@slicedearth/whoisleuth-cli 1.34.0 → 1.39.1

package/cli/artifact-verify.mjs

@@ -8,15 +8,25 @@ import { decryptWorkspaceArchive, inspectEncryptedWorkspaceArchive, isEncryptedW
 import { WORKSPACE_ARCHIVE_SCHEMA, readWorkspaceArchive, } from "../frontend/src/lib/analysis/workspace-archive.js";
 import { sha256ArtifactDigest } from "../frontend/src/lib/analysis/artifact-integrity.js";
 import { SAVED_LOOKUP_SCHEMA, SAVED_LOOKUP_SCHEMA_VERSION, parseSavedLookupDocument, } from "./saved-lookup.mjs";
+import { DOMAIN_CONTROL_MANIFEST_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
+import { INVESTIGATION_CAPSULE_SCHEMA, INVESTIGATION_CAPSULE_VERSION, verifyInvestigationCapsule, } from "../frontend/src/lib/analysis/investigation-capsule.js";
 export const OFFLINE_ARTIFACT_VERIFICATION_SCHEMA = 'whoisleuth.offline-artifact-verification';
 export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 1;
 export const MAX_OFFLINE_ARTIFACT_BYTES = 15 * 1024 * 1024;
 export const MAX_OFFLINE_PASSPHRASE_FILE_BYTES = 1024;
+export class UnsupportedOfflineArtifactError extends TypeError {
+    code = 'unsupported_artifact';
+    constructor(message) {
+        super(message);
+        this.name = 'UnsupportedOfflineArtifactError';
+    }
+}
 const SIGNED_ARTIFACT_VERSIONS = Object.freeze({
     [ACQUISITION_DECISION_PACKET_SCHEMA]: new Set([ACQUISITION_DECISION_PACKET_VERSION]),
     [BULK_DOMAIN_COMPARISON_SCHEMA]: new Set([BULK_DOMAIN_COMPARISON_VERSION]),
     [BULK_MAIL_EXPOSURE_SCHEMA]: new Set([BULK_MAIL_EXPOSURE_VERSION]),
     [BULK_REVIEW_MANIFEST_SCHEMA]: new Set([BULK_REVIEW_MANIFEST_VERSION]),
+    [DOMAIN_CONTROL_MANIFEST_SCHEMA]: new Set([DOMAIN_CONTROL_MANIFEST_VERSION]),
 });
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
@@ -25,7 +35,7 @@ function record(value) {
 }
 function parseJson(raw) {
     if (typeof raw !== 'string')
-        throw new TypeError('Artifact input must be UTF-8 JSON text.');
+        throw new TypeError('Artefact input must be UTF-8 JSON text.');
     const bytes = Buffer.byteLength(raw, 'utf8');
     if (bytes === 0 || bytes > MAX_OFFLINE_ARTIFACT_BYTES) {
         throw new TypeError(`Artifact input must be between 1 byte and ${MAX_OFFLINE_ARTIFACT_BYTES} bytes.`);
@@ -35,18 +45,22 @@ function parseJson(raw) {
         parsed = JSON.parse(raw);
     }
     catch {
-        throw new TypeError('Artifact input is not valid JSON.');
+        throw new TypeError('Artefact input is not valid JSON.');
     }
     const value = record(parsed);
     if (!value)
-        throw new TypeError('Artifact input must contain one JSON object.');
+        throw new TypeError('Artefact input must contain one JSON object.');
     return value;
 }
 function artifactVersion(value) {
-    if (!Number.isSafeInteger(value.version) || Number(value.version) < 1 || Number(value.version) > 1000) {
-        throw new TypeError('Artifact version is missing or invalid.');
+    const declared = value.version ?? value.schemaVersion;
+    if (value.version !== undefined && value.schemaVersion !== undefined && value.version !== value.schemaVersion) {
+        throw new TypeError('Artefact version declarations do not agree.');
+    }
+    if (!Number.isSafeInteger(declared) || Number(declared) < 1 || Number(declared) > 1000) {
+        throw new TypeError('Artefact version is missing or invalid.');
     }
-    return Number(value.version);
+    return Number(declared);
 }
 function inputBytes(raw) {
     return Buffer.byteLength(raw, 'utf8');
@@ -81,19 +95,21 @@ function archiveReport(raw, archive, encrypted, ciphertextBytes) {
 async function verifySignedArtifact(raw, value, schema, version) {
     const supported = SIGNED_ARTIFACT_VERSIONS[schema];
     if (!supported?.has(version)) {
-        throw new TypeError('This signed review-artifact schema or version is not supported.');
+        throw new UnsupportedOfflineArtifactError('This signed review-artifact schema or version is not supported.');
     }
     const integrity = record(value.integrity);
     if (!integrity
         || integrity.algorithm !== 'SHA-256'
         || typeof integrity.digestSha256 !== 'string'
         || !/^sha256:[a-f0-9]{64}$/u.test(integrity.digestSha256)) {
-        throw new TypeError('The signed review artifact has a missing or malformed integrity envelope.');
+        throw new TypeError('The signed review artefact has a missing or malformed integrity envelope.');
     }
     const { integrity: _integrity, ...unsigned } = value;
     if (await sha256ArtifactDigest(unsigned) !== integrity.digestSha256) {
-        throw new TypeError('The signed review artifact failed its SHA-256 integrity check.');
+        throw new TypeError('The signed review artefact failed its SHA-256 integrity check.');
     }
+    if (schema === DOMAIN_CONTROL_MANIFEST_SCHEMA)
+        verifyDomainControlManifest(value);
     return Object.freeze({
         schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
         version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,
@@ -112,7 +128,7 @@ async function verifySignedArtifact(raw, value, schema, version) {
             ciphertextBytes: null,
         }),
         limitations: Object.freeze([
-            'Digest verification detects changes to this exported artifact; it does not authenticate the analyst, collection source, or truth of the retained statements.',
+            'Digest verification detects changes to this exported artefact; it does not authenticate the analyst, collection source, or truth of the retained statements.',
         ]),
     });
 }
@@ -159,7 +175,7 @@ export async function verifyOfflineArtifact(raw, options = {}) {
     }
     if (schema === CASE_RESPONSE_PACKET_SCHEMA) {
         if (version !== CASE_RESPONSE_PACKET_VERSION) {
-            throw new TypeError('This case-response packet version is not supported.');
+            throw new UnsupportedOfflineArtifactError('This case-response packet version is not supported.');
         }
         const integrity = record(value.integrity);
         if (!integrity || !await verifyCaseResponsePacketIntegrity(value)) {
@@ -187,11 +203,41 @@ export async function verifyOfflineArtifact(raw, options = {}) {
             ]),
         });
     }
+    if (schema === INVESTIGATION_CAPSULE_SCHEMA) {
+        if (version !== INVESTIGATION_CAPSULE_VERSION) {
+            throw new UnsupportedOfflineArtifactError('This investigation-capsule version is not supported.');
+        }
+        const verification = await verifyInvestigationCapsule(value);
+        if (!verification.valid)
+            throw new TypeError('The investigation capsule failed its embedded projection integrity checks.');
+        return Object.freeze({
+            schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
+            version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,
+            artifact: Object.freeze({ kind: 'investigation_capsule', schema, version }),
+            state: 'verified',
+            valid: true,
+            checks: Object.freeze({
+                structure: 'verified',
+                contentIntegrity: 'verified',
+                authenticatedEncryption: 'not_applicable',
+            }),
+            summary: Object.freeze({
+                inputBytes: inputBytes(raw),
+                sectionCount: null,
+                recordCount: null,
+                ciphertextBytes: null,
+            }),
+            limitations: Object.freeze([
+                'The embedded brief, graph, and optional analyst-record projections match their declared digests; the linked Lookup evidence is not embedded and must be verified separately.',
+                'Digest verification detects changed content but does not authenticate the analyst, signer, collection source, or truth of retained observations and assertions.',
+            ]),
+        });
+    }
     if (schema === SAVED_LOOKUP_SCHEMA) {
         if (version !== SAVED_LOOKUP_SCHEMA_VERSION) {
-            throw new TypeError('This saved Lookup document version is not supported.');
+            throw new UnsupportedOfflineArtifactError('This saved Lookup document version is not supported.');
         }
-        const document = parseSavedLookupDocument(raw, { label: 'Saved Lookup artifact' });
+        const document = parseSavedLookupDocument(raw, { label: 'Saved Lookup artefact' });
         return Object.freeze({
             schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
             version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,
@@ -218,7 +264,7 @@ export async function verifyOfflineArtifact(raw, options = {}) {
 }
 export function formatOfflineArtifactVerification(report) {
     const lines = [
-        'WHOISleuth offline artifact verification',
+        'WHOISleuth offline artefact verification',
         `Artifact: ${report.artifact.kind} · ${report.artifact.schema} v${report.artifact.version}`,
         `State: ${report.state}`,
         `Structure: ${report.checks.structure}`,

package/cli/bulk.mjs

@@ -1,9 +1,8 @@
 import { Buffer } from 'node:buffer';
 import { abortable } from "../lib/abort.mjs";
 import { CliUsageError } from "./arguments.mjs";
+import { MAX_DEEP_BULK_QUERIES, MAX_FAST_BULK_QUERIES, } from "../lib/bulk-limits.mjs";
 const MAX_BULK_INPUT_BYTES = 1024 * 1024;
-const MAX_FAST_BULK_QUERIES = 500;
-const MAX_DEEP_BULK_QUERIES = 50;
 async function readTextStreamBounded(stream, limit = MAX_BULK_INPUT_BYTES) {
     if (!stream || stream.isTTY)
         return '';

package/cli/compare.mjs

@@ -150,7 +150,7 @@ function projectCliRegistrarPublicationInput(document) {
     }
     const parsed = objectOrNull(registrar?.parsed);
     if (status === 'success' && !parsed) {
-        throw new CliUsageError('Successful registrar RDAP input is missing normalized parsed data.');
+        throw new CliUsageError('Successful registrar RDAP input is missing normalised parsed data.');
     }
     const projected = projectRdapSource(parsed, 'rdap.registrarRdap.parsed');
     delete projected.handle;

package/cli/completion.mjs

@@ -1,7 +1,8 @@
 import { CLI_COMMANDS } from "./arguments.mjs";
+import { INVESTIGATION_PLAN_RECIPES } from "./investigation-plan.mjs";
 const COMMON_OPTIONS = Object.freeze(['--help', '--output', '--force']);
 const OPTIONS_BY_COMMAND = Object.freeze({
-    lookup: ['--json', '--markdown', '--html', '--fast', '--deep', '--plan', '--summary', '--verbose', '--strict-exit', '--events', '--quiet', '--no-color'],
+    lookup: ['--json', '--markdown', '--html', '--fast', '--deep', '--observer', '--vantage', '--plan', '--summary', '--verbose', '--strict-exit', '--events', '--quiet', '--no-color'],
     bulk: ['--json', '--jsonl', '--csv', '--domains', '--queries', '--registered-only', '--inconclusive-only', '--errors-only', '--fast', '--deep', '--concurrency', '--checkpoint', '--resume', '--events', '--quiet', '--no-color'],
     'ct-search': ['--json', '--quiet', '--no-color'],
     discover: ['--tlds', '--preset', '--families', '--keyboard', '--dictionary', '--snapshot', '--json', '--jsonl', '--domains', '--quiet', '--no-color'],
@@ -10,7 +11,9 @@ const OPTIONS_BY_COMMAND = Object.freeze({
     http: ['--json', '--quiet', '--no-color'],
     tls: ['--json', '--quiet', '--no-color'],
     'registry-support': ['--json', '--quiet', '--no-color'],
+    'registry-doctor': ['--json', '--quiet', '--no-color'],
     'risk-calibrate': ['--json', '--quiet', '--no-color'],
+    'lookalike-calibrate': ['--json', '--quiet', '--no-color'],
     'verify-artifact': ['--passphrase-file', '--json', '--quiet', '--no-color'],
     'inspect-archive': ['--passphrase-file', '--search', '--require-match', '--reveal', '--json', '--quiet', '--no-color'],
     'sign-artifact': ['--private-key-file'],
@@ -19,7 +22,13 @@ const OPTIONS_BY_COMMAND = Object.freeze({
     compare: ['--json', '--quiet', '--no-color'],
     'page-compare': ['--json', '--quiet', '--no-color'],
     'mail-review': ['--json', '--quiet', '--no-color'],
+    'review-evidence': ['--mmdb', '--json', '--quiet', '--no-color'],
+    'domain-control': ['--json', '--quiet', '--no-color'],
+    assurance: ['--json', '--quiet', '--no-color'],
+    'sharing-review': ['--marking', '--recipient-scope', '--purpose', '--human-reviewed', '--personal-data-reviewed', '--redactions-confirmed', '--json', '--quiet', '--no-color'],
+    'workflow-plan': ['--json', '--quiet', '--no-color'],
     diff: ['--json', '--quiet', '--no-color'],
+    reconcile: ['--json', '--quiet', '--no-color'],
     timeline: ['--json', '--quiet', '--no-color'],
     export: ['--markdown', '--html', '--compact'],
     completion: [],
@@ -37,16 +46,24 @@ const COMMAND_DESCRIPTIONS = Object.freeze({
     http: 'Inspect one homepage request',
     tls: 'Inspect one TLS connection',
     'registry-support': 'Explain local registry coverage',
+    'registry-doctor': 'Diagnose saved registry collection',
     'risk-calibrate': 'Replay reviewed Risk labels offline',
+    'lookalike-calibrate': 'Summarise reviewed lookalike yield offline',
     'verify-artifact': 'Validate saved evidence offline',
     'inspect-archive': 'Inspect an archive locally',
-    'sign-artifact': 'Sign a reviewed artifact locally',
+    'sign-artifact': 'Sign a reviewed artefact locally',
     'verify-signature': 'Verify a signed evidence package',
     'source-report': 'Build a target-free source report',
     compare: 'Compare registry publications in one lookup',
     'page-compare': 'Compare saved static page evidence',
     'mail-review': 'Review saved passive mail evidence',
+    'review-evidence': 'Review supplied evidence offline',
+    'domain-control': 'Build or review a domain control manifest',
+    assurance: 'Review domain change, recovery, or retirement plans',
+    'sharing-review': 'Lint an artefact before deliberate sharing',
+    'workflow-plan': 'Plan a fixed investigation recipe',
     diff: 'Compare two saved domain lookups',
+    reconcile: 'Reconcile independently labelled observations',
     timeline: 'Build same-domain history from saved lookups',
     export: 'Convert a lookup to an evidence report',
     completion: 'Print shell completion',
@@ -58,6 +75,8 @@ const VALUE_OPTIONS = Object.freeze({
     '--preset': ['common', 'impersonation', 'all'],
     '--keyboard': ['qwerty', 'azerty', 'qwertz', 'all'],
     '--mail-profile': ['standard', 'defensive-no-mail', 'parked'],
+    '--marking': ['clear', 'green', 'amber', 'amber-strict', 'red'],
+    '--recipient-scope': ['public', 'community', 'organization', 'named-recipients'],
     '--concurrency': ['1', '2', '3', '4', '5', '6', '7', '8'],
 });
 const FILE_OPTIONS = Object.freeze([
@@ -74,10 +93,13 @@ const FILE_OPTIONS = Object.freeze([
 const TEXT_OPTIONS = Object.freeze([
     '--families',
     '--resolver',
+    '--purpose',
+    '--observer',
     '--retired-selectors',
     '--search',
     '--selectors',
     '--tlds',
+    '--vantage',
 ]);
 function commandOptions(command) {
     return [...COMMON_OPTIONS, ...(OPTIONS_BY_COMMAND[command] || [])].join(' ');
@@ -99,6 +121,10 @@ _whoisleuth_completion() {
     COMPREPLY=( $(compgen -W "bash zsh fish powershell" -- "\${current}") )
     return
   fi
+  if [[ "\${command}" == "workflow-plan" && \${COMP_CWORD} -eq 2 ]]; then
+    COMPREPLY=( $(compgen -W "${INVESTIGATION_PLAN_RECIPES.join(' ')}" -- "\${current}") )
+    return
+  fi
   case "\${previous}" in
 ${valueCases}
     ${FILE_OPTIONS.join('|')}) COMPREPLY=( $(compgen -f -- "\${current}") ); return ;;
@@ -132,6 +158,10 @@ _whoisleuth() {
     compadd -- bash zsh fish powershell
     return
   fi
+  if [[ "\${command}" == "workflow-plan" && CURRENT -eq 3 ]]; then
+    compadd -- ${INVESTIGATION_PLAN_RECIPES.join(' ')}
+    return
+  fi
   case "\${previous}" in
 ${valueCases}
     ${FILE_OPTIONS.join('|')}) _files; return ;;
@@ -165,6 +195,7 @@ complete -c whoisleuth -n '__fish_use_subcommand' -l help
 complete -c whoisleuth -n '__fish_use_subcommand' -l version
 ${commandLines.join('\n')}
 complete -c whoisleuth -n '__fish_seen_subcommand_from completion' -a 'bash zsh fish powershell'
+complete -c whoisleuth -n '__fish_seen_subcommand_from workflow-plan' -a '${INVESTIGATION_PLAN_RECIPES.join(' ')}'
 ${optionLines.join('\n')}
 ${valueLines.join('\n')}
 `;
@@ -184,6 +215,7 @@ ${Object.entries(commandOptions).map(([command, options]) => `    '${command}' =
   $values = @{
 ${Object.entries(VALUE_OPTIONS).map(([option, values]) => `    '${option}' = @(${values.map((value) => `'${value}'`).join(', ')})`).join('\n')}
     'completion' = @('bash', 'zsh', 'fish', 'powershell')
+    'workflow-plan' = @(${INVESTIGATION_PLAN_RECIPES.map((value) => `'${value}'`).join(', ')})
   }
   $elements = @($commandAst.CommandElements | ForEach-Object { $_.Extent.Text })
   $command = if ($elements.Count -gt 1) { $elements[1] } else { '' }
@@ -192,6 +224,8 @@ ${Object.entries(VALUE_OPTIONS).map(([option, values]) => `    '${option}' = @($
     @($commands) + @('--help', '--version')
   } elseif ($command -eq 'completion' -and $elements.Count -le 3) {
     $values['completion']
+  } elseif ($command -eq 'workflow-plan' -and $elements.Count -le 3) {
+    $values['workflow-plan']
   } elseif ($values.ContainsKey($previous)) {
     $values[$previous]
   } elseif ($options.ContainsKey($command)) {

package/cli/doctor.mjs

@@ -1,6 +1,4 @@
-import { resolvePublicAddresses, safeFetch } from "../lib/safe-fetch.mjs";
 import { withTimeout } from "../lib/abort.mjs";
-import { whoisQuery } from "../lib/whois-transport.mjs";
 const DOCTOR_SCHEMA = 'whoisleuth.cli.doctor';
 const DOCTOR_VERSION = 1;
 const MINIMUM_NODE_MAJOR = 24;
@@ -62,9 +60,17 @@ async function buildDoctorReport(options) {
         }));
     }
     else {
-        const resolve = options.resolveAddresses || resolvePublicAddresses;
-        const fetchHttps = options.fetchHttps || safeFetch;
-        const query = options.queryWhois || whoisQuery;
+        const safeFetchModule = options.resolveAddresses && options.fetchHttps
+            ? null
+            : await import("../lib/safe-fetch.mjs");
+        const whoisModule = options.queryWhois
+            ? null
+            : await import("../lib/whois-transport.mjs");
+        const resolve = options.resolveAddresses || safeFetchModule?.resolvePublicAddresses;
+        const fetchHttps = options.fetchHttps || safeFetchModule?.safeFetch;
+        const query = options.queryWhois || whoisModule?.whoisQuery;
+        if (!resolve || !fetchHttps || !query)
+            throw new TypeError('Network diagnostic dependencies are unavailable.');
         const networkTimeoutMs = Number.isSafeInteger(options.networkTimeoutMs)
             && Number(options.networkTimeoutMs) >= 1
             && Number(options.networkTimeoutMs) <= NETWORK_TIMEOUT_MS

package/cli/evidence-command-arguments.mjs

@@ -92,7 +92,7 @@ export function parseSignArtifactArguments(argv) {
         else if (source === null)
             source = argument;
         else
-            throw new CliUsageError('sign-artifact accepts one optional JSON file. Otherwise pipe one artifact on stdin.');
+            throw new CliUsageError('sign-artifact accepts one optional JSON file. Otherwise pipe one artefact on stdin.');
     }
     if (!privateKeySource)
         throw new CliUsageError('sign-artifact requires --private-key-file.');

package/cli/evidence-command-runner.mjs

@@ -80,9 +80,9 @@ export async function runEvidenceCommand(args, dependencies) {
         return EXIT_CODES.SUCCESS;
     }
     if (args.action === 'sign-artifact') {
-        const input = await readArtifact(args.source, 'Evidence artifact input', dependencies);
+        const input = await readArtifact(args.source, 'Evidence artefact input', dependencies);
         if (!input.trim()) {
-            throw new CliUsageError('sign-artifact requires one reviewed artifact file or an artifact on stdin.');
+            throw new CliUsageError('sign-artifact requires one reviewed artefact file or an artefact on stdin.');
         }
         const privateKey = await readKey(args.privateKeySource, 'Private key file', dependencies.readPrivateKeyFile);
         const signed = await signEvidencePackage(input, privateKey, dependencies.now ? dependencies.now() : new Date().toISOString());

package/cli/evidence-signing.mjs

@@ -100,10 +100,10 @@ function payloadBytes(payload) {
     return Buffer.from(canonicalArtifactJson(payload), 'utf8');
 }
 async function signableArtifact(raw) {
-    const artifact = parseObject(raw, 'Evidence artifact');
+    const artifact = parseObject(raw, 'Evidence artefact');
     const verification = await verifyOfflineArtifact(raw);
-    if (!['case_response_packet', 'signed_review_artifact'].includes(verification.artifact.kind)) {
-        throw new TypeError('Only reviewed response packets and supported review manifests can be signed.');
+    if (!['case_response_packet', 'investigation_capsule', 'signed_review_artifact'].includes(verification.artifact.kind)) {
+        throw new TypeError('Only reviewed response packets, investigation capsules, and supported review manifests can be signed.');
     }
     return { artifact, verification };
 }
@@ -193,7 +193,7 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
             trustedPublicKeyPem
                 ? 'The signature and supplied public key match; recipient trust still depends on obtaining that public key through an authenticated channel.'
                 : 'The signature is internally valid for the embedded public key, but signer identity was not authenticated because no trusted public key was supplied.',
-            'The signature authenticates the canonical sorted-JSON content, not the original whitespace, indentation, or object-key order of the serialized file.',
+            'The signature authenticates the canonical sorted-JSON content, not the original whitespace, indentation, or object-key order of the serialised file.',
             'A valid signature proves the canonical package content has not changed since signing; it does not establish that the retained observations or analyst statements are accurate.',
             'WHOISleuth does not generate, store, recover, rotate, or publish signing keys.',
         ]),

package/cli/export-evidence.mjs

@@ -1,5 +1,8 @@
+import { createRequire } from 'node:module';
 import { projectCliLookupComparisonInput } from "./compare.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
+const require = createRequire(import.meta.url);
+const { version: APPLICATION_VERSION } = require('../package.json');
 function objectOrNull(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
@@ -14,7 +17,11 @@ function buildCliEvidenceExport(text, evidenceModule, generatedAt = new Date().t
         throw new TypeError('Lookup evidence export dependency is required.');
     }
     const buildLookupEvidence = dependency.buildLookupEvidence;
-    const result = objectOrNull(buildLookupEvidence(source, { generatedAt, idnAnalysis: null }));
+    const result = objectOrNull(buildLookupEvidence(source, {
+        generatedAt,
+        idnAnalysis: null,
+        applicationVersion: APPLICATION_VERSION,
+    }));
     if (!result
         || result.schema !== dependency.LOOKUP_EVIDENCE_SCHEMA
         || result.schemaVersion !== dependency.LOOKUP_EVIDENCE_SCHEMA_VERSION) {
@@ -25,4 +32,4 @@ function buildCliEvidenceExport(text, evidenceModule, generatedAt = new Date().t
 function formatCliEvidenceExport(document, compact = false) {
     return `${JSON.stringify(document, null, compact ? 0 : 2)}\n`;
 }
-export { buildCliEvidenceExport, formatCliEvidenceExport };
+export { APPLICATION_VERSION, buildCliEvidenceExport, formatCliEvidenceExport };

package/cli/formatters/html.mjs

@@ -12,7 +12,7 @@ function renderGroups(groups) {
 }
 function renderComparison(comparison) {
     if (!comparison.fields.length)
-        return '<p class="empty">No comparable normalized fields were published.</p>';
+        return '<p class="empty">No comparable normalised fields were published.</p>';
     const rows = comparison.fields.map((field) => `<tr><th scope="row">${escapeHtml(field.label)}</th><td><span class="status">${escapeHtml(field.status)}</span></td><td>${escapeHtml(field.rdap)}</td><td>${escapeHtml(field.whois)}</td></tr>`).join('');
     const omitted = comparison.omitted
         ? `<p class="omission">${escapeHtml(comparison.omitted)} additional comparison fields omitted.</p>`

package/cli/formatters/json.mjs

@@ -17,7 +17,13 @@ const CLI_POSTURE_SCHEMA_VERSION = 1;
 const CLI_HTTP_SCHEMA_VERSION = 1;
 const CLI_TLS_SCHEMA_VERSION = 1;
 const CLI_COMPARE_SCHEMA_VERSION = 3;
-function buildCliLookupDocument(query, classified, result, generatedAt = new Date().toISOString(), mode = 'fast') {
+function buildCliLookupDocument(query, classified, result, generatedAt = new Date().toISOString(), mode = 'fast', collectionContext = {}) {
+    const observerLabel = typeof collectionContext.observerLabel === 'string'
+        ? collectionContext.observerLabel
+        : null;
+    const vantageLabel = typeof collectionContext.vantageLabel === 'string'
+        ? collectionContext.vantageLabel
+        : null;
     return {
         schema: CLI_LOOKUP_SCHEMA,
         version: CLI_LOOKUP_SCHEMA_VERSION,
@@ -28,6 +34,12 @@ function buildCliLookupDocument(query, classified, result, generatedAt = new Dat
         inputHostname: classified.inputHostname,
         registrableDomain: classified.registrableDomain,
         isSubdomain: classified.isSubdomain,
+        ...((observerLabel || vantageLabel) ? {
+            collectionContext: {
+                ...(observerLabel ? { observerLabel } : {}),
+                ...(vantageLabel ? { vantageLabel } : {}),
+            },
+        } : {}),
         ...result,
     };
 }

package/cli/formatters/terminal.mjs

@@ -271,7 +271,6 @@ function formatTerminalRegistrySupport(document) {
         `WHOIS scope    ${supportLabel(whois.queryScope)}`,
         `WHOIS encoding ${supportLabel(whois.encodingProfile)}`,
         `WHOIS parser   ${supportLabel(whois.parserProfile)}`,
-        `Fallback       ${profile.fallbackProfile ? supportLabel(profile.fallbackProfile) : 'None'}`,
         `Fixture states ${fixtures.length ? fixtures.map((value) => supportLabel(value)).join(', ') : 'None documented'}`,
     ];
     for (const file of files)
@@ -302,6 +301,11 @@ function formatTerminalBulk(items, metadata) {
 }
 function formatTerminalCtSearch(document) {
     const matches = Array.isArray(document.matches) ? document.matches : [];
+    const certificateGroups = Array.isArray(document.certificateGroups) ? document.certificateGroups : [];
+    const crossDomainGroups = certificateGroups.filter((value) => {
+        const group = terminalRecord(value);
+        return Array.isArray(group.domains) && group.domains.length > 1;
+    });
     const visible = matches.slice(0, MAX_CT_TERMINAL_MATCHES);
     const observation = terminalRecord(document.observation);
     const lines = [
@@ -310,7 +314,9 @@ function formatTerminalCtSearch(document) {
         `Certificates   ${safeTerminalValue(document.certCount, '0')}`,
         `Observed hosts ${safeTerminalValue(Array.isArray(document.domains) ? document.domains.length : 0, '0')}`,
         `Matches        ${safeTerminalValue(matches.length, '0')}`,
+        `Issuance groups ${safeTerminalValue(certificateGroups.length, '0')} (${safeTerminalValue(crossDomainGroups.length, '0')} cross-domain)`,
         `Truncated      ${document.truncated ? 'Yes' : 'No'}`,
+        `Group cap      ${document.certificateGroupsTruncated ? 'Reached' : 'Not reached'}`,
         '',
     ];
     if (!visible.length) {
@@ -587,7 +593,7 @@ function formatTerminalCompare(document) {
     }
     lines.push('');
     if (!fields.length) {
-        lines.push('Neither source published a comparable normalized field.');
+        lines.push('Neither source published a comparable normalised field.');
     }
     else {
         for (const value of fields) {
@@ -607,7 +613,7 @@ function formatTerminalCompare(document) {
         const publicationDifferences = publicationFields.length - (Number(publicationCounts.equivalent) || 0);
         lines.push('', 'Registry / registrar RDAP publication', `Registry RDAP  ${comparisonStatusLabel(registryHealth.status)}`, `Registrar RDAP ${comparisonStatusLabel(registrarHealth.status)}`, `Compared       ${safeTerminalValue(publicationFields.length, '0')} field${publicationFields.length === 1 ? '' : 's'}`, `Equivalent     ${safeTerminalValue(publicationCounts.equivalent, '0')}`, `Differences    ${safeTerminalValue(publicationDifferences, '0')}`, '');
         if (!publicationFields.length) {
-            lines.push('Neither RDAP publication exposed a comparable normalized field.');
+            lines.push('Neither RDAP publication exposed a comparable normalised field.');
         }
         else {
             for (const value of publicationFields) {
@@ -629,6 +635,7 @@ function formatTerminalRiskCalibration(document) {
     const bands = terminalRecord(summary.scoreBands);
     const thresholds = Array.isArray(document.thresholds) ? document.thresholds : [];
     const records = Array.isArray(document.records) ? document.records : [];
+    const comparison = terminalRecord(document.modelComparison);
     const visible = records.slice(0, MAX_RISK_CALIBRATION_TERMINAL_RECORDS);
     const lines = [
         `Risk model     v${safeTerminalValue(document.riskModelVersion)}`,
@@ -642,7 +649,10 @@ function formatTerminalRiskCalibration(document) {
     ];
     for (const value of thresholds) {
         const threshold = terminalRecord(value);
-        lines.push(`${String(safeTerminalValue(threshold.threshold)).padStart(3)}+  TP ${safeTerminalValue(threshold.truePositive, '0')}  FP ${safeTerminalValue(threshold.falsePositive, '0')}  TN ${safeTerminalValue(threshold.trueNegative, '0')}  FN ${safeTerminalValue(threshold.falseNegative, '0')}  precision ${safeTerminalValue(threshold.precision)}  recall ${safeTerminalValue(threshold.recall)}`);
+        lines.push(`${String(safeTerminalValue(threshold.threshold)).padStart(3)}+  TP ${safeTerminalValue(threshold.truePositive, '0')}  FP ${safeTerminalValue(threshold.falsePositive, '0')}  TN ${safeTerminalValue(threshold.trueNegative, '0')}  FN ${safeTerminalValue(threshold.falseNegative, '0')}  precision ${safeTerminalValue(threshold.precision)}  recall ${safeTerminalValue(threshold.recall)}  F1 ${safeTerminalValue(threshold.f1)}`);
+    }
+    if (comparison.available === true) {
+        lines.push('', `Model comparison  v${safeTerminalValue(comparison.previousModelVersion)} → v${safeTerminalValue(comparison.currentModelVersion)} · ${safeTerminalValue(comparison.scoresChanged, '0')} score changes · ${safeTerminalValue(comparison.thresholdClassificationsChanged, '0')} review-band changes`);
     }
     lines.push('', 'Records');
     for (const value of visible) {

package/cli/investigation-plan.mjs

@@ -0,0 +1,112 @@
+import { domainToASCII } from 'node:url';
+export const CLI_INVESTIGATION_PLAN_SCHEMA = 'whoisleuth.cli.investigation-plan';
+export const CLI_INVESTIGATION_PLAN_VERSION = 1;
+export const INVESTIGATION_PLAN_RECIPES = [
+    'domain-triage',
+    'lookalike-review',
+    'owned-domain-review',
+    'historical-comparison',
+];
+const RECIPES = Object.freeze({
+    'domain-triage': Object.freeze({
+        label: 'New domain triage',
+        requiresDomain: true,
+        objective: 'Collect and preserve a source-aware registration, DNS, HTTP, TLS, page, and network-context review.',
+        steps: (domain) => Object.freeze([
+            step('collect', 'Collect a Deep lookup', 'lookup', [domain, '--deep', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.lookup', 'Review source health and limitations before using missing fields.'),
+            step('export', 'Create a portable evidence report', 'export', ['<saved-lookup.json>'], 'offline', 'analyst_selection', 'whoisleuth.lookup-evidence', 'Select the reviewed lookup file; the plan never guesses a path.'),
+            step('verify', 'Verify the exported artefact', 'verify-artifact', ['<evidence.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.offline-artifact-verification', 'Keep verification distinct from a claim that the observations are correct or current.'),
+        ]),
+    }),
+    'lookalike-review': Object.freeze({
+        label: 'Lookalike candidate review',
+        requiresDomain: false,
+        objective: 'Generate a bounded candidate queue, collect only the selected scope, and retain a reviewed candidate lookup.',
+        steps: (subject) => Object.freeze([
+            step('generate', 'Generate candidates offline', 'discover', [subject, '--preset', 'all', '--json'], 'offline', 'none', 'whoisleuth.cli.discover', 'Review mutation families and suppressions before collection.'),
+            step('scan', 'Collect a bounded candidate queue', 'discover-scan', [subject, '--fast', '--scan-limit', '50', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.discovery-scan', 'Fast collection is a triage boundary; partial or inconclusive authority evidence remains explicit.'),
+            step('inspect', 'Deep-review one selected candidate', 'lookup', ['<selected-domain>', '--deep', '--json'], 'network', 'analyst_selection', 'whoisleuth.cli.lookup', 'Select a candidate deliberately; generation does not prove registration, control, intent, or maliciousness.'),
+        ]),
+    }),
+    'owned-domain-review': Object.freeze({
+        label: 'Owned domain posture review',
+        requiresDomain: true,
+        objective: 'Review current passive posture and compare supplied observations with an analyst-authored control manifest.',
+        steps: (domain) => Object.freeze([
+            step('posture', 'Collect bounded DNS posture', 'posture', [domain, '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.posture', 'Review mail profile and delegation evidence before interpreting missing records.'),
+            step('lookup', 'Collect supporting Deep evidence', 'lookup', [domain, '--deep', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.lookup', 'Retain separately attributed registration, DNS, TLS, and page observations.'),
+            step('manifest', 'Review the domain control manifest', 'domain-control', ['<review-input.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.domain-control-review', 'Only complete supplied observations may produce drift.'),
+        ]),
+    }),
+    'historical-comparison': Object.freeze({
+        label: 'Historical observation comparison',
+        requiresDomain: true,
+        objective: 'Collect a current observation and compare it with analyst-selected saved observations without merging source states.',
+        steps: (domain) => Object.freeze([
+            step('current', 'Collect the current lookup', 'lookup', [domain, '--deep', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.lookup', 'A current request does not refresh or validate older provider-reported history.'),
+            step('diff', 'Compare two selected observations', 'diff', ['<previous.json>', '<current.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.cli.lookup-diff', 'Equal, different, conflicting, and unavailable evidence remain separate.'),
+            step('timeline', 'Build a bounded local timeline', 'timeline', ['<oldest.json>', '<newer.json>', '<current.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.cli.lookup-timeline', 'Choose two to twenty same-domain files in chronological scope.'),
+        ]),
+    }),
+});
+function step(id, label, command, args, mode, approval, produces, completion) {
+    return Object.freeze({ id, label, command, arguments: Object.freeze([...args]), mode, approval, produces, completion });
+}
+function boundedSubject(value) {
+    if (typeof value !== 'string' || !value.trim() || value.length > 253 || /[\u0000-\u001f\u007f]/u.test(value)) {
+        throw new TypeError('Investigation-plan subject must be bounded text without control characters.');
+    }
+    return value.replace(/\s+/gu, ' ').trim();
+}
+function normalizedDomain(value) {
+    const candidate = domainToASCII(value.toLowerCase().replace(/\.$/u, ''));
+    if (!candidate || candidate.length > 253 || !candidate.includes('.'))
+        return null;
+    return candidate.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label))
+        ? candidate
+        : null;
+}
+export function buildInvestigationPlan(recipeId, subjectValue, generatedAtValue = new Date().toISOString()) {
+    const recipe = RECIPES[recipeId];
+    if (!recipe)
+        throw new TypeError('Investigation-plan recipe is unsupported.');
+    const suppliedSubject = boundedSubject(subjectValue);
+    const subject = recipe.requiresDomain ? normalizedDomain(suppliedSubject) : suppliedSubject.toLowerCase();
+    if (!subject)
+        throw new TypeError('This investigation-plan recipe requires one valid domain.');
+    const parsedTime = Date.parse(generatedAtValue);
+    if (!Number.isFinite(parsedTime))
+        throw new TypeError('Investigation-plan generation time is invalid.');
+    const steps = recipe.steps(subject);
+    return Object.freeze({
+        schema: CLI_INVESTIGATION_PLAN_SCHEMA,
+        version: CLI_INVESTIGATION_PLAN_VERSION,
+        generatedAt: new Date(parsedTime).toISOString(),
+        recipe: Object.freeze({ id: recipeId, label: recipe.label, objective: recipe.objective }),
+        subject,
+        execution: 'plan_only',
+        steps,
+        limitations: Object.freeze([
+            'This document is a fixed plan. It does not execute commands, expand placeholders, make requests, read files, change cases, or submit reports.',
+            'Network steps require deliberate execution and disclose the selected target to the sources described by that command.',
+            'Analyst-selection steps require reviewed local artefacts; placeholders are never interpreted as file paths by this planner.',
+        ]),
+    });
+}
+export function formatInvestigationPlan(plan) {
+    return [
+        `Investigation plan: ${plan.recipe.label}`,
+        `Subject  ${plan.subject}`,
+        `Mode     ${plan.execution}`,
+        '',
+        ...plan.steps.flatMap((item, index) => [
+            `${index + 1}. ${item.label}`,
+            `   ${item.command} ${item.arguments.join(' ')}`,
+            `   ${item.mode}; approval: ${item.approval.replaceAll('_', ' ')}`,
+            `   ${item.completion}`,
+        ]),
+        '',
+        ...plan.limitations.map((item) => `Limitation: ${item}`),
+        '',
+    ].join('\n');
+}