@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/docs/cli.md

@@ -1,16 +1,18 @@
 # WHOISleuth CLI guide
 
-The first-party CLI runs locally and uses the same bounded classification,
-collection, and analysis modules as the web application. It does not call the
-hosted WHOISleuth deployment. Use this guide for installation, first commands,
-collection boundaries, output, and automation behaviour. The
-[complete CLI reference](cli-reference.md) documents every command family and
-artefact contract.
+The first-party CLI runs on the operator's machine and does not call the hosted
+WHOISleuth deployment. Use this guide for installation, common commands,
+collection boundaries and output. Installed `whoisleuth --help`, focused
+`--help` and `whoisleuth commands` output are the authority for that installed
+version. The [CLI reference](cli-reference.md) covers durable command and
+artefact contracts.
+
+The generated [privacy and data-flow catalogue](https://github.com/slicedearth/whoisleuth/blob/main/docs/privacy-data-flow-catalogue.md)
+lists the network, recipient, retention and export boundary for every command.
 
 ## Installation
 
-Public releases require Node.js 24 or later and install the `whoisleuth`
-command:
+Public releases require Node.js 24 or later:
 
 ```bash
 npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli -- whoisleuth --help
@@ -26,277 +28,126 @@ whoisleuth --version
 whoisleuth doctor
 ```
 
-The scoped package and application share one semantic version. The package
-includes `LICENSE`, `NOTICE`, `TRADEMARKS.md`, this guide, and the complete
-reference. It requires no lifecycle scripts, so the examples disable them.
-An unqualified `npx whoisleuth` is not this project.
-
-From a repository checkout, replace `whoisleuth` with
-`node bin/whoisleuth.mts`. Maintainers can assemble, install, and smoke-test the
-exact compiled package closure without publishing it:
-
-```bash
-npm run cli:package:check
-```
+The package and application share one semantic version. The package requires no
+dependency lifecycle scripts. From a repository checkout, replace `whoisleuth`
+with `node bin/whoisleuth.mts`; maintainers can verify the exact package closure
+with `npm run cli:package:check`.
 
 ## First commands
 
-Inspect the installed capabilities before collection:
+Inspect the installed command set and plan one Lookup before collecting:
 
 ```bash
 whoisleuth --help
-whoisleuth commands
+whoisleuth commands --common
 whoisleuth doctor
-whoisleuth lookup example.com --plan --json
+whoisleuth lookup example.test --plan --json
 ```
 
-Run a fast lookup or deliberately request the deeper profile:
+Run Fast or Deep Lookup:
 
 ```bash
-whoisleuth lookup example.com
-whoisleuth lookup example.com --deep
-whoisleuth lookup example.com --deep --summary
-whoisleuth lookup example.com --deep --markdown --output lookup.md
+whoisleuth example.test
+whoisleuth lookup example.test --deep
+whoisleuth lookup example.test --deep --summary
+whoisleuth lookup example.test --deep --browse
+whoisleuth lookup example.test --deep --markdown --output lookup.md
 ```
 
-Process an explicit bounded list, generate lookalike candidates, or inspect a
-saved result without sending it anywhere:
+Process selected local input:
 
 ```bash
 whoisleuth bulk domains.txt --csv
-whoisleuth discover example.com --preset common --jsonl
-whoisleuth verify-artifact lookup.json --json
+whoisleuth discover example.test --preset common --jsonl
+whoisleuth verify-artifact lookup.json --json --strict-exit
 whoisleuth compare lookup.json --json
 whoisleuth brief lookup.json
-whoisleuth registry-doctor lookup.json --json
 ```
 
-Only one query is accepted by `lookup`; multi-input processing belongs to
-`bulk`. Standard input to `lookup` is capped at 4 KiB and must contain one
-non-empty line.
-
-## Collection profiles
-
-Commands are classified as either networked or offline in focused help, the
-generated manual, and `commands --json`.
-
-| Profile | Boundary |
-| --- | --- |
-| Fast Lookup | Conservative default for domain triage. It does not run WHOIS or deep website and TLS collection. |
-| Deep Lookup | Explicitly requested bounded RDAP, WHOIS, DNS, website, TLS, registrar-RDAP, and observed-network work where applicable. |
-| Compact deep Bulk | Uses the shared Lookup orchestration but omits full-only response fields and collectors. |
-| Offline review | Reads only the named bounded artefact or analyst-authored input and makes no network request. |
-
-Networked commands run from the local machine and contact the sources declared
-by their profile. They do not use the hosted login or hosted usage controls;
-upstream services can see and rate-limit the local network address. The CLI
-does not implicitly enable the browser Console's optional external intelligence
-actions.
-
-`lookup --plan` performs classification and emits a versioned preflight without
-starting collection. It lists planned source families and disclosure targets,
-but cannot predict cache state, live configuration, redirects, referrals,
-source availability, or exact request count.
+One strict domain, IP address or ASN can occupy command position as Lookup
+shorthand. URL-like or ambiguous input requires the explicit `lookup` command.
+Only `bulk` accepts multiple targets.
 
-`doctor` is offline by default. `doctor --network` adds three independent,
-bounded checks against fixed diagnostic infrastructure and retains only state,
-HTTP status, and a bounded explanation.
+## Command groups
 
-## Command map
+The installed registry groups commands under the same analyst vocabulary as the
+application:
 
-| Goal | Commands |
+| Group | Common commands |
 | --- | --- |
-| Investigate a target | `lookup`, `http`, `tls`, `posture`, `registry-support` |
-| Review many targets | `bulk`, `discover`, `discover-scan`, `ct-search`, `ct-intake` |
-| Compare saved evidence | `compare`, `page-compare`, `diff`, `reconcile`, `timeline`, `mail-review` |
-| Review supplied evidence | `brief`, `review-evidence`, `registry-doctor`, `registry-cohort`, `source-report`, `sharing-review`, `map-observations` |
-| Plan and assure changes | `domain-control`, `monitor-once`, `assurance`, `change-packet`, `workflow-plan`, `workflow-run` |
-| Verify and package evidence | `case-pack`, `manifest`, `oam-export`, `verify-artifact`, `inspect-archive`, `sign-artifact`, `verify-signature`, `export` |
-| Calibrate offline | `risk-calibrate`, `lookalike-calibrate` |
-| Operate the CLI | `doctor`, `registry-scaffold`, `commands`, `completion`, `manual` |
+| Investigate | `lookup`, `bulk`, `discover`, `ct-search`, `posture`, `http`, `tls`, `compare`, `brief` |
+| Respond | `case-pack`, `change-packet`, `sharing-review`, `export` |
+| Assure | `dnssec-validate`, `mail-transport`, `domain-control`, `assurance`, `workflow-plan`, `diff`, `inspect-archive`, `verify-artifact` |
+| Utilities | `doctor`, `commands`, `completion`, `manual`, `registry-scaffold` |
 
-Use focused help for the exact arguments and collection ceiling:
+Filter the canonical index without running the selected commands:
 
 ```bash
-whoisleuth lookup --help
-whoisleuth sharing-review --help
+whoisleuth commands --group investigate
+whoisleuth commands --group respond --mode offline
 whoisleuth commands --json
 whoisleuth manual | man -l -
 ```
 
-## Output and automation
-
-Human-readable terminal output is the default. Interactive terminals use
-restrained semantic colour and transient progress on stderr. Redirected output,
-JSON, and JSONL contain no ANSI sequences or progress text. State remains
-explicit in text, so colour is never the only distinction.
-
-- `--json` and `--jsonl` provide bounded machine-readable documents.
-- `--summary` and `--verbose` change human detail without changing collection.
-- `--no-color` or `NO_COLOR` disables colour.
-- `WHOISLEUTH_NO_PROGRESS=1` disables the transient progress indicator.
-- `--events` keeps the final document on stdout and writes versioned JSONL
-  lifecycle events to stderr.
-- `--strict-exit` treats failures in explicitly requested source families as a
-  partial failure while keeping skipped or unsupported sources neutral.
-- `--fail-on` applies explicit `source-failure`, `inconclusive`, `danger`, or
-  `material-drift` automation policy where the selected command supports it.
-- `--junit` emits bounded CI test cases for Lookup, Bulk, and one-shot control
-  reviews; owned-domain Posture can emit `--sarif` only with
-  `--owned-domain`.
-
-`--config <file> --profile <name>` applies a strict version-1 local profile.
-The default path is `$XDG_CONFIG_HOME/whoisleuth/config.json`. Profiles can set
-only presentation mode, Fast collection, bounded concurrency, and observer or
-vantage labels. They cannot add targets, enable Deep collection, select output
-paths, approve network work, or set failure policy. Explicit command options
-override defaults from the same option group.
-
-Every command accepts `--output <file>`. WHOISleuth buffers bounded output,
-creates a private temporary file beside the destination, syncs it, and publishes
-it atomically with mode `0600`. Existing destinations are refused unless
-`--force` is deliberately combined with `--output`. Failed or cancelled
-commands do not publish partial files. Output is capped at 32 MiB.
-
-## Exit codes
-
-| Code | Meaning |
-| ---: | --- |
-| 0 | Command completed. Individual sources can still be partial or inconclusive; inspect diagnostics. |
-| 2 | Invalid command, option, input, or stdin shape. |
-| 3 | The requested lookup, collection, or comparison could not run. |
-| 4 | A bounded operation completed partially. |
-| 70 | Unexpected CLI bootstrap failure. |
-| 130 | The analyst cancelled the command; no partial final result was emitted. |
-| 143 | The process received SIGTERM; no partial final result was emitted. |
-
-## Detailed command reference
-
-The headings below preserve the established guide anchors while moving their
-full contracts into the packaged reference.
-
-### Registry capability coverage
-
-[Read the complete registry capability reference.](cli-reference.md#registry-capability-coverage)
-
-### Offline Risk calibration
-
-[Read the calibration dataset and replay contract.](cli-reference.md#offline-risk-calibration)
-
-### Lookalike review-yield calibration
-
-[Read the reviewed candidate calibration contract.](cli-reference.md#lookalike-review-yield-calibration)
-
-### Offline artefact verification
-
-[Read the archive, saved Lookup, and signed-artefact verification contract.](cli-reference.md#offline-artefact-verification)
-
-### Privacy-safe source reliability report
-
-[Read the target-free source diagnostic contract.](cli-reference.md#privacy-safe-source-reliability-report)
-
-### Workspace archive inspection
-
-[Read the redacted archive summary, stable content-digest, transfer-check, and
-search contract.](cli-reference.md#workspace-archive-inspection)
-
-### Optional evidence-package signing
-
-[Read the local signing and verification contract.](cli-reference.md#optional-evidence-package-signing)
-
-### Reproducible investigation manifest
-
-[Read the ordered, path-free artefact digest contract.](cli-reference.md#reproducible-investigation-manifest)
+`registry-scaffold` has a separate fixture bootstrap contract: its `--profile`
+selects one fixed fixture profile and it rejects shared `--config` profiles.
+It creates sanitised local fixtures and does not contact a registry.
 
-### Bulk lookup
+## Collection boundaries
 
-[Read Bulk bounds, filters, formats, checkpoints, and cancellation behaviour.](cli-reference.md#bulk-lookup)
-
-### Certificate Transparency search
-
-[Read the CT query and source-limit contract.](cli-reference.md#certificate-transparency-search)
-
-### Local certificate event intake
-
-[Read the offline, source-qualified event import contract.](cli-reference.md#local-certificate-event-intake)
-
-### Declarative observation interchange
-
-[Read the bounded field-mapping and Open Asset Model bridge contracts.](cli-reference.md#declarative-observation-interchange)
-
-### Lookalike discovery
-
-[Read candidate generation, dictionaries, snapshots, and output behaviour.](cli-reference.md#lookalike-discovery)
-
-### Supervised candidate scan
-
-[Read the bounded candidate collection workflow.](cli-reference.md#supervised-candidate-scan)
-
-### Domain posture audit
-
-[Read the DNS, mail, and certificate posture contract.](cli-reference.md#domain-posture-audit)
-
-### HTTP intelligence
-
-[Read the bounded HTTP collection contract.](cli-reference.md#http-intelligence)
-
-### TLS intelligence
-
-[Read the bounded TLS collection contract.](cli-reference.md#tls-intelligence)
-
-### Registry-source comparison
-
-[Read the normalised RDAP and WHOIS comparison contract.](cli-reference.md#registry-source-comparison)
-
-### Static page comparison
-
-[Read saved page-identity comparison behaviour.](cli-reference.md#static-page-comparison)
-
-### Passive mail exposure review
-
-[Read the saved-evidence mail review contract.](cli-reference.md#passive-mail-exposure-review)
-
-### Offline supplied-evidence review
-
-[Read the DNSSEC, DANE, zone-intent, portfolio, domain-change, and supplied-observation review contract.](cli-reference.md#offline-supplied-evidence-review)
-
-### Domain control manifests
-
-[Read desired-state manifest and drift-review behaviour.](cli-reference.md#domain-control-manifests)
-
-### Domain assurance review
-
-[Read planned-change, recovery-dependency, and retirement contracts.](cli-reference.md#domain-assurance-review)
-
-### Domain change assurance packet
-
-[Read the bounded pre-change, post-change, planning, and integrity contract.](cli-reference.md#domain-change-assurance-packet)
-
-### Pre-sharing review
+| Mode | Behaviour |
+| --- | --- |
+| Fast Lookup | Registration-first triage without WHOIS or deeper website and TLS collection. |
+| Deep Lookup | Explicit RDAP, WHOIS, DNS, website, TLS, registrar-RDAP and observed-network collection where applicable. |
+| Compact Deep Bulk | Comparison fields from shared Lookup orchestration, omitting full-only collectors and response fields. |
+| Offline | Reads only the named local artefact, stdin or built-in catalogue. |
+| Authorised active | Requires its dedicated command and per-run owned-or-authorised acknowledgement. |
 
-[Read the local marking, scope, redaction, and integrity preflight.](cli-reference.md#pre-sharing-review)
+Networked commands run from the local machine and contact the sources named in
+their focused help. They do not use the hosted login or hosted usage controls.
+`lookup --plan` lists planned source families and disclosure targets before
+collection. `doctor` is offline unless `--network` is selected.
 
-### Fixed investigation plans
+## Output and automation
 
-[Read the plan-only recipe contract and approval gates.](cli-reference.md#fixed-investigation-plans)
+Terminal text is the default. Commands expose JSON, JSONL, CSV, Markdown, HTML
+or domain-only output only where declared by the installed registry. Redirected
+and machine output contains no ANSI or transient progress text.
 
-### Local handoffs and one-shot monitoring
+- `--summary` and `--verbose` change presentation, not collection.
+- `lookup --browse` provides an interactive terminal view; press `?` for keys.
+- `--events` writes versioned lifecycle events to stderr.
+- `--strict-exit` and `--fail-on` expose selected evidence states to automation.
+- `--output` writes a private local file atomically and refuses an existing path
+  unless `--force` is also selected.
 
-[Read brief, case-package, fixed-recipe execution, and one-shot control-review contracts.](cli-reference.md#local-handoffs-and-one-shot-monitoring)
+Local configuration profiles can set presentation, Fast collection, bounded
+concurrency and observer labels. They cannot add targets, enable Deep
+collection, choose output paths or approve network work. Explicit command
+options override profile defaults.
 
-### Optional local rendered capture
+## Exit codes
 
-[Read the separate Playwright capture package boundary.](cli-reference.md#optional-local-rendered-capture)
+| Code | Meaning |
+| ---: | --- |
+| 0 | The command completed. |
+| 2 | Invalid command, option or input. |
+| 3 | Collection, lookup or comparison failed. |
+| 4 | The result was partial or a selected evidence policy was not met. |
+| 70 | Internal CLI bootstrap failure. |
+| 130 | The analyst cancelled the command. |
+| 143 | The process received SIGTERM. |
 
-### Lookup evidence export
+## Command details
 
-[Read normalised JSON, Markdown, and HTML export behaviour.](cli-reference.md#lookup-evidence-export)
+Run `whoisleuth <command> --help` for exact arguments, input ceilings, network
+effects and output formats. The packaged [CLI reference](cli-reference.md) gives
+the longer-lived compatibility and evidence contracts, while the generated
+[online command reference](https://whoisleuth.com/cli#commands) provides a searchable index.
 
 ## Safety and limitations
 
 WHOISleuth is a defensive investigation tool, not an authorisation mechanism.
-Operators remain responsible for applicable law, registry and provider terms,
-and permission to assess a target. Missing, unsupported, partial, or failed
-evidence never establishes absence, availability, safety, ownership, or intent.
-Offline analyst assertions remain separately attributed and are not converted
-into observed facts.
+Operators remain responsible for permission, applicable law and provider terms.
+Incomplete evidence remains explicitly qualified, and analyst assertions remain
+separate from observed facts.

package/frontend/src/lib/analysis/domain-control-manifest-core.js

@@ -0,0 +1,3 @@
+// Historical browser-safe import facade. The pure domain-control manifest
+// contract is shared by browser, CLI, and Node adapters.
+export { DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_PASSPORT_INPUT_SCHEMA, DOMAIN_CONTROL_PASSPORT_LIMITATIONS, DOMAIN_CONTROL_PASSPORT_SCHEMA, DOMAIN_CONTROL_PASSPORT_VERSION, MAX_DOMAIN_CONTROL_MANIFEST_BYTES, MAX_DOMAIN_CONTROL_PASSPORT_BYTES, MAX_DOMAIN_CONTROL_PASSPORT_ENTRIES, assertDomainControlPassportByteBudget, buildUnsignedDomainControlPassport, domainControlPassportSerialisedBytes, normalizeDomainControlPassportDocument, } from "../../../../packages/evidence/domain-control-runtime.mjs";

package/frontend/src/lib/analysis/domain-control-records.js

@@ -0,0 +1,3 @@
+// Historical browser-safe import facade. Domain-control record normalisation
+// is owned by the pure evidence package and shared unchanged across runtimes.
+export { MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, canonicalCaaRecord, canonicalDomainControlRecordList, canonicalDsRecord, canonicalMxRecord, } from "../../../../packages/evidence/domain-control-runtime.mjs";

package/lib/application-version.mjs

@@ -0,0 +1,3 @@
+import packageDocument from '../package.json' with { type: 'json' };
+import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
+export const WHOISLEUTH_APPLICATION_VERSION = normalizeBoundedSemanticVersion(packageDocument.version, 'Application manifest');

package/lib/availability.mjs

@@ -32,10 +32,24 @@ function errorRecord(value) {
         ? value
         : {};
 }
+function registryStatusToken(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]+/gu, '');
+}
 function rdapEventDate(events, action) {
     const date = events.find((event) => event.action === action)?.date;
     return typeof date === 'string' ? date : null;
 }
+function withoutHttpDeliveryMetadata(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const output = { ...value };
+    if (output.response && typeof output.response === 'object' && !Array.isArray(output.response)) {
+        const response = { ...output.response };
+        delete response.deliveryMetadata;
+        output.response = response;
+    }
+    return output;
+}
 // No marketplace (Afternic/Sedo/Dan.com/GoDaddy Auctions/etc.) offers a
 // free, no-auth API to check "is this specific domain listed for sale" -
 // what's checkable without credentials is the parking/landing-page
@@ -115,18 +129,17 @@ const PRIVACY_MARKERS = [
     /not disclosed/i,
     /withheld for privacy/i,
 ];
-// Only ever called after a lookup has already succeeded (this runs inside
-// checkDomainAvailability once RDAP or WHOIS has returned real data), so a
-// missing/empty registrant here isn't "we don't know" - it means the
-// registry gave us a response with no usable contact in it, which for
-// sourcing purposes (can I reach this owner from this data alone?) is the
-// same practical answer as an explicit privacy-proxy service: no.
+// Explicit privacy/redaction markers establish a positive privacy signal.
+// Usable public contact data establishes a negative one. A missing or blank
+// contact can instead reflect registry policy, access tier, parser coverage,
+// or ordinary omission, so it remains inconclusive rather than being promoted
+// to an affirmative privacy claim.
 function isPrivacyProtected(registrant) {
     if (!registrant)
-        return true;
+        return null;
     const blob = [registrant.name, registrant.org, registrant.email].filter(Boolean).join(' ');
     if (!blob)
-        return true; // record exists but every contact field is blank - that's redaction
+        return null;
     return PRIVACY_MARKERS.some((re) => re.test(blob));
 }
 // RDAP Lookup retains a bounded multi-value contact inventory, but Bulk and
@@ -197,7 +210,10 @@ async function checkDnsDelegation(domain, { resolver = dns.resolveNs } = {}) {
 // domain has "no site": transient DNS/TLS/network failures, a slow origin, or
 // an HTTP error can all produce the same null body. Keeping that distinction
 // avoids turning an inconclusive probe into a false inactivity claim.
-async function fetchHomepage(domain, { fetcher = safeFetchDetailed } = {}) {
+async function fetchHomepage(domain, { fetcher = safeFetchDetailed, timeoutMs = HOMEPAGE_FETCH_TIMEOUT_MS } = {}) {
+    const requestTimeoutMs = Number.isInteger(timeoutMs) && timeoutMs >= 10 && timeoutMs <= HOMEPAGE_FETCH_TIMEOUT_MS
+        ? timeoutMs
+        : HOMEPAGE_FETCH_TIMEOUT_MS;
     const headers = whoisleuthRequestHeaders();
     const failures = [];
     const probeStartedAt = Date.now();
@@ -205,7 +221,7 @@ async function fetchHomepage(domain, { fetcher = safeFetchDetailed } = {}) {
         const requestUrl = `${scheme}://${domain}`;
         const attemptStartedAt = Date.now();
         const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), HOMEPAGE_FETCH_TIMEOUT_MS);
+        const timeout = setTimeout(() => controller.abort(), requestTimeoutMs);
         try {
             const fetched = await fetcher(requestUrl, { signal: controller.signal, headers });
             const fetchedResponse = fetched instanceof Response ? fetched : fetched.response;
@@ -274,7 +290,7 @@ async function fetchHomepage(domain, { fetcher = safeFetchDetailed } = {}) {
         catch (err) {
             const error = errorRecord(err);
             const reason = error.name === 'AbortError'
-                ? 'timed out after 6 seconds'
+                ? `timed out after ${requestTimeoutMs} milliseconds`
                 : nonEmptyErrorMessage(err, 'request failed')
                     .replace(/[\u0000-\u001f\u007f]+/g, ' ')
                     .slice(0, 180);
@@ -446,40 +462,39 @@ async function checkDomainAvailability(domain, options = {}) {
                     source: 'whois',
                 };
             }
-            if (parsed.nameservers.length)
-                nameservers = parsed.nameservers;
-            if (parsed.statuses.length)
-                statuses = parsed.statuses.map((status) => status.toLowerCase());
-            if (parsed.registrar) {
-                registrar = {
-                    handle: null,
-                    ianaId: parsed.registrarIanaId || null,
-                    name: parsed.registrar,
-                    org: null,
-                    email: parsed.abuseEmail || null,
-                    phone: parsed.abusePhone || null,
-                };
-            }
-            if (parsed.registrantName || parsed.registrantOrg || parsed.registrantEmail || parsed.registrantPhone) {
-                registrant = {
-                    handle: null,
-                    name: parsed.registrantName || null,
-                    org: parsed.registrantOrg || null,
-                    email: parsed.registrantEmail || null,
-                    phone: parsed.registrantPhone || null,
-                };
-            }
-            if (parsed.abuseEmail || parsed.abusePhone) {
-                abuse = { handle: null, name: null, org: parsed.registrar || null, email: parsed.abuseEmail || null, phone: parsed.abusePhone || null };
-            }
-            createdDate = parsed.createdDate || null;
-            expiryDate = parsed.expiryDate || null;
-            createdDateIso = parsed.createdDateIso || parsed.lifecycle?.createdDateIso || registryDateIso(createdDate);
-            expiryDateIso = parsed.expiryDateIso || parsed.lifecycle?.expiryDateIso || registryDateIso(expiryDate);
-            if (!dnssec)
-                dnssec = parsed.dnssec || null;
-            if (parsed.registrationStatus === 'registered'
-                || registrar || createdDate || expiryDate || nameservers.length > 0 || statuses.length > 0) {
+            if (parsed.registrationStatus === 'registered') {
+                if (parsed.nameservers.length)
+                    nameservers = parsed.nameservers;
+                if (parsed.statuses.length)
+                    statuses = parsed.statuses.map((status) => status.toLowerCase());
+                if (parsed.registrar) {
+                    registrar = {
+                        handle: null,
+                        ianaId: parsed.registrarIanaId || null,
+                        name: parsed.registrar,
+                        org: null,
+                        email: parsed.abuseEmail || null,
+                        phone: parsed.abusePhone || null,
+                    };
+                }
+                if (parsed.registrantName || parsed.registrantOrg || parsed.registrantEmail || parsed.registrantPhone) {
+                    registrant = {
+                        handle: null,
+                        name: parsed.registrantName || null,
+                        org: parsed.registrantOrg || null,
+                        email: parsed.registrantEmail || null,
+                        phone: parsed.registrantPhone || null,
+                    };
+                }
+                if (parsed.abuseEmail || parsed.abusePhone) {
+                    abuse = { handle: null, name: null, org: parsed.registrar || null, email: parsed.abuseEmail || null, phone: parsed.abusePhone || null };
+                }
+                createdDate = parsed.createdDate || null;
+                expiryDate = parsed.expiryDate || null;
+                createdDateIso = parsed.createdDateIso || parsed.lifecycle?.createdDateIso || registryDateIso(createdDate);
+                expiryDateIso = parsed.expiryDateIso || parsed.lifecycle?.expiryDateIso || registryDateIso(expiryDate);
+                if (!dnssec)
+                    dnssec = parsed.dnssec || null;
                 registrationSource = 'whois';
             }
         }
@@ -491,9 +506,7 @@ async function checkDomainAvailability(domain, options = {}) {
     // registration evidence either - e.g. the registry answered inconclusively
     // or every referral hop failed/rate-limited. Report "unknown" rather than
     // fabricating "registered" from an empty record.
-    const hasWhoisRegistrationData = whoisParsed?.registrationStatus === 'registered'
-        || Boolean(registrar) || Boolean(createdDate) || Boolean(expiryDate)
-        || nameservers.length > 0 || statuses.length > 0;
+    const hasWhoisRegistrationData = whoisParsed?.registrationStatus === 'registered';
     let dnsDelegated = false;
     if (!rdapFound && !hasWhoisRegistrationData && dnsDelegationPromise) {
         const delegation = await dnsDelegationPromise;
@@ -547,7 +560,10 @@ async function checkDomainAvailability(domain, options = {}) {
         dnssec,
         source: registrationSource,
     };
-    if (statuses.some((s) => s.includes('pendingdelete') || s.includes('redemptionperiod'))) {
+    if (statuses.some((status) => {
+        const normalizedStatus = registryStatusToken(status);
+        return normalizedStatus.includes('pendingdelete') || normalizedStatus.includes('redemptionperiod');
+    })) {
         return {
             state: 'expiring',
             confidence: 'medium',
@@ -646,6 +662,7 @@ async function checkDomainAvailability(domain, options = {}) {
                 responseHeaders: homepage.technologyHeaders,
                 activityStatus,
                 includePageIdentity: pageIdentityEligible,
+                includePublicationMetadata: options.includePublicationMetadata !== false,
                 ...(options.includeCredentialSurfaceProfile !== undefined
                     ? { includeCredentialSurfaceProfile: options.includeCredentialSurfaceProfile }
                     : {}),
@@ -659,6 +676,9 @@ async function checkDomainAvailability(domain, options = {}) {
         }
     }
     const responsePolicy = qualifyResponsePolicyWithCspMeta(homepage.responsePolicy, htmlSignals.cspMetaPolicy);
+    const retainedHttp = options.includeDeliveryMetadata === false
+        ? withoutHttpDeliveryMetadata(homepage.http)
+        : homepage.http;
     const { cspMetaPolicy: _cspMetaPolicy, ...retainedHtmlSignals } = htmlSignals;
     const securityPosture = options.includeSecurityPosture === false ? null : analyzeWebsiteSecurityPosture({
         http: homepage.http,
@@ -692,7 +712,7 @@ async function checkDomainAvailability(domain, options = {}) {
             activityStatus,
             websiteProbeStatus,
             websiteProbeDetail,
-            http: homepage.http,
+            http: retainedHttp,
             deepScanComplete,
             faviconHash,
             faviconPHash,
@@ -716,7 +736,7 @@ async function checkDomainAvailability(domain, options = {}) {
         activityStatus,
         websiteProbeStatus,
         websiteProbeDetail,
-        http: homepage.http,
+        http: retainedHttp,
         deepScanComplete,
         faviconHash,
         faviconPHash,
@@ -733,4 +753,4 @@ async function checkDomainAvailability(domain, options = {}) {
         hasDmarc: dnsIntelligence.hasDmarc,
     };
 }
-export { checkDomainAvailability, checkDnsDelegation, fetchHomepage, deriveWebsiteActivity, forSaleRedirectSignal, parseRegistryDate as parseWhoisDate, };
+export { checkDomainAvailability, checkDnsDelegation, fetchHomepage, isPrivacyProtected, deriveWebsiteActivity, forSaleRedirectSignal, parseRegistryDate as parseWhoisDate, };

package/lib/bounded-contract-normalizers.mjs

@@ -2,6 +2,7 @@
 // not infer missing values and keep every string, object, enum, and counter
 // bounded before a provider or connector result reaches its public model.
 import { domainToASCII } from 'node:url';
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 export function isRecord(value) {
     return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
@@ -26,10 +27,7 @@ export function strictBoundedString(value, maxLength) {
     return normalized && normalized.length <= maxLength ? normalized : null;
 }
 export function isoTimestamp(value) {
-    if (typeof value !== 'string' || value.length > 64 || /[\u0000-\u001f\u007f]/u.test(value))
-        return null;
-    const timestamp = Date.parse(value);
-    return Number.isFinite(timestamp) ? new Date(timestamp).toISOString() : null;
+    return normalizeExplicitIsoTimestamp(value);
 }
 export function boundedHttpsUrl(value, maxLength) {
     const raw = strictBoundedString(value, maxLength);