@slicedearth/whoisleuth-cli 1.39.1 → 1.45.0

package/cli/registry-doctor.mjs

@@ -1,11 +1,9 @@
 import { registryCapabilityFor, REGISTRY_CAPABILITIES_VERSION } from "../lib/registry-capabilities.mjs";
+import { recordOrEmpty } from "../lib/bounded-contract-normalizers.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
 const REGISTRY_DOCTOR_SCHEMA = 'whoisleuth.cli.registry-doctor';
-const REGISTRY_DOCTOR_VERSION = 1;
-function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-}
+const REGISTRY_DOCTOR_VERSION = 2;
 function status(value) {
     return typeof value === 'string'
         ? value.replace(/[\u0000-\u001f\u007f]+/gu, ' ').trim().toLowerCase().slice(0, 40) || 'unavailable'
@@ -31,27 +29,114 @@ function normalizedObjectIdentifier(parsed) {
     const candidate = parsed.handle ?? parsed.objectIdentifier ?? parsed.registryObjectId ?? parsed.id;
     return typeof candidate === 'string' && candidate.trim() ? 'observed' : 'not_observed';
 }
+function stringArray(value, limit = 100) {
+    return Array.isArray(value)
+        ? [...new Set(value.slice(0, limit).filter((item) => typeof item === 'string').map((item) => item.trim().toLowerCase()).filter(Boolean))]
+        : [];
+}
+function publicationQuality(parsed, rdapStatus) {
+    if (!['success', 'partial'].includes(rdapStatus)) {
+        const unavailable = { state: 'unavailable', value: null };
+        return {
+            objectClass: unavailable,
+            objectIdentifier: unavailable,
+            mediaType: unavailable,
+            baseConformance: { state: 'unavailable', declarations: [] },
+            redactionMetadata: { state: 'unavailable', count: 0, truncated: false },
+            selfLink: { state: 'unavailable', observedRelations: [] },
+            events: { state: 'unavailable', count: 0, conflictingActions: [] },
+            reviewItems: 0,
+        };
+    }
+    const objectClassName = typeof parsed.objectClassName === 'string' ? parsed.objectClassName.trim().toLowerCase() : '';
+    const identifier = [parsed.handle, parsed.objectIdentifier, parsed.registryObjectId, parsed.id]
+        .find((value) => typeof value === 'string' && Boolean(value.trim()))?.trim() ?? null;
+    const declarations = stringArray(parsed.conformance);
+    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, 100) : [];
+    const links = Array.isArray(parsed.links) ? parsed.links.slice(0, 100).map(recordOrEmpty) : [];
+    const relations = [...new Set(links.flatMap((link) => stringArray(link.rel, 10).length
+            ? stringArray(link.rel, 10)
+            : typeof link.rel === 'string' ? [link.rel.trim().toLowerCase()] : []).filter(Boolean))];
+    const events = Array.isArray(parsed.events) ? parsed.events.slice(0, 100).map(recordOrEmpty) : [];
+    const actionDates = new Map();
+    for (const event of events) {
+        const action = typeof event.action === 'string' ? event.action.trim().toLowerCase() : '';
+        const date = typeof event.date === 'string' ? event.date.trim() : '';
+        if (!action || !date)
+            continue;
+        const dates = actionDates.get(action) ?? [];
+        dates.push(date);
+        actionDates.set(action, dates);
+    }
+    const lifecycle = recordOrEmpty(parsed.lifecycle);
+    const lifecycleMappings = [
+        ['registration', 'createdDateIso', false],
+        ['reregistration', 'reregistrationDateIso', true],
+        ['expiration', 'expiryDateIso', true],
+        ['last changed', 'updatedDateIso', true],
+        ['transfer', 'transferDateIso', true],
+        ['deletion', 'deletionDateIso', true],
+        ['reinstantiation', 'reinstantiationDateIso', true],
+        ['last update of rdap database', 'databaseUpdatedDateIso', true],
+    ];
+    const conflictingActions = lifecycleMappings.flatMap(([action, field, newest]) => {
+        const published = typeof lifecycle[field] === 'string' ? Date.parse(lifecycle[field]) : Number.NaN;
+        if (!Number.isFinite(published))
+            return [];
+        const dates = (actionDates.get(action) ?? []).map(Date.parse).filter(Number.isFinite);
+        if (!dates.length)
+            return [action];
+        const selected = newest ? Math.max(...dates) : Math.min(...dates);
+        return selected === published ? [] : [action];
+    }).sort();
+    const objectClassState = !objectClassName ? 'not_observed' : objectClassName === 'domain' ? 'observed' : 'inconsistent';
+    const baseConformanceState = declarations.includes('rdap_level_0') ? 'observed' : 'not_observed';
+    const selfLinkState = relations.includes('self') ? 'observed' : 'not_observed';
+    const hasLifecycle = lifecycleMappings.some(([, field]) => typeof lifecycle[field] === 'string');
+    const eventsState = conflictingActions.length
+        ? 'inconsistent'
+        : events.length && hasLifecycle
+            ? 'observed'
+            : events.length
+                ? 'unavailable'
+                : 'not_observed';
+    return {
+        objectClass: { state: objectClassState, value: objectClassName || null },
+        objectIdentifier: { state: identifier ? 'observed' : 'not_observed', value: identifier },
+        mediaType: { state: 'unavailable', value: null },
+        baseConformance: { state: baseConformanceState, declarations },
+        redactionMetadata: {
+            state: redactions.length ? 'observed' : 'not_observed',
+            count: redactions.length,
+            truncated: parsed.redactionsTruncated === true,
+        },
+        selfLink: { state: selfLinkState, observedRelations: relations.sort() },
+        events: { state: eventsState, count: events.length, conflictingActions },
+        reviewItems: [objectClassState, baseConformanceState, selfLinkState, eventsState]
+            .filter((state) => state === 'inconsistent' || state === 'not_observed').length,
+    };
+}
 function buildRegistryDoctorReport(raw, generatedAt = new Date().toISOString()) {
     const document = parseSavedLookupDocument(raw, { label: 'Registry doctor input' });
     const capability = registryCapabilityFor(document.registrableDomain);
     if (!capability)
         throw new CliUsageError('Registry doctor could not resolve a capability profile for this domain.');
-    const diagnostics = record(document.diagnostics);
-    const rdap = record(document.rdap);
-    const whois = record(document.whois);
-    const rdapParsed = record(rdap.parsed);
-    const whoisParsed = record(whois.parsed);
+    const diagnostics = recordOrEmpty(document.diagnostics);
+    const rdap = recordOrEmpty(document.rdap);
+    const whois = recordOrEmpty(document.whois);
+    const rdapParsed = recordOrEmpty(rdap.parsed);
+    const whoisParsed = recordOrEmpty(whois.parsed);
     const sourceInputs = [
         {
             source: 'rdap',
             expected: capability.rdapAccessProfile === 'iana-bootstrap' ? 'allowed' : 'unsupported',
-            observed: status(record(diagnostics.rdap).status),
+            observed: status(recordOrEmpty(diagnostics.rdap).status),
             parsed: rdapParsed,
         },
         {
             source: 'whois',
             expected: expectedWhois(capability.whoisAccessProfile),
-            observed: status(record(diagnostics.whois).status),
+            observed: status(recordOrEmpty(diagnostics.whois).status),
             parsed: whoisParsed,
         },
     ];
@@ -64,6 +149,7 @@ function buildRegistryDoctorReport(raw, generatedAt = new Date().toISOString())
         objectIdentifier: normalizedObjectIdentifier(source.parsed),
         limitation: capability.limitation.slice(0, 500),
     }));
+    const publication = publicationQuality(rdapParsed, sourceInputs[0]?.observed ?? 'unavailable');
     const recommendations = [
         ...sources.filter((source) => source.alignment === 'investigate').map((source) => (source.expected === 'allowed'
             ? `Review ${source.source.toUpperCase()} source health, transport attempts, and fixture coverage; the catalogue expected collection to be available.`
@@ -83,6 +169,7 @@ function buildRegistryDoctorReport(raw, generatedAt = new Date().toISOString())
             explicitSuffixProfile: capability.explicitSuffixProfile,
             coverageState: capability.coverageState,
         },
+        publication,
         sources,
         summary: {
             investigate: sources.filter((source) => source.alignment === 'investigate' || source.alignment === 'unexpected_observation').length,
@@ -94,6 +181,7 @@ function buildRegistryDoctorReport(raw, generatedAt = new Date().toISOString())
             'This diagnostic compares one saved observation with the local reviewed capability catalogue and makes no registry, registrar, RDAP, or WHOIS request.',
             'A catalogue alignment does not prove live reachability, parser completeness, current registry policy, registration, availability, ownership, safety, or maliciousness.',
             'A missing registry object identifier can be a publication characteristic. It remains not observed and is not converted into a collection failure.',
+            'Publication-quality observations describe the saved normalised RDAP object. The saved Lookup format does not retain the response media type, so that field remains unavailable.',
             'Use fixture-based maintenance checks before changing a registry parser or access profile; automated tests must not contact live registries.',
         ],
     };
@@ -112,6 +200,13 @@ function formatRegistryDoctorReport(report) {
         output.push(`  Observed: ${source.observed.replaceAll('_', ' ')}`);
         output.push(`  Object identifier: ${source.objectIdentifier.replaceAll('_', ' ')}`);
     }
+    output.push('', 'RDAP publication quality');
+    output.push(`  Object class: ${report.publication.objectClass.state.replaceAll('_', ' ')}`);
+    output.push(`  Object identifier: ${report.publication.objectIdentifier.state.replaceAll('_', ' ')}`);
+    output.push(`  Base conformance: ${report.publication.baseConformance.state.replaceAll('_', ' ')}`);
+    output.push(`  Self link: ${report.publication.selfLink.state.replaceAll('_', ' ')}`);
+    output.push(`  Events: ${report.publication.events.state.replaceAll('_', ' ')}`);
+    output.push('  Media type: unavailable in the saved Lookup contract');
     if (report.recommendations.length) {
         output.push('', 'Recommendations:');
         for (const item of report.recommendations)

package/cli/registry-fixture-scaffold.mjs

@@ -0,0 +1,74 @@
+import { registryCompatibilityMatrix } from "../lib/registry-capabilities.mjs";
+const SAFE_ID_RE = /^[a-z0-9](?:[a-z0-9-]{0,126}[a-z0-9])?$/u;
+const SAFE_SUFFIX_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
+const SCENARIOS = new Set(['registered', 'not_found', 'inconclusive']);
+export function buildRegistryFixtureScaffold(profileIdInput, suffixInput, scenarioInput) {
+    const profileId = typeof profileIdInput === 'string' ? profileIdInput.toLowerCase() : '';
+    const suffix = typeof suffixInput === 'string' ? suffixInput.toLowerCase().replace(/^\./u, '') : '';
+    const scenario = typeof scenarioInput === 'string' ? scenarioInput.toLowerCase() : '';
+    if (!SAFE_ID_RE.test(profileId))
+        throw new TypeError('The capability profile is invalid.');
+    if (!SAFE_SUFFIX_RE.test(suffix))
+        throw new TypeError('The suffix is invalid.');
+    if (!SCENARIOS.has(scenario))
+        throw new TypeError('Scenario must be registered, not_found, or inconclusive.');
+    const matchingProfiles = registryCompatibilityMatrix().filter((item) => item.id === profileId);
+    if (!matchingProfiles.length)
+        throw new TypeError('The capability profile is not present in the registry catalogue.');
+    const profile = matchingProfiles.find((item) => item.suffixes.includes(suffix));
+    if (!profile)
+        throw new TypeError(`The capability profile does not cover .${suffix}.`);
+    const domain = `EXAMPLE.${suffix.toUpperCase()}`;
+    const response = scenario === 'registered'
+        ? [
+            `Domain Name: ${domain}`,
+            'Registry Domain ID: EXAMPLE-SYNTHETIC-ID',
+            'Registrar: Example Registrar',
+            'Creation Date: 2020-01-02T03:04:05Z',
+            'Updated Date: 2024-05-06T07:08:09Z',
+            'Registry Expiry Date: 2030-01-02T03:04:05Z',
+            'Domain Status: active',
+            'Registrant Organization: Example Organisation',
+            'Registrant Email: registrant@example.invalid',
+            'Name Server: NS1.EXAMPLE.INVALID',
+            'DNSSEC: unsigned',
+        ]
+        : scenario === 'not_found'
+            ? ['REPLACE WITH A SYNTHETIC AUTHORITATIVE NO-RECORD DIALECT']
+            : ['REPLACE WITH A SYNTHETIC RESTRICTED, RATE-LIMITED, OR TEMPORARY-FAILURE DIALECT'];
+    const expected = scenario === 'registered'
+        ? {
+            registrationStatus: 'registered',
+            domainName: domain,
+            registrar: 'Example Registrar',
+            registrantOrg: 'Example Organisation',
+            registrantEmail: 'registrant@example.invalid',
+            nameservers: ['NS1.EXAMPLE.INVALID'],
+        }
+        : scenario === 'not_found'
+            ? { registrationStatus: 'not_found', notFound: true }
+            : { registrationStatus: 'inconclusive', notFound: false };
+    return [
+        '// Synthetic scaffold only. Do not paste a live WHOIS response or personal registration data.',
+        '// Preserve the registry dialect while replacing domains, contacts, handles, addresses, phones,',
+        '// nameservers, dates, identifiers, and free text with reserved or fictional values.',
+        '{',
+        `  name: ${JSON.stringify(`.${suffix} ${scenario} synthetic response`)},`,
+        `  capabilityProfile: ${JSON.stringify(profileId)},`,
+        `  scenario: ${JSON.stringify(scenario)},`,
+        '  chain: [',
+        `    rootHop(${JSON.stringify(suffix.toUpperCase())}, ${JSON.stringify(`whois.${suffix}.invalid`)}),`,
+        `    registryHop(${JSON.stringify(`whois.${suffix}.invalid`)}, ${JSON.stringify(response, null, 2).replace(/\n/gu, '\n    ')}),`,
+        '  ],',
+        `  expected: ${JSON.stringify(expected, null, 2).replace(/\n/gu, '\n  ')},`,
+        '},',
+        '',
+        '// Review checklist:',
+        '// - every domain and hostname uses the requested suffix or .invalid;',
+        '// - every email ends in .invalid; IP examples use documentation ranges;',
+        '// - no real name, address, phone, handle, identifier, or free-text notice remains;',
+        '// - authoritative absence is asserted only for a documented registry response;',
+        '// - add or refresh the tracked provenance digest after review.',
+        '',
+    ].join('\n');
+}