@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/lib/rdap-bootstrap.mjs

@@ -1,6 +1,7 @@
 // IANA RDAP bootstrap retrieval, bounded stale caching, and authority
 // selection for domain, IP, and ASN queries.
 import net from 'node:net';
+import { abortable } from "./abort.mjs";
 import { fetchRdapDetailedWithTimeout, } from "./rdap-transport.mjs";
 const BOOTSTRAP_TTL_MS = 60 * 60 * 1000;
 const BOOTSTRAP_STALE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
@@ -116,21 +117,17 @@ function validBootstrap(data) {
             && Array.isArray(service[1]) && service[1].length > 0
             && service[1].some((url) => typeof url === 'string' && /^https?:\/\//i.test(url))));
 }
-async function fetchBootstrap(kind, options = {}) {
-    if (!BOOTSTRAP_KINDS.has(kind))
-        throw new Error(`Unsupported RDAP bootstrap kind: ${kind}`);
-    const now = typeof options.now === 'function' ? options.now : Date.now;
-    const fetchUpstream = options.fetchUpstream || fetchRdapDetailedWithTimeout;
-    const cached = bootstrapCache.get(kind);
-    if (cached && now() - cached.fetchedAt < BOOTSTRAP_TTL_MS)
-        return cached.data;
-    const inflight = bootstrapInflight.get(kind);
-    if (inflight)
-        return inflight;
-    const request = (async () => {
+function startBootstrap(kind, options) {
+    const now = options.now ?? Date.now;
+    const fetchUpstream = options.fetchUpstream ?? fetchRdapDetailedWithTimeout;
+    const controller = new AbortController();
+    const { signal } = controller;
+    const request = abortable(async () => {
         try {
+            signal.throwIfAborted();
             const requestedEndpoint = `https://data.iana.org/rdap/${kind}.json`;
-            const response = await fetchUpstream(requestedEndpoint, {}, BOOTSTRAP_FETCH_TIMEOUT_MS);
+            const response = await fetchUpstream(requestedEndpoint, { signal }, BOOTSTRAP_FETCH_TIMEOUT_MS);
+            signal.throwIfAborted();
             const finalEndpoint = admitRdapEndpoint(response.finalUrl ?? requestedEndpoint);
             if (finalEndpoint !== requestedEndpoint) {
                 throw new Error(`IANA bootstrap redirected outside its fixed source endpoint for ${kind}`);
@@ -152,21 +149,74 @@ async function fetchBootstrap(kind, options = {}) {
             return data;
         }
         catch (cause) {
+            signal.throwIfAborted();
             const fallback = bootstrapCache.get(kind);
             if (fallback && now() - fallback.fetchedAt <= BOOTSTRAP_STALE_TTL_MS) {
                 return fallback.data;
             }
             throw cause;
         }
-        finally {
-            bootstrapInflight.delete(kind);
+    }, signal);
+    const flight = {
+        controller, readers: 0, settled: false,
+        request: request.finally(() => {
+            flight.settled = true;
+            if (bootstrapInflight.get(kind) === flight)
+                bootstrapInflight.delete(kind);
+        }),
+    };
+    bootstrapInflight.set(kind, flight);
+    return flight;
+}
+async function fetchBootstrap(kind, options = {}) {
+    if (!BOOTSTRAP_KINDS.has(kind))
+        throw new Error(`Unsupported RDAP bootstrap kind: ${kind}`);
+    options.signal?.throwIfAborted();
+    const now = options.now ?? Date.now;
+    const cached = bootstrapCache.get(kind);
+    if (cached && now() - cached.fetchedAt < BOOTSTRAP_TTL_MS)
+        return cached.data;
+    const flight = bootstrapInflight.get(kind) ?? startBootstrap(kind, options);
+    flight.readers++;
+    let released = false;
+    const release = () => {
+        if (released)
+            return;
+        released = true;
+        // One deadline releases only its reader. The fixed-source transport lives
+        // until the last reader leaves, and never caches a cancelled late response.
+        flight.readers--;
+        if (!flight.readers && !flight.settled) {
+            flight.controller.abort();
+            if (bootstrapInflight.get(kind) === flight)
+                bootstrapInflight.delete(kind);
         }
-    })();
-    bootstrapInflight.set(kind, request);
-    return request;
+    };
+    const { signal } = options;
+    let cancel = () => { };
+    const result = new Promise((resolve, reject) => {
+        // Attach before observing cancellation so even an abandoned queued flight
+        // retains a rejection handler. Release synchronously to avoid starting it.
+        flight.request.then(resolve, reject);
+        cancel = () => { release(); reject(signal?.reason); };
+        signal?.addEventListener('abort', cancel, { once: true });
+        if (signal?.aborted)
+            cancel();
+    });
+    try {
+        return await result;
+    }
+    finally {
+        signal?.removeEventListener('abort', cancel);
+        release();
+        if (flight.controller.signal.aborted)
+            await flight.request.catch(() => { });
+    }
 }
 function clearRdapBootstrapCache() {
     bootstrapCache.clear();
+    for (const flight of bootstrapInflight.values())
+        flight.controller.abort();
     bootstrapInflight.clear();
 }
 function uniqueRdapBases(urls) {
@@ -185,9 +235,9 @@ function uniqueRdapBases(urls) {
         return true;
     });
 }
-async function findRdapBases(type, value) {
+async function findRdapBases(type, value, options = {}) {
     if (type === 'domain') {
-        const bootstrap = await fetchBootstrap('dns');
+        const bootstrap = await fetchBootstrap('dns', options);
         const tld = value.split('.').pop()?.toLowerCase() || '';
         for (const [tlds, urls] of bootstrap.services) {
             if (tlds.some((entry) => entry.toLowerCase() === tld))
@@ -196,7 +246,7 @@ async function findRdapBases(type, value) {
         return [];
     }
     if (type === 'ipv4' || type === 'ipv6') {
-        const bootstrap = await fetchBootstrap(type);
+        const bootstrap = await fetchBootstrap(type, options);
         const matcher = type === 'ipv4' ? ipInCidrV4 : ipInCidrV6;
         let best = null;
         let bestPrefix = -1;
@@ -215,7 +265,7 @@ async function findRdapBases(type, value) {
         return best || [];
     }
     if (type === 'asn') {
-        const bootstrap = await fetchBootstrap('asn');
+        const bootstrap = await fetchBootstrap('asn', options);
         const number = parseInt(value.replace(/^AS/i, ''), 10);
         for (const [ranges, urls] of bootstrap.services) {
             for (const range of ranges) {

package/lib/rdap-capabilities.mjs

@@ -245,7 +245,7 @@ export function inspectRdapCapabilities(parsedValue, status) {
             break;
     }
     const declarations = [...unique].sort().map((value) => {
-        const entry = EXTENSION_CATALOG[value];
+        const entry = Object.hasOwn(EXTENSION_CATALOG, value) ? EXTENSION_CATALOG[value] : undefined;
         return entry
             ? {
                 identifier: value,

package/lib/rdap-client.mjs

@@ -1,7 +1,7 @@
 import { cached } from "./lookup-cache.mjs";
 import { findRdapBases, uniqueRdapBases, } from "./rdap-bootstrap.mjs";
 import { rdapAttempt, rdapFailure } from "./rdap-attempts.mjs";
-import { fetchRdapDetailedWithTimeout, } from "./rdap-transport.mjs";
+import { fetchRdapDetailedWithTimeout, RdapBodyAdmissionError, } from "./rdap-transport.mjs";
 import { admitRdapObjectEndpoint, validateRdapResponse, } from "./rdap-validation.mjs";
 const UPSTREAM_TIMEOUT_MS = 7_000;
 const UPSTREAM_TOTAL_DEADLINE_MS = 12_000;
@@ -24,20 +24,23 @@ function rdapPathFor(type, value) {
  * Query the bounded bootstrap candidate set while retaining every attempted
  * endpoint as separately attributed transport evidence.
  */
-export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap, fetchUpstream = fetchRdapDetailedWithTimeout) {
+export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap, fetchUpstream = fetchRdapDetailedWithTimeout, signal) {
+    signal?.throwIfAborted();
     const candidates = uniqueRdapBases(bases).slice(0, MAX_RDAP_ENDPOINTS);
     if (candidates.length === 0)
         return null;
     const startedAt = Date.now();
     const attempts = [];
     for (const base of candidates) {
+        signal?.throwIfAborted();
         const elapsed = Date.now() - startedAt;
         const remaining = UPSTREAM_TOTAL_DEADLINE_MS - elapsed;
         if (remaining <= 0)
             break;
         const url = `${base.replace(/\/$/, '')}/${rdapPathFor(type, value)}`;
         try {
-            const upstream = await fetchUpstream(url, { headers: { Accept: 'application/rdap+json' } }, Math.min(UPSTREAM_TIMEOUT_MS, remaining));
+            const upstream = await fetchUpstream(url, { headers: { Accept: 'application/rdap+json' }, ...(signal ? { signal } : {}) }, Math.min(UPSTREAM_TIMEOUT_MS, remaining));
+            signal?.throwIfAborted();
             const selectedEndpoint = admitRdapObjectEndpoint(type, value, upstream.finalUrl ?? url);
             if (!selectedEndpoint) {
                 attempts.push(rdapAttempt(url, 'invalid_response', {
@@ -110,6 +113,11 @@ export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap
             };
         }
         catch (cause) {
+            signal?.throwIfAborted();
+            if (cause instanceof RdapBodyAdmissionError) {
+                attempts.push(rdapAttempt(url, 'invalid_response', { status: cause.status, detail: cause.message }));
+                continue;
+            }
             const detail = String(errorProperty(cause, 'message') || 'request failed');
             const outcome = errorProperty(cause, 'name') === 'AbortError' ||
                 /timed? out|time limit/i.test(detail)
@@ -125,9 +133,9 @@ export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap
         : 'the total upstream deadline expired';
     throw Object.assign(new Error(`RDAP lookup failed across ${candidates.length} endpoint(s): ${detail}`), { attempts });
 }
-export async function fetchRdapRecordWithParser(type, value, parseRdap) {
+export async function fetchRdapRecordWithParser(type, value, parseRdap, options = {}) {
     return cached(`rdap:${type}:${value}`, async () => {
-        const bases = await findRdapBases(type, value);
-        return fetchRdapFromBasesWithParser(type, value, bases, parseRdap);
-    });
+        const bases = await findRdapBases(type, value, options);
+        return fetchRdapFromBasesWithParser(type, value, bases, parseRdap, options.fetchUpstream, options.signal);
+    }, options.signal);
 }

package/lib/rdap-normalization.mjs

@@ -1,8 +1,9 @@
 // Bounded normalization of untrusted RDAP response objects.
 import net from 'node:net';
 import { registryDateIso } from "./registry-dates.mjs";
-import {} from "./rdap-types.mjs";
+import { MAX_RDAP_STATUSES, MAX_RDAP_REDACTIONS, } from "./rdap-types.mjs";
 const MAX_RDAP_ENTITIES = 100;
+const MAX_RDAP_EVENTS = 100;
 const MAX_RDAP_ENTITY_DEPTH = 6;
 const MAX_ENTITIES_PER_ROLE = 5;
 const MAX_VCARD_ENTRIES = 100;
@@ -10,7 +11,6 @@ const MAX_ENTITY_ROLES = 12;
 const MAX_CONTACT_VALUES = 8;
 const MAX_ENTITY_LINKS = 10;
 const MAX_RDAP_LINKS = 20;
-const MAX_RDAP_REDACTIONS = 100;
 const MAX_RDAP_VARIANT_GROUPS = 20;
 const MAX_RDAP_VARIANT_NAMES = 50;
 const MAX_RDAP_SERVER_TRUNCATION_REASONS = 8;
@@ -166,8 +166,10 @@ function contactValuesTruncated(vcardArray) {
             return rawPart.length > 300 || /[\u0000-\u001f\u007f]/u.test(rawPart) || rawPart.trim() !== '';
         });
         const retainedParts = parts.filter((part) => part !== null);
+        // Empty structured components publish no address; they are not omitted
+        // evidence. Supplied non-blank values still pass every validation bound.
         if (rejectedNonBlankPart
-            || boundedString(retainedParts.join(', '), 1000) === null)
+            || (retainedParts.length > 0 && boundedString(retainedParts.join(', '), 1000) === null))
             return true;
     }
     return false;
@@ -506,18 +508,33 @@ function boundedEventString(value, maxLength) {
         return null;
     return value.trim() || null;
 }
-function normalizeRdapEvents(value) {
+function normalizedEventInventory(value) {
     if (!Array.isArray(value))
-        return [];
-    return value.slice(0, 100).map((event) => {
-        if (!event || typeof event !== 'object' || Array.isArray(event))
-            return null;
+        return { items: [], truncated: value !== undefined };
+    let truncated = value.length > MAX_RDAP_EVENTS;
+    const items = [];
+    for (const event of value.slice(0, MAX_RDAP_EVENTS)) {
+        if (!event || typeof event !== 'object' || Array.isArray(event)) {
+            truncated = true;
+            continue;
+        }
         const record = event;
         const action = boundedEventString(record.eventAction, 100)?.toLowerCase().replace(/\s+/g, ' ') || null;
         const date = boundedEventString(record.eventDate, 64);
         const actor = boundedEventString(record.eventActor, 160);
-        return action || date ? { action, date, actor } : null;
-    }).filter((event) => event !== null);
+        if (record.eventAction !== undefined && action === null
+            || record.eventDate !== undefined && date === null
+            || record.eventActor !== undefined && actor === null)
+            truncated = true;
+        if (action || date)
+            items.push({ action, date, actor });
+        else
+            truncated = true;
+    }
+    return { items, truncated };
+}
+function normalizeRdapEvents(value) {
+    return normalizedEventInventory(value).items;
 }
 function lifecycleDate(events, action, newest) {
     let selected = null;
@@ -697,7 +714,8 @@ function entityInventory(entities) {
 function parseRdapObject(type, data) {
     if (!data || typeof data !== 'object' || Array.isArray(data))
         return null;
-    const events = normalizeRdapEvents(data.events);
+    const eventInfo = normalizedEventInventory(data.events);
+    const events = eventInfo.items;
     const redactionInfo = normalizeRedactions(data.redacted);
     const noticesInfo = summarizeTextBlocks(data.notices);
     const remarksInfo = summarizeTextBlocks(data.remarks);
@@ -708,12 +726,11 @@ function parseRdapObject(type, data) {
     // to every RDAP object type. Unlike set-like fields, status order and
     // repetition remain as published for backwards compatibility.
     const statuses = Array.isArray(data.status)
-        ? data.status.slice(0, 100)
+        ? data.status.slice(0, MAX_RDAP_STATUSES)
             .map((status) => boundedString(status, 160))
             .filter((status) => status !== null)
         : [];
-    const inspectedStatusCount = Array.isArray(data.status) ? Math.min(data.status.length, 100) : 0;
-    const inspectedEventCount = Array.isArray(data.events) ? Math.min(data.events.length, 100) : 0;
+    const inspectedStatusCount = Array.isArray(data.status) ? Math.min(data.status.length, MAX_RDAP_STATUSES) : 0;
     const common = {
         objectClassName: boundedString(data.objectClassName, 80, { lower: true }),
         language: boundedString(data.lang, 35, { lower: true }),
@@ -732,12 +749,10 @@ function parseRdapObject(type, data) {
         serverTruncationReasons,
         statuses,
         statusesTruncated: data.status !== undefined && (!Array.isArray(data.status)
-            || data.status.length > 100
+            || data.status.length > MAX_RDAP_STATUSES
             || statuses.length < inspectedStatusCount),
         events,
-        eventsTruncated: data.events !== undefined && (!Array.isArray(data.events)
-            || data.events.length > 100
-            || events.length < inspectedEventCount),
+        eventsTruncated: eventInfo.truncated,
         lifecycle: summarizeLifecycle(events),
     };
     if (type === 'domain') {

package/lib/rdap-search-workbench.mjs

@@ -213,7 +213,7 @@ function inspectRdapReverseSearchResponse(value, requestedProperties = []) {
         mappings.push(Object.freeze({
             property,
             propertyPath,
-            state: REGISTERED_PROPERTY_PATHS[property]?.includes(propertyPath)
+            state: Object.hasOwn(REGISTERED_PROPERTY_PATHS, property) && REGISTERED_PROPERTY_PATHS[property]?.includes(propertyPath)
                 ? 'registered'
                 : 'unrecognized',
         }));

package/lib/rdap-transport.mjs

@@ -2,38 +2,65 @@
 // normalization, and registrar enrichment remain separate concerns in
 // lib/rdap.mts.
 import { readTextCapped, safeFetch, safeFetchDetailed } from "./safe-fetch.mjs";
+import { abortable } from "./abort.mjs";
 const MAX_RDAP_BYTES = 2000000;
-async function fetchRdapWithTimeout(url, options, timeoutMs, dependencies = {}) {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-        const response = await (dependencies.fetch ?? safeFetch)(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(response, MAX_RDAP_BYTES, { fatalUtf8: true });
-        if (truncated)
-            throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
-        return { status: response.status, ok: response.ok, text };
-    }
-    finally {
-        clearTimeout(timeout);
+export class RdapBodyAdmissionError extends Error {
+    status;
+    kind;
+    constructor(status, kind) {
+        super(kind === 'too_large' ? `RDAP response exceeded ${MAX_RDAP_BYTES} bytes.`
+            : kind === 'invalid_encoding' ? 'RDAP response contains invalid UTF-8 encoding.'
+                : 'RDAP response body could not be read completely.');
+        this.name = 'RdapBodyAdmissionError';
+        this.status = status;
+        this.kind = kind;
     }
 }
-async function fetchRdapDetailedWithTimeout(url, options, timeoutMs, dependencies = {}) {
+async function fetchRdapTransport(url, options, timeoutMs, fetchResponse, readText) {
+    options.signal?.throwIfAborted();
     const controller = new AbortController();
+    const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    const cancelBody = () => { void response?.body?.cancel().catch(() => { }); };
     try {
-        const result = await (dependencies.fetchDetailed ?? safeFetchDetailed)(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(result.response, MAX_RDAP_BYTES, { fatalUtf8: true });
+        const result = await abortable(async () => {
+            const result = await fetchResponse(url, { ...options, signal });
+            response = result.response;
+            if (signal.aborted) {
+                cancelBody();
+                signal.throwIfAborted();
+            }
+            return result;
+        }, signal);
+        let body;
+        try {
+            body = await abortable(() => readText(result.response, MAX_RDAP_BYTES, { fatalUtf8: true }), signal);
+        }
+        catch (error) {
+            signal.throwIfAborted();
+            const invalidEncoding = error instanceof TypeError && 'code' in error
+                && error.code === 'ERR_ENCODING_INVALID_ENCODED_DATA';
+            throw new RdapBodyAdmissionError(result.response.status, invalidEncoding ? 'invalid_encoding' : 'unreadable');
+        }
+        const { text, truncated } = body;
         if (truncated)
-            throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
+            throw new RdapBodyAdmissionError(result.response.status, 'too_large');
         return {
-            status: result.response.status,
-            ok: result.response.ok,
-            text,
-            finalUrl: result.finalUrl,
+            status: result.response.status, ok: result.response.ok, text,
+            ...(result.finalUrl === undefined ? {} : { finalUrl: result.finalUrl }),
         };
     }
     finally {
         clearTimeout(timeout);
+        if (signal.aborted)
+            cancelBody();
     }
 }
+async function fetchRdapWithTimeout(url, options, timeoutMs, dependencies = {}) {
+    return fetchRdapTransport(url, options, timeoutMs, async (target, request) => ({ response: await (dependencies.fetch ?? safeFetch)(target, request) }), dependencies.readText ?? readTextCapped);
+}
+async function fetchRdapDetailedWithTimeout(url, options, timeoutMs, dependencies = {}) {
+    return fetchRdapTransport(url, options, timeoutMs, dependencies.fetchDetailed ?? safeFetchDetailed, dependencies.readText ?? readTextCapped);
+}
 export { fetchRdapDetailedWithTimeout, fetchRdapWithTimeout, };

package/lib/rdap-types.mjs

@@ -1 +1,2 @@
-export {};
+export const MAX_RDAP_STATUSES = 100;
+export const MAX_RDAP_REDACTIONS = 100;

package/lib/rdap.mjs

@@ -4,18 +4,33 @@ import { fetchRdapFromBasesWithParser, fetchRdapRecordWithParser, } from "./rdap
 import { normalizeRdapEvents, parseRdap, summarizeLifecycle, } from "./rdap-normalization.mjs";
 import { fetchRegistrarRdapRecordWithParser, selectRegistrarRdapLink, } from "./rdap-registrar.mjs";
 import { fetchRdapDetailedWithTimeout, } from "./rdap-transport.mjs";
-import { registryServiceAdmissionFor } from "./registry-capabilities.mjs";
+import { REGISTRY_CAPABILITIES_VERSION, registryServiceAdmissionFor } from "./registry-capabilities.mjs";
+// A null record does not establish domain absence. Keep the HTTP explanation
+// aligned with the same admission decision used before bootstrap discovery.
+function rdapUnavailableResponse(type, value) {
+    const admission = type === 'domain' ? registryServiceAdmissionFor(value, 'rdap') : null;
+    if (admission?.allowed === false) {
+        return {
+            error: 'RDAP collection was not attempted because the retained registry capability policy does not admit this service.',
+            source: 'retained_registry_capability_policy',
+            capabilityVersion: REGISTRY_CAPABILITIES_VERSION,
+            limitation: admission.limitation,
+        };
+    }
+    return { error: `No RDAP registry found for "${value}" via IANA bootstrap` };
+}
 async function fetchRdapFromBases(type, value, bases, fetchUpstream = fetchRdapDetailedWithTimeout) {
     return fetchRdapFromBasesWithParser(type, value, bases, parseRdap, fetchUpstream);
 }
 async function fetchRdapRecord(type, value, options = {}) {
+    options.signal?.throwIfAborted();
     if (type === 'domain' && registryServiceAdmissionFor(value, 'rdap')?.allowed === false) {
         return null;
     }
     const fetchRecord = options.fetchRecord ?? fetchRdapRecordWithParser;
-    return fetchRecord(type, value, parseRdap);
+    return fetchRecord(type, value, parseRdap, options.signal ? { signal: options.signal } : {});
 }
 async function fetchRegistrarRdapRecord(domain, registryRecord, options = {}) {
     return fetchRegistrarRdapRecordWithParser(domain, registryRecord, parseRdap, options);
 }
-export { BOOTSTRAP_TTL_MS, BOOTSTRAP_STALE_TTL_MS, fetchBootstrap, clearRdapBootstrapCache, fetchRdapRecord, fetchRdapFromBases, fetchRegistrarRdapRecord, selectRegistrarRdapLink, uniqueBases, parseRdap, normalizeRdapEvents, summarizeLifecycle, };
+export { BOOTSTRAP_TTL_MS, BOOTSTRAP_STALE_TTL_MS, fetchBootstrap, clearRdapBootstrapCache, fetchRdapRecord, rdapUnavailableResponse, fetchRdapFromBases, fetchRegistrarRdapRecord, selectRegistrarRdapLink, uniqueBases, parseRdap, normalizeRdapEvents, summarizeLifecycle, };

package/lib/registrable-domain.mjs

@@ -1,5 +1,25 @@
-import { getDomain } from 'tldts';
+import { getDomain, getPublicSuffix } from 'tldts';
 import { isValidAsciiDomainName } from "./hostname.mjs";
+import { MAX_DOMAIN_NAME_LENGTH, MAX_DOMAIN_LABEL_LENGTH } from "../packages/contracts/domain-name.mjs";
+// Reserve the shortest generated name and its separating dot.
+export const MAX_DISCOVERY_SUFFIX_LENGTH = MAX_DOMAIN_NAME_LENGTH - 2;
+/** ICANN suffix rules for a plain ASCII hostname; private suffixes do not change identity. */
+export function publicSuffixForAsciiHostname(value) {
+    if (!isValidAsciiDomainName(value, { requireDot: false, requireLowercase: true }))
+        return null;
+    return getPublicSuffix(value);
+}
+/** Preserve reserved single labels; compound suffixes must match the local ICANN suffix rules. */
+export function normalizeDiscoverySuffix(raw) {
+    if (typeof raw !== 'string' || raw.length > MAX_DISCOVERY_SUFFIX_LENGTH + 1 || /[\u0000-\u001f\u007f]/u.test(raw))
+        return null;
+    const value = raw.trim().toLowerCase().replace(/^\./u, '');
+    if (!value || value.length > MAX_DISCOVERY_SUFFIX_LENGTH)
+        return null;
+    if (value.length <= MAX_DOMAIN_LABEL_LENGTH && /^[a-z]{2,}$/u.test(value))
+        return value;
+    return value.includes('.') && publicSuffixForAsciiHostname(value) === value ? value : null;
+}
 // Returns one canonical registrable-domain identity for an already public DNS
 // hostname. Callers retain the original hostname separately when subdomain
 // context matters; authority, evidence binding and scoring use this value.

package/lib/registrar-standing-contract.mjs

@@ -101,6 +101,7 @@ function validNullableTimestamp(value) {
 function validNullableDate(value) {
     return value === null || (typeof value === 'string'
         && ISO_DATE_RE.test(value)
+        && Number.isFinite(Date.parse(`${value}T00:00:00.000Z`))
         && new Date(`${value}T00:00:00.000Z`).toISOString().startsWith(value));
 }
 function validNullableText(value, maximum = MAX_REGISTRAR_STANDING_TEXT_LENGTH) {

package/lib/registry-capabilities.mjs

@@ -98,7 +98,11 @@ function registryServiceAdmissionFor(value, service) {
     if (!capability || (service !== 'rdap' && service !== 'whois'))
         return null;
     if (service === 'rdap') {
-        const allowed = capability.rdapAccessProfile === 'iana-bootstrap';
+        // A retained absence is a discovery hint, not an access restriction.
+        // Both current profiles permit bounded bootstrap discovery; unknown or
+        // future restriction profiles remain denied until explicitly handled.
+        const allowed = capability.rdapAccessProfile === 'iana-bootstrap'
+            || capability.rdapAccessProfile === 'no-iana-service';
         return {
             service,
             state: allowed ? 'allowed' : 'unsupported',

package/lib/registry-capability-catalogue.mjs

@@ -1,10 +1,11 @@
 // Registry compatibility metadata. IANA bootstrap and referral discovery
 // remain authoritative. Explicit query profiles may alter only the first
 // referred registry query after a fixture-backed adapter is integrated.
+export const REGISTRY_STANDARDS_COVERAGE_SCHEMA = 'whoisleuth.registry-standards-coverage';
 const REGISTRY_CAPABILITIES_VERSION = 29;
 const MAX_CAPABILITY_INPUT_LENGTH = 253;
 const REGISTRY_STANDARDS_COVERAGE_SNAPSHOT = Object.freeze({
-    schema: 'whoisleuth.registry-standards-coverage',
+    schema: REGISTRY_STANDARDS_COVERAGE_SCHEMA,
     version: 1,
     verifiedAt: '2026-08-03',
     sources: Object.freeze({