@slicedearth/whoisleuth-cli 1.39.1 → 1.43.0

package/cli/config-profile.mjs

@@ -0,0 +1,180 @@
+import { Buffer } from 'node:buffer';
+import { open } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { CliUsageError } from "./errors.mjs";
+export const CLI_CONFIG_SCHEMA = 'whoisleuth.cli.config';
+export const CLI_CONFIG_VERSION = 1;
+export const MAX_CLI_CONFIG_BYTES = 64 * 1024;
+const SAFE_BOOLEAN_DEFAULTS = new Set(['--no-color', '--summary', '--verbose', '--fast']);
+const SAFE_VALUE_DEFAULTS = new Set(['--concurrency', '--observer', '--vantage']);
+const OPTION_GROUPS = Object.freeze({
+    '--no-color': 'colour',
+    '--summary': 'detail',
+    '--verbose': 'detail',
+    '--fast': 'scan',
+    '--concurrency': 'concurrency',
+    '--observer': 'observer',
+    '--vantage': 'vantage',
+});
+function validProfileName(value) {
+    return typeof value === 'string' && /^[a-z0-9][a-z0-9_-]{0,39}$/u.test(value);
+}
+function safeArgumentText(value) {
+    if (typeof value !== 'string' || !value || value.length > 253 || /[\u0000-\u001f\u007f]/u.test(value)) {
+        throw new CliUsageError('CLI profile arguments must be bounded text without control characters.');
+    }
+    return value;
+}
+function validateProfileArguments(value) {
+    if (!Array.isArray(value) || value.length > 16)
+        throw new CliUsageError('Each CLI profile is limited to 16 safe default arguments.');
+    const argumentsList = value.map(safeArgumentText);
+    const validated = [];
+    const groups = new Set();
+    for (let index = 0; index < argumentsList.length; index += 1) {
+        const argument = argumentsList[index];
+        if (SAFE_BOOLEAN_DEFAULTS.has(argument)) {
+            const group = OPTION_GROUPS[argument];
+            if (groups.has(group))
+                throw new CliUsageError(`CLI profile contains conflicting ${group} defaults.`);
+            groups.add(group);
+            validated.push(argument);
+            continue;
+        }
+        if (!SAFE_VALUE_DEFAULTS.has(argument)) {
+            throw new CliUsageError(`CLI profiles cannot set ${argument}. Only presentation labels, fast mode, and bounded concurrency are supported.`);
+        }
+        const next = argumentsList[++index];
+        if (!next || next.startsWith('-'))
+            throw new CliUsageError(`${argument} in a CLI profile requires one value.`);
+        const group = OPTION_GROUPS[argument];
+        if (groups.has(group))
+            throw new CliUsageError(`CLI profile contains duplicate ${group} defaults.`);
+        if (argument === '--concurrency' && (!/^\d+$/u.test(next) || Number(next) < 1 || Number(next) > 8)) {
+            throw new CliUsageError('CLI profile concurrency must be an integer from 1 to 8.');
+        }
+        groups.add(group);
+        validated.push(argument, next);
+    }
+    return validated;
+}
+function parseProfileDocument(input) {
+    if (Buffer.byteLength(input, 'utf8') > MAX_CLI_CONFIG_BYTES)
+        throw new CliUsageError('CLI configuration is limited to 64 KiB.');
+    let parsed;
+    try {
+        parsed = JSON.parse(input.replace(/^\uFEFF/u, ''));
+    }
+    catch {
+        throw new CliUsageError('CLI configuration must be valid JSON.');
+    }
+    const root = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    if (root.schema !== CLI_CONFIG_SCHEMA || root.version !== CLI_CONFIG_VERSION || !root.profiles || typeof root.profiles !== 'object' || Array.isArray(root.profiles)) {
+        throw new CliUsageError(`CLI configuration must use ${CLI_CONFIG_SCHEMA} version ${CLI_CONFIG_VERSION}.`);
+    }
+    if (Object.keys(root).some((key) => !['schema', 'version', 'defaultProfile', 'profiles'].includes(key)))
+        throw new CliUsageError('CLI configuration contains an unsupported root field.');
+    if (root.defaultProfile !== undefined && !validProfileName(root.defaultProfile))
+        throw new CliUsageError('CLI configuration defaultProfile is invalid.');
+    const profileEntries = Object.entries(root.profiles);
+    if (profileEntries.length < 1 || profileEntries.length > 20)
+        throw new CliUsageError('CLI configuration requires from 1 to 20 profiles.');
+    const profiles = Object.fromEntries(profileEntries.map(([name, value]) => {
+        if (!validProfileName(name))
+            throw new CliUsageError(`CLI profile name "${name}" is invalid.`);
+        const profile = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+        if (Object.keys(profile).some((key) => key !== 'arguments'))
+            throw new CliUsageError(`CLI profile "${name}" contains an unsupported field.`);
+        return [name, Object.freeze({ arguments: Object.freeze(validateProfileArguments(profile.arguments)) })];
+    }));
+    return Object.freeze({ schema: CLI_CONFIG_SCHEMA, version: CLI_CONFIG_VERSION, ...(root.defaultProfile ? { defaultProfile: root.defaultProfile } : {}), profiles: Object.freeze(profiles) });
+}
+async function readConfigFile(path) {
+    const handle = await open(path, 'r');
+    try {
+        const metadata = await handle.stat();
+        if (metadata.size > MAX_CLI_CONFIG_BYTES)
+            throw new CliUsageError('CLI configuration is limited to 64 KiB.');
+        return await handle.readFile({ encoding: 'utf8' });
+    }
+    finally {
+        await handle.close();
+    }
+}
+function suppliedGroups(argumentsList) {
+    const groups = new Set();
+    for (const argument of argumentsList) {
+        const group = OPTION_GROUPS[argument];
+        if (group)
+            groups.add(group);
+        if (argument === '--deep')
+            groups.add('scan');
+    }
+    return groups;
+}
+export async function resolveCliProfileArguments(argv, options = {}) {
+    const retained = [];
+    let configPath = null;
+    let profileName = null;
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === undefined)
+            break;
+        if (argument === '--config' || argument === '--profile') {
+            const next = argv[++index];
+            if (!next || next.startsWith('-'))
+                throw new CliUsageError(`${argument} requires one value.`);
+            if (argument === '--config') {
+                if (configPath !== null)
+                    throw new CliUsageError('--config may be supplied only once.');
+                configPath = next;
+            }
+            else {
+                if (profileName !== null)
+                    throw new CliUsageError('--profile may be supplied only once.');
+                if (!validProfileName(next))
+                    throw new CliUsageError('--profile requires a lower-case name of at most 40 characters.');
+                profileName = next;
+            }
+        }
+        else
+            retained.push(argument);
+    }
+    if (!configPath && !profileName)
+        return retained;
+    const environment = options.environment || process.env;
+    const baseDirectory = environment.XDG_CONFIG_HOME || join(options.homeDirectory || homedir(), '.config');
+    const selectedPath = resolve(configPath || join(baseDirectory, 'whoisleuth', 'config.json'));
+    let input;
+    try {
+        input = await (options.readConfig || readConfigFile)(selectedPath);
+    }
+    catch (error) {
+        if (error instanceof CliUsageError)
+            throw error;
+        throw new CliUsageError(`Could not read CLI configuration from ${selectedPath}.`);
+    }
+    const document = parseProfileDocument(input);
+    const selectedName = profileName || document.defaultProfile;
+    if (!selectedName)
+        throw new CliUsageError('CLI configuration requires --profile or a defaultProfile.');
+    const selected = document.profiles[selectedName];
+    if (!selected)
+        throw new CliUsageError(`CLI profile "${selectedName}" was not found.`);
+    if (!retained.length)
+        throw new CliUsageError('A CLI profile must accompany a command.');
+    const explicitGroups = suppliedGroups(retained.slice(1));
+    const defaults = [];
+    for (let index = 0; index < selected.arguments.length; index += 1) {
+        const argument = selected.arguments[index];
+        const group = OPTION_GROUPS[argument];
+        const hasValue = SAFE_VALUE_DEFAULTS.has(argument);
+        const value = hasValue ? selected.arguments[++index] : undefined;
+        if (explicitGroups.has(group))
+            continue;
+        defaults.push(argument, ...(value ? [value] : []));
+    }
+    return [retained[0], ...defaults, ...retained.slice(1)];
+}
+export { parseProfileDocument };

package/cli/ct-event-intake.mjs

@@ -0,0 +1,159 @@
+import { domainToASCII } from 'node:url';
+import { exactKeys, requireBoundedString, requireIsoTimestamp, requireRecord, } from "../lib/bounded-contract-normalizers.mjs";
+export const CT_EVENT_BATCH_SCHEMA = 'whoisleuth.ct-event-batch';
+export const CT_EVENT_BATCH_VERSION = 1;
+export const MAX_CT_EVENT_INPUT_BYTES = 4 * 1024 * 1024;
+export const MAX_CT_EVENTS = 500;
+export const MAX_CT_EVENT_NAMES = 100;
+export const MAX_CT_EXTERNAL_FINDINGS = 100;
+export const MAX_CT_EXTERNAL_DOMAINS = 25;
+export const MAX_CT_EXTERNAL_FINDINGS_PER_DOMAIN = 20;
+const ROOT_KEYS = new Set(['schema', 'version', 'source', 'events']);
+const SOURCE_KEYS = new Set(['name', 'reference', 'collectedAt']);
+const EVENT_KEYS = new Set([
+    'logId',
+    'observedAt',
+    'certificateSha256',
+    'dnsNames',
+    'issuer',
+    'notAfter',
+    'completeness',
+    'limitations',
+]);
+const SHA256_RE = /^[a-f0-9]{64}$/u;
+function optionalText(value, label, maximum) {
+    if (value === undefined || value === null || value === '')
+        return null;
+    return requireBoundedString(value, label, maximum);
+}
+function domain(value, label) {
+    const supplied = requireBoundedString(value, label, 255).toLowerCase().replace(/^\*\./u, '').replace(/\.$/u, '');
+    const ascii = domainToASCII(supplied).toLowerCase();
+    if (!ascii || ascii.length > 253 || !ascii.includes('.') || ascii.split('.').some((part) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(part))) {
+        throw new TypeError(`${label} must be a valid DNS name.`);
+    }
+    return ascii;
+}
+function boundedLimitations(value, label) {
+    if (value === undefined)
+        return Object.freeze([]);
+    if (!Array.isArray(value) || value.length > 8)
+        throw new TypeError(`${label} must contain no more than 8 entries.`);
+    return Object.freeze([...new Set(value.map((item, index) => requireBoundedString(item, `${label}[${index}]`, 240)))]);
+}
+export function buildCtEventFindings(inputRaw) {
+    const input = requireRecord(inputRaw, 'Certificate event batch');
+    if (input.schema !== CT_EVENT_BATCH_SCHEMA || input.version !== CT_EVENT_BATCH_VERSION) {
+        throw new TypeError(`Certificate event input must use ${CT_EVENT_BATCH_SCHEMA} version ${CT_EVENT_BATCH_VERSION}.`);
+    }
+    exactKeys(input, ROOT_KEYS, 'Certificate event batch');
+    const sourceInput = requireRecord(input.source, 'source');
+    exactKeys(sourceInput, SOURCE_KEYS, 'source');
+    const source = Object.freeze({
+        name: requireBoundedString(sourceInput.name, 'source.name', 80),
+        reference: optionalText(sourceInput.reference, 'source.reference', 500),
+        collectedAt: sourceInput.collectedAt === null || sourceInput.collectedAt === undefined
+            ? null
+            : requireIsoTimestamp(sourceInput.collectedAt, 'source.collectedAt'),
+    });
+    if (!Array.isArray(input.events) || input.events.length < 1 || input.events.length > MAX_CT_EVENTS) {
+        throw new TypeError(`events must contain between 1 and ${MAX_CT_EVENTS} entries.`);
+    }
+    const candidates = input.events.flatMap((raw, eventIndex) => {
+        const event = requireRecord(raw, `events[${eventIndex}]`);
+        exactKeys(event, EVENT_KEYS, `events[${eventIndex}]`);
+        const logId = requireBoundedString(event.logId, `events[${eventIndex}].logId`, 200);
+        const observedAt = requireIsoTimestamp(event.observedAt, `events[${eventIndex}].observedAt`);
+        const certificateSha256 = requireBoundedString(event.certificateSha256, `events[${eventIndex}].certificateSha256`, 64).toLowerCase();
+        if (!SHA256_RE.test(certificateSha256))
+            throw new TypeError(`events[${eventIndex}].certificateSha256 must be a SHA-256 hexadecimal digest.`);
+        if (!Array.isArray(event.dnsNames) || event.dnsNames.length < 1 || event.dnsNames.length > MAX_CT_EVENT_NAMES) {
+            throw new TypeError(`events[${eventIndex}].dnsNames must contain between 1 and ${MAX_CT_EVENT_NAMES} entries.`);
+        }
+        const names = [...new Set(event.dnsNames.map((name, nameIndex) => domain(name, `events[${eventIndex}].dnsNames[${nameIndex}]`)))].sort();
+        const issuer = optionalText(event.issuer, `events[${eventIndex}].issuer`, 160);
+        const notAfter = event.notAfter === null || event.notAfter === undefined
+            ? null
+            : requireIsoTimestamp(event.notAfter, `events[${eventIndex}].notAfter`);
+        const completeness = event.completeness;
+        if (completeness !== 'complete' && completeness !== 'partial') {
+            throw new TypeError(`events[${eventIndex}].completeness must be complete or partial.`);
+        }
+        const limitations = boundedLimitations(event.limitations, `events[${eventIndex}].limitations`);
+        return names.map((name) => ({
+            domain: name,
+            category: 'certificate',
+            evidenceClass: 'deployment_observation',
+            summary: `Supplied certificate …${certificateSha256.slice(-12)} included ${name} among ${names.length} bounded DNS name${names.length === 1 ? '' : 's'}.`,
+            observedAt,
+            completeness,
+            limitations,
+            reference: `Certificate event ${logId}`,
+            structuredObservation: {
+                sourceSchema: 'whoisleuth.certificate-observation-rows',
+                sourceVersion: 1,
+                field: 'certificateSha256',
+                value: certificateSha256,
+                issuer,
+                notAfter,
+            },
+        }));
+    });
+    const seen = new Set();
+    const unique = candidates
+        .sort((left, right) => left.domain.localeCompare(right.domain)
+        || left.observedAt.localeCompare(right.observedAt)
+        || left.structuredObservation.value.localeCompare(right.structuredObservation.value))
+        .filter((item) => {
+        const key = `${item.domain}\u0000${item.observedAt}\u0000${item.structuredObservation.value}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+    const domainCounts = new Map();
+    const acceptedDomains = new Set();
+    const selected = [];
+    for (const finding of unique) {
+        if (!acceptedDomains.has(finding.domain) && acceptedDomains.size >= MAX_CT_EXTERNAL_DOMAINS)
+            continue;
+        const domainCount = domainCounts.get(finding.domain) ?? 0;
+        if (domainCount >= MAX_CT_EXTERNAL_FINDINGS_PER_DOMAIN)
+            continue;
+        acceptedDomains.add(finding.domain);
+        domainCounts.set(finding.domain, domainCount + 1);
+        selected.push(finding);
+        if (selected.length >= MAX_CT_EXTERNAL_FINDINGS)
+            break;
+    }
+    const truncated = selected.length < unique.length;
+    const findings = selected.map((finding) => Object.freeze({
+        ...finding,
+        limitations: Object.freeze([
+            ...finding.limitations,
+            'The supplied event is an observation, not proof that the certificate was served by the named domain or that the domain operator requested it.',
+            ...(truncated ? [`The batch contained ${unique.length} unique domain observations; this import preserves the first ${MAX_CT_EXTERNAL_FINDINGS} in deterministic order.`] : []),
+        ].slice(0, 8)),
+    }));
+    return Object.freeze({
+        schema: 'whoisleuth.external-findings',
+        schemaVersion: 3,
+        source,
+        findings: Object.freeze(findings),
+    });
+}
+export function formatCtEventFindings(document) {
+    const domains = new Set(document.findings.map((finding) => finding.domain));
+    const certificates = new Set(document.findings.map((finding) => finding.structuredObservation.value));
+    return [
+        'Certificate event intake',
+        `Source        ${document.source.name}`,
+        `Findings      ${document.findings.length}`,
+        `Domains       ${domains.size}`,
+        `Certificates  ${certificates.size}`,
+        '',
+        'The JSON form can be imported through the Console external-findings workflow.',
+        'A certificate event is a review lead, not proof that the certificate was served or requested by the domain operator.',
+        '',
+    ].join('\n');
+}

package/cli/discovery-scan-command-runner.mjs

@@ -10,6 +10,8 @@ import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 import { formatJsonDocument } from "./formatters/json.mjs";
 import { createCliProgressEvents } from "./progress-events.mjs";
+import { buildCollectionPreflight, formatCollectionPreflight } from "./collection-preflight.mjs";
+import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
 async function readAllowlist(source, dependencies, classify) {
     if (!source)
         return new Set();
@@ -40,6 +42,15 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
     if (!candidates.length)
         throw new CliUsageError('discover-scan did not generate any valid candidates to collect.');
     const queries = candidates.map((candidate) => String(candidate.domain));
+    if (args.plan) {
+        const document = buildCollectionPreflight({
+            command: 'discover-scan', targetCount: queries.length, targetLimit: args.deep ? 50 : 500,
+            deep: args.deep, concurrency: args.concurrency, output: args.output, checkpoint: false,
+            customResolvers: Boolean(args.resolverText), allowlist: Boolean(args.allowlistSource),
+        });
+        context.writeStdout(args.output === 'json' ? formatJsonDocument(document) : context.terminal(formatCollectionPreflight(document), args.color));
+        return EXIT_CODES.SUCCESS;
+    }
     const classify = dependencies.classifyQuery || classifyQuery;
     let resolverServers = [];
     if (args.resolverText) {
@@ -132,7 +143,10 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
             context.writeStderr(`Checkpoint warning: ${boundedCliErrorMessage(checkpointFailure, 'Checkpoint could not be written')}. Completed output is still available.\n`);
         }
     }
-    const exitCode = checkpointFailure || items.some((item) => !item.ok)
+    const policyFindings = evaluateCliFailPolicies(document, args.failOn || []);
+    if (policyFindings.length && !eventProgress.enabled)
+        context.writeStderr(formatFailPolicyNotice(policyFindings));
+    const exitCode = checkpointFailure || items.some((item) => !item.ok) || policyFindings.length
         ? EXIT_CODES.PARTIAL_FAILURE
         : EXIT_CODES.SUCCESS;
     eventProgress.emit({ event: 'completed', exitCode });

package/cli/domain-control-monitor.mjs

@@ -0,0 +1,104 @@
+import { classifyQuery } from "../lib/classify.mjs";
+import { buildDomainControlFlightRecorder, } from "../lib/domain-control-flight-recorder.mjs";
+import { verifyDomainControlManifest } from "../lib/domain-control-manifest.mjs";
+import { buildCliLookupDocument } from "./formatters/json.mjs";
+import { buildCliDomainControlReview, } from "./domain-control-observations.mjs";
+import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
+export const CLI_DOMAIN_CONTROL_MONITOR_SCHEMA = 'whoisleuth.cli.domain-control-monitor';
+export const CLI_DOMAIN_CONTROL_MONITOR_VERSION = 1;
+export const MAX_DOMAIN_CONTROL_MONITOR_DOMAINS = 20;
+function previousSnapshot(input) {
+    if (!input)
+        return { observations: [] };
+    let parsed;
+    try {
+        parsed = JSON.parse(input.replace(/^\uFEFF/u, ''));
+    }
+    catch {
+        throw new CliUsageError('Previous monitor snapshot must be valid JSON.');
+    }
+    const root = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    if (root.schema !== CLI_DOMAIN_CONTROL_MONITOR_SCHEMA || root.version !== CLI_DOMAIN_CONTROL_MONITOR_VERSION || !Array.isArray(root.observations)) {
+        throw new CliUsageError(`Previous monitor snapshot must use ${CLI_DOMAIN_CONTROL_MONITOR_SCHEMA} version ${CLI_DOMAIN_CONTROL_MONITOR_VERSION}.`);
+    }
+    const validated = buildDomainControlFlightRecorder({
+        schema: 'whoisleuth.domain-control-flight-recorder.input', version: 1, observations: root.observations, approvedWindows: [],
+    });
+    void validated;
+    return { observations: root.observations };
+}
+export async function runDomainControlMonitor(manifestInput, previousInput, options) {
+    const generatedAt = options.now();
+    let rawManifest;
+    try {
+        rawManifest = JSON.parse(manifestInput.replace(/^\uFEFF/u, ''));
+    }
+    catch {
+        throw new CliUsageError('Domain-control manifest must be valid JSON.');
+    }
+    const manifest = verifyDomainControlManifest(rawManifest);
+    const entries = manifest.entries.slice(0, Math.min(options.limit, MAX_DOMAIN_CONTROL_MONITOR_DOMAINS));
+    const lookups = new Array(entries.length);
+    const failures = [];
+    let cursor = 0;
+    let completed = 0;
+    const worker = async () => {
+        while (cursor < entries.length) {
+            const index = cursor++;
+            const entry = entries[index];
+            if (!entry)
+                break;
+            try {
+                const classified = classifyQuery(entry.domain);
+                const result = await options.executeLookup(classified, { fast: false, compact: false, ...(options.signal ? { signal: options.signal } : {}) });
+                lookups[index] = buildCliLookupDocument(entry.domain, classified, result, generatedAt, 'deep');
+            }
+            catch (cause) {
+                failures.push({ domain: entry.domain, error: boundedCliErrorMessage(cause, 'Lookup failed') });
+            }
+            finally {
+                completed += 1;
+                options.onSettled?.(completed, entries.length);
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(options.concurrency, Math.max(entries.length, 1)) }, worker));
+    const successful = lookups.filter(Boolean);
+    if (!successful.length)
+        throw new Error('No domain-control monitor lookup completed successfully.');
+    const review = buildCliDomainControlReview(JSON.stringify({
+        schema: 'whoisleuth.cli.domain-control-review-input', version: 1, manifest, lookups: successful,
+    }), generatedAt);
+    const previous = previousSnapshot(previousInput);
+    const observations = review.observations;
+    const flightRecorder = buildDomainControlFlightRecorder({
+        schema: 'whoisleuth.domain-control-flight-recorder.input', version: 1,
+        observations: [...previous.observations, ...observations], approvedWindows: [],
+    }, generatedAt);
+    return Object.freeze({
+        schema: CLI_DOMAIN_CONTROL_MONITOR_SCHEMA,
+        version: CLI_DOMAIN_CONTROL_MONITOR_VERSION,
+        generatedAt,
+        manifest: Object.freeze({ digestSha256: manifest.integrity.digestSha256, expiresAt: manifest.expiresAt }),
+        collection: Object.freeze({ requested: entries.length, succeeded: observations.length, failed: failures.length, failures: Object.freeze(failures) }),
+        observations,
+        review: review.review,
+        flightRecorder,
+        limitations: Object.freeze([
+            'This is one bounded run, not a daemon. Scheduling and secure checkpoint retention remain operator-controlled.',
+            'The output retains compact normalised observations and errors, not raw RDAP, WHOIS, DNS, HTTP, TLS or page payloads.',
+            'A failed source or lookup remains incomplete and does not establish that a previously observed value disappeared.',
+        ]),
+    });
+}
+export function formatDomainControlMonitor(document) {
+    return [
+        'One-shot domain control review',
+        `Requested    ${document.collection.requested}`,
+        `Succeeded    ${document.collection.succeeded}`,
+        `Failed       ${document.collection.failed}`,
+        `Review       ${document.review.state}`,
+        `Unexpected   ${document.flightRecorder.summary.unexpectedChanges}`,
+        '',
+    ].join('\n');
+}