@slicedearth/whoisleuth-cli 1.32.0

package/cli/http.mjs

@@ -0,0 +1,27 @@
+const MAX_HTTP_CLI_DETAIL_LENGTH = 300;
+const PROBE_STATUSES = new Set(['fetched', 'responded', 'inconclusive']);
+function boundedDetail(value) {
+    return String(value || '')
+        .replace(/[\x00-\x1f\x7f]+/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, MAX_HTTP_CLI_DETAIL_LENGTH) || null;
+}
+function buildHttpProbeResult(domain, probe) {
+    const input = probe && typeof probe === 'object' && !Array.isArray(probe)
+        ? probe
+        : {};
+    const status = typeof input.status === 'string' && PROBE_STATUSES.has(input.status)
+        ? input.status
+        : 'inconclusive';
+    return {
+        domain,
+        probeStatus: status,
+        activityStatus: status === 'fetched' || status === 'responded' ? 'active' : 'unreachable',
+        detail: boundedDetail(input.detail),
+        http: input.http && typeof input.http === 'object' && !Array.isArray(input.http)
+            ? input.http
+            : null,
+    };
+}
+export { MAX_HTTP_CLI_DETAIL_LENGTH, buildHttpProbeResult };

package/cli/lookup-command-runner.mjs

@@ -0,0 +1,87 @@
+import { abortable } from "../lib/abort.mjs";
+import { classifyQuery } from "../lib/classify.mjs";
+import { runUnifiedLookup } from "../lib/lookup.mjs";
+import { CliUsageError, boundedCliErrorMessage } from "./errors.mjs";
+import EXIT_CODES from "./exit-codes.mjs";
+import { buildCliEvidenceExport } from "./export-evidence.mjs";
+import { formatLookupEvidenceHtml } from "./formatters/html.mjs";
+import { buildCliLookupDocument, formatJsonDocument } from "./formatters/json.mjs";
+import { formatLookupEvidenceMarkdown } from "./formatters/markdown.mjs";
+import { formatTerminalLookup } from "./formatters/terminal.mjs";
+import { createCliProgressEvents } from "./progress-events.mjs";
+import { lookupStrictExitFindings } from "./strict-exit.mjs";
+async function runLookupCommand(args, dependencies, context) {
+    const eventProgress = createCliProgressEvents(context.stderr, {
+        command: 'lookup',
+        enabled: args.events,
+        ...(dependencies.now ? { now: dependencies.now } : {}),
+    });
+    context.setEventProgress(eventProgress);
+    eventProgress.emit({ event: 'started' });
+    const query = args.query || await context.readSingleInput();
+    if (!query)
+        throw new CliUsageError('lookup requires one domain, IP address, or ASN as an argument or on stdin.');
+    const classify = dependencies.classifyQuery || classifyQuery;
+    const executeLookup = dependencies.runUnifiedLookup || runUnifiedLookup;
+    let classified;
+    try {
+        classified = classify(query);
+    }
+    catch (error) {
+        throw new CliUsageError(boundedCliErrorMessage(error, 'Invalid query'));
+    }
+    if ((args.output === 'markdown' || args.output === 'html') && classified.type !== 'domain') {
+        throw new CliUsageError('Markdown and HTML reports support domain lookups only.');
+    }
+    const indicator = context.beginProgress(args.deep
+        ? 'Collecting deep Lookup evidence'
+        : 'Collecting registration evidence');
+    let settledSources = 0;
+    let result;
+    try {
+        result = await abortable(() => executeLookup(classified, args.deep
+            ? {
+                fast: false,
+                compact: false,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+                onSourceSettled: (settlement) => {
+                    settledSources += 1;
+                    indicator.update(`Collected ${settledSources} source${settledSources === 1 ? '' : 's'} · ${settlement.source.replaceAll('_', ' ')} ${settlement.state}`);
+                    eventProgress.emit({ event: 'source_settled', source: settlement.source, state: settlement.state });
+                },
+            }
+            : {
+                fast: true,
+                compact: false,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+            }), dependencies.signal);
+    }
+    finally {
+        context.endProgress();
+    }
+    const now = context.now();
+    const document = buildCliLookupDocument(query, classified, result, now, args.deep ? 'deep' : 'fast');
+    if (!args.quiet) {
+        if (args.output === 'json')
+            context.writeStdout(formatJsonDocument(document));
+        else if (args.output === 'markdown' || args.output === 'html') {
+            const loadEvidence = dependencies.loadEvidenceExport || (() => import("../lib/evidence-export.mjs"));
+            const evidenceModule = await loadEvidence();
+            const report = buildCliEvidenceExport(JSON.stringify(document), evidenceModule, now);
+            context.writeStdout(args.output === 'markdown'
+                ? formatLookupEvidenceMarkdown(report)
+                : formatLookupEvidenceHtml(report));
+        }
+        else {
+            context.writeStdout(context.terminal(formatTerminalLookup(document, { detail: args.detail }), args.color));
+        }
+    }
+    const strictFindings = args.strictExit ? lookupStrictExitFindings(document) : [];
+    const exitCode = strictFindings.length ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+    if (strictFindings.length && !args.events) {
+        context.writeStderr(`Strict exit: ${strictFindings.length} requested source state${strictFindings.length === 1 ? '' : 's'} were incomplete.\n`);
+    }
+    eventProgress.emit({ event: 'completed', exitCode });
+    return exitCode;
+}
+export { runLookupCommand };

package/cli/lookup-diff.mjs

@@ -0,0 +1,171 @@
+import { buildBulkComparisonEvidence } from "../lib/bulk-comparison-evidence.mjs";
+import { buildBulkDomainComparison, } from "../frontend/src/lib/analysis/bulk-domain-comparison.js";
+import { relationshipObservation } from "../frontend/src/lib/analysis/relationship-evidence.js";
+import { CliUsageError } from "./errors.mjs";
+import { parseSavedLookupDocument } from "./saved-lookup.mjs";
+export const CLI_LOOKUP_DIFF_SCHEMA = 'whoisleuth.cli.lookup-diff';
+export const CLI_LOOKUP_DIFF_VERSION = 1;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function text(value, maximum = 300) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.replace(/[\x00-\x1f\x7f]+/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum);
+    return normalized || null;
+}
+function stringList(value, maximum = 100) {
+    if (!Array.isArray(value))
+        return [];
+    return [...new Set(value.slice(0, maximum * 2).flatMap((candidate) => {
+            const normalized = text(candidate, 253)?.toLowerCase().replace(/\.$/u, '');
+            return normalized ? [normalized] : [];
+        }))].slice(0, maximum);
+}
+function lifecycleValue(parsed, field) {
+    const lifecycle = record(parsed.lifecycle);
+    return text(lifecycle[`${field}Iso`] ?? lifecycle[field] ?? parsed[`${field}Iso`] ?? parsed[field], 64);
+}
+function registrarLabel(parsed) {
+    const registrar = parsed.registrar;
+    if (typeof registrar === 'string')
+        return text(registrar);
+    const source = record(registrar);
+    return text(source.name ?? source.org ?? source.handle);
+}
+function sourceState(value) {
+    const normalized = text(value, 40)?.toLowerCase() || 'unavailable';
+    if (normalized === 'success' || normalized === 'complete')
+        return 'complete';
+    if (normalized === 'not_found')
+        return 'not_found';
+    if (normalized === 'partial')
+        return 'partial';
+    if (normalized === 'skipped' || normalized === 'disabled' || normalized === 'not_applicable')
+        return 'skipped';
+    if (normalized === 'unsupported')
+        return 'unsupported';
+    if (normalized === 'error' || normalized === 'failed' || normalized === 'timeout' || normalized === 'rate_limited')
+        return 'error';
+    return 'unavailable';
+}
+function sourceCoverage(document, availability) {
+    const diagnostics = record(document.diagnostics);
+    const entries = [
+        ['rdap', record(diagnostics.rdap).status],
+        ['whois', record(diagnostics.whois).status],
+        ['availability', record(diagnostics.availability).status],
+        ['dns', record(availability.dns).status],
+        ['http', record(availability.http).status],
+        ['tls', record(availability.tls).status],
+    ];
+    return entries.map(([source, status]) => ({ source, state: sourceState(status) }));
+}
+function lookupComparisonInput(document) {
+    const availability = record(document.availability);
+    const rdapParsed = record(record(document.rdap).parsed);
+    const whoisParsed = record(record(document.whois).parsed);
+    const preferredRegistry = Object.keys(rdapParsed).length ? rdapParsed : whoisParsed;
+    const relationship = relationshipObservation(availability);
+    const dns = record(availability.dns);
+    const dnsRecords = record(dns.records);
+    const comparisonEvidence = buildBulkComparisonEvidence(availability);
+    return {
+        domain: document.registrableDomain,
+        status: 'complete',
+        availability: text(availability.state, 40) || 'unknown',
+        confidence: text(availability.confidence, 40) || 'unknown',
+        registrar: registrarLabel(preferredRegistry) || '—',
+        activity: text(availability.activityStatus) || '—',
+        risk: null,
+        opportunity: null,
+        mutationTypes: [],
+        trusted: null,
+        error: '',
+        scanDepth: document.mode,
+        createdDate: lifecycleValue(preferredRegistry, 'createdDate'),
+        expiryDate: lifecycleValue(preferredRegistry, 'expiryDate'),
+        nameservers: relationship.nameservers.length ? relationship.nameservers : stringList(preferredRegistry.nameservers, 20),
+        hasMx: typeof availability.hasMx === 'boolean' ? availability.hasMx : null,
+        hasNullMx: typeof availability.hasNullMx === 'boolean' ? availability.hasNullMx : null,
+        hasSpf: typeof availability.hasSpf === 'boolean' ? availability.hasSpf : null,
+        hasDmarc: typeof availability.hasDmarc === 'boolean' ? availability.hasDmarc : null,
+        activityStatus: text(availability.activityStatus, 40),
+        pageTitle: text(availability.pageTitle),
+        faviconHash: relationship.faviconHash,
+        faviconPHash: relationship.faviconPHash,
+        faviconMatch: false,
+        faviconNearMatch: false,
+        reusesOfficialAssets: false,
+        hasPasswordField: record(record(availability.credentialSurfaceProfile).inputs).categories
+            ? Number(record(record(record(availability.credentialSurfaceProfile).inputs).categories).password) > 0
+            : false,
+        hasExternalFormAction: null,
+        phishingLanguageMatch: null,
+        riskModelVersion: null,
+        riskFactors: [],
+        dns: {
+            status: text(dns.status, 40),
+            records: {
+                a: stringList(dnsRecords.a),
+                aaaa: stringList(dnsRecords.aaaa),
+                cname: stringList(dnsRecords.cname),
+                caa: Array.isArray(dnsRecords.caa) ? dnsRecords.caa.slice(0, 100) : [],
+            },
+        },
+        dnssec: text(preferredRegistry.dnssec, 40),
+        comparisonEvidence,
+        relationship,
+        sourceCoverage: sourceCoverage(document, availability),
+    };
+}
+function buildCliLookupDiff(leftText, rightText, generatedAt = new Date().toISOString()) {
+    const left = parseSavedLookupDocument(leftText, { label: 'Left lookup input' });
+    const right = parseSavedLookupDocument(rightText, { label: 'Right lookup input' });
+    if (left.registrableDomain === right.registrableDomain) {
+        throw new CliUsageError('Lookup diff requires documents for two different domains.');
+    }
+    const comparison = buildBulkDomainComparison(lookupComparisonInput(left), lookupComparisonInput(right), null);
+    if (!comparison)
+        throw new CliUsageError('Lookup documents could not be compared.');
+    return {
+        schema: CLI_LOOKUP_DIFF_SCHEMA,
+        version: CLI_LOOKUP_DIFF_VERSION,
+        generatedAt,
+        left: { domain: left.registrableDomain, generatedAt: left.generatedAt, mode: left.mode },
+        right: { domain: right.registrableDomain, generatedAt: right.generatedAt, mode: right.mode },
+        comparison,
+        limitations: [
+            'This command compares bounded observations already present in two saved Lookup documents and makes no network request.',
+            'A missing value remains distinct from unavailable collection and from an observed difference.',
+            'Shared infrastructure or matching values do not establish common ownership, control, intent, safety, or maliciousness.',
+        ],
+    };
+}
+function formatCliLookupDiff(document) {
+    const rows = document.comparison.rows.filter((row) => row.state !== 'equal');
+    const output = [
+        'Domain evidence diff',
+        `Left             ${document.left.domain}`,
+        `Left observed    ${document.left.generatedAt}`,
+        `Right            ${document.right.domain}`,
+        `Right observed   ${document.right.generatedAt}`,
+        `Changed          ${document.comparison.counts.different + document.comparison.counts.conflicting}`,
+        `One-sided        ${document.comparison.counts.missing}`,
+        `Unavailable      ${document.comparison.counts.unavailable + document.comparison.counts.not_recorded}`,
+        '',
+    ];
+    if (!rows.length)
+        output.push('No bounded differences were observed in the comparable fields.');
+    for (const row of rows) {
+        output.push(`${row.label} [${row.state.replaceAll('_', ' ')}]`);
+        output.push(`  Left:  ${row.left}`);
+        output.push(`  Right: ${row.right}`);
+        output.push(`  Source: ${row.source}`);
+    }
+    output.push('', 'Limitations:');
+    for (const limitation of document.limitations)
+        output.push(`  - ${limitation}`);
+    return `${output.join('\n')}\n`;
+}
+export { buildCliLookupDiff, formatCliLookupDiff };

package/cli/mail-review.mjs

@@ -0,0 +1,204 @@
+import { Buffer } from 'node:buffer';
+import { getDomain } from 'tldts';
+import { CliUsageError } from "./errors.mjs";
+export const CLI_MAIL_REVIEW_SCHEMA = 'whoisleuth.cli.mail-review';
+export const CLI_MAIL_REVIEW_VERSION = 1;
+export const MAX_MAIL_REVIEW_INPUT_BYTES = 16 * 1024 * 1024;
+export const MAX_MAIL_REVIEW_ROWS = 500;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function text(value, maximum = 500) {
+    return typeof value === 'string'
+        ? value.replace(/[\u0000-\u001f\u007f]+/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum)
+        : '';
+}
+function boolean(value) {
+    return typeof value === 'boolean' ? value : null;
+}
+function mxHosts(availability, summary) {
+    const direct = Array.isArray(availability.mxHosts) ? availability.mxHosts : [];
+    const summarized = Array.isArray(summary.mx) ? summary.mx : [];
+    const output = new Set();
+    for (const candidate of [...direct, ...summarized].slice(0, 200)) {
+        const normalized = text(candidate, 300).replace(/^\d+\s+/u, '').replace(/\.$/u, '').toLowerCase();
+        if (normalized && normalized.length <= 253)
+            output.add(normalized);
+        if (output.size >= 50)
+            break;
+    }
+    return [...output];
+}
+function providerDomains(hosts) {
+    return [...new Set(hosts.flatMap((host) => {
+            const labels = host.split('.').filter(Boolean);
+            const domain = getDomain(host, { allowPrivateDomains: true })
+                ?? (labels.length >= 2 ? labels.slice(-2).join('.') : null);
+            return domain ? [domain.toLowerCase()] : [];
+        }))].sort().slice(0, 20);
+}
+function mailState(input) {
+    if (!['success', 'partial'].includes(input.dnsStatus))
+        return 'evidence_incomplete';
+    if (input.hasNullMx === true)
+        return 'null_mx';
+    if (input.hasMx === true) {
+        if (input.hasSpf === true && input.hasDmarc === true)
+            return 'authenticated_mail';
+        if (input.hasSpf === false || input.hasDmarc === false)
+            return 'mail_auth_gap';
+        return 'mail_auth_incomplete';
+    }
+    if (input.hasMx === false && input.hasNullMx === false)
+        return 'no_explicit_mx';
+    return 'evidence_incomplete';
+}
+function normalizeMailRow(value) {
+    const item = record(value);
+    if (item.ok !== true)
+        return null;
+    const availability = record(item.availability);
+    const summary = record(item.dnsSummary);
+    const domain = text(item.registrableDomain ?? item.query ?? availability.domain, 253).toLowerCase().replace(/\.$/u, '');
+    if (!domain || !domain.includes('.'))
+        return null;
+    const dns = record(availability.dns);
+    const dnsStatus = text(summary.status ?? dns.status, 40).toLowerCase() || 'unavailable';
+    const hosts = mxHosts(availability, summary);
+    const hasMx = boolean(availability.hasMx) ?? (hosts.length ? true : null);
+    const hasNullMx = boolean(availability.hasNullMx) ?? boolean(summary.hasNullMx);
+    const hasSpf = boolean(availability.hasSpf) ?? boolean(summary.hasSpf);
+    const hasDmarc = boolean(availability.hasDmarc) ?? boolean(summary.hasDmarc);
+    const state = mailState({ dnsStatus, hasMx, hasNullMx, hasSpf, hasDmarc });
+    return {
+        domain,
+        state,
+        dnsStatus,
+        hasMx,
+        hasNullMx,
+        hasSpf,
+        hasDmarc,
+        mxHosts: hosts,
+        providerDomains: providerDomains(hosts),
+        limitations: [
+            ...(dnsStatus === 'partial' ? ['DNS evidence was partial.'] : []),
+            ...(state === 'no_explicit_mx' ? ['No explicit MX is not equivalent to a null MX or proof that delivery is impossible.'] : []),
+            'Mail configuration does not establish use, control, intent, safety, or maliciousness.',
+        ],
+    };
+}
+function parseInput(textValue) {
+    if (typeof textValue !== 'string' || Buffer.byteLength(textValue, 'utf8') > MAX_MAIL_REVIEW_INPUT_BYTES) {
+        throw new CliUsageError(`Mail review input is limited to ${MAX_MAIL_REVIEW_INPUT_BYTES} bytes.`);
+    }
+    const textInput = textValue.replace(/^\uFEFF/u, '').trim();
+    if (!textInput)
+        throw new CliUsageError('Mail review requires one Bulk JSON or JSONL document.');
+    let values;
+    try {
+        const parsed = JSON.parse(textInput);
+        const document = record(parsed);
+        if (document.schema === 'whoisleuth.cli.bulk' && document.version === 2 && Array.isArray(document.results)) {
+            values = document.results;
+        }
+        else if (document.schema === 'whoisleuth.cli.bulk.item' && document.version === 2) {
+            values = [document];
+        }
+        else {
+            throw new CliUsageError('Mail review requires WHOISleuth Bulk JSON schema version 2.');
+        }
+    }
+    catch (error) {
+        if (error instanceof CliUsageError)
+            throw error;
+        try {
+            values = textInput.split(/\r?\n/u).filter(Boolean).map((line) => JSON.parse(line));
+        }
+        catch {
+            throw new CliUsageError('Mail review input must be valid WHOISleuth Bulk JSON or JSONL.');
+        }
+    }
+    if (!values.length || values.length > MAX_MAIL_REVIEW_ROWS) {
+        throw new CliUsageError(`Mail review supports between 1 and ${MAX_MAIL_REVIEW_ROWS} Bulk rows.`);
+    }
+    const rows = values.map((value) => record(value));
+    if (rows.some((value) => value.schema !== 'whoisleuth.cli.bulk.item' || value.version !== 2)) {
+        throw new CliUsageError('Every Mail review row must use WHOISleuth Bulk item schema version 2.');
+    }
+    return rows;
+}
+function buildCliMailReview(textValue, generatedAt = new Date().toISOString()) {
+    const inputRows = parseInput(textValue);
+    const rows = inputRows.map(normalizeMailRow).filter((row) => Boolean(row));
+    if (!rows.length)
+        throw new CliUsageError('Mail review input contains no completed domain results.');
+    const counts = {
+        authenticated_mail: 0,
+        evidence_incomplete: 0,
+        mail_auth_gap: 0,
+        mail_auth_incomplete: 0,
+        no_explicit_mx: 0,
+        null_mx: 0,
+    };
+    for (const row of rows)
+        counts[row.state] += 1;
+    const providerMap = new Map();
+    for (const row of rows) {
+        for (const provider of row.providerDomains) {
+            const domains = providerMap.get(provider) ?? [];
+            domains.push(row.domain);
+            providerMap.set(provider, domains);
+        }
+    }
+    const providerRelationships = [...providerMap.entries()]
+        .filter(([, domains]) => new Set(domains).size >= 2)
+        .map(([providerDomain, domains]) => ({
+        providerDomain,
+        domains: [...new Set(domains)].sort().slice(0, 100),
+        method: 'Shared registrable domain of an observed MX hostname',
+        limitation: 'Shared mail providers are common and do not establish common ownership, control, intent, safety, or maliciousness.',
+    }))
+        .sort((left, right) => left.providerDomain.localeCompare(right.providerDomain))
+        .slice(0, 100);
+    return {
+        schema: CLI_MAIL_REVIEW_SCHEMA,
+        version: CLI_MAIL_REVIEW_VERSION,
+        generatedAt,
+        counts,
+        rows,
+        providerRelationships,
+        limitations: [
+            'This review is passive and uses DNS evidence already retained in a WHOISleuth Bulk result; it makes no network request.',
+            'Null MX, no explicit MX, receiving mail, authentication gaps, and incomplete evidence remain separate states.',
+            'SMTP delivery, mailbox existence, catch-all behavior, banner collection, and message acceptance were not tested.',
+        ],
+    };
+}
+function formatCliMailReview(document) {
+    const lines = [
+        'Passive mail exposure review',
+        `Domains          ${document.rows.length}`,
+        `Authenticated    ${document.counts.authenticated_mail}`,
+        `Auth gaps        ${document.counts.mail_auth_gap}`,
+        `Null MX          ${document.counts.null_mx}`,
+        `No explicit MX   ${document.counts.no_explicit_mx}`,
+        `Incomplete       ${document.counts.evidence_incomplete + document.counts.mail_auth_incomplete}`,
+        '',
+    ];
+    for (const row of document.rows) {
+        lines.push(`${row.domain}  ${row.state.replaceAll('_', ' ')}`);
+        lines.push(`  MX providers  ${row.providerDomains.join(', ') || 'None observed'}`);
+        lines.push(`  SPF / DMARC   ${row.hasSpf === null ? 'unknown' : row.hasSpf ? 'observed' : 'not observed'} / ${row.hasDmarc === null ? 'unknown' : row.hasDmarc ? 'observed' : 'not observed'}`);
+    }
+    if (document.providerRelationships.length) {
+        lines.push('', 'Shared mail-provider relationships');
+        for (const relationship of document.providerRelationships) {
+            lines.push(`${relationship.providerDomain}  ${relationship.domains.join(', ')}`);
+        }
+    }
+    lines.push('', 'Limitations:');
+    for (const limitation of document.limitations)
+        lines.push(`  - ${limitation}`);
+    return `${lines.join('\n')}\n`;
+}
+export { buildCliMailReview, formatCliMailReview, mailState, normalizeMailRow };

package/cli/manual.mjs

@@ -0,0 +1,34 @@
+function roffText(value) {
+    return value
+        .replace(/\\/gu, '\\\\')
+        .replace(/-/gu, '\\-')
+        .replace(/^([.'])/gmu, '\\&$1');
+}
+function buildCliManual(options) {
+    const commands = options.commands.map((command) => {
+        const detail = options.details[command];
+        return `.SS ${roffText(command)}\n${roffText(detail.description)}\n.PP\n.B ${roffText(options.usage[command])}\n.PP\nExample: ${roffText(detail.example)}\n.PP\nBoundary: ${roffText(detail.boundary)}`;
+    }).join('\n');
+    return `.TH WHOISLEUTH 1 "" "WHOISleuth ${roffText(options.version)}" "User Commands"
+.SH NAME
+whoisleuth \- source-aware domain investigation from the terminal
+.SH SYNOPSIS
+.B whoisleuth
+command [options]
+.SH DESCRIPTION
+WHOISleuth performs bounded WHOIS, RDAP, DNS, HTTP, TLS, certificate-transparency, posture, lookalike, and offline evidence operations. Evidence sources remain separately attributed, and missing or failed collection is not converted into a claim of absence or safety.
+.SH COMMANDS
+${commands}
+.SH OUTPUT
+Human-readable output is the default. Versioned JSON and JSONL are available where documented. Diagnostics and optional progress events are written to standard error. Use --output with an optional --force flag for atomic private file output.
+.SH EXIT STATUS
+0 indicates command completion, 2 invalid usage, 3 a collection or comparison failure, 4 an explicitly detected partial result, 70 an internal bootstrap failure, and 130 analyst cancellation.
+.SH PRIVACY
+Network commands disclose the target to the directly queried upstream services. Offline commands do not make network requests. Output files are created with private permissions and are never uploaded by the CLI.
+.SH LICENSE
+AGPL-3.0-only. Copyright 2026 slicedearth.
+.SH SEE ALSO
+whoisleuth --help, whoisleuth doctor, whoisleuth completion
+`;
+}
+export { buildCliManual };

package/cli/network-command-runner.mjs

@@ -0,0 +1,88 @@
+import { fetchHomepage } from "../lib/availability.mjs";
+import { searchCertificateTransparency } from "../lib/ct-search.mjs";
+import { checkDomainPosture, normalizeAuditDomain, normalizeDkimSelectors } from "../lib/domain-posture.mjs";
+import { collectTlsIntelligence, normalizeTlsHostname } from "../lib/tls-intelligence.mjs";
+import { CliUsageError } from "./errors.mjs";
+import { buildCliCtSearchDocument, buildCliHttpDocument, buildCliPostureDocument, buildCliTlsDocument, formatJsonDocument, } from "./formatters/json.mjs";
+import { formatTerminalCtSearch, formatTerminalHttp, formatTerminalPosture, formatTerminalTls, } from "./formatters/terminal.mjs";
+import { buildHttpProbeResult } from "./http.mjs";
+import { normalizePostureSelectors } from "./posture.mjs";
+import EXIT_CODES from "./exit-codes.mjs";
+async function runNetworkCommand(args, dependencies, context) {
+    if (args.action === 'ct-search') {
+        const keyword = args.keyword || await context.readSingleInput();
+        if (!keyword)
+            throw new CliUsageError('ct-search requires one keyword as an argument or on stdin.');
+        const search = dependencies.searchCertificateTransparency || searchCertificateTransparency;
+        const result = await context.withProgress('Searching certificate observations', () => search(keyword));
+        const document = buildCliCtSearchDocument(keyword, result, context.now());
+        if (!args.quiet) {
+            context.writeStdout(args.output === 'json'
+                ? formatJsonDocument(document)
+                : context.terminal(formatTerminalCtSearch(document), args.color));
+        }
+        return EXIT_CODES.SUCCESS;
+    }
+    if (args.action === 'posture') {
+        const requestedDomain = args.domain || await context.readSingleInput();
+        if (!requestedDomain)
+            throw new CliUsageError('posture requires one domain as an argument or on stdin.');
+        const normalizeDomain = dependencies.normalizeAuditDomain || normalizeAuditDomain;
+        const domain = normalizeDomain(requestedDomain);
+        if (!domain)
+            throw new CliUsageError('posture requires a valid domain name.');
+        const normalizeSelectors = dependencies.normalizeDkimSelectors || normalizeDkimSelectors;
+        const dkimSelectors = normalizePostureSelectors(args.selectorText, normalizeSelectors);
+        const retiredDkimSelectors = normalizePostureSelectors(args.retiredSelectorText, normalizeSelectors)
+            .filter((selector) => !dkimSelectors.includes(selector))
+            .slice(0, Math.max(0, 10 - dkimSelectors.length));
+        const audit = dependencies.checkDomainPosture || checkDomainPosture;
+        const report = await context.withProgress('Collecting domain posture evidence', () => audit(domain, {
+            dkimSelectors,
+            retiredDkimSelectors,
+            mailProtectionProfile: args.mailProfile,
+        }));
+        const document = buildCliPostureDocument(requestedDomain, report, context.now());
+        if (!args.quiet) {
+            context.writeStdout(args.output === 'json'
+                ? formatJsonDocument(document)
+                : context.terminal(formatTerminalPosture(document), args.color));
+        }
+        return EXIT_CODES.SUCCESS;
+    }
+    if (args.action === 'http') {
+        const requestedDomain = args.domain || await context.readSingleInput();
+        if (!requestedDomain)
+            throw new CliUsageError('http requires one domain as an argument or on stdin.');
+        const normalizeDomain = dependencies.normalizeAuditDomain || normalizeAuditDomain;
+        const domain = normalizeDomain(requestedDomain);
+        if (!domain)
+            throw new CliUsageError('http requires a valid domain name.');
+        const probe = dependencies.fetchHomepage || fetchHomepage;
+        const result = buildHttpProbeResult(domain, await context.withProgress('Inspecting the homepage request', () => probe(domain)));
+        const document = buildCliHttpDocument(requestedDomain, result, context.now());
+        if (!args.quiet) {
+            context.writeStdout(args.output === 'json'
+                ? formatJsonDocument(document)
+                : context.terminal(formatTerminalHttp(document), args.color));
+        }
+        return EXIT_CODES.SUCCESS;
+    }
+    const requestedHostname = args.hostname || await context.readSingleInput();
+    if (!requestedHostname)
+        throw new CliUsageError('tls requires one hostname as an argument or on stdin.');
+    const normalizeHostname = dependencies.normalizeTlsHostname || normalizeTlsHostname;
+    const hostname = normalizeHostname(requestedHostname);
+    if (!hostname)
+        throw new CliUsageError('tls requires a valid DNS hostname, not an IP address.');
+    const collect = dependencies.collectTlsIntelligence || collectTlsIntelligence;
+    const result = await context.withProgress('Inspecting the current TLS connection', () => collect(hostname));
+    const document = buildCliTlsDocument(requestedHostname, result, context.now());
+    if (!args.quiet) {
+        context.writeStdout(args.output === 'json'
+            ? formatJsonDocument(document)
+            : context.terminal(formatTerminalTls(document), args.color));
+    }
+    return EXIT_CODES.SUCCESS;
+}
+export { runNetworkCommand };