@slicedearth/whoisleuth-cli 1.34.0 → 1.36.1

package/README.md

@@ -58,6 +58,8 @@ node bin/whoisleuth.mts discover example.test --dictionary private-terms.txt --s
 node bin/whoisleuth.mts discover-scan example.test --scan-limit 50 --checkpoint candidate-scan.json --json
 node bin/whoisleuth.mts page-compare official.json candidate.json --json
 node bin/whoisleuth.mts mail-review bulk.json --json
+node bin/whoisleuth.mts domain-control domain-control-input.json --json
+node bin/whoisleuth.mts workflow-plan domain-triage example.test --json
 node bin/whoisleuth.mts diff first-lookup.json second-lookup.json --json
 node bin/whoisleuth.mts timeline first-observation.json second-observation.json latest-observation.json --json
 node bin/whoisleuth.mts registry-support example.test --json

package/cli/arguments.mjs

@@ -1,5 +1,6 @@
 import { parseInspectArchiveArguments, parseSignArtifactArguments, parseVerifySignatureArguments, } from "./evidence-command-arguments.mjs";
 import { CliUsageError } from "./errors.mjs";
+import { INVESTIGATION_PLAN_RECIPES, } from "./investigation-plan.mjs";
 const MAX_CLI_ARGUMENTS = 32;
 const MAX_CLI_ARGUMENT_LENGTH = 1024;
 const CLI_COMMANDS = [
@@ -25,6 +26,9 @@ const CLI_COMMANDS = [
     'compare',
     'page-compare',
     'mail-review',
+    'review-evidence',
+    'domain-control',
+    'workflow-plan',
     'diff',
     'timeline',
     'export',
@@ -146,6 +150,12 @@ function parseCliArgumentsCore(argv) {
         return parsePageCompareArguments(argv.slice(1));
     if (command === 'mail-review')
         return parseMailReviewArguments(argv.slice(1));
+    if (command === 'review-evidence')
+        return parseReviewEvidenceArguments(argv.slice(1));
+    if (command === 'domain-control')
+        return parseDomainControlArguments(argv.slice(1));
+    if (command === 'workflow-plan')
+        return parseWorkflowPlanArguments(argv.slice(1));
     if (command === 'diff')
         return parseDiffArguments(argv.slice(1));
     if (command === 'timeline')
@@ -893,6 +903,88 @@ function parseMailReviewArguments(argv) {
         throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
     return { action: 'mail-review', source, output, quiet, color };
 }
+function parseReviewEvidenceArguments(argv) {
+    let source = null;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (const argument of argv) {
+        if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (source === null)
+            source = argument;
+        else
+            throw new CliUsageError('review-evidence accepts one optional versioned JSON input file.');
+    }
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'review-evidence', source, output, quiet, color };
+}
+function parseDomainControlArguments(argv) {
+    let source = null;
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (const argument of argv) {
+        if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else if (source === null)
+            source = argument;
+        else
+            throw new CliUsageError('domain-control accepts one optional versioned JSON input file.');
+    }
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'domain-control', source, output, quiet, color };
+}
+function parseWorkflowPlanArguments(argv) {
+    const positional = [];
+    let output = 'terminal';
+    let quiet = false;
+    let color = true;
+    for (const argument of argv) {
+        if (argument === '--json') {
+            if (output !== 'terminal')
+                throw new CliUsageError('--json may be supplied only once.');
+            output = 'json';
+        }
+        else if (argument === '--quiet')
+            quiet = true;
+        else if (argument === '--no-color')
+            color = false;
+        else if (argument.startsWith('-'))
+            throw new CliUsageError(`Unknown option "${argument}".`);
+        else
+            positional.push(argument);
+    }
+    if (positional.length !== 2)
+        throw new CliUsageError('workflow-plan requires one fixed recipe and one subject.');
+    const recipe = positional[0];
+    if (!INVESTIGATION_PLAN_RECIPES.includes(recipe)) {
+        throw new CliUsageError(`workflow-plan recipe must be one of: ${INVESTIGATION_PLAN_RECIPES.join(', ')}.`);
+    }
+    if (quiet && output !== 'terminal')
+        throw new CliUsageError('--quiet cannot be combined with machine-readable output.');
+    return { action: 'workflow-plan', recipe: recipe, subject: positional[1], output, quiet, color };
+}
 function parseDiffArguments(argv) {
     let leftSource = null;
     let rightSource = null;

package/cli/artifact-verify.mjs

@@ -8,6 +8,7 @@ import { decryptWorkspaceArchive, inspectEncryptedWorkspaceArchive, isEncryptedW
 import { WORKSPACE_ARCHIVE_SCHEMA, readWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive.js";
 import { sha256ArtifactDigest } from "../frontend/src/lib/analysis/artifact-integrity.js";
 import { SAVED_LOOKUP_SCHEMA, SAVED_LOOKUP_SCHEMA_VERSION, parseSavedLookupDocument, } from "./saved-lookup.mjs";
+import { DOMAIN_CONTROL_MANIFEST_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
 export const OFFLINE_ARTIFACT_VERIFICATION_SCHEMA = 'whoisleuth.offline-artifact-verification';
 export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 1;
 export const MAX_OFFLINE_ARTIFACT_BYTES = 15 * 1024 * 1024;
@@ -17,6 +18,7 @@ const SIGNED_ARTIFACT_VERSIONS = Object.freeze({
     [BULK_DOMAIN_COMPARISON_SCHEMA]: new Set([BULK_DOMAIN_COMPARISON_VERSION]),
     [BULK_MAIL_EXPOSURE_SCHEMA]: new Set([BULK_MAIL_EXPOSURE_VERSION]),
     [BULK_REVIEW_MANIFEST_SCHEMA]: new Set([BULK_REVIEW_MANIFEST_VERSION]),
+    [DOMAIN_CONTROL_MANIFEST_SCHEMA]: new Set([DOMAIN_CONTROL_MANIFEST_VERSION]),
 });
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
@@ -94,6 +96,8 @@ async function verifySignedArtifact(raw, value, schema, version) {
     if (await sha256ArtifactDigest(unsigned) !== integrity.digestSha256) {
         throw new TypeError('The signed review artifact failed its SHA-256 integrity check.');
     }
+    if (schema === DOMAIN_CONTROL_MANIFEST_SCHEMA)
+        verifyDomainControlManifest(value);
     return Object.freeze({
         schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
         version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,

package/cli/bulk.mjs

@@ -1,9 +1,8 @@
 import { Buffer } from 'node:buffer';
 import { abortable } from "../lib/abort.mjs";
 import { CliUsageError } from "./arguments.mjs";
+import { MAX_DEEP_BULK_QUERIES, MAX_FAST_BULK_QUERIES, } from "../lib/bulk-limits.mjs";
 const MAX_BULK_INPUT_BYTES = 1024 * 1024;
-const MAX_FAST_BULK_QUERIES = 500;
-const MAX_DEEP_BULK_QUERIES = 50;
 async function readTextStreamBounded(stream, limit = MAX_BULK_INPUT_BYTES) {
     if (!stream || stream.isTTY)
         return '';

package/cli/completion.mjs

@@ -1,4 +1,5 @@
 import { CLI_COMMANDS } from "./arguments.mjs";
+import { INVESTIGATION_PLAN_RECIPES } from "./investigation-plan.mjs";
 const COMMON_OPTIONS = Object.freeze(['--help', '--output', '--force']);
 const OPTIONS_BY_COMMAND = Object.freeze({
     lookup: ['--json', '--markdown', '--html', '--fast', '--deep', '--plan', '--summary', '--verbose', '--strict-exit', '--events', '--quiet', '--no-color'],
@@ -19,6 +20,9 @@ const OPTIONS_BY_COMMAND = Object.freeze({
     compare: ['--json', '--quiet', '--no-color'],
     'page-compare': ['--json', '--quiet', '--no-color'],
     'mail-review': ['--json', '--quiet', '--no-color'],
+    'review-evidence': ['--json', '--quiet', '--no-color'],
+    'domain-control': ['--json', '--quiet', '--no-color'],
+    'workflow-plan': ['--json', '--quiet', '--no-color'],
     diff: ['--json', '--quiet', '--no-color'],
     timeline: ['--json', '--quiet', '--no-color'],
     export: ['--markdown', '--html', '--compact'],
@@ -46,6 +50,9 @@ const COMMAND_DESCRIPTIONS = Object.freeze({
     compare: 'Compare registry publications in one lookup',
     'page-compare': 'Compare saved static page evidence',
     'mail-review': 'Review saved passive mail evidence',
+    'review-evidence': 'Review supplied evidence offline',
+    'domain-control': 'Build or review a domain control manifest',
+    'workflow-plan': 'Plan a fixed investigation recipe',
     diff: 'Compare two saved domain lookups',
     timeline: 'Build same-domain history from saved lookups',
     export: 'Convert a lookup to an evidence report',
@@ -99,6 +106,10 @@ _whoisleuth_completion() {
     COMPREPLY=( $(compgen -W "bash zsh fish powershell" -- "\${current}") )
     return
   fi
+  if [[ "\${command}" == "workflow-plan" && \${COMP_CWORD} -eq 2 ]]; then
+    COMPREPLY=( $(compgen -W "${INVESTIGATION_PLAN_RECIPES.join(' ')}" -- "\${current}") )
+    return
+  fi
   case "\${previous}" in
 ${valueCases}
     ${FILE_OPTIONS.join('|')}) COMPREPLY=( $(compgen -f -- "\${current}") ); return ;;
@@ -132,6 +143,10 @@ _whoisleuth() {
     compadd -- bash zsh fish powershell
     return
   fi
+  if [[ "\${command}" == "workflow-plan" && CURRENT -eq 3 ]]; then
+    compadd -- ${INVESTIGATION_PLAN_RECIPES.join(' ')}
+    return
+  fi
   case "\${previous}" in
 ${valueCases}
     ${FILE_OPTIONS.join('|')}) _files; return ;;
@@ -165,6 +180,7 @@ complete -c whoisleuth -n '__fish_use_subcommand' -l help
 complete -c whoisleuth -n '__fish_use_subcommand' -l version
 ${commandLines.join('\n')}
 complete -c whoisleuth -n '__fish_seen_subcommand_from completion' -a 'bash zsh fish powershell'
+complete -c whoisleuth -n '__fish_seen_subcommand_from workflow-plan' -a '${INVESTIGATION_PLAN_RECIPES.join(' ')}'
 ${optionLines.join('\n')}
 ${valueLines.join('\n')}
 `;
@@ -184,6 +200,7 @@ ${Object.entries(commandOptions).map(([command, options]) => `    '${command}' =
   $values = @{
 ${Object.entries(VALUE_OPTIONS).map(([option, values]) => `    '${option}' = @(${values.map((value) => `'${value}'`).join(', ')})`).join('\n')}
     'completion' = @('bash', 'zsh', 'fish', 'powershell')
+    'workflow-plan' = @(${INVESTIGATION_PLAN_RECIPES.map((value) => `'${value}'`).join(', ')})
   }
   $elements = @($commandAst.CommandElements | ForEach-Object { $_.Extent.Text })
   $command = if ($elements.Count -gt 1) { $elements[1] } else { '' }
@@ -192,6 +209,8 @@ ${Object.entries(VALUE_OPTIONS).map(([option, values]) => `    '${option}' = @($
     @($commands) + @('--help', '--version')
   } elseif ($command -eq 'completion' -and $elements.Count -le 3) {
     $values['completion']
+  } elseif ($command -eq 'workflow-plan' -and $elements.Count -le 3) {
+    $values['workflow-plan']
   } elseif ($values.ContainsKey($previous)) {
     $values[$previous]
   } elseif ($options.ContainsKey($command)) {

package/cli/export-evidence.mjs

@@ -1,5 +1,8 @@
+import { createRequire } from 'node:module';
 import { projectCliLookupComparisonInput } from "./compare.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
+const require = createRequire(import.meta.url);
+const { version: APPLICATION_VERSION } = require('../package.json');
 function objectOrNull(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
@@ -14,7 +17,11 @@ function buildCliEvidenceExport(text, evidenceModule, generatedAt = new Date().t
         throw new TypeError('Lookup evidence export dependency is required.');
     }
     const buildLookupEvidence = dependency.buildLookupEvidence;
-    const result = objectOrNull(buildLookupEvidence(source, { generatedAt, idnAnalysis: null }));
+    const result = objectOrNull(buildLookupEvidence(source, {
+        generatedAt,
+        idnAnalysis: null,
+        applicationVersion: APPLICATION_VERSION,
+    }));
     if (!result
         || result.schema !== dependency.LOOKUP_EVIDENCE_SCHEMA
         || result.schemaVersion !== dependency.LOOKUP_EVIDENCE_SCHEMA_VERSION) {
@@ -25,4 +32,4 @@ function buildCliEvidenceExport(text, evidenceModule, generatedAt = new Date().t
 function formatCliEvidenceExport(document, compact = false) {
     return `${JSON.stringify(document, null, compact ? 0 : 2)}\n`;
 }
-export { buildCliEvidenceExport, formatCliEvidenceExport };
+export { APPLICATION_VERSION, buildCliEvidenceExport, formatCliEvidenceExport };

package/cli/formatters/terminal.mjs

@@ -271,7 +271,6 @@ function formatTerminalRegistrySupport(document) {
         `WHOIS scope    ${supportLabel(whois.queryScope)}`,
         `WHOIS encoding ${supportLabel(whois.encodingProfile)}`,
         `WHOIS parser   ${supportLabel(whois.parserProfile)}`,
-        `Fallback       ${profile.fallbackProfile ? supportLabel(profile.fallbackProfile) : 'None'}`,
         `Fixture states ${fixtures.length ? fixtures.map((value) => supportLabel(value)).join(', ') : 'None documented'}`,
     ];
     for (const file of files)
@@ -302,6 +301,11 @@ function formatTerminalBulk(items, metadata) {
 }
 function formatTerminalCtSearch(document) {
     const matches = Array.isArray(document.matches) ? document.matches : [];
+    const certificateGroups = Array.isArray(document.certificateGroups) ? document.certificateGroups : [];
+    const crossDomainGroups = certificateGroups.filter((value) => {
+        const group = terminalRecord(value);
+        return Array.isArray(group.domains) && group.domains.length > 1;
+    });
     const visible = matches.slice(0, MAX_CT_TERMINAL_MATCHES);
     const observation = terminalRecord(document.observation);
     const lines = [
@@ -310,7 +314,9 @@ function formatTerminalCtSearch(document) {
         `Certificates   ${safeTerminalValue(document.certCount, '0')}`,
         `Observed hosts ${safeTerminalValue(Array.isArray(document.domains) ? document.domains.length : 0, '0')}`,
         `Matches        ${safeTerminalValue(matches.length, '0')}`,
+        `Issuance groups ${safeTerminalValue(certificateGroups.length, '0')} (${safeTerminalValue(crossDomainGroups.length, '0')} cross-domain)`,
         `Truncated      ${document.truncated ? 'Yes' : 'No'}`,
+        `Group cap      ${document.certificateGroupsTruncated ? 'Reached' : 'Not reached'}`,
         '',
     ];
     if (!visible.length) {

package/cli/investigation-plan.mjs

@@ -0,0 +1,112 @@
+import { domainToASCII } from 'node:url';
+export const CLI_INVESTIGATION_PLAN_SCHEMA = 'whoisleuth.cli.investigation-plan';
+export const CLI_INVESTIGATION_PLAN_VERSION = 1;
+export const INVESTIGATION_PLAN_RECIPES = [
+    'domain-triage',
+    'lookalike-review',
+    'owned-domain-review',
+    'historical-comparison',
+];
+const RECIPES = Object.freeze({
+    'domain-triage': Object.freeze({
+        label: 'New domain triage',
+        requiresDomain: true,
+        objective: 'Collect and preserve a source-aware registration, DNS, HTTP, TLS, page, and network-context review.',
+        steps: (domain) => Object.freeze([
+            step('collect', 'Collect a Deep lookup', 'lookup', [domain, '--deep', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.lookup', 'Review source health and limitations before using missing fields.'),
+            step('export', 'Create a portable evidence report', 'export', ['<saved-lookup.json>'], 'offline', 'analyst_selection', 'whoisleuth.lookup-evidence', 'Select the reviewed lookup file; the plan never guesses a path.'),
+            step('verify', 'Verify the exported artifact', 'verify-artifact', ['<evidence.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.offline-artifact-verification', 'Keep verification distinct from a claim that the observations are correct or current.'),
+        ]),
+    }),
+    'lookalike-review': Object.freeze({
+        label: 'Lookalike candidate review',
+        requiresDomain: false,
+        objective: 'Generate a bounded candidate queue, collect only the selected scope, and retain a reviewed candidate lookup.',
+        steps: (subject) => Object.freeze([
+            step('generate', 'Generate candidates offline', 'discover', [subject, '--preset', 'all', '--json'], 'offline', 'none', 'whoisleuth.cli.discover', 'Review mutation families and suppressions before collection.'),
+            step('scan', 'Collect a bounded candidate queue', 'discover-scan', [subject, '--fast', '--scan-limit', '50', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.discovery-scan', 'Fast collection is a triage boundary; partial or inconclusive authority evidence remains explicit.'),
+            step('inspect', 'Deep-review one selected candidate', 'lookup', ['<selected-domain>', '--deep', '--json'], 'network', 'analyst_selection', 'whoisleuth.cli.lookup', 'Select a candidate deliberately; generation does not prove registration, control, intent, or maliciousness.'),
+        ]),
+    }),
+    'owned-domain-review': Object.freeze({
+        label: 'Owned domain posture review',
+        requiresDomain: true,
+        objective: 'Review current passive posture and compare supplied observations with an analyst-authored control manifest.',
+        steps: (domain) => Object.freeze([
+            step('posture', 'Collect bounded DNS posture', 'posture', [domain, '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.posture', 'Review mail profile and delegation evidence before interpreting missing records.'),
+            step('lookup', 'Collect supporting Deep evidence', 'lookup', [domain, '--deep', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.lookup', 'Retain separately attributed registration, DNS, TLS, and page observations.'),
+            step('manifest', 'Review the domain control manifest', 'domain-control', ['<review-input.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.domain-control-review', 'Only complete supplied observations may produce drift.'),
+        ]),
+    }),
+    'historical-comparison': Object.freeze({
+        label: 'Historical observation comparison',
+        requiresDomain: true,
+        objective: 'Collect a current observation and compare it with analyst-selected saved observations without merging source states.',
+        steps: (domain) => Object.freeze([
+            step('current', 'Collect the current lookup', 'lookup', [domain, '--deep', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.lookup', 'A current request does not refresh or validate older provider-reported history.'),
+            step('diff', 'Compare two selected observations', 'diff', ['<previous.json>', '<current.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.cli.lookup-diff', 'Equal, different, conflicting, and unavailable evidence remain separate.'),
+            step('timeline', 'Build a bounded local timeline', 'timeline', ['<oldest.json>', '<newer.json>', '<current.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.cli.lookup-timeline', 'Choose two to twenty same-domain files in chronological scope.'),
+        ]),
+    }),
+});
+function step(id, label, command, args, mode, approval, produces, completion) {
+    return Object.freeze({ id, label, command, arguments: Object.freeze([...args]), mode, approval, produces, completion });
+}
+function boundedSubject(value) {
+    if (typeof value !== 'string' || !value.trim() || value.length > 253 || /[\u0000-\u001f\u007f]/u.test(value)) {
+        throw new TypeError('Investigation-plan subject must be bounded text without control characters.');
+    }
+    return value.replace(/\s+/gu, ' ').trim();
+}
+function normalizedDomain(value) {
+    const candidate = domainToASCII(value.toLowerCase().replace(/\.$/u, ''));
+    if (!candidate || candidate.length > 253 || !candidate.includes('.'))
+        return null;
+    return candidate.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label))
+        ? candidate
+        : null;
+}
+export function buildInvestigationPlan(recipeId, subjectValue, generatedAtValue = new Date().toISOString()) {
+    const recipe = RECIPES[recipeId];
+    if (!recipe)
+        throw new TypeError('Investigation-plan recipe is unsupported.');
+    const suppliedSubject = boundedSubject(subjectValue);
+    const subject = recipe.requiresDomain ? normalizedDomain(suppliedSubject) : suppliedSubject.toLowerCase();
+    if (!subject)
+        throw new TypeError('This investigation-plan recipe requires one valid domain.');
+    const parsedTime = Date.parse(generatedAtValue);
+    if (!Number.isFinite(parsedTime))
+        throw new TypeError('Investigation-plan generation time is invalid.');
+    const steps = recipe.steps(subject);
+    return Object.freeze({
+        schema: CLI_INVESTIGATION_PLAN_SCHEMA,
+        version: CLI_INVESTIGATION_PLAN_VERSION,
+        generatedAt: new Date(parsedTime).toISOString(),
+        recipe: Object.freeze({ id: recipeId, label: recipe.label, objective: recipe.objective }),
+        subject,
+        execution: 'plan_only',
+        steps,
+        limitations: Object.freeze([
+            'This document is a fixed plan. It does not execute commands, expand placeholders, make requests, read files, change cases, or submit reports.',
+            'Network steps require deliberate execution and disclose the selected target to the sources described by that command.',
+            'Analyst-selection steps require reviewed local artifacts; placeholders are never interpreted as file paths by this planner.',
+        ]),
+    });
+}
+export function formatInvestigationPlan(plan) {
+    return [
+        `Investigation plan: ${plan.recipe.label}`,
+        `Subject  ${plan.subject}`,
+        `Mode     ${plan.execution}`,
+        '',
+        ...plan.steps.flatMap((item, index) => [
+            `${index + 1}. ${item.label}`,
+            `   ${item.command} ${item.arguments.join(' ')}`,
+            `   ${item.mode}; approval: ${item.approval.replaceAll('_', ' ')}`,
+            `   ${item.completion}`,
+        ]),
+        '',
+        ...plan.limitations.map((item) => `Limitation: ${item}`),
+        '',
+    ].join('\n');
+}

package/cli/mail-review.mjs

@@ -1,8 +1,9 @@
 import { Buffer } from 'node:buffer';
 import { getDomain } from 'tldts';
+import { analyzeTlsaEvidence } from "../lib/tlsa-evidence.mjs";
 import { CliUsageError } from "./errors.mjs";
 export const CLI_MAIL_REVIEW_SCHEMA = 'whoisleuth.cli.mail-review';
-export const CLI_MAIL_REVIEW_VERSION = 1;
+export const CLI_MAIL_REVIEW_VERSION = 2;
 export const MAX_MAIL_REVIEW_INPUT_BYTES = 16 * 1024 * 1024;
 export const MAX_MAIL_REVIEW_ROWS = 500;
 function record(value) {
@@ -53,6 +54,21 @@ function mailState(input) {
         return 'no_explicit_mx';
     return 'evidence_incomplete';
 }
+function alignMailDaneEvidence(report, hosts) {
+    const aligned = report.service?.transport === 'tcp'
+        && report.service.port === 25
+        && hosts.includes(report.service.hostname);
+    if (aligned || report.state === 'invalid')
+        return report;
+    return Object.freeze({
+        ...report,
+        state: 'invalid',
+        limitations: Object.freeze([
+            ...report.limitations,
+            'The TLSA service name did not identify port 25 on an MX hostname retained for this domain.',
+        ]),
+    });
+}
 function normalizeMailRow(value) {
     const item = record(value);
     if (item.ok !== true)
@@ -70,6 +86,18 @@ function normalizeMailRow(value) {
     const hasSpf = boolean(availability.hasSpf) ?? boolean(summary.hasSpf);
     const hasDmarc = boolean(availability.hasDmarc) ?? boolean(summary.hasDmarc);
     const state = mailState({ dnsStatus, hasMx, hasNullMx, hasSpf, hasDmarc });
+    const tlsaInput = record(item.tlsaEvidence);
+    const dane = Object.keys(tlsaInput).length
+        ? alignMailDaneEvidence(analyzeTlsaEvidence({
+            serviceName: tlsaInput.serviceName,
+            dnssecState: tlsaInput.dnssecState,
+            pkixValidationState: tlsaInput.pkixValidationState,
+            records: tlsaInput.records,
+            certificateDerBase64: tlsaInput.certificateDerBase64,
+            spkiDerBase64: tlsaInput.spkiDerBase64,
+            authorityMaterials: tlsaInput.authorityMaterials,
+        }), hosts)
+        : null;
     return {
         domain,
         state,
@@ -80,9 +108,11 @@ function normalizeMailRow(value) {
         hasDmarc,
         mxHosts: hosts,
         providerDomains: providerDomains(hosts),
+        dane,
         limitations: [
             ...(dnsStatus === 'partial' ? ['DNS evidence was partial.'] : []),
             ...(state === 'no_explicit_mx' ? ['No explicit MX is not equivalent to a null MX or proof that delivery is impossible.'] : []),
+            ...(dane?.state === 'matched' ? [] : dane ? ['Supplied TLSA evidence did not establish one complete DNSSEC-validated match.'] : ['No TLSA evidence was supplied for offline DANE comparison.']),
             'Mail configuration does not establish use, control, intent, safety, or maliciousness.',
         ],
     };
@@ -142,6 +172,17 @@ function buildCliMailReview(textValue, generatedAt = new Date().toISOString()) {
     };
     for (const row of rows)
         counts[row.state] += 1;
+    const daneCounts = {
+        matched: 0,
+        different: 0,
+        partial: 0,
+        untrusted: 0,
+        unavailable: 0,
+        invalid: 0,
+        not_supplied: 0,
+    };
+    for (const row of rows)
+        daneCounts[row.dane?.state ?? 'not_supplied'] += 1;
     const providerMap = new Map();
     for (const row of rows) {
         for (const provider of row.providerDomains) {
@@ -165,11 +206,13 @@ function buildCliMailReview(textValue, generatedAt = new Date().toISOString()) {
         version: CLI_MAIL_REVIEW_VERSION,
         generatedAt,
         counts,
+        daneCounts,
         rows,
         providerRelationships,
         limitations: [
             'This review is passive and uses DNS evidence already retained in a WHOISleuth Bulk result; it makes no network request.',
             'Null MX, no explicit MX, receiving mail, authentication gaps, and incomplete evidence remain separate states.',
+            'Optional TLSA evidence is compared offline. A DANE match requires separately validated DNSSEC evidence from the same observation.',
             'SMTP delivery, mailbox existence, catch-all behavior, banner collection, and message acceptance were not tested.',
         ],
     };
@@ -183,12 +226,14 @@ function formatCliMailReview(document) {
         `Null MX          ${document.counts.null_mx}`,
         `No explicit MX   ${document.counts.no_explicit_mx}`,
         `Incomplete       ${document.counts.evidence_incomplete + document.counts.mail_auth_incomplete}`,
+        `DANE matched     ${document.daneCounts.matched}`,
         '',
     ];
     for (const row of document.rows) {
         lines.push(`${row.domain}  ${row.state.replaceAll('_', ' ')}`);
         lines.push(`  MX providers  ${row.providerDomains.join(', ') || 'None observed'}`);
         lines.push(`  SPF / DMARC   ${row.hasSpf === null ? 'unknown' : row.hasSpf ? 'observed' : 'not observed'} / ${row.hasDmarc === null ? 'unknown' : row.hasDmarc ? 'observed' : 'not observed'}`);
+        lines.push(`  DANE / TLSA   ${row.dane?.state ?? 'not supplied'}`);
     }
     if (document.providerRelationships.length) {
         lines.push('', 'Shared mail-provider relationships');
@@ -201,4 +246,4 @@ function formatCliMailReview(document) {
         lines.push(`  - ${limitation}`);
     return `${lines.join('\n')}\n`;
 }
-export { buildCliMailReview, formatCliMailReview, mailState, normalizeMailRow };
+export { alignMailDaneEvidence, buildCliMailReview, formatCliMailReview, mailState, normalizeMailRow };