Registrable Domain

Neither popular library is correct, and they are wrong in complementary ways. Measured across twelve hosts by running both: tldts collapses victim.github.io to github.io, and psl returns the string 1.1 as the domain of 192.168.1.1.

Both failures are silent. tldts collapsing every GitHub Pages tenant onto one domain erases exactly the boundary the Public Suffix List private section exists to draw -- so a cookie-scope check, a same-site check or an allowlist answers same owner for two unrelated tenants, and it returns a plausible domain string rather than throwing. psl returning 1.1 for an IP produces a value that passes a truthiness check and looks like a two-label domain, so the caller proceeds with a host that was never a domain at all.

Depends on psl for the list itself rather than bundling a snapshot, because the Public Suffix List changes several times a year and a stale copy is wrong in exactly the unobservable way this exists to prevent. What is added is the correctness around it. An unlisted suffix REFUSES rather than getting psl's last-two-labels guess -- that guess is how a.b.unknown-tld becomes owned by b.unknown-tld, with no error flag set. IP literals refuse, and a malformed address is classified invalid rather than ip, because a caller logging blocked an IP for garbage input is being told the wrong thing. Leading-zero octets refuse, since 010.1.1.1 is octal to some resolvers and decimal to others. And sameRegistrableOwner returns false when either side has no domain, because neither is a domain is not the same owner, and a comparison that returns true for two IP literals is how an allowlist opens.

VERIFIED: 30 tests, and 6 deliberate defects applied to the real source — 4 caught, 2 measured as equivalent (they change only the refusal REASON, never the verdict; the argument ships in mutations.json so you can re-run it). Three of my own bugs were found by tests written to check the competitors, and a fourth mutation survived because the code it targeted was dead -- removed rather than counted.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function registrableDomain(input: unknown): DomainResult;
  export function sameRegistrableOwner(a: unknown, b: unknown): boolean;

  export type HostKind = "domain" | "ip" | "local" | "invalid";