@slicedearth/whoisleuth-cli 1.43.0 → 1.47.4

package/cli/local-mmdb-review.mjs

@@ -1,9 +1,11 @@
-import { stat } from 'node:fs/promises';
+import { constants as fsConstants } from 'node:fs';
+import { open, realpath } from 'node:fs/promises';
 import { isIP } from 'node:net';
-import { open } from 'maxmind';
+import { Reader } from 'maxmind';
 import { formatIpPrefix, parseIpPrefix } from "../lib/ip-prefix.mjs";
 import { CliUsageError } from "./errors.mjs";
 export const LOCAL_MMDB_QUERY_SCHEMA = 'whoisleuth.local-mmdb-query';
+export const LOCAL_MMDB_QUERY_VERSION = 1;
 export const MAX_LOCAL_MMDB_BYTES = 512 * 1024 * 1024;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
@@ -17,6 +19,43 @@ function names(value) {
     const source = record(value);
     return boundedText(source.en, 120);
 }
+async function readStableMmdb(databasePath) {
+    let handle = null;
+    try {
+        const resolvedPath = await realpath(databasePath);
+        handle = await open(resolvedPath, fsConstants.O_RDONLY | fsConstants.O_NONBLOCK | fsConstants.O_NOFOLLOW);
+        const before = await handle.stat();
+        if (!before.isFile() || before.size <= 0 || before.size > MAX_LOCAL_MMDB_BYTES) {
+            throw new CliUsageError(`The supplied MMDB must be a file no larger than ${MAX_LOCAL_MMDB_BYTES} bytes.`);
+        }
+        const database = Buffer.allocUnsafe(before.size);
+        let offset = 0;
+        while (offset < database.length) {
+            const { bytesRead } = await handle.read(database, offset, database.length - offset, offset);
+            if (bytesRead === 0)
+                break;
+            offset += bytesRead;
+        }
+        const after = await handle.stat();
+        if (offset !== database.length
+            || before.dev !== after.dev
+            || before.ino !== after.ino
+            || before.size !== after.size
+            || before.mtimeMs !== after.mtimeMs
+            || before.ctimeMs !== after.ctimeMs) {
+            throw new CliUsageError('The supplied MMDB changed while it was being read.');
+        }
+        return database;
+    }
+    catch (cause) {
+        if (cause instanceof CliUsageError)
+            throw cause;
+        throw new CliUsageError('The supplied MMDB file could not be read.');
+    }
+    finally {
+        await handle?.close().catch(() => { });
+    }
+}
 export async function reviewLocalMmdb(input, databasePath) {
     const address = boundedText(input.address, 64)?.toLowerCase() ?? '';
     const sourceLabel = boundedText(input.sourceLabel, 120);
@@ -27,21 +66,13 @@ export async function reviewLocalMmdb(input, databasePath) {
     if (!sourceLabel || !databaseVersion || !license) {
         throw new CliUsageError('Local MMDB review requires bounded sourceLabel, databaseVersion, and licence metadata.');
     }
-    let info;
-    try {
-        info = await stat(databasePath);
-    }
-    catch {
-        throw new CliUsageError('The supplied MMDB file could not be read.');
-    }
-    if (!info.isFile() || info.size <= 0 || info.size > MAX_LOCAL_MMDB_BYTES) {
-        throw new CliUsageError(`The supplied MMDB must be a file no larger than ${MAX_LOCAL_MMDB_BYTES} bytes.`);
-    }
     let reader;
     try {
-        reader = await open(databasePath, { cache: { max: 1_000 } });
+        reader = new Reader(await readStableMmdb(databasePath));
     }
-    catch {
+    catch (cause) {
+        if (cause instanceof CliUsageError)
+            throw cause;
         throw new CliUsageError('The supplied file is not a readable MaxMind DB database.');
     }
     const [rawMatch, prefixLength] = reader.getWithPrefixLength(address);

package/cli/lookup-command-runner.mjs

@@ -84,8 +84,8 @@ async function runLookupCommand(args, dependencies, context) {
             const evidenceModule = await loadEvidence();
             const report = buildCliEvidenceExport(JSON.stringify(document), evidenceModule, now);
             context.writeStdout(args.output === 'markdown'
-                ? formatLookupEvidenceMarkdown(report)
-                : formatLookupEvidenceHtml(report));
+                ? formatLookupEvidenceMarkdown(report, { includeAttribution: args.includeAttribution })
+                : formatLookupEvidenceHtml(report, { includeAttribution: args.includeAttribution }));
         }
         else {
             context.writeStdout(context.terminal(formatTerminalLookup(document, { detail: args.detail }), args.color));

package/cli/lookup-diff.mjs

@@ -95,6 +95,9 @@ function lookupComparisonInput(document) {
         faviconMatch: false,
         faviconNearMatch: false,
         reusesOfficialAssets: false,
+        idnReferenceMatch: false,
+        pageBaselineMatch: false,
+        hasActiveBrandProfile: false,
         hasPasswordField: recordOrEmpty(recordOrEmpty(availability.credentialSurfaceProfile).inputs).categories
             ? Number(recordOrEmpty(recordOrEmpty(recordOrEmpty(availability.credentialSurfaceProfile).inputs).categories).password) > 0
             : false,
@@ -115,6 +118,12 @@ function lookupComparisonInput(document) {
         comparisonEvidence,
         relationship,
         sourceCoverage: sourceCoverage(document, availability),
+        profileContext: {
+            sourceState: 'ready',
+            activeProfileId: null,
+            profileUpdatedAt: null,
+            limitation: '',
+        },
     };
 }
 function buildCliLookupDiff(leftText, rightText, generatedAt = new Date().toISOString(), options = {}) {

package/cli/lookup-reconcile.mjs

@@ -37,7 +37,7 @@ function buildCliLookupReconciliation(inputs, generatedAt = new Date().toISOStri
         label: `Lookup reconciliation observation ${index + 1}`,
     }));
     const domain = documents[0]?.registrableDomain;
-    if (!domain || documents.some((document) => document.registrableDomain !== domain)) {
+    if (!domain || documents.some((candidate) => candidate.registrableDomain !== domain)) {
         throw new CliUsageError('Lookup reconciliation requires observations for one domain.');
     }
     const comparisons = documents.slice(1).map((document, index) => buildCliLookupDiff(inputs[0], inputs[index + 1], generatedAt, { domainMode: 'same' }));

package/cli/mail-review.mjs

@@ -128,14 +128,14 @@ function parseInput(textValue) {
     try {
         const parsed = JSON.parse(textInput);
         const document = record(parsed);
-        if (document.schema === 'whoisleuth.cli.bulk' && document.version === 2 && Array.isArray(document.results)) {
+        if (document.schema === 'whoisleuth.cli.bulk' && [2, 3].includes(Number(document.version)) && Array.isArray(document.results)) {
             values = document.results;
         }
-        else if (document.schema === 'whoisleuth.cli.bulk.item' && document.version === 2) {
+        else if (document.schema === 'whoisleuth.cli.bulk.item' && [2, 3].includes(Number(document.version))) {
             values = [document];
         }
         else {
-            throw new CliUsageError('Mail review requires WHOISleuth Bulk JSON schema version 2.');
+            throw new CliUsageError('Mail review requires WHOISleuth Bulk JSON schema version 2 or 3.');
         }
     }
     catch (error) {
@@ -152,8 +152,8 @@ function parseInput(textValue) {
         throw new CliUsageError(`Mail review supports between 1 and ${MAX_MAIL_REVIEW_ROWS} Bulk rows.`);
     }
     const rows = values.map((value) => record(value));
-    if (rows.some((value) => value.schema !== 'whoisleuth.cli.bulk.item' || value.version !== 2)) {
-        throw new CliUsageError('Every Mail review row must use WHOISleuth Bulk item schema version 2.');
+    if (rows.some((value) => value.schema !== 'whoisleuth.cli.bulk.item' || ![2, 3].includes(Number(value.version)))) {
+        throw new CliUsageError('Every Mail review row must use WHOISleuth Bulk item schema version 2 or 3.');
     }
     return rows;
 }

package/cli/manual.mjs

@@ -23,7 +23,7 @@ ${commands}
 .SH OUTPUT
 Human-readable output is the default. Versioned JSON and JSONL are available where documented. Diagnostics and optional progress events are written to standard error. Use --output with an optional --force flag for atomic private file output.
 .SH EXIT STATUS
-0 indicates command completion, 2 invalid usage, 3 a collection or comparison failure, 4 an explicitly detected partial result, 70 an internal bootstrap failure, and 130 analyst cancellation.
+0 indicates command completion, 2 invalid usage, 3 a collection or comparison failure, 4 an explicitly detected partial result, 70 an internal bootstrap failure, 130 analyst cancellation, and 143 service termination.
 .SH PRIVACY
 Network commands disclose the target to the directly queried upstream services. Offline commands do not make network requests. Output files are created with private permissions and are never uploaded by the CLI.
 .SH LICENSE

package/cli/network-command-runner.mjs

@@ -2,6 +2,8 @@ import { fetchHomepage } from "../lib/availability.mjs";
 import { searchCertificateTransparency } from "../lib/ct-search.mjs";
 import { checkDomainPosture, normalizeAuditDomain, normalizeDkimSelectors } from "../lib/domain-posture.mjs";
 import { collectTlsIntelligence, normalizeTlsHostname } from "../lib/tls-intelligence.mjs";
+import { MAX_DNSSEC_TRUST_ANCHOR_BYTES, formatDnssecChainReport, validateDnssecChain, } from "../lib/dnssec-chain-validation.mjs";
+import { MAX_MAIL_TRANSPORT_INPUT_BYTES, collectMailTransportReview, formatMailTransportReview, } from "../lib/smtp-transport-review.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { buildCliCtSearchDocument, buildCliHttpDocument, buildCliPostureDocument, buildCliTlsDocument, formatJsonDocument, } from "./formatters/json.mjs";
 import { formatTerminalCtSearch, formatTerminalHttp, formatTerminalPosture, formatTerminalTls, } from "./formatters/terminal.mjs";
@@ -71,6 +73,82 @@ async function runNetworkCommand(args, dependencies, context) {
         }
         return EXIT_CODES.SUCCESS;
     }
+    if (args.action === 'dnssec-validate') {
+        let anchorInput;
+        try {
+            anchorInput = dependencies.readTrustAnchorInput
+                ? await dependencies.readTrustAnchorInput(args.trustAnchorSource)
+                : await context.readInput(args.trustAnchorSource, MAX_DNSSEC_TRUST_ANCHOR_BYTES, 'DNSSEC trust anchor');
+        }
+        catch (error) {
+            if (error instanceof CliUsageError)
+                throw error;
+            throw new CliUsageError(`Could not read DNSSEC trust anchor: ${String(error instanceof Error ? error.message : error).slice(0, 240)}`);
+        }
+        const validate = dependencies.validateDnssecChain ?? validateDnssecChain;
+        const report = await context.withProgress('Validating the isolated DNSSEC chain', () => validate({
+            target: args.target,
+            resolver: args.resolver,
+            trustAnchor: anchorInput,
+            observedAt: context.now(),
+            ownedOrAuthorized: args.ownedOrAuthorized,
+        }));
+        if (!args.quiet) {
+            context.writeStdout(args.output === 'json'
+                ? formatJsonDocument(report)
+                : context.terminal(formatDnssecChainReport(report), args.color));
+        }
+        return report.state === 'secure' || report.state === 'insecure'
+            ? EXIT_CODES.SUCCESS
+            : EXIT_CODES.PARTIAL_FAILURE;
+    }
+    if (args.action === 'mail-transport') {
+        let input;
+        let anchorInput;
+        try {
+            input = await (dependencies.readMailTransportInput
+                ? dependencies.readMailTransportInput(args.source)
+                : context.readInput(args.source, MAX_MAIL_TRANSPORT_INPUT_BYTES, 'Mail transport input'));
+        }
+        catch (error) {
+            if (error instanceof CliUsageError)
+                throw error;
+            throw new CliUsageError(`Could not read mail transport input: ${String(error instanceof Error ? error.message : error).slice(0, 240)}`);
+        }
+        try {
+            anchorInput = await (dependencies.readTrustAnchorInput
+                ? dependencies.readTrustAnchorInput(args.trustAnchorSource)
+                : context.readInput(args.trustAnchorSource, MAX_DNSSEC_TRUST_ANCHOR_BYTES, 'DNSSEC trust anchor'));
+        }
+        catch (error) {
+            if (error instanceof CliUsageError)
+                throw error;
+            throw new CliUsageError(`Could not read DNSSEC trust anchor: ${String(error instanceof Error ? error.message : error).slice(0, 240)}`);
+        }
+        if (!input.trim())
+            throw new CliUsageError('mail-transport requires one versioned JSON file or a document on stdin.');
+        const collect = dependencies.collectMailTransportReview ?? collectMailTransportReview;
+        let review;
+        try {
+            review = await context.withProgress('Reviewing selected authorised mail transports', () => collect(input, {
+                resolver: args.resolver,
+                trustAnchor: anchorInput,
+                ownedOrAuthorized: args.ownedOrAuthorized,
+                activeProbeAcknowledged: args.activeProbeAcknowledged,
+            }));
+        }
+        catch (error) {
+            if (error instanceof TypeError)
+                throw new CliUsageError(error.message);
+            throw error;
+        }
+        if (!args.quiet) {
+            context.writeStdout(args.output === 'json'
+                ? formatJsonDocument(review)
+                : context.terminal(formatMailTransportReview(review), args.color));
+        }
+        return review.runState === 'complete' ? EXIT_CODES.SUCCESS : EXIT_CODES.PARTIAL_FAILURE;
+    }
     const requestedHostname = args.hostname || await context.readSingleInput();
     if (!requestedHostname)
         throw new CliUsageError('tls requires one hostname as an argument or on stdin.');

package/cli/offline-evidence-review.mjs

@@ -8,6 +8,7 @@ import { buildLocalGeoIpDatabase, lookupLocalGeoIp, } from "../lib/local-geoip-e
 import { inspectRdapReverseSearchResponse, normalizeRdapSearchHelp, planRdapReverseSearch, } from "../lib/rdap-search-workbench.mjs";
 import { reviewRpkiRoute } from "../lib/rpki-evidence.mjs";
 import { analyzeTlsaEvidence } from "../lib/tlsa-evidence.mjs";
+import { CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA, buildCryptographicAssuranceReview, } from "../lib/cryptographic-assurance.mjs";
 import { reviewZoneIntent } from "../lib/zone-intent-review.mjs";
 import { reviewDnsConvergence } from "../lib/dns-convergence-review.mjs";
 import { compareTrustStoreEvidence } from "../lib/trust-store-comparison.mjs";
@@ -16,6 +17,13 @@ import { LOCAL_MMDB_QUERY_SCHEMA, reviewLocalMmdb } from "./local-mmdb-review.mj
 const OFFLINE_EVIDENCE_REVIEW_SCHEMA = 'whoisleuth.cli.offline-evidence-review';
 const OFFLINE_EVIDENCE_REVIEW_VERSION = 1;
 const MAX_OFFLINE_EVIDENCE_INPUT_BYTES = 16 * 1024 * 1024;
+const RDAP_SEARCH_INPUT_SCHEMA = 'whoisleuth.rdap-search-input';
+const DNSSEC_EVIDENCE_INPUT_SCHEMA = 'whoisleuth.dnssec-evidence-input';
+const TLSA_EVIDENCE_INPUT_SCHEMA = 'whoisleuth.tlsa-evidence-input';
+const RPKI_ROUTE_INPUT_SCHEMA = 'whoisleuth.rpki-route-input';
+const LOCAL_GEOIP_QUERY_SCHEMA = 'whoisleuth.local-geoip-query';
+const ENCRYPTED_DNS_PLAN_INPUT_SCHEMA = 'whoisleuth.encrypted-dns-plan-input';
+const OFFLINE_EVIDENCE_INPUT_VERSION = 1;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -40,7 +48,7 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
     const input = parseInput(value);
     let kind;
     let result;
-    if (input.schema === 'whoisleuth.rdap-search-input') {
+    if (input.schema === RDAP_SEARCH_INPUT_SCHEMA) {
         kind = 'rdap_search';
         const request = record(input.request);
         const help = normalizeRdapSearchHelp(input.help);
@@ -58,7 +66,7 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
                 : inspectRdapReverseSearchResponse(input.response, [request.property]),
         });
     }
-    else if (input.schema === 'whoisleuth.dnssec-evidence-input') {
+    else if (input.schema === DNSSEC_EVIDENCE_INPUT_SCHEMA) {
         kind = 'dnssec';
         result = validateDnssecEvidence({
             ownerName: input.ownerName,
@@ -69,7 +77,7 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
             observedAt: input.observedAt,
         });
     }
-    else if (input.schema === 'whoisleuth.tlsa-evidence-input') {
+    else if (input.schema === TLSA_EVIDENCE_INPUT_SCHEMA) {
         kind = 'tlsa';
         result = analyzeTlsaEvidence({
             serviceName: input.serviceName,
@@ -81,7 +89,7 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
             authorityMaterials: input.authorityMaterials,
         });
     }
-    else if (input.schema === 'whoisleuth.rpki-route-input') {
+    else if (input.schema === RPKI_ROUTE_INPUT_SCHEMA) {
         kind = 'rpki';
         result = reviewRpkiRoute({
             routePrefix: input.routePrefix,
@@ -89,11 +97,15 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
             authorizations: input.authorizations,
         });
     }
-    else if (input.schema === 'whoisleuth.local-geoip-query') {
+    else if (input.schema === CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA) {
+        kind = 'cryptographic_assurance';
+        result = buildCryptographicAssuranceReview(input, generatedAt);
+    }
+    else if (input.schema === LOCAL_GEOIP_QUERY_SCHEMA) {
         kind = 'geoip';
         result = lookupLocalGeoIp(buildLocalGeoIpDatabase(input.database), input.address);
     }
-    else if (input.schema === 'whoisleuth.encrypted-dns-plan-input') {
+    else if (input.schema === ENCRYPTED_DNS_PLAN_INPUT_SCHEMA) {
         kind = 'encrypted_dns';
         const query = record(input.query);
         result = planEncryptedDnsQuery(normalizeEncryptedDnsAdapter(input.adapter), { name: query.name, type: query.type });
@@ -168,7 +180,8 @@ function formatOfflineEvidenceReview(document) {
                 : 'review'
             : typeof gate.pass === 'boolean'
                 ? gate.pass ? 'ready' : 'review'
-                : document.kind === 'domain_portfolio' ? 'inventory' : 'reviewed';
+                : document.kind === 'domain_portfolio' ? 'inventory'
+                    : document.kind === 'cryptographic_assurance' ? 'separate' : 'reviewed';
     const lines = [
         'Offline evidence review',
         `Kind   ${document.kind.replaceAll('_', ' ')}`,
@@ -220,6 +233,13 @@ function formatOfflineEvidenceReview(document) {
         lines.push(`Recovery ${listLength(result.recoveryCycles)}`);
         lines.push(`Unknown ${Object.values(unknownCounts).reduce((total, value) => total + count(value), 0)}`);
     }
+    else if (document.kind === 'cryptographic_assurance') {
+        const cards = Array.isArray(result.cards) ? result.cards : [];
+        for (const value of cards) {
+            const card = record(value);
+            lines.push(`${String(card.label ?? card.family ?? 'Evidence')}  ${String(card.state ?? 'unavailable').replaceAll('_', ' ')} (${String(card.completeness ?? 'unavailable')})`);
+        }
+    }
     else {
         for (const [label, key] of [
             ['Records', 'records'],
@@ -253,4 +273,4 @@ function formatOfflineEvidenceReview(document) {
     }
     return `${lines.join('\n')}\n`;
 }
-export { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, OFFLINE_EVIDENCE_REVIEW_SCHEMA, OFFLINE_EVIDENCE_REVIEW_VERSION, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, };
+export { DNSSEC_EVIDENCE_INPUT_SCHEMA, ENCRYPTED_DNS_PLAN_INPUT_SCHEMA, LOCAL_GEOIP_QUERY_SCHEMA, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, OFFLINE_EVIDENCE_INPUT_VERSION, OFFLINE_EVIDENCE_REVIEW_SCHEMA, OFFLINE_EVIDENCE_REVIEW_VERSION, RDAP_SEARCH_INPUT_SCHEMA, RPKI_ROUTE_INPUT_SCHEMA, TLSA_EVIDENCE_INPUT_SCHEMA, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, };

package/cli/page-compare.mjs

@@ -4,7 +4,7 @@ import { comparePageBaselines } from "../frontend/src/lib/analysis/page-similari
 import { CliUsageError } from "./errors.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
 export const CLI_PAGE_COMPARE_SCHEMA = 'whoisleuth.cli.page-compare';
-export const CLI_PAGE_COMPARE_VERSION = 2;
+export const CLI_PAGE_COMPARE_VERSION = 3;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -56,6 +56,8 @@ function buildCliPageComparison(leftText, rightText, generatedAt = new Date().to
         && ['success', 'partial'].includes(right.compact.technology.state);
     const tlsUsable = ['success', 'partial'].includes(left.compact.tls.state)
         && ['success', 'partial'].includes(right.compact.tls.state);
+    const technologyPartial = left.compact.technology.truncated || right.compact.technology.truncated
+        || left.compact.technology.state === 'partial' || right.compact.technology.state === 'partial';
     return {
         schema: CLI_PAGE_COMPARE_SCHEMA,
         version: CLI_PAGE_COMPARE_VERSION,
@@ -72,14 +74,15 @@ function buildCliPageComparison(leftText, rightText, generatedAt = new Date().to
         },
         page,
         technology: {
-            state: technologyUsable ? setComparison(leftTechnology, rightTechnology) : 'unavailable',
+            state: technologyUsable
+                ? technologyPartial ? 'partial' : setComparison(leftTechnology, rightTechnology)
+                : 'unavailable',
             leftSourceState: left.compact.technology.state,
             rightSourceState: right.compact.technology.state,
             leftIds: leftTechnology,
             rightIds: rightTechnology,
             sharedIds: sharedTechnology,
-            partial: left.compact.technology.truncated || right.compact.technology.truncated
-                || left.compact.technology.state === 'partial' || right.compact.technology.state === 'partial',
+            partial: technologyPartial,
         },
         tls: {
             leftSourceState: left.compact.tls.state,
@@ -115,7 +118,7 @@ function formatCliPageComparison(document) {
     for (const component of document.page.components) {
         lines.push(`${component.label.padEnd(18)} ${component.outcome}`);
     }
-    lines.push('', 'Technology', `Relationship     ${document.technology.state}`, `Shared           ${document.technology.sharedIds.join(', ') || 'None observed'}`, `Left             ${document.technology.leftIds.join(', ') || 'Unavailable'}`, `Right            ${document.technology.rightIds.join(', ') || 'Unavailable'}`, '', 'TLS', `Issuer           ${document.tls.issuer.state}`, `Public key       ${document.tls.publicKey.state}`, '', 'Limitations:');
+    lines.push('', 'Technology', `Relationship     ${document.technology.state}`, `Evidence         ${document.technology.partial ? 'Partial; equality and disjointness withheld' : 'Complete retained sets'}`, `Shared           ${document.technology.sharedIds.join(', ') || 'None observed'}`, `Left             ${document.technology.leftIds.join(', ') || 'Unavailable'}`, `Right            ${document.technology.rightIds.join(', ') || 'Unavailable'}`, '', 'TLS', `Issuer           ${document.tls.issuer.state}`, `Public key       ${document.tls.publicKey.state}`, '', 'Limitations:');
     for (const limitation of document.limitations)
         lines.push(`  - ${limitation}`);
     return `${lines.join('\n')}\n`;