@slicedearth/whoisleuth-cli 2.6.0 → 2.7.0

package/lib/lookup-response.mjs

@@ -76,12 +76,16 @@ async function buildUnifiedLookupResponse(context) {
         ? { skipped: true, detail: 'RDAP is disabled by deployment policy.' }
         : rdapRecord
             ? { ...rdapRecord, ...(registrarRdap ? { registrarRdap } : {}) }
-            : {
-                error: rdapResult.status === 'rejected'
-                    ? boundedSourceDetail(rdapResult.reason, 'RDAP lookup failed')
-                    : 'No RDAP registry found for this query via IANA bootstrap',
-                attempts: rdapAttempts,
-            };
+            : rdapResult.status === 'rejected'
+                ? { error: boundedSourceDetail(rdapResult.reason, 'RDAP lookup failed'), attempts: rdapAttempts }
+                : { status: 'unsupported', detail: 'No RDAP service is listed for this target in the IANA bootstrap.', attempts: rdapAttempts };
+    const whoisStatus = !whoisEnabled
+        ? 'disabled'
+        : skipWhois
+            ? 'skipped'
+            : whoisResult.status === 'rejected'
+                ? 'error'
+                : whoisCollectionStatus(whoisChain, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined);
     let whois;
     if (!whoisEnabled) {
         whois = { skipped: true, detail: 'WHOIS is disabled by deployment policy.' };
@@ -90,7 +94,11 @@ async function buildUnifiedLookupResponse(context) {
         whois = { skipped: true, detail: 'WHOIS is omitted in fast RDAP-only mode.' };
     }
     else if (Array.isArray(whoisChain)) {
-        whois = { chain: whoisChain, parsed: parseWhoisChain(whoisChain, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined) };
+        whois = whoisStatus === 'unsupported' || whoisStatus === 'skipped'
+            ? { status: whoisStatus, chain: whoisChain,
+                detail: whoisChain[0]?.detail ?? 'IANA did not publish a domain WHOIS referral for this target.' }
+            : { chain: whoisChain, parsed: parseWhoisChain(whoisChain, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined),
+                ...(whoisStatus === 'error' ? { error: boundedSourceDetail({ message: whoisChain[0]?.error }, 'WHOIS lookup failed') } : {}) };
     }
     else {
         whois = {
@@ -138,13 +146,6 @@ async function buildUnifiedLookupResponse(context) {
             : !rdapRecord
                 ? 'unsupported'
                 : rdapRecord.upstreamStatus === 404 ? 'not_found' : 'success';
-    const whoisStatus = !whoisEnabled
-        ? 'disabled'
-        : skipWhois
-            ? 'skipped'
-            : whoisResult.status === 'rejected'
-                ? 'error'
-                : whoisCollectionStatus(whoisChain, classified.type === 'domain' ? classified.registrableDomain ?? classified.value : undefined);
     const availabilityStatus = classified.type !== 'domain'
         ? 'not_applicable'
         : !availabilityEnabled ? 'disabled'

package/lib/lookup-source-progress.mjs

@@ -100,9 +100,11 @@ function normalizeLookupSourceSettlement(source, outcome, value, requestedDomain
     const limitation = outcome === 'rejected'
         ? 'This source did not complete. No absence or safety conclusion was inferred.'
         : state === 'skipped'
-            ? 'This source was not requested or was not applicable to the target.'
+            ? 'This source was not queried: it was not requested, did not apply to the target, or was excluded by an access policy.'
             : state === 'unsupported'
-                ? 'This source could not provide authoritative evidence for this target.'
+                ? source === 'rdap' || source === 'whois'
+                    ? 'No service is published through the applicable registry discovery source for this target; this is not a failed lookup or an absence finding.'
+                    : 'This source could not provide authoritative evidence for this target.'
                 : state === 'partial'
                     ? 'This source returned incomplete evidence; missing fields remain unknown.'
                     : null;

package/lib/lookup.mjs

@@ -22,6 +22,7 @@ import { normalizeLookupSourceSettlement, plannedLookupProgressSources, } from "
 import { buildUnifiedLookupResponse } from "./lookup-response.mjs";
 import { createLookupTimingTracker } from "./lookup-diagnostics.mjs";
 import { prepareSelectedLookupUrl } from "../packages/evidence/lookup-target.mjs";
+import { createLookupCollectionReceiptTracker } from "./lookup-collection-receipt.mjs";
 async function runUnifiedLookup(classified, options = {}) {
     const fetchRdap = options.fetchRdapRecord || fetchRdapRecord;
     const fetchRegistrarRdap = options.fetchRegistrarRdapRecord || fetchRegistrarRdapRecord;
@@ -45,18 +46,42 @@ async function runUnifiedLookup(classified, options = {}) {
     const securityTxtRequested = options.securityTxt === true;
     const featurePolicy = options.featurePolicy || networkFeaturePolicy();
     const timing = createLookupTimingTracker(!fast && !compact, options.now || Date.now);
+    const receipt = !compact && options.onCollectionReceipt
+        ? createLookupCollectionReceiptTracker(classified, options) : null;
     const startedCollectors = [];
     const measure = (source, operation) => (timing.measure(source, () => abortable(() => {
+        receipt?.started(source);
         const running = Promise.resolve(operation());
         if (options.waitForStartedCollectors)
             startedCollectors.push(running.catch(() => { }));
         return running;
-    }, options.signal)));
+    }, options.signal)).then(value => {
+        receipt?.settled(source, 'fulfilled', value);
+        return value;
+    }, error => {
+        receipt?.settled(source, 'rejected', error);
+        throw error;
+    }));
     const rdapEnabled = featureDecision('rdap', featurePolicy).enabled;
     const whoisEnabled = featureDecision('whois', featurePolicy).enabled;
     const availabilityEnabled = featureDecision('availability', featurePolicy).enabled;
     const websiteProbeEnabled = featureDecision('website_probe', featurePolicy).enabled;
     const dnsIntelligenceEnabled = featureDecision('dns_intelligence', featurePolicy).enabled;
+    if (!rdapEnabled) {
+        receipt?.admission('rdap', 'disabled');
+        receipt?.admission('registrar_rdap', 'disabled');
+        receipt?.admission('network_context', 'disabled');
+    }
+    if (!whoisEnabled)
+        receipt?.admission('whois', 'disabled');
+    if (!availabilityEnabled) {
+        receipt?.admission('domain_evidence', 'disabled');
+        receipt?.admission('network_context', 'disabled');
+    }
+    if (!dnsIntelligenceEnabled)
+        receipt?.admission('reverse_dns', 'disabled');
+    if (!websiteProbeEnabled)
+        receipt?.admission('security_txt', 'disabled');
     const skipWhois = fast || !whoisEnabled;
     const selectedUrl = options.selectedUrl === undefined ? undefined
         : prepareSelectedLookupUrl(options.selectedUrl, classified.inputHostname ?? classified.value);
@@ -72,6 +97,8 @@ async function runUnifiedLookup(classified, options = {}) {
     // Registrar RDAP is a separately attributed deep-lookup enrichment. It may
     // overlap the WHOIS chain, but it never joins the promises used to decide
     // availability and can add up to its own bounded timeout to a deep lookup.
+    if (classified.type === 'domain' && rdapEnabled && !fast && !compact)
+        receipt?.admission('registrar_rdap', 'prerequisite_unavailable');
     const registrarRdapPromise = classified.type === 'domain' && rdapEnabled && !fast && !compact
         ? rdapPromise.then((record) => record && record.upstreamStatus === 200 && record.parsed
             ? measure('registrar_rdap', () => fetchRegistrarRdap(classified.value, record))
@@ -187,7 +214,7 @@ async function runUnifiedLookup(classified, options = {}) {
         }
     }
     try {
-        return await buildUnifiedLookupResponse({
+        const result = await buildUnifiedLookupResponse({
             availabilityEnabled,
             availabilityPromise,
             classified,
@@ -211,6 +238,10 @@ async function runUnifiedLookup(classified, options = {}) {
             whoisEnabled,
             whoisPromise,
         });
+        options.signal?.throwIfAborted();
+        if (receipt)
+            options.onCollectionReceipt?.(receipt.finish());
+        return result;
     }
     finally {
         if (options.waitForStartedCollectors)

package/lib/rdap-capabilities.mjs

@@ -3,14 +3,13 @@
 // search and does not treat an absent extension declaration as proof that a
 // server cannot support the related operation.
 export const RDAP_CAPABILITY_INSPECTION_VERSION = 1;
-export const RDAP_EXTENSION_CATALOG_REVIEWED_AT = '2026-07-31';
+export const RDAP_EXTENSION_CATALOG_REVIEWED_AT = '2026-10-14';
 export const MAX_RDAP_CAPABILITY_DECLARATIONS = 50;
 export const MAX_RDAP_UNKNOWN_CAPABILITIES = 20;
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
-// Reviewed against the protocol registry on 2026-07-31. The registry-drift
-// audit owns freshness checks; runtime lookup behavior never depends on this
-// catalogue being exhaustive.
-const EXTENSION_CATALOG = Object.freeze({
+// Published interpretation snapshot. Saved evidence selects this exact revision;
+// later catalogue revisions extend or replace entries without changing it.
+const JULY_2026_EXTENSION_CATALOG = Object.freeze({
     rdap_level_0: {
         label: 'Core RDAP response',
         category: 'core',
@@ -164,8 +163,39 @@ const EXTENSION_CATALOG = Object.freeze({
         capability: 'DNS time-to-live values in RDAP responses.',
     },
 });
+const RDAP_EXTENSION_CATALOGS = Object.freeze({
+    '2026-07-31': JULY_2026_EXTENSION_CATALOG,
+    '2026-10-14': Object.freeze({
+        ...JULY_2026_EXTENSION_CATALOG,
+        reliabilityassessment: {
+            label: 'Reliability assessment metadata',
+            category: 'operator',
+            capability: 'Operator-declared assessment metadata; no assessment is retrieved or verified.',
+        },
+    }),
+});
+const CATALOG_EPOCHS = Object.keys(RDAP_EXTENSION_CATALOGS).sort();
+export function resolveRdapCapabilityCatalogRevision(value) {
+    if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/u.test(value)
+        || value < CATALOG_EPOCHS[0] || value > RDAP_EXTENSION_CATALOG_REVIEWED_AT)
+        return null;
+    const time = Date.parse(`${value}T00:00:00.000Z`);
+    if (!Number.isFinite(time) || new Date(time).toISOString().slice(0, 10) !== value)
+        return null;
+    // Review-only renewals retain the same semantic epoch and the recorded date.
+    for (let index = CATALOG_EPOCHS.length - 1; index >= 0; index -= 1) {
+        const epoch = CATALOG_EPOCHS[index];
+        if (epoch <= value)
+            return epoch;
+    }
+    return null;
+}
 export function reviewedRdapExtensionCatalog() {
-    return Object.entries(EXTENSION_CATALOG)
+    const revision = resolveRdapCapabilityCatalogRevision(RDAP_EXTENSION_CATALOG_REVIEWED_AT);
+    if (revision === null)
+        throw new TypeError('Unsupported RDAP capability catalogue revision.');
+    const catalog = RDAP_EXTENSION_CATALOGS[revision];
+    return Object.entries(catalog)
         .filter(([, entry]) => entry.category !== 'core')
         .map(([identifier, entry]) => Object.freeze({
         identifier,
@@ -232,7 +262,11 @@ function reverseSearchCapability(state, declared) {
         ],
     };
 }
-export function inspectRdapCapabilities(parsedValue, status) {
+export function inspectRdapCapabilities(parsedValue, status, catalogReviewedAt = RDAP_EXTENSION_CATALOG_REVIEWED_AT) {
+    const revision = resolveRdapCapabilityCatalogRevision(catalogReviewedAt);
+    if (revision === null)
+        throw new TypeError('Unsupported RDAP capability catalogue revision.');
+    const catalog = RDAP_EXTENSION_CATALOGS[revision];
     const parsed = record(parsedValue);
     const state = sourceState(parsed, status);
     const rawDeclarations = Array.isArray(parsed?.conformance) ? parsed.conformance : [];
@@ -245,7 +279,7 @@ export function inspectRdapCapabilities(parsedValue, status) {
             break;
     }
     const declarations = [...unique].sort().map((value) => {
-        const entry = Object.hasOwn(EXTENSION_CATALOG, value) ? EXTENSION_CATALOG[value] : undefined;
+        const entry = Object.hasOwn(catalog, value) ? catalog[value] : undefined;
         return entry
             ? {
                 identifier: value,
@@ -281,7 +315,7 @@ export function inspectRdapCapabilities(parsedValue, status) {
     }
     return {
         version: RDAP_CAPABILITY_INSPECTION_VERSION,
-        catalogReviewedAt: RDAP_EXTENSION_CATALOG_REVIEWED_AT,
+        catalogReviewedAt,
         state,
         declarations,
         unknownIdentifiers,

package/lib/registry-insights.mjs

@@ -9,7 +9,8 @@ import { inspectRdapCapabilities } from "./rdap-capabilities.mjs";
 import { isRecord, recordOrEmpty } from "./json-record.mjs";
 import { MAX_RDAP_REDACTIONS, MAX_RDAP_STATUSES } from "./rdap-types.mjs";
 import { MAX_WHOIS_STATUSES } from "./whois-contracts.mjs";
-export const REGISTRY_INSIGHTS_VERSION = 1;
+import { LEGACY_REGISTRY_INSIGHTS_VERSION, REGISTRY_INSIGHTS_VERSION, isSupportedRegistryInsightsVersion, } from "../packages/contracts/registry-insights.mjs";
+export { REGISTRY_INSIGHTS_VERSION } from "../packages/contracts/registry-insights.mjs";
 export const MAX_REGISTRY_INSIGHT_STATUSES = 40;
 export const MAX_REGISTRY_INSIGHT_ISSUES = 12;
 export const MAX_REGISTRY_ABUSE_ROUTES = 8;
@@ -288,7 +289,10 @@ function contactRoute(kind, contact, source) {
         ],
     }));
 }
-export function buildRegistryInsights(input) {
+export function buildRegistryInsights(input, options = {}) {
+    const version = options.version ?? REGISTRY_INSIGHTS_VERSION;
+    if (!isSupportedRegistryInsightsVersion(version))
+        throw new TypeError('Unsupported registry insight version.');
     const rdap = record(input.rdapParsed);
     const whois = record(input.whoisParsed);
     const registrarRdap = record(input.registrarRdapParsed);
@@ -322,7 +326,14 @@ export function buildRegistryInsights(input) {
     ];
     const lifecycleCandidates = [
         { statuses: rdapStatuses.values, state: publications[0].state },
-        { statuses: whoisStatuses.values, state: publications[1].state },
+        {
+            statuses: whoisStatuses.values,
+            // A completed response describes collection, not positive registration.
+            // Preserve the old derivation only when verifying a historical export.
+            state: version === LEGACY_REGISTRY_INSIGHTS_VERSION || whois.registrationStatus === 'registered'
+                ? publications[1].state
+                : 'unavailable',
+        },
     ].filter((candidate) => candidate.state !== 'unavailable');
     const lifecycleSource = lifecycleCandidates.find((candidate) => candidate.statuses.length)
         ?? lifecycleCandidates[0]
@@ -343,7 +354,7 @@ export function buildRegistryInsights(input) {
             break;
     }
     return {
-        version: REGISTRY_INSIGHTS_VERSION,
+        version,
         contactDisclosure: {
             registryRdap: disclosure('registry_rdap', input.rdapParsed, input.rdapStatus),
             whois: disclosure('whois', input.whoisParsed, input.whoisStatus),
@@ -369,8 +380,8 @@ export function buildRegistryInsights(input) {
         },
         publications,
         rdapCapabilities: {
-            registry: inspectRdapCapabilities(input.rdapParsed, input.rdapStatus),
-            registrar: inspectRdapCapabilities(input.registrarRdapParsed, input.registrarRdapStatus),
+            registry: inspectRdapCapabilities(input.rdapParsed, input.rdapStatus, options.rdapCapabilityCatalogReviewedAt),
+            registrar: inspectRdapCapabilities(input.registrarRdapParsed, input.registrarRdapStatus, options.rdapCapabilityCatalogReviewedAt),
         },
         abuseRouting: [...uniqueRoutes.values()],
     };