@slicedearth/whoisleuth-cli 1.32.0 → 1.34.0

package/DISCLOSURE

@@ -0,0 +1,18 @@
+WHOISleuth is a defensive domain investigation and brand-protection tool. Its
+command-line package can collect bounded WHOIS, RDAP, DNS, HTTP, TLS,
+certificate-transparency, website, and related infrastructure evidence. It can
+also generate and review lookalike-domain candidates, compare saved evidence,
+and prepare analyst-controlled reports. These security-relevant capabilities
+can have both legitimate and potentially harmful uses.
+
+WHOISleuth is intended for authorised defensive investigation, abuse response,
+threat research, domain acquisition due diligence, asset review, and education.
+Network collection is initiated explicitly by the operator, uses bounded
+requests, and keeps source provenance and incomplete results visible. The tool
+does not exploit targets, bypass access controls, submit credentials, execute
+remote page scripts, or automate enforcement actions.
+
+Operators are responsible for using WHOISleuth only on systems and data they
+are authorised to examine and in accordance with applicable laws, provider
+terms, and organisational policies. Observations and heuristic signals are
+investigative leads, not proof of ownership, intent, safety, or maliciousness.

package/README.md

@@ -11,19 +11,35 @@ WHOISleuth requires Node.js 24 or later. Run the reviewed public package without
 a global installation:
 
 ```bash
-npm exec --yes --package=@slicedearth/whoisleuth-cli -- whoisleuth --help
+npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli -- whoisleuth --help
 ```
 
 Or install the `whoisleuth` command globally:
 
 ```bash
-npm install --global @slicedearth/whoisleuth-cli
+npm install --global --ignore-scripts @slicedearth/whoisleuth-cli
 whoisleuth doctor
 ```
 
+Update an existing global installation and confirm the installed release with:
+
+```bash
+npm install --global --ignore-scripts @slicedearth/whoisleuth-cli@latest
+whoisleuth --version
+```
+
 The package version follows the application version. Each release is assembled
 from the executable's bounded dependency closure and retains the project
 licence, notices, trademark terms, source location, and provenance metadata.
+The generated package manifest pins each direct runtime dependency to the exact
+version exercised by the reviewed repository lockfile.
+
+The package has no install, postinstall, or other lifecycle scripts. Network
+access begins only when an analyst runs a networked command. Offline commands
+may read deliberately selected local evidence or configuration files, but do
+not upload them or invoke a hosted WHOISleuth deployment. The installation
+examples disable lifecycle scripts for the package and its dependency tree;
+WHOISleuth does not require them.
 
 ## Repository checkout
 
@@ -33,17 +49,22 @@ Contributors can run the same source command without installing the package:
 node bin/whoisleuth.mts --help
 node bin/whoisleuth.mts lookup example.test
 node bin/whoisleuth.mts lookup example.test --deep --summary
+node bin/whoisleuth.mts lookup example.test --deep --plan --json
 node bin/whoisleuth.mts lookup example.test --deep --markdown --output lookup.md
 node bin/whoisleuth.mts bulk domains.txt --deep --checkpoint bulk-checkpoint.json
 node bin/whoisleuth.mts bulk domains.txt --csv --registered-only
+node bin/whoisleuth.mts bulk domains.txt --queries --errors-only
 node bin/whoisleuth.mts discover example.test --dictionary private-terms.txt --snapshot discovery-state.json --json
 node bin/whoisleuth.mts discover-scan example.test --scan-limit 50 --checkpoint candidate-scan.json --json
 node bin/whoisleuth.mts page-compare official.json candidate.json --json
 node bin/whoisleuth.mts mail-review bulk.json --json
 node bin/whoisleuth.mts diff first-lookup.json second-lookup.json --json
+node bin/whoisleuth.mts timeline first-observation.json second-observation.json latest-observation.json --json
 node bin/whoisleuth.mts registry-support example.test --json
 node bin/whoisleuth.mts doctor
+node bin/whoisleuth.mts commands --json
 node bin/whoisleuth.mts completion zsh
+node bin/whoisleuth.mts completion powershell
 node bin/whoisleuth.mts manual | man -l -
 ```
 
@@ -51,6 +72,13 @@ Fast lookup is the default. Deep collection must be requested explicitly and
 can disclose the target to additional authoritative or first-party network
 sources. Missing, partial, rate-limited, and unsupported sources remain
 explicit and are never interpreted as evidence of safety or absence.
+`lookup --plan` classifies a target and explains the selected source families
+and disclosures without making a network request. `commands --json` exposes the
+installed command contracts for local wrappers without running collection.
+Focused command help and the generated manual label every operation as offline
+or networked and state its target, input, and concurrency boundaries. The
+packaged [dual-use disclosure](DISCLOSURE) defines the supported defensive use
+of those capabilities.
 
 Interactive output uses restrained semantic colour, width-aware wrapping, and
 stderr-only progress for slower collection. Redirected and machine-readable
@@ -65,8 +93,15 @@ the partial-result exit code. Ctrl-C suppresses partial final output and
 returns exit code 130; a second interrupt performs best-effort temporary-file
 cleanup before exiting immediately.
 
-Bulk also supports fixed-column CSV, domain-only output, registered and
-inconclusive output filters, and bounded A, AAAA, NS, and MX summaries. Discover
+The offline `timeline` command orders 2 to 20 saved Lookup documents for one
+domain and compares each adjacent observation. It retains observation times and
+normalized field states but no input filenames or raw registry payloads.
+Observed differences remain separate from missing, unavailable, and changed
+collection conditions.
+
+Bulk also supports fixed-column CSV, domain-only or exact-query output,
+registered, inconclusive, and hard-failure output filters, and bounded A, AAAA,
+NS, and MX summaries. Discover
 supports local custom dictionaries and private snapshot comparison suitable
 for an operator-managed scheduler. The separate networked `discover-scan`
 command can collect a deterministic bounded subset in chunks, retain mutation
@@ -79,6 +114,7 @@ favicon, technology, and TLS evidence, while saved Bulk output can be reviewed
 for passive MX, null MX, SPF, DMARC, and shared-provider context.
 
 See `docs/cli.md` in the package for the complete command, privacy, output, and
-evidence-contract reference.
+evidence-contract reference. Report suspected vulnerabilities through the
+private channel described in `SECURITY.md`.
 
 Copyright 2026 slicedearth. Licensed under AGPL-3.0-only.

package/SECURITY.md

@@ -0,0 +1,35 @@
+# Security policy
+
+## Supported versions
+
+Security fixes are applied to the latest released WHOISleuth application and
+CLI version. Older releases are not maintained as separate security branches.
+Upgrade to the latest release before reporting a problem that may already have
+been corrected.
+
+## Report a vulnerability privately
+
+Use [GitHub private vulnerability reporting](https://github.com/slicedearth/whoisleuth/security/advisories/new)
+for suspected vulnerabilities in the application, CLI, release process, or
+deployment defaults. Do not open a public issue for an undisclosed security
+problem.
+
+Include the affected version, the smallest reproducible example, expected and
+observed behaviour, and the likely impact. Use reserved or synthetic domains
+and remove credentials, session material, personal information, private case
+data, and raw registration records before submitting evidence.
+
+Ordinary defects, feature requests, and questions that do not expose a security
+weakness can use the public issue tracker.
+
+## Scope and response
+
+Reports are assessed against WHOISleuth's documented trust boundaries,
+including its local-first workspace, bounded network collection, shared
+deployment password, and optional hosted monitoring. A source outage, partial
+registry response, or heuristic disagreement is not by itself a security
+vulnerability, but unsafe handling of those states may be.
+
+Confirmed reports will be handled through a private advisory until a fix and
+coordinated disclosure are ready. No bounty or guaranteed response time is
+offered.

package/cli/arguments.mjs

@@ -5,6 +5,7 @@ const MAX_CLI_ARGUMENT_LENGTH = 1024;
 const CLI_COMMANDS = [
     'completion',
     'doctor',
+    'commands',
     'manual',
     'lookup',
     'bulk',
@@ -25,6 +26,7 @@ const CLI_COMMANDS = [
     'page-compare',
     'mail-review',
     'diff',
+    'timeline',
     'export',
 ];
 function boundedArgument(value) {
@@ -108,6 +110,8 @@ function parseCliArgumentsCore(argv) {
         return parseCompletionArguments(argv.slice(1));
     if (command === 'doctor')
         return parseDoctorArguments(argv.slice(1));
+    if (command === 'commands')
+        return parseCommandsArguments(argv.slice(1));
     if (command === 'manual')
         return parseManualArguments(argv.slice(1));
     if (command === 'ct-search')
@@ -144,6 +148,8 @@ function parseCliArgumentsCore(argv) {
         return parseMailReviewArguments(argv.slice(1));
     if (command === 'diff')
         return parseDiffArguments(argv.slice(1));
+    if (command === 'timeline')
+        return parseTimelineArguments(argv.slice(1));
     if (command === 'export')
         return parseExportArguments(argv.slice(1));
     let query = null;
@@ -156,6 +162,7 @@ function parseCliArgumentsCore(argv) {
     let detailSet = false;
     let strictExit = false;
     let events = false;
+    let plan = false;
     for (const argument of argv.slice(1)) {
         if (argument === '--json') {
             if (output !== 'terminal')
@@ -195,6 +202,11 @@ function parseCliArgumentsCore(argv) {
                 throw new CliUsageError('--events may be supplied only once.');
             events = true;
         }
+        else if (argument === '--plan') {
+            if (plan)
+                throw new CliUsageError('--plan may be supplied only once.');
+            plan = true;
+        }
         else if (argument === '--quiet')
             quiet = true;
         else if (argument === '--no-color')
@@ -210,11 +222,16 @@ function parseCliArgumentsCore(argv) {
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
     if (detailSet && output !== 'terminal')
         throw new CliUsageError('--summary and --verbose apply only to terminal output.');
-    return { action: 'lookup', query, output, deep, detail, strictExit, events, quiet, color };
+    if (plan && (output === 'markdown' || output === 'html'))
+        throw new CliUsageError('--plan supports terminal or JSON output only.');
+    if (plan && (detailSet || strictExit || events || quiet)) {
+        throw new CliUsageError('--plan cannot be combined with detail, strict-exit, event, or quiet options.');
+    }
+    return { action: 'lookup', query, output, deep, detail, strictExit, events, plan, quiet, color };
 }
 function parseCompletionArguments(argv) {
-    if (argv.length !== 1 || !['bash', 'zsh', 'fish'].includes(argv[0] || '')) {
-        throw new CliUsageError('completion requires exactly one shell: bash, zsh, or fish.');
+    if (argv.length !== 1 || !['bash', 'zsh', 'fish', 'powershell'].includes(argv[0] || '')) {
+        throw new CliUsageError('completion requires exactly one shell: bash, zsh, fish, or powershell.');
     }
     return { action: 'completion', shell: argv[0] };
 }
@@ -223,6 +240,27 @@ function parseManualArguments(argv) {
         throw new CliUsageError('manual does not accept command arguments.');
     return { action: 'manual' };
 }
+function parseCommandsArguments(argv) {
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (const argument of argv) {
+        if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else
+            throw new CliUsageError(`Unknown option "${argument}".`);
+    }
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'commands', output, quiet, color };
+}
 function parseDoctorArguments(argv) {
     let network = false;
     let output = 'terminal';
@@ -266,10 +304,18 @@ function parseBulkArguments(argv) {
         const argument = argv[index];
         if (argument === undefined)
             break;
-        if (argument === '--json' || argument === '--jsonl' || argument === '--csv' || argument === '--domains') {
+        if (argument === '--json' || argument === '--jsonl' || argument === '--csv' || argument === '--domains' || argument === '--queries') {
             if (output !== 'terminal')
                 throw new CliUsageError('Choose only one output format.');
-            output = argument === '--json' ? 'json' : argument === '--jsonl' ? 'jsonl' : argument === '--csv' ? 'csv' : 'domains';
+            output = argument === '--json'
+                ? 'json'
+                : argument === '--jsonl'
+                    ? 'jsonl'
+                    : argument === '--csv'
+                        ? 'csv'
+                        : argument === '--domains'
+                            ? 'domains'
+                            : 'queries';
         }
         else if (argument === '--deep' || argument === '--fast') {
             if (scanMode)
@@ -305,10 +351,14 @@ function parseBulkArguments(argv) {
                 throw new CliUsageError('--events may be supplied only once.');
             events = true;
         }
-        else if (argument === '--registered-only' || argument === '--inconclusive-only') {
+        else if (argument === '--registered-only' || argument === '--inconclusive-only' || argument === '--errors-only') {
             if (filter !== 'all')
-                throw new CliUsageError('--registered-only and --inconclusive-only are mutually exclusive and may be supplied only once.');
-            filter = argument === '--registered-only' ? 'registered' : 'inconclusive';
+                throw new CliUsageError('Bulk output filters are mutually exclusive and may be supplied only once.');
+            filter = argument === '--registered-only'
+                ? 'registered'
+                : argument === '--inconclusive-only'
+                    ? 'inconclusive'
+                    : 'errors';
         }
         else if (argument === '--quiet')
             quiet = true;
@@ -876,6 +926,36 @@ function parseDiffArguments(argv) {
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
     return { action: 'diff', leftSource, rightSource, output, quiet, color };
 }
+function parseTimelineArguments(argv) {
+    const sources = [];
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (const argument of argv) {
+        if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else
+            sources.push(argument);
+    }
+    if (sources.length < 2 || sources.length > 20) {
+        throw new CliUsageError('timeline requires from 2 to 20 saved lookup JSON files.');
+    }
+    if (new Set(sources).size !== sources.length) {
+        throw new CliUsageError('timeline input files must be different.');
+    }
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'timeline', sources, output, quiet, color };
+}
 function parseRegistrySupportArguments(argv) {
     let target = null;
     let output = 'terminal';

package/cli/artifact-verify.mjs

@@ -7,6 +7,7 @@ import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, } from "../f
 import { decryptWorkspaceArchive, inspectEncryptedWorkspaceArchive, isEncryptedWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive-crypto.js";
 import { WORKSPACE_ARCHIVE_SCHEMA, readWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive.js";
 import { sha256ArtifactDigest } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { SAVED_LOOKUP_SCHEMA, SAVED_LOOKUP_SCHEMA_VERSION, parseSavedLookupDocument, } from "./saved-lookup.mjs";
 export const OFFLINE_ARTIFACT_VERIFICATION_SCHEMA = 'whoisleuth.offline-artifact-verification';
 export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 1;
 export const MAX_OFFLINE_ARTIFACT_BYTES = 15 * 1024 * 1024;
@@ -186,6 +187,33 @@ export async function verifyOfflineArtifact(raw, options = {}) {
             ]),
         });
     }
+    if (schema === SAVED_LOOKUP_SCHEMA) {
+        if (version !== SAVED_LOOKUP_SCHEMA_VERSION) {
+            throw new TypeError('This saved Lookup document version is not supported.');
+        }
+        const document = parseSavedLookupDocument(raw, { label: 'Saved Lookup artifact' });
+        return Object.freeze({
+            schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
+            version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,
+            artifact: Object.freeze({ kind: 'saved_lookup', schema, version }),
+            state: 'structure_valid',
+            valid: true,
+            checks: Object.freeze({
+                structure: 'verified',
+                contentIntegrity: 'not_checked',
+                authenticatedEncryption: 'not_applicable',
+            }),
+            summary: Object.freeze({
+                inputBytes: inputBytes(raw),
+                sectionCount: null,
+                recordCount: null,
+                ciphertextBytes: null,
+            }),
+            limitations: Object.freeze([
+                `The saved ${document.mode} Lookup matches its versioned structural contract, but this document format has no embedded checksum or signature. Structural validity does not prove that its evidence is accurate, current, or unchanged since collection.`,
+            ]),
+        });
+    }
     return verifySignedArtifact(raw, value, schema, version);
 }
 export function formatOfflineArtifactVerification(report) {

package/cli/bulk-command-runner.mjs

@@ -3,7 +3,7 @@ import { classifyQuery } from "../lib/classify.mjs";
 import { runUnifiedLookup } from "../lib/lookup.mjs";
 import { createBulkCheckpointWriter } from "./bulk-checkpoint.mjs";
 import { MAX_BULK_INPUT_BYTES, parseBulkQueries, readTextStreamBounded, runBulkLookups, } from "./bulk.mjs";
-import { formatBulkCsv, formatBulkDomainList, selectBulkItems } from "./bulk-output.mjs";
+import { formatBulkCsv, formatBulkDomainList, formatBulkQueryList, selectBulkItems } from "./bulk-output.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 import { buildCliBulkDocument, formatJsonDocument, formatJsonLines } from "./formatters/json.mjs";
@@ -91,6 +91,8 @@ async function runBulkCommand(args, dependencies, context) {
             context.writeStdout(formatBulkCsv(selectedItems));
         else if (args.output === 'domains')
             context.writeStdout(formatBulkDomainList(selectedItems));
+        else if (args.output === 'queries')
+            context.writeStdout(formatBulkQueryList(selectedItems));
         else
             context.writeStdout(context.terminal(formatTerminalBulk(selectedItems, metadata), args.color));
     }

package/cli/bulk-output.mjs

@@ -18,6 +18,8 @@ function selectBulkItems(items, filter) {
     if (filter === 'all')
         return [...items];
     return items.filter((item) => {
+        if (filter === 'errors')
+            return !item.ok;
         if (!item.ok)
             return filter === 'inconclusive';
         const state = availabilityState(item);
@@ -109,4 +111,7 @@ function formatBulkDomainList(items) {
         : []);
     return values.length ? `${[...new Set(values)].join('\n')}\n` : '';
 }
-export { REGISTERED_STATES, availabilityState, bulkDnsSummary, formatBulkCsv, formatBulkDomainList, selectBulkItems, };
+function formatBulkQueryList(items) {
+    return items.length ? `${items.map((item) => item.query).join('\n')}\n` : '';
+}
+export { REGISTERED_STATES, availabilityState, bulkDnsSummary, formatBulkCsv, formatBulkDomainList, formatBulkQueryList, selectBulkItems, };

package/cli/command-catalogue.mjs

@@ -0,0 +1,33 @@
+export const CLI_COMMAND_CATALOGUE_SCHEMA = 'whoisleuth.cli.command-catalogue';
+export const CLI_COMMAND_CATALOGUE_VERSION = 1;
+function buildCliCommandCatalogue(options) {
+    return Object.freeze({
+        schema: CLI_COMMAND_CATALOGUE_SCHEMA,
+        version: CLI_COMMAND_CATALOGUE_VERSION,
+        packageVersion: options.packageVersion,
+        commands: Object.freeze(options.commands.map((command) => {
+            const detail = options.details[command];
+            return Object.freeze({
+                command,
+                description: detail.description,
+                usage: options.usage[command],
+                example: detail.example,
+                collection: options.collections[command],
+                boundary: detail.boundary,
+            });
+        })),
+    });
+}
+function formatCliCommandCatalogue(catalogue) {
+    const lines = [
+        `WHOISleuth CLI ${catalogue.packageVersion}`,
+        'Command catalogue',
+        '',
+    ];
+    for (const entry of catalogue.commands) {
+        lines.push(`${entry.command} [${entry.collection.mode}]`, `  ${entry.description}`, `  ${entry.usage}`);
+    }
+    lines.push('', 'Run "whoisleuth <command> --help" for examples and collection boundaries.');
+    return `${lines.join('\n')}\n`;
+}
+export { buildCliCommandCatalogue, formatCliCommandCatalogue };

package/cli/completion.mjs

@@ -1,8 +1,8 @@
 import { CLI_COMMANDS } from "./arguments.mjs";
 const COMMON_OPTIONS = Object.freeze(['--help', '--output', '--force']);
 const OPTIONS_BY_COMMAND = Object.freeze({
-    lookup: ['--json', '--markdown', '--html', '--fast', '--deep', '--summary', '--verbose', '--strict-exit', '--events', '--quiet', '--no-color'],
-    bulk: ['--json', '--jsonl', '--csv', '--domains', '--registered-only', '--inconclusive-only', '--fast', '--deep', '--concurrency', '--checkpoint', '--resume', '--events', '--quiet', '--no-color'],
+    lookup: ['--json', '--markdown', '--html', '--fast', '--deep', '--plan', '--summary', '--verbose', '--strict-exit', '--events', '--quiet', '--no-color'],
+    bulk: ['--json', '--jsonl', '--csv', '--domains', '--queries', '--registered-only', '--inconclusive-only', '--errors-only', '--fast', '--deep', '--concurrency', '--checkpoint', '--resume', '--events', '--quiet', '--no-color'],
     'ct-search': ['--json', '--quiet', '--no-color'],
     discover: ['--tlds', '--preset', '--families', '--keyboard', '--dictionary', '--snapshot', '--json', '--jsonl', '--domains', '--quiet', '--no-color'],
     'discover-scan': ['--tlds', '--preset', '--families', '--keyboard', '--dictionary', '--fast', '--deep', '--scan-limit', '--chunk-size', '--concurrency', '--resolver', '--allowlist', '--checkpoint', '--resume', '--observation-snapshot', '--registered-only', '--inconclusive-only', '--acquisition-only', '--suppressed-only', '--events', '--json', '--jsonl', '--csv', '--domains', '--quiet', '--no-color'],
@@ -20,8 +20,10 @@ const OPTIONS_BY_COMMAND = Object.freeze({
     'page-compare': ['--json', '--quiet', '--no-color'],
     'mail-review': ['--json', '--quiet', '--no-color'],
     diff: ['--json', '--quiet', '--no-color'],
+    timeline: ['--json', '--quiet', '--no-color'],
     export: ['--markdown', '--html', '--compact'],
     completion: [],
+    commands: ['--json', '--quiet', '--no-color'],
     doctor: ['--network', '--json', '--quiet', '--no-color'],
     manual: [],
 });
@@ -36,7 +38,7 @@ const COMMAND_DESCRIPTIONS = Object.freeze({
     tls: 'Inspect one TLS connection',
     'registry-support': 'Explain local registry coverage',
     'risk-calibrate': 'Replay reviewed Risk labels offline',
-    'verify-artifact': 'Validate an evidence artifact offline',
+    'verify-artifact': 'Validate saved evidence offline',
     'inspect-archive': 'Inspect an archive locally',
     'sign-artifact': 'Sign a reviewed artifact locally',
     'verify-signature': 'Verify a signed evidence package',
@@ -45,8 +47,10 @@ const COMMAND_DESCRIPTIONS = Object.freeze({
     'page-compare': 'Compare saved static page evidence',
     'mail-review': 'Review saved passive mail evidence',
     diff: 'Compare two saved domain lookups',
+    timeline: 'Build same-domain history from saved lookups',
     export: 'Convert a lookup to an evidence report',
     completion: 'Print shell completion',
+    commands: 'List installed command contracts',
     doctor: 'Check the local CLI runtime',
     manual: 'Print the generated manual page',
 });
@@ -92,7 +96,7 @@ _whoisleuth_completion() {
     return
   fi
   if [[ "\${command}" == "completion" && \${COMP_CWORD} -eq 2 ]]; then
-    COMPREPLY=( $(compgen -W "bash zsh fish" -- "\${current}") )
+    COMPREPLY=( $(compgen -W "bash zsh fish powershell" -- "\${current}") )
     return
   fi
   case "\${previous}" in
@@ -125,7 +129,7 @@ _whoisleuth() {
   command="\${words[2]}"
   previous="\${words[CURRENT-1]}"
   if [[ "\${command}" == "completion" && CURRENT -eq 3 ]]; then
-    compadd -- bash zsh fish
+    compadd -- bash zsh fish powershell
     return
   fi
   case "\${previous}" in
@@ -160,16 +164,56 @@ complete -c whoisleuth -f
 complete -c whoisleuth -n '__fish_use_subcommand' -l help
 complete -c whoisleuth -n '__fish_use_subcommand' -l version
 ${commandLines.join('\n')}
-complete -c whoisleuth -n '__fish_seen_subcommand_from completion' -a 'bash zsh fish'
+complete -c whoisleuth -n '__fish_seen_subcommand_from completion' -a 'bash zsh fish powershell'
 ${optionLines.join('\n')}
 ${valueLines.join('\n')}
 `;
 }
+function powershellCompletion() {
+    const commandOptions = Object.fromEntries(CLI_COMMANDS.map((command) => [
+        command,
+        [...COMMON_OPTIONS, ...(OPTIONS_BY_COMMAND[command] || [])],
+    ]));
+    return `# WHOISleuth PowerShell completion
+Register-ArgumentCompleter -Native -CommandName whoisleuth -ScriptBlock {
+  param($wordToComplete, $commandAst, $cursorPosition)
+  $commands = @(${CLI_COMMANDS.map((command) => `'${command}'`).join(', ')})
+  $options = @{
+${Object.entries(commandOptions).map(([command, options]) => `    '${command}' = @(${options.map((option) => `'${option}'`).join(', ')})`).join('\n')}
+  }
+  $values = @{
+${Object.entries(VALUE_OPTIONS).map(([option, values]) => `    '${option}' = @(${values.map((value) => `'${value}'`).join(', ')})`).join('\n')}
+    'completion' = @('bash', 'zsh', 'fish', 'powershell')
+  }
+  $elements = @($commandAst.CommandElements | ForEach-Object { $_.Extent.Text })
+  $command = if ($elements.Count -gt 1) { $elements[1] } else { '' }
+  $previous = if ($elements.Count -gt 1) { $elements[$elements.Count - 1] } else { '' }
+  $candidates = if ($elements.Count -le 2) {
+    @($commands) + @('--help', '--version')
+  } elseif ($command -eq 'completion' -and $elements.Count -le 3) {
+    $values['completion']
+  } elseif ($values.ContainsKey($previous)) {
+    $values[$previous]
+  } elseif ($options.ContainsKey($command)) {
+    $options[$command]
+  } else {
+    @('--help')
+  }
+  foreach ($candidate in $candidates) {
+    if ($candidate.StartsWith($wordToComplete, [System.StringComparison]::OrdinalIgnoreCase)) {
+      [System.Management.Automation.CompletionResult]::new($candidate, $candidate, 'ParameterValue', $candidate)
+    }
+  }
+}
+`;
+}
 function buildShellCompletion(shell) {
     if (shell === 'bash')
         return bashCompletion();
     if (shell === 'zsh')
         return zshCompletion();
-    return fishCompletion();
+    if (shell === 'fish')
+        return fishCompletion();
+    return powershellCompletion();
 }
 export { buildShellCompletion, };