@slicedearth/whoisleuth-cli 1.39.1 → 1.43.0

package/cli/investigation-run.mjs

@@ -0,0 +1,112 @@
+import { Buffer } from 'node:buffer';
+import { buildInvestigationPlan, } from "./investigation-plan.mjs";
+import { CliUsageError } from "./errors.mjs";
+export const CLI_INVESTIGATION_RUN_SCHEMA = 'whoisleuth.cli.investigation-run';
+export const CLI_INVESTIGATION_RUN_VERSION = 1;
+export const MAX_INVESTIGATION_RUN_BYTES = 24 * 1024 * 1024;
+function boundedResult(value) {
+    if (Buffer.byteLength(value, 'utf8') > MAX_INVESTIGATION_RUN_BYTES) {
+        throw new CliUsageError(`Investigation step output is limited to ${MAX_INVESTIGATION_RUN_BYTES} bytes.`);
+    }
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return value.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/gu, '').slice(0, MAX_INVESTIGATION_RUN_BYTES);
+    }
+}
+function parseResumeState(input, recipe, subject) {
+    if (!input)
+        return [];
+    if (Buffer.byteLength(input, 'utf8') > MAX_INVESTIGATION_RUN_BYTES)
+        throw new CliUsageError('Investigation resume state exceeds the 24 MiB limit.');
+    let parsed;
+    try {
+        parsed = JSON.parse(input.replace(/^\uFEFF/u, ''));
+    }
+    catch {
+        throw new CliUsageError('Investigation resume state must be valid JSON.');
+    }
+    const root = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    if (root.schema !== CLI_INVESTIGATION_RUN_SCHEMA || root.version !== CLI_INVESTIGATION_RUN_VERSION || root.recipe !== recipe || root.subject !== subject || !Array.isArray(root.completedSteps)) {
+        throw new CliUsageError('Investigation resume state must match this versioned recipe and subject.');
+    }
+    return root.completedSteps.slice(0, 16).flatMap((value) => {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            return [];
+        const item = value;
+        if (typeof item.id !== 'string' || typeof item.command !== 'string' || !Array.isArray(item.arguments) || !['offline', 'network'].includes(String(item.mode)) || !Number.isSafeInteger(item.exitCode))
+            return [];
+        return [Object.freeze({
+                id: item.id,
+                command: item.command,
+                arguments: Object.freeze(item.arguments.filter((entry) => typeof entry === 'string').slice(0, 32)),
+                mode: item.mode,
+                exitCode: Number(item.exitCode),
+                result: item.result,
+            })];
+    });
+}
+export async function runInvestigationRecipe(recipe, subjectValue, options) {
+    const plan = buildInvestigationPlan(recipe, subjectValue, options.generatedAt);
+    const prior = parseResumeState(options.resumeInput, recipe, plan.subject);
+    const allowedStepIds = new Set(plan.steps.map((step) => step.id));
+    if (prior.some((step) => !allowedStepIds.has(step.id)))
+        throw new CliUsageError('Investigation resume state contains a step outside the fixed recipe.');
+    const completed = [...prior];
+    let state = 'complete';
+    let currentStep = null;
+    for (const step of plan.steps) {
+        if (completed.some((item) => item.id === step.id))
+            continue;
+        currentStep = step;
+        if (step.arguments.some((argument) => /^<[^>]+>$/u.test(argument))) {
+            state = 'awaiting_analyst_selection';
+            break;
+        }
+        if (step.mode === 'network' && !options.approveNetwork) {
+            state = 'awaiting_network_approval';
+            break;
+        }
+        const result = await options.execute(step.command, step.arguments);
+        completed.push(Object.freeze({
+            id: step.id,
+            command: step.command,
+            arguments: step.arguments,
+            mode: step.mode,
+            exitCode: result.exitCode,
+            result: boundedResult(result.stdout),
+        }));
+        if (result.exitCode !== 0 && result.exitCode !== 2) {
+            state = 'step_failed';
+            break;
+        }
+        currentStep = null;
+    }
+    return Object.freeze({
+        schema: CLI_INVESTIGATION_RUN_SCHEMA,
+        version: CLI_INVESTIGATION_RUN_VERSION,
+        generatedAt: options.generatedAt,
+        recipe,
+        subject: plan.subject,
+        state,
+        networkApprovedForThisRun: options.approveNetwork,
+        completedSteps: Object.freeze(completed),
+        currentStep,
+        limitations: Object.freeze([
+            'Only commands and arguments from the installed fixed recipe can execute; no shell, script, arbitrary command, or enforcement action is accepted.',
+            'Network steps run only with --approve-network for the current invocation. Analyst-selection placeholders always pause and are never interpreted as paths or values.',
+            'A resume file is a local checkpoint, not proof that prior evidence remains current or that a human reviewed each stored result.',
+        ]),
+    });
+}
+export function formatInvestigationRun(document) {
+    return [
+        `Investigation run: ${document.recipe}`,
+        `Subject    ${document.subject}`,
+        `State      ${document.state.replaceAll('_', ' ')}`,
+        `Completed  ${document.completedSteps.length}`,
+        ...(document.currentStep ? [`Next       ${document.currentStep.label}`, `Approval   ${document.currentStep.approval.replaceAll('_', ' ')}`] : []),
+        '',
+    ].join('\n');
+}

package/cli/lookup-brief.mjs

@@ -0,0 +1,116 @@
+import { parseSavedLookupDocument } from "./saved-lookup.mjs";
+export const CLI_LOOKUP_BRIEF_SCHEMA = 'whoisleuth.cli.lookup-brief';
+export const CLI_LOOKUP_BRIEF_VERSION = 2;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function text(value, maximum = 300) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.replace(/[\u0000-\u001f\u007f]+/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum);
+    return normalized || null;
+}
+function sourceState(value) {
+    return text(value, 40)?.toLowerCase() ?? 'unavailable';
+}
+export function buildCliLookupBrief(input, generatedAt = new Date().toISOString()) {
+    const document = parseSavedLookupDocument(input, { label: 'Lookup brief input' });
+    const diagnostics = record(document.diagnostics);
+    const availability = record(document.availability);
+    const rdap = record(record(document.rdap).parsed);
+    const whois = record(record(document.whois).parsed);
+    const preferred = Object.keys(rdap).length ? rdap : whois;
+    const sources = ['rdap', 'whois', 'availability', 'dns', 'http', 'tls'].map((id) => {
+        const nested = id === 'dns' || id === 'http' || id === 'tls' ? record(availability[id]) : record(diagnostics[id]);
+        return Object.freeze({ id, state: sourceState(nested.status ?? nested.state), observedAt: text(nested.observedAt ?? nested.fetchedAt ?? nested.queriedAt, 64) });
+    });
+    const facts = [
+        ['Registration state', availability.state, 'Authority-aware availability'],
+        ['Registrar', record(preferred.registrar).name ?? preferred.registrar, Object.keys(rdap).length ? 'Registry RDAP' : 'WHOIS'],
+        ['Created', record(preferred.lifecycle).createdIso ?? preferred.createdDateIso, Object.keys(rdap).length ? 'Registry RDAP' : 'WHOIS'],
+        ['Expires', record(preferred.lifecycle).expiryIso ?? preferred.expiryDateIso, Object.keys(rdap).length ? 'Registry RDAP' : 'WHOIS'],
+        ['Website activity', availability.activityStatus, 'HTTP'],
+        ['Page title', availability.pageTitle, 'Static page identity'],
+    ].flatMap(([label, value, source]) => {
+        const normalized = text(value);
+        return normalized ? [Object.freeze({ label: String(label), value: normalized, source: String(source) })] : [];
+    });
+    const incomplete = sources.filter((item) => !['complete', 'success'].includes(item.state));
+    const analysis = record(document.analysis);
+    const contradictions = [analysis.registryComparison, document.registryComparison, document.registrarPublicationComparison]
+        .flatMap((value) => Array.isArray(record(value).fields) ? record(value).fields : [])
+        .flatMap((value) => {
+        const item = record(value);
+        return item.status === 'conflict' ? [text(item.label, 120) ?? 'Registration publication conflict'] : [];
+    }).slice(0, 16);
+    const actionPlan = [
+        ...(contradictions.length ? [{
+                id: 'registration-publication-review',
+                action: 'Review the separately attributed registration publications before relying on the conflicting fields.',
+                reason: `${contradictions.length} conflicting publication field${contradictions.length === 1 ? '' : 's'} were retained.`,
+                expectedOutcome: 'Establish which observation is current, authoritative, or still unresolved.',
+                evidence: 'registry publication comparison',
+            }] : []),
+        ...(incomplete.length ? [{
+                id: 'source-state-review',
+                action: `Refresh or explain the ${incomplete.map((item) => item.id).join(', ')} source state before treating missing values as meaningful.`,
+                reason: 'At least one source was not complete in the saved observation.',
+                expectedOutcome: 'Determine whether each limitation is transient, persistent, or expected for that source.',
+                evidence: 'source health',
+            }] : []),
+        ...(document.mode === 'fast' ? [{
+                id: 'collection-depth-review',
+                action: 'Run a deliberate Deep lookup if DNS, HTTP, TLS, page, or network evidence is required.',
+                reason: 'The saved observation used the intentionally narrower Fast contract.',
+                expectedOutcome: 'Collect the explicitly selected additional source classes without implying that unavailable evidence is absent.',
+                evidence: 'collection mode',
+            }] : []),
+        {
+            id: 'case-evidence-review',
+            action: 'Pin only the facts needed for the decision and keep analyst hypotheses separate from observations.',
+            reason: 'The brief organises one observation but does not create an analyst decision.',
+            expectedOutcome: 'Preserve a reviewable boundary between observed facts, hypotheses, unknowns, and decisions.',
+            evidence: 'case workflow',
+        },
+    ].slice(0, 6).map((item) => Object.freeze(item));
+    const recommendedActions = actionPlan.map((item) => item.action);
+    return Object.freeze({
+        schema: CLI_LOOKUP_BRIEF_SCHEMA,
+        version: CLI_LOOKUP_BRIEF_VERSION,
+        generatedAt,
+        target: document.registrableDomain,
+        observedAt: document.generatedAt,
+        mode: document.mode,
+        facts: Object.freeze(facts),
+        sourceHealth: Object.freeze(sources),
+        contradictions: Object.freeze(contradictions),
+        unknowns: Object.freeze(incomplete.map((item) => `${item.id}: ${item.state}`)),
+        actionPlan: Object.freeze(actionPlan),
+        recommendedActions: Object.freeze(recommendedActions.slice(0, 6)),
+        limitations: Object.freeze([
+            'This brief is derived from one saved Lookup and makes no request.',
+            'It organises bounded facts and uncertainty but does not create an analyst assertion, decide maliciousness, or establish current state.',
+            'Raw registry, provider, HTTP and page payloads are excluded.',
+        ]),
+    });
+}
+export function formatCliLookupBrief(document) {
+    return [
+        `Lookup brief: ${document.target}`,
+        `Observed  ${document.observedAt}`,
+        `Mode      ${document.mode}`,
+        '',
+        'Verified facts',
+        ...(document.facts.length ? document.facts.map((item) => `  ${item.label}: ${item.value} (${item.source})`) : ['  No bounded fact was available.']),
+        '',
+        'Unknown or incomplete',
+        ...(document.unknowns.length ? document.unknowns.map((item) => `  ${item}`) : ['  No incomplete source state was identified.']),
+        '',
+        'Recommended manual actions',
+        ...document.actionPlan.flatMap((item, index) => [
+            `  ${index + 1}. ${item.action}`,
+            `     Expected outcome: ${item.expectedOutcome}`,
+        ]),
+        '',
+    ].join('\n');
+}

package/cli/lookup-command-runner.mjs

@@ -11,6 +11,8 @@ import { formatTerminalLookup } from "./formatters/terminal.mjs";
 import { buildCliLookupPlan, formatCliLookupPlan } from "./lookup-plan.mjs";
 import { createCliProgressEvents } from "./progress-events.mjs";
 import { lookupStrictExitFindings } from "./strict-exit.mjs";
+import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
+import { formatCliJunit } from "./ci-report.mjs";
 async function runLookupCommand(args, dependencies, context) {
     const eventProgress = createCliProgressEvents(context.stderr, {
         command: 'lookup',
@@ -75,6 +77,8 @@ async function runLookupCommand(args, dependencies, context) {
     if (!args.quiet) {
         if (args.output === 'json')
             context.writeStdout(formatJsonDocument(document));
+        else if (args.output === 'junit')
+            context.writeStdout(formatCliJunit(document));
         else if (args.output === 'markdown' || args.output === 'html') {
             const loadEvidence = dependencies.loadEvidenceExport || (() => import("../lib/evidence-export.mjs"));
             const evidenceModule = await loadEvidence();
@@ -88,10 +92,13 @@ async function runLookupCommand(args, dependencies, context) {
         }
     }
     const strictFindings = args.strictExit ? lookupStrictExitFindings(document) : [];
-    const exitCode = strictFindings.length ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+    const policyFindings = evaluateCliFailPolicies(document, args.failOn || []);
+    const exitCode = strictFindings.length || policyFindings.length ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
     if (strictFindings.length && !args.events) {
         context.writeStderr(`Strict exit: ${strictFindings.length} requested source state${strictFindings.length === 1 ? '' : 's'} were incomplete.\n`);
     }
+    if (policyFindings.length && !args.events)
+        context.writeStderr(formatFailPolicyNotice(policyFindings));
     eventProgress.emit({ event: 'completed', exitCode });
     return exitCode;
 }

package/cli/lookup-diff.mjs

@@ -1,13 +1,11 @@
 import { buildBulkComparisonEvidence } from "../lib/bulk-comparison-evidence.mjs";
+import { recordOrEmpty } from "../lib/bounded-contract-normalizers.mjs";
 import { buildBulkDomainComparison, } from "../frontend/src/lib/analysis/bulk-domain-comparison.js";
 import { relationshipObservation } from "../frontend/src/lib/analysis/relationship-evidence.js";
 import { CliUsageError } from "./errors.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
 export const CLI_LOOKUP_DIFF_SCHEMA = 'whoisleuth.cli.lookup-diff';
 export const CLI_LOOKUP_DIFF_VERSION = 1;
-function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-}
 function text(value, maximum = 300) {
     if (typeof value !== 'string')
         return null;
@@ -23,14 +21,14 @@ function stringList(value, maximum = 100) {
         }))].slice(0, maximum);
 }
 function lifecycleValue(parsed, field) {
-    const lifecycle = record(parsed.lifecycle);
+    const lifecycle = recordOrEmpty(parsed.lifecycle);
     return text(lifecycle[`${field}Iso`] ?? lifecycle[field] ?? parsed[`${field}Iso`] ?? parsed[field], 64);
 }
 function registrarLabel(parsed) {
     const registrar = parsed.registrar;
     if (typeof registrar === 'string')
         return text(registrar);
-    const source = record(registrar);
+    const source = recordOrEmpty(registrar);
     return text(source.name ?? source.org ?? source.handle);
 }
 function sourceState(value) {
@@ -50,25 +48,25 @@ function sourceState(value) {
     return 'unavailable';
 }
 function sourceCoverage(document, availability) {
-    const diagnostics = record(document.diagnostics);
+    const diagnostics = recordOrEmpty(document.diagnostics);
     const entries = [
-        ['rdap', record(diagnostics.rdap).status],
-        ['whois', record(diagnostics.whois).status],
-        ['availability', record(diagnostics.availability).status],
-        ['dns', record(availability.dns).status],
-        ['http', record(availability.http).status],
-        ['tls', record(availability.tls).status],
+        ['rdap', recordOrEmpty(diagnostics.rdap).status],
+        ['whois', recordOrEmpty(diagnostics.whois).status],
+        ['availability', recordOrEmpty(diagnostics.availability).status],
+        ['dns', recordOrEmpty(availability.dns).status],
+        ['http', recordOrEmpty(availability.http).status],
+        ['tls', recordOrEmpty(availability.tls).status],
     ];
     return entries.map(([source, status]) => ({ source, state: sourceState(status) }));
 }
 function lookupComparisonInput(document) {
-    const availability = record(document.availability);
-    const rdapParsed = record(record(document.rdap).parsed);
-    const whoisParsed = record(record(document.whois).parsed);
+    const availability = recordOrEmpty(document.availability);
+    const rdapParsed = recordOrEmpty(recordOrEmpty(document.rdap).parsed);
+    const whoisParsed = recordOrEmpty(recordOrEmpty(document.whois).parsed);
     const preferredRegistry = Object.keys(rdapParsed).length ? rdapParsed : whoisParsed;
     const relationship = relationshipObservation(availability);
-    const dns = record(availability.dns);
-    const dnsRecords = record(dns.records);
+    const dns = recordOrEmpty(availability.dns);
+    const dnsRecords = recordOrEmpty(dns.records);
     const comparisonEvidence = buildBulkComparisonEvidence(availability);
     return {
         domain: document.registrableDomain,
@@ -97,8 +95,8 @@ function lookupComparisonInput(document) {
         faviconMatch: false,
         faviconNearMatch: false,
         reusesOfficialAssets: false,
-        hasPasswordField: record(record(availability.credentialSurfaceProfile).inputs).categories
-            ? Number(record(record(record(availability.credentialSurfaceProfile).inputs).categories).password) > 0
+        hasPasswordField: recordOrEmpty(recordOrEmpty(availability.credentialSurfaceProfile).inputs).categories
+            ? Number(recordOrEmpty(recordOrEmpty(recordOrEmpty(availability.credentialSurfaceProfile).inputs).categories).password) > 0
             : false,
         hasExternalFormAction: null,
         phishingLanguageMatch: null,

package/cli/network-command-runner.mjs

@@ -8,6 +8,7 @@ import { formatTerminalCtSearch, formatTerminalHttp, formatTerminalPosture, form
 import { buildHttpProbeResult } from "./http.mjs";
 import { normalizePostureSelectors } from "./posture.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
+import { buildPostureSarif } from "./ci-report.mjs";
 async function runNetworkCommand(args, dependencies, context) {
     if (args.action === 'ct-search') {
         const keyword = args.keyword || await context.readSingleInput();
@@ -46,7 +47,9 @@ async function runNetworkCommand(args, dependencies, context) {
         if (!args.quiet) {
             context.writeStdout(args.output === 'json'
                 ? formatJsonDocument(document)
-                : context.terminal(formatTerminalPosture(document), args.color));
+                : args.output === 'sarif'
+                    ? formatJsonDocument(buildPostureSarif(document))
+                    : context.terminal(formatTerminalPosture(document), args.color));
         }
         return EXIT_CODES.SUCCESS;
     }

package/cli/offline-evidence-review.mjs

@@ -1,10 +1,16 @@
 import { Buffer } from 'node:buffer';
 import { normalizeEncryptedDnsAdapter, planEncryptedDnsQuery, } from "../lib/encrypted-dns-contract.mjs";
 import { validateDnssecEvidence } from "../lib/dnssec-evidence-validation.mjs";
+import { reviewDomainChange } from "../lib/domain-change-review.mjs";
+import { reviewDomainPortfolio } from "../lib/domain-portfolio-review.mjs";
+import { reviewNameserverPreflight } from "../lib/nameserver-preflight-review.mjs";
 import { buildLocalGeoIpDatabase, lookupLocalGeoIp, } from "../lib/local-geoip-evidence.mjs";
-import { normalizeRdapSearchHelp, planRdapReverseSearch, } from "../lib/rdap-search-workbench.mjs";
+import { inspectRdapReverseSearchResponse, normalizeRdapSearchHelp, planRdapReverseSearch, } from "../lib/rdap-search-workbench.mjs";
 import { reviewRpkiRoute } from "../lib/rpki-evidence.mjs";
 import { analyzeTlsaEvidence } from "../lib/tlsa-evidence.mjs";
+import { reviewZoneIntent } from "../lib/zone-intent-review.mjs";
+import { reviewDnsConvergence } from "../lib/dns-convergence-review.mjs";
+import { compareTrustStoreEvidence } from "../lib/trust-store-comparison.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { LOCAL_MMDB_QUERY_SCHEMA, reviewLocalMmdb } from "./local-mmdb-review.mjs";
 const OFFLINE_EVIDENCE_REVIEW_SCHEMA = 'whoisleuth.cli.offline-evidence-review';
@@ -38,14 +44,18 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
         kind = 'rdap_search';
         const request = record(input.request);
         const help = normalizeRdapSearchHelp(input.help);
+        const plan = planRdapReverseSearch(help, {
+            searchableResourceType: String(request.searchableResourceType ?? ''),
+            relatedResourceType: String(request.relatedResourceType ?? ''),
+            property: String(request.property ?? ''),
+            value: request.value,
+        });
         result = Object.freeze({
             help,
-            plan: planRdapReverseSearch(help, {
-                searchableResourceType: String(request.searchableResourceType ?? ''),
-                relatedResourceType: String(request.relatedResourceType ?? ''),
-                property: String(request.property ?? ''),
-                value: request.value,
-            }),
+            plan,
+            responseInspection: input.response === undefined
+                ? null
+                : inspectRdapReverseSearchResponse(input.response, [request.property]),
         });
     }
     else if (input.schema === 'whoisleuth.dnssec-evidence-input') {
@@ -88,6 +98,30 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
         const query = record(input.query);
         result = planEncryptedDnsQuery(normalizeEncryptedDnsAdapter(input.adapter), { name: query.name, type: query.type });
     }
+    else if (input.schema === 'whoisleuth.zone-intent.input') {
+        kind = 'zone_intent';
+        result = reviewZoneIntent(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.domain-portfolio.input') {
+        kind = 'domain_portfolio';
+        result = reviewDomainPortfolio(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.domain-change.input') {
+        kind = 'domain_change';
+        result = reviewDomainChange(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.dns-convergence.input') {
+        kind = 'dns_convergence';
+        result = reviewDnsConvergence(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.nameserver-preflight.input') {
+        kind = 'nameserver_preflight';
+        result = reviewNameserverPreflight(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.trust-store-comparison.input') {
+        kind = 'trust_store';
+        result = compareTrustStoreEvidence(input, generatedAt);
+    }
     else {
         throw new CliUsageError('Offline evidence review does not recognise this input schema.');
     }
@@ -121,7 +155,20 @@ async function buildOfflineEvidenceReviewWithLocalResources(value, generatedAt =
 }
 function formatOfflineEvidenceReview(document) {
     const result = record(document.result);
-    const state = typeof result.state === 'string' ? result.state : 'reviewed';
+    const gate = record(result.gate);
+    const counts = record(result.counts);
+    const count = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : 0;
+    const listLength = (value) => Array.isArray(value) ? value.length : 0;
+    const state = typeof result.state === 'string'
+        ? result.state
+        : document.kind === 'zone_intent'
+            ? result.complete === true
+                && ['different', 'missing', 'unexpected', 'incomplete'].every((key) => count(counts[key]) === 0)
+                ? 'aligned'
+                : 'review'
+            : typeof gate.pass === 'boolean'
+                ? gate.pass ? 'ready' : 'review'
+                : document.kind === 'domain_portfolio' ? 'inventory' : 'reviewed';
     const lines = [
         'Offline evidence review',
         `Kind   ${document.kind.replaceAll('_', ' ')}`,
@@ -130,8 +177,48 @@ function formatOfflineEvidenceReview(document) {
     if (document.kind === 'rdap_search') {
         const help = record(result.help);
         const plan = record(result.plan);
+        const responseInspection = record(result.responseInspection);
         lines.push(`Help   ${String(help.state ?? 'unavailable').replaceAll('_', ' ')}`);
         lines.push(`Plan   ${String(plan.state ?? 'unavailable').replaceAll('_', ' ')}`);
+        if (result.responseInspection !== null)
+            lines.push(`Result ${String(responseInspection.state ?? 'invalid').replaceAll('_', ' ')}`);
+    }
+    else if (document.kind === 'zone_intent') {
+        const desired = record(result.desired);
+        lines.push(`Desired ${listLength(desired.records)}`);
+        lines.push(`Compared ${listLength(result.comparisons)}`);
+        lines.push(`Aligned ${count(counts.aligned)}`);
+        lines.push(`Changed ${count(counts.different) + count(counts.missing) + count(counts.unexpected)}`);
+        lines.push(`Partial ${count(counts.incomplete)}`);
+        lines.push(`Rejected ${listLength(desired.rejected)}`);
+    }
+    else if (document.kind === 'domain_change') {
+        lines.push(`Authority ${listLength(result.authoritativeRecordMatrix)} rows`);
+        lines.push(`Resolvers ${listLength(result.resolverDivergenceMatrix)} rows`);
+    }
+    else if (document.kind === 'dns_convergence') {
+        lines.push(`Observers ${listLength(result.observers)}`);
+        lines.push(`Snapshots ${listLength(result.snapshots)}`);
+        lines.push(`Record sets ${listLength(result.rows)}`);
+    }
+    else if (document.kind === 'nameserver_preflight') {
+        const rows = Array.isArray(result.rows) ? result.rows : [];
+        lines.push(`Servers ${rows.length}`);
+        lines.push(`Ready  ${rows.filter((item) => record(item).ready === true).length}`);
+    }
+    else if (document.kind === 'trust_store') {
+        lines.push(`Stores ${count(counts.stores)}`);
+        lines.push(`Matched ${count(counts.anchorObserved)}`);
+        lines.push(`Not observed ${count(counts.notObserved)}`);
+        lines.push(`Inconclusive ${count(counts.inconclusive)}`);
+    }
+    else if (document.kind === 'domain_portfolio') {
+        const unknownCounts = record(result.unknownCounts);
+        lines.push(`Assets ${listLength(result.assets)}`);
+        lines.push(`Dependencies ${listLength(result.simulations)}`);
+        lines.push(`Renewals ${listLength(result.renewalQueue)}`);
+        lines.push(`Recovery ${listLength(result.recoveryCycles)}`);
+        lines.push(`Unknown ${Object.values(unknownCounts).reduce((total, value) => total + count(value), 0)}`);
     }
     else {
         for (const [label, key] of [
@@ -146,6 +233,16 @@ function formatOfflineEvidenceReview(document) {
                 lines.push(`${label.padEnd(7)}${candidate}`);
         }
     }
+    const reasons = Array.isArray(gate.reasons) ? gate.reasons : [];
+    if (reasons.length) {
+        lines.push('', 'Review reasons:');
+        for (const reason of reasons.slice(0, 8)) {
+            if (typeof reason === 'string')
+                lines.push(`  - ${reason.replace(/[\u0000-\u001f\u007f]+/gu, ' ').trim().slice(0, 240)}`);
+        }
+        if (reasons.length > 8)
+            lines.push(`  - ${reasons.length - 8} more reason(s) omitted.`);
+    }
     lines.push('', 'Limitations:');
     for (const limitation of document.limitations)
         lines.push(`  - ${limitation}`);