@slicedearth/whoisleuth-cli 2.5.1 → 2.7.0

package/lib/lookup-collection-receipt.mjs

@@ -0,0 +1,52 @@
+import { LOOKUP_SOURCE_IDS, LOOKUP_CHOICE_KEYS, LOOKUP_CHOICE_SOURCES, LOOKUP_SOURCE_STATES, LOOKUP_COLLECTION_RECEIPT_VERSION, lookupCollectionChoices, parseLookupCollectionReceipt, } from "../packages/evidence/lookup-collection-receipt.mjs";
+import { plannedLookupSources } from "./lookup-progress.mjs";
+import { normalizeLookupSourceSettlement } from "./lookup-source-progress.mjs";
+/** Operation-local observer. It neither admits nor starts collection. */
+export function createLookupCollectionReceiptTracker(classified, options) {
+    const requestedDepth = options.fast ? 'fast' : 'deep';
+    const originalChoices = lookupCollectionChoices(options);
+    const eligible = new Set(plannedLookupSources(classified.type, requestedDepth, originalChoices));
+    const requested = new Set(eligible);
+    for (const choice of LOOKUP_CHOICE_KEYS)
+        if (originalChoices[choice])
+            requested.add(LOOKUP_CHOICE_SOURCES[choice]);
+    const sources = new Map(LOOKUP_SOURCE_IDS.map(source => [source, {
+            source,
+            intent: requested.has(source) ? 'requested' : 'not_requested',
+            admission: eligible.has(source) ? 'unknown' : 'not_applicable',
+            attempt: 'not_started', settlement: 'unknown', complete: null, truncated: null,
+        }]));
+    function admission(source, value) {
+        const current = sources.get(source);
+        if (current.attempt !== 'started')
+            sources.set(source, { ...current, admission: value });
+    }
+    function started(source) {
+        sources.set(source, { ...sources.get(source), admission: 'admitted', attempt: 'started' });
+    }
+    function settled(source, outcome, value) {
+        const current = sources.get(source);
+        if (current.attempt !== 'started')
+            return;
+        const summary = normalizeLookupSourceSettlement(source, outcome, value, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined);
+        const raw = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+        // Preserve final distinctions that the provisional progress vocabulary folds
+        // into skipped. The current source's explicit quality still takes precedence.
+        const status = typeof raw.status === 'string'
+            && LOOKUP_SOURCE_STATES.includes(raw.status) ? raw.status : null;
+        const settlement = outcome === 'fulfilled' && status && ['disabled', 'not_applicable', 'stale'].includes(status)
+            ? status : summary.state;
+        sources.set(source, { ...current, settlement,
+            complete: value == null ? null : ['success', 'complete', 'not_found'].includes(settlement) && summary.complete && !summary.truncated,
+            truncated: value == null || outcome === 'rejected' ? null : summary.truncated,
+        });
+    }
+    function finish() {
+        return parseLookupCollectionReceipt({
+            version: LOOKUP_COLLECTION_RECEIPT_VERSION, requestedDepth, targetClass: classified.type,
+            webSelection: classified.type !== 'domain' ? 'not_applicable' : options.selectedUrl ? 'selected_url' : 'hostname',
+            originalChoices, sources: [...sources.values()],
+        });
+    }
+    return Object.freeze({ admission, started, settled, finish });
+}

package/lib/lookup-diagnostics.mjs

@@ -2,22 +2,12 @@
 import { OPERATION_BUDGET_ERROR_CODE } from "./operation-budget.mjs";
 import { FEATURE_DISABLED_ERROR_CODE } from "./feature-policy.mjs";
 import { LOOKUP_SOURCE_STATES, lookupDiagnosticStates } from "./lookup-progress.mjs";
+import { LOOKUP_SOURCE_IDS } from "../packages/evidence/lookup-collection-receipt.mjs";
 const LOOKUP_DIAGNOSTICS_VERSION = 8;
 const LOOKUP_LEGACY_DIAGNOSTICS_VERSION = 7;
 const LOOKUP_TIMING_VERSION = 1;
 const MAX_LOOKUP_TIMING_MS = 120_000;
-const LOOKUP_TIMING_SOURCE_ORDER = Object.freeze([
-    'rdap',
-    'whois',
-    'domain_evidence',
-    'reverse_dns',
-    'registrar_rdap',
-    'network_context',
-    'security_txt',
-    'external_intelligence',
-    'malware_host_intelligence',
-    'malware_ioc_intelligence',
-]);
+const LOOKUP_TIMING_SOURCE_ORDER = LOOKUP_SOURCE_IDS;
 const LOOKUP_ERROR_CODES = Object.freeze({
     AUTH_REQUIRED: 'AUTH_REQUIRED',
     RATE_LIMITED: 'RATE_LIMITED',

package/lib/lookup-progress.mjs

@@ -2,6 +2,8 @@
 // presentation-only; only a validated final ordinary Lookup result may cross
 // the persistence boundary.
 import { scanBoundedJson, MAX_BOUNDED_JSON_DEPTH, MAX_BOUNDED_JSON_KEYS, MAX_BOUNDED_JSON_VALUES } from "../packages/analysis/bounded-json.mjs";
+import { LOOKUP_SOURCE_IDS as SOURCE_IDS, LOOKUP_SOURCE_STATES } from "../packages/evidence/lookup-collection-receipt.mjs";
+export { LOOKUP_SOURCE_STATES } from "../packages/evidence/lookup-collection-receipt.mjs";
 export const LOOKUP_PROGRESS_SCHEMA = 'whoisleuth.lookup-progress';
 export const LOOKUP_PROGRESS_VERSION = 1;
 export const MAX_LOOKUP_PROGRESS_SOURCES = 16;
@@ -9,18 +11,6 @@ export const MAX_LOOKUP_PROGRESS_EVENTS = MAX_LOOKUP_PROGRESS_SOURCES + 2;
 export const MAX_LOOKUP_PROGRESS_FRAGMENT_BYTES = 256 * 1024;
 export const MAX_LOOKUP_PROGRESS_FINAL_BYTES = 8 * 1024 * 1024;
 export const MAX_LOOKUP_PROGRESS_STREAM_BYTES = 12 * 1024 * 1024;
-const SOURCE_IDS = Object.freeze([
-    'rdap',
-    'whois',
-    'domain_evidence',
-    'reverse_dns',
-    'registrar_rdap',
-    'network_context',
-    'security_txt',
-    'external_intelligence',
-    'malware_host_intelligence',
-    'malware_ioc_intelligence',
-]);
 const SOURCE_ID_SET = new Set(SOURCE_IDS);
 const SOURCE_STATES = new Set([
     'success',
@@ -33,28 +23,36 @@ const SOURCE_STATES = new Set([
     'rate_limited',
 ]);
 // Final diagnostic states are distinct from the provisional progress subset.
-export const LOOKUP_SOURCE_STATES = Object.freeze([
-    'success', 'partial', 'not_found', 'skipped', 'error', 'unsupported',
-    'not_applicable', 'unavailable', 'rate_limited', 'complete', 'disabled', 'stale',
-]);
 const FINAL_SOURCE_STATES = new Set(LOOKUP_SOURCE_STATES);
-export function lookupDiagnosticStates(value) {
+const DIAGNOSTIC_SOURCE_PATHS = Object.freeze({
+    rdap: ['rdap'], registrar_rdap: ['rdap', 'registrar'], whois: ['whois'],
+    availability: ['availability'], reverse_dns: ['reverseDns'], network_context: ['network'],
+    security_txt: ['securityTxt'], sslbl: ['sslbl'],
+});
+export function lookupDiagnosticEntries(value) {
     const record = (input) => input && typeof input === 'object' && !Array.isArray(input)
         ? input : {};
-    const diagnostics = record(value);
-    const candidates = {
-        rdap: record(diagnostics.rdap).status,
-        registrar_rdap: record(record(diagnostics.rdap).registrar).status,
-        whois: record(diagnostics.whois).status,
-        availability: record(diagnostics.availability).status,
-        reverse_dns: record(diagnostics.reverseDns).status,
-        network_context: record(diagnostics.network).status,
-        security_txt: record(diagnostics.securityTxt).status,
-        sslbl: record(diagnostics.sslbl).status,
-    };
-    return Object.freeze(Object.fromEntries(Object.entries(candidates).map(([source, state]) => [
-        source, typeof state === 'string' && FINAL_SOURCE_STATES.has(state) ? state : null,
-    ])));
+    return Object.freeze(Object.entries(DIAGNOSTIC_SOURCE_PATHS).map(([source, keys]) => {
+        let current = value;
+        let present = true;
+        for (const key of keys) {
+            const parent = record(current);
+            if (!Object.hasOwn(parent, key)) {
+                present = false;
+                break;
+            }
+            current = parent[key];
+        }
+        const diagnostic = record(current);
+        const state = present && Object.hasOwn(diagnostic, 'status') ? diagnostic.status : undefined;
+        return Object.freeze({
+            source, path: `diagnostics.${keys.join('.')}.status`, present,
+            state: typeof state === 'string' && FINAL_SOURCE_STATES.has(state) ? state : null,
+        });
+    }));
+}
+export function lookupDiagnosticStates(value) {
+    return Object.freeze(Object.fromEntries(lookupDiagnosticEntries(value).map(({ source, state }) => [source, state])));
 }
 const SOURCE_ID_RE = /^[a-z][a-z0-9_]{0,39}$/u;
 /** The existing Lookup recipe, shared by offline plans and source progress.

package/lib/lookup-response-contract.mjs

@@ -13,6 +13,7 @@ import { assertBoundedJsonStructure } from "../packages/analysis/bounded-json.mj
 import { canonicalRegistrableDomain } from "../packages/analysis/registrable-domain.mjs";
 import { validLookupObservationScope } from "../packages/evidence/lookup-target.mjs";
 import { isWebCollectionQuality } from "../packages/evidence/collection-quality.mjs";
+import { parseLookupCollectionReceipt } from "../packages/evidence/lookup-collection-receipt.mjs";
 import { MAX_LOOKUP_DNS_RECORDS_PER_TYPE, MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS, MAX_LOOKUP_TLS_ALT_NAMES, MAX_LOOKUP_TLS_CERTIFICATE_POLICIES, MAX_LOOKUP_TLS_CHAIN_CERTIFICATES, MAX_LOOKUP_TLS_FINDINGS, MAX_LOOKUP_TLS_NAME_VALUES, } from "./lookup-network-evidence-bounds.mjs";
 import { MAX_SECURITY_POSTURE_FINDINGS, sanitizeLookupChildProfiles, validSecurityPostureFinding, validTlsChainCertificate, validTlsFinding, } from "./lookup-child-profile-contract.mjs";
 import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "./homepage-metadata-contract.mjs";
@@ -646,6 +647,7 @@ function validAvailabilityScalars(value) {
         && (value.hasNullMx === undefined || value.hasNullMx === null || typeof value.hasNullMx === 'boolean')
         && (value.hasSpf === undefined || value.hasSpf === null || typeof value.hasSpf === 'boolean')
         && (value.hasDmarc === undefined || value.hasDmarc === null || typeof value.hasDmarc === 'boolean')
+        && (value.hasExternalPasswordForm === undefined || value.hasExternalPasswordForm === null || typeof value.hasExternalPasswordForm === 'boolean')
         && validOptionalStringArray(value.mxHosts, MAX_LOOKUP_DNS_RECORDS_PER_TYPE, 253);
 }
 function validLookupDomainIdentity(value) {
@@ -824,6 +826,14 @@ function parseLookupHttpResponse(value) {
             return invalidLookupResponse();
     }
     const lookupResponse = sanitizeLookupChildProfiles(value);
+    try {
+        const receipt = parseLookupCollectionReceipt(lookupResponse.collectionReceipt);
+        if (receipt && receipt.targetClass !== lookupResponse.type)
+            return invalidLookupResponse();
+    }
+    catch {
+        return invalidLookupResponse();
+    }
     if (lookupResponse.registrarStanding !== undefined
         && (!validRegistrarStanding(lookupResponse.registrarStanding)
             || lookupResponse.registrarStanding.ianaId !== resolveRegistrarIanaId(lookupResponse.rdap.parsed, lookupResponse.whois.parsed)))

package/lib/lookup-response.mjs

@@ -76,12 +76,16 @@ async function buildUnifiedLookupResponse(context) {
         ? { skipped: true, detail: 'RDAP is disabled by deployment policy.' }
         : rdapRecord
             ? { ...rdapRecord, ...(registrarRdap ? { registrarRdap } : {}) }
-            : {
-                error: rdapResult.status === 'rejected'
-                    ? boundedSourceDetail(rdapResult.reason, 'RDAP lookup failed')
-                    : 'No RDAP registry found for this query via IANA bootstrap',
-                attempts: rdapAttempts,
-            };
+            : rdapResult.status === 'rejected'
+                ? { error: boundedSourceDetail(rdapResult.reason, 'RDAP lookup failed'), attempts: rdapAttempts }
+                : { status: 'unsupported', detail: 'No RDAP service is listed for this target in the IANA bootstrap.', attempts: rdapAttempts };
+    const whoisStatus = !whoisEnabled
+        ? 'disabled'
+        : skipWhois
+            ? 'skipped'
+            : whoisResult.status === 'rejected'
+                ? 'error'
+                : whoisCollectionStatus(whoisChain, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined);
     let whois;
     if (!whoisEnabled) {
         whois = { skipped: true, detail: 'WHOIS is disabled by deployment policy.' };
@@ -90,7 +94,11 @@ async function buildUnifiedLookupResponse(context) {
         whois = { skipped: true, detail: 'WHOIS is omitted in fast RDAP-only mode.' };
     }
     else if (Array.isArray(whoisChain)) {
-        whois = { chain: whoisChain, parsed: parseWhoisChain(whoisChain, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined) };
+        whois = whoisStatus === 'unsupported' || whoisStatus === 'skipped'
+            ? { status: whoisStatus, chain: whoisChain,
+                detail: whoisChain[0]?.detail ?? 'IANA did not publish a domain WHOIS referral for this target.' }
+            : { chain: whoisChain, parsed: parseWhoisChain(whoisChain, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined),
+                ...(whoisStatus === 'error' ? { error: boundedSourceDetail({ message: whoisChain[0]?.error }, 'WHOIS lookup failed') } : {}) };
     }
     else {
         whois = {
@@ -138,13 +146,6 @@ async function buildUnifiedLookupResponse(context) {
             : !rdapRecord
                 ? 'unsupported'
                 : rdapRecord.upstreamStatus === 404 ? 'not_found' : 'success';
-    const whoisStatus = !whoisEnabled
-        ? 'disabled'
-        : skipWhois
-            ? 'skipped'
-            : whoisResult.status === 'rejected'
-                ? 'error'
-                : whoisCollectionStatus(whoisChain, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined);
     const availabilityStatus = classified.type !== 'domain'
         ? 'not_applicable'
         : !availabilityEnabled ? 'disabled'

package/lib/lookup-source-progress.mjs

@@ -100,9 +100,11 @@ function normalizeLookupSourceSettlement(source, outcome, value, requestedDomain
     const limitation = outcome === 'rejected'
         ? 'This source did not complete. No absence or safety conclusion was inferred.'
         : state === 'skipped'
-            ? 'This source was not requested or was not applicable to the target.'
+            ? 'This source was not queried: it was not requested, did not apply to the target, or was excluded by an access policy.'
             : state === 'unsupported'
-                ? 'This source could not provide authoritative evidence for this target.'
+                ? source === 'rdap' || source === 'whois'
+                    ? 'No service is published through the applicable registry discovery source for this target; this is not a failed lookup or an absence finding.'
+                    : 'This source could not provide authoritative evidence for this target.'
                 : state === 'partial'
                     ? 'This source returned incomplete evidence; missing fields remain unknown.'
                     : null;

package/lib/lookup.mjs

@@ -22,6 +22,7 @@ import { normalizeLookupSourceSettlement, plannedLookupProgressSources, } from "
 import { buildUnifiedLookupResponse } from "./lookup-response.mjs";
 import { createLookupTimingTracker } from "./lookup-diagnostics.mjs";
 import { prepareSelectedLookupUrl } from "../packages/evidence/lookup-target.mjs";
+import { createLookupCollectionReceiptTracker } from "./lookup-collection-receipt.mjs";
 async function runUnifiedLookup(classified, options = {}) {
     const fetchRdap = options.fetchRdapRecord || fetchRdapRecord;
     const fetchRegistrarRdap = options.fetchRegistrarRdapRecord || fetchRegistrarRdapRecord;
@@ -45,18 +46,42 @@ async function runUnifiedLookup(classified, options = {}) {
     const securityTxtRequested = options.securityTxt === true;
     const featurePolicy = options.featurePolicy || networkFeaturePolicy();
     const timing = createLookupTimingTracker(!fast && !compact, options.now || Date.now);
+    const receipt = !compact && options.onCollectionReceipt
+        ? createLookupCollectionReceiptTracker(classified, options) : null;
     const startedCollectors = [];
     const measure = (source, operation) => (timing.measure(source, () => abortable(() => {
+        receipt?.started(source);
         const running = Promise.resolve(operation());
         if (options.waitForStartedCollectors)
             startedCollectors.push(running.catch(() => { }));
         return running;
-    }, options.signal)));
+    }, options.signal)).then(value => {
+        receipt?.settled(source, 'fulfilled', value);
+        return value;
+    }, error => {
+        receipt?.settled(source, 'rejected', error);
+        throw error;
+    }));
     const rdapEnabled = featureDecision('rdap', featurePolicy).enabled;
     const whoisEnabled = featureDecision('whois', featurePolicy).enabled;
     const availabilityEnabled = featureDecision('availability', featurePolicy).enabled;
     const websiteProbeEnabled = featureDecision('website_probe', featurePolicy).enabled;
     const dnsIntelligenceEnabled = featureDecision('dns_intelligence', featurePolicy).enabled;
+    if (!rdapEnabled) {
+        receipt?.admission('rdap', 'disabled');
+        receipt?.admission('registrar_rdap', 'disabled');
+        receipt?.admission('network_context', 'disabled');
+    }
+    if (!whoisEnabled)
+        receipt?.admission('whois', 'disabled');
+    if (!availabilityEnabled) {
+        receipt?.admission('domain_evidence', 'disabled');
+        receipt?.admission('network_context', 'disabled');
+    }
+    if (!dnsIntelligenceEnabled)
+        receipt?.admission('reverse_dns', 'disabled');
+    if (!websiteProbeEnabled)
+        receipt?.admission('security_txt', 'disabled');
     const skipWhois = fast || !whoisEnabled;
     const selectedUrl = options.selectedUrl === undefined ? undefined
         : prepareSelectedLookupUrl(options.selectedUrl, classified.inputHostname ?? classified.value);
@@ -72,6 +97,8 @@ async function runUnifiedLookup(classified, options = {}) {
     // Registrar RDAP is a separately attributed deep-lookup enrichment. It may
     // overlap the WHOIS chain, but it never joins the promises used to decide
     // availability and can add up to its own bounded timeout to a deep lookup.
+    if (classified.type === 'domain' && rdapEnabled && !fast && !compact)
+        receipt?.admission('registrar_rdap', 'prerequisite_unavailable');
     const registrarRdapPromise = classified.type === 'domain' && rdapEnabled && !fast && !compact
         ? rdapPromise.then((record) => record && record.upstreamStatus === 200 && record.parsed
             ? measure('registrar_rdap', () => fetchRegistrarRdap(classified.value, record))
@@ -187,7 +214,7 @@ async function runUnifiedLookup(classified, options = {}) {
         }
     }
     try {
-        return await buildUnifiedLookupResponse({
+        const result = await buildUnifiedLookupResponse({
             availabilityEnabled,
             availabilityPromise,
             classified,
@@ -211,6 +238,10 @@ async function runUnifiedLookup(classified, options = {}) {
             whoisEnabled,
             whoisPromise,
         });
+        options.signal?.throwIfAborted();
+        if (receipt)
+            options.onCollectionReceipt?.(receipt.finish());
+        return result;
     }
     finally {
         if (options.waitForStartedCollectors)

package/lib/operation-budget.mjs

@@ -34,6 +34,7 @@ const OPERATION_FEATURES = Object.freeze({
     AVAILABILITY_FAST: 'availability_fast',
     AVAILABILITY_DEEP: 'availability_deep',
     CERTIFICATE_TRANSPARENCY: 'certificate_transparency',
+    DOMAIN_FEED_SEARCH: 'domain_feed_search',
     DOMAIN_POSTURE: 'domain_posture',
 });
 const OPERATION_FEATURE_CLASSES = Object.freeze({
@@ -47,6 +48,7 @@ const OPERATION_FEATURE_CLASSES = Object.freeze({
     [OPERATION_FEATURES.AVAILABILITY_FAST]: OPERATION_CLASSES.REGISTRY_LIGHT,
     [OPERATION_FEATURES.AVAILABILITY_DEEP]: OPERATION_CLASSES.REGISTRY_DEEP,
     [OPERATION_FEATURES.CERTIFICATE_TRANSPARENCY]: OPERATION_CLASSES.CERTIFICATE_SEARCH,
+    [OPERATION_FEATURES.DOMAIN_FEED_SEARCH]: OPERATION_CLASSES.CERTIFICATE_SEARCH,
     [OPERATION_FEATURES.DOMAIN_POSTURE]: OPERATION_CLASSES.POSTURE_AUDIT,
 });
 // The browser currently runs at most 12 fast Bulk workers, 4 deep Bulk
@@ -87,6 +89,8 @@ function operationFeatureFor(feature, { fast = false, compact = false } = {}) {
         return OPERATION_FEATURES.WHOIS;
     if (feature === 'certificate_transparency')
         return OPERATION_FEATURES.CERTIFICATE_TRANSPARENCY;
+    if (feature === 'domain_feed_search')
+        return OPERATION_FEATURES.DOMAIN_FEED_SEARCH;
     if (feature === 'domain_posture')
         return OPERATION_FEATURES.DOMAIN_POSTURE;
     return null;

package/lib/rdap-capabilities.mjs

@@ -3,14 +3,13 @@
 // search and does not treat an absent extension declaration as proof that a
 // server cannot support the related operation.
 export const RDAP_CAPABILITY_INSPECTION_VERSION = 1;
-export const RDAP_EXTENSION_CATALOG_REVIEWED_AT = '2026-07-31';
+export const RDAP_EXTENSION_CATALOG_REVIEWED_AT = '2026-10-14';
 export const MAX_RDAP_CAPABILITY_DECLARATIONS = 50;
 export const MAX_RDAP_UNKNOWN_CAPABILITIES = 20;
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
-// Reviewed against the protocol registry on 2026-07-31. The registry-drift
-// audit owns freshness checks; runtime lookup behavior never depends on this
-// catalogue being exhaustive.
-const EXTENSION_CATALOG = Object.freeze({
+// Published interpretation snapshot. Saved evidence selects this exact revision;
+// later catalogue revisions extend or replace entries without changing it.
+const JULY_2026_EXTENSION_CATALOG = Object.freeze({
     rdap_level_0: {
         label: 'Core RDAP response',
         category: 'core',
@@ -164,8 +163,39 @@ const EXTENSION_CATALOG = Object.freeze({
         capability: 'DNS time-to-live values in RDAP responses.',
     },
 });
+const RDAP_EXTENSION_CATALOGS = Object.freeze({
+    '2026-07-31': JULY_2026_EXTENSION_CATALOG,
+    '2026-10-14': Object.freeze({
+        ...JULY_2026_EXTENSION_CATALOG,
+        reliabilityassessment: {
+            label: 'Reliability assessment metadata',
+            category: 'operator',
+            capability: 'Operator-declared assessment metadata; no assessment is retrieved or verified.',
+        },
+    }),
+});
+const CATALOG_EPOCHS = Object.keys(RDAP_EXTENSION_CATALOGS).sort();
+export function resolveRdapCapabilityCatalogRevision(value) {
+    if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/u.test(value)
+        || value < CATALOG_EPOCHS[0] || value > RDAP_EXTENSION_CATALOG_REVIEWED_AT)
+        return null;
+    const time = Date.parse(`${value}T00:00:00.000Z`);
+    if (!Number.isFinite(time) || new Date(time).toISOString().slice(0, 10) !== value)
+        return null;
+    // Review-only renewals retain the same semantic epoch and the recorded date.
+    for (let index = CATALOG_EPOCHS.length - 1; index >= 0; index -= 1) {
+        const epoch = CATALOG_EPOCHS[index];
+        if (epoch <= value)
+            return epoch;
+    }
+    return null;
+}
 export function reviewedRdapExtensionCatalog() {
-    return Object.entries(EXTENSION_CATALOG)
+    const revision = resolveRdapCapabilityCatalogRevision(RDAP_EXTENSION_CATALOG_REVIEWED_AT);
+    if (revision === null)
+        throw new TypeError('Unsupported RDAP capability catalogue revision.');
+    const catalog = RDAP_EXTENSION_CATALOGS[revision];
+    return Object.entries(catalog)
         .filter(([, entry]) => entry.category !== 'core')
         .map(([identifier, entry]) => Object.freeze({
         identifier,
@@ -232,7 +262,11 @@ function reverseSearchCapability(state, declared) {
         ],
     };
 }
-export function inspectRdapCapabilities(parsedValue, status) {
+export function inspectRdapCapabilities(parsedValue, status, catalogReviewedAt = RDAP_EXTENSION_CATALOG_REVIEWED_AT) {
+    const revision = resolveRdapCapabilityCatalogRevision(catalogReviewedAt);
+    if (revision === null)
+        throw new TypeError('Unsupported RDAP capability catalogue revision.');
+    const catalog = RDAP_EXTENSION_CATALOGS[revision];
     const parsed = record(parsedValue);
     const state = sourceState(parsed, status);
     const rawDeclarations = Array.isArray(parsed?.conformance) ? parsed.conformance : [];
@@ -245,7 +279,7 @@ export function inspectRdapCapabilities(parsedValue, status) {
             break;
     }
     const declarations = [...unique].sort().map((value) => {
-        const entry = Object.hasOwn(EXTENSION_CATALOG, value) ? EXTENSION_CATALOG[value] : undefined;
+        const entry = Object.hasOwn(catalog, value) ? catalog[value] : undefined;
         return entry
             ? {
                 identifier: value,
@@ -281,7 +315,7 @@ export function inspectRdapCapabilities(parsedValue, status) {
     }
     return {
         version: RDAP_CAPABILITY_INSPECTION_VERSION,
-        catalogReviewedAt: RDAP_EXTENSION_CATALOG_REVIEWED_AT,
+        catalogReviewedAt,
         state,
         declarations,
         unknownIdentifiers,

package/lib/registry-insights.mjs

@@ -9,7 +9,8 @@ import { inspectRdapCapabilities } from "./rdap-capabilities.mjs";
 import { isRecord, recordOrEmpty } from "./json-record.mjs";
 import { MAX_RDAP_REDACTIONS, MAX_RDAP_STATUSES } from "./rdap-types.mjs";
 import { MAX_WHOIS_STATUSES } from "./whois-contracts.mjs";
-export const REGISTRY_INSIGHTS_VERSION = 1;
+import { LEGACY_REGISTRY_INSIGHTS_VERSION, REGISTRY_INSIGHTS_VERSION, isSupportedRegistryInsightsVersion, } from "../packages/contracts/registry-insights.mjs";
+export { REGISTRY_INSIGHTS_VERSION } from "../packages/contracts/registry-insights.mjs";
 export const MAX_REGISTRY_INSIGHT_STATUSES = 40;
 export const MAX_REGISTRY_INSIGHT_ISSUES = 12;
 export const MAX_REGISTRY_ABUSE_ROUTES = 8;
@@ -288,7 +289,10 @@ function contactRoute(kind, contact, source) {
         ],
     }));
 }
-export function buildRegistryInsights(input) {
+export function buildRegistryInsights(input, options = {}) {
+    const version = options.version ?? REGISTRY_INSIGHTS_VERSION;
+    if (!isSupportedRegistryInsightsVersion(version))
+        throw new TypeError('Unsupported registry insight version.');
     const rdap = record(input.rdapParsed);
     const whois = record(input.whoisParsed);
     const registrarRdap = record(input.registrarRdapParsed);
@@ -322,7 +326,14 @@ export function buildRegistryInsights(input) {
     ];
     const lifecycleCandidates = [
         { statuses: rdapStatuses.values, state: publications[0].state },
-        { statuses: whoisStatuses.values, state: publications[1].state },
+        {
+            statuses: whoisStatuses.values,
+            // A completed response describes collection, not positive registration.
+            // Preserve the old derivation only when verifying a historical export.
+            state: version === LEGACY_REGISTRY_INSIGHTS_VERSION || whois.registrationStatus === 'registered'
+                ? publications[1].state
+                : 'unavailable',
+        },
     ].filter((candidate) => candidate.state !== 'unavailable');
     const lifecycleSource = lifecycleCandidates.find((candidate) => candidate.statuses.length)
         ?? lifecycleCandidates[0]
@@ -343,7 +354,7 @@ export function buildRegistryInsights(input) {
             break;
     }
     return {
-        version: REGISTRY_INSIGHTS_VERSION,
+        version,
         contactDisclosure: {
             registryRdap: disclosure('registry_rdap', input.rdapParsed, input.rdapStatus),
             whois: disclosure('whois', input.whoisParsed, input.whoisStatus),
@@ -369,8 +380,8 @@ export function buildRegistryInsights(input) {
         },
         publications,
         rdapCapabilities: {
-            registry: inspectRdapCapabilities(input.rdapParsed, input.rdapStatus),
-            registrar: inspectRdapCapabilities(input.registrarRdapParsed, input.registrarRdapStatus),
+            registry: inspectRdapCapabilities(input.rdapParsed, input.rdapStatus, options.rdapCapabilityCatalogReviewedAt),
+            registrar: inspectRdapCapabilities(input.registrarRdapParsed, input.registrarRdapStatus, options.rdapCapabilityCatalogReviewedAt),
         },
         abuseRouting: [...uniqueRoutes.values()],
     };

package/lib/service-binding-dns.mjs

@@ -526,6 +526,8 @@ function defaultTcpExchange(query, resolver, options) {
             }
         });
         socket.once('connect', () => {
+            if (settled)
+                return;
             const length = Buffer.alloc(2);
             length.writeUInt16BE(query.length, 0);
             socket.write(Buffer.concat([length, query]));
@@ -534,6 +536,7 @@ function defaultTcpExchange(query, resolver, options) {
 }
 function defaultDnsExchange(query, resolver, options) {
     return new Promise((resolve, reject) => {
+        options.signal?.throwIfAborted();
         const socket = createSocket(resolver.family === 6 ? 'udp6' : 'udp4');
         let settled = false;
         const timer = setTimeout(() => {
@@ -544,6 +547,7 @@ function defaultDnsExchange(query, resolver, options) {
                 return;
             settled = true;
             clearTimeout(timer);
+            options.signal?.removeEventListener('abort', cancelled);
             try {
                 socket.close();
             }
@@ -555,6 +559,12 @@ function defaultDnsExchange(query, resolver, options) {
             else
                 resolve(response);
         };
+        const cancelled = () => finish(options.signal?.reason ?? new Error('DNS UDP query cancelled'));
+        options.signal?.addEventListener('abort', cancelled, { once: true });
+        if (options.signal?.aborted) {
+            cancelled();
+            return;
+        }
         socket.once('error', (error) => finish(error));
         socket.once('message', (message) => {
             if (message.length > MAX_DNS_MESSAGE_BYTES) {
@@ -565,6 +575,8 @@ function defaultDnsExchange(query, resolver, options) {
             }
         });
         socket.connect(resolver.port, resolver.address, () => {
+            if (settled)
+                return;
             socket.send(query, (error) => {
                 if (error)
                     finish(error);
@@ -592,6 +604,7 @@ function missingResponseError(rcode) {
     return new ServiceBindingDnsError(`DNS resolver returned ${names[rcode] || `rcode ${rcode}`}`, 'EDNSFAIL');
 }
 async function resolveServiceBindingRecords(nameValue, type, options = {}) {
+    options.signal?.throwIfAborted();
     const name = normalizeQueryName(nameValue);
     const transactionId = options.transactionId ?? randomInt(0x1_0000);
     const query = buildServiceBindingDnsQuery(name, type, transactionId);
@@ -608,17 +621,20 @@ async function resolveServiceBindingRecords(nameValue, type, options = {}) {
     const deadline = Date.now() + timeoutMs;
     let lastError = null;
     for (const resolver of resolvers) {
+        options.signal?.throwIfAborted();
         const udpTimeoutMs = deadline - Date.now();
         if (udpTimeoutMs <= 0)
             break;
         try {
-            let response = await exchange(query, resolver, { timeoutMs: udpTimeoutMs });
+            let response = await exchange(query, resolver, { timeoutMs: udpTimeoutMs, ...(options.signal ? { signal: options.signal } : {}) });
+            options.signal?.throwIfAborted();
             if (isTruncatedDnsResponse(response, transactionId)) {
                 const tcpTimeoutMs = deadline - Date.now();
                 if (tcpTimeoutMs <= 0) {
                     throw new ServiceBindingDnsError('DNS service-binding query timed out', 'ETIMEOUT');
                 }
-                response = await (options.tcpExchange || defaultTcpExchange)(query, resolver, { timeoutMs: tcpTimeoutMs });
+                response = await (options.tcpExchange || defaultTcpExchange)(query, resolver, { timeoutMs: tcpTimeoutMs, ...(options.signal ? { signal: options.signal } : {}) });
+                options.signal?.throwIfAborted();
             }
             const parsed = parseServiceBindingDnsResponse(response, { transactionId, name, type });
             if (parsed.truncatedResponse)
@@ -631,6 +647,7 @@ async function resolveServiceBindingRecords(nameValue, type, options = {}) {
             return { records: parsed.records, truncated: parsed.truncated };
         }
         catch (error) {
+            options.signal?.throwIfAborted();
             lastError = error;
             const code = error && typeof error === 'object' ? String(error.code || '') : '';
             if (code === 'ENODATA' || code === 'ENOTFOUND')