@slicedearth/whoisleuth-cli 1.39.1 → 1.45.0

package/cli/artifact-verify.mjs

@@ -9,7 +9,10 @@ import { WORKSPACE_ARCHIVE_SCHEMA, readWorkspaceArchive, } from "../frontend/src
 import { sha256ArtifactDigest } from "../frontend/src/lib/analysis/artifact-integrity.js";
 import { SAVED_LOOKUP_SCHEMA, SAVED_LOOKUP_SCHEMA_VERSION, parseSavedLookupDocument, } from "./saved-lookup.mjs";
 import { DOMAIN_CONTROL_MANIFEST_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
+import { DOMAIN_CHANGE_PACKET_SCHEMA, DOMAIN_CHANGE_PACKET_VERSION, } from "../lib/domain-change-packet.mjs";
 import { INVESTIGATION_CAPSULE_SCHEMA, INVESTIGATION_CAPSULE_VERSION, verifyInvestigationCapsule, } from "../frontend/src/lib/analysis/investigation-capsule.js";
+import { INVESTIGATION_MANIFEST_SCHEMA, INVESTIGATION_MANIFEST_VERSION, } from "./investigation-manifest.mjs";
+import { CLI_CASE_PACK_SCHEMA, CLI_CASE_PACK_VERSION, verifyCliCasePack, } from "./case-pack.mjs";
 export const OFFLINE_ARTIFACT_VERIFICATION_SCHEMA = 'whoisleuth.offline-artifact-verification';
 export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 1;
 export const MAX_OFFLINE_ARTIFACT_BYTES = 15 * 1024 * 1024;
@@ -27,6 +30,8 @@ const SIGNED_ARTIFACT_VERSIONS = Object.freeze({
     [BULK_MAIL_EXPOSURE_SCHEMA]: new Set([BULK_MAIL_EXPOSURE_VERSION]),
     [BULK_REVIEW_MANIFEST_SCHEMA]: new Set([BULK_REVIEW_MANIFEST_VERSION]),
     [DOMAIN_CONTROL_MANIFEST_SCHEMA]: new Set([DOMAIN_CONTROL_MANIFEST_VERSION]),
+    [DOMAIN_CHANGE_PACKET_SCHEMA]: new Set([DOMAIN_CHANGE_PACKET_VERSION]),
+    [INVESTIGATION_MANIFEST_SCHEMA]: new Set([INVESTIGATION_MANIFEST_VERSION]),
 });
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
@@ -72,7 +77,7 @@ function archiveReport(raw, archive, encrypted, ciphertextBytes) {
         artifact: Object.freeze({
             kind: encrypted ? 'encrypted_workspace_archive' : 'workspace_archive',
             schema: WORKSPACE_ARCHIVE_SCHEMA,
-            version: archive.version,
+            version: archive.sourceVersion,
         }),
         state: 'verified',
         valid: true,
@@ -134,6 +139,35 @@ async function verifySignedArtifact(raw, value, schema, version) {
 }
 export async function verifyOfflineArtifact(raw, options = {}) {
     const value = parseJson(raw);
+    const casePackPacket = record(value.packet);
+    if (casePackPacket?.schema === CLI_CASE_PACK_SCHEMA) {
+        const verified = verifyCliCasePack(value);
+        return Object.freeze({
+            schema: OFFLINE_ARTIFACT_VERIFICATION_SCHEMA,
+            version: OFFLINE_ARTIFACT_VERIFICATION_VERSION,
+            artifact: Object.freeze({
+                kind: 'cli_case_pack',
+                schema: CLI_CASE_PACK_SCHEMA,
+                version: CLI_CASE_PACK_VERSION,
+            }),
+            state: 'verified',
+            valid: true,
+            checks: Object.freeze({
+                structure: 'verified',
+                contentIntegrity: 'verified',
+                authenticatedEncryption: 'not_applicable',
+            }),
+            summary: Object.freeze({
+                inputBytes: inputBytes(raw),
+                sectionCount: null,
+                recordCount: verified.caseCount,
+                ciphertextBytes: null,
+            }),
+            limitations: Object.freeze([
+                'Case-pack verification detects changes after export and checks the bounded case collection; it does not authenticate the analyst, review decision, source observations, or recipient authorisation.',
+            ]),
+        });
+    }
     if (isEncryptedWorkspaceArchive(value)) {
         const inspected = inspectEncryptedWorkspaceArchive(value);
         if (!options.passphrase) {

package/cli/bulk-checkpoint.mjs

@@ -1,20 +1,18 @@
 import { createHash } from 'node:crypto';
 import { open } from 'node:fs/promises';
-import { CliUsageError } from "./errors.mjs";
+import { recordOrNull } from "../lib/bounded-contract-normalizers.mjs";
+import { readBoundedRegularTextFile } from "../lib/bounded-file.mjs";
+import { boundedCliInputError, CliUsageError } from "./errors.mjs";
 import { writePrivateFile } from "./output-file.mjs";
 export const CLI_BULK_CHECKPOINT_SCHEMA = 'whoisleuth.cli.bulk-checkpoint';
-export const CLI_BULK_CHECKPOINT_VERSION = 1;
+export const CLI_BULK_CHECKPOINT_VERSION = 2;
+const SUPPORTED_BULK_CHECKPOINT_VERSIONS = new Set([1, CLI_BULK_CHECKPOINT_VERSION]);
 export const MAX_BULK_CHECKPOINT_BYTES = 16 * 1024 * 1024;
 const MAX_CHECKPOINT_JSON_DEPTH = 12;
 const MAX_CHECKPOINT_OBJECT_KEYS = 256;
 const MAX_CHECKPOINT_ARRAY_ITEMS = 1_024;
 const MAX_CHECKPOINT_STRING_LENGTH = 32_768;
 const COMPACT_RESULT_KEYS = new Set(['availability', 'diagnostics']);
-function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : null;
-}
 function checkpointDigest(queries, deep) {
     return createHash('sha256')
         .update(deep ? 'deep\n' : 'fast\n')
@@ -37,7 +35,7 @@ function isBoundedCheckpointJson(value, depth = 0) {
         return value.length <= MAX_CHECKPOINT_ARRAY_ITEMS
             && value.every((item) => isBoundedCheckpointJson(item, depth + 1));
     }
-    const object = record(value);
+    const object = recordOrNull(value);
     if (!object)
         return false;
     const entries = Object.entries(object);
@@ -45,37 +43,44 @@ function isBoundedCheckpointJson(value, depth = 0) {
         && entries.every(([key, item]) => key.length <= 128 && isBoundedCheckpointJson(item, depth + 1));
 }
 function normalizeCompactResult(value) {
-    const result = record(value);
+    const result = recordOrNull(value);
     if (!result || !isBoundedCheckpointJson(result))
         return null;
     const keys = Object.keys(result);
     if (keys.length !== COMPACT_RESULT_KEYS.size || keys.some((key) => !COMPACT_RESULT_KEYS.has(key)))
         return null;
-    if (!record(result.availability) || !record(result.diagnostics))
+    if (!recordOrNull(result.availability) || !recordOrNull(result.diagnostics))
         return null;
     return result;
 }
-function normalizeCheckpointResult(value, queries, classifyQuery) {
-    const item = record(value);
+function normalizeCheckpointResult(value, queries, classifyQuery, version = CLI_BULK_CHECKPOINT_VERSION) {
+    const item = recordOrNull(value);
     const index = item?.index;
     if (!Number.isSafeInteger(index) || Number(index) < 0 || Number(index) >= queries.length)
         return null;
     const query = queries[Number(index)];
     if (typeof item?.query !== 'string' || item.query !== query)
         return null;
+    const observedAt = version >= 2
+        ? item.observedAt === null
+            ? null
+            : validTimestamp(item.observedAt) ? new Date(item.observedAt).toISOString() : undefined
+        : null;
+    if (observedAt === undefined)
+        return null;
     if (item.ok === false) {
         if (typeof item.error !== 'string' || !item.error || item.error.length > 300)
             return null;
-        return { index: Number(index), query, ok: false, error: item.error };
+        return { index: Number(index), query, ok: false, error: item.error, observedAt };
     }
     const result = normalizeCompactResult(item.result);
     if (item.ok !== true || !result)
         return null;
     const classified = classifyQuery(query);
-    const storedClassified = record(item.classified);
+    const storedClassified = recordOrNull(item.classified);
     if (storedClassified?.type !== classified.type || storedClassified.value !== classified.value)
         return null;
-    return { index: Number(index), query, ok: true, classified, result };
+    return { index: Number(index), query, ok: true, classified, result, observedAt };
 }
 function parseBulkCheckpoint(text, options) {
     if (typeof text !== 'string' || Buffer.byteLength(text, 'utf8') > MAX_BULK_CHECKPOINT_BYTES) {
@@ -88,10 +93,13 @@ function parseBulkCheckpoint(text, options) {
     catch {
         throw new CliUsageError('Bulk checkpoint must be valid JSON.');
     }
-    const document = record(parsed);
+    const document = recordOrNull(parsed);
     const expectedDigest = checkpointDigest(options.queries, options.deep);
-    if (document?.schema !== CLI_BULK_CHECKPOINT_SCHEMA || document.version !== CLI_BULK_CHECKPOINT_VERSION) {
-        throw new CliUsageError(`Bulk checkpoint must use ${CLI_BULK_CHECKPOINT_SCHEMA} version ${CLI_BULK_CHECKPOINT_VERSION}.`);
+    const version = typeof document?.version === 'number' && Number.isSafeInteger(document.version)
+        ? document.version
+        : 0;
+    if (document?.schema !== CLI_BULK_CHECKPOINT_SCHEMA || !SUPPORTED_BULK_CHECKPOINT_VERSIONS.has(version)) {
+        throw new CliUsageError(`Bulk checkpoint must use ${CLI_BULK_CHECKPOINT_SCHEMA} version 1 or ${CLI_BULK_CHECKPOINT_VERSION}.`);
     }
     if (document.mode !== (options.deep ? 'deep' : 'fast')
         || document.inputDigestSha256 !== expectedDigest
@@ -104,11 +112,11 @@ function parseBulkCheckpoint(text, options) {
     const results = [];
     const seen = new Set();
     for (const candidate of document.results.slice(0, options.queries.length + 1)) {
-        const result = normalizeCheckpointResult(candidate, options.queries, options.classifyQuery);
+        const result = normalizeCheckpointResult(candidate, options.queries, options.classifyQuery, version);
         if (!result || seen.has(result.index))
             throw new CliUsageError('Bulk checkpoint contains an invalid or duplicate result.');
         seen.add(result.index);
-        results.push(result);
+        results.push({ ...result, collectionOrigin: 'resumed_checkpoint' });
     }
     return {
         schema: CLI_BULK_CHECKPOINT_SCHEMA,
@@ -122,16 +130,15 @@ function parseBulkCheckpoint(text, options) {
     };
 }
 async function readCheckpointFile(path) {
-    const handle = await open(path, 'r');
     try {
-        const stats = await handle.stat();
-        if (!stats.isFile() || stats.size > MAX_BULK_CHECKPOINT_BYTES) {
-            throw new CliUsageError(`Bulk checkpoint input is limited to ${MAX_BULK_CHECKPOINT_BYTES} bytes.`);
-        }
-        return await handle.readFile({ encoding: 'utf8' });
+        return await readBoundedRegularTextFile(path, {
+            maximumBytes: MAX_BULK_CHECKPOINT_BYTES,
+            label: 'Bulk checkpoint input',
+            allowSymbolicLink: true,
+        });
     }
-    finally {
-        await handle.close();
+    catch (error) {
+        throw boundedCliInputError(error, 'Bulk checkpoint input');
     }
 }
 async function checkpointFileExists(path) {
@@ -144,11 +151,12 @@ async function checkpointFileExists(path) {
         const code = error && typeof error === 'object' && 'code' in error ? error.code : null;
         if (code === 'ENOENT')
             return false;
-        throw error;
+        throw boundedCliInputError(error, 'Bulk checkpoint input');
     }
 }
 async function createBulkCheckpointWriter(options) {
     const now = options.now || (() => new Date().toISOString());
+    const writeCheckpoint = options.writeFile ?? writePrivateFile;
     const exists = await checkpointFileExists(options.path);
     if (options.resume && !exists)
         throw new CliUsageError('Bulk checkpoint does not exist; remove --resume to start a new checkpoint.');
@@ -159,7 +167,8 @@ async function createBulkCheckpointWriter(options) {
         : null;
     const startedAt = resumed?.startedAt || now();
     const results = new Map((resumed?.results || []).map((item) => [item.index, item]));
-    let chain = Promise.resolve();
+    let activeWrite = null;
+    let dirty = false;
     let writeFailure = null;
     let created = resumed !== null;
     function document() {
@@ -172,19 +181,20 @@ async function createBulkCheckpointWriter(options) {
             queryCount: options.queries.length,
             startedAt,
             updatedAt,
-            results: [...results.values()].sort((left, right) => left.index - right.index),
+            results: [...results.values()]
+                .sort((left, right) => left.index - right.index)
+                .map(({ collectionOrigin: _collectionOrigin, ...result }) => result),
         };
     }
-    function scheduleWrite() {
-        chain = chain.then(async () => {
-            if (writeFailure)
-                return;
+    async function drainWrites() {
+        while (dirty && !writeFailure) {
+            dirty = false;
             try {
                 const content = `${JSON.stringify(document(), null, 2)}\n`;
                 if (Buffer.byteLength(content, 'utf8') > MAX_BULK_CHECKPOINT_BYTES) {
                     throw new CliUsageError(`Bulk checkpoints are limited to ${MAX_BULK_CHECKPOINT_BYTES} bytes.`);
                 }
-                await writePrivateFile(options.path, content, {
+                await writeCheckpoint(options.path, content, {
                     force: created,
                     existingFileMessage: 'Bulk checkpoint already exists; use --resume or choose another path.',
                 });
@@ -193,6 +203,23 @@ async function createBulkCheckpointWriter(options) {
             catch (error) {
                 writeFailure = error;
             }
+        }
+    }
+    function scheduleWrite() {
+        dirty = true;
+        if (activeWrite || writeFailure)
+            return;
+        const pending = drainWrites();
+        activeWrite = pending;
+        void pending.then(() => {
+            if (activeWrite === pending)
+                activeWrite = null;
+            if (dirty && !writeFailure)
+                scheduleWrite();
+        }, (error) => {
+            writeFailure ||= error;
+            if (activeWrite === pending)
+                activeWrite = null;
         });
     }
     if (!resumed)
@@ -200,16 +227,22 @@ async function createBulkCheckpointWriter(options) {
     return Object.freeze({
         initialResults: Object.freeze([...results.values()].sort((left, right) => left.index - right.index)),
         record(result) {
-            const normalized = normalizeCheckpointResult(result, options.queries, options.classifyQuery);
+            const observedAt = validTimestamp(result.observedAt) ? new Date(result.observedAt).toISOString() : now();
+            const normalized = normalizeCheckpointResult({ ...result, observedAt }, options.queries, options.classifyQuery);
             if (!normalized) {
                 writeFailure ||= new CliUsageError('Bulk checkpoint result is not a bounded compact lookup result.');
                 return;
             }
-            results.set(normalized.index, normalized);
+            results.set(normalized.index, { ...normalized, collectionOrigin: 'current_run' });
             scheduleWrite();
         },
         async flush() {
-            await chain;
+            while (activeWrite || dirty) {
+                if (!activeWrite)
+                    scheduleWrite();
+                if (activeWrite)
+                    await activeWrite;
+            }
             if (writeFailure)
                 throw writeFailure;
         },

package/cli/bulk-command-runner.mjs

@@ -8,6 +8,9 @@ import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 import { buildCliBulkDocument, formatJsonDocument, formatJsonLines } from "./formatters/json.mjs";
 import { formatTerminalBulk } from "./formatters/terminal.mjs";
+import { buildCollectionPreflight, formatCollectionPreflight } from "./collection-preflight.mjs";
+import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
+import { formatCliJunit } from "./ci-report.mjs";
 import { createCliProgressEvents } from "./progress-events.mjs";
 async function runBulkCommand(args, dependencies, context) {
     const eventProgress = createCliProgressEvents(context.stderr, {
@@ -23,7 +26,7 @@ async function runBulkCommand(args, dependencies, context) {
             ? await dependencies.readBulkInput(args.source)
             : await readTextStreamBounded(args.source
                 ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                : dependencies.stdin || process.stdin, MAX_BULK_INPUT_BYTES);
+                : dependencies.stdin || process.stdin, MAX_BULK_INPUT_BYTES, dependencies.signal);
     }
     catch (error) {
         if (error instanceof CliUsageError)
@@ -31,6 +34,14 @@ async function runBulkCommand(args, dependencies, context) {
         throw new CliUsageError(`Could not read bulk input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
     }
     const parsed = parseBulkQueries(input, { deep: args.deep });
+    if (args.plan) {
+        const document = buildCollectionPreflight({
+            command: 'bulk', targetCount: parsed.queries.length, targetLimit: args.deep ? 50 : 500,
+            deep: args.deep, concurrency: args.concurrency, output: args.output, checkpoint: false,
+        });
+        context.writeStdout(args.output === 'json' ? formatJsonDocument(document) : context.terminal(formatCollectionPreflight(document), args.color));
+        return EXIT_CODES.SUCCESS;
+    }
     const classify = dependencies.classifyQuery || classifyQuery;
     const checkpointWriter = dependencies.createBulkCheckpointWriter || createBulkCheckpointWriter;
     const checkpoint = args.checkpoint
@@ -45,6 +56,8 @@ async function runBulkCommand(args, dependencies, context) {
         : null;
     const indicator = context.beginProgress(`Collecting 0 of ${parsed.queries.length} targets`);
     let completed = checkpoint?.initialResults.length || 0;
+    const resumedItems = new Map((checkpoint?.initialResults ?? []).map((item) => [item.index, item]));
+    const settledItems = new Map();
     if (completed)
         indicator.update(`Resumed ${completed} of ${parsed.queries.length} targets`);
     let items;
@@ -58,12 +71,23 @@ async function runBulkCommand(args, dependencies, context) {
             ...(checkpoint ? { initialResults: checkpoint.initialResults } : {}),
             ...(dependencies.signal ? { signal: dependencies.signal } : {}),
             onItemSettled: (item) => {
+                const observed = {
+                    ...item,
+                    observedAt: context.now(),
+                    collectionOrigin: 'current_run',
+                };
+                settledItems.set(item.index, observed);
                 completed += 1;
                 indicator.update(`Collected ${completed} of ${parsed.queries.length} targets`);
                 eventProgress.emit({ event: 'item_settled', index: item.index, ok: item.ok });
-                checkpoint?.record(item);
+                checkpoint?.record(observed);
             },
         });
+        items = items.map((item) => resumedItems.get(item.index) ?? settledItems.get(item.index) ?? {
+            ...item,
+            observedAt: null,
+            collectionOrigin: 'current_run',
+        });
     }
     finally {
         context.endProgress();
@@ -82,9 +106,12 @@ async function runBulkCommand(args, dependencies, context) {
         filter: args.filter,
     };
     const selectedItems = selectBulkItems(items, args.filter);
+    const selectedDocument = buildCliBulkDocument(selectedItems, metadata);
     if (!args.quiet) {
         if (args.output === 'json')
-            context.writeStdout(formatJsonDocument(buildCliBulkDocument(selectedItems, metadata)));
+            context.writeStdout(formatJsonDocument(selectedDocument));
+        else if (args.output === 'junit')
+            context.writeStdout(formatCliJunit(selectedDocument));
         else if (args.output === 'jsonl')
             context.writeStdout(formatJsonLines(selectedItems, metadata));
         else if (args.output === 'csv')
@@ -102,7 +129,10 @@ async function runBulkCommand(args, dependencies, context) {
             context.writeStderr(`Checkpoint warning: ${boundedCliErrorMessage(checkpointFailure, 'Checkpoint could not be written')}. Completed output is still available.\n`);
         }
     }
-    const exitCode = checkpointFailure || items.some((item) => !item.ok)
+    const policyFindings = evaluateCliFailPolicies(buildCliBulkDocument(items, { ...metadata, filter: 'all' }), args.failOn || []);
+    if (policyFindings.length && !eventProgress.enabled)
+        context.writeStderr(formatFailPolicyNotice(policyFindings));
+    const exitCode = checkpointFailure || items.some((item) => !item.ok) || policyFindings.length
         ? EXIT_CODES.PARTIAL_FAILURE
         : EXIT_CODES.SUCCESS;
     eventProgress.emit({ event: 'completed', exitCode });

package/cli/bulk.mjs

@@ -3,17 +3,28 @@ import { abortable } from "../lib/abort.mjs";
 import { CliUsageError } from "./arguments.mjs";
 import { MAX_DEEP_BULK_QUERIES, MAX_FAST_BULK_QUERIES, } from "../lib/bulk-limits.mjs";
 const MAX_BULK_INPUT_BYTES = 1024 * 1024;
-async function readTextStreamBounded(stream, limit = MAX_BULK_INPUT_BYTES) {
+async function readTextStreamBounded(stream, limit = MAX_BULK_INPUT_BYTES, signal) {
     if (!stream || stream.isTTY)
         return '';
+    const abort = () => stream.destroy?.(new DOMException('Aborted', 'AbortError'));
+    if (signal?.aborted)
+        throw new DOMException('Aborted', 'AbortError');
+    signal?.addEventListener('abort', abort, { once: true });
     const chunks = [];
     let total = 0;
-    for await (const chunk of stream) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        total += buffer.length;
-        if (total > limit)
-            throw new CliUsageError(`Bulk input is limited to ${limit} bytes.`);
-        chunks.push(buffer);
+    try {
+        for await (const chunk of stream) {
+            if (signal?.aborted)
+                throw new DOMException('Aborted', 'AbortError');
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            total += buffer.length;
+            if (total > limit)
+                throw new CliUsageError(`Bulk input is limited to ${limit} bytes.`);
+            chunks.push(buffer);
+        }
+    }
+    finally {
+        signal?.removeEventListener('abort', abort);
     }
     return Buffer.concat(chunks).toString('utf8');
 }

package/cli/case-pack.mjs

@@ -0,0 +1,136 @@
+import { createHash } from 'node:crypto';
+import { Buffer } from 'node:buffer';
+import { canonicalArtifactJson } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { buildCaseReport } from "../frontend/src/lib/analysis/case-report.js";
+import { CASE_IMPORT_VERSIONS, MAX_CASE_IMPORT_BYTES, CASE_SCHEMA_VERSION, normalizeCaseStore, } from "../frontend/src/lib/analysis/case-model.js";
+import { CliUsageError } from "./errors.mjs";
+export const CLI_CASE_PACK_SCHEMA = 'whoisleuth.cli.case-pack';
+export const CLI_CASE_PACK_VERSION = 1;
+export const MAX_CASE_PACK_INPUT_BYTES = 4 * 1024 * 1024;
+export const MAX_CASE_PACK_CASES = 25;
+function redactedCase(record, audience) {
+    if (audience === 'internal')
+        return structuredClone(record);
+    return {
+        ...structuredClone(record),
+        notes: [],
+        actions: audience === 'public' ? [] : record.actions.map((item) => ({ ...item, recipient: '[redacted]' })),
+        manualTrail: record.manualTrail.map((item) => ({ ...item, target: null })),
+        assertions: audience === 'public' ? [] : structuredClone(record.assertions),
+    };
+}
+export function buildCliCasePack(input, options, generatedAt = new Date().toISOString()) {
+    if (!options.reviewed)
+        throw new CliUsageError('case-pack requires --reviewed after the audience-specific output has been checked.');
+    if (Buffer.byteLength(input, 'utf8') > MAX_CASE_PACK_INPUT_BYTES)
+        throw new CliUsageError('Case-pack input is limited to 4 MiB.');
+    let parsed;
+    try {
+        parsed = JSON.parse(input.replace(/^\uFEFF/u, ''));
+    }
+    catch {
+        throw new CliUsageError('Case-pack input must be valid JSON.');
+    }
+    const root = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    if (typeof root.version !== 'number' || !CASE_IMPORT_VERSIONS.includes(root.version) || !Array.isArray(root.cases)) {
+        throw new CliUsageError(`Case-pack input must be a supported WHOISleuth case export through schema ${CASE_SCHEMA_VERSION}.`);
+    }
+    const normalised = normalizeCaseStore(root).cases;
+    if (!normalised.length)
+        throw new CliUsageError('Case-pack input did not contain a valid case.');
+    if (normalised.length !== root.cases.length) {
+        throw new CliUsageError('Case-pack input contains an invalid or duplicate case. Correct the browser export before packaging it.');
+    }
+    if (normalised.length > MAX_CASE_PACK_CASES) {
+        throw new CliUsageError(`Case packs are limited to ${MAX_CASE_PACK_CASES} reviewed cases. Export a smaller selected set so no case is silently omitted.`);
+    }
+    const cases = normalised.map((item) => redactedCase(item, options.audience));
+    const reports = cases.map((item) => buildCaseReport(item, { includeNotes: false, generatedAt }).json);
+    const exclusions = options.audience === 'internal'
+        ? ['Raw upstream payloads and credentials are outside the case schema.']
+        : options.audience === 'trusted'
+            ? ['Case notes', 'Recipient values', 'Manual trail targets', 'Raw upstream payloads and credentials']
+            : ['Case notes', 'Actions and recipient values', 'Analyst assertions', 'Manual trail targets', 'Raw upstream payloads and credentials'];
+    const packet = Object.freeze({
+        schema: CLI_CASE_PACK_SCHEMA,
+        version: CLI_CASE_PACK_VERSION,
+        audience: options.audience,
+        reviewed: true,
+        reports: Object.freeze(reports),
+        redactionManifest: Object.freeze({ excluded: Object.freeze(exclusions), sourceCaseCount: normalised.length }),
+        limitations: Object.freeze([
+            'This local package is browser-importable through its top-level case collection and does not upload or submit evidence.',
+            'The reviewed flag records a deliberate CLI choice; it does not prove recipient authorisation, factual correctness, or legal sufficiency.',
+            'Importing the package does not restore fields excluded by its audience profile.',
+        ]),
+    });
+    const unsigned = { version: CASE_SCHEMA_VERSION, exportedAt: generatedAt, cases, packet };
+    const document = Object.freeze({
+        ...unsigned,
+        integrity: Object.freeze({
+            algorithm: 'SHA-256',
+            canonicalization: 'sorted-json-v1',
+            digestSha256: `sha256:${createHash('sha256').update(canonicalArtifactJson(unsigned)).digest('hex')}`,
+        }),
+    });
+    if (Buffer.byteLength(JSON.stringify(document), 'utf8') > MAX_CASE_IMPORT_BYTES) {
+        throw new CliUsageError('The generated case pack exceeds the browser 2 MiB import limit. Select fewer cases or a more restrictive audience so no evidence is silently omitted.');
+    }
+    return document;
+}
+export function verifyCliCasePack(input) {
+    const root = input && typeof input === 'object' && !Array.isArray(input)
+        ? input
+        : null;
+    const packet = root?.packet && typeof root.packet === 'object' && !Array.isArray(root.packet)
+        ? root.packet
+        : null;
+    const integrity = root?.integrity && typeof root.integrity === 'object' && !Array.isArray(root.integrity)
+        ? root.integrity
+        : null;
+    if (!root
+        || !packet
+        || packet.schema !== CLI_CASE_PACK_SCHEMA
+        || packet.version !== CLI_CASE_PACK_VERSION
+        || packet.reviewed !== true
+        || !['internal', 'public', 'trusted'].includes(String(packet.audience))
+        || !Array.isArray(packet.reports)
+        || !Array.isArray(root.cases)
+        || root.cases.length < 1
+        || root.cases.length > MAX_CASE_PACK_CASES
+        || packet.reports.length !== root.cases.length
+        || typeof root.version !== 'number'
+        || !CASE_IMPORT_VERSIONS.includes(root.version)
+        || !integrity
+        || integrity.algorithm !== 'SHA-256'
+        || integrity.canonicalization !== 'sorted-json-v1'
+        || typeof integrity.digestSha256 !== 'string'
+        || !/^sha256:[a-f0-9]{64}$/u.test(integrity.digestSha256)) {
+        throw new TypeError('The CLI case pack structure or integrity envelope is invalid.');
+    }
+    if (Buffer.byteLength(JSON.stringify(root), 'utf8') > MAX_CASE_IMPORT_BYTES) {
+        throw new TypeError('The CLI case pack exceeds the browser import limit.');
+    }
+    const { integrity: _integrity, ...unsigned } = root;
+    const calculated = `sha256:${createHash('sha256').update(canonicalArtifactJson(unsigned)).digest('hex')}`;
+    if (calculated !== integrity.digestSha256) {
+        throw new TypeError('The CLI case pack failed its SHA-256 integrity check.');
+    }
+    const normalised = normalizeCaseStore(root).cases;
+    if (normalised.length !== root.cases.length) {
+        throw new TypeError('The CLI case pack contains an invalid case collection.');
+    }
+    return Object.freeze({ caseCount: normalised.length });
+}
+export function formatCliCasePack(document) {
+    return [
+        'Reviewed case pack',
+        `Audience   ${document.packet.audience}`,
+        `Cases      ${document.cases.length}`,
+        `Reports    ${document.packet.reports.length}`,
+        `Digest     ${document.integrity.digestSha256}`,
+        '',
+        ...document.packet.redactionManifest.excluded.map((item) => `Excluded: ${item}`),
+        '',
+    ].join('\n');
+}

package/cli/ci-report.mjs

@@ -0,0 +1,73 @@
+import { WHOISLEUTH_REQUEST_POLICY_URL } from "../lib/project-metadata.mjs";
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function xml(value) {
+    return String(value).replace(/&/gu, '&amp;').replace(/</gu, '&lt;').replace(/>/gu, '&gt;').replace(/"/gu, '&quot;').replace(/'/gu, '&apos;');
+}
+function junitCases(document) {
+    const schema = String(document.schema || '');
+    if (schema === 'whoisleuth.cli.lookup') {
+        const diagnostics = record(document.diagnostics);
+        const cases = Object.entries(diagnostics).slice(0, 64).map(([source, value]) => {
+            const state = String(record(value).status ?? record(value).state ?? 'unavailable').toLowerCase();
+            return ['error', 'failed', 'partial', 'rate_limited', 'timeout', 'unavailable'].includes(state)
+                ? { name: `source ${source}`, failure: `Source state: ${state}` }
+                : { name: `source ${source}` };
+        });
+        return cases.length ? cases : [{ name: 'lookup diagnostics', failure: 'No source diagnostics were available.' }];
+    }
+    if (schema === 'whoisleuth.cli.bulk') {
+        const summary = record(document.summary);
+        const failed = Number(summary.failed ?? 0);
+        const results = Array.isArray(document.results) ? document.results.map(record) : [];
+        const inconclusive = results.filter((item) => ['unknown', 'inconclusive', 'partial', 'unavailable'].includes(String(record(item.availability).state || '').toLowerCase())).length;
+        return [
+            failed ? { name: 'collection failures', failure: `${failed} target collection(s) failed.` } : { name: 'collection failures' },
+            inconclusive ? { name: 'authority conclusions', failure: `${inconclusive} target state(s) remained inconclusive.` } : { name: 'authority conclusions' },
+        ];
+    }
+    if (schema === 'whoisleuth.cli.domain-control-monitor') {
+        const collection = record(document.collection);
+        const summary = record(record(document.flightRecorder).summary);
+        const failed = Number(collection.failed ?? 0);
+        const drift = Number(summary.unexpectedChanges ?? 0);
+        return [
+            failed ? { name: 'domain control collection', failure: `${failed} owned-domain collection(s) failed.` } : { name: 'domain control collection' },
+            drift ? { name: 'unexpected domain control changes', failure: `${drift} complete observation change(s) require review.` } : { name: 'unexpected domain control changes' },
+        ];
+    }
+    return [{ name: 'WHOISleuth result', failure: 'Unsupported document for JUnit conversion.' }];
+}
+export function formatCliJunit(document) {
+    const cases = junitCases(record(document));
+    const failures = cases.filter((item) => item.failure).length;
+    return `<?xml version="1.0" encoding="UTF-8"?>\n<testsuite name="WHOISleuth" tests="${cases.length}" failures="${failures}">\n${cases.map((item) => `  <testcase classname="whoisleuth" name="${xml(item.name)}">${item.failure ? `<failure message="${xml(item.failure)}" />` : ''}</testcase>`).join('\n')}\n</testsuite>\n`;
+}
+export function buildPostureSarif(document) {
+    const root = record(document);
+    const checks = Array.isArray(root.checks) ? root.checks.map(record).slice(0, 64) : [];
+    const actionable = checks.filter((item) => ['warning', 'danger'].includes(String(item.status).toLowerCase()));
+    const rules = actionable.map((item) => ({
+        id: `WHOISLEUTH-${String(item.id || 'posture').replace(/[^a-z0-9_-]/giu, '-').slice(0, 64)}`,
+        shortDescription: { text: String(item.label || 'Domain posture finding').slice(0, 200) },
+        help: { text: String(item.remediation || item.detail || 'Review this owned-domain posture finding.').slice(0, 1000) },
+    }));
+    return Object.freeze({
+        version: '2.1.0',
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        runs: [Object.freeze({
+                tool: { driver: { name: 'WHOISleuth', informationUri: WHOISLEUTH_REQUEST_POLICY_URL, rules } },
+                results: actionable.map((item) => ({
+                    ruleId: `WHOISLEUTH-${String(item.id || 'posture').replace(/[^a-z0-9_-]/giu, '-').slice(0, 64)}`,
+                    level: String(item.status).toLowerCase() === 'danger' ? 'error' : 'warning',
+                    message: { text: `${String(item.summary || item.label || 'Posture finding').slice(0, 500)}${item.remediation ? ` Next: ${String(item.remediation).slice(0, 500)}` : ''}` },
+                })),
+                properties: {
+                    ownedDomainConfirmed: true,
+                    generatedAt: typeof root.generatedAt === 'string' ? root.generatedAt : null,
+                    evidenceBoundary: 'Passive owned-domain DNS posture; raw records and contact data omitted from SARIF.',
+                },
+            })],
+    });
+}