@slicedearth/whoisleuth-cli 1.34.0 → 1.39.1

package/cli/runner.mjs

@@ -2,18 +2,13 @@ import { Buffer } from 'node:buffer';
 import { createReadStream } from 'node:fs';
 import { createRequire } from 'node:module';
 import { abortable } from "../lib/abort.mjs";
-import { resolvePublicAddresses, safeFetch } from "../lib/safe-fetch.mjs";
-import { whoisQuery } from "../lib/whois-transport.mjs";
 import { REGISTRY_CAPABILITIES_VERSION, registryCapabilityFor } from "../lib/registry-capabilities.mjs";
-import { explainRiskScore, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../lib/risk-scoring.mjs";
+import { explainRiskScore, explainRiskScoreV6, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../lib/risk-scoring.mjs";
 import { CLI_COMMANDS, parseCliArguments } from "./arguments.mjs";
-import { runBulkCommand } from "./bulk-command-runner.mjs";
 import { buildCliCommandCatalogue, formatCliCommandCatalogue } from "./command-catalogue.mjs";
 import { buildShellCompletion } from "./completion.mjs";
 import { buildDoctorReport, formatDoctorReport } from "./doctor.mjs";
 import { MAX_COMPARE_INPUT_BYTES, compareLookupDocument, parseCliLookupDocument, readCompareInputBounded, } from "./compare.mjs";
-import { runDiscoveryCommand } from "./discovery-command-runner.mjs";
-import { runDiscoveryScanCommand } from "./discovery-scan-command-runner.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import { evidenceCommandFailureLabel, isEvidenceCommand, runEvidenceCommand, } from "./evidence-command-runner.mjs";
 import { buildCliEvidenceExport, formatCliEvidenceExport } from "./export-evidence.mjs";
@@ -23,20 +18,27 @@ import { buildCliCompareDocument, formatJsonDocument, } from "./formatters/json.
 import { formatLookupEvidenceMarkdown } from "./formatters/markdown.mjs";
 import { formatTerminalCompare, formatTerminalRegistrySupport, formatTerminalRiskCalibration, } from "./formatters/terminal.mjs";
 import { buildCliLookupDiff, formatCliLookupDiff } from "./lookup-diff.mjs";
+import { MAX_LOOKUP_RECONCILIATION_INPUT_BYTES, buildCliLookupReconciliation, formatCliLookupReconciliation, } from "./lookup-reconcile.mjs";
+import { MAX_SHARING_REVIEW_BYTES, buildSharingReview, formatSharingReview, } from "./sharing-review.mjs";
 import { MAX_LOOKUP_TIMELINE_INPUT_BYTES, buildCliLookupTimeline, formatCliLookupTimeline, } from "./lookup-timeline.mjs";
 import { buildCliPageComparison, formatCliPageComparison } from "./page-compare.mjs";
 import { MAX_MAIL_REVIEW_INPUT_BYTES, buildCliMailReview, formatCliMailReview, } from "./mail-review.mjs";
-import { runLookupCommand } from "./lookup-command-runner.mjs";
+import { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, } from "./offline-evidence-review.mjs";
+import { DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, buildDomainControlManifest, formatDomainControlResult, reviewDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
+import { MAX_ASSURANCE_INPUT_BYTES, buildDomainAssurance, formatDomainAssurance, } from "../lib/domain-assurance.mjs";
 import { buildCliManual } from "./manual.mjs";
+import { buildInvestigationPlan, formatInvestigationPlan } from "./investigation-plan.mjs";
+import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "../lib/project-metadata.mjs";
 import { createBufferedOutput, writePrivateFile } from "./output-file.mjs";
 import { createTerminalProgress } from "./progress.mjs";
 import { buildRegistrySupportDocument } from "./registry-support.mjs";
+import { buildRegistryDoctorReport, formatRegistryDoctorReport } from "./registry-doctor.mjs";
 import { MAX_OFFLINE_ARTIFACT_BYTES, MAX_OFFLINE_PASSPHRASE_FILE_BYTES, formatOfflineArtifactVerification, verifyOfflineArtifact, } from "./artifact-verify.mjs";
 import { MAX_SOURCE_RELIABILITY_INPUT_BYTES, buildSourceReliabilityReport, formatSourceReliabilityReport, } from "./source-reliability.mjs";
 import { MAX_RISK_CALIBRATION_INPUT_BYTES, buildRiskCalibrationReport, parseRiskCalibrationDataset, readRiskCalibrationInputBounded, } from "./risk-calibration.mjs";
+import { MAX_LOOKALIKE_CALIBRATION_BYTES, buildLookalikeCalibration, formatLookalikeCalibration, } from "./lookalike-calibration.mjs";
 import { MAX_SAVED_LOOKUP_INPUT_BYTES, readSavedLookupInputBounded } from "./saved-lookup.mjs";
 import { presentTerminalOutput, terminalPresentation, } from "./terminal-presentation.mjs";
-import { runNetworkCommand } from "./network-command-runner.mjs";
 const require = createRequire(import.meta.url);
 const { version: VERSION } = require('../package.json');
 const MAX_STDIN_BYTES = 4096;
@@ -60,13 +62,20 @@ Discover:
   discover           Generate offline lookalike candidates.
   discover-scan      Collect a bounded candidate review queue.
   registry-support   Explain local registry coverage without a request.
+  registry-doctor    Diagnose a saved registry collection against local policy.
 
 Review saved evidence:
   source-report      Summarise source reliability without retaining targets.
   compare            Compare saved registry publications.
   page-compare       Compare saved static page and TLS evidence.
   mail-review        Review saved passive mail exposure evidence.
+  review-evidence    Review supplied DNS, routing, GeoIP, or RDAP evidence offline.
+  domain-control     Build or review an integrity-protected desired-state manifest.
+  assurance          Review change, recovery, concentration, or retirement plans.
+  sharing-review     Lint a reviewed artifact before deliberate sharing.
+  workflow-plan      Plan a fixed investigation recipe without executing it.
   diff               Compare two saved domain observations.
+  reconcile          Reconcile independently labelled observations.
   timeline           Compare a sequence of observations for one domain.
   export             Convert a saved lookup into an evidence report.
   inspect-archive    Inspect a workspace archive, redacted by default.
@@ -76,6 +85,7 @@ Integrity and calibration:
   sign-artifact      Sign one reviewed packet or manifest locally.
   verify-signature   Verify one signed evidence package locally.
   risk-calibrate     Replay reviewed labels without changing the model.
+  lookalike-calibrate Summarise reviewed mutation-family yield without tuning generation.
 
 Terminal:
   doctor             Check the local runtime; network tests require --network.
@@ -90,14 +100,14 @@ Diagnostics are written to stderr. Fast lookup is the default; deep collection
 must be requested explicitly and can disclose a target to additional sources.
 
 Copyright 2026 slicedearth. Licensed under AGPL-3.0-only.
-Source and licence: https://github.com/slicedearth/whoisleuth
+Source and licence: ${WHOISLEUTH_SOURCE_REPOSITORY_URL}
 `;
 const COMMAND_USAGE = Object.freeze({
     completion: 'whoisleuth completion <bash|zsh|fish|powershell>',
     doctor: 'whoisleuth doctor [--network] [--json] [--quiet] [--no-color]',
     commands: 'whoisleuth commands [--json] [--quiet] [--no-color]',
     manual: 'whoisleuth manual',
-    lookup: 'whoisleuth lookup <domain|IP|ASN> [--json|--markdown|--html] [--fast|--deep] [--plan] [--summary|--verbose] [--strict-exit] [--events] [--quiet] [--no-color]',
+    lookup: 'whoisleuth lookup <domain|IP|ASN> [--json|--markdown|--html] [--fast|--deep] [--observer <label>] [--vantage <label>] [--plan] [--summary|--verbose] [--strict-exit] [--events] [--quiet] [--no-color]',
     bulk: 'whoisleuth bulk [file] [--json|--jsonl|--csv|--domains|--queries] [--registered-only|--inconclusive-only|--errors-only] [--fast|--deep] [--concurrency <1-8>] [--checkpoint <file> [--resume]] [--events]',
     'ct-search': 'whoisleuth ct-search <keyword> [--json] [--quiet] [--no-color]',
     discover: 'whoisleuth discover <brand|domain> [--tlds <list>] [--preset <name>|--families <ids>] [--keyboard <layout>] [--dictionary <file>] [--snapshot <file>] [--json|--jsonl|--domains]',
@@ -106,7 +116,9 @@ const COMMAND_USAGE = Object.freeze({
     http: 'whoisleuth http <domain> [--json] [--quiet] [--no-color]',
     tls: 'whoisleuth tls <hostname> [--json] [--quiet] [--no-color]',
     'registry-support': 'whoisleuth registry-support <domain|suffix> [--json] [--quiet] [--no-color]',
+    'registry-doctor': 'whoisleuth registry-doctor [lookup.json] [--json] [--quiet] [--no-color]',
     'risk-calibrate': 'whoisleuth risk-calibrate [dataset.json] [--json] [--quiet] [--no-color]',
+    'lookalike-calibrate': 'whoisleuth lookalike-calibrate [dataset.json] [--json] [--quiet] [--no-color]',
     'verify-artifact': 'whoisleuth verify-artifact [artifact.json] [--passphrase-file <file>] [--json] [--quiet] [--no-color]',
     'inspect-archive': 'whoisleuth inspect-archive [archive.json] [--passphrase-file <file>] [--search <value>] [--require-match] [--reveal] [--json]',
     'sign-artifact': 'whoisleuth sign-artifact [artifact.json] --private-key-file <file>',
@@ -115,7 +127,13 @@ const COMMAND_USAGE = Object.freeze({
     compare: 'whoisleuth compare [lookup.json] [--json] [--quiet] [--no-color]',
     'page-compare': 'whoisleuth page-compare <left.json> <right.json> [--json] [--quiet] [--no-color]',
     'mail-review': 'whoisleuth mail-review [bulk.json|bulk.jsonl] [--json] [--quiet] [--no-color]',
+    'review-evidence': 'whoisleuth review-evidence [evidence.json] [--mmdb <database-file>] [--json] [--quiet] [--no-color]',
+    'domain-control': 'whoisleuth domain-control [manifest-input.json|review-input.json] [--json] [--quiet] [--no-color]',
+    assurance: 'whoisleuth assurance [assurance-input.json] [--json] [--quiet] [--no-color]',
+    'sharing-review': 'whoisleuth sharing-review [artifact.json] --marking <level> --recipient-scope <scope> --purpose <text> [--human-reviewed] [--personal-data-reviewed] [--redactions-confirmed] [--json]',
+    'workflow-plan': 'whoisleuth workflow-plan <recipe> <domain|brand> [--json] [--quiet] [--no-color]',
     diff: 'whoisleuth diff <left.json> <right.json> [--json] [--quiet] [--no-color]',
+    reconcile: 'whoisleuth reconcile <observation.json> <observation.json> [...] [--json] [--quiet] [--no-color]',
     timeline: 'whoisleuth timeline <observation.json> <observation.json> [...] [--json] [--quiet] [--no-color]',
     export: 'whoisleuth export [lookup.json] [--markdown|--html|--compact]',
 });
@@ -185,11 +203,21 @@ const COMMAND_DETAILS = Object.freeze({
         example: 'whoisleuth registry-support example.test --json',
         boundary: 'This command is offline. Catalogue coverage does not test live reachability or decide registration or availability.',
     },
+    'registry-doctor': {
+        description: 'Compare a saved Lookup registry result with the reviewed local capability profile.',
+        example: 'whoisleuth registry-doctor lookup.json --json',
+        boundary: 'The command is offline. It distinguishes expected access constraints from collection results and does not contact a live registry.',
+    },
     'risk-calibrate': {
         description: 'Replay reviewed labels against the current explainable Risk model.',
         example: 'whoisleuth risk-calibrate calibration.json --json',
         boundary: 'Calibration is offline and diagnostic. It never trains, tunes, or changes the scoring model automatically.',
     },
+    'lookalike-calibrate': {
+        description: 'Summarise reviewed candidate dispositions by mutation family without retaining domains.',
+        example: 'whoisleuth lookalike-calibrate reviewed-candidates.json --json',
+        boundary: 'Calibration is offline and diagnostic. It omits candidate identifiers, domains, notes, and evidence and never tunes generation or filtering automatically.',
+    },
     'verify-artifact': {
         description: 'Validate a supported archive, packet, manifest, or saved Lookup without printing evidence contents.',
         example: 'whoisleuth verify-artifact workspace.json --json',
@@ -230,11 +258,41 @@ const COMMAND_DETAILS = Object.freeze({
         example: 'whoisleuth mail-review candidates.json --json',
         boundary: 'Review is offline and sends no SMTP traffic. Missing or partial DNS evidence remains inconclusive.',
     },
+    'review-evidence': {
+        description: 'Review one versioned DNSSEC, TLSA, RPKI, GeoIP, encrypted-DNS, or RDAP planning document offline.',
+        example: 'whoisleuth review-evidence dnssec-evidence.json --json',
+        boundary: 'The command reads only the supplied document. It performs no DNS, RDAP, BGP, GeoIP-provider, TLS, HTTP, or SMTP request.',
+    },
+    'domain-control': {
+        description: 'Build an integrity-protected desired-state manifest or compare one with supplied observations.',
+        example: 'whoisleuth domain-control domain-control-input.json --json',
+        boundary: 'The command is offline and changes no registrar, DNS, mail, or certificate configuration. Only complete supplied observations can produce drift.',
+    },
+    assurance: {
+        description: 'Review a versioned domain change, recovery-dependency, or retirement plan.',
+        example: 'whoisleuth assurance domain-assurance.json --json',
+        boundary: 'The command is offline and treats every provider label, readiness state, and evidence reference as analyst-authored input. It changes no configuration.',
+    },
+    'sharing-review': {
+        description: 'Lint one reviewed artefact against local integrity, marking, recipient, personal-data, and redaction controls.',
+        example: 'whoisleuth sharing-review packet.json --marking amber --recipient-scope organization --purpose "Reviewed incident handoff" --human-reviewed --personal-data-reviewed --redactions-confirmed --json',
+        boundary: 'The command is offline and emits only bounded schema/version metadata, no content values, and no raw evidence. Its result is a review aid, not legal advice or recipient authorisation.',
+    },
+    'workflow-plan': {
+        description: 'Build a fixed domain-investigation plan from existing bounded CLI commands.',
+        example: 'whoisleuth workflow-plan domain-triage example.test --json',
+        boundary: 'Planning is offline and plan-only. It does not execute commands, expand placeholders, read files, make requests, or submit evidence.',
+    },
     diff: {
         description: 'Compare bounded evidence retained in two saved domain lookups.',
         example: 'whoisleuth diff first.json second.json --json',
         boundary: 'Comparison is offline. Missing, unavailable, equal, and different evidence remain separate states.',
     },
+    reconcile: {
+        description: 'Reconcile bounded values across independently labelled observations of one domain.',
+        example: 'whoisleuth reconcile office.json mobile.json external.json --json',
+        boundary: 'The command is offline, accepts 2 to 5 saved observations for one domain, and never treats labels as proof of network independence or majority agreement as truth.',
+    },
     timeline: {
         description: 'Build an ordered same-domain history from saved Lookup observations.',
         example: 'whoisleuth timeline first.json second.json latest.json --json',
@@ -260,16 +318,24 @@ const COMMAND_COLLECTION = Object.freeze({
     http: { mode: 'network', scope: 'Accepts one domain and follows only the bounded SSRF-guarded homepage redirect workflow.' },
     tls: { mode: 'network', scope: 'Accepts one public hostname and opens one bounded certificate connection.' },
     'registry-support': { mode: 'offline', scope: 'Reads the embedded registry capability catalogue for one domain or suffix.' },
+    'registry-doctor': { mode: 'offline', scope: 'Reads one saved Lookup and the embedded registry capability catalogue.' },
     'risk-calibrate': { mode: 'offline', scope: 'Reads one bounded reviewed-label dataset and changes no model or evidence.' },
+    'lookalike-calibrate': { mode: 'offline', scope: 'Reads at most 5,000 reviewed candidate labels from one dataset capped at 2 MiB.' },
     'verify-artifact': { mode: 'offline', scope: 'Reads one selected bounded archive, packet, manifest, or saved Lookup document.' },
     'inspect-archive': { mode: 'offline', scope: 'Reads one selected bounded workspace archive with redacted output by default.' },
-    'sign-artifact': { mode: 'offline', scope: 'Reads one selected artifact and one local private key without transmitting either.' },
+    'sign-artifact': { mode: 'offline', scope: 'Reads one selected artefact and one local private key without transmitting either.' },
     'verify-signature': { mode: 'offline', scope: 'Reads one selected signed package and optional local public key.' },
     'source-report': { mode: 'offline', scope: 'Reads bounded saved evidence and emits target-free source reliability data.' },
     compare: { mode: 'offline', scope: 'Reads one saved Lookup and compares its separately attributed registry publications.' },
     'page-compare': { mode: 'offline', scope: 'Reads two saved Lookup documents and executes no page code.' },
     'mail-review': { mode: 'offline', scope: 'Reads one saved Bulk result and sends no DNS or SMTP traffic.' },
+    'review-evidence': { mode: 'offline', scope: 'Reads one bounded versioned evidence or request-planning document and performs no collection.' },
+    'domain-control': { mode: 'offline', scope: 'Reads one bounded desired-state or review document and performs no collection or configuration change.' },
+    assurance: { mode: 'offline', scope: 'Reads one versioned plan capped at 2 MiB and makes no request or configuration change.' },
+    'sharing-review': { mode: 'offline', scope: 'Reads one artefact capped at 15 MiB, emits only bounded schema/version metadata and no content values, and performs no transmission.' },
+    'workflow-plan': { mode: 'offline', scope: 'Builds a fixed typed recipe and executes none of its network or file steps.' },
     diff: { mode: 'offline', scope: 'Reads two saved Lookup documents for different domains.' },
+    reconcile: { mode: 'offline', scope: 'Reads 2 to 5 saved observations for one domain, capped at 32 MiB in total.' },
     timeline: { mode: 'offline', scope: 'Reads 2 to 20 saved observations for one domain, capped at 32 MiB in total.' },
     export: { mode: 'offline', scope: 'Reads one saved Lookup and writes one bounded report.' },
 });
@@ -417,7 +483,7 @@ async function runParsedCli(args, dependencies = {}) {
                 network: args.network,
                 presentation: terminalPresentation(stdout, args.color, environment),
                 ...(dependencies.resolvePublicAddresses ? { resolveAddresses: dependencies.resolvePublicAddresses } : {}),
-                ...(dependencies.safeFetch ? { fetchHttps: dependencies.safeFetch } : { fetchHttps: safeFetch }),
+                ...(dependencies.safeFetch ? { fetchHttps: dependencies.safeFetch } : {}),
                 ...(dependencies.whoisQuery ? { queryWhois: dependencies.whoisQuery } : {}),
             });
             const report = args.network
@@ -447,6 +513,33 @@ async function runParsedCli(args, dependencies = {}) {
                 write(stdout, args.output === 'json' ? formatJsonDocument(document) : terminal(formatTerminalRegistrySupport(document), args.color));
             return EXIT_CODES.SUCCESS;
         }
+        if (args.action === 'registry-doctor') {
+            failureLabel = 'Registry compatibility diagnostic';
+            let input;
+            try {
+                input = dependencies.readCompareInput
+                    ? await dependencies.readCompareInput(args.source)
+                    : await readSavedLookupInputBounded(args.source
+                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
+                        : dependencies.stdin || process.stdin, {
+                        limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
+                        label: 'Registry doctor input',
+                    });
+            }
+            catch (error) {
+                if (error instanceof CliUsageError)
+                    throw error;
+                throw new CliUsageError(`Could not read registry doctor input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+            }
+            if (!input.trim())
+                throw new CliUsageError('registry-doctor requires one saved Lookup JSON file or a document on stdin.');
+            const report = buildRegistryDoctorReport(input, commandContext.now());
+            if (!args.quiet)
+                write(stdout, args.output === 'json'
+                    ? formatJsonDocument(report)
+                    : terminal(formatRegistryDoctorReport(report), args.color));
+            return report.summary.investigate ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+        }
         if (args.action === 'risk-calibrate') {
             failureLabel = 'Risk calibration';
             let input;
@@ -469,13 +562,50 @@ async function runParsedCli(args, dependencies = {}) {
                 generatedAt: dependencies.now ? dependencies.now() : new Date().toISOString(),
                 modelVersion: dependencies.riskModelVersion || RISK_MODEL_VERSION,
                 reviewThreshold: dependencies.riskReviewThreshold || RISK_REVIEW_THRESHOLD,
+                ...(!dependencies.explainRiskScore ? {
+                    previousModelVersion: 6,
+                    explainPreviousRiskScore: explainRiskScoreV6,
+                } : {}),
             });
             if (!args.quiet)
                 write(stdout, args.output === 'json' ? formatJsonDocument(report) : terminal(formatTerminalRiskCalibration(report), args.color));
             return EXIT_CODES.SUCCESS;
         }
+        if (args.action === 'lookalike-calibrate') {
+            failureLabel = 'Lookalike review-yield calibration';
+            let input;
+            try {
+                input = dependencies.readRiskCalibrationInput
+                    ? await dependencies.readRiskCalibrationInput(args.source)
+                    : await readSavedLookupInputBounded(args.source
+                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
+                        : dependencies.stdin || process.stdin, {
+                        limit: MAX_LOOKALIKE_CALIBRATION_BYTES,
+                        label: 'Lookalike calibration input',
+                    });
+            }
+            catch (error) {
+                if (error instanceof CliUsageError)
+                    throw error;
+                throw new CliUsageError(`Could not read lookalike calibration input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+            }
+            if (!input.trim())
+                throw new CliUsageError('lookalike-calibrate requires one dataset JSON file or a document on stdin.');
+            let report;
+            try {
+                report = buildLookalikeCalibration(input, commandContext.now());
+            }
+            catch (error) {
+                throw new CliUsageError(boundedCliErrorMessage(error, 'Lookalike calibration input is invalid'));
+            }
+            if (!args.quiet)
+                write(stdout, args.output === 'json'
+                    ? formatJsonDocument(report)
+                    : terminal(formatLookalikeCalibration(report), args.color));
+            return EXIT_CODES.SUCCESS;
+        }
         if (args.action === 'verify-artifact') {
-            failureLabel = 'Artifact verification';
+            failureLabel = 'Artefact verification';
             let input;
             try {
                 input = dependencies.readArtifactInput
@@ -484,7 +614,7 @@ async function runParsedCli(args, dependencies = {}) {
                         ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
                         : dependencies.stdin || process.stdin, {
                         limit: MAX_OFFLINE_ARTIFACT_BYTES,
-                        label: 'Artifact input',
+                        label: 'Artefact input',
                     });
             }
             catch (error) {
@@ -493,7 +623,7 @@ async function runParsedCli(args, dependencies = {}) {
                 throw new CliUsageError(`Could not read artifact input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
             }
             if (!input.trim())
-                throw new CliUsageError('verify-artifact requires one JSON file or an artifact on stdin.');
+                throw new CliUsageError('verify-artifact requires one JSON file or an artefact on stdin.');
             let passphrase = null;
             if (args.passphraseSource) {
                 let passphraseText;
@@ -644,6 +774,168 @@ async function runParsedCli(args, dependencies = {}) {
                     : terminal(formatCliMailReview(document), args.color));
             return EXIT_CODES.SUCCESS;
         }
+        if (args.action === 'review-evidence') {
+            failureLabel = 'Offline evidence review';
+            let input;
+            try {
+                input = dependencies.readArtifactInput
+                    ? await dependencies.readArtifactInput(args.source)
+                    : await readSavedLookupInputBounded(args.source
+                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
+                        : dependencies.stdin || process.stdin, {
+                        limit: MAX_OFFLINE_EVIDENCE_INPUT_BYTES,
+                        label: 'Offline evidence input',
+                    });
+            }
+            catch (error) {
+                if (error instanceof CliUsageError)
+                    throw error;
+                throw new CliUsageError(`Could not read offline evidence input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+            }
+            if (!input.trim())
+                throw new CliUsageError('review-evidence requires one JSON file or a document on stdin.');
+            const document = args.mmdbSource
+                ? await buildOfflineEvidenceReviewWithLocalResources(input, commandContext.now(), { mmdbPath: args.mmdbSource })
+                : buildOfflineEvidenceReview(input, commandContext.now());
+            if (!args.quiet)
+                write(stdout, args.output === 'json'
+                    ? formatJsonDocument(document)
+                    : terminal(formatOfflineEvidenceReview(document), args.color));
+            return EXIT_CODES.SUCCESS;
+        }
+        if (args.action === 'domain-control') {
+            failureLabel = 'Domain control review';
+            let input;
+            try {
+                input = dependencies.readArtifactInput
+                    ? await dependencies.readArtifactInput(args.source)
+                    : await readSavedLookupInputBounded(args.source
+                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
+                        : dependencies.stdin || process.stdin, {
+                        limit: MAX_OFFLINE_EVIDENCE_INPUT_BYTES,
+                        label: 'Domain control input',
+                    });
+            }
+            catch (error) {
+                if (error instanceof CliUsageError)
+                    throw error;
+                throw new CliUsageError(`Could not read domain control input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+            }
+            if (!input.trim())
+                throw new CliUsageError('domain-control requires one JSON file or a document on stdin.');
+            let parsed;
+            try {
+                parsed = JSON.parse(input);
+            }
+            catch {
+                throw new CliUsageError('Domain control input is not valid JSON.');
+            }
+            const schema = parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+                ? parsed.schema
+                : null;
+            const document = schema === DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA
+                ? buildDomainControlManifest(parsed, commandContext.now())
+                : schema === DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA
+                    ? reviewDomainControlManifest(parsed, commandContext.now())
+                    : null;
+            if (!document) {
+                throw new CliUsageError(`Domain control input must use ${DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA} or ${DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA}.`);
+            }
+            if (!args.quiet)
+                write(stdout, args.output === 'json'
+                    ? formatJsonDocument(document)
+                    : terminal(formatDomainControlResult(document), args.color));
+            return EXIT_CODES.SUCCESS;
+        }
+        if (args.action === 'assurance') {
+            failureLabel = 'Domain assurance review';
+            let input;
+            try {
+                input = dependencies.readArtifactInput
+                    ? await dependencies.readArtifactInput(args.source)
+                    : await readSavedLookupInputBounded(args.source
+                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
+                        : dependencies.stdin || process.stdin, {
+                        limit: MAX_ASSURANCE_INPUT_BYTES,
+                        label: 'Domain assurance input',
+                    });
+            }
+            catch (error) {
+                if (error instanceof CliUsageError)
+                    throw error;
+                throw new CliUsageError(`Could not read domain assurance input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+            }
+            if (!input.trim())
+                throw new CliUsageError('assurance requires one versioned JSON file or a document on stdin.');
+            let parsed;
+            try {
+                parsed = JSON.parse(input);
+            }
+            catch {
+                throw new CliUsageError('Domain assurance input is not valid JSON.');
+            }
+            let document;
+            try {
+                document = buildDomainAssurance(parsed, commandContext.now());
+            }
+            catch (error) {
+                throw new CliUsageError(boundedCliErrorMessage(error, 'Domain assurance input is invalid'));
+            }
+            if (!args.quiet)
+                write(stdout, args.output === 'json'
+                    ? formatJsonDocument(document)
+                    : terminal(formatDomainAssurance(document), args.color));
+            return EXIT_CODES.SUCCESS;
+        }
+        if (args.action === 'sharing-review') {
+            failureLabel = 'Evidence sharing review';
+            let input;
+            try {
+                input = dependencies.readArtifactInput
+                    ? await dependencies.readArtifactInput(args.source)
+                    : await readSavedLookupInputBounded(args.source
+                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
+                        : dependencies.stdin || process.stdin, {
+                        limit: MAX_SHARING_REVIEW_BYTES,
+                        label: 'Sharing review input',
+                    });
+            }
+            catch (error) {
+                if (error instanceof CliUsageError)
+                    throw error;
+                throw new CliUsageError(`Could not read sharing review input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+            }
+            if (!input.trim())
+                throw new CliUsageError('sharing-review requires one artefact JSON file or a document on stdin.');
+            let document;
+            try {
+                document = await buildSharingReview(input, {
+                    marking: args.marking,
+                    recipientScope: args.recipientScope,
+                    purpose: args.purpose,
+                    humanReviewed: args.humanReviewed,
+                    personalDataReviewed: args.personalDataReviewed,
+                    redactionsConfirmed: args.redactionsConfirmed,
+                }, commandContext.now());
+            }
+            catch (error) {
+                throw new CliUsageError(boundedCliErrorMessage(error, 'Sharing review input is invalid'));
+            }
+            if (!args.quiet)
+                write(stdout, args.output === 'json'
+                    ? formatJsonDocument(document)
+                    : terminal(formatSharingReview(document), args.color));
+            return document.summary.status === 'blocked' ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+        }
+        if (args.action === 'workflow-plan') {
+            failureLabel = 'Investigation plan';
+            const document = buildInvestigationPlan(args.recipe, args.subject, commandContext.now());
+            if (!args.quiet)
+                write(stdout, args.output === 'json'
+                    ? formatJsonDocument(document)
+                    : terminal(formatInvestigationPlan(document), args.color));
+            return EXIT_CODES.SUCCESS;
+        }
         if (args.action === 'diff') {
             failureLabel = 'Lookup evidence diff';
             const readDiffInput = dependencies.readDiffInput || (async (source) => (readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), {
@@ -670,6 +962,36 @@ async function runParsedCli(args, dependencies = {}) {
                     : terminal(formatCliLookupDiff(document), args.color));
             return EXIT_CODES.SUCCESS;
         }
+        if (args.action === 'reconcile') {
+            failureLabel = 'Lookup observation reconciliation';
+            const readReconciliationInput = dependencies.readDiffInput || (async (source) => (readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), {
+                limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
+                label: 'Lookup reconciliation input',
+            })));
+            const inputs = [];
+            let totalBytes = 0;
+            try {
+                for (const source of args.sources) {
+                    const input = await readReconciliationInput(source);
+                    totalBytes += Buffer.byteLength(input, 'utf8');
+                    if (totalBytes > MAX_LOOKUP_RECONCILIATION_INPUT_BYTES) {
+                        throw new CliUsageError(`Lookup reconciliation input is limited to ${MAX_LOOKUP_RECONCILIATION_INPUT_BYTES} bytes in total.`);
+                    }
+                    inputs.push(input);
+                }
+            }
+            catch (error) {
+                if (error instanceof CliUsageError)
+                    throw error;
+                throw new CliUsageError(`Could not read Lookup reconciliation input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+            }
+            const document = buildCliLookupReconciliation(inputs, commandContext.now());
+            if (!args.quiet)
+                write(stdout, args.output === 'json'
+                    ? formatJsonDocument(document)
+                    : terminal(formatCliLookupReconciliation(document), args.color));
+            return EXIT_CODES.SUCCESS;
+        }
         if (args.action === 'timeline') {
             failureLabel = 'Lookup observation timeline';
             const readTimelineInput = dependencies.readDiffInput || (async (source) => (readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), {
@@ -734,14 +1056,17 @@ async function runParsedCli(args, dependencies = {}) {
         }
         if (args.action === 'bulk') {
             failureLabel = 'Bulk lookup';
+            const { runBulkCommand } = await import("./bulk-command-runner.mjs");
             return await runBulkCommand(args, dependencies, commandContext);
         }
         if (args.action === 'discover') {
             failureLabel = 'Candidate generation';
+            const { runDiscoveryCommand } = await import("./discovery-command-runner.mjs");
             return await runDiscoveryCommand(args, dependencies, commandContext);
         }
         if (args.action === 'discover-scan') {
             failureLabel = 'Candidate scan';
+            const { runDiscoveryScanCommand } = await import("./discovery-scan-command-runner.mjs");
             return await runDiscoveryScanCommand(args, dependencies, commandContext);
         }
         if (args.action === 'ct-search'
@@ -755,8 +1080,10 @@ async function runParsedCli(args, dependencies = {}) {
                     : args.action === 'http'
                         ? 'HTTP probe'
                         : 'TLS intelligence';
+            const { runNetworkCommand } = await import("./network-command-runner.mjs");
             return await runNetworkCommand(args, dependencies, commandContext);
         }
+        const { runLookupCommand } = await import("./lookup-command-runner.mjs");
         return await runLookupCommand(args, dependencies, commandContext);
     }
     catch (error) {

package/cli/saved-lookup.mjs

@@ -77,10 +77,10 @@ function parseSavedLookupDocument(text, options = {}) {
     const rdapParsed = objectOrNull(rdap?.parsed);
     const whoisParsed = objectOrNull(whois?.parsed);
     if (rdapStatus === 'success' && !rdapParsed) {
-        throw new CliUsageError('Successful RDAP input is missing normalized parsed data.');
+        throw new CliUsageError('Successful RDAP input is missing normalised parsed data.');
     }
     if ((whoisStatus === 'complete' || whoisStatus === 'partial') && !whoisParsed) {
-        throw new CliUsageError('Successful WHOIS input is missing normalized parsed data.');
+        throw new CliUsageError('Successful WHOIS input is missing normalised parsed data.');
     }
     return document;
 }