@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/lib/opportunity-scoring.mjs

@@ -1,107 +1,2 @@
-import { buildScoreEvidenceQuality, } from "./scoring-evidence-quality.mjs";
-export const OPPORTUNITY_MODEL_VERSION = 2;
-export const OPPORTUNITY_REVIEW_THRESHOLD = 70;
-const STATE_BASE = Object.freeze({
-    available: 82,
-    for_sale: 70,
-    expiring: 52,
-    registered: 22,
-});
-const STATE_LABELS = Object.freeze({
-    available: 'available',
-    for_sale: 'registered with a sale signal',
-    expiring: 'registered in a lifecycle transition',
-    registered: 'registered',
-});
-function finite(value) {
-    return typeof value === 'number' && Number.isFinite(value) ? value : null;
-}
-function formatAge(days) {
-    if (days < 60)
-        return `${Math.max(0, Math.round(days))}d old`;
-    const years = days / 365.25;
-    return years < 1 ? `${Math.round(days / 30)}mo old` : `${years.toFixed(1)}y old`;
-}
-function addFactor(factors, dimensions, family, label, delta) {
-    factors.push({ family, label, delta });
-    dimensions.set(family, (dimensions.get(family) ?? 0) + delta);
-}
-export function normalizeOpportunityModelVersion(value) {
-    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0 && value <= 1000 ? value : null;
-}
-// Opportunity is acquisition readiness, not price, value, eligibility, or a
-// prediction that a registration will lapse. It uses only bounded evidence
-// already collected for the current lookup.
-export function explainOpportunityScore(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return null;
-    const input = value;
-    const state = input.availability ?? input.state;
-    if (typeof state !== 'string' || !Object.hasOwn(STATE_BASE, state))
-        return null;
-    const factors = [];
-    const dimensions = new Map();
-    addFactor(factors, dimensions, 'registration', `Base readiness for “${STATE_LABELS[state] ?? state}”`, STATE_BASE[state] ?? 0);
-    if (input.confidence === 'high')
-        addFactor(factors, dimensions, 'registration', 'High-confidence registration decision', 8);
-    else if (input.confidence === 'medium')
-        addFactor(factors, dimensions, 'registration', 'Medium-confidence registration decision', 3);
-    else if (input.confidence === 'low')
-        addFactor(factors, dimensions, 'registration', 'Low-confidence registration decision', -8);
-    if (state === 'for_sale')
-        addFactor(factors, dimensions, 'listing', 'Bounded sale signal observed; listing remains unverified', 6);
-    else if (input.activityStatus === 'parked')
-        addFactor(factors, dimensions, 'listing', 'Parked page observed without a verified sale offer', 3);
-    else if (state === 'registered' && input.activityStatus === 'active') {
-        addFactor(factors, dimensions, 'listing', 'Active website suggests an in-use registration', -12);
-    }
-    if (input.hasPublicRegistrantContact === true) {
-        addFactor(factors, dimensions, 'contactability', 'Public registrant contact route observed; acquisition suitability is not established', 10);
-    }
-    const expiresInDays = finite(input.expiresInDays);
-    if (state === 'registered' && expiresInDays !== null && expiresInDays >= 0 && expiresInDays < 30) {
-        addFactor(factors, dimensions, 'lifecycle', 'Published expiry is within 30 days; release is not implied', 4);
-    }
-    if (typeof input.privacyProtected === 'boolean') {
-        addFactor(factors, dimensions, 'contactability', 'Registration privacy is neutral; it does not establish contactability', 0);
-    }
-    const ageDays = finite(input.domainAgeDays);
-    if (ageDays !== null && ageDays >= 0) {
-        addFactor(factors, dimensions, 'registration', `Domain age (${formatAge(ageDays)}) is context only`, 0);
-    }
-    const rawScore = Math.round(factors.reduce((total, factor) => total + factor.delta, 0));
-    const score = Math.max(0, Math.min(100, rawScore));
-    const dimensionLabels = {
-        registration: 'Registration certainty',
-        listing: 'Listing readiness',
-        contactability: 'Contactability',
-        lifecycle: 'Lifecycle timing',
-    };
-    const observedFamilies = [...dimensions.keys()];
-    const evidenceQuality = buildScoreEvidenceQuality(input, {
-        expectedDepth: 'fast',
-        observedFamilies,
-        expectedFamilies: ['registration'],
-    });
-    return {
-        modelVersion: OPPORTUNITY_MODEL_VERSION,
-        score,
-        rawScore,
-        capped: score !== rawScore,
-        factors,
-        dimensions: [...dimensions.entries()].map(([id, contribution]) => ({ id, label: dimensionLabels[id], contribution })),
-        evidenceQuality,
-    };
-}
-export function computeOpportunityScore(value) {
-    return explainOpportunityScore(value)?.score ?? null;
-}
-export function opportunityTone(score) {
-    if (score === null)
-        return 'neutral';
-    if (score >= OPPORTUNITY_REVIEW_THRESHOLD)
-        return 'good';
-    if (score >= 40)
-        return 'neutral';
-    return 'warn';
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/opportunity-scoring.mjs";

package/lib/outbound-identity.mjs

@@ -1,5 +1,5 @@
 import { WHOISLEUTH_APPLICATION_VERSION } from "./application-version.mjs";
-import { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL, } from "./project-metadata.mjs";
+import { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL, } from "../packages/analysis/project-metadata.mjs";
 export { WHOISLEUTH_PROJECT_URL, WHOISLEUTH_REQUEST_POLICY_URL };
 export const WHOISLEUTH_USER_AGENT_VERSION = WHOISLEUTH_APPLICATION_VERSION;
 export const WHOISLEUTH_USER_AGENT = `WHOISleuth/${WHOISLEUTH_USER_AGENT_VERSION} (+${WHOISLEUTH_REQUEST_POLICY_URL})`;

package/lib/page-fingerprints.mjs

@@ -64,7 +64,24 @@ function reduceDynamicValues(value) {
         .replace(/\b\d{4}-\d{1,2}-\d{1,2}(?:[t\s]\d{1,2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:z|[+-]\d{2}:?\d{2})?)?\b/gi, '<time>')
         .replace(/\b\d{10,13}\b/g, '<time>')
         .replace(/\b[a-f0-9]{16,}\b/gi, '<id>')
-        .replace(/\b(?=[a-z0-9_-]{20,}\b)(?=[a-z0-9_-]*[a-z])(?=[a-z0-9_-]*\d)[a-z0-9_-]+\b/gi, '<id>');
+        .replace(/[a-z0-9_-]+/gi, (token) => {
+        // Visit each maximal token once. Repeated lookaheads at word boundaries
+        // rescan hyphenated text quadratically when a required digit is absent.
+        // Only hyphens are outside the former ASCII word-boundary match;
+        // underscores remain part of the identifier, including at either end.
+        let start = 0;
+        let end = token.length;
+        while (start < end && token[start] === '-')
+            start += 1;
+        while (end > start && token[end - 1] === '-')
+            end -= 1;
+        if (end - start < 20)
+            return token;
+        const identifier = token.slice(start, end);
+        return /[a-z]/i.test(identifier) && /\d/.test(identifier)
+            ? `${token.slice(0, start)}<id>${token.slice(end)}`
+            : token;
+    });
 }
 function normalizeText(value, maxLength = 512) {
     const normalized = reduceDynamicValues(String(value || ''))

package/lib/perceptual-hash-comparison.mjs

@@ -1,34 +1,2 @@
-// Browser-safe comparison contract for the 64-bit perceptual hashes produced
-// by the bounded image decoder. Keeping comparison and informativeness here
-// prevents Node and browser consumers from drifting into different matches.
-export const PERCEPTUAL_HASH_HEX_RE = /^[0-9a-f]{16}$/u;
-export const MIN_INFORMATIVE_HASH_BITS = 10;
-const POPCOUNT = new Uint8Array(16);
-for (let index = 0; index < POPCOUNT.length; index += 1) {
-    POPCOUNT[index] = (index & 1) + ((index >> 1) & 1) + ((index >> 2) & 1) + ((index >> 3) & 1);
-}
-export function isPerceptualHash(value) {
-    return typeof value === 'string' && PERCEPTUAL_HASH_HEX_RE.test(value);
-}
-function popcountHex(hex) {
-    let bits = 0;
-    for (let index = 0; index < hex.length; index += 1) {
-        bits += POPCOUNT[parseInt(hex.charAt(index), 16)] ?? 0;
-    }
-    return bits;
-}
-export function isInformativePerceptualHash(value) {
-    if (!isPerceptualHash(value))
-        return false;
-    const bits = popcountHex(value);
-    return bits >= MIN_INFORMATIVE_HASH_BITS && bits <= 64 - MIN_INFORMATIVE_HASH_BITS;
-}
-export function hammingDistanceHex(left, right) {
-    if (!isPerceptualHash(left) || !isPerceptualHash(right))
-        return null;
-    let distance = 0;
-    for (let index = 0; index < 16; index += 1) {
-        distance += POPCOUNT[parseInt(left.charAt(index), 16) ^ parseInt(right.charAt(index), 16)] ?? 0;
-    }
-    return distance;
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/perceptual-hash-comparison.mjs";

package/lib/perceptual-hash.mjs

@@ -21,11 +21,23 @@
 // case, while staying cheap (no DCT). Output is 16 lowercase hex chars;
 // similarity is the Hamming distance between two such strings.
 import * as zlib from 'node:zlib';
-import { hammingDistanceHex, isInformativePerceptualHash, } from "./perceptual-hash-comparison.mjs";
+import { hammingDistanceHex, isInformativePerceptualHash, } from "../packages/analysis/perceptual-hash-comparison.mjs";
 // Bound the decode work on attacker-controlled image bytes. Real favicons top
 // out around 256x256; larger inputs above this ceiling remain exact-only
 // evidence rather than causing unbounded pixel allocation.
 const MAX_DIM = 1024;
+// Permit two maximum-sized decode attempts (more than a normal resolution
+// pyramid), while bounding aggregate inflation/filtering across a container.
+// Encoded payloads may consume at most the container's byte length in total;
+// ordinary non-overlapping entries never exceed that bound.
+const MAX_DECODE_PIXELS = 2 * MAX_DIM * MAX_DIM;
+function admitPixels(work, width, height) {
+    const count = width * height;
+    if (count > work.pixels)
+        return false;
+    work.pixels -= count;
+    return true;
+}
 const PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
 function byteAt(bytes, index) {
     return bytes[index] ?? 0;
@@ -53,7 +65,7 @@ function paethPredictor(a, b, c) {
 // { width, height, pixels } with pixels as RGBA bytes, or null for anything
 // outside that subset (or malformed input). CRCs are intentionally not
 // verified - we're computing a fuzzy hash, not validating integrity.
-function decodePng(buf) {
+function decodePng(buf, work) {
     const CHANNELS = { 0: 1, 2: 3, 3: 1, 4: 2, 6: 4 };
     let width = 0;
     let height = 0;
@@ -90,7 +102,7 @@ function decodePng(buf) {
             transparency = data;
         }
         else if (type === 'IDAT') {
-            idatParts.push(Buffer.from(data));
+            idatParts.push(data);
         }
         else if (type === 'IEND') {
             break;
@@ -113,6 +125,8 @@ function decodePng(buf) {
         return null;
     if (idatParts.length === 0)
         return null;
+    if (!admitPixels(work, width, height))
+        return null;
     // A valid non-interlaced 8-bit PNG decompresses to exactly one filter byte
     // plus one scanline per row. Cap the inflate at that size so a malicious
     // IDAT can't expand a sub-200KB favicon into hundreds of MB (a zip bomb)
@@ -218,7 +232,7 @@ function decodePng(buf) {
 // palettized and 24/32-bit truecolour. The stored height is doubled (it
 // includes the 1-bpp AND transparency mask). Non-alpha and legacy all-zero
 // alpha images use that mask; meaningful 32-bit alpha remains authoritative.
-function decodeDib(buf) {
+function decodeDib(buf, work) {
     if (buf.length < 40)
         return null;
     const headerSize = buf.readUInt32LE(0);
@@ -258,6 +272,8 @@ function decodeDib(buf) {
     const maskPresent = maskStart + maskRowSize * height <= buf.length;
     if (bitCount !== 32 && !maskPresent)
         return null;
+    if (!admitPixels(work, width, height))
+        return null;
     const paletteColor = (index) => {
         if (!palette || index >= palette.count)
             return [0, 0, 0];
@@ -323,9 +339,10 @@ function decodeDib(buf) {
 // one is in a variant we don't decode (e.g. a 4-bit-palette PNG sub-entry
 // alongside a plain BMP one). A multi-size favicon.ico only needs one usable
 // entry, and any size hashes to nearly the same dHash since it downsamples.
-function decodeIco(buf) {
+function decodeIco(buf, work) {
     const count = buf.readUInt16LE(4);
-    if (count < 1 || 6 + count * 16 > buf.length)
+    const directoryEnd = 6 + count * 16;
+    if (count < 1 || directoryEnd > buf.length)
         return null;
     const entries = [];
     for (let i = 0; i < count; i += 1) {
@@ -334,14 +351,22 @@ function decodeIco(buf) {
         const h = buf[entry + 1] || 256;
         const size = buf.readUInt32LE(entry + 8);
         const dataOffset = buf.readUInt32LE(entry + 12);
-        if (dataOffset + size > buf.length || size < 1)
+        if (dataOffset < directoryEnd || dataOffset + size > buf.length || size < 1)
             continue;
         entries.push({ area: w * h, dataOffset, size });
     }
     entries.sort((a, b) => b.area - a.area);
+    const visited = new Set();
     for (const { dataOffset, size } of entries) {
+        const identity = `${dataOffset}:${size}`;
+        if (visited.has(identity))
+            continue;
+        visited.add(identity);
+        if (size > work.encodedBytes)
+            return null;
+        work.encodedBytes -= size;
         const payload = buf.subarray(dataOffset, dataOffset + size);
-        const image = isPng(payload) ? decodePng(payload) : decodeDib(payload);
+        const image = isPng(payload) ? decodePng(payload, work) : decodeDib(payload, work);
         if (image)
             return image;
     }
@@ -350,10 +375,11 @@ function decodeIco(buf) {
 function decodeImage(buf) {
     if (!Buffer.isBuffer(buf))
         return null;
+    const work = { encodedBytes: buf.length, pixels: MAX_DECODE_PIXELS };
     if (isPng(buf))
-        return decodePng(buf);
+        return decodePng(buf, work);
     if (isIco(buf))
-        return decodeIco(buf);
+        return decodeIco(buf, work);
     return null;
 }
 // Downscales to cols x rows of grayscale luma. Transparency is composited

package/lib/portable-generator.mjs

@@ -1,29 +1,2 @@
-import { WHOISLEUTH_SOURCE_REPOSITORY_URL, } from "./project-metadata.mjs";
-import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
-const URI_LABEL_UNSAFE_GLOBAL_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/gu;
-const URI_LABEL_SCHEME_RE = /^[A-Za-z][A-Za-z0-9+.-]*:(?:\/\/|[^\s])/u;
-export function isUriShapedLabel(value) {
-    if (typeof value !== 'string')
-        return false;
-    const candidate = value.replace(URI_LABEL_UNSAFE_GLOBAL_RE, '').trim();
-    return URI_LABEL_SCHEME_RE.test(candidate);
-}
-export function buildPortableGeneratorMetadata(applicationVersion) {
-    let version = null;
-    if (applicationVersion !== null && applicationVersion !== undefined && applicationVersion !== '') {
-        try {
-            version = normalizeBoundedSemanticVersion(applicationVersion, 'Portable report application');
-        }
-        catch {
-            version = null;
-        }
-    }
-    return Object.freeze({
-        name: 'WHOISleuth',
-        version,
-        projectUrl: WHOISLEUTH_SOURCE_REPOSITORY_URL,
-    });
-}
-export function portableGeneratorAttribution(generator) {
-    return `Generated with ${generator.name}${generator.version ? ` ${generator.version}` : ''} · Source: ${generator.projectUrl}`;
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/portable-generator.mjs";

package/lib/project-metadata.mjs

@@ -1,8 +1,2 @@
-// Browser-safe public project metadata shared by request identity, package
-// verification, canonical URLs, structured data, and public policy pages.
-export const WHOISLEUTH_SITE_ORIGIN = 'https://www.whoisleuth.com';
-export const WHOISLEUTH_PROJECT_URL = `${WHOISLEUTH_SITE_ORIGIN}/`;
-export const WHOISLEUTH_REQUEST_POLICY_URL = `${WHOISLEUTH_SITE_ORIGIN}/request-policy`;
-export const WHOISLEUTH_SOURCE_REPOSITORY_URL = 'https://github.com/slicedearth/whoisleuth';
-export const WHOISLEUTH_SOURCE_REPOSITORY_GIT_URL = `git+${WHOISLEUTH_SOURCE_REPOSITORY_URL}.git`;
-export const WHOISLEUTH_SOURCE_ISSUES_URL = `${WHOISLEUTH_SOURCE_REPOSITORY_URL}/issues`;
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/project-metadata.mjs";

package/lib/rdap-client.mjs

@@ -61,21 +61,25 @@ export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap
                 }));
                 continue;
             }
-            let data;
+            let data = null;
             try {
                 data = JSON.parse(upstream.text);
             }
             catch {
-                attempts.push(rdapAttempt(selectedEndpoint, 'invalid_json', {
-                    status: upstream.status,
-                    detail: 'The endpoint returned invalid JSON.',
-                }));
-                continue;
+                // RFC 7480 section 5.3 makes the explanatory body optional for a
+                // negative answer. URL binding and transport/body bounds still apply.
+                if (upstream.status !== 404) {
+                    attempts.push(rdapAttempt(selectedEndpoint, 'invalid_json', {
+                        status: upstream.status,
+                        detail: 'The endpoint returned invalid JSON.',
+                    }));
+                    continue;
+                }
             }
             if (upstream.status === 404) {
                 attempts.push(rdapAttempt(selectedEndpoint, 'not_found', {
                     status: upstream.status,
-                    detail: 'The authoritative endpoint reported no matching object.',
+                    detail: `The authoritative endpoint reported no matching object.${data === null ? ' No usable JSON explanation was supplied.' : ''}`,
                     selected: true,
                 }));
                 return {

package/lib/registrable-domain.mjs

@@ -1,56 +1,2 @@
-import { getDomain, getPublicSuffix } from 'tldts';
-import { isValidAsciiDomainName } from "./hostname.mjs";
-import { MAX_DOMAIN_NAME_LENGTH, MAX_DOMAIN_LABEL_LENGTH } from "../packages/contracts/domain-name.mjs";
-// Reserve the shortest generated name and its separating dot.
-export const MAX_DISCOVERY_SUFFIX_LENGTH = MAX_DOMAIN_NAME_LENGTH - 2;
-/** ICANN suffix rules for a plain ASCII hostname; private suffixes do not change identity. */
-export function publicSuffixForAsciiHostname(value) {
-    if (!isValidAsciiDomainName(value, { requireDot: false, requireLowercase: true }))
-        return null;
-    return getPublicSuffix(value);
-}
-/** Preserve reserved single labels; compound suffixes must match the local ICANN suffix rules. */
-export function normalizeDiscoverySuffix(raw) {
-    if (typeof raw !== 'string' || raw.length > MAX_DISCOVERY_SUFFIX_LENGTH + 1 || /[\u0000-\u001f\u007f]/u.test(raw))
-        return null;
-    const value = raw.trim().toLowerCase().replace(/^\./u, '');
-    if (!value || value.length > MAX_DISCOVERY_SUFFIX_LENGTH)
-        return null;
-    if (value.length <= MAX_DOMAIN_LABEL_LENGTH && /^[a-z]{2,}$/u.test(value))
-        return value;
-    return value.includes('.') && publicSuffixForAsciiHostname(value) === value ? value : null;
-}
-// Returns one canonical registrable-domain identity for an already public DNS
-// hostname. Callers retain the original hostname separately when subdomain
-// context matters; authority, evidence binding and scoring use this value.
-export function canonicalRegistrableDomain(value) {
-    if (typeof value !== 'string')
-        return null;
-    const trimmed = value.trim();
-    if (!trimmed || /[\u0000-\u001f\u007f]/u.test(trimmed))
-        return null;
-    const withoutScheme = trimmed.replace(/^[a-z]+:\/\//iu, '').split(/[/?#]/u)[0] ?? '';
-    if (withoutScheme.endsWith('..'))
-        return null;
-    const candidate = withoutScheme.replace(/\.$/u, '');
-    if (!candidate)
-        return null;
-    let hostname;
-    try {
-        hostname = new URL(`https://${candidate}/`).hostname.toLowerCase().replace(/\.$/u, '');
-    }
-    catch {
-        return null;
-    }
-    if (!isValidAsciiDomainName(hostname, { requireDot: true, requireLowercase: true }))
-        return null;
-    // Keep this boundary identical to classifyQuery() and the collection
-    // runtime: registrable identity follows the ICANN Public Suffix List, while
-    // privately operated suffixes remain ordinary host context.
-    const domain = getDomain(hostname);
-    return domain
-        && isValidAsciiDomainName(domain, { requireDot: true, requireLowercase: true })
-        && (hostname === domain || hostname.endsWith(`.${domain}`))
-        ? domain
-        : null;
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/registrable-domain.mjs";

package/lib/registrar-standing-contract.mjs

@@ -64,7 +64,7 @@ const SOURCE_HEALTH_STATES = new Set(REGISTRAR_STANDING_SOURCE_HEALTH_STATES);
 const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/u;
 const NOTICE_ID_RE = /^notice-[1-9]\d{0,7}$/u;
 const IANA_ID_RE = /^[1-9]\d{0,7}$/u;
-function normalizedRegistrarIanaId(value) {
+export function normalizedRegistrarIanaId(value) {
     if (typeof value === 'number' && Number.isSafeInteger(value))
         value = String(value);
     if (typeof value !== 'string')

package/lib/registrar-standing.mjs

@@ -5,7 +5,7 @@
 import { createHash } from 'node:crypto';
 import { REGISTRAR_STANDING_CATALOGUE } from "./generated/registrar-standing-catalogue.mjs";
 import { ICANN_COMPLIANCE_SOURCE_URL, IANA_REGISTRAR_SOURCE_URL, REGISTRAR_STANDING_CATALOGUE_SCHEMA, REGISTRAR_STANDING_CATALOGUE_VERSION, REGISTRAR_STANDING_MAX_AGE_DAYS, REGISTRAR_STANDING_MAX_FUTURE_SKEW_MS, registrarStandingOfficialSourceUrl, } from "./registrar-standing-catalogue-contract.mjs";
-import { deriveRegistrarStandingAssessment, MAX_REGISTRAR_COMPLIANCE_ACTIONS, REGISTRAR_STANDING_SCHEMA, REGISTRAR_STANDING_VERSION, } from "./registrar-standing-contract.mjs";
+import { deriveRegistrarStandingAssessment, normalizedRegistrarIanaId, MAX_REGISTRAR_COMPLIANCE_ACTIONS, REGISTRAR_STANDING_SCHEMA, REGISTRAR_STANDING_VERSION, } from "./registrar-standing-contract.mjs";
 const STATUS_BY_CODE = Object.freeze({
     A: 'accredited',
     R: 'reserved',
@@ -40,6 +40,10 @@ function ageDays(value, now) {
 function sourceHealth(value, now) {
     return ageDays(value, now) <= REGISTRAR_STANDING_MAX_AGE_DAYS ? 'current' : 'stale';
 }
+function complianceHealth(catalogue, now) {
+    return catalogue.icann.catalogueYear === now.getUTCFullYear()
+        ? sourceHealth(catalogue.icann.reviewedAt, now) : 'stale';
+}
 function validatedCatalogue(value, now) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return null;
@@ -157,14 +161,6 @@ function accreditationMap(catalogue) {
     }
     return result;
 }
-function normalizedIanaId(value) {
-    if (typeof value === 'number' && Number.isSafeInteger(value))
-        value = String(value);
-    if (typeof value !== 'string')
-        return null;
-    const trimmed = value.trim();
-    return /^\d{1,8}$/u.test(trimmed) && Number(trimmed) > 0 ? String(Number(trimmed)) : null;
-}
 function projectedActions(catalogue, ianaId) {
     const matching = catalogue.icann.notices.filter((notice) => String(notice.ianaId) === ianaId);
     const actions = matching.slice(0, MAX_REGISTRAR_COMPLIANCE_ACTIONS).map((notice) => {
@@ -183,9 +179,9 @@ export function buildRegistrarStanding(options) {
     if (!(now instanceof Date) || !Number.isFinite(now.getTime()))
         throw new TypeError('Registrar standing time must be valid.');
     const catalogue = validatedCatalogue(options.catalogue ?? REGISTRAR_STANDING_CATALOGUE, now);
-    const ianaId = normalizedIanaId(options.registrarIanaId);
+    const ianaId = normalizedRegistrarIanaId(options.registrarIanaId);
     const ianaHealth = catalogue ? sourceHealth(catalogue.iana.observedAt, now) : 'unavailable';
-    const icannHealth = catalogue ? sourceHealth(catalogue.icann.reviewedAt, now) : 'unavailable';
+    const icannHealth = catalogue ? complianceHealth(catalogue, now) : 'unavailable';
     const accreditation = catalogue && ianaId
         ? accreditationMap(catalogue).get(ianaId) ?? 'unknown'
         : 'unknown';
@@ -205,7 +201,7 @@ export function buildRegistrarStanding(options) {
             ? `The reviewed ${catalogue.icann.catalogueYear} ICANN index is not a complete enforcement history and excludes third-party allegations.`
             : 'The checked-in official-source catalogue could not be validated, so registrar standing is unavailable.',
         ...(!ianaId ? ['No single numeric registrar IANA ID was available across the registration evidence, so no registrar match was attempted.'] : []),
-        ...(combinedHealth === 'stale' ? ['The catalogue is past its review-age threshold; current absence and accreditation conclusions require a refresh.'] : []),
+        ...(combinedHealth === 'stale' ? ['The catalogue is outside its current-year coverage or review-age threshold; current absence and accreditation conclusions require a refresh.'] : []),
     ].slice(0, 4);
     const nextActions = hasAction ? [
         'Open the official notice and verify its dates, scope, and current outcome before acting.',
@@ -259,7 +255,7 @@ export function registrarStandingCatalogueHealth(now = new Date(), value = REGIS
         });
     const age = Math.max(ageDays(catalogue.iana.observedAt, now), ageDays(catalogue.icann.reviewedAt, now));
     return Object.freeze({
-        state: age <= REGISTRAR_STANDING_MAX_AGE_DAYS ? 'current' : 'stale',
+        state: age <= REGISTRAR_STANDING_MAX_AGE_DAYS && complianceHealth(catalogue, now) === 'current' ? 'current' : 'stale',
         sourceObservedAt: [catalogue.iana.observedAt, catalogue.icann.reviewedAt]
             .sort((left, right) => Date.parse(left) - Date.parse(right))[0] ?? null,
         ageDays: age,

package/lib/registry-capabilities.mjs

@@ -1,5 +1,5 @@
 // Registry capability evaluation over the immutable reviewed catalogue.
-import { CAPABILITY_BY_SUFFIX, DEFAULT_CAPABILITY, EXPLICIT_CAPABILITIES, MAX_CAPABILITY_INPUT_LENGTH, REGISTRY_CAPABILITIES_VERSION, REGISTRY_STANDARDS_COVERAGE_SNAPSHOT, VERSION_26_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, } from "./registry-capability-catalogue.mjs";
+import { CAPABILITY_BY_SUFFIX, DEFAULT_CAPABILITY, EXPLICIT_CAPABILITIES, MAX_CAPABILITY_INPUT_LENGTH, REGISTRY_CAPABILITIES_VERSION, REGISTRY_STANDARDS_COVERAGE_SNAPSHOT, REVIEWED_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, } from "./registry-capability-catalogue.mjs";
 const IANA_TLD_RECORD_PREFIX = 'https://www.iana.org/domains/root/db/';
 function documentationUrlsForSuffix(capability, suffixes) {
     if (suffixes.length !== 1 || capability.suffixes.length <= 1) {
@@ -151,4 +151,4 @@ function registryCompatibilityMatrix() {
     })))
         .sort((left, right) => (left.suffixes[0] ?? '').localeCompare(right.suffixes[0] ?? ''));
 }
-export { REGISTRY_CAPABILITIES_VERSION, VERSION_26_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, registryCapabilityFor, registryCompatibilityMatrix, listRegistryCapabilities, registryAccessDiagnosticFor, registryServiceAdmissionFor, registryStandardsCoverageSnapshot, };
+export { REGISTRY_CAPABILITIES_VERSION, REVIEWED_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, registryCapabilityFor, registryCompatibilityMatrix, listRegistryCapabilities, registryAccessDiagnosticFor, registryServiceAdmissionFor, registryStandardsCoverageSnapshot, };

package/lib/registry-capability-catalogue.mjs

@@ -2,17 +2,17 @@
 // remain authoritative. Explicit query profiles may alter only the first
 // referred registry query after a fixture-backed adapter is integrated.
 export const REGISTRY_STANDARDS_COVERAGE_SCHEMA = 'whoisleuth.registry-standards-coverage';
-const REGISTRY_CAPABILITIES_VERSION = 29;
+const REGISTRY_CAPABILITIES_VERSION = 31;
 const MAX_CAPABILITY_INPUT_LENGTH = 253;
 const REGISTRY_STANDARDS_COVERAGE_SNAPSHOT = Object.freeze({
     schema: REGISTRY_STANDARDS_COVERAGE_SCHEMA,
     version: 1,
-    verifiedAt: '2026-08-03',
+    verifiedAt: '2026-10-03',
     sources: Object.freeze({
-        rootZoneVersion: '2026080200',
-        rootZoneLastUpdatedAt: '2026-08-02T07:07:01.000Z',
-        rootZoneTldSetSha256: 'aa0a75a9860b2cba07d7fe8172f4546d981be3674bf6764fb0d5f39a45940d25',
-        rdapBootstrapPublication: '2026-07-23T02:00:03.000Z',
+        rootZoneVersion: '2026100200',
+        rootZoneLastUpdatedAt: '2026-10-02T07:07:02.000Z',
+        rootZoneTldSetSha256: '71093802743b87ee52fac5dd4f662cafd0133dae5089ac6c2e34ee73cebfc836',
+        rdapBootstrapPublication: '2026-09-30T23:00:03.000Z',
         rdapBootstrapVersion: '1.0',
         urls: Object.freeze([
             'https://data.iana.org/TLD/tlds-alpha-by-domain.txt',
@@ -21,15 +21,15 @@ const REGISTRY_STANDARDS_COVERAGE_SNAPSHOT = Object.freeze({
         ]),
     }),
     counts: Object.freeze({
-        activeTlds: 1438,
+        activeTlds: 1437,
         countryCode: 309,
-        nonCountryCode: 1129,
-        generic: 1111,
+        nonCountryCode: 1128,
+        generic: 1110,
         genericRestricted: 3,
         sponsored: 14,
         infrastructure: 1,
-        rdapBootstrapServiceGroups: 590,
-        genericAndRestrictedRdapCovered: 1114,
+        rdapBootstrapServiceGroups: 592,
+        genericAndRestrictedRdapCovered: 1113,
         sponsoredRdapCovered: 12,
         infrastructureRdapCovered: 0,
     }),
@@ -82,7 +82,7 @@ const VERSION_16_NO_IANA_MACHINE_SERVICE_SUFFIXES = Object.freeze([
 ]);
 const VERSION_19_NO_IANA_MACHINE_SERVICE_SUFFIXES = Object.freeze([
     'xn--mgbai9azgqp6j', 'xn--mgbayh7gpa', 'xn--mgbc0a9azcg',
-    'xn--mgbcpq6gpa1a', 'xn--mgbpl2fh', 'xn--wgbh1c',
+    'xn--mgbpl2fh', 'xn--wgbh1c',
 ]);
 const VERSION_19_RDAP_ONLY_SUFFIXES = Object.freeze(['na', 'pn']);
 const VERSION_20_FIXTURE_SUFFIXES = Object.freeze([
@@ -117,13 +117,13 @@ const VERSION_24_PROMOTED_SUFFIXES = Object.freeze([
     'xn--90ae', 'xn--l1acc', 'xn--wgbl6a',
 ]);
 const CURRENT_UNVERIFIED_REFERRAL_SUFFIXES = Object.freeze(VERSION_23_UNVERIFIED_REFERRAL_SUFFIXES.filter((suffix) => !VERSION_24_PROMOTED_SUFFIXES.includes(suffix)));
-const VERSION_26_NO_RDAP_SUFFIXES = Object.freeze([
+const REVIEWED_NO_RDAP_SUFFIXES = Object.freeze([
     'ac', 'ae', 'af', 'am', 'at', 'be', 'bg', 'by', 'cl', 'cn',
     'co', 'de', 'dk', 'ee', 'eu', 'gf', 'gi', 'gt', 'hk', 'hr',
-    'hu', 'ie', 'il', 'io', 'ir', 'it', 'jp', 'kr', 'kz', 'la',
+    'hu', 'ie', 'il', 'io', 'ir', 'it', 'jp', 'kz', 'la',
     'lt', 'lu', 'lv', 'md', 'me', 'mk', 'mo', 'mq', 'mx', 'my',
     'nz', 'pk', 'pt', 'ro', 'rs', 'ru', 'sa', 'se', 'sk', 'su',
-    'tn', 'tr', 'us', 'vc', 'xn--2scrj9c', 'xn--3e0b707e',
+    'tn', 'tr', 'us', 'vc', 'xn--2scrj9c',
     'xn--3hcrj9c', 'xn--45br5cyl', 'xn--45brj9c', 'xn--80ao21a',
     'xn--90a3ac', 'xn--90ais', 'xn--d1alf', 'xn--e1a4c',
     'xn--fiqs8s', 'xn--fiqz9s', 'xn--fpcrj9c3d', 'xn--gecrj9c',
@@ -132,7 +132,7 @@ const VERSION_26_NO_RDAP_SUFFIXES = Object.freeze([
     'xn--qxa6a', 'xn--rvc1e0am3e', 'xn--s9brj9c',
     'xn--xkc2dl3a5ee0h', 'xn--y9a3aq',
 ]);
-const VERSION_26_NO_RDAP_SUFFIX_SET = new Set(VERSION_26_NO_RDAP_SUFFIXES);
+const REVIEWED_NO_RDAP_SUFFIX_SET = new Set(REVIEWED_NO_RDAP_SUFFIXES);
 const VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES = Object.freeze([
     'app', 'boo', 'channel', 'dad', 'day', 'dev', 'esq', 'foo', 'how', 'info',
     'ing', 'meme', 'mov', 'new', 'nexus', 'page', 'phd', 'prof', 'rsvp', 'soy',
@@ -312,6 +312,14 @@ const EXPLICIT_CAPABILITY_SEEDS = [
         documentationUrls: [`https://www.iana.org/domains/root/db/${suffix}.html`],
         limitation: RDAP_ONLY_MACHINE_SERVICE_LIMITATION,
     })),
+    {
+        id: 'no-iana-machine-service-xn--mgbcpq6gpa1a', suffixes: ['xn--mgbcpq6gpa1a'], registryClass: 'country-code',
+        whoisParserProfile: 'generic-colon', fixtureScenarios: [],
+        coverageState: 'access_documented', whoisAccessProfile: 'no-iana-service',
+        rdapAccessProfile: 'iana-bootstrap', verificationFiles: [],
+        documentationUrls: ['https://www.iana.org/domains/root/db/xn--mgbcpq6gpa1a.html'],
+        limitation: RDAP_ONLY_MACHINE_SERVICE_LIMITATION,
+    },
     ...VERSION_20_FIXTURE_SUFFIXES.map((suffix) => ({
         id: `iana-cc-colon-${suffix}`,
         suffixes: [suffix],
@@ -1044,7 +1052,7 @@ const EXPLICIT_CAPABILITY_SEEDS = [
     {
         id: 'nic-bh-icann-colon', suffixes: ['bh'], registryClass: 'country-code',
         whoisParserProfile: 'icann-style-colon', fixtureScenarios: ['registered', 'not_found'],
-        rdapAccessProfile: 'no-iana-service',
+        rdapAccessProfile: 'iana-bootstrap',
         documentationUrls: ['https://www.iana.org/domains/root/db/bh.html'],
     },
     {
@@ -1181,7 +1189,7 @@ const EXPLICIT_CAPABILITY_SEEDS = [
 ];
 function resolvedSeedRdapAccessProfile(entry) {
     const declared = entry.rdapAccessProfile || 'iana-bootstrap';
-    const resolved = new Set(entry.suffixes.map((suffix) => (VERSION_26_NO_RDAP_SUFFIX_SET.has(suffix) ? 'no-iana-service' : declared)));
+    const resolved = new Set(entry.suffixes.map((suffix) => (REVIEWED_NO_RDAP_SUFFIX_SET.has(suffix) ? 'no-iana-service' : declared)));
     if (resolved.size !== 1) {
         throw new Error(`Registry capability ${entry.id} mixes RDAP access profiles and must be split by suffix.`);
     }
@@ -1215,4 +1223,4 @@ for (const capability of EXPLICIT_CAPABILITIES) {
         CAPABILITY_BY_SUFFIX.set(suffix, capability);
     }
 }
-export { REGISTRY_CAPABILITIES_VERSION, MAX_CAPABILITY_INPUT_LENGTH, VERSION_26_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, REGISTRY_STANDARDS_COVERAGE_SNAPSHOT, DEFAULT_CAPABILITY, EXPLICIT_CAPABILITIES, CAPABILITY_BY_SUFFIX, };
+export { REGISTRY_CAPABILITIES_VERSION, MAX_CAPABILITY_INPUT_LENGTH, REVIEWED_NO_RDAP_SUFFIXES, VERSION_27_RDAP_ONLY_GENERIC_SUFFIXES, REGISTRY_STANDARDS_COVERAGE_SNAPSHOT, DEFAULT_CAPABILITY, EXPLICIT_CAPABILITIES, CAPABILITY_BY_SUFFIX, };