@slicedearth/whoisleuth-cli 1.32.0

package/LICENSES/Retire.js-Apache-2.0.txt

@@ -0,0 +1,199 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work by You
+      to the Licensor shall be under the terms and conditions of this License,
+      without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify the
+      terms of any separate license agreement you may have executed with
+      Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied,
+      including, without limitation, any warranties or conditions of TITLE,
+      NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
+      You are solely responsible for determining the appropriateness of using
+      or redistributing the Work and assume any risks associated with Your
+      exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be liable
+      to You for damages, including any direct, indirect, special, incidental,
+      or consequential damages of any character arising as a result of this
+      License or out of the use or inability to use the Work (including but not
+      limited to damages for loss of goodwill, work stoppage, computer failure
+      or malfunction, or any and all other commercial damages or losses), even
+      if such Contributor has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer, and charge
+      a fee for, acceptance of support, warranty, indemnity, or other liability
+      obligations and/or rights consistent with this License. However, in
+      accepting such obligations, You may act only on Your own behalf and on
+      Your sole responsibility, not on behalf of any other Contributor, and
+      only if You agree to indemnify, defend, and hold each Contributor
+      harmless for any liability incurred by, or claims asserted against, such
+      Contributor by reason of your accepting any such warranty or additional
+      liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!) The text should be enclosed in the appropriate comment
+      syntax for the file format. We also recommend that a file or class name
+      and description of purpose be included on the same "printed page" as the
+      copyright notice for easier identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,76 @@
+WHOISleuth
+Copyright 2026 slicedearth
+
+This product is licensed under the GNU Affero General Public License,
+version 3 only (AGPL-3.0-only).
+See the LICENSE file for the full license text.
+
+The WHOISleuth name and logo identify the WHOISleuth project and are not
+licensed under the AGPL. See TRADEMARKS.md for permitted uses.
+
+Development-only accessibility tests use @axe-core/playwright and axe-core,
+which are licensed under the Mozilla Public License 2.0. These packages are not
+part of the production runtime.
+
+The generated browser-library catalogue projection is derived from the
+Retire.js browser repository, version 5.4.3, and has been modified by selecting
+and bounding the fields used by WHOISleuth. Retire.js is licensed under the
+Apache License 2.0. See LICENSES/Retire.js-Apache-2.0.txt for the full licence
+text.
+
+The checked-in SSLBL certificate-fingerprint snapshot is derived from the
+SSLBL certificate blacklist published by abuse.ch under CC0. WHOISleuth stores
+only exact SHA-1 fingerprints plus source timestamps and integrity digests. It
+omits listing reasons and performs matching locally. Source:
+https://sslbl.abuse.ch/blacklist/
+
+The checked-in Common-infrastructure snapshot is a bounded projection of
+selected MISP warning-lists. It retains exact CIDR entries, source dates,
+source digests, the pinned upstream commit, and attribution needed to qualify
+shared cloud, delivery, and reviewed public-resolver ranges. MISP
+warning-lists are available under CC0 1.0 Universal or the BSD 2-Clause
+"Simplified" License. Source:
+https://github.com/MISP/misp-warninglists
+
+The exact locked production-dependency inventory and the licence documents
+distributed by those packages are retained in
+frontend/static/third-party-notices.txt. The same file is served by the static
+website at /third-party-notices.txt and is checked for lockfile drift in CI.
+
+The generated Unicode confusable projection is derived from Unicode UTS #39
+data file confusables.txt, Unicode version 17.0.0.
+
+UNICODE LICENSE V3 COPYRIGHT AND PERMISSION NOTICE
+Copyright © 1991-2026 Unicode, Inc.
+
+NOTICE TO USER: Carefully read the following legal agreement. BY DOWNLOADING,
+INSTALLING, COPYING OR OTHERWISE USING DATA FILES, AND/OR SOFTWARE, YOU
+UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE TERMS AND CONDITIONS
+OF THIS AGREEMENT. IF YOU DO NOT AGREE, DO NOT DOWNLOAD, INSTALL, COPY,
+DISTRIBUTE OR USE THE DATA FILES OR SOFTWARE.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+data files and any associated documentation (the "Data Files") or software and
+any associated documentation (the "Software") to deal in the Data Files or
+Software without restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, and/or sell copies of the Data Files
+or Software, and to permit persons to whom the Data Files or Software are
+furnished to do so, provided that either (a) this copyright and permission
+notice appear with all copies of the Data Files or Software, or (b) this
+copyright and permission notice appear in associated Documentation.
+
+THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD
+PARTY RIGHTS.
+
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS NOTICE BE
+LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY
+DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+CONNECTION WITH THE USE OR PERFORMANCE OF THE DATA FILES OR SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder shall not be
+used in advertising or otherwise to promote the sale, use or other dealings in
+these Data Files or Software without prior written authorization of the
+copyright holder.

package/README.md

@@ -0,0 +1,84 @@
+# WHOISleuth CLI
+
+WHOISleuth's command-line interface runs the same bounded WHOIS, RDAP, DNS,
+HTTP, TLS, certificate-transparency, domain-posture, and lookalike analysis
+used by the self-hosted application. Network commands run directly from the
+operator's machine. Offline evidence commands do not contact the hosted site.
+
+## Install
+
+WHOISleuth requires Node.js 24 or later. Run the reviewed public package without
+a global installation:
+
+```bash
+npm exec --yes --package=@slicedearth/whoisleuth-cli -- whoisleuth --help
+```
+
+Or install the `whoisleuth` command globally:
+
+```bash
+npm install --global @slicedearth/whoisleuth-cli
+whoisleuth doctor
+```
+
+The package version follows the application version. Each release is assembled
+from the executable's bounded dependency closure and retains the project
+licence, notices, trademark terms, source location, and provenance metadata.
+
+## Repository checkout
+
+Contributors can run the same source command without installing the package:
+
+```bash
+node bin/whoisleuth.mts --help
+node bin/whoisleuth.mts lookup example.test
+node bin/whoisleuth.mts lookup example.test --deep --summary
+node bin/whoisleuth.mts lookup example.test --deep --markdown --output lookup.md
+node bin/whoisleuth.mts bulk domains.txt --deep --checkpoint bulk-checkpoint.json
+node bin/whoisleuth.mts bulk domains.txt --csv --registered-only
+node bin/whoisleuth.mts discover example.test --dictionary private-terms.txt --snapshot discovery-state.json --json
+node bin/whoisleuth.mts discover-scan example.test --scan-limit 50 --checkpoint candidate-scan.json --json
+node bin/whoisleuth.mts page-compare official.json candidate.json --json
+node bin/whoisleuth.mts mail-review bulk.json --json
+node bin/whoisleuth.mts diff first-lookup.json second-lookup.json --json
+node bin/whoisleuth.mts registry-support example.test --json
+node bin/whoisleuth.mts doctor
+node bin/whoisleuth.mts completion zsh
+node bin/whoisleuth.mts manual | man -l -
+```
+
+Fast lookup is the default. Deep collection must be requested explicitly and
+can disclose the target to additional authoritative or first-party network
+sources. Missing, partial, rate-limited, and unsupported sources remain
+explicit and are never interpreted as evidence of safety or absence.
+
+Interactive output uses restrained semantic colour, width-aware wrapping, and
+stderr-only progress for slower collection. Redirected and machine-readable
+output stays free of ANSI and progress text. Lookup also provides `--summary`
+and `--verbose` terminal views without changing what is collected. `doctor` is
+offline unless `--network` is explicitly supplied, and completion scripts are
+printed without modifying shell configuration. Commands can use atomic private
+`--output` files, Lookup can emit strict automation exits and target-free
+versioned progress events, and Bulk can resume an exact validated compact
+checkpoint. A checkpoint write failure preserves completed output and returns
+the partial-result exit code. Ctrl-C suppresses partial final output and
+returns exit code 130; a second interrupt performs best-effort temporary-file
+cleanup before exiting immediately.
+
+Bulk also supports fixed-column CSV, domain-only output, registered and
+inconclusive output filters, and bounded A, AAAA, NS, and MX summaries. Discover
+supports local custom dictionaries and private snapshot comparison suitable
+for an operator-managed scheduler. The separate networked `discover-scan`
+command can collect a deterministic bounded subset in chunks, retain mutation
+provenance, apply a non-destructive analyst allowlist, group exact shared DNS
+observations, and compare a private component-aware material-change snapshot.
+The full allowlist is not emitted, but matching scanned candidates are labelled
+as suppressed so the review decision remains explainable. Saved Deep
+lookups can be compared across static page, parse5-tokenized DOM structure,
+favicon, technology, and TLS evidence, while saved Bulk output can be reviewed
+for passive MX, null MX, SPF, DMARC, and shared-provider context.
+
+See `docs/cli.md` in the package for the complete command, privacy, output, and
+evidence-contract reference.
+
+Copyright 2026 slicedearth. Licensed under AGPL-3.0-only.

package/TRADEMARKS.md

@@ -0,0 +1,41 @@
+# WHOISleuth trademark policy
+
+The WHOISleuth name and logo identify the WHOISleuth project maintained by
+slicedearth. They are not registered trademarks, and this policy does not
+claim registration.
+
+The GNU Affero General Public License governs the project source code. It does
+not grant permission to use the WHOISleuth name or logo except for reasonable
+and customary uses that describe the origin of the software.
+
+## Uses that do not require permission
+
+You may:
+
+- refer truthfully to WHOISleuth or link to the official project;
+- state that another project is based on, compatible with, or derived from
+  WHOISleuth, provided the statement does not imply endorsement;
+- retain the name and logo in an unmodified copy of WHOISleuth, including the
+  project's existing copyright, source, and licence notices; and
+- use the name in reviews, commentary, education, research, and other uses
+  permitted by applicable law.
+
+## Modified versions and services
+
+A materially modified distribution or hosted service should use a different
+product name and logo. It may describe itself as "based on WHOISleuth" and
+must not imply that it is the official project, is maintained by slicedearth,
+or has been approved or endorsed by the project.
+
+Without prior permission, do not use the WHOISleuth name or logo for a company,
+product, service, domain name, social-media account, or visual identity in a
+way that is likely to cause confusion about origin, sponsorship, or approval.
+
+## Permission and legal rights
+
+Requests for uses not covered above can be made through the project maintainer's
+GitHub profile at <https://github.com/slicedearth>.
+
+This policy does not restrict rights granted by the AGPL or rights available
+under applicable trademark law, including nominative or other legally
+permitted fair use.

package/bin/whoisleuth.mjs

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import { boundedCliErrorMessage } from "../cli/errors.mjs";
+import { cleanupPendingOutputFilesSync } from "../cli/output-file.mjs";
+import { runCli } from "../cli/runner.mjs";
+for (const stream of [process.stdout, process.stderr]) {
+    stream.on('error', (error) => {
+        if (error.code === 'EPIPE')
+            process.exit(0);
+        throw error;
+    });
+}
+const cancellation = new AbortController();
+let interruptionCount = 0;
+const interrupt = () => {
+    interruptionCount += 1;
+    if (interruptionCount === 1)
+        cancellation.abort(new DOMException('Aborted', 'AbortError'));
+    else {
+        cleanupPendingOutputFilesSync();
+        process.exit(130);
+    }
+};
+process.on('SIGINT', interrupt);
+runCli(process.argv.slice(2), { signal: cancellation.signal }).then((code) => {
+    if (code === 130) {
+        process.removeListener('SIGINT', interrupt);
+        process.exit(130);
+    }
+    process.exitCode = code;
+}).catch((error) => {
+    process.stderr.write(`Internal CLI error: ${boundedCliErrorMessage(error)}\n`);
+    process.exitCode = 70;
+}).finally(() => {
+    process.removeListener('SIGINT', interrupt);
+});

package/cli/archive-inspect.mjs

@@ -0,0 +1,198 @@
+import { Buffer } from 'node:buffer';
+import { createHash } from 'node:crypto';
+import { domainToASCII } from 'node:url';
+import { decryptWorkspaceArchive, isEncryptedWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive-crypto.js";
+import { WORKSPACE_ARCHIVE_SCHEMA, readWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive.js";
+import { MAX_OFFLINE_ARTIFACT_BYTES, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+export const ARCHIVE_INSPECTION_SCHEMA = 'whoisleuth.workspace-archive-inspection';
+export const ARCHIVE_INSPECTION_VERSION = 1;
+export const MAX_ARCHIVE_SEARCH_LENGTH = 253;
+export const MAX_ARCHIVE_SEARCH_MATCHES = 100;
+export const MAX_ARCHIVE_SEARCH_NODES = 100_000;
+const SEARCHABLE_FIELDS = new Set([
+    'domain',
+    'hostname',
+    'inputHostname',
+    'query',
+    'registrableDomain',
+    'seed',
+    'target',
+]);
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function parseJson(raw) {
+    if (typeof raw !== 'string')
+        throw new TypeError('Archive input must be UTF-8 JSON text.');
+    const bytes = Buffer.byteLength(raw, 'utf8');
+    if (bytes === 0 || bytes > MAX_OFFLINE_ARTIFACT_BYTES) {
+        throw new TypeError(`Archive input must be between 1 byte and ${MAX_OFFLINE_ARTIFACT_BYTES} bytes.`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new TypeError('Archive input must be valid JSON.');
+    }
+    const value = record(parsed);
+    if (!value)
+        throw new TypeError('Archive input must contain one JSON object.');
+    return value;
+}
+function normalizeSearch(value) {
+    if (value === null || value === undefined || value === '')
+        return null;
+    if (typeof value !== 'string'
+        || value.length > MAX_ARCHIVE_SEARCH_LENGTH
+        || CONTROL_RE.test(value)) {
+        throw new TypeError(`Archive search must be at most ${MAX_ARCHIVE_SEARCH_LENGTH} control-free characters.`);
+    }
+    const normalized = canonicalSearchValue(value);
+    if (!normalized)
+        throw new TypeError('Archive search must not be empty.');
+    return normalized;
+}
+function canonicalSearchValue(value) {
+    const normalized = value.trim().toLowerCase().replace(/\.+$/u, '');
+    if (!normalized)
+        return '';
+    const ascii = domainToASCII(normalized);
+    return ascii || normalized;
+}
+function valueDigest(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+function searchSection(section, value, search, reveal, results, state) {
+    const stack = [{ value, depth: 0 }];
+    while (stack.length && results.length < MAX_ARCHIVE_SEARCH_MATCHES) {
+        const current = stack.pop();
+        if (!current || current.depth > 16)
+            continue;
+        if (state.visited >= MAX_ARCHIVE_SEARCH_NODES) {
+            state.truncated = true;
+            return;
+        }
+        state.visited += 1;
+        const object = record(current.value);
+        if (object) {
+            for (const [field, child] of Object.entries(object).slice(0, 300)) {
+                if (SEARCHABLE_FIELDS.has(field) && typeof child === 'string') {
+                    const normalized = canonicalSearchValue(child);
+                    if (normalized === search) {
+                        results.push(Object.freeze({
+                            section,
+                            field,
+                            valueDigestSha256: valueDigest(normalized),
+                            ...(reveal ? { value: child.slice(0, MAX_ARCHIVE_SEARCH_LENGTH) } : {}),
+                        }));
+                        if (results.length >= MAX_ARCHIVE_SEARCH_MATCHES) {
+                            state.truncated = stack.length > 0;
+                            return;
+                        }
+                    }
+                }
+                if (child && typeof child === 'object')
+                    stack.push({ value: child, depth: current.depth + 1 });
+            }
+        }
+        else if (Array.isArray(current.value)) {
+            for (const child of current.value.slice(0, 5_000)) {
+                if (child && typeof child === 'object')
+                    stack.push({ value: child, depth: current.depth + 1 });
+            }
+        }
+    }
+}
+export async function inspectWorkspaceArchive(raw, options = {}) {
+    const parsed = parseJson(raw);
+    const encrypted = isEncryptedWorkspaceArchive(parsed);
+    if (encrypted && !options.passphrase) {
+        throw new TypeError('Encrypted archive inspection requires a separate passphrase file.');
+    }
+    await verifyOfflineArtifact(raw, options.passphrase === undefined
+        ? {}
+        : { passphrase: options.passphrase });
+    const archiveValue = encrypted
+        ? await decryptWorkspaceArchive(parsed, options.passphrase)
+        : parsed;
+    const archive = await readWorkspaceArchive(archiveValue);
+    const search = normalizeSearch(options.search);
+    const reveal = options.reveal === true;
+    if (reveal && !search)
+        throw new TypeError('--reveal requires --search.');
+    const results = [];
+    const searchState = { visited: 0, truncated: false };
+    if (search) {
+        for (const section of archive.sections) {
+            searchSection(section.id, section.data, search, reveal, results, searchState);
+            if (results.length >= MAX_ARCHIVE_SEARCH_MATCHES || searchState.truncated)
+                break;
+        }
+    }
+    if (options.requireMatch === true && search && results.length === 0) {
+        throw new TypeError('Archive search found no exact canonical match.');
+    }
+    return Object.freeze({
+        schema: ARCHIVE_INSPECTION_SCHEMA,
+        version: ARCHIVE_INSPECTION_VERSION,
+        mode: 'offline_local',
+        archive: Object.freeze({
+            encrypted,
+            schema: WORKSPACE_ARCHIVE_SCHEMA,
+            version: archive.version,
+        }),
+        summary: Object.freeze({
+            inputBytes: Buffer.byteLength(raw, 'utf8'),
+            sectionCount: archive.sections.length,
+            recordCount: archive.sections.reduce((sum, section) => sum + section.recordCount, 0),
+        }),
+        sections: Object.freeze(archive.sections.map((section) => Object.freeze({
+            id: section.id,
+            label: section.label,
+            schema: section.schema,
+            version: section.version,
+            status: section.status,
+            recordCount: section.recordCount,
+            bytes: section.bytes,
+            checksum: section.checksum,
+        }))),
+        search: Object.freeze({
+            requested: search !== null,
+            revealValues: reveal,
+            matchCount: results.length,
+            truncated: searchState.truncated || results.length >= MAX_ARCHIVE_SEARCH_MATCHES,
+            results: Object.freeze(results),
+        }),
+        limitations: Object.freeze([
+            'Inspection validates the archive and reports bounded section metadata without printing retained evidence by default.',
+            'Search checks exact values in a small allowlist of target fields and never searches analyst notes, contacts, or raw evidence.',
+            ...(reveal
+                ? ['Search values were revealed only because the operator supplied --reveal; handle the output as sensitive evidence.']
+                : ['Search results contain field names and digests only. A digest does not authenticate or establish the accuracy of a retained value.']),
+        ]),
+    });
+}
+export function formatArchiveInspection(report) {
+    const lines = [
+        'WHOISleuth workspace archive inspection',
+        `Archive: ${report.archive.encrypted ? 'encrypted' : 'plain'} · v${report.archive.version}`,
+        `Sections: ${report.summary.sectionCount}`,
+        `Records: ${report.summary.recordCount}`,
+    ];
+    for (const section of report.sections) {
+        lines.push(`${section.label}: ${section.recordCount} records · ${section.status} · ${section.bytes} bytes`);
+    }
+    if (report.search.requested) {
+        lines.push(`Search matches: ${report.search.matchCount}${report.search.truncated ? ' (truncated)' : ''}`);
+        for (const match of report.search.results) {
+            lines.push(`${match.section}.${match.field}: ${match.value ?? `sha256:${match.valueDigestSha256}`}`);
+        }
+    }
+    for (const limitation of report.limitations)
+        lines.push(`Limitation: ${limitation}`);
+    return `${lines.join('\n')}\n`;
+}