seer-core 0.51.0

use chrono::{DateTime, FixedOffset, Utc};
use regex::Regex;
use serde::{Deserialize, Serialize};
use std::sync::LazyLock;

use super::parsers::{push_bounded, MAX_NAMESERVERS, MAX_STATUSES};

/// Compiles one `Label: value` pattern per label, matching anywhere on a
/// line: `(?i)<label>:[ \t]*(.+)`. Labels are regex fragments; a list's order
/// is its priority ([`extract_field_with_patterns`] takes the first match).
///
/// The label is separated from its value by `[ \t]*` (horizontal whitespace
/// only), never `\s*`: `\s` also matches `\r`/`\n`, so an EMPTY field
/// (`Name Server: \r\n`, `DNSSEC:\n`) would swallow the line break and capture
/// the NEXT line as its value (`DNSSEC: URL of the ICANN Whois Inaccuracy
/// Complaint Form: …`). Registries that genuinely put the value on the
/// following line (NASK `REGISTRAR:\n<name>`, DNS Belgium
/// `Registrar:\n\tName: <name>`) are handled explicitly by
/// [`extract_section_value`] instead.
pub(super) fn field_patterns(labels: &[&str]) -> Vec<Regex> {
    labels
        .iter()
        .map(|label| compile(&format!(r"(?i){label}:[ \t]*(.+)")))
        .collect()
}

/// Like [`field_patterns`], but anchored to the start of a line (indentation
/// allowed), for labels that also end a longer one (`Organization:` inside
/// `Admin Organization:`) or would otherwise match inside prose.
fn line_field_patterns(labels: &[&str]) -> Vec<Regex> {
    labels
        .iter()
        .map(|label| compile(&format!(r"(?im)^[ \t]*{label}:[ \t]*(.+)$")))
        .collect()
}

fn compile(pattern: &str) -> Regex {
    Regex::new(pattern).expect("valid WHOIS field regex")
}

static REGISTRAR_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Registrar", "Registrar Name", "Sponsoring Registrar"]));

static REGISTRANT_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Registrant Name", "Registrant"]));

static ORGANIZATION_PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
    let mut patterns = field_patterns(&["Registrant Organization"]);
    // The bare/ambiguous org labels are line-anchored so they cannot match the
    // "Organization:" inside "Admin Organization:" / "Tech Organization:" and
    // thereby attribute another contact's org to the registrant.
    patterns.extend(line_field_patterns(&[
        "Organization",
        "org-name",
        "Org Name",
    ]));
    patterns
});

static CREATION_DATE_PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
    let mut patterns = field_patterns(&[
        "Creation Date",
        "Created Date",
        "Created On",
        "Created",
        "Registration Date",
        "Domain Registration Date",
    ]);
    // Punktum (.dk) style `Registered:           2018-01-25`, and French
    // registries (ANINF .ga) `Date de création:`.
    patterns.extend(line_field_patterns(&["Registered", "Date de création"]));
    patterns
});

static EXPIRATION_DATE_PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
    let mut patterns = field_patterns(&[
        "(?:Registry )?Expir(?:y|ation) Date",
        "Expiration Date",
        "Expires On",
        "Expires",
        "Expiry Date",
        "paid-till",
    ]);
    // French registries (ANINF .ga): `Date d'expiration:`
    patterns.extend(line_field_patterns(&["Date d'expiration"]));
    patterns
});

static UPDATED_DATE_PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
    let mut patterns = field_patterns(&[
        "Updated Date",
        "Last Updated On",
        "Last Modified",
        "Last Update",
        "Modified",
    ]);
    // French registries (ANINF .ga): `Dernière modification:` — contact
    // blocks repeat this label; extract_field_with_patterns takes the first
    // match, which is the domain-level line.
    patterns.extend(line_field_patterns(&["Dernière modification"]));
    patterns
});

static DNSSEC_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["DNSSEC", "DNSSEC Status"]));

static NAMESERVER_PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
    let mut patterns = field_patterns(&["Name Server", "Nameserver", "nserver"]);
    patterns.push(compile(r"(?im)^NS:[ \t]+(.+)$"));
    // Punktum (.dk) lists nameservers as `Hostname:` lines under a
    // `Nameservers` heading (line-anchored to avoid hostname mentions inside
    // prose); French registries (ANINF .ga) use `Serveur de noms:` lines.
    patterns.extend(line_field_patterns(&["Hostname", "Serveur de noms"]));
    patterns
});

static REGISTRANT_EMAIL_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Registrant Email", "Registrant E-mail"]));

static REGISTRANT_PHONE_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Registrant Phone", "Registrant Tel"]));

static REGISTRANT_ADDRESS_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Registrant Street", "Registrant Address"]));

static REGISTRANT_COUNTRY_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Registrant Country"]));

static ADMIN_NAME_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Admin Name", "Administrative Contact Name"]));

static ADMIN_ORG_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Admin Organization"]));

static ADMIN_EMAIL_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Admin Email", "Admin E-mail"]));

static ADMIN_PHONE_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Admin Phone", "Admin Tel"]));

static TECH_NAME_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Tech Name", "Technical Contact Name"]));

static TECH_ORG_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Tech Organization"]));

static TECH_EMAIL_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Tech Email", "Tech E-mail"]));

static TECH_PHONE_PATTERNS: LazyLock<Vec<Regex>> =
    LazyLock::new(|| field_patterns(&["Tech Phone", "Tech Tel"]));

#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct WhoisResponse {
    pub domain: String,
    pub registrar: Option<String>,
    pub registrant: Option<String>,
    pub organization: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub registrant_email: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub registrant_phone: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub registrant_address: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub registrant_country: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub admin_name: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub admin_organization: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub admin_email: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub admin_phone: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub tech_name: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub tech_organization: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub tech_email: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub tech_phone: Option<String>,
    pub creation_date: Option<DateTime<Utc>>,
    pub expiration_date: Option<DateTime<Utc>>,
    pub updated_date: Option<DateTime<Utc>>,
    pub nameservers: Vec<String>,
    pub status: Vec<String>,
    pub dnssec: Option<String>,
    pub whois_server: String,
    // Suppressed from default serialization: the raw response is up to 1 MB of
    // attacker-controlled content from third-party registries/registrars. It
    // leaking into API/MCP JSON output creates a prompt-injection vector for
    // downstream LLM consumers. The field is still populated internally for
    // is_available() / indicates_not_found() scanning and for callers that
    // access it directly via struct field.
    //
    // `default` is required alongside `skip_serializing`: without it, a
    // round-trip through serialized JSON (e.g. lookup history persistence,
    // the lookup cache) fails to deserialize with "missing field
    // `raw_response`", because—unlike `Option`—a bare `String` is not
    // defaulted on absence. The skip keeps it out of the JSON; the default
    // lets it read back as empty.
    #[serde(skip_serializing, default)]
    pub raw_response: String,
}

impl WhoisResponse {
    /// Parses a WHOIS response with the registry-specific parser for the
    /// domain's TLD, falling back to the generic parser otherwise.
    pub fn parse(domain: &str, whois_server: &str, raw: &str) -> Self {
        super::parsers::parse(domain, whois_server, raw)
    }

    /// The generic regex-based parser: the fallback for every TLD without a
    /// registry-specific parser (see [`parse`](Self::parse)).
    pub fn parse_internal(domain: &str, whois_server: &str, raw: &str) -> Self {
        let registrar = extract_field_with_patterns(raw, &REGISTRAR_PATTERNS)
            .or_else(|| extract_section_value(raw, &["registrar"]));
        let registrant = extract_field_with_patterns(raw, &REGISTRANT_PATTERNS)
            .or_else(|| extract_section_value(raw, &["registrant"]));
        let organization = extract_field_with_patterns(raw, &ORGANIZATION_PATTERNS);
        let registrant_email = extract_field_with_patterns(raw, &REGISTRANT_EMAIL_PATTERNS);
        let registrant_phone = extract_field_with_patterns(raw, &REGISTRANT_PHONE_PATTERNS);
        let registrant_address = extract_field_with_patterns(raw, &REGISTRANT_ADDRESS_PATTERNS);
        let registrant_country = extract_field_with_patterns(raw, &REGISTRANT_COUNTRY_PATTERNS);
        let admin_name = extract_field_with_patterns(raw, &ADMIN_NAME_PATTERNS);
        let admin_organization = extract_field_with_patterns(raw, &ADMIN_ORG_PATTERNS);
        let admin_email = extract_field_with_patterns(raw, &ADMIN_EMAIL_PATTERNS);
        let admin_phone = extract_field_with_patterns(raw, &ADMIN_PHONE_PATTERNS);
        let tech_name = extract_field_with_patterns(raw, &TECH_NAME_PATTERNS);
        let tech_organization = extract_field_with_patterns(raw, &TECH_ORG_PATTERNS);
        let tech_email = extract_field_with_patterns(raw, &TECH_EMAIL_PATTERNS);
        let tech_phone = extract_field_with_patterns(raw, &TECH_PHONE_PATTERNS);
        // Extract the raw date strings first so the registry's date order can
        // be inferred from any unambiguous one before parsing the ambiguous
        // ones (issue #47). A registry is internally consistent, so the order
        // revealed by one date applies to all dates in the response.
        // SWITCH (.ch/.li) puts the value on the line after the header.
        let creation_str = extract_field_with_patterns(raw, &CREATION_DATE_PATTERNS)
            .or_else(|| extract_section_value(raw, &["first registration date"]));
        let expiration_str = extract_field_with_patterns(raw, &EXPIRATION_DATE_PATTERNS);
        let updated_str = extract_field_with_patterns(raw, &UPDATED_DATE_PATTERNS);
        let date_order = infer_date_order(
            [&creation_str, &expiration_str, &updated_str]
                .into_iter()
                .flatten()
                .map(String::as_str),
        )
        .unwrap_or(DateOrder::DayFirst);
        let creation_date = creation_str
            .as_deref()
            .and_then(|s| parse_date_with_order(s, date_order));
        let expiration_date = expiration_str
            .as_deref()
            .and_then(|s| parse_date_with_order(s, date_order));
        let updated_date = updated_str
            .as_deref()
            .and_then(|s| parse_date_with_order(s, date_order));
        let nameservers = extract_nameservers(raw);
        let status = extract_status_top_level(raw);
        let dnssec = extract_field_with_patterns(raw, &DNSSEC_PATTERNS);

        WhoisResponse {
            domain: domain.to_string(),
            registrar,
            registrant,
            organization,
            registrant_email,
            registrant_phone,
            registrant_address,
            registrant_country,
            admin_name,
            admin_organization,
            admin_email,
            admin_phone,
            tech_name,
            tech_organization,
            tech_email,
            tech_phone,
            creation_date,
            expiration_date,
            updated_date,
            nameservers,
            status,
            dnssec,
            whois_server: whois_server.to_string(),
            raw_response: raw.to_string(),
        }
    }

    /// True when a registrar or a registration date was extracted — what a
    /// registrar referral must carry to replace the registry's record.
    pub(crate) fn has_registration_fields(&self) -> bool {
        self.registrar.is_some() || self.creation_date.is_some() || self.expiration_date.is_some()
    }

    /// "Thin" = no positive registration signal at all: no registrar, no
    /// creation/expiry date, and no delegated nameservers. A thin body is what
    /// blocked or RDAP-first registries return for an unregistered domain.
    ///
    /// Nameservers count as registration data because some registries never
    /// publish a registrar or dates over port 43: DENIC (.de, which has no
    /// RDAP) returns only `Nserver`/`Status`/`Changed`, so without them every
    /// registered .de domain read as thin and was reported as "registry detail
    /// unavailable, retry shortly" with its WHOIS data discarded. Shared by
    /// [`is_available`](Self::is_available), the availability fallback ladder
    /// and the smart-lookup routes so they cannot drift.
    pub(crate) fn is_thin(&self) -> bool {
        !self.has_registration_fields() && self.nameservers.is_empty()
    }

    /// True when any registration field at all was extracted: the
    /// [`is_thin`](Self::is_thin) fields or a status.
    pub(crate) fn has_any_registry_field(&self) -> bool {
        !self.is_thin() || !self.status.is_empty()
    }

    /// Returns true if the response contains the core registration fields
    /// that registries typically provide (registrar, dates, nameservers).
    /// When true, following the registrar referral can be skipped since the
    /// additional detail (contact info) is usually GDPR-redacted anyway.
    ///
    /// Some registries (NIC.LV, SIDN/.nl) intentionally omit creation/expiry
    /// from their WHOIS, so accept a non-empty `status` field as an
    /// alternative registry signal alongside registrar + nameservers — this
    /// avoids a wasted referral attempt on every lookup for those TLDs.
    pub fn has_core_data(&self) -> bool {
        let has_dates_or_status = self.creation_date.is_some()
            || self.expiration_date.is_some()
            || !self.status.is_empty();
        self.registrar.is_some() && has_dates_or_status && !self.nameservers.is_empty()
    }

    /// Returns true when the registry's WHOIS server replied with a
    /// service-level "this TLD is not served here" / malformed-query sentinel
    /// instead of domain data — i.e. there is no usable port-43 WHOIS for this
    /// query. This is common for Identity Digital RDAP-only TLDs (.email,
    /// .life, .ninja, …) whose `whois.nic.<tld>` host answers "TLD is not
    /// supported." to every query and whose RDAP advertises `port43: null`.
    ///
    /// Distinct from [`is_available`](Self::is_available) (the domain is
    /// unregistered) and from a thin-but-valid record: it only fires when no
    /// registration field was extracted AND the body matches a known
    /// service-error sentinel at the start of a line.
    pub fn registry_unavailable(&self) -> bool {
        // Only meaningful when we extracted no registration data at all — a
        // record with a registrar / dates / nameservers / status is real data,
        // never a service error.
        if self.has_any_registry_field() {
            return false;
        }
        // Match known service-error sentinels at the start of a (trimmed) line,
        // mirroring `indicates_not_found`'s anchoring to avoid false positives
        // from TOS boilerplate that may quote these phrases.
        const SERVICE_ERROR_SENTINELS: &[&str] = &[
            "tld is not supported",
            "this tld is not",
            "malformed request",
            "invalid query",
            "no whois server is known",
            "this server does not",
        ];
        // Registries retiring port-43 WHOIS under ICANN's RDAP transition
        // (e.g. GMO Registry, May 2026) answer every query with a prose
        // retirement notice; the phrase can sit mid-sentence, so it is
        // matched with contains() rather than the line-start sentinels.
        const SERVICE_RETIRED_PHRASES: &[&str] =
            &["whois service has been retired", "whois has been retired"];
        let lower = self.raw_response.to_lowercase();
        lower.lines().any(|line| {
            let t = line.trim_start();
            SERVICE_ERROR_SENTINELS.iter().any(|s| t.starts_with(s))
                || SERVICE_RETIRED_PHRASES.iter().any(|s| t.contains(s))
        })
    }

    pub fn is_available(&self) -> bool {
        // A response carrying concrete registration data is registered, full
        // stop — never let an unanchored substring match (a "not found" /
        // "object not found" fragment buried in an abuse-contact line, notice,
        // or registrant value) flip a registered domain to "available". This
        // guards the H6 false-positive class without having to anchor every
        // pattern (which would regress legitimate mid-line phrasings like
        // TWNIC "Domain not found." or HKIRC "...has not been registered.").
        if !self.is_thin() {
            return false;
        }

        // Scan the full response line-by-line (excluding empty lines). Some
        // registries (TWNIC, JPRS, NIC.br) prepend 3-4 notice lines before the
        // "no match" line, which would escape a small take(N) window.
        //
        // Comment markers are STRIPPED rather than skipped: many ccTLD
        // registries print the verdict itself on a comment line (AFNIC
        // "%% NOT FOUND", NORID "% No match", CZ.NIC "%ERROR:101: no entries
        // found", RESTENA "% No such domain" — captured live 2026-07). The
        // word-count gate and the non-availability veto below still shield
        // against TOS prose on those same comment lines.
        //
        // Stream the scan line-by-line — avoids the ~1 MB `Vec<&str>` +
        // ~1 MB joined `String` the previous implementation allocated for
        // every call. Each line's lowercase form is a fresh small `String`
        // (the size of one line, not the whole body) which is dropped at
        // the end of the iteration.
        for line in self.raw_response.lines() {
            let content = line.trim().trim_start_matches(['%', '#']).trim_start();
            if content.is_empty() {
                continue;
            }
            // Normalize internal whitespace (tabs, runs of spaces) to single
            // spaces before matching. Registries like DNS Belgium print
            // "Status:\tAVAILABLE" with a tab, which would otherwise slip
            // past space-delimited patterns such as "status: available".
            let lower = content.to_lowercase();
            let words: Vec<&str> = lower.split_whitespace().collect();
            let normalized = words.join(" ");
            // A line that negates or refuses availability is never an
            // availability indicator, even when it contains an availability
            // substring (e.g. "available for registration" inside "not
            // available for registration", or "no data found" inside a
            // rate-limit banner). Skip it BEFORE the positive match so the
            // unanchored contains() cannot invert a refused/reserved name into
            // "available" (issue #45).
            if is_non_availability_line(&normalized) {
                continue;
            }
            // Sentence-form verdicts (KISA, EDUCAUSE, NASK) run past the word
            // gate; they are matched anchored at line start instead, which a
            // footer merely *quoting* the phrase mid-sentence cannot satisfy.
            if AVAILABILITY_SENTENCE_PATTERNS
                .iter()
                .any(|p| normalized.starts_with(p))
            {
                return true;
            }
            // Availability indicators are short status lines — the longest
            // known registry phrasing ("No information was found matching
            // that query.") is 7 words. Anything longer is prose (a TOS or
            // notice footer) that may merely quote a phrase like "not found"
            // or "does not exist"; skipping it avoids flipping a registered
            // (but thin, fieldless) response to "available". The H6 guard
            // above already covers responses that DO carry registration data.
            if words.len() > MAX_STATUS_LINE_WORDS {
                continue;
            }
            if AVAILABILITY_PATTERNS.iter().any(|p| normalized.contains(p)) {
                return true;
            }
            // SIDN (.nl) / SETAR (.aw) style "<domain> is free": suffix-anchored
            // so prose like "registration is free of charge" cannot match.
            if normalized.ends_with(" is free") {
                return true;
            }
        }
        false
    }

    /// Checks if the response indicates the registrar doesn't have data for this domain.
    /// This is different from is_available() - the domain may exist at the registry level
    /// but the referral registrar may not have data for it.
    ///
    /// Matches patterns only at the start of a (trimmed) line to avoid false
    /// positives from TOS footer boilerplate that may quote these phrases.
    pub fn indicates_not_found(&self) -> bool {
        let lower = self.raw_response.to_lowercase();
        lower.lines().any(|line| {
            let t = line.trim_start();
            NOT_FOUND_PATTERNS.iter().any(|p| t.starts_with(p))
        })
    }

    /// Returns true when the WHOIS body explicitly *refuses*, *throttles*, or
    /// *negates* availability rather than answering it: a rate-limit / quota /
    /// access-denied banner, a port-43 refusal, a reserved/blocked status, or an
    /// explicit "not available for registration". Used by the availability
    /// fallback ([`crate::availability`]) to route such bodies to an
    /// inconclusive verdict instead of guessing "available"/"registered" from
    /// weaker signals like DNS presence.
    ///
    /// Distinct from [`is_available`](Self::is_available) (a conclusive
    /// "no match") and [`registry_unavailable`](Self::registry_unavailable)
    /// (the TLD has no usable port-43 WHOIS server at all). Scans every
    /// non-comment line (no word-count gate) so a sentence-form refusal like
    /// SWITCH's "Requests of this client are not permitted." is caught.
    pub fn indicates_registry_refusal(&self) -> bool {
        for line in self.raw_response.lines() {
            let trimmed = line.trim();
            if trimmed.is_empty() || trimmed.starts_with('#') || trimmed.starts_with('%') {
                continue;
            }
            let lower = trimmed.to_lowercase();
            let normalized = lower.split_whitespace().collect::<Vec<_>>().join(" ");
            if is_non_availability_line(&normalized) {
                return true;
            }
        }
        false
    }
}

/// Maximum word count for a line to be considered an availability *status*
/// line rather than prose. Registry "not found" phrasings are short (the
/// longest observed is 7 words); TOS/notice footers that merely quote such
/// phrases run much longer. Lines above this bound are ignored by
/// `is_available()` so footer prose can't flip a thin response to available.
const MAX_STATUS_LINE_WORDS: usize = 10;

/// Patterns indicating a domain is available (unregistered).
/// Matched case-insensitively via `contains()` on short status lines only
/// (see `MAX_STATUS_LINE_WORDS`).
const AVAILABILITY_PATTERNS: &[&str] = &[
    "no match for",
    "no match",
    "not found",
    "no data found",
    "no entries found",
    "domain not found",
    "available for registration",
    "not registered",
    // HKIRC (.hk / .香港) phrases it "has not been registered" — the bare
    // "not registered" above does not cover the interposed "been".
    "not been registered",
    "status: available",
    "status: free",
    "no object found",
    "does not exist",
    // Additional registry phrasings surfaced by a cross-TLD audit, mostly
    // no-RDAP ccTLDs where WHOIS is the only registry signal. All are unique
    // to "not found" responses (verified not to collide with registered or
    // "not available" bodies).
    "nothing found", // KazNIC .kz / .қаз ("*** Nothing found for this query.") and NIC.AT .at
    "no found",      // TWNIC .tw / 台灣 / 台湾 ("No Found")
    "no record found", // .ls and others ("No record found for '...'.")
    "no information was found", // .africa ("No information was found matching that query.")
    "object not found", // generic ("Object not found")
    "not find matchingrecord", // CONAC .政务 / .公益 ("Not find MatchingRecord")
    // Phrasings surfaced by the 2026-07 full-TLD live sweep:
    "no such domain",             // RESTENA .lu ("% No such domain")
    "object_not_found",           // NIC Mexico .mx ("No_Se_Encontro_El_Objeto/Object_Not_Found")
    "no se encuentra registrado", // NIC Argentina .ar (Spanish-only response)
    // ISOC-IL .il / .ישראל: "% No data was found to match the request
    // criteria." — "was" breaks the bare "no data found" pattern above.
    "no data was found",
];

/// Sentence-form "not found" verdicts that exceed [`MAX_STATUS_LINE_WORDS`].
/// Matched with `starts_with` on the normalized line (anchored), so TOS
/// footers that merely quote such a phrase mid-sentence cannot match.
/// Wording captured live 2026-07.
const AVAILABILITY_SENTENCE_PATTERNS: &[&str] = &[
    // KISA .kr: "The requested domain was not found in the Registry or
    // Registrar’s WHOIS Server."
    "the requested domain was not found",
    // EDUCAUSE .edu: "The domain name you requested was not found in our
    // database."
    "the domain name you requested was not found",
    // NASK .pl: "No information available about domain name <x> in the
    // Registry NASK database."
    "no information available about domain name",
];

/// Phrases that mark a status line as the *opposite* of available — an explicit
/// negation ("not available"), a reserved/blocked status, or a throttle/refusal
/// (rate limit, quota, access denied). Checked BEFORE [`AVAILABILITY_PATTERNS`]
/// in `is_available` so an unanchored positive substring (e.g. "available for
/// registration" inside "not available for registration", or "no data found"
/// inside a rate-limit banner) cannot invert a refused/reserved name into
/// "available, high confidence" (issue #45). Also backs
/// [`WhoisResponse::indicates_registry_refusal`] for routing such bodies to an
/// inconclusive availability verdict.
///
/// Every entry here contains a space, so it can never occur inside a domain
/// name and is safely matched with `contains()`. Single-token markers live in
/// [`NON_AVAILABILITY_WORDS`].
const NON_AVAILABILITY_PATTERNS: &[&str] = &[
    "not available", // "...is not available for registration."
    // Reserved-status phrasings. Deliberately NOT the bare word "reserved":
    // nearly every WHOIS body ends with an "All rights reserved." copyright
    // footer, and matching it would misroute genuinely-unregistered domains
    // to "inconclusive" before the DNS tie-breaker runs.
    "reserved -",    // "reserved - not registered for public use"
    "is reserved",   // "this name is reserved by the registry"
    "been reserved", // "this domain has been reserved"
    "reserved by",   // "reserved by the registry operator"
    "reserved for",  // "reserved for future use"
    "status: reserved",
    "reserved domain", // "Reserved Domain Name" (ICANN reserved names)
    "reserved name",
    "rate limit", // "rate limited" / "Access rate limited; ..."
    "rate exceeded",
    "too many requests",
    "access denied",
    "not permitted", // SWITCH .ch "Requests of this client are not permitted."
    "try again",     // throttle hint ("please try again later")
    "temporarily unavailable",
];

/// Single-token refusal / throttle markers. Unlike the phrases above these
/// can occur INSIDE the domain name a "no match" line echoes back
/// (`quotations.pl`, `UNBLOCKED-GAMES.COM`, `refused.ls`), which would turn a
/// conclusive "available" into "inconclusive". They are therefore matched as
/// whole words only — see [`contains_word`].
const NON_AVAILABILITY_WORDS: &[&str] = &[
    "rate-limit",   // hyphenated variant of "rate limit"
    "rate-limited", // "Your IP has been rate-limited."
    "quota",
    "denied",
    "refused",
    "blocked",
];

/// True when a normalized (lowercased, single-spaced) line negates, refuses
/// or throttles availability.
fn is_non_availability_line(normalized: &str) -> bool {
    NON_AVAILABILITY_PATTERNS
        .iter()
        .any(|p| normalized.contains(p))
        || NON_AVAILABILITY_WORDS
            .iter()
            .any(|w| contains_word(normalized, w))
}

/// Characters that can be part of a domain-name label.
fn is_label_char(c: char) -> bool {
    c.is_alphanumeric() || c == '-' || c == '_'
}

/// True when `word` occurs in `haystack` as a whole word rather than as part
/// of a domain name: it may not touch a label character on either side, nor a
/// `.` that joins it to another label (`refused.ls`, `www.blocked`). A `.`
/// that merely ends the sentence (`Query refused.`) is still a boundary.
fn contains_word(haystack: &str, word: &str) -> bool {
    haystack.match_indices(word).any(|(start, _)| {
        let before_ok = haystack[..start]
            .chars()
            .next_back()
            .is_none_or(|c| !is_label_char(c) && c != '.');
        let mut after = haystack[start + word.len()..].chars();
        let after_ok = match after.next() {
            None => true,
            Some('.') => after.next().is_none_or(|c| !is_label_char(c)),
            Some(c) => !is_label_char(c),
        };
        before_ok && after_ok
    })
}

/// Patterns indicating the registrar didn't have data for this domain.
/// Matched at the start of a trimmed line (not inside TOS footers).
const NOT_FOUND_PATTERNS: &[&str] = &[
    "no match for",
    "domain not found",
    "no data found",
    "queried object does not exist",
    "object does not exist",
    "not found:",
    "status: free",
    "domain is not registered",
];

fn extract_field_with_patterns(text: &str, patterns: &[Regex]) -> Option<String> {
    for re in patterns {
        // The first occurrence of this label that carries a value. An empty
        // occurrence (`Label: \r\n` — the `(.+)` captures just the `\r`) is
        // skipped so CRLF and LF bodies behave alike: under LF the regex
        // engine already steps past an empty `Label:\n` line on its own.
        let first_value = re
            .captures_iter(text)
            .filter_map(|caps| caps.get(1))
            .map(|m| m.as_str().trim())
            .find(|v| !v.is_empty());
        if let Some(value) = first_value {
            if !is_placeholder_value(value) {
                return Some(value.to_string());
            }
        }
    }
    None
}

/// Registry/registrar boilerplate printed in place of contact data — most
/// often in the `Registrant Email:` slot of post-GDPR gTLD output — that is
/// NOT a value ("Please query the RDDS service of the Registrar of Record
/// identified in this output for information on how to contact the
/// Registrant, …").
const PLACEHOLDER_PHRASES: &[&str] = &[
    "please query the rdds",
    "please query the whois",
    "please ask the registrar",
    "how to contact the registrant",
    "select request email form",    // MarkMonitor
    "select contact domain holder", // GoDaddy
];

/// True for values that are privacy/redaction placeholders or boilerplate
/// rather than real data ("REDACTED FOR PRIVACY", "Not disclosed", DNS
/// Belgium's "Not shown, please visit www.dnsbelgium.be for webbased whois.",
/// [`PLACEHOLDER_PHRASES`], "N/A").
fn is_placeholder_value(value: &str) -> bool {
    let lower = value.to_lowercase();
    lower.contains("redacted")
        || lower.contains("data protected")
        || lower.contains("privacy")
        || lower.contains("not disclosed")
        || lower.contains("not shown")
        || lower.contains("withheld")
        || PLACEHOLDER_PHRASES.iter().any(|p| lower.contains(p))
        || lower == "n/a"
        || lower == "none"
}

/// Section-style fallback for registries that print a label alone on its own
/// line and the value on the NEXT line — NASK (`REGISTRAR:` / `MarkMonitor,
/// Inc.`), DNS Belgium (`Registrar:` / `\tName:\t MarkMonitor Inc.`) and
/// TWNIC (`Registrant:` / `      Google LLC`).
///
/// Only the line immediately after a header whose whole content is one of
/// `labels` + `:` (case-insensitive) is considered, and only when it is a bare
/// value (no `:` at all) or a `Name: <value>` sub-field. Anything else — most
/// importantly another `Key: value` field (`Registrar IANA ID: 376`) — is not
/// a value for this header, which is exactly the misattribution the
/// horizontal-whitespace field patterns exist to prevent.
fn extract_section_value(text: &str, labels: &[&str]) -> Option<String> {
    let mut lines = text.lines();
    while let Some(line) = lines.next() {
        let Some(label) = line.trim().strip_suffix(':') else {
            continue;
        };
        if !labels.iter().any(|l| label.trim().eq_ignore_ascii_case(l)) {
            continue;
        }
        let next = lines.next()?.trim();
        let value = match next.split_once(':') {
            None => next,
            Some((key, value)) if key.trim().eq_ignore_ascii_case("name") => value.trim(),
            Some(_) => continue,
        };
        if !value.is_empty() && !is_placeholder_value(value) {
            return Some(value.to_string());
        }
    }
    None
}

/// Interpretation order for ambiguous all-numeric dates (`A/B/YYYY` /
/// `A.B.YYYY` where both `A` and `B` are <= 12). `DayFirst` reads them as
/// `DD/MM` (the international norm, Seer's documented default); `MonthFirst`
/// reads them as `MM/DD` (the US convention). Unambiguous dates (a field > 12,
/// ISO, or named-month) parse identically under either order.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub(crate) enum DateOrder {
    DayFirst,
    MonthFirst,
}

/// Infer the date order for a response from any *unambiguous* candidate date: a
/// numeric `A/B/YYYY` or `A.B.YYYY` where exactly one of the first two fields
/// exceeds 12 reveals whether the registry writes day-first or month-first.
/// Registries are internally consistent, so one unambiguous date fixes the order
/// for every ambiguous date in the same response. Returns `None` when nothing
/// disambiguates (ISO, named-month, or both fields no greater than 12) — callers
/// then fall back to the documented [`DateOrder::DayFirst`] default. This
/// replaces the old hardcoded global DMY tie-break with per-response (hence
/// per-registry) evidence, fixing US `MM/DD/YYYY` registries without a fragile
/// server table (issue #47).
fn infer_date_order<'a>(candidates: impl IntoIterator<Item = &'a str>) -> Option<DateOrder> {
    static_regex! {
        NUMERIC_DATE = r"^\s*(\d{1,2})[/.](\d{1,2})[/.]\d{4}\b";
    }
    for s in candidates {
        if let Some(c) = NUMERIC_DATE.captures(s) {
            if let (Ok(a), Ok(b)) = (c[1].parse::<u32>(), c[2].parse::<u32>()) {
                if a > 12 && b <= 12 {
                    return Some(DateOrder::DayFirst); // first field can only be a day
                }
                if b > 12 && a <= 12 {
                    return Some(DateOrder::MonthFirst); // second field can only be a day
                }
            }
        }
    }
    None
}

/// Parse a date string from registry output into a UTC datetime, using the
/// documented international day-first interpretation for ambiguous all-numeric
/// dates. Thin wrapper over [`parse_date_with_order`].
pub(crate) fn parse_date(date_str: &str) -> Option<DateTime<Utc>> {
    parse_date_with_order(date_str, DateOrder::DayFirst)
}

/// Parse a date string from registry output into a UTC datetime, tolerating the
/// ~20 formats registries emit in practice. `order` decides how an ambiguous
/// all-numeric date is read (see [`DateOrder`]); unambiguous dates parse the
/// same either way. Shared with the RDAP parser (RDAP's `eventDate` is nominally
/// strict RFC 3339, but real servers are as sloppy as WHOIS, so both reuse this
/// tolerant parser).
pub(crate) fn parse_date_with_order(date_str: &str, order: DateOrder) -> Option<DateTime<Utc>> {
    let cleaned = date_str
        .trim()
        .replace(" UTC", "Z")
        .replace(" (UTC)", "")
        .replace(" +0000", "Z");

    // First: try RFC 3339, which handles any timezone offset (e.g., +05:30, +01:00, Z)
    if let Ok(dt) = DateTime::parse_from_rfc3339(&cleaned) {
        return Some(dt.with_timezone(&Utc));
    }

    // Second: try ISO 8601 with timezone offset (e.g., 2024-01-15T10:30:00+05:30)
    if let Ok(dt) = DateTime::<FixedOffset>::parse_from_str(&cleaned, "%Y-%m-%dT%H:%M:%S%z") {
        return Some(dt.with_timezone(&Utc));
    }

    // Third: try space-separated datetime with timezone offset (e.g., 2024-01-15 10:30:00+05:30)
    if let Ok(dt) = DateTime::<FixedOffset>::parse_from_str(&cleaned, "%Y-%m-%d %H:%M:%S%z") {
        return Some(dt.with_timezone(&Utc));
    }

    // Fourth: try NaiveDateTime / NaiveDate formats (timezone-less dates).
    // Unambiguous formats (year-first, named-month) first — these never depend
    // on the day/month order.
    const UNAMBIGUOUS_FORMATS: &[&str] = &[
        "%Y-%m-%dT%H:%M:%SZ",
        "%Y-%m-%dT%H:%M:%S%.fZ",
        // Naive ISO datetime, read as UTC (DENIC `Changed:`).
        "%Y-%m-%dT%H:%M:%S",
        "%Y-%m-%d %H:%M:%S",
        "%d-%b-%Y %H:%M:%S",
        "%d-%b-%Y %H:%M:%S%.f",
        // " UTC" gets normalized to "Z" at the top of parse_date(); match both
        "%d-%b-%Y %H:%M:%SZ",
        "%d-%b-%Y %H:%M:%S UTC",
        "%Y-%m-%d",
        "%d-%b-%Y",
        "%d-%B-%Y",
        // NASK (.pl): `created: 2002.09.19 13:00:00`
        "%Y.%m.%d %H:%M:%S",
        "%Y.%m.%d",
        "%Y/%m/%d %H:%M:%S",
        "%Y/%m/%d",
        "%b %d %Y",
        // DNS Belgium (.be): `Registered: Tue Dec 12 2000`
        "%a %b %d %Y",
    ];
    // Ambiguous all-numeric formats, tried in the hinted order first. The
    // other order is still tried second so an unambiguous date (a field > 12)
    // is recovered rather than dropped — the second pass can only succeed for
    // an input the first rejected, so it never reinterprets an accepted date.
    // Each has a time-of-day variant (CZ.NIC: `registered: 18.09.2000
    // 13:05:00`); the date part obeys the same order rules.
    const DAY_FIRST: &[&str] = &[
        "%d.%m.%Y %H:%M:%S",
        "%d.%m.%Y",
        "%d/%m/%Y %H:%M:%S",
        "%d/%m/%Y",
    ];
    const MONTH_FIRST: &[&str] = &[
        "%m.%d.%Y %H:%M:%S",
        "%m.%d.%Y",
        "%m/%d/%Y %H:%M:%S",
        "%m/%d/%Y",
    ];
    let (first_pair, second_pair) = match order {
        DateOrder::DayFirst => (DAY_FIRST, MONTH_FIRST),
        DateOrder::MonthFirst => (MONTH_FIRST, DAY_FIRST),
    };

    for fmt in UNAMBIGUOUS_FORMATS
        .iter()
        .chain(first_pair.iter())
        .chain(second_pair.iter())
    {
        if let Ok(dt) = chrono::NaiveDateTime::parse_from_str(&cleaned, fmt) {
            return Some(dt.and_utc());
        }
        if let Ok(d) = chrono::NaiveDate::parse_from_str(&cleaned, fmt) {
            return Some(d.and_hms_opt(0, 0, 0)?.and_utc());
        }
    }

    // Last resort: try parsing ISO 8601 directly
    if let Ok(dt) = cleaned.parse::<DateTime<Utc>>() {
        return Some(dt);
    }

    None
}

fn extract_nameservers(text: &str) -> Vec<String> {
    let mut nameservers = Vec::new();

    for re in NAMESERVER_PATTERNS.iter() {
        for caps in re.captures_iter(text) {
            if nameservers.len() >= MAX_NAMESERVERS {
                return nameservers;
            }
            if let Some(m) = caps.get(1) {
                // Strip glue IP addresses that some registries append after the hostname
                // e.g., "ns1.example.br 200.1.2.3 2001:db8::1" → "ns1.example.br"
                let raw = m.as_str().trim();
                let ns = raw.split_whitespace().next().unwrap_or(raw).to_lowercase();
                push_bounded(&mut nameservers, ns, MAX_NAMESERVERS);
            }
        }
    }

    nameservers
}

/// Extracts Status values only from the top-level domain block of a WHOIS
/// response. Stops scanning as soon as a RIPE-style `[Section-Header]` line is
/// encountered, which prevents contact-object `Status:` lines (e.g., inside
/// `[Tech-C]` blocks) from polluting the domain status list.
fn extract_status_top_level(raw: &str) -> Vec<String> {
    let mut statuses = Vec::new();

    for line in raw.lines() {
        if statuses.len() >= MAX_STATUSES {
            break;
        }
        let trimmed = line.trim_start();

        // Stop at the first RIPE/JPRS-style sub-object section header.
        if trimmed.starts_with('[') && trimmed.contains(']') {
            break;
        }
        // Skip comments and empty lines.
        if trimmed.is_empty() || trimmed.starts_with('%') || trimmed.starts_with('#') {
            continue;
        }

        // Match "Domain Status:", "Status:", "status:", "state:" case-insensitively
        // via a prefix check on the lowercased line.
        let lower = trimmed.to_lowercase();
        // Slice the ORIGINAL line by the ASCII prefix length. The prefixes are
        // pure ASCII, so their byte length is identical in `trimmed` and
        // `lower`; deriving the slice point from `lower`'s suffix length is
        // unsound because `to_lowercase()` is not length-preserving for all
        // Unicode (e.g. Turkish İ → i̇ grows 2→3 bytes), which could make the
        // lowercased suffix longer than the whole original line and underflow
        // `trimmed.len() - rest.len()` into an out-of-bounds slice panic.
        let value_opt = if lower.starts_with("domain status:") {
            Some(&trimmed["domain status:".len()..])
        } else if lower.starts_with("status:") {
            Some(&trimmed["status:".len()..])
        } else if lower.starts_with("state:") {
            Some(&trimmed["state:".len()..])
        } else {
            None
        };

        // A value may list several comma-separated statuses (TCI's .ru/.su/.рф
        // `state: REGISTERED, DELEGATED, VERIFIED`); keep each one. Within an
        // entry only the first word is the status — ICANN-style lines append
        // an explanatory URL (`clientHold https://icann.org/epp#clientHold`).
        if let Some(rest) = value_opt {
            for entry in rest.split(',') {
                if let Some(first) = entry.split_whitespace().next() {
                    push_bounded(&mut statuses, first.to_string(), MAX_STATUSES);
                }
            }
        }
    }

    statuses
}

#[cfg(test)]
mod tests {
    use super::*;

    fn make_response(raw: &str) -> WhoisResponse {
        WhoisResponse::parse_internal("example.jp", "whois.jprs.jp", raw)
    }

    #[test]
    fn organization_pattern_ignores_admin_and_tech_org_lines() {
        // With no registrant organization present, the bare `Organization:`
        // pattern must not capture the org from an `Admin Organization:` /
        // `Tech Organization:` line and mislabel it as the registrant org.
        let raw = "Domain Name: example.com\n\
                   Admin Organization: AcmeAdminCorp\n\
                   Tech Organization: AcmeTechCorp\n";
        assert_eq!(
            extract_field_with_patterns(raw, &ORGANIZATION_PATTERNS),
            None
        );

        // A genuine (possibly indented) registrant Organization: line is still
        // captured.
        let raw2 = "Domain Name: example.com\n\
                    Registrant Contact:\n\
                    \tOrganization: Real Registrant LLC\n\
                    Admin Organization: AcmeAdminCorp\n";
        assert_eq!(
            extract_field_with_patterns(raw2, &ORGANIZATION_PATTERNS).as_deref(),
            Some("Real Registrant LLC")
        );
    }

    #[test]
    fn comma_separated_state_keeps_every_status() {
        // TCI (.ru/.su/.рф) lists all states on one line; only the first was
        // kept before, with its trailing comma ("REGISTERED,").
        let raw = "domain:        MICROSOFT.RU\n\
                   state:         REGISTERED, DELEGATED, VERIFIED\n\
                   registrar:     RU-CENTER-RU\n";
        assert_eq!(
            extract_status_top_level(raw),
            vec!["REGISTERED", "DELEGATED", "VERIFIED"]
        );

        // ICANN-style trailing URL is still dropped.
        let raw = "Domain Status: clientHold https://icann.org/epp#clientHold\n";
        assert_eq!(extract_status_top_level(raw), vec!["clientHold"]);
    }

    // --- empty fields must not capture the following line ---------------

    #[test]
    fn empty_fields_do_not_capture_the_next_line() {
        // `\s*` between label and value used to match the CR/LF of an EMPTY
        // field and capture the following line as its value.
        let raw = concat!(
            "Domain Name: EXAMPLE.COM\r\n",
            "Registrar WHOIS Server: whois.tucows.com\r\n",
            "Creation Date: 2010-01-01T00:00:00Z\r\n",
            "Registrar Registration Expiration Date: \r\n",
            "Registrar: TUCOWS, INC.\r\n",
            "Registrant Organization: \r\n",
            "Registrant Street: 123 Main\r\n",
            "Name Server: \r\n",
            "DNSSEC: \r\n",
            "URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/\r\n",
        );
        let r = WhoisResponse::parse("example.com", "whois.tucows.com", raw);
        assert!(
            r.nameservers.is_empty(),
            "empty Name Server must not yield the next label: {:?}",
            r.nameservers
        );
        assert_eq!(r.dnssec, None, "empty DNSSEC must not capture the URL line");
        assert_eq!(
            r.organization, None,
            "empty Registrant Organization must not capture the street line"
        );
        assert_eq!(r.registrant_address.as_deref(), Some("123 Main"));
        assert_eq!(r.registrar.as_deref(), Some("TUCOWS, INC."));
        assert_eq!(
            r.expiration_date, None,
            "empty expiry must stay None, not the registrar line"
        );

        // LF-only variant with trailing whitespace, plus a later populated
        // expiry label: the empty occurrence is skipped and the real one wins.
        let raw = "Registrar Registration Expiration Date: \n\
                   Registrar: TUCOWS, INC.\n\
                   Name Server: \n\
                   DNSSEC: unsigned\n\
                   Registry Expiry Date: 2027-03-01T00:00:00Z\n";
        let r = WhoisResponse::parse("example.com", "whois.tucows.com", raw);
        assert!(r.nameservers.is_empty(), "got {:?}", r.nameservers);
        assert_eq!(r.dnssec.as_deref(), Some("unsigned"));
        assert_eq!(
            r.expiration_date.map(|d| d.format("%Y-%m-%d").to_string()),
            Some("2027-03-01".to_string())
        );
    }

    /// DNS Belgium (.be) prints section headers with the value on the next
    /// (tab-indented) line: `Registrar:` / `\tName:\t MarkMonitor Inc.`.
    #[test]
    fn dns_belgium_section_registrar_is_extracted() {
        let raw = "% .be Whois Server 6.1\n\
                   %\n\
                   Domain:\tgoogle.be\n\
                   Status:\tNOT AVAILABLE\n\
                   Registered:\tTue Dec 12 2000\n\
                   \n\
                   Registrant:\n\
                   \tNot shown, please visit www.dnsbelgium.be for webbased whois.\n\
                   \n\
                   Registrar Technical Contacts:\n\
                   \tOrganisation:\tMarkMonitor Inc.\n\
                   \tLanguage:\ten\n\
                   \tPhone:\t+1.2083895740\n\
                   \tEmail:\tccops@markmonitor.com\n\
                   \n\
                   \n\
                   Registrar:\n\
                   \tName:\t MarkMonitor Inc.\n\
                   \tWebsite: http://www.markmonitor.com\n\
                   \n\
                   Nameservers:\n\
                   \tns2.google.com\n\
                   \tns1.google.com\n\
                   \n\
                   Keys:\n\
                   \n\
                   Flags:\n\
                   \tclientTransferProhibited\n\
                   \n\
                   Please visit www.dnsbelgium.be for more info.\n";
        let r = WhoisResponse::parse("google.be", "whois.dns.be", raw);
        assert_eq!(r.registrar.as_deref(), Some("MarkMonitor Inc."));
        assert_eq!(
            r.registrant, None,
            "the 'Not shown' notice is not a registrant"
        );
        assert_eq!(
            r.creation_date.map(|d| d.format("%Y-%m-%d").to_string()),
            Some("2000-12-12".to_string()),
            "created from 'Registered: Tue Dec 12 2000'"
        );
    }

    /// NASK (.pl) prints `REGISTRAR:` alone, then the registrar's name on
    /// the next line.
    #[test]
    fn nask_section_registrar_is_extracted() {
        let raw = "DOMAIN NAME:           google.pl\n\
                   registrant type:       organization\n\
                   nameservers:           ns1.google.com.\n\
                   \x20                      ns2.google.com.\n\
                   created:               2002.09.19 13:00:00\n\
                   last modified:         2025.08.19 13:47:36\n\
                   renewal date:          2026.09.18 14:00:00\n\
                   \n\
                   no option\n\
                   \n\
                   dnssec:                Unsigned\n\
                   \n\
                   \n\
                   REGISTRAR:\n\
                   MarkMonitor, Inc.\n\
                   3540 East Longwing Lane, Suite 300\n\
                   Meridian, Idaho 83646\n\
                   United States\n\
                   +1.2083895740\n\
                   ccops@markmonitor.com\n\
                   www.markmonitor.com\n\
                   \n\
                   WHOIS database responses: https://dns.pl/en/whois\n";
        let r = WhoisResponse::parse("google.pl", "whois.dns.pl", raw);
        assert_eq!(r.registrar.as_deref(), Some("MarkMonitor, Inc."));
        assert_eq!(r.dnssec.as_deref(), Some("Unsigned"));
        let fmt = |d: Option<DateTime<Utc>>| d.map(|d| d.format("%Y-%m-%d %H:%M:%S").to_string());
        assert_eq!(
            fmt(r.creation_date).as_deref(),
            Some("2002-09-19 13:00:00"),
            "created from 'created: 2002.09.19 13:00:00'"
        );
        assert_eq!(
            fmt(r.updated_date).as_deref(),
            Some("2025-08-19 13:47:36"),
            "updated from 'last modified: 2025.08.19 13:47:36'"
        );
    }

    /// TWNIC (.tw) lists the registrant name on the line after `Registrant:`.
    #[test]
    fn twnic_section_registrant_is_extracted() {
        let raw = "Domain Name: google.com.tw\n\
                   \x20  Domain Status: clientUpdateProhibited\n\
                   \x20  Registrant:\n\
                   \x20     Google LLC\n\
                   \x20     DNS Admin  dns-admin@google.com\n\
                   \n\
                   \x20  Record expires on 2026-11-09 00:00:00 (UTC+8)\n\
                   \n\
                   Registration Service Provider: Markmonitor, Inc.\n";
        let r = WhoisResponse::parse("google.com.tw", "whois.twnic.net.tw", raw);
        assert_eq!(r.registrant.as_deref(), Some("Google LLC"));
    }

    #[test]
    fn section_fallback_ignores_a_following_key_value_field() {
        // An empty `Registrar:` followed by another field is NOT a section
        // header: the next field's text must not become the registrar.
        let raw = "Domain Name: EXAMPLE.COM\nRegistrar:\nRegistrar IANA ID: 376\n";
        let r = WhoisResponse::parse("example.com", "whois.example", raw);
        assert_eq!(r.registrar, None);
    }

    #[test]
    fn contact_boilerplate_is_not_stored_as_a_value() {
        let raw = "Domain Name: EXAMPLE.COM\r\n\
                   Registrant Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.\r\n\
                   Admin Email: Please ask the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.\r\n\
                   Tech Email: Select Request Email Form at https://domains.markmonitor.com/whois/example.com\r\n\
                   Registrant Phone: +1.5555550100\r\n";
        let r = WhoisResponse::parse("example.com", "whois.example", raw);
        assert_eq!(r.registrant_email, None);
        assert_eq!(r.admin_email, None);
        assert_eq!(r.tech_email, None);
        assert_eq!(
            r.registrant_phone.as_deref(),
            Some("+1.5555550100"),
            "real values are kept"
        );
    }

    // --- H10: is_available() scans the full response --------------------

    #[test]
    fn is_available_jprs_style_with_notice_preamble() {
        // JPRS prepends notice lines before the availability indicator.
        let raw = "\
Notice: JPRS database is provided for information purposes only.
Notice: Use of this service is subject to the JPRS terms.
Notice: For more info see https://jprs.jp/
Notice: Copyright (C) JPRS.

No match!!

";
        assert!(make_response(raw).is_available());
    }

    #[test]
    fn is_available_nic_br_style() {
        let raw = "\
% Copyright (c) Nic.br
% The use of the data below is only permitted as described in
% full by the terms of use at https://registro.br/termo/en.html,
% being prohibited its distribution, commercialization or
% reproduction, in particular, to use it for advertising or
% any similar purpose.

No match for domain exemplo.br.
";
        assert!(make_response(raw).is_available());
    }

    #[test]
    fn is_available_twnic_style() {
        let raw = "\
TWNIC WHOIS Server. This service is free and is provided as is.

Notice: Use of this service is subject to terms.
Notice: Do not use for spam.

Domain not found.
";
        assert!(make_response(raw).is_available());
    }

    #[test]
    fn is_available_false_when_registration_data_present_despite_noise() {
        // A registered domain whose WHOIS prose contains an availability
        // fragment (here in an abuse-contact/notice line) must NOT read as
        // available — concrete registration data (registrar/dates/NS) wins
        // over an unanchored substring match. This is the H6 false-positive
        // class: "<registered domain> reported AVAILABLE".
        let raw = "\
Domain Name: example.com
Registrar: Example Registrar, Inc.
Creation Date: 2020-01-01T00:00:00Z
Name Server: ns1.example.com
Registrar Abuse Contact: please report if the object not found in directory
";
        assert!(!make_response(raw).is_available());
    }

    #[test]
    fn is_available_false_for_registered_domain() {
        let raw = "\
Domain Name: example.com
Registrar: Example Registrar, Inc.
Creation Date: 2020-01-01T00:00:00Z
Name Server: ns1.example.com
";
        assert!(!make_response(raw).is_available());
    }

    // --- registry_unavailable(): registry serves no usable WHOIS --------

    #[test]
    fn registry_unavailable_true_for_tld_not_supported_sentinel() {
        // Identity Digital (.email/.life/.ninja/…) port-43 servers reply
        // "TLD is not supported." with no domain fields — RDAP-only TLDs.
        let raw = "\
TLD is not supported.
>>> Last update of WHOIS database: 2026-06-03T22:45:28Z <<<

Terms of Use: Access to WHOIS information is provided to assist persons ...
";
        assert!(make_response(raw).registry_unavailable());
    }

    #[test]
    fn registry_unavailable_true_for_malformed_request_sentinel() {
        let raw = "\
Malformed request.
>>> Last update of WHOIS database: 2026-06-03T22:46:35Z <<<
";
        assert!(make_response(raw).registry_unavailable());
    }

    #[test]
    fn registry_unavailable_false_for_registered_domain() {
        let raw = "\
Domain Name: example.com
Registrar: Example Registrar, Inc.
Creation Date: 2020-01-01T00:00:00Z
Name Server: ns1.example.com
";
        assert!(!make_response(raw).registry_unavailable());
    }

    #[test]
    fn registry_unavailable_false_for_available_domain() {
        // An unregistered-domain "no match" response is NOT a service error —
        // it must read as available, not registry-unavailable.
        let raw = "No match for domain EXAMPLE.\n";
        assert!(!make_response(raw).registry_unavailable());
    }

    #[test]
    fn extract_status_does_not_panic_on_unicode_lowercasing_expansion() {
        // Turkish dotted capital İ (2 bytes) lowercases to i̇ (3 bytes), so a
        // status VALUE full of them makes the lowercased line longer than the
        // original. The old code sliced the original by a length derived from
        // the lowercased copy (`trimmed.len() - rest.len()`), which underflowed
        // and panicked out-of-bounds. `raw` is attacker-controlled (a hostile
        // WHOIS server), so this was a remotely-triggerable panic / DoS.
        let raw = format!("Domain Status: {}\n", "İ".repeat(40));
        let r = make_response(&raw); // must not panic
        assert!(
            !r.status.is_empty(),
            "status value should still be extracted"
        );
    }

    #[test]
    fn is_available_hkirc_has_not_been_registered() {
        // HKIRC (.hk and the IDN .香港/xn--j6w193g) signals an unregistered
        // domain with "The domain has not been registered." — note the
        // wording is "has not BEEN registered", which does NOT contain the
        // bare "not registered" substring the old pattern list relied on.
        let raw = "The domain has not been registered.\n";
        assert!(make_response(raw).is_available());
    }

    #[test]
    fn is_available_tab_delimited_status_available() {
        // DNS Belgium (.be) and similar registries separate the label and
        // value with a TAB: "Status:\tAVAILABLE". The scan must normalize
        // internal whitespace so the "status: available" pattern still hits.
        let raw = "Domain:\tfoo.be\nStatus:\tAVAILABLE\n";
        assert!(make_response(raw).is_available());
    }

    #[test]
    fn is_not_available_tab_delimited_status_not_available() {
        // Guard against a false positive from whitespace normalization:
        // "Status:\tNOT AVAILABLE" (a registered .be domain) must NOT be
        // read as available — "status: available" is not a substring of
        // "status: not available".
        let raw = "Domain:\tfoo.be\nStatus:\tNOT AVAILABLE\n";
        assert!(!make_response(raw).is_available());
    }

    #[test]
    fn is_available_recognizes_additional_registry_phrasings() {
        // "Not found" wordings surfaced by the cross-TLD audit, mostly from
        // no-RDAP ccTLDs where WHOIS is the only registry signal.
        for raw in [
            "*** Nothing found for this query.\n", // .kz / .қаз (KazNIC)
            "No Found\n",                          // TWNIC .tw / 台灣 / 台湾
            "No record found for 'example.ls'.\n", // .ls (Lesotho)
            "No information was found matching that query.\n", // .africa
            "Object not found\n",                  // generic
            "Not find MatchingRecord\n",           // CONAC .政务 / .公益
            "% No data was found to match the request criteria.\n", // ISOC-IL .il
        ] {
            assert!(
                make_response(raw).is_available(),
                "should detect available from: {raw:?}"
            );
        }
    }

    #[test]
    fn is_available_does_not_match_registered_or_blocked_phrasings() {
        // Guard against false positives from the broadened pattern list: a
        // registered domain, a "not available" status, a port-43 refusal, and
        // TOS prose containing "free" must all stay NOT-available.
        for raw in [
            "Domain Status: clientTransferProhibited\nRegistrar: Example, Inc.\n",
            "Status: NOT AVAILABLE\n",
            "Requests of this client are not permitted. Please use the web form.\n",
            "This WHOIS service is free for personal, non-commercial use.\n",
        ] {
            assert!(
                !make_response(raw).is_available(),
                "must NOT detect available from: {raw:?}"
            );
        }
    }

    #[test]
    fn is_available_false_for_negation_and_refusal_lines() {
        // Regression for the availability-inversion bug (#45): the per-line
        // scan matched AVAILABILITY_PATTERNS via an unanchored contains() with
        // no negation guard, so a short status line that *negates* or *refuses*
        // availability ("not available for registration", "not registered" in a
        // reserved status, "no data found" while rate-limited) was inverted into
        // "available, high confidence". All three must read as NOT available.
        for raw in [
            // reserved/premium — registry refuses registration (contains the
            // "available for registration" substring after "not ").
            "This domain name is not available for registration.\n",
            // reserved/blocked status (contains the "not registered" substring).
            "Domain Status: reserved - not registered for public use\n",
            // throttled — inconclusive, not free (contains "no data found").
            "Access rate limited; no data found for unauthenticated clients\n",
        ] {
            assert!(
                !make_response(raw).is_available(),
                "negation/refusal line must NOT read as available: {raw:?}"
            );
        }
    }

    #[test]
    fn indicates_registry_refusal_detects_throttle_and_negation() {
        // The refusal detector backs decide_fallback's inconclusive routing: a
        // thin body that explicitly refuses / throttles / negates availability
        // must be flagged so the fallback decision does not guess.
        for raw in [
            "This domain name is not available for registration.\n",
            "Domain Status: reserved - not registered for public use\n",
            "Access rate limited; no data found for unauthenticated clients\n",
            "Requests of this client are not permitted. Please use the web form.\n",
        ] {
            assert!(
                make_response(raw).indicates_registry_refusal(),
                "should flag refusal/throttle/negation: {raw:?}"
            );
        }
    }

    /// Single-token refusal markers ("quota", "blocked", "refused", …) used
    /// to match inside the domain name echoed by a "no match" line, turning a
    /// conclusive "available" into "inconclusive".
    #[test]
    fn refusal_words_inside_the_echoed_domain_do_not_veto_availability() {
        for (domain, raw) in [
            (
                "quotations.pl",
                "No information available about domain name quotations.pl in the Registry NASK database.\n",
            ),
            ("unblocked-games.com", "No match for \"UNBLOCKED-GAMES.COM\".\n"),
            ("refused.ls", "No record found for 'refused.ls'.\n"),
            ("denied-access.com", "No match for \"DENIED-ACCESS.COM\".\n"),
            ("rate-limiter.com", "No match for \"RATE-LIMITER.COM\".\n"),
        ] {
            let r = WhoisResponse::parse(domain, "whois.example", raw);
            assert!(
                !r.indicates_registry_refusal(),
                "{domain}: echoed domain is not a refusal: {raw:?}"
            );
            assert!(r.is_available(), "{domain}: must read as available: {raw:?}");
        }
    }

    #[test]
    fn refusal_words_are_still_detected_as_whole_words() {
        for raw in [
            "Query refused.\n",
            "Your request has been blocked\n",
            "Request denied: too many queries from your IP\n",
            "Query quota exceeded for this client\n",
            "Rate-limit exceeded, no data found\n",
            "Your IP has been rate-limited.\n",
        ] {
            let r = make_response(raw);
            assert!(r.indicates_registry_refusal(), "must flag: {raw:?}");
            assert!(!r.is_available(), "must not read as available: {raw:?}");
        }
    }

    #[test]
    fn contains_word_respects_domain_label_boundaries() {
        assert!(contains_word("query refused.", "refused"));
        assert!(contains_word("refused", "refused"));
        assert!(contains_word("(blocked)", "blocked"));
        assert!(!contains_word(
            "no record found for 'refused.ls'.",
            "refused"
        ));
        assert!(!contains_word("www.blocked.example", "blocked"));
        assert!(!contains_word("unblocked-games.com", "blocked"));
        assert!(!contains_word("quotations.pl", "quota"));
    }

    #[test]
    fn indicates_registry_refusal_false_for_plain_not_found_and_registered() {
        // A genuine "no match" availability response and a registered domain
        // must NOT be flagged as refusal — those are conclusive signals.
        for raw in [
            "No match for domain EXAMPLE.\n",
            "Domain not found.\n",
            "Conditions of use for the whois service via port 43\n",
            "Domain Name: example.com\nRegistrar: Example, Inc.\nName Server: ns1.example.com\n",
            // Near-universal copyright footers contain the word "reserved" but
            // are not a refusal — a thin response whose only non-comment line
            // is such a footer must stay eligible for the DNS tie-breaker
            // instead of short-circuiting to "inconclusive".
            "Copyright (c) 2024 Example Registry Corp. All rights reserved.\n",
            "All rights reserved. Use of this service is subject to the terms of use.\n",
        ] {
            assert!(
                !make_response(raw).indicates_registry_refusal(),
                "must NOT flag as refusal: {raw:?}"
            );
        }
    }

    #[test]
    fn is_available_ignores_not_found_phrase_buried_in_prose() {
        // A thin response with NO parsed registration fields (so the H6
        // registration-data guard does not fire) whose only "does not exist"
        // / "not found" occurrence is inside a long prose/notice sentence
        // must NOT be read as available. Availability indicators are short
        // status lines, not phrases buried in footer prose.
        let raw = "\
This is an informational banner from the registry WHOIS service provider.
Note that if the queried object does not exist in our database we simply return an empty result rather than an error response.
Records not found in this directory may still exist upstream in the thick registry, so please check with the sponsoring registrar.
";
        assert!(
            !make_response(raw).is_available(),
            "long prose sentences must not trigger availability"
        );
    }

    // --- M19: indicates_not_found anchors at line start -----------------

    #[test]
    fn indicates_not_found_true_on_line_start() {
        let raw = "\
Domain Name: example.com
queried object does not exist
";
        assert!(make_response(raw).indicates_not_found());
    }

    #[test]
    fn indicates_not_found_false_when_phrase_is_in_tos_footer() {
        // A registered-domain response whose TOS footer quotes the phrase
        // must not be flagged as not-found.
        let raw = "\
Domain Name: example.com
Registrar: Example Registrar, Inc.
Creation Date: 2020-01-01T00:00:00Z
Name Server: ns1.example.com

Terms of Service:
Note that if the queried object does not exist in our database we return NXDOMAIN.
This document does not imply anything about specific domains.
";
        assert!(!make_response(raw).indicates_not_found());
    }

    // --- M13: extract_status_top_level skips sub-object sections --------

    #[test]
    fn status_extracted_only_from_top_level_block() {
        let raw = "\
Domain Name: example.jp
Status: Active
Registrar: Example Registrar

[Tech-C]
Status: ok
Name: Technical Contact
";
        let parsed = make_response(raw);
        // Only the top-level Active should be present; the Tech-C "ok" is skipped.
        assert_eq!(parsed.status, vec!["Active".to_string()]);
    }

    #[test]
    fn status_multiple_top_level_values_deduped() {
        let raw = "\
Domain Name: example.com
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Domain Status: clientTransferProhibited
";
        let parsed = make_response(raw);
        assert_eq!(
            parsed.status,
            vec![
                "clientTransferProhibited".to_string(),
                "clientUpdateProhibited".to_string(),
            ]
        );
    }

    // --- M14: parse_date handles "15-Jan-2024 10:30:00" -----------------

    #[test]
    fn parse_date_handles_d_b_y_with_time() {
        let parsed = parse_date("15-Jan-2024 10:30:00").expect("should parse");
        use chrono::Datelike;
        assert_eq!(parsed.year(), 2024);
        assert_eq!(parsed.month(), 1);
        assert_eq!(parsed.day(), 15);
    }

    #[test]
    fn parse_date_handles_d_b_y_with_time_utc_suffix() {
        let parsed = parse_date("15-Jan-2024 10:30:00 UTC").expect("should parse");
        use chrono::Datelike;
        assert_eq!(parsed.year(), 2024);
    }

    #[test]
    fn parse_date_still_handles_d_b_y_date_only() {
        let parsed = parse_date("15-Jan-2024").expect("should parse");
        use chrono::Datelike;
        assert_eq!(parsed.year(), 2024);
    }

    // --- parse_date: ambiguous numeric dates default to day-first, but
    //     unambiguous US month-first dates are recovered (not dropped) ----

    #[test]
    fn parse_date_recovers_unambiguous_us_mdy() {
        // Some registrars emit US month-first numeric dates. When the day
        // field is > 12 the date is unambiguously MDY and was previously
        // dropped (there was no %m/%d/%Y format). Recover it rather than
        // returning None.
        use chrono::Datelike;
        let parsed = parse_date("02/13/2024").expect("unambiguous MDY should parse");
        assert_eq!(parsed.year(), 2024);
        assert_eq!(parsed.month(), 2);
        assert_eq!(parsed.day(), 13);
    }

    #[test]
    fn parse_date_ambiguous_numeric_is_day_first() {
        // Documented precedence: ambiguous all-numeric dates (both fields
        // <= 12) are interpreted day-first (the international norm), matching
        // the %d/%m/%Y format ordering. "06/07/2024" => 6 July 2024. The
        // month-first fallback must NOT change this.
        use chrono::Datelike;
        let parsed = parse_date("06/07/2024").expect("should parse");
        assert_eq!(parsed.year(), 2024);
        assert_eq!(parsed.month(), 7);
        assert_eq!(parsed.day(), 6);
    }

    // --- #47: per-registry date order disambiguation --------------------

    #[test]
    fn parse_date_with_order_disambiguates_month_first() {
        // The same ambiguous string reads differently per order hint:
        // day-first => 3 April; month-first (US) => 4 March.
        use chrono::Datelike;
        let dmy = parse_date_with_order("03/04/2024", DateOrder::DayFirst).expect("parse");
        assert_eq!(
            (dmy.month(), dmy.day()),
            (4, 3),
            "day-first reads 03/04 as 3 April"
        );
        let mdy = parse_date_with_order("03/04/2024", DateOrder::MonthFirst).expect("parse");
        assert_eq!(
            (mdy.month(), mdy.day()),
            (3, 4),
            "month-first reads 03/04 as 4 March"
        );
    }

    #[test]
    fn parse_date_with_order_unambiguous_is_order_independent() {
        // A field > 12 disambiguates the date regardless of the hint.
        use chrono::Datelike;
        for s in ["13/04/2024", "04/13/2024"] {
            for order in [DateOrder::DayFirst, DateOrder::MonthFirst] {
                let d = parse_date_with_order(s, order).expect("parse");
                assert_eq!(
                    (d.year(), d.month(), d.day()),
                    (2024, 4, 13),
                    "{s:?} under {order:?} must be 2024-04-13"
                );
            }
        }
    }

    #[test]
    fn parse_internal_infers_us_month_first_from_unambiguous_sibling() {
        // A US-format registry response: the ambiguous creation date
        // "03/04/2024" (both fields <= 12) must be read month-first (4 March)
        // because the sibling expiry "04/15/2034" is unambiguously month-first
        // (day 15). Registries are internally consistent, so one unambiguous
        // date reveals the order for the whole response (issue #47).
        use chrono::Datelike;
        let raw = "Creation Date: 03/04/2024\nRegistry Expiry Date: 04/15/2034\n";
        let r = make_response(raw);
        let creation = r.creation_date.expect("creation parsed");
        assert_eq!(
            (creation.month(), creation.day()),
            (3, 4),
            "ambiguous date must follow the registry's revealed month-first order"
        );
    }

    #[test]
    fn parse_internal_defaults_day_first_without_disambiguating_sibling() {
        // No unambiguous sibling → the documented day-first default holds.
        use chrono::Datelike;
        let raw = "Creation Date: 06/07/2024\n";
        let r = make_response(raw);
        let creation = r.creation_date.expect("creation parsed");
        assert_eq!(
            (creation.month(), creation.day()),
            (7, 6),
            "no disambiguating sibling keeps the day-first default"
        );
    }

    #[test]
    fn parse_date_handles_numeric_dates_with_time_of_day() {
        let fmt = |s: &str, order| {
            parse_date_with_order(s, order).map(|d| d.format("%Y-%m-%d %H:%M:%S").to_string())
        };
        let day_first = DateOrder::DayFirst;
        // Year-first (unambiguous).
        assert_eq!(
            fmt("2002.09.19 13:00:00", day_first).as_deref(),
            Some("2002-09-19 13:00:00")
        );
        assert_eq!(
            fmt("2002/09/19 13:00:00", day_first).as_deref(),
            Some("2002-09-19 13:00:00")
        );
        // CZ.NIC day-first with time.
        assert_eq!(
            fmt("18.09.2000 13:05:00", day_first).as_deref(),
            Some("2000-09-18 13:05:00")
        );
        // Ambiguous numeric dates with a time keep obeying the order hint...
        assert_eq!(
            fmt("03/04/2024 10:00:00", DateOrder::DayFirst).as_deref(),
            Some("2024-04-03 10:00:00")
        );
        assert_eq!(
            fmt("03/04/2024 10:00:00", DateOrder::MonthFirst).as_deref(),
            Some("2024-03-04 10:00:00")
        );
        // ...and unambiguous ones parse the same under either hint (#47).
        for order in [DateOrder::DayFirst, DateOrder::MonthFirst] {
            assert_eq!(
                fmt("04/13/2024 08:30:00", order).as_deref(),
                Some("2024-04-13 08:30:00")
            );
            assert_eq!(
                fmt("13.04.2024 08:30:00", order).as_deref(),
                Some("2024-04-13 08:30:00")
            );
        }
        // DNS Belgium weekday-prefixed dates.
        assert_eq!(
            fmt("Tue Dec 12 2000", day_first).as_deref(),
            Some("2000-12-12 00:00:00")
        );
    }

    #[test]
    fn parse_internal_infers_order_from_sibling_with_time_of_day() {
        // A US-format registry that prints times: the unambiguous expiry
        // (day 15) still reveals month-first for the ambiguous creation date.
        use chrono::Datelike;
        let raw = "Creation Date: 03/04/2024 10:00:00\n\
                   Registry Expiry Date: 04/15/2034 10:00:00\n";
        let r = make_response(raw);
        let creation = r.creation_date.expect("creation parsed");
        assert_eq!((creation.month(), creation.day()), (3, 4));
        let expiry = r.expiration_date.expect("expiry parsed");
        assert_eq!((expiry.month(), expiry.day()), (4, 15));
    }

    // --- H3: raw_response is not serialized -----------------------------

    #[test]
    fn raw_response_is_skipped_from_json_output() {
        let raw = "Domain Name: example.com\nRegistrar: Example Registrar\n";
        let parsed = make_response(raw);
        assert!(
            !parsed.raw_response.is_empty(),
            "raw_response still populated internally"
        );
        let json = serde_json::to_string(&parsed).expect("serialize");
        assert!(
            !json.contains("raw_response"),
            "raw_response must not appear in serialized JSON output: {}",
            json
        );
        assert!(
            !json.contains("Domain Name: example.com"),
            "raw response content must not leak in JSON: {}",
            json
        );
    }

    /// Regression: a serialized `WhoisResponse` must deserialize back.
    /// `raw_response` is `skip_serializing` (the 1 MB raw blob must never leak),
    /// but it also needs `default` — otherwise deserialization fails with
    /// "missing field `raw_response`", which silently corrupts persisted lookup
    /// history / cache files (the corrupt-file branch then discards them).
    #[test]
    fn whois_response_survives_json_round_trip() {
        let parsed = make_response("Domain Name: example.com\nRegistrar: Example Registrar\n");
        let json = serde_json::to_string(&parsed).expect("serialize");
        let back: WhoisResponse =
            serde_json::from_str(&json).expect("round-trip must not fail (missing field?)");
        assert_eq!(back.domain, parsed.domain, "domain survives round-trip");
        assert!(
            back.raw_response.is_empty(),
            "skipped raw_response defaults to empty on load"
        );
    }

    /// Punktum (.dk) format, captured live 2026-07: nameservers appear as
    /// `Hostname:` lines under a `Nameservers` heading, and the creation
    /// date is labelled `Registered:`.
    #[test]
    fn punktum_dk_hostnames_and_registered_date() {
        let raw = "Domain:               punktum.dk\n\
                   DNS:                  punktum.dk\n\
                   Registered:           2018-01-25\n\
                   Expires:              2027-01-31\n\
                   Registration period:  1 year\n\
                   DNSSEC:               Signed delegation\n\
                   Status:               Active\n\
                   \n\
                   Nameservers\n\
                   Hostname:             auth01.ns.dk-hostmaster.dk\n\
                   Hostname:             auth02.ns.dk-hostmaster.dk\n\
                   Hostname:             auth03.ns.dk-hostmaster.dk\n";
        let r = WhoisResponse::parse("punktum.dk", "whois.punktum.dk", raw);
        assert_eq!(
            r.nameservers,
            vec![
                "auth01.ns.dk-hostmaster.dk",
                "auth02.ns.dk-hostmaster.dk",
                "auth03.ns.dk-hostmaster.dk"
            ]
        );
        assert!(r.creation_date.is_some(), "created from 'Registered:'");
        assert!(r.expiration_date.is_some(), "expires from 'Expires:'");
    }

    /// Many ccTLD registries print the availability verdict on `%`-comment
    /// lines (wording captured live 2026-07). The comment marker must be
    /// stripped and the remainder evaluated, not skipped wholesale.
    #[test]
    fn availability_verdicts_on_comment_lines_are_detected() {
        let cases: &[(&str, &str)] = &[
            (
                "fr/AFNIC",
                "%% This is the AFNIC Whois server.\n%%\n%% NOT FOUND\n",
            ),
            (
                "br/NIC.br",
                "% Copyright (c) Nic.br\n% No match for seer-sweep.br\n",
            ),
            ("no/NORID", "% Norid AS holds the copyright\n% No match\n"),
            (
                "at/NIC.AT",
                "% Copyright (c)2026 by NIC.AT (1)\n% nothing found\n",
            ),
            (
                "cz/CZ.NIC",
                "%ERROR:101: no entries found\n% No entries found.\n",
            ),
            ("rs/RNIDS", "%ERROR:103: Domain is not registered\n"),
            (
                "is/ISNIC",
                "% Rights restricted by copyright.\n% No entries found for query \"x.is\".\n",
            ),
            ("lu/RESTENA", "% WHOIS x.lu\n% No such domain\n"),
            ("dz/NIC.DZ", "% No match for domain 'X.DZ'.\n"),
            ("sn/NIC.SN", "%% NOT FOUND\n"),
        ];
        for (name, raw) in cases {
            let r = WhoisResponse::parse("example.test", "whois.test", raw);
            assert!(
                r.is_available(),
                "{name}: comment-line verdict must mark available:\n{raw}"
            );
        }
    }

    /// Sentence-form "not found" phrasings exceed the 10-word status-line
    /// gate; they are matched anchored at line start instead (live 2026-07).
    #[test]
    fn availability_sentence_phrasings_are_detected() {
        let cases: &[(&str, &str)] = &[
            (
                "kr/KISA",
                "query : x.kr\nThe requested domain was not found in the Registry or Registrar\u{2019}s WHOIS Server.\n",
            ),
            (
                "edu/EDUCAUSE",
                "Domain Name: X.EDU\nThe domain name you requested was not found in our database.\n",
            ),
            (
                "pl/NASK",
                "No information available about domain name x.pl in the Registry NASK database.\n",
            ),
        ];
        for (name, raw) in cases {
            let r = WhoisResponse::parse("example.test", "whois.test", raw);
            assert!(
                r.is_available(),
                "{name}: sentence-form verdict must mark available:\n{raw}"
            );
        }
    }

    /// Registry-specific short phrasings captured live 2026-07: SIDN/.aw
    /// "<domain> is free" (suffix-anchored so prose like "registration is
    /// free of charge" cannot match), NIC Mexico's underscore token, and
    /// NIC Argentina's Spanish phrasing.
    #[test]
    fn availability_special_short_phrasings_are_detected() {
        for (name, raw) in [
            ("nl/SIDN", "x.nl is free\n"),
            ("aw/SETAR", "x.aw is free\n"),
            (
                "mx/NICMexico",
                "No_Se_Encontro_El_Objeto/Object_Not_Found\n",
            ),
            (
                "ar/NICArgentina",
                "El dominio no se encuentra registrado en NIC Argentina\n",
            ),
        ] {
            let r = WhoisResponse::parse("example.test", "whois.test", raw);
            assert!(r.is_available(), "{name} must mark available:\n{raw}");
        }
        // Suffix anchoring: "is free" mid-sentence must NOT flip availability.
        let prose = WhoisResponse::parse(
            "example.test",
            "whois.test",
            "Registration is free of charge today\n",
        );
        assert!(
            !prose.is_available(),
            "'is free' inside prose must not mark available"
        );
    }

    /// ANINF (.ga, captured live 2026-07) answers in French: dates are
    /// `Date de création:` / `Date d'expiration:` / `Dernière modification:`
    /// and nameservers are `Serveur de noms:` lines. Contact blocks carry
    /// their own `Dernière modification:` — the domain-level one (first in
    /// the body) must win.
    #[test]
    fn aninf_ga_french_labels_parse() {
        let raw = "Domain ID:                     DOM8624-GA\n\
                   Nom de domaine:                google.ga\n\
                   Date de création:              2023-06-06T19:15:12.718385Z\n\
                   Dernière modification:         2026-05-12T17:27:38.344508Z\n\
                   Date d'expiration:             2027-06-06T19:15:12.694489Z\n\
                   Registrar:                     MARKMONITOR Inc.\n\
                   Statut:                        actif\n\
                   \n\
                   [TECH_C]\n\
                   Nom:                           REDACTED_FOR_PRIVACY\n\
                   Dernière modification:         2023-11-09T18:15:51.973324Z\n\
                   \n\
                   Serveur de noms:               ns1.google.com\n\
                   Serveur de noms:               ns2.google.com\n\
                   \n\
                   DNSSEC:                        unsigned\n";
        let r = WhoisResponse::parse("google.ga", "whois.nic.ga", raw);
        assert_eq!(r.nameservers, vec!["ns1.google.com", "ns2.google.com"]);
        let created = r.creation_date.expect("creation from Date de création");
        assert_eq!(
            created.format("%Y-%m-%d").to_string(),
            "2023-06-06",
            "domain creation date"
        );
        let expires = r.expiration_date.expect("expiry from Date d'expiration");
        assert_eq!(expires.format("%Y-%m-%d").to_string(), "2027-06-06");
        let updated = r.updated_date.expect("updated from Dernière modification");
        assert_eq!(
            updated.format("%Y-%m-%d").to_string(),
            "2026-05-12",
            "domain-level modification must win over the contact block's"
        );
    }

    /// GMO Registry retired port-43 WHOIS (May 2026, ICANN RDAP transition)
    /// and now answers every query with a retirement notice. That is a
    /// service-level "no usable WHOIS" signal, not a registered/available
    /// verdict.
    #[test]
    fn whois_retirement_notice_is_registry_unavailable() {
        let raw = "Notice: Effective May 1, 2026, the WHOIS service has been retired in accordance with ICANN's RDAP transition policy. All registration data queries are now served via RDAP. The Registration Data Access Protocol (RDAP) base URL is: https://rdap.gmoregistry.net/rdap/";
        let r = WhoisResponse::parse("nic.canon", "whois.nic.canon", raw);
        assert!(
            r.registry_unavailable(),
            "retirement notice must be registry_unavailable"
        );
        assert!(!r.is_available(), "retirement notice is not 'available'");
    }
    #[test]
    fn switch_first_registration_date_on_the_next_line_is_parsed() {
        // SWITCH prints the value on the line after its header; the generic
        // `Key: value` patterns deliberately no longer reach across lines.
        let raw = "Domain name:\nexample.ch\n\nHolder of domain name:\nRedacted\n\n\
                   First registration date:\n01.12.2003\n";
        let r = WhoisResponse::parse_internal("example.ch", "whois.nic.ch", raw);
        assert_eq!(
            r.creation_date.map(|d| d.format("%Y-%m-%d").to_string()),
            Some("2003-12-01".to_string())
        );
        // SWITCH's legacy free-text value is not a date and is not guessed at.
        let raw = "First registration date:\nregistered before 1st January 1996\n";
        let r = WhoisResponse::parse_internal("old.ch", "whois.nic.ch", raw);
        assert!(r.creation_date.is_none());
    }

    // --- generic-parser fixtures ---------------------------------------

    #[test]
    fn generic_parser_basic() {
        let raw = r#"
Domain Name: example.com
Registrar: Example Registrar, Inc.
Creation Date: 2020-01-15T00:00:00Z
Expiration Date: 2025-01-15T00:00:00Z
Name Server: ns1.example.com
Name Server: ns2.example.com
"#;
        let result = WhoisResponse::parse_internal("example.com", "whois.example.com", raw);

        assert_eq!(result.domain, "example.com");
        assert_eq!(
            result.registrar,
            Some("Example Registrar, Inc.".to_string())
        );
        assert_eq!(result.nameservers.len(), 2);
    }

    // ------------------------------------------------------------------
    // Real-world fixture tests (M13).
    //
    // The trivial LF-only fixture above hid regressions for the three most
    // common shapes of gTLD WHOIS responses:
    //   1. Current Verisign thick .com format (CRLF, registrar/registry split)
    //   2. Post-2018 GDPR-redacted .com responses (PII replaced with
    //      "REDACTED FOR PRIVACY")
    //   3. CRLF line endings throughout (TCP WHOIS protocol default)
    //
    // These fixtures assert only on parser-visible fields (domain name,
    // registrar, dates, nameservers, status) — never PII, since real
    // responses vary in what they redact.
    // ------------------------------------------------------------------

    /// Current Verisign thick-WHOIS format for `.com` (post-GDPR).
    /// Abbreviated from a real response, preserving structure and CRLF.
    const VERISIGN_COM_FIXTURE: &str = concat!(
        "   Domain Name: EXAMPLE.COM\r\n",
        "   Registry Domain ID: 2336799_DOMAIN_COM-VRSN\r\n",
        "   Registrar WHOIS Server: whois.iana.org\r\n",
        "   Registrar URL: http://res-dom.iana.org\r\n",
        "   Updated Date: 2024-08-14T07:01:34Z\r\n",
        "   Creation Date: 1995-08-14T04:00:00Z\r\n",
        "   Registry Expiry Date: 2025-08-13T04:00:00Z\r\n",
        "   Registrar: RESERVED-Internet Assigned Numbers Authority\r\n",
        "   Registrar IANA ID: 376\r\n",
        "   Registrar Abuse Contact Email:\r\n",
        "   Registrar Abuse Contact Phone:\r\n",
        "   Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited\r\n",
        "   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited\r\n",
        "   Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited\r\n",
        "   Name Server: A.IANA-SERVERS.NET\r\n",
        "   Name Server: B.IANA-SERVERS.NET\r\n",
        "   DNSSEC: signedDelegation\r\n",
        "   DNSSEC DS Data: 370 13 2 BE74359954660069D5C63DA59519AB22E46C7A3AEFAD516946B72A91BC93D46F\r\n",
        "   URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/\r\n",
        ">>> Last update of whois database: 2026-04-20T12:34:56Z <<<\r\n",
    );

    #[test]
    fn test_verisign_thick_com_fixture() {
        let result = WhoisResponse::parse_internal(
            "example.com",
            "whois.verisign-grs.com",
            VERISIGN_COM_FIXTURE,
        );

        assert_eq!(result.domain, "example.com");
        assert_eq!(
            result.registrar.as_deref(),
            Some("RESERVED-Internet Assigned Numbers Authority"),
            "must extract registrar from current Verisign thick-WHOIS"
        );
        // Both A and B IANA servers should be captured.
        assert!(
            result
                .nameservers
                .iter()
                .any(|n| n.to_lowercase().contains("a.iana-servers.net")),
            "nameservers missing A: {:?}",
            result.nameservers
        );
        assert!(
            result
                .nameservers
                .iter()
                .any(|n| n.to_lowercase().contains("b.iana-servers.net")),
            "nameservers missing B: {:?}",
            result.nameservers
        );
        assert_eq!(result.nameservers.len(), 2);
        assert!(result.creation_date.is_some(), "creation date must parse");
        assert!(
            result.expiration_date.is_some(),
            "expiration date must parse"
        );
        assert_eq!(result.dnssec.as_deref(), Some("signedDelegation"));
        // At least three statuses captured.
        assert!(
            result.status.len() >= 3,
            "expected >= 3 statuses, got {:?}",
            result.status
        );
        // not-available: the response contains registration data.
        assert!(!result.is_available());
    }

    /// Post-2018 GDPR-redacted thick response for a `.com` domain.
    /// All PII is replaced by the string "REDACTED FOR PRIVACY"; core
    /// registry fields remain present. CRLF throughout.
    const GDPR_REDACTED_COM_FIXTURE: &str = concat!(
        "   Domain Name: REDACTED-EXAMPLE.COM\r\n",
        "   Registry Domain ID: 9999999_DOMAIN_COM-VRSN\r\n",
        "   Registrar WHOIS Server: whois.markmonitor.com\r\n",
        "   Registrar URL: http://www.markmonitor.com\r\n",
        "   Updated Date: 2025-11-08T10:00:00Z\r\n",
        "   Creation Date: 2010-03-12T17:22:00Z\r\n",
        "   Registry Expiry Date: 2027-03-12T17:22:00Z\r\n",
        "   Registrar: MarkMonitor Inc.\r\n",
        "   Registrar IANA ID: 292\r\n",
        "   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited\r\n",
        "   Registry Registrant ID: REDACTED FOR PRIVACY\r\n",
        "   Registrant Name: REDACTED FOR PRIVACY\r\n",
        "   Registrant Organization: REDACTED FOR PRIVACY\r\n",
        "   Registrant Street: REDACTED FOR PRIVACY\r\n",
        "   Registrant City: REDACTED FOR PRIVACY\r\n",
        "   Registrant State/Province: REDACTED FOR PRIVACY\r\n",
        "   Registrant Postal Code: REDACTED FOR PRIVACY\r\n",
        "   Registrant Country: REDACTED FOR PRIVACY\r\n",
        "   Registrant Phone: REDACTED FOR PRIVACY\r\n",
        "   Registrant Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.\r\n",
        "   Admin Name: REDACTED FOR PRIVACY\r\n",
        "   Admin Email: REDACTED FOR PRIVACY\r\n",
        "   Tech Name: REDACTED FOR PRIVACY\r\n",
        "   Tech Email: REDACTED FOR PRIVACY\r\n",
        "   Name Server: NS1.MARKMONITOR.COM\r\n",
        "   Name Server: NS2.MARKMONITOR.COM\r\n",
        "   DNSSEC: unsigned\r\n",
        ">>> Last update of WHOIS database: 2026-04-20T12:00:00Z <<<\r\n",
    );

    #[test]
    fn test_gdpr_redacted_com_fixture() {
        let result = WhoisResponse::parse_internal(
            "redacted-example.com",
            "whois.verisign-grs.com",
            GDPR_REDACTED_COM_FIXTURE,
        );

        // Registry-level fields MUST still be extracted — these are never
        // redacted for gTLDs.
        assert_eq!(result.registrar.as_deref(), Some("MarkMonitor Inc."));
        assert!(result.creation_date.is_some());
        assert!(result.expiration_date.is_some());
        assert!(result.updated_date.is_some());
        assert_eq!(result.nameservers.len(), 2);
        assert_eq!(result.dnssec.as_deref(), Some("unsigned"));

        // PII fields are redacted — the parser actively filters out any
        // value containing "redacted" / "privacy" / "withheld" and returns
        // None for those, so downstream JSON/human output hides them
        // cleanly. This is a critical contract: GDPR-redacted responses
        // must not leak the literal "REDACTED FOR PRIVACY" string as if
        // it were a real contact name.
        assert!(
            result.registrant.is_none(),
            "registrant must be None when WHOIS says 'REDACTED FOR PRIVACY' \
             (got: {:?})",
            result.registrant
        );
        assert!(
            result.admin_name.is_none(),
            "admin_name must be None for redacted response"
        );
        assert!(
            result.tech_name.is_none(),
            "tech_name must be None for redacted response"
        );
        assert!(
            result.registrant_email.is_none(),
            "the 'Please query the RDDS service…' notice is not an email \
             (got: {:?})",
            result.registrant_email
        );

        // has_core_data should still be true — we have registrar, dates,
        // and nameservers.
        assert!(
            result.has_core_data(),
            "GDPR-redacted response still has core registration data"
        );

        assert!(!result.is_available());
    }

    /// Pure-CRLF thin response (registry-only) without any registrant data.
    /// This is what typical gTLD registries return before the registrar
    /// referral.
    const CRLF_THIN_REGISTRY_FIXTURE: &str = concat!(
        "Domain Name: thin-example.com\r\n",
        "Registry Domain ID: 1234567_DOMAIN_COM-VRSN\r\n",
        "Registrar WHOIS Server: whois.godaddy.com\r\n",
        "Registrar URL: http://www.godaddy.com\r\n",
        "Updated Date: 2025-09-01T00:00:00Z\r\n",
        "Creation Date: 2015-05-20T00:00:00Z\r\n",
        "Registry Expiry Date: 2026-05-20T00:00:00Z\r\n",
        "Registrar: GoDaddy.com, LLC\r\n",
        "Registrar IANA ID: 146\r\n",
        "Domain Status: ok https://icann.org/epp#ok\r\n",
        "Name Server: ns1.thin-example.com\r\n",
        "Name Server: ns2.thin-example.com\r\n",
        "DNSSEC: unsigned\r\n",
    );

    #[test]
    fn test_crlf_thin_registry_fixture() {
        let result = WhoisResponse::parse_internal(
            "thin-example.com",
            "whois.verisign-grs.com",
            CRLF_THIN_REGISTRY_FIXTURE,
        );

        // CRLF line endings must not break regex-based extraction.
        assert_eq!(result.registrar.as_deref(), Some("GoDaddy.com, LLC"));
        assert!(
            result.creation_date.is_some(),
            "creation date must parse under CRLF"
        );
        assert!(
            result.expiration_date.is_some(),
            "expiration date must parse under CRLF"
        );
        assert_eq!(result.nameservers.len(), 2);
        assert_eq!(result.dnssec.as_deref(), Some("unsigned"));
        assert_eq!(result.status.len(), 1);
        assert!(result.has_core_data());
        assert!(!result.is_available());
    }

    /// Minimal "not found" response — typical for available gTLDs.
    const AVAILABLE_COM_FIXTURE: &str = concat!(
        "No match for domain \"THIS-IS-UNREGISTERED-FOR-SURE-12345.COM\".\r\n",
        ">>> Last update of WHOIS database: 2026-04-20T12:00:00Z <<<\r\n",
    );

    #[test]
    fn test_available_com_fixture_is_detected() {
        let result = WhoisResponse::parse_internal(
            "this-is-unregistered-for-sure-12345.com",
            "whois.verisign-grs.com",
            AVAILABLE_COM_FIXTURE,
        );
        assert!(
            result.is_available(),
            "'No match for domain' response must be detected as available"
        );
        assert!(result.registrar.is_none());
        assert!(result.nameservers.is_empty());
    }
}