@slicedearth/whoisleuth-cli 1.39.1 → 1.45.0

package/cli/lookup-command-runner.mjs

@@ -11,6 +11,8 @@ import { formatTerminalLookup } from "./formatters/terminal.mjs";
 import { buildCliLookupPlan, formatCliLookupPlan } from "./lookup-plan.mjs";
 import { createCliProgressEvents } from "./progress-events.mjs";
 import { lookupStrictExitFindings } from "./strict-exit.mjs";
+import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
+import { formatCliJunit } from "./ci-report.mjs";
 async function runLookupCommand(args, dependencies, context) {
     const eventProgress = createCliProgressEvents(context.stderr, {
         command: 'lookup',
@@ -75,6 +77,8 @@ async function runLookupCommand(args, dependencies, context) {
     if (!args.quiet) {
         if (args.output === 'json')
             context.writeStdout(formatJsonDocument(document));
+        else if (args.output === 'junit')
+            context.writeStdout(formatCliJunit(document));
         else if (args.output === 'markdown' || args.output === 'html') {
             const loadEvidence = dependencies.loadEvidenceExport || (() => import("../lib/evidence-export.mjs"));
             const evidenceModule = await loadEvidence();
@@ -88,10 +92,13 @@ async function runLookupCommand(args, dependencies, context) {
         }
     }
     const strictFindings = args.strictExit ? lookupStrictExitFindings(document) : [];
-    const exitCode = strictFindings.length ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+    const policyFindings = evaluateCliFailPolicies(document, args.failOn || []);
+    const exitCode = strictFindings.length || policyFindings.length ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
     if (strictFindings.length && !args.events) {
         context.writeStderr(`Strict exit: ${strictFindings.length} requested source state${strictFindings.length === 1 ? '' : 's'} were incomplete.\n`);
     }
+    if (policyFindings.length && !args.events)
+        context.writeStderr(formatFailPolicyNotice(policyFindings));
     eventProgress.emit({ event: 'completed', exitCode });
     return exitCode;
 }

package/cli/lookup-diff.mjs

@@ -1,13 +1,11 @@
 import { buildBulkComparisonEvidence } from "../lib/bulk-comparison-evidence.mjs";
+import { recordOrEmpty } from "../lib/bounded-contract-normalizers.mjs";
 import { buildBulkDomainComparison, } from "../frontend/src/lib/analysis/bulk-domain-comparison.js";
 import { relationshipObservation } from "../frontend/src/lib/analysis/relationship-evidence.js";
 import { CliUsageError } from "./errors.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
 export const CLI_LOOKUP_DIFF_SCHEMA = 'whoisleuth.cli.lookup-diff';
 export const CLI_LOOKUP_DIFF_VERSION = 1;
-function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-}
 function text(value, maximum = 300) {
     if (typeof value !== 'string')
         return null;
@@ -23,14 +21,14 @@ function stringList(value, maximum = 100) {
         }))].slice(0, maximum);
 }
 function lifecycleValue(parsed, field) {
-    const lifecycle = record(parsed.lifecycle);
+    const lifecycle = recordOrEmpty(parsed.lifecycle);
     return text(lifecycle[`${field}Iso`] ?? lifecycle[field] ?? parsed[`${field}Iso`] ?? parsed[field], 64);
 }
 function registrarLabel(parsed) {
     const registrar = parsed.registrar;
     if (typeof registrar === 'string')
         return text(registrar);
-    const source = record(registrar);
+    const source = recordOrEmpty(registrar);
     return text(source.name ?? source.org ?? source.handle);
 }
 function sourceState(value) {
@@ -50,25 +48,25 @@ function sourceState(value) {
     return 'unavailable';
 }
 function sourceCoverage(document, availability) {
-    const diagnostics = record(document.diagnostics);
+    const diagnostics = recordOrEmpty(document.diagnostics);
     const entries = [
-        ['rdap', record(diagnostics.rdap).status],
-        ['whois', record(diagnostics.whois).status],
-        ['availability', record(diagnostics.availability).status],
-        ['dns', record(availability.dns).status],
-        ['http', record(availability.http).status],
-        ['tls', record(availability.tls).status],
+        ['rdap', recordOrEmpty(diagnostics.rdap).status],
+        ['whois', recordOrEmpty(diagnostics.whois).status],
+        ['availability', recordOrEmpty(diagnostics.availability).status],
+        ['dns', recordOrEmpty(availability.dns).status],
+        ['http', recordOrEmpty(availability.http).status],
+        ['tls', recordOrEmpty(availability.tls).status],
     ];
     return entries.map(([source, status]) => ({ source, state: sourceState(status) }));
 }
 function lookupComparisonInput(document) {
-    const availability = record(document.availability);
-    const rdapParsed = record(record(document.rdap).parsed);
-    const whoisParsed = record(record(document.whois).parsed);
+    const availability = recordOrEmpty(document.availability);
+    const rdapParsed = recordOrEmpty(recordOrEmpty(document.rdap).parsed);
+    const whoisParsed = recordOrEmpty(recordOrEmpty(document.whois).parsed);
     const preferredRegistry = Object.keys(rdapParsed).length ? rdapParsed : whoisParsed;
     const relationship = relationshipObservation(availability);
-    const dns = record(availability.dns);
-    const dnsRecords = record(dns.records);
+    const dns = recordOrEmpty(availability.dns);
+    const dnsRecords = recordOrEmpty(dns.records);
     const comparisonEvidence = buildBulkComparisonEvidence(availability);
     return {
         domain: document.registrableDomain,
@@ -97,8 +95,8 @@ function lookupComparisonInput(document) {
         faviconMatch: false,
         faviconNearMatch: false,
         reusesOfficialAssets: false,
-        hasPasswordField: record(record(availability.credentialSurfaceProfile).inputs).categories
-            ? Number(record(record(record(availability.credentialSurfaceProfile).inputs).categories).password) > 0
+        hasPasswordField: recordOrEmpty(recordOrEmpty(availability.credentialSurfaceProfile).inputs).categories
+            ? Number(recordOrEmpty(recordOrEmpty(recordOrEmpty(availability.credentialSurfaceProfile).inputs).categories).password) > 0
             : false,
         hasExternalFormAction: null,
         phishingLanguageMatch: null,

package/cli/lookup-reconcile.mjs

@@ -37,7 +37,7 @@ function buildCliLookupReconciliation(inputs, generatedAt = new Date().toISOStri
         label: `Lookup reconciliation observation ${index + 1}`,
     }));
     const domain = documents[0]?.registrableDomain;
-    if (!domain || documents.some((document) => document.registrableDomain !== domain)) {
+    if (!domain || documents.some((candidate) => candidate.registrableDomain !== domain)) {
         throw new CliUsageError('Lookup reconciliation requires observations for one domain.');
     }
     const comparisons = documents.slice(1).map((document, index) => buildCliLookupDiff(inputs[0], inputs[index + 1], generatedAt, { domainMode: 'same' }));

package/cli/mail-review.mjs

@@ -128,14 +128,14 @@ function parseInput(textValue) {
     try {
         const parsed = JSON.parse(textInput);
         const document = record(parsed);
-        if (document.schema === 'whoisleuth.cli.bulk' && document.version === 2 && Array.isArray(document.results)) {
+        if (document.schema === 'whoisleuth.cli.bulk' && [2, 3].includes(Number(document.version)) && Array.isArray(document.results)) {
             values = document.results;
         }
-        else if (document.schema === 'whoisleuth.cli.bulk.item' && document.version === 2) {
+        else if (document.schema === 'whoisleuth.cli.bulk.item' && [2, 3].includes(Number(document.version))) {
             values = [document];
         }
         else {
-            throw new CliUsageError('Mail review requires WHOISleuth Bulk JSON schema version 2.');
+            throw new CliUsageError('Mail review requires WHOISleuth Bulk JSON schema version 2 or 3.');
         }
     }
     catch (error) {
@@ -152,8 +152,8 @@ function parseInput(textValue) {
         throw new CliUsageError(`Mail review supports between 1 and ${MAX_MAIL_REVIEW_ROWS} Bulk rows.`);
     }
     const rows = values.map((value) => record(value));
-    if (rows.some((value) => value.schema !== 'whoisleuth.cli.bulk.item' || value.version !== 2)) {
-        throw new CliUsageError('Every Mail review row must use WHOISleuth Bulk item schema version 2.');
+    if (rows.some((value) => value.schema !== 'whoisleuth.cli.bulk.item' || ![2, 3].includes(Number(value.version)))) {
+        throw new CliUsageError('Every Mail review row must use WHOISleuth Bulk item schema version 2 or 3.');
     }
     return rows;
 }

package/cli/manual.mjs

@@ -23,7 +23,7 @@ ${commands}
 .SH OUTPUT
 Human-readable output is the default. Versioned JSON and JSONL are available where documented. Diagnostics and optional progress events are written to standard error. Use --output with an optional --force flag for atomic private file output.
 .SH EXIT STATUS
-0 indicates command completion, 2 invalid usage, 3 a collection or comparison failure, 4 an explicitly detected partial result, 70 an internal bootstrap failure, and 130 analyst cancellation.
+0 indicates command completion, 2 invalid usage, 3 a collection or comparison failure, 4 an explicitly detected partial result, 70 an internal bootstrap failure, 130 analyst cancellation, and 143 service termination.
 .SH PRIVACY
 Network commands disclose the target to the directly queried upstream services. Offline commands do not make network requests. Output files are created with private permissions and are never uploaded by the CLI.
 .SH LICENSE

package/cli/network-command-runner.mjs

@@ -8,6 +8,7 @@ import { formatTerminalCtSearch, formatTerminalHttp, formatTerminalPosture, form
 import { buildHttpProbeResult } from "./http.mjs";
 import { normalizePostureSelectors } from "./posture.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
+import { buildPostureSarif } from "./ci-report.mjs";
 async function runNetworkCommand(args, dependencies, context) {
     if (args.action === 'ct-search') {
         const keyword = args.keyword || await context.readSingleInput();
@@ -46,7 +47,9 @@ async function runNetworkCommand(args, dependencies, context) {
         if (!args.quiet) {
             context.writeStdout(args.output === 'json'
                 ? formatJsonDocument(document)
-                : context.terminal(formatTerminalPosture(document), args.color));
+                : args.output === 'sarif'
+                    ? formatJsonDocument(buildPostureSarif(document))
+                    : context.terminal(formatTerminalPosture(document), args.color));
         }
         return EXIT_CODES.SUCCESS;
     }

package/cli/offline-evidence-review.mjs

@@ -1,10 +1,16 @@
 import { Buffer } from 'node:buffer';
 import { normalizeEncryptedDnsAdapter, planEncryptedDnsQuery, } from "../lib/encrypted-dns-contract.mjs";
 import { validateDnssecEvidence } from "../lib/dnssec-evidence-validation.mjs";
+import { reviewDomainChange } from "../lib/domain-change-review.mjs";
+import { reviewDomainPortfolio } from "../lib/domain-portfolio-review.mjs";
+import { reviewNameserverPreflight } from "../lib/nameserver-preflight-review.mjs";
 import { buildLocalGeoIpDatabase, lookupLocalGeoIp, } from "../lib/local-geoip-evidence.mjs";
-import { normalizeRdapSearchHelp, planRdapReverseSearch, } from "../lib/rdap-search-workbench.mjs";
+import { inspectRdapReverseSearchResponse, normalizeRdapSearchHelp, planRdapReverseSearch, } from "../lib/rdap-search-workbench.mjs";
 import { reviewRpkiRoute } from "../lib/rpki-evidence.mjs";
 import { analyzeTlsaEvidence } from "../lib/tlsa-evidence.mjs";
+import { reviewZoneIntent } from "../lib/zone-intent-review.mjs";
+import { reviewDnsConvergence } from "../lib/dns-convergence-review.mjs";
+import { compareTrustStoreEvidence } from "../lib/trust-store-comparison.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { LOCAL_MMDB_QUERY_SCHEMA, reviewLocalMmdb } from "./local-mmdb-review.mjs";
 const OFFLINE_EVIDENCE_REVIEW_SCHEMA = 'whoisleuth.cli.offline-evidence-review';
@@ -38,14 +44,18 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
         kind = 'rdap_search';
         const request = record(input.request);
         const help = normalizeRdapSearchHelp(input.help);
+        const plan = planRdapReverseSearch(help, {
+            searchableResourceType: String(request.searchableResourceType ?? ''),
+            relatedResourceType: String(request.relatedResourceType ?? ''),
+            property: String(request.property ?? ''),
+            value: request.value,
+        });
         result = Object.freeze({
             help,
-            plan: planRdapReverseSearch(help, {
-                searchableResourceType: String(request.searchableResourceType ?? ''),
-                relatedResourceType: String(request.relatedResourceType ?? ''),
-                property: String(request.property ?? ''),
-                value: request.value,
-            }),
+            plan,
+            responseInspection: input.response === undefined
+                ? null
+                : inspectRdapReverseSearchResponse(input.response, [request.property]),
         });
     }
     else if (input.schema === 'whoisleuth.dnssec-evidence-input') {
@@ -88,6 +98,30 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
         const query = record(input.query);
         result = planEncryptedDnsQuery(normalizeEncryptedDnsAdapter(input.adapter), { name: query.name, type: query.type });
     }
+    else if (input.schema === 'whoisleuth.zone-intent.input') {
+        kind = 'zone_intent';
+        result = reviewZoneIntent(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.domain-portfolio.input') {
+        kind = 'domain_portfolio';
+        result = reviewDomainPortfolio(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.domain-change.input') {
+        kind = 'domain_change';
+        result = reviewDomainChange(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.dns-convergence.input') {
+        kind = 'dns_convergence';
+        result = reviewDnsConvergence(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.nameserver-preflight.input') {
+        kind = 'nameserver_preflight';
+        result = reviewNameserverPreflight(input, generatedAt);
+    }
+    else if (input.schema === 'whoisleuth.trust-store-comparison.input') {
+        kind = 'trust_store';
+        result = compareTrustStoreEvidence(input, generatedAt);
+    }
     else {
         throw new CliUsageError('Offline evidence review does not recognise this input schema.');
     }
@@ -121,7 +155,20 @@ async function buildOfflineEvidenceReviewWithLocalResources(value, generatedAt =
 }
 function formatOfflineEvidenceReview(document) {
     const result = record(document.result);
-    const state = typeof result.state === 'string' ? result.state : 'reviewed';
+    const gate = record(result.gate);
+    const counts = record(result.counts);
+    const count = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : 0;
+    const listLength = (value) => Array.isArray(value) ? value.length : 0;
+    const state = typeof result.state === 'string'
+        ? result.state
+        : document.kind === 'zone_intent'
+            ? result.complete === true
+                && ['different', 'missing', 'unexpected', 'incomplete'].every((key) => count(counts[key]) === 0)
+                ? 'aligned'
+                : 'review'
+            : typeof gate.pass === 'boolean'
+                ? gate.pass ? 'ready' : 'review'
+                : document.kind === 'domain_portfolio' ? 'inventory' : 'reviewed';
     const lines = [
         'Offline evidence review',
         `Kind   ${document.kind.replaceAll('_', ' ')}`,
@@ -130,8 +177,48 @@ function formatOfflineEvidenceReview(document) {
     if (document.kind === 'rdap_search') {
         const help = record(result.help);
         const plan = record(result.plan);
+        const responseInspection = record(result.responseInspection);
         lines.push(`Help   ${String(help.state ?? 'unavailable').replaceAll('_', ' ')}`);
         lines.push(`Plan   ${String(plan.state ?? 'unavailable').replaceAll('_', ' ')}`);
+        if (result.responseInspection !== null)
+            lines.push(`Result ${String(responseInspection.state ?? 'invalid').replaceAll('_', ' ')}`);
+    }
+    else if (document.kind === 'zone_intent') {
+        const desired = record(result.desired);
+        lines.push(`Desired ${listLength(desired.records)}`);
+        lines.push(`Compared ${listLength(result.comparisons)}`);
+        lines.push(`Aligned ${count(counts.aligned)}`);
+        lines.push(`Changed ${count(counts.different) + count(counts.missing) + count(counts.unexpected)}`);
+        lines.push(`Partial ${count(counts.incomplete)}`);
+        lines.push(`Rejected ${listLength(desired.rejected)}`);
+    }
+    else if (document.kind === 'domain_change') {
+        lines.push(`Authority ${listLength(result.authoritativeRecordMatrix)} rows`);
+        lines.push(`Resolvers ${listLength(result.resolverDivergenceMatrix)} rows`);
+    }
+    else if (document.kind === 'dns_convergence') {
+        lines.push(`Observers ${listLength(result.observers)}`);
+        lines.push(`Snapshots ${listLength(result.snapshots)}`);
+        lines.push(`Record sets ${listLength(result.rows)}`);
+    }
+    else if (document.kind === 'nameserver_preflight') {
+        const rows = Array.isArray(result.rows) ? result.rows : [];
+        lines.push(`Servers ${rows.length}`);
+        lines.push(`Ready  ${rows.filter((item) => record(item).ready === true).length}`);
+    }
+    else if (document.kind === 'trust_store') {
+        lines.push(`Stores ${count(counts.stores)}`);
+        lines.push(`Matched ${count(counts.anchorObserved)}`);
+        lines.push(`Not observed ${count(counts.notObserved)}`);
+        lines.push(`Inconclusive ${count(counts.inconclusive)}`);
+    }
+    else if (document.kind === 'domain_portfolio') {
+        const unknownCounts = record(result.unknownCounts);
+        lines.push(`Assets ${listLength(result.assets)}`);
+        lines.push(`Dependencies ${listLength(result.simulations)}`);
+        lines.push(`Renewals ${listLength(result.renewalQueue)}`);
+        lines.push(`Recovery ${listLength(result.recoveryCycles)}`);
+        lines.push(`Unknown ${Object.values(unknownCounts).reduce((total, value) => total + count(value), 0)}`);
     }
     else {
         for (const [label, key] of [
@@ -146,6 +233,16 @@ function formatOfflineEvidenceReview(document) {
                 lines.push(`${label.padEnd(7)}${candidate}`);
         }
     }
+    const reasons = Array.isArray(gate.reasons) ? gate.reasons : [];
+    if (reasons.length) {
+        lines.push('', 'Review reasons:');
+        for (const reason of reasons.slice(0, 8)) {
+            if (typeof reason === 'string')
+                lines.push(`  - ${reason.replace(/[\u0000-\u001f\u007f]+/gu, ' ').trim().slice(0, 240)}`);
+        }
+        if (reasons.length > 8)
+            lines.push(`  - ${reasons.length - 8} more reason(s) omitted.`);
+    }
     lines.push('', 'Limitations:');
     for (const limitation of document.limitations)
         lines.push(`  - ${limitation}`);

package/cli/open-asset-model-bridge.mjs

@@ -0,0 +1,169 @@
+import { isIP } from 'node:net';
+import { parseExternalFindingsDocument, } from "../frontend/src/lib/analysis/external-findings-import.js";
+import { requireIsoTimestamp } from "../lib/bounded-contract-normalizers.mjs";
+export const OPEN_ASSET_MODEL_BRIDGE_SCHEMA = 'whoisleuth.open-asset-model-bridge';
+export const OPEN_ASSET_MODEL_BRIDGE_VERSION = 1;
+const SHA256_RE = /^[a-f0-9]{64}$/u;
+function fqdnId(domain) {
+    return `FQDN/${domain}`;
+}
+function certificateId(digest) {
+    return `TLSCertificate/sha256:${digest}`;
+}
+function ipId(address) {
+    return `IPAddress/${address}`;
+}
+function earlier(left, right) {
+    return left.localeCompare(right) <= 0 ? left : right;
+}
+function later(left, right) {
+    return left.localeCompare(right) >= 0 ? left : right;
+}
+function combinedCompleteness(left, right) {
+    return left === right ? right : 'partial';
+}
+function setObservedAsset(assets, key, value, observedAt, completeness) {
+    const existing = assets.get(key);
+    const existingDiscovery = existing?.discovery && typeof existing.discovery === 'object'
+        ? existing.discovery
+        : null;
+    if (!existing || !existingDiscovery || typeof existingDiscovery.observed_at !== 'string') {
+        assets.set(key, value);
+        return;
+    }
+    assets.set(key, {
+        ...existing,
+        discovery: {
+            ...existingDiscovery,
+            observed_at: later(existingDiscovery.observed_at, observedAt),
+            completeness: combinedCompleteness(existingDiscovery.completeness, completeness),
+        },
+    });
+}
+function setObservedRelation(relations, key, value, observedAt, completeness) {
+    const existing = relations.get(key);
+    const existingDiscovery = existing?.discovery && typeof existing.discovery === 'object'
+        ? existing.discovery
+        : null;
+    if (!existing
+        || typeof existing.created_at !== 'string'
+        || typeof existing.last_seen !== 'string'
+        || !existingDiscovery) {
+        relations.set(key, value);
+        return;
+    }
+    relations.set(key, {
+        ...existing,
+        created_at: earlier(existing.created_at, observedAt),
+        last_seen: later(existing.last_seen, observedAt),
+        discovery: {
+            ...existingDiscovery,
+            completeness: combinedCompleteness(existingDiscovery.completeness, completeness),
+        },
+    });
+}
+export function buildOpenAssetModelBridge(input, generatedAtValue = new Date().toISOString()) {
+    const document = parseExternalFindingsDocument(input);
+    const generatedAt = requireIsoTimestamp(generatedAtValue, 'generatedAt');
+    const assets = new Map();
+    const relations = new Map();
+    for (const finding of document.findings) {
+        const domainAssetId = fqdnId(finding.domain);
+        setObservedAsset(assets, domainAssetId, {
+            key: domainAssetId,
+            type: 'FQDN',
+            attributes: { name: finding.domain },
+            discovery: { source: document.source.name, observed_at: finding.observedAt, completeness: finding.completeness },
+        }, finding.observedAt, finding.completeness);
+        const observation = finding.structuredObservation;
+        if (!observation)
+            continue;
+        if (observation.sourceSchema === 'whoisleuth.certificate-observation-rows'
+            && (observation.field === 'certificateSha256' || observation.field === 'fingerprintSha256')) {
+            const digest = observation.value.toLowerCase();
+            if (!SHA256_RE.test(digest))
+                throw new TypeError('Certificate bridge observations require a SHA-256 hexadecimal digest.');
+            const certificateAssetId = certificateId(digest);
+            setObservedAsset(assets, certificateAssetId, {
+                key: certificateAssetId,
+                type: 'TLSCertificate',
+                attributes: {
+                    sha256: digest,
+                    issuer_common_name: observation.issuer,
+                    not_after: observation.notAfter,
+                },
+                discovery: { source: document.source.name, observed_at: finding.observedAt, completeness: finding.completeness },
+            }, finding.observedAt, finding.completeness);
+            const relationKey = `${certificateAssetId}\u0000san_dns_name\u0000${domainAssetId}`;
+            setObservedRelation(relations, relationKey, {
+                type: 'SimpleRelation',
+                label: 'san_dns_name',
+                source: certificateAssetId,
+                target: domainAssetId,
+                created_at: finding.observedAt,
+                last_seen: finding.observedAt,
+                discovery: { source: document.source.name, completeness: finding.completeness },
+            }, finding.observedAt, finding.completeness);
+        }
+        if (observation.sourceSchema === 'whoisleuth.dns-observation-rows'
+            && (observation.field === 'A' || observation.field === 'AAAA')) {
+            const ipVersion = isIP(observation.value);
+            const targetId = ipVersion ? ipId(observation.value) : null;
+            if (!targetId)
+                continue;
+            if ((observation.field === 'A' && ipVersion !== 4) || (observation.field === 'AAAA' && ipVersion !== 6))
+                continue;
+            setObservedAsset(assets, targetId, {
+                key: targetId,
+                type: 'IPAddress',
+                attributes: { address: observation.value, type: ipVersion === 4 ? 'IPv4' : 'IPv6' },
+                discovery: { source: document.source.name, observed_at: finding.observedAt, completeness: finding.completeness },
+            }, finding.observedAt, finding.completeness);
+            const relationKey = `${domainAssetId}\u0000dns_record\u0000${targetId}`;
+            setObservedRelation(relations, relationKey, {
+                type: 'BasicDNSRelation',
+                label: 'dns_record',
+                source: domainAssetId,
+                target: targetId,
+                created_at: finding.observedAt,
+                last_seen: finding.observedAt,
+                discovery: { source: document.source.name, completeness: finding.completeness },
+            }, finding.observedAt, finding.completeness);
+        }
+    }
+    return Object.freeze({
+        schema: OPEN_ASSET_MODEL_BRIDGE_SCHEMA,
+        version: OPEN_ASSET_MODEL_BRIDGE_VERSION,
+        generatedAt,
+        model: Object.freeze({
+            name: 'OWASP Open Asset Model',
+            profile: 'WHOISleuth bounded external-findings projection',
+            reference: 'https://github.com/owasp-amass/open-asset-model',
+        }),
+        assets: Object.freeze([...assets.values()].sort((left, right) => String(left.key).localeCompare(String(right.key)))),
+        relations: Object.freeze([...relations.values()].sort((left, right) => String(left.source).localeCompare(String(right.source)) || String(left.target).localeCompare(String(right.target)))),
+        provenance: Object.freeze({
+            source: document.source,
+            findingsReviewed: document.findings.length,
+            evidenceClasses: Object.freeze([...new Set(document.findings.map((finding) => finding.evidenceClass))].sort()),
+        }),
+        limitations: Object.freeze([
+            'This is a versioned WHOISleuth bridge projection using documented Open Asset Model asset and relation vocabulary; receiving tools must still validate it against their supported model version.',
+            'Only bounded FQDN, IPAddress, TLSCertificate, dns_record, and san_dns_name projections are emitted. Unsupported finding categories remain represented only by their FQDN asset.',
+            'Source completeness is preserved as discovery metadata and is not converted into an Open Asset Model confidence score.',
+            'Relations are observations and investigation pivots, not proof of ownership, control, coordination, intent, safety, or maliciousness.',
+        ]),
+    });
+}
+export function formatOpenAssetModelBridge(document) {
+    return [
+        'Open Asset Model bridge',
+        `Assets       ${document.assets.length}`,
+        `Relations    ${document.relations.length}`,
+        `Findings     ${document.provenance.findingsReviewed}`,
+        `Source       ${document.provenance.source.name}`,
+        '',
+        'Output is a bounded bridge projection; validate it against the receiving implementation before import.',
+        '',
+    ].join('\n');
+}

package/cli/registry-cohort.mjs

@@ -0,0 +1,121 @@
+import { Buffer } from 'node:buffer';
+import { CliUsageError } from "./errors.mjs";
+import { buildRegistryDoctorReport } from "./registry-doctor.mjs";
+export const REGISTRY_COHORT_SCHEMA = 'whoisleuth.cli.registry-cohort';
+export const REGISTRY_COHORT_VERSION = 1;
+export const MAX_REGISTRY_COHORT_INPUT_BYTES = 16 * 1024 * 1024;
+export const MAX_REGISTRY_COHORT_SAMPLES = 500;
+export const MIN_REGISTRY_COHORT_SAMPLE = 5;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function documents(text) {
+    if (Buffer.byteLength(text, 'utf8') > MAX_REGISTRY_COHORT_INPUT_BYTES) {
+        throw new CliUsageError(`Registry cohort input is limited to ${MAX_REGISTRY_COHORT_INPUT_BYTES} bytes.`);
+    }
+    const trimmed = text.replace(/^\uFEFF/u, '').trim();
+    if (!trimmed)
+        throw new CliUsageError('Registry cohort input is empty.');
+    let values;
+    if (trimmed.startsWith('[')) {
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch {
+            throw new CliUsageError('Registry cohort input must be valid JSON or JSONL.');
+        }
+        if (!Array.isArray(parsed))
+            throw new CliUsageError('Registry cohort JSON input must be an array.');
+        values = parsed;
+    }
+    else {
+        const lines = trimmed.split(/\r?\n/u).filter((line) => line.trim());
+        values = lines.map((line, index) => {
+            try {
+                return JSON.parse(line);
+            }
+            catch {
+                throw new CliUsageError(`Registry cohort JSONL line ${index + 1} is invalid.`);
+            }
+        });
+    }
+    if (!values.length || values.length > MAX_REGISTRY_COHORT_SAMPLES) {
+        throw new CliUsageError(`Registry cohort input must contain from 1 to ${MAX_REGISTRY_COHORT_SAMPLES} saved Lookups.`);
+    }
+    const output = values.map(record);
+    if (output.some((item) => !Object.keys(item).length))
+        throw new CliUsageError('Every registry cohort item must be one saved Lookup object.');
+    return output;
+}
+export function buildRegistryCohortReport(text, generatedAt = new Date().toISOString()) {
+    const reports = documents(text).map((item) => buildRegistryDoctorReport(JSON.stringify(item), generatedAt));
+    const groups = new Map();
+    for (const report of reports) {
+        const key = `${report.suffix}\u0000${report.profile.id}`;
+        const group = groups.get(key) ?? [];
+        group.push(report);
+        groups.set(key, group);
+    }
+    const cohorts = [...groups.values()].map((group) => {
+        const sample = group[0];
+        if (!sample)
+            throw new CliUsageError('Registry cohort grouping failed.');
+        const sampleCount = group.length;
+        const investigate = group.reduce((total, item) => total + item.summary.investigate, 0);
+        const publicationReviewItems = group.reduce((total, item) => total + item.publication.reviewItems, 0);
+        return Object.freeze({
+            suffix: sample.suffix,
+            profileId: sample.profile.id,
+            sampleCount,
+            state: sampleCount < MIN_REGISTRY_COHORT_SAMPLE
+                ? 'insufficient_sample'
+                : investigate || publicationReviewItems
+                    ? 'review'
+                    : 'consistent',
+            sourceAlignment: Object.freeze({
+                investigate,
+                expectedConstraints: group.reduce((total, item) => total + item.summary.expectedConstraints, 0),
+                observed: group.reduce((total, item) => total + item.summary.observed, 0),
+            }),
+            publication: Object.freeze({
+                reviewItems: publicationReviewItems,
+                objectIdentifiersObserved: group.filter((item) => item.publication.objectIdentifier.state === 'observed').length,
+                baseConformanceObserved: group.filter((item) => item.publication.baseConformance.state === 'observed').length,
+                selfLinksObserved: group.filter((item) => item.publication.selfLink.state === 'observed').length,
+                redactionMetadataObserved: group.filter((item) => item.publication.redactionMetadata.state === 'observed').length,
+            }),
+        });
+    }).sort((left, right) => left.suffix.localeCompare(right.suffix) || left.profileId.localeCompare(right.profileId));
+    return Object.freeze({
+        schema: REGISTRY_COHORT_SCHEMA,
+        version: REGISTRY_COHORT_VERSION,
+        generatedAt,
+        sampleCount: reports.length,
+        minimumCohortSample: MIN_REGISTRY_COHORT_SAMPLE,
+        cohorts: Object.freeze(cohorts),
+        limitations: Object.freeze([
+            'The report intentionally omits domains, queries and raw evidence. It groups saved observations only by suffix and capability profile.',
+            `Cohorts with fewer than ${MIN_REGISTRY_COHORT_SAMPLE} observations remain insufficient sample and must not drive catalogue changes.`,
+            'Repeated observations from one environment are not representative by themselves. Review fixture provenance and source health before changing a parser or access profile.',
+        ]),
+    });
+}
+export function formatRegistryCohortReport(report) {
+    const output = [
+        'Registry quality cohort',
+        `Saved observations  ${report.sampleCount}`,
+        `Minimum sample      ${report.minimumCohortSample}`,
+        '',
+    ];
+    for (const cohort of report.cohorts) {
+        output.push(`.${cohort.suffix} · ${cohort.profileId} [${cohort.state.replaceAll('_', ' ')}]`);
+        output.push(`  Samples: ${cohort.sampleCount}`);
+        output.push(`  Source review items: ${cohort.sourceAlignment.investigate}`);
+        output.push(`  Publication review items: ${cohort.publication.reviewItems}`);
+    }
+    output.push('', 'Limitations:');
+    for (const limitation of report.limitations)
+        output.push(`  - ${limitation}`);
+    return `${output.join('\n')}\n`;
+}