Core contract
RegistrarModule provides lookup(domain, connection) and execute(action, domainSnapshot, connection), plus schema/Test. Report explicit availability states; unknown, premium or manual-check is not ordinary available inventory. Use a real read-only account test and fixed or tightly validated verified-TLS destinations.
Actions are individually supported: register, transfer, renew, sync/info, nameservers, lock/unlock, privacy and EPP only where actually implemented. Return explicit unsupported errors. A registrar task/order ID may mean accepted/pending; it is not registry activation.
Canonical customer contact
RegistrarCustomerContact opts into input.contact containing first_name, last_name, organization, email, address1, address2, city, state, postcode, ISO country and international E.164 phone. The guarded newer core supplies the owning customer's saved billing identity when no explicit contact/handle was selected. Validate/map these fields to the provider and stop when required data is missing.
An explicit contact choice is retained in a narrow encrypted expectation bound to domain, customer, service and registrar for later confirmation. Profile edits must not silently replace that choice. Do not persist transfer secrets, payment consent or raw provider credentials in it. Registry-specific eligibility/agreements remain explicit input; never invent them.
Terms and transfer DNS
Implement RegistrarTermSupport when exact operation/year restrictions can be verified before checkout. A retail override cannot manufacture an unsupported term. RegistrarTransferNameservers opts into the core's observed existing delegation; do not substitute hosting defaults for a transfer. Some providers require existing registrant handles or account-default contact acknowledgement, as their guide states.
Submission and confirmation
Persist the purchase marker before the single remote write. Read back the exact account-owned domain, intended contacts/nameservers and expiry before declaring activation. Renewal needs authenticated expiry advancement. Timeout after submission remains uncertain and must not auto-repurchase. Re-read through the same immutable registrar connection; unrelated local dates or another provider's public WHOIS cannot prove ownership.
Validate
Test normal/unavailable/premium lookups, missing contacts, restricted terms, transfer DNS, account mismatch, asynchronous task, expiry failure, repeated purchase, timeout and secret redaction. Use the actual provider's approved test account for external certification; local mocked shapes are not a real registry purchase.