@slicedearth/whoisleuth-cli 1.36.1 → 1.43.0

package/cli/artifact-verify.mjs

@@ -9,16 +9,29 @@ import { WORKSPACE_ARCHIVE_SCHEMA, readWorkspaceArchive, } from "../frontend/src
 import { sha256ArtifactDigest } from "../frontend/src/lib/analysis/artifact-integrity.js";
 import { SAVED_LOOKUP_SCHEMA, SAVED_LOOKUP_SCHEMA_VERSION, parseSavedLookupDocument, } from "./saved-lookup.mjs";
 import { DOMAIN_CONTROL_MANIFEST_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
+import { DOMAIN_CHANGE_PACKET_SCHEMA, DOMAIN_CHANGE_PACKET_VERSION, } from "../lib/domain-change-packet.mjs";
+import { INVESTIGATION_CAPSULE_SCHEMA, INVESTIGATION_CAPSULE_VERSION, verifyInvestigationCapsule, } from "../frontend/src/lib/analysis/investigation-capsule.js";
+import { INVESTIGATION_MANIFEST_SCHEMA, INVESTIGATION_MANIFEST_VERSION, } from "./investigation-manifest.mjs";
+import { CLI_CASE_PACK_SCHEMA, CLI_CASE_PACK_VERSION, verifyCliCasePack, } from "./case-pack.mjs";
 export const OFFLINE_ARTIFACT_VERIFICATION_SCHEMA = 'whoisleuth.offline-artifact-verification';
 export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 1;
 export const MAX_OFFLINE_ARTIFACT_BYTES = 15 * 1024 * 1024;
 export const MAX_OFFLINE_PASSPHRASE_FILE_BYTES = 1024;
+export class UnsupportedOfflineArtifactError extends TypeError {
+    code = 'unsupported_artifact';
+    constructor(message) {
+        super(message);
+        this.name = 'UnsupportedOfflineArtifactError';
+    }
+}
 const SIGNED_ARTIFACT_VERSIONS = Object.freeze({
     [ACQUISITION_DECISION_PACKET_SCHEMA]: new Set([ACQUISITION_DECISION_PACKET_VERSION]),
     [BULK_DOMAIN_COMPARISON_SCHEMA]: new Set([BULK_DOMAIN_COMPARISON_VERSION]),
     [BULK_MAIL_EXPOSURE_SCHEMA]: new Set([BULK_MAIL_EXPOSURE_VERSION]),
     [BULK_REVIEW_MANIFEST_SCHEMA]: new Set([BULK_REVIEW_MANIFEST_VERSION]),
     [DOMAIN_CONTROL_MANIFEST_SCHEMA]: new Set([DOMAIN_CONTROL_MANIFEST_VERSION]),
+    [DOMAIN_CHANGE_PACKET_SCHEMA]: new Set([DOMAIN_CHANGE_PACKET_VERSION]),
+    [INVESTIGATION_MANIFEST_SCHEMA]: new Set([INVESTIGATION_MANIFEST_VERSION]),
 });
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
@@ -27,7 +40,7 @@ function record(value) {
 }
 function parseJson(raw) {
     if (typeof raw !== 'string')
-        throw new TypeError('Artifact input must be UTF-8 JSON text.');
+        throw new TypeError('Artefact input must be UTF-8 JSON text.');
     const bytes = Buffer.byteLength(raw, 'utf8');
     if (bytes === 0 || bytes > MAX_OFFLINE_ARTIFACT_BYTES) {
         throw new TypeError(`Artifact input must be between 1 byte and ${MAX_OFFLINE_ARTIFACT_BYTES} bytes.`);
@@ -37,18 +50,22 @@ function parseJson(raw) {
         parsed = JSON.parse(raw);
     }
     catch {
-        throw new TypeError('Artifact input is not valid JSON.');
+        throw new TypeError('Artefact input is not valid JSON.');
     }
     const value = record(parsed);
     if (!value)
-        throw new TypeError('Artifact input must contain one JSON object.');
+        throw new TypeError('Artefact input must contain one JSON object.');
     return value;
 }
 function artifactVersion(value) {
-    if (!Number.isSafeInteger(value.version) || Number(value.version) < 1 || Number(value.version) > 1000) {
-        throw new TypeError('Artifact version is missing or invalid.');
+    const declared = value.version ?? value.schemaVersion;
+    if (value.version !== undefined && value.schemaVersion !== undefined && value.version !== value.schemaVersion) {
+        throw new TypeError('Artefact version declarations do not agree.');
+    }
+    if (!Number.isSafeInteger(declared) || Number(declared) < 1 || Number(declared) > 1000) {
+        throw new TypeError('Artefact version is missing or invalid.');
     }
-    return Number(value.version);
+    return Number(declared);
 }
 function inputBytes(raw) {
     return Buffer.byteLength(raw, 'utf8');
@@ -60,7 +77,7 @@ function archiveReport(raw, archive, encrypted, ciphertextBytes) {
         artifact: Object.freeze({
             kind: encrypted ? 'encrypted_workspace_archive' : 'workspace_archive',
             schema: WORKSPACE_ARCHIVE_SCHEMA,
-            version: archive.version,
+            version: archive.sourceVersion,
         }),
         state: 'verified',
         valid: true,
@@ -83,18 +100,18 @@ function archiveReport(raw, archive, encrypted, ciphertextBytes) {
 async function verifySignedArtifact(raw, value, schema, version) {
     const supported = SIGNED_ARTIFACT_VERSIONS[schema];
     if (!supported?.has(version)) {
-        throw new TypeError('This signed review-artifact schema or version is not supported.');
+        throw new UnsupportedOfflineArtifactError('This signed review-artifact schema or version is not supported.');
     }
     const integrity = record(value.integrity);
     if (!integrity
         || integrity.algorithm !== 'SHA-256'
         || typeof integrity.digestSha256 !== 'string'
         || !/^sha256:[a-f0-9]{64}$/u.test(integrity.digestSha256)) {
-        throw new TypeError('The signed review artifact has a missing or malformed integrity envelope.');
+        throw new TypeError('The signed review artefact has a missing or malformed integrity envelope.');
     }
     const { integrity: _integrity, ...unsigned } = value;
     if (await sha256ArtifactDigest(unsigned) !== integrity.digestSha256) {
-        throw new TypeError('The signed review artifact failed its SHA-256 integrity check.');
+        throw new TypeError('The signed review artefact failed its SHA-256 integrity check.');
     }
     if (schema === DOMAIN_CONTROL_MANIFEST_SCHEMA)
         verifyDomainControlManifest(value);
@@ -116,12 +133,41 @@ async function verifySignedArtifact(raw, value, schema, version) {
             ciphertextBytes: null,
         }),
         limitations: Object.freeze([
-            'Digest verification detects changes to this exported artifact; it does not authenticate the analyst, collection source, or truth of the retained statements.',
+            'Digest verification detects changes to this exported artefact; it does not authenticate the analyst, collection source, or truth of the retained statements.',
         ]),
     });
 }
 export async function verifyOfflineArtifact(raw, options = {}) {
     const value = parseJson(raw);
+    const casePackPacket = record(value.packet);
+    if (casePackPacket?.schema === CLI_CASE_PACK_SCHEMA) {
+        const verified = verifyCliCasePack(value);
+        return Object.freeze({
+            schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
+            version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,
+            artifact: Object.freeze({
+                kind: 'cli_case_pack',
+                schema: CLI_CASE_PACK_SCHEMA,
+                version: CLI_CASE_PACK_VERSION,
+            }),
+            state: 'verified',
+            valid: true,
+            checks: Object.freeze({
+                structure: 'verified',
+                contentIntegrity: 'verified',
+                authenticatedEncryption: 'not_applicable',
+            }),
+            summary: Object.freeze({
+                inputBytes: inputBytes(raw),
+                sectionCount: null,
+                recordCount: verified.caseCount,
+                ciphertextBytes: null,
+            }),
+            limitations: Object.freeze([
+                'Case-pack verification detects changes after export and checks the bounded case collection; it does not authenticate the analyst, review decision, source observations, or recipient authorisation.',
+            ]),
+        });
+    }
     if (isEncryptedWorkspaceArchive(value)) {
         const inspected = inspectEncryptedWorkspaceArchive(value);
         if (!options.passphrase) {
@@ -163,7 +209,7 @@ export async function verifyOfflineArtifact(raw, options = {}) {
     }
     if (schema === CASE_RESPONSE_PACKET_SCHEMA) {
         if (version !== CASE_RESPONSE_PACKET_VERSION) {
-            throw new TypeError('This case-response packet version is not supported.');
+            throw new UnsupportedOfflineArtifactError('This case-response packet version is not supported.');
         }
         const integrity = record(value.integrity);
         if (!integrity || !await verifyCaseResponsePacketIntegrity(value)) {
@@ -191,11 +237,41 @@ export async function verifyOfflineArtifact(raw, options = {}) {
             ]),
         });
     }
+    if (schema === INVESTIGATION_CAPSULE_SCHEMA) {
+        if (version !== INVESTIGATION_CAPSULE_VERSION) {
+            throw new UnsupportedOfflineArtifactError('This investigation-capsule version is not supported.');
+        }
+        const verification = await verifyInvestigationCapsule(value);
+        if (!verification.valid)
+            throw new TypeError('The investigation capsule failed its embedded projection integrity checks.');
+        return Object.freeze({
+            schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
+            version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,
+            artifact: Object.freeze({ kind: 'investigation_capsule', schema, version }),
+            state: 'verified',
+            valid: true,
+            checks: Object.freeze({
+                structure: 'verified',
+                contentIntegrity: 'verified',
+                authenticatedEncryption: 'not_applicable',
+            }),
+            summary: Object.freeze({
+                inputBytes: inputBytes(raw),
+                sectionCount: null,
+                recordCount: null,
+                ciphertextBytes: null,
+            }),
+            limitations: Object.freeze([
+                'The embedded brief, graph, and optional analyst-record projections match their declared digests; the linked Lookup evidence is not embedded and must be verified separately.',
+                'Digest verification detects changed content but does not authenticate the analyst, signer, collection source, or truth of retained observations and assertions.',
+            ]),
+        });
+    }
     if (schema === SAVED_LOOKUP_SCHEMA) {
         if (version !== SAVED_LOOKUP_SCHEMA_VERSION) {
-            throw new TypeError('This saved Lookup document version is not supported.');
+            throw new UnsupportedOfflineArtifactError('This saved Lookup document version is not supported.');
         }
-        const document = parseSavedLookupDocument(raw, { label: 'Saved Lookup artifact' });
+        const document = parseSavedLookupDocument(raw, { label: 'Saved Lookup artefact' });
         return Object.freeze({
             schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
             version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,
@@ -222,7 +298,7 @@ export async function verifyOfflineArtifact(raw, options = {}) {
 }
 export function formatOfflineArtifactVerification(report) {
     const lines = [
-        'WHOISleuth offline artifact verification',
+        'WHOISleuth offline artefact verification',
         `Artifact: ${report.artifact.kind} · ${report.artifact.schema} v${report.artifact.version}`,
         `State: ${report.state}`,
         `Structure: ${report.checks.structure}`,

package/cli/bulk-checkpoint.mjs

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { open } from 'node:fs/promises';
+import { recordOrNull } from "../lib/bounded-contract-normalizers.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { writePrivateFile } from "./output-file.mjs";
 export const CLI_BULK_CHECKPOINT_SCHEMA = 'whoisleuth.cli.bulk-checkpoint';
@@ -10,11 +11,6 @@ const MAX_CHECKPOINT_OBJECT_KEYS = 256;
 const MAX_CHECKPOINT_ARRAY_ITEMS = 1_024;
 const MAX_CHECKPOINT_STRING_LENGTH = 32_768;
 const COMPACT_RESULT_KEYS = new Set(['availability', 'diagnostics']);
-function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : null;
-}
 function checkpointDigest(queries, deep) {
     return createHash('sha256')
         .update(deep ? 'deep\n' : 'fast\n')
@@ -37,7 +33,7 @@ function isBoundedCheckpointJson(value, depth = 0) {
         return value.length <= MAX_CHECKPOINT_ARRAY_ITEMS
             && value.every((item) => isBoundedCheckpointJson(item, depth + 1));
     }
-    const object = record(value);
+    const object = recordOrNull(value);
     if (!object)
         return false;
     const entries = Object.entries(object);
@@ -45,18 +41,18 @@ function isBoundedCheckpointJson(value, depth = 0) {
         && entries.every(([key, item]) => key.length <= 128 && isBoundedCheckpointJson(item, depth + 1));
 }
 function normalizeCompactResult(value) {
-    const result = record(value);
+    const result = recordOrNull(value);
     if (!result || !isBoundedCheckpointJson(result))
         return null;
     const keys = Object.keys(result);
     if (keys.length !== COMPACT_RESULT_KEYS.size || keys.some((key) => !COMPACT_RESULT_KEYS.has(key)))
         return null;
-    if (!record(result.availability) || !record(result.diagnostics))
+    if (!recordOrNull(result.availability) || !recordOrNull(result.diagnostics))
         return null;
     return result;
 }
 function normalizeCheckpointResult(value, queries, classifyQuery) {
-    const item = record(value);
+    const item = recordOrNull(value);
     const index = item?.index;
     if (!Number.isSafeInteger(index) || Number(index) < 0 || Number(index) >= queries.length)
         return null;
@@ -72,7 +68,7 @@ function normalizeCheckpointResult(value, queries, classifyQuery) {
     if (item.ok !== true || !result)
         return null;
     const classified = classifyQuery(query);
-    const storedClassified = record(item.classified);
+    const storedClassified = recordOrNull(item.classified);
     if (storedClassified?.type !== classified.type || storedClassified.value !== classified.value)
         return null;
     return { index: Number(index), query, ok: true, classified, result };
@@ -88,7 +84,7 @@ function parseBulkCheckpoint(text, options) {
     catch {
         throw new CliUsageError('Bulk checkpoint must be valid JSON.');
     }
-    const document = record(parsed);
+    const document = recordOrNull(parsed);
     const expectedDigest = checkpointDigest(options.queries, options.deep);
     if (document?.schema !== CLI_BULK_CHECKPOINT_SCHEMA || document.version !== CLI_BULK_CHECKPOINT_VERSION) {
         throw new CliUsageError(`Bulk checkpoint must use ${CLI_BULK_CHECKPOINT_SCHEMA} version ${CLI_BULK_CHECKPOINT_VERSION}.`);

package/cli/bulk-command-runner.mjs

@@ -8,6 +8,9 @@ import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 import { buildCliBulkDocument, formatJsonDocument, formatJsonLines } from "./formatters/json.mjs";
 import { formatTerminalBulk } from "./formatters/terminal.mjs";
+import { buildCollectionPreflight, formatCollectionPreflight } from "./collection-preflight.mjs";
+import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
+import { formatCliJunit } from "./ci-report.mjs";
 import { createCliProgressEvents } from "./progress-events.mjs";
 async function runBulkCommand(args, dependencies, context) {
     const eventProgress = createCliProgressEvents(context.stderr, {
@@ -31,6 +34,14 @@ async function runBulkCommand(args, dependencies, context) {
         throw new CliUsageError(`Could not read bulk input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
     }
     const parsed = parseBulkQueries(input, { deep: args.deep });
+    if (args.plan) {
+        const document = buildCollectionPreflight({
+            command: 'bulk', targetCount: parsed.queries.length, targetLimit: args.deep ? 50 : 500,
+            deep: args.deep, concurrency: args.concurrency, output: args.output, checkpoint: false,
+        });
+        context.writeStdout(args.output === 'json' ? formatJsonDocument(document) : context.terminal(formatCollectionPreflight(document), args.color));
+        return EXIT_CODES.SUCCESS;
+    }
     const classify = dependencies.classifyQuery || classifyQuery;
     const checkpointWriter = dependencies.createBulkCheckpointWriter || createBulkCheckpointWriter;
     const checkpoint = args.checkpoint
@@ -82,9 +93,12 @@ async function runBulkCommand(args, dependencies, context) {
         filter: args.filter,
     };
     const selectedItems = selectBulkItems(items, args.filter);
+    const selectedDocument = buildCliBulkDocument(selectedItems, metadata);
     if (!args.quiet) {
         if (args.output === 'json')
-            context.writeStdout(formatJsonDocument(buildCliBulkDocument(selectedItems, metadata)));
+            context.writeStdout(formatJsonDocument(selectedDocument));
+        else if (args.output === 'junit')
+            context.writeStdout(formatCliJunit(selectedDocument));
         else if (args.output === 'jsonl')
             context.writeStdout(formatJsonLines(selectedItems, metadata));
         else if (args.output === 'csv')
@@ -102,7 +116,10 @@ async function runBulkCommand(args, dependencies, context) {
             context.writeStderr(`Checkpoint warning: ${boundedCliErrorMessage(checkpointFailure, 'Checkpoint could not be written')}. Completed output is still available.\n`);
         }
     }
-    const exitCode = checkpointFailure || items.some((item) => !item.ok)
+    const policyFindings = evaluateCliFailPolicies(buildCliBulkDocument(items, { ...metadata, filter: 'all' }), args.failOn || []);
+    if (policyFindings.length && !eventProgress.enabled)
+        context.writeStderr(formatFailPolicyNotice(policyFindings));
+    const exitCode = checkpointFailure || items.some((item) => !item.ok) || policyFindings.length
         ? EXIT_CODES.PARTIAL_FAILURE
         : EXIT_CODES.SUCCESS;
     eventProgress.emit({ event: 'completed', exitCode });

package/cli/case-pack.mjs

@@ -0,0 +1,136 @@
+import { createHash } from 'node:crypto';
+import { Buffer } from 'node:buffer';
+import { canonicalArtifactJson } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { buildCaseReport } from "../frontend/src/lib/analysis/case-report.js";
+import { CASE_IMPORT_VERSIONS, MAX_CASE_IMPORT_BYTES, CASE_SCHEMA_VERSION, normalizeCaseStore, } from "../frontend/src/lib/analysis/case-model.js";
+import { CliUsageError } from "./errors.mjs";
+export const CLI_CASE_PACK_SCHEMA = 'whoisleuth.cli.case-pack';
+export const CLI_CASE_PACK_VERSION = 1;
+export const MAX_CASE_PACK_INPUT_BYTES = 4 * 1024 * 1024;
+export const MAX_CASE_PACK_CASES = 25;
+function redactedCase(record, audience) {
+    if (audience === 'internal')
+        return structuredClone(record);
+    return {
+        ...structuredClone(record),
+        notes: [],
+        actions: audience === 'public' ? [] : record.actions.map((item) => ({ ...item, recipient: '[redacted]' })),
+        manualTrail: record.manualTrail.map((item) => ({ ...item, target: null })),
+        assertions: audience === 'public' ? [] : structuredClone(record.assertions),
+    };
+}
+export function buildCliCasePack(input, options, generatedAt = new Date().toISOString()) {
+    if (!options.reviewed)
+        throw new CliUsageError('case-pack requires --reviewed after the audience-specific output has been checked.');
+    if (Buffer.byteLength(input, 'utf8') > MAX_CASE_PACK_INPUT_BYTES)
+        throw new CliUsageError('Case-pack input is limited to 4 MiB.');
+    let parsed;
+    try {
+        parsed = JSON.parse(input.replace(/^\uFEFF/u, ''));
+    }
+    catch {
+        throw new CliUsageError('Case-pack input must be valid JSON.');
+    }
+    const root = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    if (typeof root.version !== 'number' || !CASE_IMPORT_VERSIONS.includes(root.version) || !Array.isArray(root.cases)) {
+        throw new CliUsageError(`Case-pack input must be a supported WHOISleuth case export through schema ${CASE_SCHEMA_VERSION}.`);
+    }
+    const normalised = normalizeCaseStore(root).cases;
+    if (!normalised.length)
+        throw new CliUsageError('Case-pack input did not contain a valid case.');
+    if (normalised.length !== root.cases.length) {
+        throw new CliUsageError('Case-pack input contains an invalid or duplicate case. Correct the browser export before packaging it.');
+    }
+    if (normalised.length > MAX_CASE_PACK_CASES) {
+        throw new CliUsageError(`Case packs are limited to ${MAX_CASE_PACK_CASES} reviewed cases. Export a smaller selected set so no case is silently omitted.`);
+    }
+    const cases = normalised.map((item) => redactedCase(item, options.audience));
+    const reports = cases.map((item) => buildCaseReport(item, { includeNotes: false, generatedAt }).json);
+    const exclusions = options.audience === 'internal'
+        ? ['Raw upstream payloads and credentials are outside the case schema.']
+        : options.audience === 'trusted'
+            ? ['Case notes', 'Recipient values', 'Manual trail targets', 'Raw upstream payloads and credentials']
+            : ['Case notes', 'Actions and recipient values', 'Analyst assertions', 'Manual trail targets', 'Raw upstream payloads and credentials'];
+    const packet = Object.freeze({
+        schema: CLI_CASE_PACK_SCHEMA,
+        version: CLI_CASE_PACK_VERSION,
+        audience: options.audience,
+        reviewed: true,
+        reports: Object.freeze(reports),
+        redactionManifest: Object.freeze({ excluded: Object.freeze(exclusions), sourceCaseCount: normalised.length }),
+        limitations: Object.freeze([
+            'This local package is browser-importable through its top-level case collection and does not upload or submit evidence.',
+            'The reviewed flag records a deliberate CLI choice; it does not prove recipient authorisation, factual correctness, or legal sufficiency.',
+            'Importing the package does not restore fields excluded by its audience profile.',
+        ]),
+    });
+    const unsigned = { version: CASE_SCHEMA_VERSION, exportedAt: generatedAt, cases, packet };
+    const document = Object.freeze({
+        ...unsigned,
+        integrity: Object.freeze({
+            algorithm: 'SHA-256',
+            canonicalization: 'sorted-json-v1',
+            digestSha256: `sha256:${createHash('sha256').update(canonicalArtifactJson(unsigned)).digest('hex')}`,
+        }),
+    });
+    if (Buffer.byteLength(JSON.stringify(document), 'utf8') > MAX_CASE_IMPORT_BYTES) {
+        throw new CliUsageError('The generated case pack exceeds the browser 2 MiB import limit. Select fewer cases or a more restrictive audience so no evidence is silently omitted.');
+    }
+    return document;
+}
+export function verifyCliCasePack(input) {
+    const root = input && typeof input === 'object' && !Array.isArray(input)
+        ? input
+        : null;
+    const packet = root?.packet && typeof root.packet === 'object' && !Array.isArray(root.packet)
+        ? root.packet
+        : null;
+    const integrity = root?.integrity && typeof root.integrity === 'object' && !Array.isArray(root.integrity)
+        ? root.integrity
+        : null;
+    if (!root
+        || !packet
+        || packet.schema !== CLI_CASE_PACK_SCHEMA
+        || packet.version !== CLI_CASE_PACK_VERSION
+        || packet.reviewed !== true
+        || !['internal', 'public', 'trusted'].includes(String(packet.audience))
+        || !Array.isArray(packet.reports)
+        || !Array.isArray(root.cases)
+        || root.cases.length < 1
+        || root.cases.length > MAX_CASE_PACK_CASES
+        || packet.reports.length !== root.cases.length
+        || typeof root.version !== 'number'
+        || !CASE_IMPORT_VERSIONS.includes(root.version)
+        || !integrity
+        || integrity.algorithm !== 'SHA-256'
+        || integrity.canonicalization !== 'sorted-json-v1'
+        || typeof integrity.digestSha256 !== 'string'
+        || !/^sha256:[a-f0-9]{64}$/u.test(integrity.digestSha256)) {
+        throw new TypeError('The CLI case pack structure or integrity envelope is invalid.');
+    }
+    if (Buffer.byteLength(JSON.stringify(root), 'utf8') > MAX_CASE_IMPORT_BYTES) {
+        throw new TypeError('The CLI case pack exceeds the browser import limit.');
+    }
+    const { integrity: _integrity, ...unsigned } = root;
+    const calculated = `sha256:${createHash('sha256').update(canonicalArtifactJson(unsigned)).digest('hex')}`;
+    if (calculated !== integrity.digestSha256) {
+        throw new TypeError('The CLI case pack failed its SHA-256 integrity check.');
+    }
+    const normalised = normalizeCaseStore(root).cases;
+    if (normalised.length !== root.cases.length) {
+        throw new TypeError('The CLI case pack contains an invalid case collection.');
+    }
+    return Object.freeze({ caseCount: normalised.length });
+}
+export function formatCliCasePack(document) {
+    return [
+        'Reviewed case pack',
+        `Audience   ${document.packet.audience}`,
+        `Cases      ${document.cases.length}`,
+        `Reports    ${document.packet.reports.length}`,
+        `Digest     ${document.integrity.digestSha256}`,
+        '',
+        ...document.packet.redactionManifest.excluded.map((item) => `Excluded: ${item}`),
+        '',
+    ].join('\n');
+}

package/cli/ci-report.mjs

@@ -0,0 +1,73 @@
+import { WHOISLEUTH_REQUEST_POLICY_URL } from "../lib/project-metadata.mjs";
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function xml(value) {
+    return String(value).replace(/&/gu, '&amp;').replace(/</gu, '&lt;').replace(/>/gu, '&gt;').replace(/"/gu, '&quot;').replace(/'/gu, '&apos;');
+}
+function junitCases(document) {
+    const schema = String(document.schema || '');
+    if (schema === 'whoisleuth.cli.lookup') {
+        const diagnostics = record(document.diagnostics);
+        const cases = Object.entries(diagnostics).slice(0, 64).map(([source, value]) => {
+            const state = String(record(value).status ?? record(value).state ?? 'unavailable').toLowerCase();
+            return ['error', 'failed', 'partial', 'rate_limited', 'timeout', 'unavailable'].includes(state)
+                ? { name: `source ${source}`, failure: `Source state: ${state}` }
+                : { name: `source ${source}` };
+        });
+        return cases.length ? cases : [{ name: 'lookup diagnostics', failure: 'No source diagnostics were available.' }];
+    }
+    if (schema === 'whoisleuth.cli.bulk') {
+        const summary = record(document.summary);
+        const failed = Number(summary.failed ?? 0);
+        const results = Array.isArray(document.results) ? document.results.map(record) : [];
+        const inconclusive = results.filter((item) => ['unknown', 'inconclusive', 'partial', 'unavailable'].includes(String(record(item.availability).state || '').toLowerCase())).length;
+        return [
+            failed ? { name: 'collection failures', failure: `${failed} target collection(s) failed.` } : { name: 'collection failures' },
+            inconclusive ? { name: 'authority conclusions', failure: `${inconclusive} target state(s) remained inconclusive.` } : { name: 'authority conclusions' },
+        ];
+    }
+    if (schema === 'whoisleuth.cli.domain-control-monitor') {
+        const collection = record(document.collection);
+        const summary = record(record(document.flightRecorder).summary);
+        const failed = Number(collection.failed ?? 0);
+        const drift = Number(summary.unexpectedChanges ?? 0);
+        return [
+            failed ? { name: 'domain control collection', failure: `${failed} owned-domain collection(s) failed.` } : { name: 'domain control collection' },
+            drift ? { name: 'unexpected domain control changes', failure: `${drift} complete observation change(s) require review.` } : { name: 'unexpected domain control changes' },
+        ];
+    }
+    return [{ name: 'WHOISleuth result', failure: 'Unsupported document for JUnit conversion.' }];
+}
+export function formatCliJunit(document) {
+    const cases = junitCases(record(document));
+    const failures = cases.filter((item) => item.failure).length;
+    return `<?xml version="1.0" encoding="UTF-8"?>\n<testsuite name="WHOISleuth" tests="${cases.length}" failures="${failures}">\n${cases.map((item) => `  <testcase classname="whoisleuth" name="${xml(item.name)}">${item.failure ? `<failure message="${xml(item.failure)}" />` : ''}</testcase>`).join('\n')}\n</testsuite>\n`;
+}
+export function buildPostureSarif(document) {
+    const root = record(document);
+    const checks = Array.isArray(root.checks) ? root.checks.map(record).slice(0, 64) : [];
+    const actionable = checks.filter((item) => ['warning', 'danger'].includes(String(item.status).toLowerCase()));
+    const rules = actionable.map((item) => ({
+        id: `WHOISLEUTH-${String(item.id || 'posture').replace(/[^a-z0-9_-]/giu, '-').slice(0, 64)}`,
+        shortDescription: { text: String(item.label || 'Domain posture finding').slice(0, 200) },
+        help: { text: String(item.remediation || item.detail || 'Review this owned-domain posture finding.').slice(0, 1000) },
+    }));
+    return Object.freeze({
+        version: '2.1.0',
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        runs: [Object.freeze({
+                tool: { driver: { name: 'WHOISleuth', informationUri: WHOISLEUTH_REQUEST_POLICY_URL, rules } },
+                results: actionable.map((item) => ({
+                    ruleId: `WHOISLEUTH-${String(item.id || 'posture').replace(/[^a-z0-9_-]/giu, '-').slice(0, 64)}`,
+                    level: String(item.status).toLowerCase() === 'danger' ? 'error' : 'warning',
+                    message: { text: `${String(item.summary || item.label || 'Posture finding').slice(0, 500)}${item.remediation ? ` Next: ${String(item.remediation).slice(0, 500)}` : ''}` },
+                })),
+                properties: {
+                    ownedDomainConfirmed: true,
+                    generatedAt: typeof root.generatedAt === 'string' ? root.generatedAt : null,
+                    evidenceBoundary: 'Passive owned-domain DNS posture; raw records and contact data omitted from SARIF.',
+                },
+            })],
+    });
+}

package/cli/collection-preflight.mjs

@@ -0,0 +1,59 @@
+export const CLI_COLLECTION_PREFLIGHT_SCHEMA = 'whoisleuth.cli.collection-preflight';
+export const CLI_COLLECTION_PREFLIGHT_VERSION = 1;
+export function buildCollectionPreflight(options) {
+    const sourceFamilies = options.deep
+        ? ['RDAP', 'WHOIS', 'DNS', 'HTTP and static page identity', 'TLS', 'network allocation and routing context', 'configured optional threat sources']
+        : ['RDAP', 'conditional DNS authority evidence'];
+    return Object.freeze({
+        schema: CLI_COLLECTION_PREFLIGHT_SCHEMA,
+        version: CLI_COLLECTION_PREFLIGHT_VERSION,
+        command: options.command,
+        mode: options.deep ? 'deep' : 'fast',
+        networkRequestsMade: false,
+        scope: Object.freeze({
+            selectedTargets: options.targetCount,
+            commandTargetLimit: options.targetLimit,
+            concurrency: options.concurrency,
+            sourceFamilies: Object.freeze(sourceFamilies),
+            exactRequestCountKnown: false,
+            requestBoundary: 'Collector-specific timeouts, response limits, referrals, redirects, retries, registry policy and provider quotas remain enforced independently.',
+        }),
+        disclosure: Object.freeze([
+            'Targets are sent only to the source families required by the selected mode and permitted by registry/provider policy.',
+            ...(options.customResolvers ? ['Selected public DNS resolvers receive the DNS questions needed for collection.'] : ['The runtime DNS resolver receives DNS questions when DNS collection is required.']),
+            ...(options.deep ? ['Target web infrastructure receives bounded homepage, favicon and TLS requests; configured optional providers can receive the documented target representation.'] : []),
+        ]),
+        persistence: Object.freeze({
+            output: options.output,
+            checkpoint: options.checkpoint,
+            note: options.checkpoint
+                ? 'A private resumable checkpoint is written locally; final output remains separate.'
+                : 'No checkpoint is written. Final output is emitted only to the selected destination.',
+        }),
+        review: Object.freeze({
+            allowlistAffectsPriorityOnly: options.allowlist === true,
+            enforcementActions: false,
+        }),
+        limitations: Object.freeze([
+            'This offline preflight reports collection families and hard target/concurrency bounds, not an exact raw request count.',
+            'Redirects, WHOIS referrals, cache state, feature configuration, policy decisions, source availability and prerequisite evidence can change the requests actually made.',
+            'A planned source may still return unsupported, unavailable, partial, rate-limited or inconclusive evidence.',
+        ]),
+    });
+}
+export function formatCollectionPreflight(document) {
+    return [
+        `WHOISleuth ${document.command} preflight`,
+        `Mode              ${document.mode}`,
+        `Selected targets  ${document.scope.selectedTargets} / ${document.scope.commandTargetLimit}`,
+        `Concurrency       ${document.scope.concurrency}`,
+        'Network requests  none',
+        '',
+        'Collector families',
+        ...document.scope.sourceFamilies.map((source) => `  ${source}`),
+        '',
+        ...document.disclosure.map((item) => `Disclosure: ${item}`),
+        ...document.limitations.map((item) => `Limitation: ${item}`),
+        '',
+    ].join('\n');
+}