@slicedearth/whoisleuth-cli 1.43.0 → 1.47.4

package/cli/runner.mjs

@@ -1,15 +1,16 @@
 import { Buffer } from 'node:buffer';
-import { createReadStream } from 'node:fs';
 import { createRequire } from 'node:module';
 import { abortable } from "../lib/abort.mjs";
+import { scanBoundedJson } from "../lib/bounded-json.mjs";
 import { REGISTRY_CAPABILITIES_VERSION, registryCapabilityFor } from "../lib/registry-capabilities.mjs";
 import { explainRiskScore, explainRiskScoreV6, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../lib/risk-scoring.mjs";
+import { buildRiskCalibrationSummaryReport } from "../lib/risk-calibration-summary.mjs";
 import { CLI_COMMANDS, parseCliArguments } from "./arguments.mjs";
 import { buildCliCommandCatalogue, formatCliCommandCatalogue } from "./command-catalogue.mjs";
 import { COMMAND_COLLECTION, COMMAND_DETAILS, COMMAND_USAGE, HELP, commandHelp, } from "./command-reference.mjs";
 import { buildShellCompletion } from "./completion.mjs";
 import { buildDoctorReport, formatDoctorReport } from "./doctor.mjs";
-import { MAX_COMPARE_INPUT_BYTES, compareLookupDocument, parseCliLookupDocument, readCompareInputBounded, } from "./compare.mjs";
+import { MAX_COMPARE_INPUT_BYTES, compareLookupDocument, parseCliLookupDocument, } from "./compare.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import { evidenceCommandFailureLabel, isEvidenceCommand, runEvidenceCommand, } from "./evidence-command-runner.mjs";
 import { buildCliEvidenceExport, formatCliEvidenceExport } from "./export-evidence.mjs";
@@ -18,7 +19,7 @@ import { formatLookupEvidenceHtml } from "./formatters/html.mjs";
 import { buildCliCompareDocument, formatJsonDocument, } from "./formatters/json.mjs";
 import { formatLookupEvidenceMarkdown } from "./formatters/markdown.mjs";
 import { formatTerminalCompare, formatTerminalRegistrySupport, formatTerminalRiskCalibration, } from "./formatters/terminal.mjs";
-import { buildCliLookupDiff, formatCliLookupDiff } from "./lookup-diff.mjs";
+import { MAX_RETAINED_ARTIFACT_DIFF_BYTES, buildCliRetainedArtifactDiff, formatCliRetainedArtifactDiff, } from "./retained-artifact-diff.mjs";
 import { MAX_LOOKUP_RECONCILIATION_INPUT_BYTES, buildCliLookupReconciliation, formatCliLookupReconciliation, } from "./lookup-reconcile.mjs";
 import { MAX_SHARING_REVIEW_BYTES, buildSharingReview, formatSharingReview, } from "./sharing-review.mjs";
 import { MAX_LOOKUP_TIMELINE_INPUT_BYTES, buildCliLookupTimeline, formatCliLookupTimeline, } from "./lookup-timeline.mjs";
@@ -27,19 +28,20 @@ import { MAX_MAIL_REVIEW_INPUT_BYTES, buildCliMailReview, formatCliMailReview, }
 import { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, } from "./offline-evidence-review.mjs";
 import { DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, buildDomainControlManifest, formatDomainControlResult, reviewDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
 import { DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA, buildDomainControlFlightRecorder, formatDomainControlFlightRecorder, } from "../lib/domain-control-flight-recorder.mjs";
-import { CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, buildCliDomainControlReview, formatCliDomainControlReview, } from "./domain-control-observations.mjs";
+import { CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH, MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS, MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES, buildCliDomainControlReview, formatCliDomainControlReview, } from "./domain-control-observations.mjs";
 import { buildCliLookupBrief, formatCliLookupBrief } from "./lookup-brief.mjs";
 import { buildCliCasePack, formatCliCasePack } from "./case-pack.mjs";
 import { formatDomainControlMonitor, runDomainControlMonitor } from "./domain-control-monitor.mjs";
 import { MAX_ASSURANCE_INPUT_BYTES, buildDomainAssurance, formatDomainAssurance, } from "../lib/domain-assurance.mjs";
 import { MAX_DOMAIN_CHANGE_PACKET_INPUT_BYTES, buildDomainChangePacket, formatDomainChangePacket, } from "../lib/domain-change-packet.mjs";
 import { buildCliManual } from "./manual.mjs";
-import { MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, buildInvestigationManifest, formatInvestigationManifest, } from "./investigation-manifest.mjs";
+import { MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES, buildInvestigationManifest, formatInvestigationManifest, } from "./investigation-manifest.mjs";
 import { MAX_EXTERNAL_OBSERVATION_MAPPING_BYTES, mapExternalObservations, formatExternalObservationMapping, } from "./external-observation-mapping.mjs";
 import { buildOpenAssetModelBridge, formatOpenAssetModelBridge, } from "./open-asset-model-bridge.mjs";
 import { MAX_CT_EVENT_INPUT_BYTES, buildCtEventFindings, formatCtEventFindings, } from "./ct-event-intake.mjs";
 import { buildInvestigationPlan, formatInvestigationPlan } from "./investigation-plan.mjs";
-import { formatInvestigationRun, runInvestigationRecipe } from "./investigation-run.mjs";
+import { MAX_INVESTIGATION_RUN_BYTES, formatInvestigationRun, runInvestigationRecipe } from "./investigation-run.mjs";
+import { readCliTextInput } from "./input.mjs";
 import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
 import { formatCliJunit } from "./ci-report.mjs";
 import { createBufferedOutput, writePrivateFile } from "./output-file.mjs";
@@ -48,28 +50,22 @@ import { buildRegistrySupportDocument } from "./registry-support.mjs";
 import { buildRegistryDoctorReport, formatRegistryDoctorReport } from "./registry-doctor.mjs";
 import { MAX_REGISTRY_COHORT_INPUT_BYTES, buildRegistryCohortReport, formatRegistryCohortReport, } from "./registry-cohort.mjs";
 import { buildRegistryFixtureScaffold } from "./registry-fixture-scaffold.mjs";
-import { MAX_OFFLINE_ARTIFACT_BYTES, MAX_OFFLINE_PASSPHRASE_FILE_BYTES, formatOfflineArtifactVerification, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { MAX_OFFLINE_ARTIFACT_BYTES, MAX_OFFLINE_PASSPHRASE_FILE_BYTES, formatOfflineArtifactVerification, isCompleteOfflineArtifactVerification, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { buildInterchangeFidelityReport, formatInterchangeFidelityReport, } from "./interchange-report.mjs";
 import { MAX_SOURCE_RELIABILITY_INPUT_BYTES, buildSourceReliabilityReport, formatSourceReliabilityReport, } from "./source-reliability.mjs";
-import { MAX_RISK_CALIBRATION_INPUT_BYTES, buildRiskCalibrationReport, parseRiskCalibrationDataset, readRiskCalibrationInputBounded, } from "./risk-calibration.mjs";
+import { MAX_RISK_CALIBRATION_INPUT_BYTES, buildRiskCalibrationReport, parseRiskCalibrationDataset, } from "./risk-calibration.mjs";
 import { MAX_LOOKALIKE_CALIBRATION_BYTES, buildLookalikeCalibration, formatLookalikeCalibration, } from "./lookalike-calibration.mjs";
-import { MAX_SAVED_LOOKUP_INPUT_BYTES, readSavedLookupInputBounded } from "./saved-lookup.mjs";
+import { MAX_SAVED_LOOKUP_INPUT_BYTES } from "./saved-lookup.mjs";
 import { presentTerminalOutput, terminalPresentation, } from "./terminal-presentation.mjs";
 const require = createRequire(import.meta.url);
 const { version: VERSION } = require('../package.json');
 const MAX_STDIN_BYTES = 4096;
-async function readStdinBounded(stream, limit = MAX_STDIN_BYTES) {
-    if (!stream || stream.isTTY)
-        return '';
-    const chunks = [];
-    let total = 0;
-    for await (const chunk of stream) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        total += buffer.length;
-        if (total > limit)
-            throw new CliUsageError(`Standard input is limited to ${limit} bytes.`);
-        chunks.push(buffer);
-    }
-    const text = Buffer.concat(chunks).toString('utf8').trim();
+async function readStdinBounded(stream, limit = MAX_STDIN_BYTES, signal) {
+    const text = (await readCliTextInput(null, stream, {
+        maximumBytes: limit,
+        label: 'Standard input',
+        ...(signal ? { signal } : {}),
+    })).trim();
     const lines = text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
     if (lines.length > 1)
         throw new CliUsageError('Single-value commands accept one stdin line. Use the bulk command for multiple inputs.');
@@ -136,7 +132,30 @@ async function runParsedCli(args, dependencies = {}) {
         };
         const readSingleInput = async () => (dependencies.readStdin
             ? await dependencies.readStdin()
-            : await readStdinBounded(dependencies.stdin || process.stdin));
+            : await readStdinBounded(dependencies.stdin || process.stdin, MAX_STDIN_BYTES, dependencies.signal));
+        const readInput = async (source, maximumBytes, label) => (readCliTextInput(source, dependencies.stdin || process.stdin, {
+            maximumBytes,
+            label,
+            ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+        }));
+        const readPassphraseSource = async (source) => {
+            let passphraseText;
+            try {
+                passphraseText = dependencies.readPassphraseFile
+                    ? await dependencies.readPassphraseFile(source)
+                    : await readInput(source, MAX_OFFLINE_PASSPHRASE_FILE_BYTES, 'Passphrase file');
+            }
+            catch (error) {
+                if (error instanceof CliUsageError)
+                    throw error;
+                throw new CliUsageError(`Could not read passphrase file: ${boundedCliErrorMessage(error, 'File could not be read')}`);
+            }
+            const passphrase = passphraseText.replace(/\r?\n$/u, '');
+            if (!passphrase || /[\r\n\u0000]/u.test(passphrase)) {
+                throw new CliUsageError('Passphrase file must contain exactly one non-empty UTF-8 line.');
+            }
+            return passphrase;
+        };
         const commandContext = Object.freeze({
             stdout,
             stderr,
@@ -144,6 +163,7 @@ async function runParsedCli(args, dependencies = {}) {
             writeStdout: (value) => write(stdout, value),
             writeStderr: (value) => write(stderr, value),
             readSingleInput,
+            readInput,
             now: () => dependencies.now ? dependencies.now() : new Date().toISOString(),
             beginProgress,
             endProgress,
@@ -191,11 +211,16 @@ async function runParsedCli(args, dependencies = {}) {
         if (args.action === 'manifest') {
             failureLabel = 'Investigation manifest';
             const artifacts = [];
+            let totalBytes = 0;
             try {
                 for (const source of args.sources) {
                     const content = dependencies.readDiffInput
                         ? await dependencies.readDiffInput(source)
-                        : await readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), { limit: MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, label: 'Manifest artefact input' });
+                        : await readInput(source, MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, 'Manifest artefact input');
+                    totalBytes += Buffer.byteLength(content, 'utf8');
+                    if (totalBytes > MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES) {
+                        throw new CliUsageError(`Manifest artefacts exceed the ${MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES}-byte combined limit.`);
+                    }
                     artifacts.push({ content });
                 }
             }
@@ -228,12 +253,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_EXTERNAL_OBSERVATION_MAPPING_BYTES,
-                        label: mapping ? 'External observation mapping input' : 'Open Asset Model bridge input',
-                    });
+                    : await readInput(args.source, MAX_EXTERNAL_OBSERVATION_MAPPING_BYTES, mapping ? 'External observation mapping input' : 'Open Asset Model bridge input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -289,7 +309,7 @@ async function runParsedCli(args, dependencies = {}) {
         }
         if (args.action === 'registry-support') {
             failureLabel = 'Registry support';
-            const readInput = dependencies.readStdin || (() => readStdinBounded(dependencies.stdin || process.stdin));
+            const readInput = dependencies.readStdin || (() => readStdinBounded(dependencies.stdin || process.stdin, MAX_STDIN_BYTES, dependencies.signal));
             const requestedInput = args.target || await readInput();
             if (!requestedInput)
                 throw new CliUsageError('registry-support requires one domain or suffix as an argument or on stdin.');
@@ -310,12 +330,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readCompareInput
                     ? await dependencies.readCompareInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
-                        label: 'Registry doctor input',
-                    });
+                    : await readInput(args.source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Registry doctor input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -337,12 +352,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readCompareInput
                     ? await dependencies.readCompareInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_REGISTRY_COHORT_INPUT_BYTES,
-                        label: 'Registry cohort input',
-                    });
+                    : await readInput(args.source, MAX_REGISTRY_COHORT_INPUT_BYTES, 'Registry cohort input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -374,9 +384,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readRiskCalibrationInput
                     ? await dependencies.readRiskCalibrationInput(args.source)
-                    : await readRiskCalibrationInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, MAX_RISK_CALIBRATION_INPUT_BYTES);
+                    : await readInput(args.source, MAX_RISK_CALIBRATION_INPUT_BYTES, 'Risk calibration input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -396,7 +404,11 @@ async function runParsedCli(args, dependencies = {}) {
                 } : {}),
             });
             if (!args.quiet)
-                write(stdout, args.output === 'json' ? formatJsonDocument(report) : terminal(formatTerminalRiskCalibration(report), args.color));
+                write(stdout, args.output === 'summary_json'
+                    ? formatJsonDocument(buildRiskCalibrationSummaryReport(report))
+                    : args.output === 'json'
+                        ? formatJsonDocument(report)
+                        : terminal(formatTerminalRiskCalibration(report), args.color));
             return EXIT_CODES.SUCCESS;
         }
         if (args.action === 'lookalike-calibrate') {
@@ -405,12 +417,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readRiskCalibrationInput
                     ? await dependencies.readRiskCalibrationInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_LOOKALIKE_CALIBRATION_BYTES,
-                        label: 'Lookalike calibration input',
-                    });
+                    : await readInput(args.source, MAX_LOOKALIKE_CALIBRATION_BYTES, 'Lookalike calibration input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -438,12 +445,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_OFFLINE_ARTIFACT_BYTES,
-                        label: 'Artefact input',
-                    });
+                    : await readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Artefact input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -452,33 +454,58 @@ async function runParsedCli(args, dependencies = {}) {
             }
             if (!input.trim())
                 throw new CliUsageError('verify-artifact requires one JSON file or an artefact on stdin.');
-            let passphrase = null;
-            if (args.passphraseSource) {
-                let passphraseText;
+            const passphrase = args.passphraseSource ? await readPassphraseSource(args.passphraseSource) : null;
+            let manifest = null;
+            if (args.manifestSource && args.manifestEntryId) {
+                let raw;
                 try {
-                    passphraseText = dependencies.readPassphraseFile
-                        ? await dependencies.readPassphraseFile(args.passphraseSource)
-                        : await readSavedLookupInputBounded(createReadStream(args.passphraseSource, { highWaterMark: MAX_OFFLINE_PASSPHRASE_FILE_BYTES }), {
-                            limit: MAX_OFFLINE_PASSPHRASE_FILE_BYTES,
-                            label: 'Passphrase file',
-                        });
+                    raw = dependencies.readArtifactInput
+                        ? await dependencies.readArtifactInput(args.manifestSource)
+                        : await readInput(args.manifestSource, MAX_OFFLINE_ARTIFACT_BYTES, 'Investigation manifest input');
                 }
                 catch (error) {
                     if (error instanceof CliUsageError)
                         throw error;
-                    throw new CliUsageError(`Could not read passphrase file: ${boundedCliErrorMessage(error, 'File could not be read')}`);
-                }
-                passphrase = passphraseText.replace(/\r?\n$/u, '');
-                if (!passphrase || /[\r\n\u0000]/u.test(passphrase)) {
-                    throw new CliUsageError('Passphrase file must contain exactly one non-empty UTF-8 line.');
+                    throw new CliUsageError(`Could not read investigation manifest input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
                 }
+                if (!raw.trim())
+                    throw new CliUsageError('The investigation manifest input is empty.');
+                manifest = Object.freeze({ raw, entryId: args.manifestEntryId });
             }
-            const report = await verifyOfflineArtifact(input, { passphrase });
+            const report = await verifyOfflineArtifact(input, { passphrase, manifest });
             if (!args.quiet) {
                 write(stdout, args.output === 'json'
                     ? formatJsonDocument(report)
                     : terminal(formatOfflineArtifactVerification(report), args.color));
             }
+            return args.strictExit && !isCompleteOfflineArtifactVerification(report)
+                ? EXIT_CODES.PARTIAL_FAILURE
+                : EXIT_CODES.SUCCESS;
+        }
+        if (args.action === 'interchange-report') {
+            failureLabel = 'Interchange fidelity report';
+            let input;
+            try {
+                input = dependencies.readArtifactInput
+                    ? await dependencies.readArtifactInput(args.source)
+                    : await readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Interchange input');
+            }
+            catch (error) {
+                if (error instanceof CliUsageError)
+                    throw error;
+                throw new CliUsageError(`Could not read interchange input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+            }
+            if (!input.trim())
+                throw new CliUsageError('interchange-report requires one JSON file or an artefact on stdin.');
+            const passphrase = args.passphraseSource ? await readPassphraseSource(args.passphraseSource) : null;
+            const report = await buildInterchangeFidelityReport(input, {
+                generatedAt: commandContext.now(),
+                passphrase,
+            });
+            if (!args.quiet)
+                write(stdout, args.output === 'json'
+                    ? formatJsonDocument(report)
+                    : terminal(formatInterchangeFidelityReport(report), args.color));
             return EXIT_CODES.SUCCESS;
         }
         if (isEvidenceCommand(args)) {
@@ -494,6 +521,7 @@ async function runParsedCli(args, dependencies = {}) {
                 readPrivateKeyFile: dependencies.readPrivateKeyFile,
                 readPublicKeyFile: dependencies.readPublicKeyFile,
                 now: dependencies.now,
+                signal: dependencies.signal,
             });
         }
         if (args.action === 'source-report') {
@@ -502,12 +530,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readSourceReliabilityInput
                     ? await dependencies.readSourceReliabilityInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_SOURCE_RELIABILITY_INPUT_BYTES,
-                        label: 'Source reliability input',
-                    });
+                    : await readInput(args.source, MAX_SOURCE_RELIABILITY_INPUT_BYTES, 'Source reliability input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -530,9 +553,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readCompareInput
                     ? await dependencies.readCompareInput(args.source)
-                    : await readCompareInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, MAX_COMPARE_INPUT_BYTES);
+                    : await readInput(args.source, MAX_COMPARE_INPUT_BYTES, 'Comparison input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -553,10 +574,8 @@ async function runParsedCli(args, dependencies = {}) {
         }
         if (args.action === 'page-compare') {
             failureLabel = 'Static page comparison';
-            const readDiffInput = dependencies.readDiffInput || (async (source) => (readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), {
-                limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
-                label: 'Page comparison input',
-            })));
+            const readDiffInput = dependencies.readDiffInput
+                || ((source) => readInput(source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Page comparison input'));
             let leftInput;
             let rightInput;
             try {
@@ -583,12 +602,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readMailReviewInput
                     ? await dependencies.readMailReviewInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_MAIL_REVIEW_INPUT_BYTES,
-                        label: 'Mail review input',
-                    });
+                    : await readInput(args.source, MAX_MAIL_REVIEW_INPUT_BYTES, 'Mail review input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -608,12 +622,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_OFFLINE_EVIDENCE_INPUT_BYTES,
-                        label: 'Offline evidence input',
-                    });
+                    : await readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Offline evidence input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -651,12 +660,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: isBrief ? MAX_SAVED_LOOKUP_INPUT_BYTES : 4 * 1024 * 1024,
-                        label: isBrief ? 'Lookup brief input' : 'Case-pack input',
-                    });
+                    : await readInput(args.source, isBrief ? MAX_SAVED_LOOKUP_INPUT_BYTES : 4 * 1024 * 1024, isBrief ? 'Lookup brief input' : 'Case-pack input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -687,12 +691,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_OFFLINE_EVIDENCE_INPUT_BYTES,
-                        label: 'Domain control input',
-                    });
+                    : await readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Domain control input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -701,11 +700,21 @@ async function runParsedCli(args, dependencies = {}) {
             }
             if (!input.trim())
                 throw new CliUsageError('domain-control requires one JSON file or a document on stdin.');
+            const normalizedDomainControlInput = input.replace(/^\uFEFF/u, '');
             let parsed;
             try {
-                parsed = JSON.parse(input);
+                scanBoundedJson(normalizedDomainControlInput, {
+                    maximumDepth: MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH,
+                    maximumKeys: MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS,
+                    maximumValues: MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES,
+                });
+                parsed = JSON.parse(normalizedDomainControlInput);
             }
-            catch {
+            catch (cause) {
+                const detail = cause instanceof Error ? cause.message : '';
+                if (detail.startsWith('Artefact JSON ')) {
+                    throw new CliUsageError(`Domain control input ${detail.slice('Artefact JSON '.length)}`);
+                }
                 throw new CliUsageError('Domain control input is not valid JSON.');
             }
             const schema = parsed && typeof parsed === 'object' && !Array.isArray(parsed)
@@ -741,19 +750,11 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 manifestInput = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_OFFLINE_EVIDENCE_INPUT_BYTES,
-                        label: 'Domain-control manifest input',
-                    });
+                    : await readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Domain-control manifest input');
                 if (args.previousSource) {
                     previousInput = dependencies.readDiffInput
                         ? await dependencies.readDiffInput(args.previousSource)
-                        : await readSavedLookupInputBounded(createReadStream(args.previousSource, { highWaterMark: 64 * 1024 }), {
-                            limit: MAX_OFFLINE_EVIDENCE_INPUT_BYTES,
-                            label: 'Prior monitor snapshot',
-                        });
+                        : await readInput(args.previousSource, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Prior monitor snapshot');
                 }
             }
             catch (error) {
@@ -796,12 +797,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_ASSURANCE_INPUT_BYTES,
-                        label: 'Domain assurance input',
-                    });
+                    : await readInput(args.source, MAX_ASSURANCE_INPUT_BYTES, 'Domain assurance input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -836,12 +832,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_DOMAIN_CHANGE_PACKET_INPUT_BYTES,
-                        label: 'Domain change packet input',
-                    });
+                    : await readInput(args.source, MAX_DOMAIN_CHANGE_PACKET_INPUT_BYTES, 'Domain change packet input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -876,12 +867,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_SHARING_REVIEW_BYTES,
-                        label: 'Sharing review input',
-                    });
+                    : await readInput(args.source, MAX_SHARING_REVIEW_BYTES, 'Sharing review input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -926,10 +912,7 @@ async function runParsedCli(args, dependencies = {}) {
                 try {
                     resumeInput = dependencies.readDiffInput
                         ? await dependencies.readDiffInput(args.resumeSource)
-                        : await readSavedLookupInputBounded(createReadStream(args.resumeSource, { highWaterMark: 64 * 1024 }), {
-                            limit: 24 * 1024 * 1024,
-                            label: 'Investigation resume state',
-                        });
+                        : await readInput(args.resumeSource, MAX_INVESTIGATION_RUN_BYTES, 'Investigation resume state');
                 }
                 catch (error) {
                     if (error instanceof CliUsageError)
@@ -959,11 +942,9 @@ async function runParsedCli(args, dependencies = {}) {
             return document.state === 'step_failed' ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
         }
         if (args.action === 'diff') {
-            failureLabel = 'Lookup evidence diff';
-            const readDiffInput = dependencies.readDiffInput || (async (source) => (readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), {
-                limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
-                label: 'Lookup diff input',
-            })));
+            failureLabel = 'Retained artifact diff';
+            const readDiffInput = dependencies.readDiffInput
+                || ((source) => readInput(source, MAX_RETAINED_ARTIFACT_DIFF_BYTES, 'Retained diff input'));
             let leftInput;
             let rightInput;
             try {
@@ -975,21 +956,19 @@ async function runParsedCli(args, dependencies = {}) {
             catch (error) {
                 if (error instanceof CliUsageError)
                     throw error;
-                throw new CliUsageError(`Could not read Lookup diff input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+                throw new CliUsageError(`Could not read retained diff input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
             }
-            const document = buildCliLookupDiff(leftInput, rightInput, dependencies.now ? dependencies.now() : new Date().toISOString());
+            const document = buildCliRetainedArtifactDiff(leftInput, rightInput, { leftSessionId: args.leftSessionId, rightSessionId: args.rightSessionId }, dependencies.now ? dependencies.now() : new Date().toISOString());
             if (!args.quiet)
                 write(stdout, args.output === 'json'
                     ? formatJsonDocument(document)
-                    : terminal(formatCliLookupDiff(document), args.color));
+                    : terminal(formatCliRetainedArtifactDiff(document), args.color));
             return EXIT_CODES.SUCCESS;
         }
         if (args.action === 'reconcile') {
             failureLabel = 'Lookup observation reconciliation';
-            const readReconciliationInput = dependencies.readDiffInput || (async (source) => (readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), {
-                limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
-                label: 'Lookup reconciliation input',
-            })));
+            const readReconciliationInput = dependencies.readDiffInput
+                || ((source) => readInput(source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Lookup reconciliation input'));
             const inputs = [];
             let totalBytes = 0;
             try {
@@ -1016,10 +995,8 @@ async function runParsedCli(args, dependencies = {}) {
         }
         if (args.action === 'timeline') {
             failureLabel = 'Lookup observation timeline';
-            const readTimelineInput = dependencies.readDiffInput || (async (source) => (readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), {
-                limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
-                label: 'Lookup timeline input',
-            })));
+            const readTimelineInput = dependencies.readDiffInput
+                || ((source) => readInput(source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Lookup timeline input'));
             const inputs = [];
             let totalBytes = 0;
             try {
@@ -1050,12 +1027,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readExportInput
                     ? await dependencies.readExportInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_SAVED_LOOKUP_INPUT_BYTES,
-                        label: 'Evidence export input',
-                    });
+                    : await readInput(args.source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Evidence export input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -1069,9 +1041,9 @@ async function runParsedCli(args, dependencies = {}) {
             const now = dependencies.now ? dependencies.now() : new Date().toISOString();
             const document = buildCliEvidenceExport(input, evidenceModule, now);
             const output = args.format === 'markdown'
-                ? formatLookupEvidenceMarkdown(document)
+                ? formatLookupEvidenceMarkdown(document, { includeAttribution: args.includeAttribution })
                 : args.format === 'html'
-                    ? formatLookupEvidenceHtml(document)
+                    ? formatLookupEvidenceHtml(document, { includeAttribution: args.includeAttribution })
                     : formatCliEvidenceExport(document, args.compact);
             write(stdout, output);
             return EXIT_CODES.SUCCESS;
@@ -1097,12 +1069,7 @@ async function runParsedCli(args, dependencies = {}) {
             try {
                 input = dependencies.readArtifactInput
                     ? await dependencies.readArtifactInput(args.source)
-                    : await readSavedLookupInputBounded(args.source
-                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
-                        : dependencies.stdin || process.stdin, {
-                        limit: MAX_CT_EVENT_INPUT_BYTES,
-                        label: 'Certificate event input',
-                    });
+                    : await readInput(args.source, MAX_CT_EVENT_INPUT_BYTES, 'Certificate event input');
             }
             catch (error) {
                 if (error instanceof CliUsageError)
@@ -1134,14 +1101,20 @@ async function runParsedCli(args, dependencies = {}) {
         if (args.action === 'ct-search'
             || args.action === 'posture'
             || args.action === 'http'
-            || args.action === 'tls') {
+            || args.action === 'tls'
+            || args.action === 'dnssec-validate'
+            || args.action === 'mail-transport') {
             failureLabel = args.action === 'ct-search'
                 ? 'Certificate Transparency search'
                 : args.action === 'posture'
                     ? 'Domain posture audit'
                     : args.action === 'http'
                         ? 'HTTP probe'
-                        : 'TLS intelligence';
+                        : args.action === 'tls'
+                            ? 'TLS intelligence'
+                            : args.action === 'dnssec-validate'
+                                ? 'DNSSEC chain validation'
+                                : 'Mail transport review';
             const { runNetworkCommand } = await import("./network-command-runner.mjs");
             return await runNetworkCommand(args, dependencies, commandContext);
         }