@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/cli/command-reference.mjs

@@ -14,6 +14,8 @@ Investigate:
   bulk               Triage newline-delimited targets with bounded concurrency.
   http               Inspect one homepage request and redirect chain.
   tls                Inspect one hostname's current certificate connection.
+  dnssec-validate    Validate one authorised DNSSEC chain in isolation.
+  mail-transport     Review selected authorised MX transports and STARTTLS.
   posture            Review DNS mail and domain-control posture.
 
 Discover:
@@ -23,7 +25,7 @@ Discover:
   discover-scan      Collect a bounded candidate review queue.
   registry-support   Explain local registry coverage without a request.
   registry-doctor    Diagnose a saved registry collection against local policy.
-  registry-cohort    Aggregate target-free registry quality cohorts.
+  registry-cohort    Build target-free registry quality timelines.
   registry-scaffold  Create a sanitised synthetic fixture scaffold.
 
 Review saved evidence:
@@ -33,7 +35,7 @@ Review saved evidence:
   compare            Compare saved registry publications.
   page-compare       Compare saved static page and TLS evidence.
   mail-review        Review saved passive mail exposure evidence.
-  review-evidence    Review supplied DNS, routing, GeoIP, RDAP, or trust-store evidence offline.
+  review-evidence    Review supplied DNS, routing, cryptographic, GeoIP, RDAP, or trust-store evidence offline.
   brief              Turn one saved Lookup into a bounded decision brief.
   case-pack          Build a reviewed browser-importable case package.
   domain-control     Build or review an integrity-protected desired-state manifest.
@@ -43,12 +45,13 @@ Review saved evidence:
   sharing-review     Lint a reviewed artifact before deliberate sharing.
   workflow-plan      Plan a fixed investigation recipe without executing it.
   workflow-run       Execute resumable approved steps from a fixed recipe.
-  diff               Compare two saved domain observations.
+  diff               Compare two compatible retained artefacts.
   reconcile          Reconcile independently labelled observations.
   timeline           Compare a sequence of observations for one domain.
   export             Convert a saved lookup into an evidence report.
   inspect-archive    Inspect a workspace archive, redacted by default.
   verify-artifact    Validate saved evidence or an integrity envelope offline.
+  interchange-report Report preserved and excluded field groups offline.
 
 Integrity and calibration:
   manifest           Record ordered artefact and configuration digests.
@@ -81,7 +84,7 @@ const COMMAND_USAGE = Object.freeze({
     manifest: 'whoisleuth manifest <artefact.json> [...] --workflow <label> [--configuration-digest <sha256:digest>] [--json] [--quiet] [--no-color]',
     'map-observations': 'whoisleuth map-observations [mapping.json] [--json] [--quiet] [--no-color]',
     'oam-export': 'whoisleuth oam-export [external-findings.json] [--json] [--quiet] [--no-color]',
-    lookup: 'whoisleuth lookup <domain|IP|ASN> [--json|--junit|--markdown|--html] [--fast|--deep] [--observer <label>] [--vantage <label>] [--plan] [--summary|--verbose] [--strict-exit] [--fail-on <policies>] [--events] [--quiet] [--no-color]',
+    lookup: 'whoisleuth lookup <domain|IP|ASN> [--json|--junit|--markdown|--html] [--no-attribution] [--fast|--deep] [--observer <label>] [--vantage <label>] [--plan] [--summary|--verbose] [--strict-exit] [--fail-on <policies>] [--events] [--quiet] [--no-color]',
     bulk: 'whoisleuth bulk [file] [--json|--jsonl|--junit|--csv|--domains|--queries] [--registered-only|--inconclusive-only|--errors-only] [--fast|--deep] [--concurrency <1-8>] [--checkpoint <file> [--resume]] [--events] [--plan] [--fail-on <policies>]',
     'ct-search': 'whoisleuth ct-search <keyword> [--json] [--quiet] [--no-color]',
     'ct-intake': 'whoisleuth ct-intake [events.json] [--json] [--quiet] [--no-color]',
@@ -90,13 +93,16 @@ const COMMAND_USAGE = Object.freeze({
     posture: 'whoisleuth posture <domain> [--selectors <list>] [--retired-selectors <list>] [--mail-profile <profile>] [--json|--sarif --owned-domain] [--quiet] [--no-color]',
     http: 'whoisleuth http <domain> [--json] [--quiet] [--no-color]',
     tls: 'whoisleuth tls <hostname> [--json] [--quiet] [--no-color]',
+    'dnssec-validate': 'whoisleuth dnssec-validate <domain> --resolver <public-IP> --trust-anchor <anchor.json> --owned-or-authorized [--json] [--quiet] [--no-color]',
+    'mail-transport': 'whoisleuth mail-transport [input.json] --resolver <public-IP> --trust-anchor <anchor.json> --owned-or-authorized --active-probe [--json] [--quiet] [--no-color]',
     'registry-support': 'whoisleuth registry-support <domain|suffix> [--json] [--quiet] [--no-color]',
     'registry-doctor': 'whoisleuth registry-doctor [lookup.json] [--json] [--quiet] [--no-color]',
-    'registry-cohort': 'whoisleuth registry-cohort [lookups.json|lookups.jsonl] [--json] [--quiet] [--no-color]',
+    'registry-cohort': 'whoisleuth registry-cohort [lookups-or-reports.json|jsonl] [--json] [--quiet] [--no-color]',
     'registry-scaffold': 'whoisleuth registry-scaffold --profile <id> --suffix <suffix> --scenario <registered|not_found|inconclusive>',
-    'risk-calibrate': 'whoisleuth risk-calibrate [dataset.json] [--json] [--quiet] [--no-color]',
+    'risk-calibrate': 'whoisleuth risk-calibrate [dataset.json] [--json|--summary-json] [--quiet] [--no-color]',
     'lookalike-calibrate': 'whoisleuth lookalike-calibrate [dataset.json] [--json] [--quiet] [--no-color]',
-    'verify-artifact': 'whoisleuth verify-artifact [artifact.json] [--passphrase-file <file>] [--json] [--quiet] [--no-color]',
+    'verify-artifact': 'whoisleuth verify-artifact [artifact.json] [--passphrase-file <file>] [--manifest <manifest.json> --manifest-entry <artifact-N>] [--json] [--strict-exit] [--quiet] [--no-color]',
+    'interchange-report': 'whoisleuth interchange-report [artifact.json] [--passphrase-file <file>] [--json] [--quiet] [--no-color]',
     'inspect-archive': 'whoisleuth inspect-archive [archive.json] [--passphrase-file <file>] [--search <value>] [--require-match] [--reveal] [--expect-content-digest <sha256:digest>] [--json]',
     'sign-artifact': 'whoisleuth sign-artifact [artifact.json] --private-key-file <file>',
     'verify-signature': 'whoisleuth verify-signature [package.json] [--public-key-file <file>] [--json] [--quiet] [--no-color]',
@@ -114,10 +120,10 @@ const COMMAND_USAGE = Object.freeze({
     'sharing-review': 'whoisleuth sharing-review [artifact.json] --marking <level> --recipient-scope <scope> --purpose <text> [--human-reviewed] [--personal-data-reviewed] [--redactions-confirmed] [--json]',
     'workflow-plan': 'whoisleuth workflow-plan <recipe> <domain|brand> [--json] [--quiet] [--no-color]',
     'workflow-run': 'whoisleuth workflow-run <recipe> <domain|brand> [--approve-network] [--resume <state.json>] [--json] [--quiet] [--no-color]',
-    diff: 'whoisleuth diff <left.json> <right.json> [--json] [--quiet] [--no-color]',
+    diff: 'whoisleuth diff <left.json> <right.json> [--left-session <id> --right-session <id>] [--json] [--quiet] [--no-color]',
     reconcile: 'whoisleuth reconcile <observation.json> <observation.json> [...] [--json] [--quiet] [--no-color]',
     timeline: 'whoisleuth timeline <observation.json> <observation.json> [...] [--json] [--quiet] [--no-color]',
-    export: 'whoisleuth export [lookup.json] [--markdown|--html|--compact]',
+    export: 'whoisleuth export [lookup.json] [--markdown|--html|--compact] [--no-attribution]',
 });
 const COMMAND_DETAILS = Object.freeze({
     completion: {
@@ -200,6 +206,16 @@ const COMMAND_DETAILS = Object.freeze({
         example: 'whoisleuth tls example.test --json',
         boundary: 'One observed connection is point-in-time evidence and does not establish every address, edge, or historical certificate.',
     },
+    'dnssec-validate': {
+        description: 'Cryptographically validate one authorised DNSSEC chain from a supplied trust anchor through one selected public resolver.',
+        example: 'whoisleuth dnssec-validate example.test --resolver "$PUBLIC_RESOLVER_IP" --trust-anchor anchor.json --owned-or-authorized --json',
+        boundary: 'This isolated action is never invoked by Lookup, Bulk, monitoring, or recipes. It caps DNS queries, aliases, delegations, bytes, and duration; transport and validation failures remain separate, and secure is not a general safety verdict.',
+    },
+    'mail-transport': {
+        description: 'Review selected authorised MX endpoints, DNSSEC-qualified TLSA evidence, SMTP capabilities, and optional STARTTLS certificates.',
+        example: 'whoisleuth mail-transport selected-mx.json --resolver "$PUBLIC_RESOLVER_IP" --trust-anchor anchor.json --owned-or-authorized --active-probe --json',
+        boundary: 'This isolated action probes at most three selected MX hosts sequentially, reports selection, public revalidation, connection, and address authentication separately, sends only EHLO and optional STARTTLS, never retries, and performs no authentication, relay, recipient, mailbox, catch-all, or message test. If a DANE-TA TLSA usage 2 association is published, active collection retains only the leaf certificate and leaves that comparison partial without certificate-path construction and trust-anchor path validation. SMTP relay PKIX-TA usage 0 and PKIX-EE usage 1 records remain unsupported and cannot complete SMTP DANE assurance; a separate usage 3 match remains eligible.',
+    },
     'registry-support': {
         description: 'Explain the local registry capability profile for one domain or suffix.',
         example: 'whoisleuth registry-support example.test --json',
@@ -211,9 +227,9 @@ const COMMAND_DETAILS = Object.freeze({
         boundary: 'The command is offline. It distinguishes expected access constraints from collection results and does not contact a live registry.',
     },
     'registry-cohort': {
-        description: 'Aggregate saved registry observations into privacy-safe suffix and capability-profile cohorts.',
+        description: 'Build privacy-safe suffix and capability-profile timelines from saved observations or retained cohort reports.',
         example: 'whoisleuth registry-cohort saved-lookups.jsonl --json',
-        boundary: 'This command is offline and omits domains, queries, and raw evidence. Cohorts below the fixed minimum sample remain insufficient.',
+        boundary: 'This command is offline and omits domains, queries, and raw evidence. Input families cannot be mixed, and retained samples are never assumed independent.',
     },
     'registry-scaffold': {
         description: 'Create a bounded synthetic WHOIS fixture scaffold for one existing capability profile.',
@@ -222,8 +238,8 @@ const COMMAND_DETAILS = Object.freeze({
     },
     'risk-calibrate': {
         description: 'Replay reviewed labels against the current explainable Risk model.',
-        example: 'whoisleuth risk-calibrate calibration.json --json',
-        boundary: 'Calibration is offline and diagnostic. It never trains, tunes, or changes the scoring model automatically.',
+        example: 'whoisleuth risk-calibrate calibration.json --summary-json',
+        boundary: 'Calibration is offline and diagnostic. The summary form omits record identifiers, domains, and evidence; neither form trains, tunes, or changes the scoring model automatically.',
     },
     'lookalike-calibrate': {
         description: 'Summarise reviewed candidate dispositions by mutation family without retaining domains.',
@@ -231,9 +247,14 @@ const COMMAND_DETAILS = Object.freeze({
         boundary: 'Calibration is offline and diagnostic. It omits candidate identifiers, domains, notes, and evidence and never tunes generation or filtering automatically.',
     },
     'verify-artifact': {
-        description: 'Validate a supported archive, packet, manifest, or saved Lookup without printing evidence contents.',
-        example: 'whoisleuth verify-artifact workspace.json --json',
-        boundary: 'Verification is offline and redacted. Encrypted archives require an explicitly supplied passphrase file.',
+        description: 'Validate a supported archive, claim passport, packet, manifest, saved Lookup, or supported Lookup-evidence export without printing evidence contents.',
+        example: 'whoisleuth verify-artifact report.json --manifest manifest.json --manifest-entry artifact-2 --json --strict-exit',
+        boundary: 'Verification is offline and redacted. Encrypted archives require an explicitly supplied passphrase file; --strict-exit returns 4 when only an envelope or legacy projection integrity was verified.',
+    },
+    'interchange-report': {
+        description: 'Report what one recognised portable artefact preserves, excludes, and supports across browser and CLI workflows.',
+        example: 'whoisleuth interchange-report workspace.json --json',
+        boundary: 'The report is offline and metadata-only. It does not echo targets, contacts, notes, passphrases, evidence values, or an unrecognised schema string.',
     },
     'inspect-archive': {
         description: 'Summarise or search one workspace archive with redacted output by default.',
@@ -246,9 +267,9 @@ const COMMAND_DETAILS = Object.freeze({
         boundary: 'The command never creates, stores, or transmits keys. Key custody and signer identity remain the operator\'s responsibility.',
     },
     'verify-signature': {
-        description: 'Verify the integrity and signature of one signed evidence package.',
+        description: 'Verify the cryptographic signature of one signed evidence package and report embedded-artifact assurance separately.',
         example: 'whoisleuth verify-signature packet.signed.json --json',
-        boundary: 'A valid signature proves package consistency for the embedded key, not the real-world identity or authority of its holder.',
+        boundary: 'A valid signature proves package consistency for the embedded key. It does not upgrade failed or unsupported embedded-artifact assurance or establish the holder\'s real-world identity or authority.',
     },
     'source-report': {
         description: 'Create a target-free reliability summary from a saved lookup.',
@@ -321,9 +342,9 @@ const COMMAND_DETAILS = Object.freeze({
         boundary: 'Only installed recipe commands can run. Network steps require explicit approval for each invocation, and analyst-selection placeholders always pause without interpretation.',
     },
     diff: {
-        description: 'Compare bounded evidence retained in two saved domain lookups.',
+        description: 'Compare two compatible retained Lookup, Bulk-session, or domain-portfolio artefacts.',
         example: 'whoisleuth diff first.json second.json --json',
-        boundary: 'Comparison is offline. Missing, unavailable, equal, and different evidence remain separate states.',
+        boundary: 'Comparison is offline. Multi-session Bulk exports require explicit session IDs, and missing, unavailable, equal, and different evidence remain separate states.',
     },
     reconcile: {
         description: 'Reconcile bounded values across independently labelled observations of one domain.',
@@ -338,7 +359,7 @@ const COMMAND_DETAILS = Object.freeze({
     export: {
         description: 'Convert one saved lookup into a versioned evidence report.',
         example: 'whoisleuth export lookup.json --markdown',
-        boundary: 'Exports preserve source attribution and limitations. Compact output intentionally omits raw registry payloads.',
+        boundary: 'The saved Lookup is capped at 8 MiB and scanned for duplicate keys, the prototype-sensitive __proto__ key, and bounded nesting, key, value, and per-container counts before parsing. Exports preserve evidence-source attribution and limitations. Markdown and HTML include a presentation-only generator footer unless --no-attribution is selected; JSON retains bounded generator provenance. Compact output intentionally omits raw registry payloads.',
     },
 });
 const COMMAND_COLLECTION = Object.freeze({
@@ -358,13 +379,16 @@ const COMMAND_COLLECTION = Object.freeze({
     posture: { mode: 'network', scope: 'Accepts one domain and performs bounded DNS queries only.' },
     http: { mode: 'network', scope: 'Accepts one domain and follows only the bounded SSRF-guarded homepage redirect workflow.' },
     tls: { mode: 'network', scope: 'Accepts one public hostname and opens one bounded certificate connection.' },
+    'dnssec-validate': { mode: 'network', scope: 'Accepts one authorised domain, one public resolver IP, and one local trust-anchor file; DNS-over-TCP validation is capped at 32 queries and 15 seconds.' },
+    'mail-transport': { mode: 'network', scope: 'Accepts at most three selected authorised MX hosts, uses one public resolver, and performs sequential bounded SMTP connections with no retries.' },
     'registry-support': { mode: 'offline', scope: 'Reads the embedded registry capability catalogue for one domain or suffix.' },
     'registry-doctor': { mode: 'offline', scope: 'Reads one saved Lookup and the embedded registry capability catalogue.' },
-    'registry-cohort': { mode: 'offline', scope: 'Reads at most 500 saved Lookups and emits target-free suffix/profile cohort counts.' },
+    'registry-cohort': { mode: 'offline', scope: 'Reads at most 500 saved Lookups or retained cohort reports from one unmixed family and emits bounded target-free timelines.' },
     'registry-scaffold': { mode: 'offline', scope: 'Reads the embedded registry capability catalogue and prints one synthetic fixture template.' },
     'risk-calibrate': { mode: 'offline', scope: 'Reads one bounded reviewed-label dataset and changes no model or evidence.' },
     'lookalike-calibrate': { mode: 'offline', scope: 'Reads at most 5,000 reviewed candidate labels from one dataset capped at 2 MiB.' },
-    'verify-artifact': { mode: 'offline', scope: 'Reads one selected bounded archive, packet, manifest, or saved Lookup document.' },
+    'verify-artifact': { mode: 'offline', scope: 'Reads one selected bounded artefact and, when explicitly supplied, one manifest whose selected entry is compared by exact bytes and canonical identity.' },
+    'interchange-report': { mode: 'offline', scope: 'Reads one selected bounded portable artefact and emits fixed compatibility metadata only.' },
     'inspect-archive': { mode: 'offline', scope: 'Reads one selected bounded workspace archive with redacted output by default.' },
     'sign-artifact': { mode: 'offline', scope: 'Reads one selected artefact and one local private key without transmitting either.' },
     'verify-signature': { mode: 'offline', scope: 'Reads one selected signed package and optional local public key.' },
@@ -382,7 +406,7 @@ const COMMAND_COLLECTION = Object.freeze({
     'sharing-review': { mode: 'offline', scope: 'Reads one artefact capped at 15 MiB, emits only bounded schema/version metadata and no content values, and performs no transmission.' },
     'workflow-plan': { mode: 'offline', scope: 'Builds a fixed typed recipe and executes none of its network or file steps.' },
     'workflow-run': { mode: 'network', scope: 'Runs only concrete fixed-recipe steps; network collection requires --approve-network and analyst-selection steps always pause.' },
-    diff: { mode: 'offline', scope: 'Reads two saved Lookup documents for different domains.' },
+    diff: { mode: 'offline', scope: 'Reads two compatible retained artefacts capped at 8 MiB each and retains no source paths.' },
     reconcile: { mode: 'offline', scope: 'Reads 2 to 5 saved observations for one domain, capped at 32 MiB in total.' },
     timeline: { mode: 'offline', scope: 'Reads 2 to 20 saved observations for one domain, capped at 32 MiB in total.' },
     export: { mode: 'offline', scope: 'Reads one saved Lookup and writes one bounded report.' },

package/cli/completion.mjs

@@ -5,7 +5,7 @@ const OPTIONS_BY_COMMAND = Object.freeze({
     manifest: ['--workflow', '--configuration-digest', '--json', '--quiet', '--no-color'],
     'map-observations': ['--json', '--quiet', '--no-color'],
     'oam-export': ['--json', '--quiet', '--no-color'],
-    lookup: ['--json', '--junit', '--markdown', '--html', '--fast', '--deep', '--observer', '--vantage', '--plan', '--summary', '--verbose', '--strict-exit', '--fail-on', '--events', '--quiet', '--no-color'],
+    lookup: ['--json', '--junit', '--markdown', '--html', '--no-attribution', '--fast', '--deep', '--observer', '--vantage', '--plan', '--summary', '--verbose', '--strict-exit', '--fail-on', '--events', '--quiet', '--no-color'],
     bulk: ['--json', '--jsonl', '--junit', '--csv', '--domains', '--queries', '--registered-only', '--inconclusive-only', '--errors-only', '--fast', '--deep', '--concurrency', '--checkpoint', '--resume', '--events', '--plan', '--fail-on', '--quiet', '--no-color'],
     'ct-search': ['--json', '--quiet', '--no-color'],
     'ct-intake': ['--json', '--quiet', '--no-color'],
@@ -14,13 +14,16 @@ const OPTIONS_BY_COMMAND = Object.freeze({
     posture: ['--selectors', '--retired-selectors', '--mail-profile', '--json', '--sarif', '--owned-domain', '--quiet', '--no-color'],
     http: ['--json', '--quiet', '--no-color'],
     tls: ['--json', '--quiet', '--no-color'],
+    'dnssec-validate': ['--resolver', '--trust-anchor', '--owned-or-authorized', '--json', '--quiet', '--no-color'],
+    'mail-transport': ['--resolver', '--trust-anchor', '--owned-or-authorized', '--active-probe', '--json', '--quiet', '--no-color'],
     'registry-support': ['--json', '--quiet', '--no-color'],
     'registry-doctor': ['--json', '--quiet', '--no-color'],
     'registry-cohort': ['--json', '--quiet', '--no-color'],
     'registry-scaffold': ['--profile', '--suffix', '--scenario'],
-    'risk-calibrate': ['--json', '--quiet', '--no-color'],
+    'risk-calibrate': ['--json', '--summary-json', '--quiet', '--no-color'],
     'lookalike-calibrate': ['--json', '--quiet', '--no-color'],
-    'verify-artifact': ['--passphrase-file', '--json', '--quiet', '--no-color'],
+    'verify-artifact': ['--passphrase-file', '--manifest', '--manifest-entry', '--json', '--strict-exit', '--quiet', '--no-color'],
+    'interchange-report': ['--passphrase-file', '--json', '--quiet', '--no-color'],
     'inspect-archive': ['--passphrase-file', '--search', '--require-match', '--reveal', '--expect-content-digest', '--json', '--quiet', '--no-color'],
     'sign-artifact': ['--private-key-file'],
     'verify-signature': ['--public-key-file', '--json', '--quiet', '--no-color'],
@@ -38,10 +41,10 @@ const OPTIONS_BY_COMMAND = Object.freeze({
     'sharing-review': ['--marking', '--recipient-scope', '--purpose', '--human-reviewed', '--personal-data-reviewed', '--redactions-confirmed', '--json', '--quiet', '--no-color'],
     'workflow-plan': ['--json', '--quiet', '--no-color'],
     'workflow-run': ['--approve-network', '--resume', '--json', '--quiet', '--no-color'],
-    diff: ['--json', '--quiet', '--no-color'],
+    diff: ['--left-session', '--right-session', '--json', '--quiet', '--no-color'],
     reconcile: ['--json', '--quiet', '--no-color'],
     timeline: ['--json', '--quiet', '--no-color'],
-    export: ['--markdown', '--html', '--compact'],
+    export: ['--markdown', '--html', '--compact', '--no-attribution'],
     completion: [],
     commands: ['--json', '--quiet', '--no-color'],
     doctor: ['--network', '--json', '--quiet', '--no-color'],
@@ -60,13 +63,16 @@ const COMMAND_DESCRIPTIONS = Object.freeze({
     posture: 'Review DNS and mail posture',
     http: 'Inspect one homepage request',
     tls: 'Inspect one TLS connection',
+    'dnssec-validate': 'Validate an authorised DNSSEC chain',
+    'mail-transport': 'Review selected authorised SMTP transports',
     'registry-support': 'Explain local registry coverage',
     'registry-doctor': 'Diagnose saved registry collection',
-    'registry-cohort': 'Aggregate target-free registry quality cohorts',
+    'registry-cohort': 'Build target-free registry quality timelines',
     'registry-scaffold': 'Create a sanitised registry fixture scaffold',
     'risk-calibrate': 'Replay reviewed Risk labels offline',
     'lookalike-calibrate': 'Summarise reviewed lookalike yield offline',
     'verify-artifact': 'Validate saved evidence offline',
+    'interchange-report': 'Report portable artefact fidelity offline',
     'inspect-archive': 'Inspect an archive locally',
     'sign-artifact': 'Sign a reviewed artefact locally',
     'verify-signature': 'Verify a signed evidence package',
@@ -84,7 +90,7 @@ const COMMAND_DESCRIPTIONS = Object.freeze({
     'sharing-review': 'Lint an artefact before deliberate sharing',
     'workflow-plan': 'Plan a fixed investigation recipe',
     'workflow-run': 'Execute approved fixed-recipe steps',
-    diff: 'Compare two saved domain lookups',
+    diff: 'Compare two compatible retained artefacts',
     reconcile: 'Reconcile independently labelled observations',
     timeline: 'Build same-domain history from saved lookups',
     export: 'Convert a lookup to an evidence report',
@@ -115,6 +121,7 @@ const FILE_OPTIONS = Object.freeze([
     '--observation-snapshot',
     '--previous',
     '--resume',
+    '--trust-anchor',
 ]);
 const FILE_POSITIONAL_COMMANDS = new Set([
     'manifest',
@@ -122,6 +129,7 @@ const FILE_POSITIONAL_COMMANDS = new Set([
     'oam-export',
     'ct-intake',
     'change-packet',
+    'mail-transport',
 ]);
 const TEXT_OPTIONS = Object.freeze([
     '--families',
@@ -231,7 +239,7 @@ function fishCompletion() {
         const requiresValue = fileValue || [...Object.keys(VALUE_OPTIONS), ...TEXT_OPTIONS].includes(option);
         return `complete -c whoisleuth -n '${condition}' -l ${name}${requiresValue ? ' -r' : ''}${fileValue ? ' -F' : ''}`;
     };
-    const commonCondition = `__fish_seen_subcommand_from ${CLI_COMMANDS.join(' ')}`;
+    const commonCondition = 'not __fish_use_subcommand';
     const commonOptionLines = COMMON_OPTIONS.map((option) => optionLine(commonCondition, option));
     const optionLines = Object.entries(OPTIONS_BY_COMMAND).flatMap(([command, options]) => (options.map((option) => optionLine(`__fish_seen_subcommand_from ${command}`, option))));
     const valueLines = Object.entries(VALUE_OPTIONS).flatMap(([option, values]) => (values.map((value) => `complete -c whoisleuth -n '__fish_prev_arg_in ${option}' -a '${value}'`)));

package/cli/ct-event-intake.mjs

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import { domainToASCII } from 'node:url';
 import { exactKeys, requireBoundedString, requireIsoTimestamp, requireRecord, } from "../lib/bounded-contract-normalizers.mjs";
 export const CT_EVENT_BATCH_SCHEMA = 'whoisleuth.ct-event-batch';
@@ -21,6 +22,15 @@ const EVENT_KEYS = new Set([
     'limitations',
 ]);
 const SHA256_RE = /^[a-f0-9]{64}$/u;
+function eventId(logId, certificateSha256, observedAt) {
+    return createHash('sha256')
+        .update(logId)
+        .update('\u0000')
+        .update(certificateSha256)
+        .update('\u0000')
+        .update(observedAt)
+        .digest('hex');
+}
 function optionalText(value, label, maximum) {
     if (value === undefined || value === null || value === '')
         return null;
@@ -80,6 +90,7 @@ export function buildCtEventFindings(inputRaw) {
             throw new TypeError(`events[${eventIndex}].completeness must be complete or partial.`);
         }
         const limitations = boundedLimitations(event.limitations, `events[${eventIndex}].limitations`);
+        const retainedEventId = eventId(logId, certificateSha256, observedAt);
         return names.map((name) => ({
             domain: name,
             category: 'certificate',
@@ -96,6 +107,11 @@ export function buildCtEventFindings(inputRaw) {
                 value: certificateSha256,
                 issuer,
                 notAfter,
+                eventId: retainedEventId,
+                logId,
+                certificateSha256,
+                dnsNameCount: names.length,
+                namesComplete: completeness === 'complete',
             },
         }));
     });
@@ -105,7 +121,7 @@ export function buildCtEventFindings(inputRaw) {
         || left.observedAt.localeCompare(right.observedAt)
         || left.structuredObservation.value.localeCompare(right.structuredObservation.value))
         .filter((item) => {
-        const key = `${item.domain}\u0000${item.observedAt}\u0000${item.structuredObservation.value}`;
+        const key = `${item.domain}\u0000${item.observedAt}\u0000${item.structuredObservation.value}\u0000${item.structuredObservation.eventId}`;
         if (seen.has(key))
             return false;
         seen.add(key);
@@ -127,17 +143,31 @@ export function buildCtEventFindings(inputRaw) {
             break;
     }
     const truncated = selected.length < unique.length;
+    const selectedNamesByEvent = new Map();
+    for (const finding of selected) {
+        const retainedEventId = finding.structuredObservation.eventId;
+        selectedNamesByEvent.set(retainedEventId, (selectedNamesByEvent.get(retainedEventId) ?? 0) + 1);
+    }
     const findings = selected.map((finding) => Object.freeze({
         ...finding,
+        structuredObservation: Object.freeze({
+            ...finding.structuredObservation,
+            namesComplete: finding.structuredObservation.namesComplete
+                && selectedNamesByEvent.get(finding.structuredObservation.eventId) === finding.structuredObservation.dnsNameCount,
+        }),
         limitations: Object.freeze([
             ...finding.limitations,
             'The supplied event is an observation, not proof that the certificate was served by the named domain or that the domain operator requested it.',
+            ...(finding.structuredObservation.namesComplete
+                && selectedNamesByEvent.get(finding.structuredObservation.eventId) !== finding.structuredObservation.dnsNameCount
+                ? ['The bounded import did not retain every DNS name from this certificate event.']
+                : []),
             ...(truncated ? [`The batch contained ${unique.length} unique domain observations; this import preserves the first ${MAX_CT_EXTERNAL_FINDINGS} in deterministic order.`] : []),
         ].slice(0, 8)),
     }));
     return Object.freeze({
         schema: 'whoisleuth.external-findings',
-        schemaVersion: 3,
+        schemaVersion: 4,
         source,
         findings: Object.freeze(findings),
     });

package/cli/discovery-scan-command-runner.mjs

@@ -1,9 +1,8 @@
-import { createReadStream } from 'node:fs';
 import { classifyQuery } from "../lib/classify.mjs";
 import { normalizeSelectedDnsResolvers } from "../lib/dns-resolver-selection.mjs";
 import { runUnifiedLookup } from "../lib/lookup.mjs";
 import { createBulkCheckpointWriter } from "./bulk-checkpoint.mjs";
-import { buildDiscoveryScanDocument, formatDiscoveryScanCsv, formatDiscoveryScanDomains, formatDiscoveryScanJsonLines, formatTerminalDiscoveryScan, parseDiscoveryScanAllowlist, readDiscoveryScanListBounded, runDiscoveryScanChunks, } from "./discovery-scan.mjs";
+import { buildDiscoveryScanDocument, formatDiscoveryScanCsv, formatDiscoveryScanDomains, formatDiscoveryScanJsonLines, formatTerminalDiscoveryScan, parseDiscoveryScanAllowlist, runDiscoveryScanChunks, } from "./discovery-scan.mjs";
 import { updateDiscoveryObservationSnapshot } from "./discovery-observation-snapshot.mjs";
 import { generateDiscoveryCandidates } from "./discovery-workflow.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
@@ -12,13 +11,13 @@ import { formatJsonDocument } from "./formatters/json.mjs";
 import { createCliProgressEvents } from "./progress-events.mjs";
 import { buildCollectionPreflight, formatCollectionPreflight } from "./collection-preflight.mjs";
 import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
-async function readAllowlist(source, dependencies, classify) {
+async function readAllowlist(source, dependencies, context, classify) {
     if (!source)
         return new Set();
     try {
         const text = dependencies.readDiscoveryAllowlist
             ? await dependencies.readDiscoveryAllowlist(source)
-            : await readDiscoveryScanListBounded(createReadStream(source, { highWaterMark: 64 * 1024 }));
+            : await context.readInput(source, 64 * 1024, 'Discovery scan allowlist');
         return parseDiscoveryScanAllowlist(text, classify);
     }
     catch (error) {
@@ -61,7 +60,7 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
             throw new CliUsageError(boundedCliErrorMessage(error, 'Invalid DNS resolver selection'));
         }
     }
-    const allowlist = await readAllowlist(args.allowlistSource, dependencies, classify);
+    const allowlist = await readAllowlist(args.allowlistSource, dependencies, context, classify);
     const checkpointWriter = dependencies.createBulkCheckpointWriter || createBulkCheckpointWriter;
     const checkpoint = args.checkpoint
         ? await checkpointWriter({

package/cli/discovery-workflow.mjs

@@ -1,6 +1,5 @@
 import { createHash } from 'node:crypto';
-import { createReadStream } from 'node:fs';
-import { DEFAULT_DISCOVERY_TLDS, MAX_DISCOVERY_DICTIONARY_BYTES, normalizeDiscoveryTlds, readDiscoveryDictionaryBounded, } from "./discover.mjs";
+import { DEFAULT_DISCOVERY_TLDS, MAX_DISCOVERY_DICTIONARY_BYTES, normalizeDiscoveryTlds, } from "./discover.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 async function generateDiscoveryCandidates(args, dependencies, context) {
     const seed = args.seed || await context.readSingleInput();
@@ -29,7 +28,7 @@ async function generateDiscoveryCandidates(args, dependencies, context) {
         try {
             dictionaryText = dependencies.readDiscoveryDictionary
                 ? await dependencies.readDiscoveryDictionary(args.dictionarySource)
-                : await readDiscoveryDictionaryBounded(createReadStream(args.dictionarySource, { highWaterMark: MAX_DISCOVERY_DICTIONARY_BYTES }), MAX_DISCOVERY_DICTIONARY_BYTES);
+                : await context.readInput(args.dictionarySource, MAX_DISCOVERY_DICTIONARY_BYTES, 'Discovery dictionary');
         }
         catch (error) {
             if (error instanceof CliUsageError)

package/cli/doctor.mjs

@@ -1,6 +1,6 @@
 import { withTimeout } from "../lib/abort.mjs";
-const DOCTOR_SCHEMA = 'whoisleuth.cli.doctor';
-const DOCTOR_VERSION = 1;
+export const DOCTOR_SCHEMA = 'whoisleuth.cli.doctor';
+export const DOCTOR_VERSION = 1;
 const MINIMUM_NODE_MAJOR = 24;
 const NETWORK_HOST = 'whois.iana.org';
 const NETWORK_QUERY = 'example.com';

package/cli/domain-control-monitor.mjs

@@ -1,4 +1,5 @@
 import { classifyQuery } from "../lib/classify.mjs";
+import { scanBoundedJson } from "../lib/bounded-json.mjs";
 import { buildDomainControlFlightRecorder, } from "../lib/domain-control-flight-recorder.mjs";
 import { verifyDomainControlManifest } from "../lib/domain-control-manifest.mjs";
 import { buildCliLookupDocument } from "./formatters/json.mjs";
@@ -7,16 +8,27 @@ import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 export const CLI_DOMAIN_CONTROL_MONITOR_SCHEMA = 'whoisleuth.cli.domain-control-monitor';
 export const CLI_DOMAIN_CONTROL_MONITOR_VERSION = 1;
 export const MAX_DOMAIN_CONTROL_MONITOR_DOMAINS = 20;
-function previousSnapshot(input) {
-    if (!input)
-        return { observations: [] };
-    let parsed;
+function parseMonitorJson(input, label) {
+    const normalized = input.replace(/^\uFEFF/u, '');
     try {
-        parsed = JSON.parse(input.replace(/^\uFEFF/u, ''));
+        scanBoundedJson(normalized);
+        return JSON.parse(normalized);
     }
-    catch {
-        throw new CliUsageError('Previous monitor snapshot must be valid JSON.');
+    catch (cause) {
+        const detail = cause instanceof Error ? cause.message : '';
+        if (detail === 'Artefact input is not valid JSON.') {
+            throw new CliUsageError(`${label} must be valid JSON.`);
+        }
+        if (detail.startsWith('Artefact JSON ')) {
+            throw new CliUsageError(`${label} ${detail.slice('Artefact JSON '.length)}`);
+        }
+        throw new CliUsageError(`${label} must satisfy the bounded JSON structure contract.`);
     }
+}
+function previousSnapshot(input) {
+    if (!input)
+        return { observations: [] };
+    const parsed = parseMonitorJson(input, 'Previous monitor snapshot');
     const root = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
     if (root.schema !== CLI_DOMAIN_CONTROL_MONITOR_SCHEMA || root.version !== CLI_DOMAIN_CONTROL_MONITOR_VERSION || !Array.isArray(root.observations)) {
         throw new CliUsageError(`Previous monitor snapshot must use ${CLI_DOMAIN_CONTROL_MONITOR_SCHEMA} version ${CLI_DOMAIN_CONTROL_MONITOR_VERSION}.`);
@@ -29,14 +41,9 @@ function previousSnapshot(input) {
 }
 export async function runDomainControlMonitor(manifestInput, previousInput, options) {
     const generatedAt = options.now();
-    let rawManifest;
-    try {
-        rawManifest = JSON.parse(manifestInput.replace(/^\uFEFF/u, ''));
-    }
-    catch {
-        throw new CliUsageError('Domain-control manifest must be valid JSON.');
-    }
+    const rawManifest = parseMonitorJson(manifestInput, 'Domain-control manifest');
     const manifest = verifyDomainControlManifest(rawManifest);
+    const previous = previousSnapshot(previousInput);
     const entries = manifest.entries.slice(0, Math.min(options.limit, MAX_DOMAIN_CONTROL_MONITOR_DOMAINS));
     const lookups = new Array(entries.length);
     const failures = [];
@@ -69,7 +76,6 @@ export async function runDomainControlMonitor(manifestInput, previousInput, opti
     const review = buildCliDomainControlReview(JSON.stringify({
         schema: 'whoisleuth.cli.domain-control-review-input', version: 1, manifest, lookups: successful,
     }), generatedAt);
-    const previous = previousSnapshot(previousInput);
     const observations = review.observations;
     const flightRecorder = buildDomainControlFlightRecorder({
         schema: 'whoisleuth.domain-control-flight-recorder.input', version: 1,

package/cli/domain-control-observations.mjs

@@ -1,4 +1,5 @@
 import { Buffer } from 'node:buffer';
+import { MAX_BOUNDED_JSON_DEPTH, MAX_BOUNDED_JSON_KEYS, MAX_BOUNDED_JSON_VALUES, scanBoundedJson, } from "../lib/bounded-json.mjs";
 import { DOMAIN_CONTROL_FLIGHT_RECORDER_FIELDS, } from "../lib/domain-control-flight-recorder.mjs";
 import { DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, reviewDomainControlManifest, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
 import { CliUsageError } from "./errors.mjs";
@@ -7,6 +8,10 @@ export const CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA = 'whoisleuth.cli.domain-con
 export const CLI_DOMAIN_CONTROL_REVIEW_SCHEMA = 'whoisleuth.cli.domain-control-review';
 export const CLI_DOMAIN_CONTROL_REVIEW_VERSION = 1;
 export const MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES = 32 * 1024 * 1024;
+export const MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS = 100;
+export const MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH = MAX_BOUNDED_JSON_DEPTH + 2;
+export const MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS = MAX_BOUNDED_JSON_KEYS * (MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS + 1);
+export const MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES = MAX_BOUNDED_JSON_VALUES * (MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS + 1);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -134,9 +139,27 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
     if (Buffer.byteLength(inputText, 'utf8') > MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES) {
         throw new CliUsageError(`Domain-control review input is limited to ${MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES} bytes.`);
     }
+    const normalizedInput = inputText.replace(/^\uFEFF/u, '');
+    try {
+        scanBoundedJson(normalizedInput, {
+            maximumDepth: MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH,
+            maximumKeys: MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS,
+            maximumValues: MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES,
+        });
+    }
+    catch (cause) {
+        const detail = cause instanceof Error ? cause.message : '';
+        if (detail === 'Artefact input is not valid JSON.') {
+            throw new CliUsageError('Domain-control review input must be valid JSON.');
+        }
+        const boundedDetail = detail.replace(/^Artefact JSON /u, '');
+        throw new CliUsageError(boundedDetail
+            ? `Domain-control review input ${boundedDetail}`
+            : 'Domain-control review input must be valid JSON.');
+    }
     let parsed;
     try {
-        parsed = JSON.parse(inputText.replace(/^\uFEFF/u, ''));
+        parsed = JSON.parse(normalizedInput);
     }
     catch {
         throw new CliUsageError('Domain-control review input must be valid JSON.');
@@ -148,7 +171,7 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
     if (Object.keys(input).some((key) => !new Set(['schema', 'version', 'manifest', 'lookups']).has(key))) {
         throw new CliUsageError('Domain-control review input contains an unsupported field.');
     }
-    if (input.lookups.length < 1 || input.lookups.length > 100) {
+    if (input.lookups.length < 1 || input.lookups.length > MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS) {
         throw new CliUsageError('Domain-control review requires from 1 to 100 saved Lookup documents.');
     }
     const manifest = verifyDomainControlManifest(input.manifest);