@slicedearth/whoisleuth-cli 2.0.0 → 2.1.0

package/lib/registrar-standing-contract.mjs

@@ -0,0 +1,300 @@
+// Browser-safe contract for the registrar accreditation and compliance context
+// attached to a Lookup response. The source catalogue and maintenance tooling
+// remain server-side; this module validates only the small, attributed
+// projection that crosses the HTTP and evidence-export boundaries.
+import { isJsonObject, validBoundedString, } from "./lookup-contract-primitives.mjs";
+import { ICANN_COMPLIANCE_SOURCE_URL, IANA_REGISTRAR_SOURCE_URL, registrarStandingOfficialSourceUrl, } from "./registrar-standing-catalogue-contract.mjs";
+import { defineSchemaCompatibility } from "../packages/contracts/schema-compatibility.mjs";
+export const REGISTRAR_STANDING_SCHEMA = 'whoisleuth.registrar-standing';
+export const REGISTRAR_STANDING_VERSION = 1;
+export const MAX_REGISTRAR_STANDING_BYTES = 32 * 1024;
+export const MAX_REGISTRAR_COMPLIANCE_ACTIONS = 5;
+export const MAX_REGISTRAR_STANDING_LIMITATIONS = 4;
+export const MAX_REGISTRAR_STANDING_NEXT_ACTIONS = 4;
+export const MAX_REGISTRAR_STANDING_TEXT_LENGTH = 360;
+export const REGISTRAR_STANDING_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'derived.registrar-standing',
+    kind: 'derived',
+    schema: REGISTRAR_STANDING_SCHEMA,
+    currentVersion: REGISTRAR_STANDING_VERSION,
+    supportedVersions: [REGISTRAR_STANDING_VERSION],
+    acceptsUnversionedLegacy: false,
+    futureVersionBehavior: 'reject',
+    migration: 'exact_current_only',
+    writeSemantics: 'read_only',
+    byteBudget: MAX_REGISTRAR_STANDING_BYTES,
+    owner: 'lib/registrar-standing-contract.mts',
+    note: 'Bounded zero-request projection keeping official registrar accreditation, compliance actions, source health and limitations separately attributed.',
+});
+export const REGISTRAR_ACCREDITATION_STATES = Object.freeze([
+    'accredited',
+    'terminated',
+    'reserved',
+    'unknown',
+]);
+export const REGISTRAR_COMPLIANCE_ACTION_TYPES = Object.freeze([
+    'breach',
+    'suspension',
+    'termination',
+    'non_renewal',
+]);
+export const REGISTRAR_COMPLIANCE_STATES = Object.freeze([
+    'matching_actions',
+    'reviewed_no_match',
+    'stale',
+    'unavailable',
+    'not_applicable',
+]);
+export const REGISTRAR_STANDING_ASSESSMENT_STATES = Object.freeze([
+    'accredited',
+    'notice_present',
+    'terminated',
+    'reserved',
+    'unknown',
+]);
+export const REGISTRAR_STANDING_SOURCE_HEALTH_STATES = Object.freeze([
+    'current',
+    'stale',
+    'unavailable',
+]);
+const ACCREDITATION_STATES = new Set(REGISTRAR_ACCREDITATION_STATES);
+const COMPLIANCE_ACTION_TYPES = new Set(REGISTRAR_COMPLIANCE_ACTION_TYPES);
+const COMPLIANCE_STATES = new Set(REGISTRAR_COMPLIANCE_STATES);
+const SOURCE_HEALTH_STATES = new Set(REGISTRAR_STANDING_SOURCE_HEALTH_STATES);
+const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/u;
+const NOTICE_ID_RE = /^notice-[1-9]\d{0,7}$/u;
+const IANA_ID_RE = /^[1-9]\d{0,7}$/u;
+function normalizedRegistrarIanaId(value) {
+    if (typeof value === 'number' && Number.isSafeInteger(value))
+        value = String(value);
+    if (typeof value !== 'string')
+        return null;
+    const trimmed = value.trim();
+    return /^\d{1,8}$/u.test(trimmed) && Number(trimmed) > 0 ? String(Number(trimmed)) : null;
+}
+export function registrarIanaIds(...publications) {
+    const identifiers = new Set();
+    for (const publication of publications) {
+        if (!isJsonObject(publication))
+            continue;
+        const identifier = normalizedRegistrarIanaId(publication.registrarIanaId);
+        if (identifier)
+            identifiers.add(identifier);
+    }
+    return Object.freeze([...identifiers].sort((left, right) => Number(left) - Number(right)));
+}
+export function resolveRegistrarIanaId(...publications) {
+    const identifiers = registrarIanaIds(...publications);
+    return identifiers.length === 1 ? identifiers[0] ?? null : null;
+}
+function exactKeys(value, keys) {
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function validNullableTimestamp(value) {
+    return value === null || (typeof value === 'string'
+        && value.length <= 64
+        && Number.isFinite(Date.parse(value))
+        && new Date(value).toISOString() === value);
+}
+function validNullableDate(value) {
+    return value === null || (typeof value === 'string'
+        && ISO_DATE_RE.test(value)
+        && new Date(`${value}T00:00:00.000Z`).toISOString().startsWith(value));
+}
+function validNullableText(value, maximum = MAX_REGISTRAR_STANDING_TEXT_LENGTH) {
+    return value === null || validBoundedString(value, maximum);
+}
+function validStringList(value, maximum) {
+    return Array.isArray(value)
+        && value.length <= maximum
+        && value.every((item) => validBoundedString(item, MAX_REGISTRAR_STANDING_TEXT_LENGTH))
+        && new Set(value).size === value.length;
+}
+function validRegistrarComplianceAction(value) {
+    if (!isJsonObject(value) || !exactKeys(value, [
+        'noticeId',
+        'type',
+        'issuedOn',
+        'sourceUrl',
+        'indexOutcome',
+    ]))
+        return false;
+    if (typeof value.noticeId !== 'string')
+        return false;
+    return NOTICE_ID_RE.test(value.noticeId)
+        && typeof value.type === 'string'
+        && COMPLIANCE_ACTION_TYPES.has(value.type)
+        && validNullableDate(value.issuedOn)
+        && value.issuedOn !== null
+        && registrarStandingOfficialSourceUrl(value.sourceUrl, 'icann_notice', value.noticeId) === value.sourceUrl
+        && validNullableText(value.indexOutcome);
+}
+function sourceTimestampMatchesHealth(value, health) {
+    return health === 'unavailable' ? value === null : value !== null;
+}
+export function deriveRegistrarStandingAssessment(accreditationState, actions, health) {
+    const termination = actions.find((action) => action.type === 'termination');
+    if (health !== 'current')
+        return Object.freeze({
+            state: 'unknown',
+            label: 'Current standing unavailable',
+            detail: health === 'stale'
+                ? 'The checked-in official-source catalogue is beyond its review age, so a current standing conclusion is unavailable.'
+                : 'The checked-in official-source catalogue could not be validated, so a current standing conclusion is unavailable.',
+        });
+    if (accreditationState === 'reserved')
+        return Object.freeze({
+            state: 'reserved',
+            label: 'Reserved IANA identifier',
+            detail: 'IANA records this identifier as reserved rather than as an accredited registrar.',
+        });
+    if (accreditationState === 'terminated')
+        return Object.freeze({
+            state: 'terminated',
+            label: 'Accreditation terminated',
+            detail: termination
+                ? 'IANA records the registrar as terminated and the current-year ICANN catalogue contains a termination notice.'
+                : 'IANA records the registrar as terminated; the reviewed current-year notice catalogue may not contain the historical action.',
+        });
+    if (actions.length)
+        return Object.freeze({
+            state: 'notice_present',
+            label: termination ? 'Official termination notice found' : 'Official compliance notice found',
+            detail: termination && accreditationState === 'accredited'
+                ? 'The reviewed IANA catalogue records the registrar as accredited while the current-year ICANN index contains a termination notice. Review the notice dates, scope and current outcome.'
+                : `The reviewed ${new Set(actions.map((action) => action.type)).size === 1 ? actions[0]?.type.replaceAll('_', '-') : 'compliance'} notice catalogue contains ${actions.length} matching current-year action${actions.length === 1 ? '' : 's'}.`,
+        });
+    if (accreditationState === 'accredited')
+        return Object.freeze({
+            state: 'accredited',
+            label: 'Accredited in reviewed catalogue',
+            detail: 'IANA records the registrar as accredited, with no matching action in the reviewed current-year ICANN notice catalogue.',
+        });
+    return Object.freeze({
+        state: 'unknown',
+        label: 'Current standing unavailable',
+        detail: 'The published registrar identifier could not be matched to the checked-in official-source catalogue.',
+    });
+}
+export function validRegistrarStanding(value) {
+    if (!isJsonObject(value) || !exactKeys(value, [
+        'schema',
+        'version',
+        'ianaId',
+        'accreditation',
+        'compliance',
+        'assessment',
+        'limitations',
+        'nextActions',
+    ]))
+        return false;
+    if (value.schema !== REGISTRAR_STANDING_SCHEMA
+        || value.version !== REGISTRAR_STANDING_VERSION
+        || (value.ianaId !== null && (typeof value.ianaId !== 'string' || !IANA_ID_RE.test(value.ianaId)))
+        || !isJsonObject(value.accreditation)
+        || !isJsonObject(value.compliance)
+        || !isJsonObject(value.assessment))
+        return false;
+    const accreditation = value.accreditation;
+    if (!exactKeys(accreditation, ['state', 'sourceUrl', 'observedAt', 'sourceHealth'])
+        || typeof accreditation.state !== 'string'
+        || !ACCREDITATION_STATES.has(accreditation.state)
+        || accreditation.sourceUrl !== IANA_REGISTRAR_SOURCE_URL
+        || !validNullableTimestamp(accreditation.observedAt)
+        || typeof accreditation.sourceHealth !== 'string'
+        || !SOURCE_HEALTH_STATES.has(accreditation.sourceHealth))
+        return false;
+    const compliance = value.compliance;
+    if (!exactKeys(compliance, [
+        'state',
+        'sourceUrl',
+        'reviewedAt',
+        'catalogueYear',
+        'sourceHealth',
+        'actions',
+        'truncated',
+    ])
+        || typeof compliance.state !== 'string'
+        || !COMPLIANCE_STATES.has(compliance.state)
+        || compliance.sourceUrl !== ICANN_COMPLIANCE_SOURCE_URL
+        || !validNullableTimestamp(compliance.reviewedAt)
+        || (compliance.catalogueYear !== null
+            && (!Number.isInteger(compliance.catalogueYear) || Number(compliance.catalogueYear) < 2000 || Number(compliance.catalogueYear) > 9999))
+        || typeof compliance.sourceHealth !== 'string'
+        || !SOURCE_HEALTH_STATES.has(compliance.sourceHealth)
+        || !Array.isArray(compliance.actions)
+        || compliance.actions.length > MAX_REGISTRAR_COMPLIANCE_ACTIONS
+        || !compliance.actions.every(validRegistrarComplianceAction)
+        || typeof compliance.truncated !== 'boolean')
+        return false;
+    const actions = compliance.actions;
+    const noticeIds = actions.map((action) => action.noticeId);
+    const catalogueYear = compliance.catalogueYear;
+    const actionsInOrder = actions.every((action, index) => {
+        const previous = actions[index - 1];
+        return !previous
+            || previous.issuedOn > action.issuedOn
+            || (previous.issuedOn === action.issuedOn && previous.noticeId > action.noticeId);
+    });
+    if (!sourceTimestampMatchesHealth(accreditation.observedAt, String(accreditation.sourceHealth))
+        || !sourceTimestampMatchesHealth(compliance.reviewedAt, String(compliance.sourceHealth))
+        || (compliance.sourceHealth === 'unavailable') !== (catalogueYear === null)
+        || (accreditation.sourceHealth === 'unavailable' && accreditation.state !== 'unknown')
+        || new Set(noticeIds).size !== noticeIds.length
+        || !actionsInOrder
+        || actions.some((action) => catalogueYear === null || Number(action.issuedOn.slice(0, 4)) !== catalogueYear)
+        || actions.some((action) => compliance.reviewedAt !== null
+            && Date.parse(`${action.issuedOn}T00:00:00.000Z`) > Date.parse(compliance.reviewedAt))
+        || (compliance.truncated && actions.length !== MAX_REGISTRAR_COMPLIANCE_ACTIONS))
+        return false;
+    if (value.ianaId === null) {
+        if (accreditation.state !== 'unknown'
+            || compliance.state !== 'not_applicable'
+            || actions.length !== 0
+            || compliance.truncated)
+            return false;
+    }
+    else if (compliance.sourceHealth === 'unavailable') {
+        if (compliance.state !== 'unavailable' || actions.length !== 0 || compliance.truncated)
+            return false;
+    }
+    else if (actions.length > 0) {
+        if (compliance.state !== 'matching_actions')
+            return false;
+    }
+    else if (compliance.sourceHealth === 'stale') {
+        if (compliance.state !== 'stale')
+            return false;
+    }
+    else if (compliance.state !== 'reviewed_no_match')
+        return false;
+    const assessment = value.assessment;
+    if (!validStringList(value.limitations, MAX_REGISTRAR_STANDING_LIMITATIONS)
+        || !validStringList(value.nextActions, MAX_REGISTRAR_STANDING_NEXT_ACTIONS)
+        || (actions.length === 0) !== (value.nextActions.length === 0))
+        return false;
+    const combinedHealth = accreditation.sourceHealth === 'unavailable'
+        || compliance.sourceHealth === 'unavailable'
+        ? 'unavailable'
+        : accreditation.sourceHealth === 'stale' || compliance.sourceHealth === 'stale'
+            ? 'stale'
+            : 'current';
+    const expectedAssessment = deriveRegistrarStandingAssessment(accreditation.state, actions, combinedHealth);
+    return exactKeys(assessment, ['state', 'label', 'detail'])
+        && assessment.state === expectedAssessment.state
+        && assessment.label === expectedAssessment.label
+        && assessment.detail === expectedAssessment.detail;
+}
+export function registrarStandingObservedBy(value, boundary) {
+    if (!validRegistrarStanding(value)
+        || typeof boundary !== 'string'
+        || boundary.length > 64
+        || !Number.isFinite(Date.parse(boundary))
+        || new Date(boundary).toISOString() !== boundary)
+        return false;
+    const maximum = Date.parse(boundary);
+    return [value.accreditation.observedAt, value.compliance.reviewedAt]
+        .every((timestamp) => timestamp === null || Date.parse(timestamp) <= maximum);
+}

package/lib/registrar-standing.mjs

@@ -0,0 +1,269 @@
+// Offline registrar standing context keyed by the numeric IANA ID already
+// published in registration evidence. This module never performs collection.
+// Accreditation and compliance remain separate official-source observations;
+// neither is treated as evidence that the looked-up domain is malicious.
+import { createHash } from 'node:crypto';
+import { REGISTRAR_STANDING_CATALOGUE } from "./generated/registrar-standing-catalogue.mjs";
+import { ICANN_COMPLIANCE_SOURCE_URL, IANA_REGISTRAR_SOURCE_URL, REGISTRAR_STANDING_CATALOGUE_SCHEMA, REGISTRAR_STANDING_CATALOGUE_VERSION, REGISTRAR_STANDING_MAX_AGE_DAYS, REGISTRAR_STANDING_MAX_FUTURE_SKEW_MS, registrarStandingOfficialSourceUrl, } from "./registrar-standing-catalogue-contract.mjs";
+import { deriveRegistrarStandingAssessment, MAX_REGISTRAR_COMPLIANCE_ACTIONS, REGISTRAR_STANDING_SCHEMA, REGISTRAR_STANDING_VERSION, } from "./registrar-standing-contract.mjs";
+const STATUS_BY_CODE = Object.freeze({
+    A: 'accredited',
+    R: 'reserved',
+    T: 'terminated',
+});
+const SHA256_RE = /^[a-f0-9]{64}$/u;
+const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/u;
+const NOTICE_ID_RE = /^notice-[1-9]\d{0,7}$/u;
+const CONTROL_CHAR_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/u;
+function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function validTimestamp(value) {
+    return typeof value === 'string'
+        && value.length <= 64
+        && Number.isFinite(Date.parse(value))
+        && new Date(value).toISOString() === value;
+}
+function validDate(value) {
+    return typeof value === 'string'
+        && ISO_DATE_RE.test(value)
+        && new Date(`${value}T00:00:00.000Z`).toISOString().startsWith(value);
+}
+function exactKeys(value, keys) {
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function ageDays(value, now) {
+    return Math.max(0, Math.floor((now.getTime() - Date.parse(value)) / 86_400_000));
+}
+function sourceHealth(value, now) {
+    return ageDays(value, now) <= REGISTRAR_STANDING_MAX_AGE_DAYS ? 'current' : 'stale';
+}
+function validatedCatalogue(value, now) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const root = value;
+    if (!exactKeys(root, ['schema', 'version', 'generatedAt', 'iana', 'icann'])
+        || root.schema !== REGISTRAR_STANDING_CATALOGUE_SCHEMA
+        || root.version !== REGISTRAR_STANDING_CATALOGUE_VERSION
+        || !validTimestamp(root.generatedAt)
+        || !root.iana
+        || typeof root.iana !== 'object'
+        || Array.isArray(root.iana)
+        || !root.icann
+        || typeof root.icann !== 'object'
+        || Array.isArray(root.icann))
+        return null;
+    const iana = root.iana;
+    const icann = root.icann;
+    if (!exactKeys(iana, ['sourceUrl', 'observedAt', 'normalizedSha256', 'rows', 'counts', 'encodedStatuses'])
+        || !exactKeys(icann, ['sourceUrl', 'reviewedAt', 'catalogueYear', 'normalizedSha256', 'notices'])
+        || iana.sourceUrl !== IANA_REGISTRAR_SOURCE_URL
+        || !validTimestamp(iana.observedAt)
+        || typeof iana.normalizedSha256 !== 'string'
+        || !SHA256_RE.test(iana.normalizedSha256)
+        || !Number.isInteger(iana.rows)
+        || Number(iana.rows) < 1
+        || Number(iana.rows) > 10_000
+        || typeof iana.encodedStatuses !== 'string'
+        || iana.encodedStatuses.length > 100_000
+        || sha256(iana.encodedStatuses) !== iana.normalizedSha256
+        || !iana.counts
+        || typeof iana.counts !== 'object'
+        || Array.isArray(iana.counts)
+        || icann.sourceUrl !== ICANN_COMPLIANCE_SOURCE_URL
+        || !validTimestamp(icann.reviewedAt)
+        || icann.reviewedAt !== root.generatedAt
+        || Date.parse(String(iana.observedAt)) > Date.parse(String(root.generatedAt))
+        || Date.parse(String(root.generatedAt)) > now.getTime() + REGISTRAR_STANDING_MAX_FUTURE_SKEW_MS
+        || !Number.isInteger(icann.catalogueYear)
+        || Number(icann.catalogueYear) < 2000
+        || Number(icann.catalogueYear) > 9999
+        || typeof icann.normalizedSha256 !== 'string'
+        || !SHA256_RE.test(icann.normalizedSha256)
+        || !Array.isArray(icann.notices)
+        || icann.notices.length > 500
+        || sha256(JSON.stringify(icann.notices)) !== icann.normalizedSha256)
+        return null;
+    const counts = iana.counts;
+    if (!exactKeys(counts, ['Accredited', 'Reserved', 'Terminated'])
+        || Object.values(counts).some((count) => !Number.isInteger(count) || Number(count) < 0))
+        return null;
+    const statusEntries = iana.encodedStatuses.split(',');
+    if (statusEntries.length !== iana.rows)
+        return null;
+    let previousId = 0;
+    const statusCounts = { Accredited: 0, Reserved: 0, Terminated: 0 };
+    const registrarIds = new Set();
+    for (const entry of statusEntries) {
+        const match = /^([1-9]\d{0,7}):([ART])$/u.exec(entry);
+        if (!match || Number(match[1]) <= previousId)
+            return null;
+        previousId = Number(match[1]);
+        registrarIds.add(previousId);
+        if (match[2] === 'A')
+            statusCounts.Accredited += 1;
+        else if (match[2] === 'R')
+            statusCounts.Reserved += 1;
+        else
+            statusCounts.Terminated += 1;
+    }
+    if (counts.Accredited !== statusCounts.Accredited
+        || counts.Reserved !== statusCounts.Reserved
+        || counts.Terminated !== statusCounts.Terminated)
+        return null;
+    const noticeIds = new Set();
+    let previousNotice = null;
+    for (const candidate of icann.notices) {
+        if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate))
+            return null;
+        const notice = candidate;
+        if (!exactKeys(notice, ['noticeId', 'ianaId', 'type', 'issuedOn', 'sourceUrl', 'indexOutcome'])
+            || typeof notice.noticeId !== 'string'
+            || !NOTICE_ID_RE.test(notice.noticeId)
+            || noticeIds.has(notice.noticeId)
+            || !Number.isInteger(notice.ianaId)
+            || Number(notice.ianaId) < 1
+            || Number(notice.ianaId) > 99_999_999
+            || !registrarIds.has(Number(notice.ianaId))
+            || !['breach', 'suspension', 'termination', 'non_renewal'].includes(String(notice.type))
+            || !validDate(notice.issuedOn)
+            || Number(notice.issuedOn.slice(0, 4)) !== Number(icann.catalogueYear)
+            || Date.parse(`${String(notice.issuedOn)}T00:00:00.000Z`) > Date.parse(String(root.generatedAt))
+            || registrarStandingOfficialSourceUrl(notice.sourceUrl, 'icann_notice', notice.noticeId) !== notice.sourceUrl
+            || (notice.indexOutcome !== null
+                && (typeof notice.indexOutcome !== 'string'
+                    || !notice.indexOutcome
+                    || notice.indexOutcome.length > 240
+                    || CONTROL_CHAR_RE.test(notice.indexOutcome))))
+            return null;
+        if (previousNotice
+            && (previousNotice.issuedOn < notice.issuedOn
+                || (previousNotice.issuedOn === notice.issuedOn && previousNotice.noticeId < notice.noticeId)))
+            return null;
+        noticeIds.add(notice.noticeId);
+        previousNotice = { issuedOn: notice.issuedOn, noticeId: notice.noticeId };
+    }
+    return value;
+}
+function accreditationMap(catalogue) {
+    const result = new Map();
+    for (const encoded of catalogue.iana.encodedStatuses.split(',')) {
+        const [id, code] = encoded.split(':');
+        const status = STATUS_BY_CODE[code];
+        if (id && status)
+            result.set(id, status);
+    }
+    return result;
+}
+function normalizedIanaId(value) {
+    if (typeof value === 'number' && Number.isSafeInteger(value))
+        value = String(value);
+    if (typeof value !== 'string')
+        return null;
+    const trimmed = value.trim();
+    return /^\d{1,8}$/u.test(trimmed) && Number(trimmed) > 0 ? String(Number(trimmed)) : null;
+}
+function projectedActions(catalogue, ianaId) {
+    const matching = catalogue.icann.notices.filter((notice) => String(notice.ianaId) === ianaId);
+    const actions = matching.slice(0, MAX_REGISTRAR_COMPLIANCE_ACTIONS).map((notice) => {
+        return Object.freeze({
+            noticeId: notice.noticeId,
+            type: notice.type,
+            issuedOn: notice.issuedOn,
+            sourceUrl: notice.sourceUrl,
+            indexOutcome: notice.indexOutcome,
+        });
+    });
+    return Object.freeze({ actions: Object.freeze(actions), truncated: matching.length > actions.length });
+}
+export function buildRegistrarStanding(options) {
+    const now = options.now ?? new Date();
+    if (!(now instanceof Date) || !Number.isFinite(now.getTime()))
+        throw new TypeError('Registrar standing time must be valid.');
+    const catalogue = validatedCatalogue(options.catalogue ?? REGISTRAR_STANDING_CATALOGUE, now);
+    const ianaId = normalizedIanaId(options.registrarIanaId);
+    const ianaHealth = catalogue ? sourceHealth(catalogue.iana.observedAt, now) : 'unavailable';
+    const icannHealth = catalogue ? sourceHealth(catalogue.icann.reviewedAt, now) : 'unavailable';
+    const accreditation = catalogue && ianaId
+        ? accreditationMap(catalogue).get(ianaId) ?? 'unknown'
+        : 'unknown';
+    const projected = catalogue && ianaId
+        ? projectedActions(catalogue, ianaId)
+        : Object.freeze({ actions: Object.freeze([]), truncated: false });
+    const combinedHealth = ianaHealth === 'unavailable' || icannHealth === 'unavailable'
+        ? 'unavailable'
+        : ianaHealth === 'stale' || icannHealth === 'stale'
+            ? 'stale'
+            : 'current';
+    const assessment = deriveRegistrarStandingAssessment(accreditation, projected.actions, combinedHealth);
+    const hasAction = projected.actions.length > 0;
+    const limitations = [
+        'Registrar standing describes the provider, not whether this domain is malicious, safe, owned, or controlled.',
+        catalogue
+            ? `The reviewed ${catalogue.icann.catalogueYear} ICANN index is not a complete enforcement history and excludes third-party allegations.`
+            : 'The checked-in official-source catalogue could not be validated, so registrar standing is unavailable.',
+        ...(!ianaId ? ['No single numeric registrar IANA ID was available across the registration evidence, so no registrar match was attempted.'] : []),
+        ...(combinedHealth === 'stale' ? ['The catalogue is past its review-age threshold; current absence and accreditation conclusions require a refresh.'] : []),
+    ].slice(0, 4);
+    const nextActions = hasAction ? [
+        'Open the official notice and verify its dates, scope, and current outcome before acting.',
+        'Preserve current registration, transfer-status, delegation, and account-control evidence.',
+        'Review authenticated registrar notifications and account activity through the provider control plane.',
+        'Recheck the registrar IANA ID and domain transfer status during follow-up.',
+    ] : [];
+    return Object.freeze({
+        schema: REGISTRAR_STANDING_SCHEMA,
+        version: REGISTRAR_STANDING_VERSION,
+        ianaId,
+        accreditation: Object.freeze({
+            state: accreditation,
+            sourceUrl: IANA_REGISTRAR_SOURCE_URL,
+            observedAt: catalogue?.iana.observedAt ?? null,
+            sourceHealth: ianaHealth,
+        }),
+        compliance: Object.freeze({
+            state: !ianaId
+                ? 'not_applicable'
+                : !catalogue
+                    ? 'unavailable'
+                    : projected.actions.length
+                        ? 'matching_actions'
+                        : icannHealth === 'stale'
+                            ? 'stale'
+                            : 'reviewed_no_match',
+            sourceUrl: ICANN_COMPLIANCE_SOURCE_URL,
+            reviewedAt: catalogue?.icann.reviewedAt ?? null,
+            catalogueYear: catalogue?.icann.catalogueYear ?? null,
+            sourceHealth: icannHealth,
+            actions: projected.actions,
+            truncated: projected.truncated,
+        }),
+        assessment,
+        limitations: Object.freeze(limitations),
+        nextActions: Object.freeze(nextActions),
+    });
+}
+export function registrarStandingCatalogueHealth(now = new Date(), value = REGISTRAR_STANDING_CATALOGUE) {
+    if (!(now instanceof Date) || !Number.isFinite(now.getTime()))
+        throw new TypeError('Registrar standing health time must be valid.');
+    const catalogue = validatedCatalogue(value, now);
+    if (!catalogue)
+        return Object.freeze({
+            state: 'unavailable',
+            sourceObservedAt: null,
+            ageDays: null,
+            itemCount: null,
+            detail: 'The checked-in registrar standing catalogue failed its schema or digest checks.',
+        });
+    const age = Math.max(ageDays(catalogue.iana.observedAt, now), ageDays(catalogue.icann.reviewedAt, now));
+    return Object.freeze({
+        state: age <= REGISTRAR_STANDING_MAX_AGE_DAYS ? 'current' : 'stale',
+        sourceObservedAt: [catalogue.iana.observedAt, catalogue.icann.reviewedAt]
+            .sort((left, right) => Date.parse(left) - Date.parse(right))[0] ?? null,
+        ageDays: age,
+        itemCount: catalogue.iana.rows + catalogue.icann.notices.length,
+        detail: `${catalogue.iana.rows.toLocaleString('en')} IANA registrar IDs and ${catalogue.icann.notices.length} ${catalogue.icann.catalogueYear} ICANN notices passed local digest and shape checks.`,
+    });
+}

package/lib/registry-insights.mjs

@@ -6,6 +6,7 @@
 // contact data or a registration condition is absent.
 import { compareRegistrySources } from "./registry-comparison.mjs";
 import { inspectRdapCapabilities } from "./rdap-capabilities.mjs";
+import { isRecord, recordOrEmpty } from "./json-record.mjs";
 export const REGISTRY_INSIGHTS_VERSION = 1;
 export const MAX_REGISTRY_INSIGHT_STATUSES = 40;
 export const MAX_REGISTRY_INSIGHT_ISSUES = 12;
@@ -14,14 +15,7 @@ const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const PRIVACY_PROXY_RE = /(?:privacy|proxy|whoisguard|data protected|identity protect|private registration)/iu;
 const REDACTED_RE = /(?:redacted|masked|not published)/iu;
 const WITHHELD_RE = /(?:withheld|not disclosed|restricted disclosure)/iu;
-function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : {};
-}
-function isRecord(value) {
-    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
-}
+const record = recordOrEmpty;
 function text(value, maximum = 320) {
     return typeof value === 'string' && !CONTROL_RE.test(value)
         ? value.trim().slice(0, maximum)