain is unregistered.';
 const UK_TRANSITION_LIMITATION = 'Synthetic fixtures verify the documented sectioned port-43 response while that WHOIS service is phased out. RDAP remains the preferred registry source, and fixture coverage does not prove current reachability or field publication.';
@@ -63,8 +64,8 @@ const SHARED_WHOIS_NO_RDAP_LIMITATION = 'Synthetic fixture reuse is limited to a
 const WHOIS_ONLY_FIXTURE_LIMITATION = 'Synthetic fixtures verify the current WHOIS parser profile. IANA publishes no RDAP bootstrap service for this suffix, and missing registry data is not evidence that the domain is unregistered.';
 const NEGATIVE_ONLY_FIXTURE_LIMITATION = 'Synthetic fixtures verify only the authoritative no-record dialect; registered-field compatibility is not claimed, and fixture coverage does not prove current live-registry reachability or policy.';
 const WHOIS_ONLY_NEGATIVE_FIXTURE_LIMITATION = 'Synthetic fixtures verify only the authoritative WHOIS no-record dialect; registered-field compatibility is not claimed, IANA publishes no RDAP bootstrap service, and missing registry data is not evidence that the domain is unregistered.';
-const UNVERIFIED_WHOIS_REFERRAL_LIMITATION = 'IANA publishes a domain WHOIS referral, but its response behavior is not fixture-verified. A failed, restricted, prohibited, reserved, or otherwise inconclusive response is not evidence that the domain is unregistered, and IANA publishes no RDAP bootstrap service for this suffix.';
-const UNVERIFIED_WHOIS_WITH_RDAP_LIMITATION = 'IANA publishes domain WHOIS and RDAP discovery, but the WHOIS response behavior is not fixture-verified. A failed, restricted, prohibited, reserved, or otherwise inconclusive WHOIS response is not evidence that the domain is unregistered; RDAP remains separately attributed.';
+const UNVERIFIED_WHOIS_REFERRAL_LIMITATION = 'IANA publishes a domain WHOIS referral, but its response behaviour is not fixture-verified. A failed, restricted, prohibited, reserved, or otherwise inconclusive response is not evidence that the domain is unregistered, and IANA publishes no RDAP bootstrap service for this suffix.';
+const UNVERIFIED_WHOIS_WITH_RDAP_LIMITATION = 'IANA publishes domain WHOIS and RDAP discovery, but the WHOIS response behaviour is not fixture-verified. A failed, restricted, prohibited, reserved, or otherwise inconclusive WHOIS response is not evidence that the domain is unregistered; RDAP remains separately attributed.';
 const NORID_CLOSED_SUFFIX_LIMITATION = 'The registry has not opened this suffix for registrations, and IANA publishes no domain WHOIS or RDAP service. Missing registry data is contextual only and must not be interpreted as a live availability result.';
 const MIL_ACCESS_LIMITATION = 'IANA publishes no public domain WHOIS or RDAP service for this sponsored suffix. Missing registry data is contextual only and is not evidence that a name is unregistered or available.';
 const ARPA_ACCESS_LIMITATION = 'This infrastructure suffix is not ordinary public registration space. IANA publishes WHOIS metadata but no RDAP bootstrap service, and missing or non-domain-shaped data must not be interpreted as registration availability.';
@@ -158,7 +159,6 @@ const DEFAULT_CAPABILITY = freezeCapability({
     whoisQueryScope: 'first-referral',
     whoisEncodingProfile: 'utf-8',
     whoisParserProfile: 'generic-colon',
-    fallbackProfile: null,
     whoisAccessProfile: 'iana-referral',
     rdapAccessProfile: 'iana-bootstrap',
     coverageState: 'discovery_only',
@@ -661,10 +661,12 @@ const EXPLICIT_CAPABILITY_SEEDS = [
         ],
     },
     {
-        id: 'gt-registry-web', suffixes: ['gt'], registryClass: 'country-code',
-        whoisParserProfile: 'generic-colon', fallbackProfile: 'gt-registry-web',
-        fixtureScenarios: ['registered', 'not_found', 'unavailable'],
-        verificationFiles: ['test/whois-gt-fallback.test.mts'],
+        id: 'gt-no-iana-service', suffixes: ['gt'], registryClass: 'country-code',
+        whoisParserProfile: 'generic-colon', fixtureScenarios: [],
+        coverageState: 'access_documented', whoisAccessProfile: 'no-iana-service',
+        rdapAccessProfile: 'no-iana-service', verificationFiles: [],
+        documentationUrls: ['https://www.iana.org/domains/root/db/gt.html'],
+        limitation: 'IANA publishes no RDAP service or domain WHOIS service for this suffix. WHOISleuth does not automate the registry website.',
     },
     {
         id: 'carnet-icann-colon', suffixes: ['hr'], registryClass: 'country-code',
@@ -1179,7 +1181,6 @@ const EXPLICIT_CAPABILITIES = EXPLICIT_CAPABILITY_SEEDS.map((entry) => {
     const rdapAccessProfile = resolvedSeedRdapAccessProfile(entry);
     return freezeCapability({
         ...entry,
-        fallbackProfile: entry.fallbackProfile || null,
         rdapDiscovery: 'iana-bootstrap',
         whoisDiscovery: 'iana-referral',
         whoisQueryProfile: entry.whoisQueryProfile || 'plain-domain',