@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/lib/rdap-transport.mjs

@@ -2,38 +2,65 @@
 // normalization, and registrar enrichment remain separate concerns in
 // lib/rdap.mts.
 import { readTextCapped, safeFetch, safeFetchDetailed } from "./safe-fetch.mjs";
+import { abortable } from "./abort.mjs";
 const MAX_RDAP_BYTES = 2000000;
-async function fetchRdapWithTimeout(url, options, timeoutMs, dependencies = {}) {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-        const response = await (dependencies.fetch ?? safeFetch)(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(response, MAX_RDAP_BYTES, { fatalUtf8: true });
-        if (truncated)
-            throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
-        return { status: response.status, ok: response.ok, text };
-    }
-    finally {
-        clearTimeout(timeout);
+export class RdapBodyAdmissionError extends Error {
+    status;
+    kind;
+    constructor(status, kind) {
+        super(kind === 'too_large' ? `RDAP response exceeded ${MAX_RDAP_BYTES} bytes.`
+            : kind === 'invalid_encoding' ? 'RDAP response contains invalid UTF-8 encoding.'
+                : 'RDAP response body could not be read completely.');
+        this.name = 'RdapBodyAdmissionError';
+        this.status = status;
+        this.kind = kind;
     }
 }
-async function fetchRdapDetailedWithTimeout(url, options, timeoutMs, dependencies = {}) {
+async function fetchRdapTransport(url, options, timeoutMs, fetchResponse, readText) {
+    options.signal?.throwIfAborted();
     const controller = new AbortController();
+    const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    const cancelBody = () => { void response?.body?.cancel().catch(() => { }); };
     try {
-        const result = await (dependencies.fetchDetailed ?? safeFetchDetailed)(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(result.response, MAX_RDAP_BYTES, { fatalUtf8: true });
+        const result = await abortable(async () => {
+            const result = await fetchResponse(url, { ...options, signal });
+            response = result.response;
+            if (signal.aborted) {
+                cancelBody();
+                signal.throwIfAborted();
+            }
+            return result;
+        }, signal);
+        let body;
+        try {
+            body = await abortable(() => readText(result.response, MAX_RDAP_BYTES, { fatalUtf8: true }), signal);
+        }
+        catch (error) {
+            signal.throwIfAborted();
+            const invalidEncoding = error instanceof TypeError && 'code' in error
+                && error.code === 'ERR_ENCODING_INVALID_ENCODED_DATA';
+            throw new RdapBodyAdmissionError(result.response.status, invalidEncoding ? 'invalid_encoding' : 'unreadable');
+        }
+        const { text, truncated } = body;
         if (truncated)
-            throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
+            throw new RdapBodyAdmissionError(result.response.status, 'too_large');
         return {
-            status: result.response.status,
-            ok: result.response.ok,
-            text,
-            finalUrl: result.finalUrl,
+            status: result.response.status, ok: result.response.ok, text,
+            ...(result.finalUrl === undefined ? {} : { finalUrl: result.finalUrl }),
         };
     }
     finally {
         clearTimeout(timeout);
+        if (signal.aborted)
+            cancelBody();
     }
 }
+async function fetchRdapWithTimeout(url, options, timeoutMs, dependencies = {}) {
+    return fetchRdapTransport(url, options, timeoutMs, async (target, request) => ({ response: await (dependencies.fetch ?? safeFetch)(target, request) }), dependencies.readText ?? readTextCapped);
+}
+async function fetchRdapDetailedWithTimeout(url, options, timeoutMs, dependencies = {}) {
+    return fetchRdapTransport(url, options, timeoutMs, dependencies.fetchDetailed ?? safeFetchDetailed, dependencies.readText ?? readTextCapped);
+}
 export { fetchRdapDetailedWithTimeout, fetchRdapWithTimeout, };

package/lib/rdap-types.mjs

@@ -1 +1,2 @@
-export {};
+export const MAX_RDAP_STATUSES = 100;
+export const MAX_RDAP_REDACTIONS = 100;

package/lib/rdap.mjs

@@ -4,18 +4,33 @@ import { fetchRdapFromBasesWithParser, fetchRdapRecordWithParser, } from "./rdap
 import { normalizeRdapEvents, parseRdap, summarizeLifecycle, } from "./rdap-normalization.mjs";
 import { fetchRegistrarRdapRecordWithParser, selectRegistrarRdapLink, } from "./rdap-registrar.mjs";
 import { fetchRdapDetailedWithTimeout, } from "./rdap-transport.mjs";
-import { registryServiceAdmissionFor } from "./registry-capabilities.mjs";
+import { REGISTRY_CAPABILITIES_VERSION, registryServiceAdmissionFor } from "./registry-capabilities.mjs";
+// A null record does not establish domain absence. Keep the HTTP explanation
+// aligned with the same admission decision used before bootstrap discovery.
+function rdapUnavailableResponse(type, value) {
+    const admission = type === 'domain' ? registryServiceAdmissionFor(value, 'rdap') : null;
+    if (admission?.allowed === false) {
+        return {
+            error: 'RDAP collection was not attempted because the retained registry capability policy does not admit this service.',
+            source: 'retained_registry_capability_policy',
+            capabilityVersion: REGISTRY_CAPABILITIES_VERSION,
+            limitation: admission.limitation,
+        };
+    }
+    return { error: `No RDAP registry found for "${value}" via IANA bootstrap` };
+}
 async function fetchRdapFromBases(type, value, bases, fetchUpstream = fetchRdapDetailedWithTimeout) {
     return fetchRdapFromBasesWithParser(type, value, bases, parseRdap, fetchUpstream);
 }
 async function fetchRdapRecord(type, value, options = {}) {
+    options.signal?.throwIfAborted();
     if (type === 'domain' && registryServiceAdmissionFor(value, 'rdap')?.allowed === false) {
         return null;
     }
     const fetchRecord = options.fetchRecord ?? fetchRdapRecordWithParser;
-    return fetchRecord(type, value, parseRdap);
+    return fetchRecord(type, value, parseRdap, options.signal ? { signal: options.signal } : {});
 }
 async function fetchRegistrarRdapRecord(domain, registryRecord, options = {}) {
     return fetchRegistrarRdapRecordWithParser(domain, registryRecord, parseRdap, options);
 }
-export { BOOTSTRAP_TTL_MS, BOOTSTRAP_STALE_TTL_MS, fetchBootstrap, clearRdapBootstrapCache, fetchRdapRecord, fetchRdapFromBases, fetchRegistrarRdapRecord, selectRegistrarRdapLink, uniqueBases, parseRdap, normalizeRdapEvents, summarizeLifecycle, };
+export { BOOTSTRAP_TTL_MS, BOOTSTRAP_STALE_TTL_MS, fetchBootstrap, clearRdapBootstrapCache, fetchRdapRecord, rdapUnavailableResponse, fetchRdapFromBases, fetchRegistrarRdapRecord, selectRegistrarRdapLink, uniqueBases, parseRdap, normalizeRdapEvents, summarizeLifecycle, };

package/lib/registrable-domain.mjs

@@ -1,36 +1,2 @@
-import { getDomain } from 'tldts';
-import { isValidAsciiDomainName } from "./hostname.mjs";
-// Returns one canonical registrable-domain identity for an already public DNS
-// hostname. Callers retain the original hostname separately when subdomain
-// context matters; authority, evidence binding and scoring use this value.
-export function canonicalRegistrableDomain(value) {
-    if (typeof value !== 'string')
-        return null;
-    const trimmed = value.trim();
-    if (!trimmed || /[\u0000-\u001f\u007f]/u.test(trimmed))
-        return null;
-    const withoutScheme = trimmed.replace(/^[a-z]+:\/\//iu, '').split(/[/?#]/u)[0] ?? '';
-    if (withoutScheme.endsWith('..'))
-        return null;
-    const candidate = withoutScheme.replace(/\.$/u, '');
-    if (!candidate)
-        return null;
-    let hostname;
-    try {
-        hostname = new URL(`https://${candidate}/`).hostname.toLowerCase().replace(/\.$/u, '');
-    }
-    catch {
-        return null;
-    }
-    if (!isValidAsciiDomainName(hostname, { requireDot: true, requireLowercase: true }))
-        return null;
-    // Keep this boundary identical to classifyQuery() and the collection
-    // runtime: registrable identity follows the ICANN Public Suffix List, while
-    // privately operated suffixes remain ordinary host context.
-    const domain = getDomain(hostname);
-    return domain
-        && isValidAsciiDomainName(domain, { requireDot: true, requireLowercase: true })
-        && (hostname === domain || hostname.endsWith(`.${domain}`))
-        ? domain
-        : null;
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/registrable-domain.mjs";

package/lib/registrar-standing-contract.mjs

@@ -64,7 +64,7 @@ const SOURCE_HEALTH_STATES = new Set(REGISTRAR_STANDING_SOURCE_HEALTH_STATES);
 const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/u;
 const NOTICE_ID_RE = /^notice-[1-9]\d{0,7}$/u;
 const IANA_ID_RE = /^[1-9]\d{0,7}$/u;
-function normalizedRegistrarIanaId(value) {
+export function normalizedRegistrarIanaId(value) {
     if (typeof value === 'number' && Number.isSafeInteger(value))
         value = String(value);
     if (typeof value !== 'string')
@@ -101,6 +101,7 @@ function validNullableTimestamp(value) {
 function validNullableDate(value) {
     return value === null || (typeof value === 'string'
         && ISO_DATE_RE.test(value)
+        && Number.isFinite(Date.parse(`${value}T00:00:00.000Z`))
         && new Date(`${value}T00:00:00.000Z`).toISOString().startsWith(value));
 }
 function validNullableText(value, maximum = MAX_REGISTRAR_STANDING_TEXT_LENGTH) {

package/lib/registrar-standing.mjs

@@ -5,7 +5,7 @@
 import { createHash } from 'node:crypto';
 import { REGISTRAR_STANDING_CATALOGUE } from "./generated/registrar-standing-catalogue.mjs";
 import { ICANN_COMPLIANCE_SOURCE_URL, IANA_REGISTRAR_SOURCE_URL, REGISTRAR_STANDING_CATALOGUE_SCHEMA, REGISTRAR_STANDING_CATALOGUE_VERSION, REGISTRAR_STANDING_MAX_AGE_DAYS, REGISTRAR_STANDING_MAX_FUTURE_SKEW_MS, registrarStandingOfficialSourceUrl, } from "./registrar-standing-catalogue-contract.mjs";
-import { deriveRegistrarStandingAssessment, MAX_REGISTRAR_COMPLIANCE_ACTIONS, REGISTRAR_STANDING_SCHEMA, REGISTRAR_STANDING_VERSION, } from "./registrar-standing-contract.mjs";
+import { deriveRegistrarStandingAssessment, normalizedRegistrarIanaId, MAX_REGISTRAR_COMPLIANCE_ACTIONS, REGISTRAR_STANDING_SCHEMA, REGISTRAR_STANDING_VERSION, } from "./registrar-standing-contract.mjs";
 const STATUS_BY_CODE = Object.freeze({
     A: 'accredited',
     R: 'reserved',
@@ -40,6 +40,10 @@ function ageDays(value, now) {
 function sourceHealth(value, now) {
     return ageDays(value, now) <= REGISTRAR_STANDING_MAX_AGE_DAYS ? 'current' : 'stale';
 }
+function complianceHealth(catalogue, now) {
+    return catalogue.icann.catalogueYear === now.getUTCFullYear()
+        ? sourceHealth(catalogue.icann.reviewedAt, now) : 'stale';
+}
 function validatedCatalogue(value, now) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return null;
@@ -157,14 +161,6 @@ function accreditationMap(catalogue) {
     }
     return result;
 }
-function normalizedIanaId(value) {
-    if (typeof value === 'number' && Number.isSafeInteger(value))
-        value = String(value);
-    if (typeof value !== 'string')
-        return null;
-    const trimmed = value.trim();
-    return /^\d{1,8}$/u.test(trimmed) && Number(trimmed) > 0 ? String(Number(trimmed)) : null;
-}
 function projectedActions(catalogue, ianaId) {
     const matching = catalogue.icann.notices.filter((notice) => String(notice.ianaId) === ianaId);
     const actions = matching.slice(0, MAX_REGISTRAR_COMPLIANCE_ACTIONS).map((notice) => {
@@ -183,9 +179,9 @@ export function buildRegistrarStanding(options) {
     if (!(now instanceof Date) || !Number.isFinite(now.getTime()))
         throw new TypeError('Registrar standing time must be valid.');
     const catalogue = validatedCatalogue(options.catalogue ?? REGISTRAR_STANDING_CATALOGUE, now);
-    const ianaId = normalizedIanaId(options.registrarIanaId);
+    const ianaId = normalizedRegistrarIanaId(options.registrarIanaId);
     const ianaHealth = catalogue ? sourceHealth(catalogue.iana.observedAt, now) : 'unavailable';
-    const icannHealth = catalogue ? sourceHealth(catalogue.icann.reviewedAt, now) : 'unavailable';
+    const icannHealth = catalogue ? complianceHealth(catalogue, now) : 'unavailable';
     const accreditation = catalogue && ianaId
         ? accreditationMap(catalogue).get(ianaId) ?? 'unknown'
         : 'unknown';
@@ -205,7 +201,7 @@ export function buildRegistrarStanding(options) {
             ? `The reviewed ${catalogue.icann.catalogueYear} ICANN index is not a complete enforcement history and excludes third-party allegations.`
             : 'The checked-in official-source catalogue could not be validated, so registrar standing is unavailable.',
         ...(!ianaId ? ['No single numeric registrar IANA ID was available across the registration evidence, so no registrar match was attempted.'] : []),
-        ...(combinedHealth === 'stale' ? ['The catalogue is past its review-age threshold; current absence and accreditation conclusions require a refresh.'] : []),
+        ...(combinedHealth === 'stale' ? ['The catalogue is outside its current-year coverage or review-age threshold; current absence and accreditation conclusions require a refresh.'] : []),
     ].slice(0, 4);
     const nextActions = hasAction ? [
         'Open the official notice and verify its dates, scope, and current outcome before acting.',
@@ -259,7 +255,7 @@ export function registrarStandingCatalogueHealth(now = new Date(), value = REGIS
         });
     const age = Math.max(ageDays(catalogue.iana.observedAt, now), ageDays(catalogue.icann.reviewedAt, now));
     return Object.freeze({
-        state: age <= REGISTRAR_STANDING_MAX_AGE_DAYS ? 'current' : 'stale',
+        state: age <= REGISTRAR_STANDING_MAX_AGE_DAYS && complianceHealth(catalogue, now) === 'current' ? 'current' : 'stale',
         sourceObservedAt: [catalogue.iana.observedAt, catalogue.icann.reviewedAt]
             .sort((left, right) => Date.parse(left) - Date.parse(right))[0] ?? null,
         ageDays: age,

package/lib/registry-capabilities.mjs

@@ -1,5 +1,5 @@
 // Registry capability evaluation over the immutable reviewed catalogue.
-import { CAPABILITY_BY_SUFFIX, DEFAULT_CAPABILITY, EXPLICIT_CAPABILITIES, MAX_CAPABILITY_INPUT_LENGTH, REGISTRY_CAPABILITIES_VERSION, REGISTRY_STANDARDS_COVERAGE_SNAPSHOT, VERSION_26_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, } from "./registry-capability-catalogue.mjs";
+import { CAPABILITY_BY_SUFFIX, DEFAULT_CAPABILITY, EXPLICIT_CAPABILITIES, MAX_CAPABILITY_INPUT_LENGTH, REGISTRY_CAPABILITIES_VERSION, REGISTRY_STANDARDS_COVERAGE_SNAPSHOT, REVIEWED_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, } from "./registry-capability-catalogue.mjs";
 const IANA_TLD_RECORD_PREFIX = 'https://www.iana.org/domains/root/db/';
 function documentationUrlsForSuffix(capability, suffixes) {
     if (suffixes.length !== 1 || capability.suffixes.length <= 1) {
@@ -98,7 +98,11 @@ function registryServiceAdmissionFor(value, service) {
     if (!capability || (service !== 'rdap' && service !== 'whois'))
         return null;
     if (service === 'rdap') {
-        const allowed = capability.rdapAccessProfile === 'iana-bootstrap';
+        // A retained absence is a discovery hint, not an access restriction.
+        // Both current profiles permit bounded bootstrap discovery; unknown or
+        // future restriction profiles remain denied until explicitly handled.
+        const allowed = capability.rdapAccessProfile === 'iana-bootstrap'
+            || capability.rdapAccessProfile === 'no-iana-service';
         return {
             service,
             state: allowed ? 'allowed' : 'unsupported',
@@ -147,4 +151,4 @@ function registryCompatibilityMatrix() {
     })))
         .sort((left, right) => (left.suffixes[0] ?? '').localeCompare(right.suffixes[0] ?? ''));
 }
-export { REGISTRY_CAPABILITIES_VERSION, VERSION_26_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, registryCapabilityFor, registryCompatibilityMatrix, listRegistryCapabilities, registryAccessDiagnosticFor, registryServiceAdmissionFor, registryStandardsCoverageSnapshot, };
+export { REGISTRY_CAPABILITIES_VERSION, REVIEWED_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, registryCapabilityFor, registryCompatibilityMatrix, listRegistryCapabilities, registryAccessDiagnosticFor, registryServiceAdmissionFor, registryStandardsCoverageSnapshot, };

package/lib/registry-capability-catalogue.mjs

@@ -1,17 +1,18 @@
 // Registry compatibility metadata. IANA bootstrap and referral discovery
 // remain authoritative. Explicit query profiles may alter only the first
 // referred registry query after a fixture-backed adapter is integrated.
-const REGISTRY_CAPABILITIES_VERSION = 29;
+export const REGISTRY_STANDARDS_COVERAGE_SCHEMA = 'whoisleuth.registry-standards-coverage';
+const REGISTRY_CAPABILITIES_VERSION = 31;
 const MAX_CAPABILITY_INPUT_LENGTH = 253;
 const REGISTRY_STANDARDS_COVERAGE_SNAPSHOT = Object.freeze({
-    schema: 'whoisleuth.registry-standards-coverage',
+    schema: REGISTRY_STANDARDS_COVERAGE_SCHEMA,
     version: 1,
-    verifiedAt: '2026-08-03',
+    verifiedAt: '2026-10-03',
     sources: Object.freeze({
-        rootZoneVersion: '2026080200',
-        rootZoneLastUpdatedAt: '2026-08-02T07:07:01.000Z',
-        rootZoneTldSetSha256: 'aa0a75a9860b2cba07d7fe8172f4546d981be3674bf6764fb0d5f39a45940d25',
-        rdapBootstrapPublication: '2026-07-23T02:00:03.000Z',
+        rootZoneVersion: '2026100200',
+        rootZoneLastUpdatedAt: '2026-10-02T07:07:02.000Z',
+        rootZoneTldSetSha256: '71093802743b87ee52fac5dd4f662cafd0133dae5089ac6c2e34ee73cebfc836',
+        rdapBootstrapPublication: '2026-09-30T23:00:03.000Z',
         rdapBootstrapVersion: '1.0',
         urls: Object.freeze([
             'https://data.iana.org/TLD/tlds-alpha-by-domain.txt',
@@ -20,15 +21,15 @@ const REGISTRY_STANDARDS_COVERAGE_SNAPSHOT = Object.freeze({
         ]),
     }),
     counts: Object.freeze({
-        activeTlds: 1438,
+        activeTlds: 1437,
         countryCode: 309,
-        nonCountryCode: 1129,
-        generic: 1111,
+        nonCountryCode: 1128,
+        generic: 1110,
         genericRestricted: 3,
         sponsored: 14,
         infrastructure: 1,
-        rdapBootstrapServiceGroups: 590,
-        genericAndRestrictedRdapCovered: 1114,
+        rdapBootstrapServiceGroups: 592,
+        genericAndRestrictedRdapCovered: 1113,
         sponsoredRdapCovered: 12,
         infrastructureRdapCovered: 0,
     }),
@@ -81,7 +82,7 @@ const VERSION_16_NO_IANA_MACHINE_SERVICE_SUFFIXES = Object.freeze([
 ]);
 const VERSION_19_NO_IANA_MACHINE_SERVICE_SUFFIXES = Object.freeze([
     'xn--mgbai9azgqp6j', 'xn--mgbayh7gpa', 'xn--mgbc0a9azcg',
-    'xn--mgbcpq6gpa1a', 'xn--mgbpl2fh', 'xn--wgbh1c',
+    'xn--mgbpl2fh', 'xn--wgbh1c',
 ]);
 const VERSION_19_RDAP_ONLY_SUFFIXES = Object.freeze(['na', 'pn']);
 const VERSION_20_FIXTURE_SUFFIXES = Object.freeze([
@@ -116,13 +117,13 @@ const VERSION_24_PROMOTED_SUFFIXES = Object.freeze([
     'xn--90ae', 'xn--l1acc', 'xn--wgbl6a',
 ]);
 const CURRENT_UNVERIFIED_REFERRAL_SUFFIXES = Object.freeze(VERSION_23_UNVERIFIED_REFERRAL_SUFFIXES.filter((suffix) => !VERSION_24_PROMOTED_SUFFIXES.includes(suffix)));
-const VERSION_26_NO_RDAP_SUFFIXES = Object.freeze([
+const REVIEWED_NO_RDAP_SUFFIXES = Object.freeze([
     'ac', 'ae', 'af', 'am', 'at', 'be', 'bg', 'by', 'cl', 'cn',
     'co', 'de', 'dk', 'ee', 'eu', 'gf', 'gi', 'gt', 'hk', 'hr',
-    'hu', 'ie', 'il', 'io', 'ir', 'it', 'jp', 'kr', 'kz', 'la',
+    'hu', 'ie', 'il', 'io', 'ir', 'it', 'jp', 'kz', 'la',
     'lt', 'lu', 'lv', 'md', 'me', 'mk', 'mo', 'mq', 'mx', 'my',
     'nz', 'pk', 'pt', 'ro', 'rs', 'ru', 'sa', 'se', 'sk', 'su',
-    'tn', 'tr', 'us', 'vc', 'xn--2scrj9c', 'xn--3e0b707e',
+    'tn', 'tr', 'us', 'vc', 'xn--2scrj9c',
     'xn--3hcrj9c', 'xn--45br5cyl', 'xn--45brj9c', 'xn--80ao21a',
     'xn--90a3ac', 'xn--90ais', 'xn--d1alf', 'xn--e1a4c',
     'xn--fiqs8s', 'xn--fiqz9s', 'xn--fpcrj9c3d', 'xn--gecrj9c',
@@ -131,7 +132,7 @@ const VERSION_26_NO_RDAP_SUFFIXES = Object.freeze([
     'xn--qxa6a', 'xn--rvc1e0am3e', 'xn--s9brj9c',
     'xn--xkc2dl3a5ee0h', 'xn--y9a3aq',
 ]);
-const VERSION_26_NO_RDAP_SUFFIX_SET = new Set(VERSION_26_NO_RDAP_SUFFIXES);
+const REVIEWED_NO_RDAP_SUFFIX_SET = new Set(REVIEWED_NO_RDAP_SUFFIXES);
 const VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES = Object.freeze([
     'app', 'boo', 'channel', 'dad', 'day', 'dev', 'esq', 'foo', 'how', 'info',
     'ing', 'meme', 'mov', 'new', 'nexus', 'page', 'phd', 'prof', 'rsvp', 'soy',
@@ -311,6 +312,14 @@ const EXPLICIT_CAPABILITY_SEEDS = [
         documentationUrls: [`https://www.iana.org/domains/root/db/${suffix}.html`],
         limitation: RDAP_ONLY_MACHINE_SERVICE_LIMITATION,
     })),
+    {
+        id: 'no-iana-machine-service-xn--mgbcpq6gpa1a', suffixes: ['xn--mgbcpq6gpa1a'], registryClass: 'country-code',
+        whoisParserProfile: 'generic-colon', fixtureScenarios: [],
+        coverageState: 'access_documented', whoisAccessProfile: 'no-iana-service',
+        rdapAccessProfile: 'iana-bootstrap', verificationFiles: [],
+        documentationUrls: ['https://www.iana.org/domains/root/db/xn--mgbcpq6gpa1a.html'],
+        limitation: RDAP_ONLY_MACHINE_SERVICE_LIMITATION,
+    },
     ...VERSION_20_FIXTURE_SUFFIXES.map((suffix) => ({
         id: `iana-cc-colon-${suffix}`,
         suffixes: [suffix],
@@ -1043,7 +1052,7 @@ const EXPLICIT_CAPABILITY_SEEDS = [
     {
         id: 'nic-bh-icann-colon', suffixes: ['bh'], registryClass: 'country-code',
         whoisParserProfile: 'icann-style-colon', fixtureScenarios: ['registered', 'not_found'],
-        rdapAccessProfile: 'no-iana-service',
+        rdapAccessProfile: 'iana-bootstrap',
         documentationUrls: ['https://www.iana.org/domains/root/db/bh.html'],
     },
     {
@@ -1180,7 +1189,7 @@ const EXPLICIT_CAPABILITY_SEEDS = [
 ];
 function resolvedSeedRdapAccessProfile(entry) {
     const declared = entry.rdapAccessProfile || 'iana-bootstrap';
-    const resolved = new Set(entry.suffixes.map((suffix) => (VERSION_26_NO_RDAP_SUFFIX_SET.has(suffix) ? 'no-iana-service' : declared)));
+    const resolved = new Set(entry.suffixes.map((suffix) => (REVIEWED_NO_RDAP_SUFFIX_SET.has(suffix) ? 'no-iana-service' : declared)));
     if (resolved.size !== 1) {
         throw new Error(`Registry capability ${entry.id} mixes RDAP access profiles and must be split by suffix.`);
     }
@@ -1214,4 +1223,4 @@ for (const capability of EXPLICIT_CAPABILITIES) {
         CAPABILITY_BY_SUFFIX.set(suffix, capability);
     }
 }
-export { REGISTRY_CAPABILITIES_VERSION, MAX_CAPABILITY_INPUT_LENGTH, VERSION_26_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, REGISTRY_STANDARDS_COVERAGE_SNAPSHOT, DEFAULT_CAPABILITY, EXPLICIT_CAPABILITIES, CAPABILITY_BY_SUFFIX, };
+export { REGISTRY_CAPABILITIES_VERSION, MAX_CAPABILITY_INPUT_LENGTH, REVIEWED_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, REGISTRY_STANDARDS_COVERAGE_SNAPSHOT, DEFAULT_CAPABILITY, EXPLICIT_CAPABILITIES, CAPABILITY_BY_SUFFIX, };

package/lib/registry-dates.mjs

@@ -1,190 +1,2 @@
-// Deterministic normalization for lifecycle dates published by RDAP and
-// WHOIS services. Raw upstream strings remain the provenance source; these
-// helpers only produce additive Date/ISO companions for comparison, storage,
-// and presentation.
-const REGISTRY_MONTHS = Object.freeze({
-    jan: 1, feb: 2, mar: 3, apr: 4, may: 5, jun: 6,
-    jul: 7, aug: 8, sep: 9, oct: 10, nov: 11, dec: 12,
-});
-const REGISTRY_MONTH_NAMES = Object.freeze({
-    january: 1, february: 2, march: 3, april: 4, may: 5, june: 6,
-    july: 7, august: 8, september: 9, october: 10, november: 11, december: 12,
-});
-function utcDateFromParts(year, month, day, hour = 0, minute = 0, second = 0, millisecond = 0) {
-    if (![year, month, day, hour, minute, second, millisecond].every(Number.isInteger))
-        return null;
-    if (year < 1000 || year > 9999 || month < 1 || month > 12 || day < 1
-        || hour < 0 || hour > 23 || minute < 0 || minute > 59
-        || second < 0 || second > 59 || millisecond < 0 || millisecond > 999)
-        return null;
-    const date = new Date(Date.UTC(year, month - 1, day, hour, minute, second, millisecond));
-    if (date.getUTCFullYear() !== year || date.getUTCMonth() !== month - 1 || date.getUTCDate() !== day
-        || date.getUTCHours() !== hour || date.getUTCMinutes() !== minute
-        || date.getUTCSeconds() !== second || date.getUTCMilliseconds() !== millisecond)
-        return null;
-    return date;
-}
-// Parse the explicit non-ISO formats observed across supported ccTLD WHOIS
-// services before considering ISO-shaped input. Runtime Date parsing treats
-// dotted dates ambiguously and timezone-less timestamps in the host's local
-// timezone, so every accepted shape is validated and normalized through UTC.
-function parseRegistryDate(input) {
-    if (typeof input !== 'string')
-        return null;
-    // The documented .nz WHOIS examples place one space before the RFC3339
-    // `T` separator. Canonicalize that registry-specific presentation quirk
-    // before applying the existing strict ISO-shaped parser.
-    const value = input.trim()
-        .replace(/^(\d{4}-\d{2}-\d{2})[ ]+[Tt](?=\d{2}:)/, '$1T')
-        // The .ee WHOIS service separates an otherwise ISO-shaped numeric
-        // timezone from its clock with one space.
-        .replace(/^(\d{4}-\d{2}-\d{2}[Tt ]\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?)[ ]+([+-]\d{2}:?\d{2})$/, '$1$2');
-    if (!value)
-        return null;
-    // DD.MM.YYYY[ HH:MM:SS] - e.g. 14.03.2024 10:46:48
-    let match = value.match(/^(\d{1,2})\.(\d{1,2})\.(\d{4})(?:\s+(\d{1,2}):(\d{2}):(\d{2}))?$/);
-    if (match) {
-        const [, day = '', month = '', year = '', hour = '0', minute = '0', second = '0'] = match;
-        return utcDateFromParts(+year, +month, +day, +(hour || 0), +(minute || 0), +(second || 0));
-    }
-    // YYYY. MM. DD. - e.g. 2006. 09. 18.
-    match = value.match(/^(\d{4})\.\s*(\d{1,2})\.\s*(\d{1,2})\.?$/);
-    if (match) {
-        const [, year = '', month = '', day = ''] = match;
-        return utcDateFromParts(+year, +month, +day);
-    }
-    // YYYY.MM.DD HH:MM:SS - used by NASK's .pl WHOIS service.
-    match = value.match(/^(\d{4})\.(\d{1,2})\.(\d{1,2})\s+(\d{1,2}):(\d{2}):(\d{2})$/);
-    if (match) {
-        const [, year = '', month = '', day = '', hour = '', minute = '', second = ''] = match;
-        return utcDateFromParts(+year, +month, +day, +hour, +minute, +second);
-    }
-    // YYYY/MM/DD - an unambiguous year-first form used by CIRA WHOIS.
-    match = value.match(/^(\d{4})\/(\d{1,2})\/(\d{1,2})$/);
-    if (match) {
-        const [, year = '', month = '', day = ''] = match;
-        return utcDateFromParts(+year, +month, +day);
-    }
-    // YYYYMMDD with an optional time or Registro.br contact-reference suffix.
-    // The raw value remains available as provenance while the validated date
-    // and optional clock time are projected into the additive ISO companion.
-    match = value.match(/^(\d{4})(\d{2})(\d{2})(?:\s+(\d{1,2}):(\d{2}):(\d{2})|\s+#[0-9]{1,20})?$/);
-    if (match) {
-        const [, year = '', month = '', day = '', hour = '0', minute = '0', second = '0'] = match;
-        return utcDateFromParts(+year, +month, +day, +(hour || 0), +(minute || 0), +(second || 0));
-    }
-    // YYYY-Mon-DD. - e.g. 1999-Feb-16.
-    match = value.match(/^(\d{4})-([A-Za-z]{3})-(\d{1,2})\.?$/);
-    if (match) {
-        const month = REGISTRY_MONTHS[(match[2] ?? '').toLowerCase()];
-        return month ? utcDateFromParts(+(match[1] ?? ''), month, +(match[3] ?? '')) : null;
-    }
-    // DD-Mon-YYYY[ HH:MM:SS] - used by several ICANN-style ccTLD services.
-    match = value.match(/^(\d{1,2})-([A-Za-z]{3})-(\d{4})(?:\s+(\d{1,2}):(\d{2}):(\d{2}))?$/);
-    if (match) {
-        const month = REGISTRY_MONTHS[(match[2] ?? '').toLowerCase()];
-        return month
-            ? utcDateFromParts(+(match[3] ?? ''), month, +(match[1] ?? ''), +(match[4] || 0), +(match[5] || 0), +(match[6] || 0))
-            : null;
-    }
-    // DD-MM-YYYY - the day-first form published by the currently profiled
-    // registries that use bare numeric hyphen dates. A future month-first
-    // source must receive its own marker-gated parser rather than reusing this
-    // global shape. The four-digit final year remains distinct from ISO below.
-    match = value.match(/^(\d{1,2})-(\d{1,2})-(\d{4})$/);
-    if (match) {
-        const [, day = '', month = '', year = ''] = match;
-        return utcDateFromParts(+year, +month, +day);
-    }
-    // YYYY-MM-DD HH:MM:SS (GMT+H:MM) - the explicit offset form published by
-    // the Kazakhstan registry. Parentheses and the GMT marker are required so
-    // unrelated prose is not accepted as a lifecycle timestamp.
-    match = value.match(/^(\d{4})-(\d{2})-(\d{2})\s+(\d{2}):(\d{2}):(\d{2})\s+\(GMT([+-])(\d{1,2}):(\d{2})\)$/i);
-    if (match) {
-        const [, year = '', month = '', day = '', hour = '', minute = '', second = '', sign = '', offsetHours = '', offsetMinutes = '',] = match;
-        const local = utcDateFromParts(+year, +month, +day, +hour, +minute, +second);
-        if (!local || +offsetHours > 23 || +offsetMinutes > 59)
-            return null;
-        const offsetMs = (+offsetHours * 60 + +offsetMinutes) * 60000;
-        return new Date(local.getTime() + (sign === '+' ? -offsetMs : offsetMs));
-    }
-    // DD-MM-YYYY HH:MM:SS GMT+H - the Tunisian registry's bounded local-time
-    // presentation. Accept an optional minute component but require the GMT
-    // marker and validate the calendar and offset before normalization.
-    match = value.match(/^(\d{1,2})-(\d{1,2})-(\d{4})\s+(\d{2}):(\d{2}):(\d{2})\s+GMT([+-])(\d{1,2})(?::(\d{2}))?$/i);
-    if (match) {
-        const [, day = '', month = '', year = '', hour = '', minute = '', second = '', sign = '', offsetHours = '', offsetMinutes = '0',] = match;
-        const local = utcDateFromParts(+year, +month, +day, +hour, +minute, +second);
-        if (!local || +offsetHours > 23 || +offsetMinutes > 59)
-            return null;
-        const offsetMs = (+offsetHours * 60 + +offsetMinutes) * 60000;
-        return new Date(local.getTime() + (sign === '+' ? -offsetMs : offsetMs));
-    }
-    // DD Mon YYYY - the compact English month form published by THNIC.
-    match = value.match(/^(\d{1,2})\s+([A-Za-z]{3})\s+(\d{4})$/);
-    if (match) {
-        const month = REGISTRY_MONTHS[(match[2] ?? '').toLowerCase()];
-        return month ? utcDateFromParts(+(match[3] ?? ''), month, +(match[1] ?? '')) : null;
-    }
-    // Ordinal-day Month YYYY[ at HH:MM:SS.sss] - the English form published
-    // by the Channel Islands registry. The suffix and `at` token are required
-    // so ordinary prose containing a month name is not accepted as lifecycle
-    // evidence.
-    match = value.match(/^(\d{1,2})(st|nd|rd|th)\s+([A-Za-z]{3,9})\s+(\d{4})(?:\s+at\s+(\d{1,2}):(\d{2}):(\d{2})(?:\.(\d{1,3}))?)?$/i);
-    if (match) {
-        const day = +(match[1] ?? '');
-        const suffix = (match[2] ?? '').toLowerCase();
-        const expectedSuffix = day % 100 >= 11 && day % 100 <= 13
-            ? 'th'
-            : ({ 1: 'st', 2: 'nd', 3: 'rd' }[day % 10] || 'th');
-        if (suffix !== expectedSuffix)
-            return null;
-        const monthText = (match[3] ?? '').toLowerCase();
-        const month = REGISTRY_MONTH_NAMES[monthText] || REGISTRY_MONTHS[monthText];
-        const millisecond = match[8] ? Number(`${match[8]}00`.slice(0, 3)) : 0;
-        return month
-            ? utcDateFromParts(+(match[4] ?? ''), month, day, +(match[5] || 0), +(match[6] || 0), +(match[7] || 0), millisecond)
-            : null;
-    }
-    // Ddd Mon DD YYYY[ HH:MM:SS] - the English textual form used by the
-    // Belgian registry. Weekday text is presentation-only; the validated
-    // calendar components determine the canonical UTC companion.
-    match = value.match(/^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s+([A-Za-z]{3})\s+(\d{1,2})\s+(\d{4})(?:\s+(\d{1,2}):(\d{2}):(\d{2}))?$/i);
-    if (match) {
-        const month = REGISTRY_MONTHS[(match[1] ?? '').toLowerCase()];
-        return month
-            ? utcDateFromParts(+(match[3] ?? ''), month, +(match[2] ?? ''), +(match[4] || 0), +(match[5] || 0), +(match[6] || 0))
-            : null;
-    }
-    // Month DD YYYY - ISNIC publishes English month names with variable
-    // spacing and no timezone. Keep the accepted shape narrow and accept only
-    // the twelve exact English names from a fixed table.
-    match = value.match(/^([A-Za-z]{3,9})\s+(\d{1,2})\s+(\d{4})$/);
-    if (match) {
-        const month = REGISTRY_MONTH_NAMES[(match[1] ?? '').toLowerCase()];
-        return month ? utcDateFromParts(+(match[3] ?? ''), month, +(match[2] ?? '')) : null;
-    }
-    // ISO 8601-shaped dates and timestamps. A missing timezone is deliberately
-    // interpreted as UTC so Express and function deployments agree.
-    match = value.match(/^(\d{4})-(\d{2})-(\d{2})(?:[Tt ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(?:([Zz])|([+-])(\d{2}):?(\d{2}))?)?$/);
-    if (!match)
-        return null;
-    const [, year = '', month = '', day = '', hour = '0', minute = '0', second = '0', fraction, zulu, offsetSign, offsetHours = '0', offsetMinutes = '0',] = match;
-    const millisecond = fraction ? Number(`${fraction}000`.slice(0, 3)) : 0;
-    const local = utcDateFromParts(+year, +month, +day, +(hour || 0), +(minute || 0), +(second || 0), millisecond);
-    if (!local)
-        return null;
-    if (!offsetSign || zulu)
-        return local;
-    const offsetHour = +offsetHours;
-    const offsetMinute = +offsetMinutes;
-    if (offsetHour > 23 || offsetMinute > 59)
-        return null;
-    const offsetMs = (offsetHour * 60 + offsetMinute) * 60000;
-    return new Date(local.getTime() + (offsetSign === '+' ? -offsetMs : offsetMs));
-}
-function registryDateIso(value) {
-    const date = parseRegistryDate(value);
-    return date ? date.toISOString() : null;
-}
-export { parseRegistryDate, registryDateIso };
+// Stable source-facing entry point; portable consumers use the evidence owner.
+export { parseRegistryDate, registryDateIso } from "../packages/evidence/registry-dates.mjs";