@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/cli/manual.mjs

@@ -12,20 +12,20 @@ function buildCliManual(options) {
     }).join('\n');
     return `.TH WHOISLEUTH 1 "" "WHOISleuth ${roffText(options.version)}" "User Commands"
 .SH NAME
-whoisleuth \- source-aware domain investigation from the terminal
+whoisleuth \- domain investigation from the terminal
 .SH SYNOPSIS
 .B whoisleuth
-command [options]
+[command|target] [options]
 .SH DESCRIPTION
-WHOISleuth performs bounded WHOIS, RDAP, DNS, HTTP, TLS, certificate-transparency, posture, lookalike, and offline evidence operations. Evidence sources remain separately attributed, and missing or failed collection is not converted into a claim of absence or safety.
+WHOISleuth performs WHOIS, RDAP, DNS, HTTP, TLS, certificate-transparency, posture, lookalike and offline evidence operations with explicit source and collection states. With no arguments, an eligible interactive terminal opens the Lookup and command launcher; unsupported or redirected terminals print help.
 .SH COMMANDS
 ${commands}
 .SH OUTPUT
-Human-readable output is the default. Versioned JSON and JSONL are available where documented. Diagnostics and optional progress events are written to standard error. Use --output with an optional --force flag for atomic private file output.
+Human-readable output is the default. Versioned JSON and JSONL are available where documented. Diagnostics and optional progress events use standard error. Use --output and optional --force for atomic private file output. Use --palette auto, light, or dark for a fixed terminal palette. Lookup --browse provides an interactive terminal view.
 .SH EXIT STATUS
 0 indicates command completion, 2 invalid usage, 3 a collection or comparison failure, 4 an explicitly detected partial result, 70 an internal bootstrap failure, 130 analyst cancellation, and 143 service termination.
 .SH PRIVACY
-Network commands disclose the target to the directly queried upstream services. Offline commands do not make network requests. Output files are created with private permissions and are never uploaded by the CLI.
+Network commands disclose the target to the sources named in focused help. Offline commands read local input only. Output files use private permissions and remain on the operator's machine.
 .SH LICENSE
 AGPL-3.0-only. Copyright 2026 slicedearth.
 .SH SEE ALSO

package/cli/network-command-runner.mjs

@@ -2,6 +2,8 @@ import { fetchHomepage } from "../lib/availability.mjs";
 import { searchCertificateTransparency } from "../lib/ct-search.mjs";
 import { checkDomainPosture, normalizeAuditDomain, normalizeDkimSelectors } from "../lib/domain-posture.mjs";
 import { collectTlsIntelligence, normalizeTlsHostname } from "../lib/tls-intelligence.mjs";
+import { MAX_DNSSEC_TRUST_ANCHOR_BYTES, formatDnssecChainReport, validateDnssecChain, } from "../lib/dnssec-chain-validation.mjs";
+import { MAX_MAIL_TRANSPORT_INPUT_BYTES, collectMailTransportReview, formatMailTransportReview, } from "../lib/smtp-transport-review.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { buildCliCtSearchDocument, buildCliHttpDocument, buildCliPostureDocument, buildCliTlsDocument, formatJsonDocument, } from "./formatters/json.mjs";
 import { formatTerminalCtSearch, formatTerminalHttp, formatTerminalPosture, formatTerminalTls, } from "./formatters/terminal.mjs";
@@ -71,6 +73,82 @@ async function runNetworkCommand(args, dependencies, context) {
         }
         return EXIT_CODES.SUCCESS;
     }
+    if (args.action === 'dnssec-validate') {
+        let anchorInput;
+        try {
+            anchorInput = dependencies.readTrustAnchorInput
+                ? await dependencies.readTrustAnchorInput(args.trustAnchorSource)
+                : await context.readInput(args.trustAnchorSource, MAX_DNSSEC_TRUST_ANCHOR_BYTES, 'DNSSEC trust anchor');
+        }
+        catch (error) {
+            if (error instanceof CliUsageError)
+                throw error;
+            throw new CliUsageError(`Could not read DNSSEC trust anchor: ${String(error instanceof Error ? error.message : error).slice(0, 240)}`);
+        }
+        const validate = dependencies.validateDnssecChain ?? validateDnssecChain;
+        const report = await context.withProgress('Validating the isolated DNSSEC chain', () => validate({
+            target: args.target,
+            resolver: args.resolver,
+            trustAnchor: anchorInput,
+            observedAt: context.now(),
+            ownedOrAuthorized: args.ownedOrAuthorized,
+        }));
+        if (!args.quiet) {
+            context.writeStdout(args.output === 'json'
+                ? formatJsonDocument(report)
+                : context.terminal(formatDnssecChainReport(report), args.color));
+        }
+        return report.state === 'secure' || report.state === 'insecure'
+            ? EXIT_CODES.SUCCESS
+            : EXIT_CODES.PARTIAL_FAILURE;
+    }
+    if (args.action === 'mail-transport') {
+        let input;
+        let anchorInput;
+        try {
+            input = await (dependencies.readMailTransportInput
+                ? dependencies.readMailTransportInput(args.source)
+                : context.readInput(args.source, MAX_MAIL_TRANSPORT_INPUT_BYTES, 'Mail transport input'));
+        }
+        catch (error) {
+            if (error instanceof CliUsageError)
+                throw error;
+            throw new CliUsageError(`Could not read mail transport input: ${String(error instanceof Error ? error.message : error).slice(0, 240)}`);
+        }
+        try {
+            anchorInput = await (dependencies.readTrustAnchorInput
+                ? dependencies.readTrustAnchorInput(args.trustAnchorSource)
+                : context.readInput(args.trustAnchorSource, MAX_DNSSEC_TRUST_ANCHOR_BYTES, 'DNSSEC trust anchor'));
+        }
+        catch (error) {
+            if (error instanceof CliUsageError)
+                throw error;
+            throw new CliUsageError(`Could not read DNSSEC trust anchor: ${String(error instanceof Error ? error.message : error).slice(0, 240)}`);
+        }
+        if (!input.trim())
+            throw new CliUsageError('mail-transport requires one versioned JSON file or a document on stdin.');
+        const collect = dependencies.collectMailTransportReview ?? collectMailTransportReview;
+        let review;
+        try {
+            review = await context.withProgress('Reviewing selected authorised mail transports', () => collect(input, {
+                resolver: args.resolver,
+                trustAnchor: anchorInput,
+                ownedOrAuthorized: args.ownedOrAuthorized,
+                activeProbeAcknowledged: args.activeProbeAcknowledged,
+            }));
+        }
+        catch (error) {
+            if (error instanceof TypeError)
+                throw new CliUsageError(error.message);
+            throw error;
+        }
+        if (!args.quiet) {
+            context.writeStdout(args.output === 'json'
+                ? formatJsonDocument(review)
+                : context.terminal(formatMailTransportReview(review), args.color));
+        }
+        return review.runState === 'complete' ? EXIT_CODES.SUCCESS : EXIT_CODES.PARTIAL_FAILURE;
+    }
     const requestedHostname = args.hostname || await context.readSingleInput();
     if (!requestedHostname)
         throw new CliUsageError('tls requires one hostname as an argument or on stdin.');

package/cli/offline-evidence-review.mjs

@@ -1,4 +1,5 @@
 import { Buffer } from 'node:buffer';
+import { scanBoundedJson } from "../lib/bounded-json.mjs";
 import { normalizeEncryptedDnsAdapter, planEncryptedDnsQuery, } from "../lib/encrypted-dns-contract.mjs";
 import { validateDnssecEvidence } from "../lib/dnssec-evidence-validation.mjs";
 import { reviewDomainChange } from "../lib/domain-change-review.mjs";
@@ -8,14 +9,23 @@ import { buildLocalGeoIpDatabase, lookupLocalGeoIp, } from "../lib/local-geoip-e
 import { inspectRdapReverseSearchResponse, normalizeRdapSearchHelp, planRdapReverseSearch, } from "../lib/rdap-search-workbench.mjs";
 import { reviewRpkiRoute } from "../lib/rpki-evidence.mjs";
 import { analyzeTlsaEvidence } from "../lib/tlsa-evidence.mjs";
+import { CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA, buildCryptographicAssuranceReview, } from "../lib/cryptographic-assurance.mjs";
 import { reviewZoneIntent } from "../lib/zone-intent-review.mjs";
 import { reviewDnsConvergence } from "../lib/dns-convergence-review.mjs";
 import { compareTrustStoreEvidence } from "../lib/trust-store-comparison.mjs";
 import { CliUsageError } from "./errors.mjs";
+import { safeTerminalValue } from "./formatters/terminal.mjs";
 import { LOCAL_MMDB_QUERY_SCHEMA, reviewLocalMmdb } from "./local-mmdb-review.mjs";
 const OFFLINE_EVIDENCE_REVIEW_SCHEMA = 'whoisleuth.cli.offline-evidence-review';
 const OFFLINE_EVIDENCE_REVIEW_VERSION = 1;
 const MAX_OFFLINE_EVIDENCE_INPUT_BYTES = 16 * 1024 * 1024;
+const RDAP_SEARCH_INPUT_SCHEMA = 'whoisleuth.rdap-search-input';
+const DNSSEC_EVIDENCE_INPUT_SCHEMA = 'whoisleuth.dnssec-evidence-input';
+const TLSA_EVIDENCE_INPUT_SCHEMA = 'whoisleuth.tlsa-evidence-input';
+const RPKI_ROUTE_INPUT_SCHEMA = 'whoisleuth.rpki-route-input';
+const LOCAL_GEOIP_QUERY_SCHEMA = 'whoisleuth.local-geoip-query';
+const ENCRYPTED_DNS_PLAN_INPUT_SCHEMA = 'whoisleuth.encrypted-dns-plan-input';
+const OFFLINE_EVIDENCE_INPUT_VERSION = 1;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -23,12 +33,14 @@ function parseInput(value) {
     if (typeof value !== 'string' || Buffer.byteLength(value, 'utf8') > MAX_OFFLINE_EVIDENCE_INPUT_BYTES) {
         throw new CliUsageError(`Offline evidence input is limited to ${MAX_OFFLINE_EVIDENCE_INPUT_BYTES} bytes.`);
     }
+    const normalized = value.replace(/^\uFEFF/u, '');
     let parsed;
     try {
-        parsed = JSON.parse(value.replace(/^\uFEFF/u, ''));
+        scanBoundedJson(normalized);
+        parsed = JSON.parse(normalized);
     }
     catch {
-        throw new CliUsageError('Offline evidence review requires one valid JSON document.');
+        throw new CliUsageError('Offline evidence review requires one valid bounded JSON document without duplicate keys.');
     }
     const document = record(parsed);
     if (document.version !== 1 || typeof document.schema !== 'string') {
@@ -40,7 +52,7 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
     const input = parseInput(value);
     let kind;
     let result;
-    if (input.schema === 'whoisleuth.rdap-search-input') {
+    if (input.schema === RDAP_SEARCH_INPUT_SCHEMA) {
         kind = 'rdap_search';
         const request = record(input.request);
         const help = normalizeRdapSearchHelp(input.help);
@@ -58,7 +70,7 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
                 : inspectRdapReverseSearchResponse(input.response, [request.property]),
         });
     }
-    else if (input.schema === 'whoisleuth.dnssec-evidence-input') {
+    else if (input.schema === DNSSEC_EVIDENCE_INPUT_SCHEMA) {
         kind = 'dnssec';
         result = validateDnssecEvidence({
             ownerName: input.ownerName,
@@ -69,19 +81,19 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
             observedAt: input.observedAt,
         });
     }
-    else if (input.schema === 'whoisleuth.tlsa-evidence-input') {
+    else if (input.schema === TLSA_EVIDENCE_INPUT_SCHEMA) {
         kind = 'tlsa';
         result = analyzeTlsaEvidence({
             serviceName: input.serviceName,
-            dnssecState: input.dnssecState,
-            pkixValidationState: input.pkixValidationState,
+            dnssecState: 'unavailable',
+            pkixValidationState: 'unavailable',
             records: input.records,
             certificateDerBase64: input.certificateDerBase64,
             spkiDerBase64: input.spkiDerBase64,
             authorityMaterials: input.authorityMaterials,
         });
     }
-    else if (input.schema === 'whoisleuth.rpki-route-input') {
+    else if (input.schema === RPKI_ROUTE_INPUT_SCHEMA) {
         kind = 'rpki';
         result = reviewRpkiRoute({
             routePrefix: input.routePrefix,
@@ -89,11 +101,15 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
             authorizations: input.authorizations,
         });
     }
-    else if (input.schema === 'whoisleuth.local-geoip-query') {
+    else if (input.schema === CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA) {
+        kind = 'cryptographic_assurance';
+        result = buildCryptographicAssuranceReview(input, generatedAt);
+    }
+    else if (input.schema === LOCAL_GEOIP_QUERY_SCHEMA) {
         kind = 'geoip';
         result = lookupLocalGeoIp(buildLocalGeoIpDatabase(input.database), input.address);
     }
-    else if (input.schema === 'whoisleuth.encrypted-dns-plan-input') {
+    else if (input.schema === ENCRYPTED_DNS_PLAN_INPUT_SCHEMA) {
         kind = 'encrypted_dns';
         const query = record(input.query);
         result = planEncryptedDnsQuery(normalizeEncryptedDnsAdapter(input.adapter), { name: query.name, type: query.type });
@@ -168,7 +184,8 @@ function formatOfflineEvidenceReview(document) {
                 : 'review'
             : typeof gate.pass === 'boolean'
                 ? gate.pass ? 'ready' : 'review'
-                : document.kind === 'domain_portfolio' ? 'inventory' : 'reviewed';
+                : document.kind === 'domain_portfolio' ? 'inventory'
+                    : document.kind === 'cryptographic_assurance' ? 'separate' : 'reviewed';
     const lines = [
         'Offline evidence review',
         `Kind   ${document.kind.replaceAll('_', ' ')}`,
@@ -220,6 +237,20 @@ function formatOfflineEvidenceReview(document) {
         lines.push(`Recovery ${listLength(result.recoveryCycles)}`);
         lines.push(`Unknown ${Object.values(unknownCounts).reduce((total, value) => total + count(value), 0)}`);
     }
+    else if (document.kind === 'cryptographic_assurance') {
+        const cards = Array.isArray(result.cards) ? result.cards : [];
+        for (const value of cards) {
+            const card = record(value);
+            lines.push(`${safeTerminalValue(card.label ?? card.family, 'Evidence')}  ${safeTerminalValue(card.state, 'unavailable').replaceAll('_', ' ')} (${safeTerminalValue(card.completeness, 'unavailable')})`);
+            lines.push(`  Source ${safeTerminalValue(card.source, 'not supplied')}`);
+            lines.push(`  Authority ${safeTerminalValue(card.authority, 'not supplied')}`);
+            const cardLimitations = Array.isArray(card.limitations) ? card.limitations : [];
+            for (const limitation of cardLimitations) {
+                if (typeof limitation === 'string')
+                    lines.push(`  Limitation: ${safeTerminalValue(limitation)}`);
+            }
+        }
+    }
     else {
         for (const [label, key] of [
             ['Records', 'records'],
@@ -238,7 +269,7 @@ function formatOfflineEvidenceReview(document) {
         lines.push('', 'Review reasons:');
         for (const reason of reasons.slice(0, 8)) {
             if (typeof reason === 'string')
-                lines.push(`  - ${reason.replace(/[\u0000-\u001f\u007f]+/gu, ' ').trim().slice(0, 240)}`);
+                lines.push(`  - ${safeTerminalValue(reason)}`);
         }
         if (reasons.length > 8)
             lines.push(`  - ${reasons.length - 8} more reason(s) omitted.`);
@@ -249,8 +280,8 @@ function formatOfflineEvidenceReview(document) {
     const nestedLimitations = Array.isArray(result.limitations) ? result.limitations : [];
     for (const limitation of nestedLimitations) {
         if (typeof limitation === 'string')
-            lines.push(`  - ${limitation}`);
+            lines.push(`  - ${safeTerminalValue(limitation)}`);
     }
     return `${lines.join('\n')}\n`;
 }
-export { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, OFFLINE_EVIDENCE_REVIEW_SCHEMA, OFFLINE_EVIDENCE_REVIEW_VERSION, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, };
+export { DNSSEC_EVIDENCE_INPUT_SCHEMA, ENCRYPTED_DNS_PLAN_INPUT_SCHEMA, LOCAL_GEOIP_QUERY_SCHEMA, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, OFFLINE_EVIDENCE_INPUT_VERSION, OFFLINE_EVIDENCE_REVIEW_SCHEMA, OFFLINE_EVIDENCE_REVIEW_VERSION, RDAP_SEARCH_INPUT_SCHEMA, RPKI_ROUTE_INPUT_SCHEMA, TLSA_EVIDENCE_INPUT_SCHEMA, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, };

package/cli/open-asset-model-bridge.mjs

@@ -1,5 +1,5 @@
 import { isIP } from 'node:net';
-import { parseExternalFindingsDocument, } from "../frontend/src/lib/analysis/external-findings-import.js";
+import { parseExternalFindingsDocument, } from "../packages/interchange/external-findings-import.mjs";
 import { requireIsoTimestamp } from "../lib/bounded-contract-normalizers.mjs";
 export const OPEN_ASSET_MODEL_BRIDGE_SCHEMA = 'whoisleuth.open-asset-model-bridge';
 export const OPEN_ASSET_MODEL_BRIDGE_VERSION = 1;

package/cli/output-file.mjs

@@ -5,7 +5,14 @@ import { basename, dirname, join, resolve } from 'node:path';
 import { CliUsageError } from "./errors.mjs";
 export const MAX_CLI_OUTPUT_BYTES = 32 * 1024 * 1024;
 const MAX_CLI_OUTPUT_PATH_LENGTH = 4096;
-const pendingOutputFiles = new Set();
+const pendingOutputFiles = new Map();
+const OUTPUT_FILE_OPERATIONS = Object.freeze({
+    randomUUID,
+    open,
+    link,
+    rename,
+    unlink,
+});
 function safeOutputPath(value) {
     if (typeof value !== 'string' || !value || value.length > MAX_CLI_OUTPUT_PATH_LENGTH) {
         throw new CliUsageError(`Output paths are limited to ${MAX_CLI_OUTPUT_PATH_LENGTH} characters.`);
@@ -35,18 +42,22 @@ function createBufferedOutput() {
         value: () => chunks.join(''),
     });
 }
-async function writePrivateFile(pathValue, content, options = {}) {
+async function writePrivateFile(pathValue, content, options = {}, operations = OUTPUT_FILE_OPERATIONS) {
     const target = safeOutputPath(pathValue);
     if (Buffer.byteLength(content, 'utf8') > MAX_CLI_OUTPUT_BYTES) {
         throw new CliUsageError(`Generated output is limited to ${MAX_CLI_OUTPUT_BYTES} bytes.`);
     }
     const directory = dirname(target);
-    const temporary = join(directory, `.${basename(target)}.${process.pid}.${randomUUID()}.tmp`);
+    const temporary = join(directory, `.${basename(target)}.${process.pid}.${operations.randomUUID()}.tmp`);
     let temporaryCreated = false;
     try {
-        const handle = await open(temporary, 'wx', 0o600);
+        const handle = await operations.open(temporary, 'wx', 0o600);
         temporaryCreated = true;
-        pendingOutputFiles.add(temporary);
+        pendingOutputFiles.set(temporary, {
+            remove: () => operations.unlink(temporary),
+            published: false,
+            settled: false,
+        });
         try {
             await handle.writeFile(content, { encoding: 'utf8' });
             await handle.sync();
@@ -55,12 +66,12 @@ async function writePrivateFile(pathValue, content, options = {}) {
             await handle.close();
         }
         if (options.force) {
-            await rename(temporary, target);
+            await operations.rename(temporary, target);
             temporaryCreated = false;
         }
         else {
             try {
-                await link(temporary, target);
+                await operations.link(temporary, target);
             }
             catch (error) {
                 const code = error && typeof error === 'object' && 'code' in error ? error.code : null;
@@ -69,19 +80,64 @@ async function writePrivateFile(pathValue, content, options = {}) {
                 }
                 throw error;
             }
-            await unlink(temporary);
-            temporaryCreated = false;
+            const pending = pendingOutputFiles.get(temporary);
+            if (pending)
+                pending.published = true;
+            try {
+                await operations.unlink(temporary);
+                temporaryCreated = false;
+            }
+            catch {
+                // The target is already published. A second best-effort cleanup runs
+                // below, and signal cleanup retains ownership if it still cannot run.
+            }
         }
         return target;
     }
     finally {
-        if (temporaryCreated)
-            await unlink(temporary).catch(() => { });
-        pendingOutputFiles.delete(temporary);
+        if (temporaryCreated) {
+            try {
+                await operations.unlink(temporary);
+                temporaryCreated = false;
+            }
+            catch {
+                // Keep the path registered for best-effort signal cleanup.
+            }
+        }
+        if (temporaryCreated) {
+            const pending = pendingOutputFiles.get(temporary);
+            if (pending)
+                pending.settled = true;
+        }
+        if (!temporaryCreated)
+            pendingOutputFiles.delete(temporary);
     }
 }
+async function cleanupPendingOutputFiles() {
+    const entries = [...pendingOutputFiles].filter(([, pending]) => pending.settled);
+    let removed = 0;
+    for (const [path, pending] of entries) {
+        try {
+            await pending.remove();
+            pendingOutputFiles.delete(path);
+            removed += 1;
+        }
+        catch {
+            // The caller receives an explicit retained count and can disclose that
+            // the published output is intact while temporary cleanup remains due.
+        }
+    }
+    const retainedFiles = [...pendingOutputFiles.values()].filter((item) => item.settled);
+    return Object.freeze({
+        attempted: entries.length,
+        removed,
+        retained: retainedFiles.length,
+        retainedPublished: retainedFiles.filter((item) => item.published).length,
+        retainedUnpublished: retainedFiles.filter((item) => !item.published).length,
+    });
+}
 function cleanupPendingOutputFilesSync() {
-    for (const path of pendingOutputFiles) {
+    for (const path of pendingOutputFiles.keys()) {
         try {
             unlinkSync(path);
         }
@@ -94,4 +150,4 @@ function cleanupPendingOutputFilesSync() {
         }
     }
 }
-export { cleanupPendingOutputFilesSync, createBufferedOutput, writePrivateFile };
+export { cleanupPendingOutputFiles, cleanupPendingOutputFilesSync, createBufferedOutput, writePrivateFile };

package/cli/page-compare.mjs

@@ -1,10 +1,10 @@
 import { buildBulkComparisonEvidence } from "../lib/bulk-comparison-evidence.mjs";
-import { createPageBaseline } from "../frontend/src/lib/analysis/page-baseline.js";
-import { comparePageBaselines } from "../frontend/src/lib/analysis/page-similarity.js";
+import { createPageBaseline } from "../packages/workspace/page-baseline.mjs";
+import { comparePageBaselines } from "../packages/comparison/page-similarity.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
-export const CLI_PAGE_COMPARE_SCHEMA = 'whoisleuth.cli.page-compare';
-export const CLI_PAGE_COMPARE_VERSION = 2;
+import { CLI_PAGE_COMPARE_SCHEMA, CLI_PAGE_COMPARE_VERSION, } from "../packages/contracts/offline-comparison.mjs";
+export { CLI_PAGE_COMPARE_SCHEMA, CLI_PAGE_COMPARE_VERSION };
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -56,6 +56,9 @@ function buildCliPageComparison(leftText, rightText, generatedAt = new Date().to
         && ['success', 'partial'].includes(right.compact.technology.state);
     const tlsUsable = ['success', 'partial'].includes(left.compact.tls.state)
         && ['success', 'partial'].includes(right.compact.tls.state);
+    const tlsPartial = left.compact.tls.state === 'partial' || right.compact.tls.state === 'partial';
+    const technologyPartial = left.compact.technology.truncated || right.compact.technology.truncated
+        || left.compact.technology.state === 'partial' || right.compact.technology.state === 'partial';
     return {
         schema: CLI_PAGE_COMPARE_SCHEMA,
         version: CLI_PAGE_COMPARE_VERSION,
@@ -72,25 +75,30 @@ function buildCliPageComparison(leftText, rightText, generatedAt = new Date().to
         },
         page,
         technology: {
-            state: technologyUsable ? setComparison(leftTechnology, rightTechnology) : 'unavailable',
+            state: technologyUsable
+                ? technologyPartial ? 'partial' : setComparison(leftTechnology, rightTechnology)
+                : 'unavailable',
             leftSourceState: left.compact.technology.state,
             rightSourceState: right.compact.technology.state,
             leftIds: leftTechnology,
             rightIds: rightTechnology,
             sharedIds: sharedTechnology,
-            partial: left.compact.technology.truncated || right.compact.technology.truncated
-                || left.compact.technology.state === 'partial' || right.compact.technology.state === 'partial',
+            partial: technologyPartial,
         },
         tls: {
             leftSourceState: left.compact.tls.state,
             rightSourceState: right.compact.tls.state,
             issuer: {
-                state: tlsUsable ? scalarComparison(left.compact.tls.issuerLabel, right.compact.tls.issuerLabel) : 'unavailable',
+                state: tlsUsable
+                    ? tlsPartial ? 'partial' : scalarComparison(left.compact.tls.issuerLabel, right.compact.tls.issuerLabel)
+                    : 'unavailable',
                 left: left.compact.tls.issuerLabel,
                 right: right.compact.tls.issuerLabel,
             },
             publicKey: {
-                state: tlsUsable ? scalarComparison(left.compact.tls.spkiSha256, right.compact.tls.spkiSha256) : 'unavailable',
+                state: tlsUsable
+                    ? tlsPartial ? 'partial' : scalarComparison(left.compact.tls.spkiSha256, right.compact.tls.spkiSha256)
+                    : 'unavailable',
                 leftSha256: left.compact.tls.spkiSha256,
                 rightSha256: right.compact.tls.spkiSha256,
             },
@@ -115,7 +123,7 @@ function formatCliPageComparison(document) {
     for (const component of document.page.components) {
         lines.push(`${component.label.padEnd(18)} ${component.outcome}`);
     }
-    lines.push('', 'Technology', `Relationship     ${document.technology.state}`, `Shared           ${document.technology.sharedIds.join(', ') || 'None observed'}`, `Left             ${document.technology.leftIds.join(', ') || 'Unavailable'}`, `Right            ${document.technology.rightIds.join(', ') || 'Unavailable'}`, '', 'TLS', `Issuer           ${document.tls.issuer.state}`, `Public key       ${document.tls.publicKey.state}`, '', 'Limitations:');
+    lines.push('', 'Technology', `Relationship     ${document.technology.state}`, `Evidence         ${document.technology.partial ? 'Partial; equality and disjointness withheld' : 'Complete retained sets'}`, `Shared           ${document.technology.sharedIds.join(', ') || 'None observed'}`, `Left             ${document.technology.leftIds.join(', ') || 'Unavailable'}`, `Right            ${document.technology.rightIds.join(', ') || 'Unavailable'}`, '', 'TLS', `Issuer           ${document.tls.issuer.state}`, `Public key       ${document.tls.publicKey.state}`, '', 'Limitations:');
     for (const limitation of document.limitations)
         lines.push(`  - ${limitation}`);
     return `${lines.join('\n')}\n`;

package/cli/progress-events.mjs

@@ -1,3 +1,4 @@
+import { terminalSafeJson } from "./formatters/json.mjs";
 export const CLI_PROGRESS_EVENT_SCHEMA = 'whoisleuth.cli.progress';
 export const CLI_PROGRESS_EVENT_VERSION = 1;
 const MAX_CLI_PROGRESS_EVENTS = 2_100;
@@ -45,7 +46,7 @@ function createCliProgressEvents(stream, options) {
                 ...(typeof fields.ok === 'boolean' ? { ok: fields.ok } : {}),
                 ...(exitCode !== null ? { exitCode } : {}),
             };
-            stream.write(`${JSON.stringify(document)}\n`);
+            stream.write(`${terminalSafeJson(document)}\n`);
             sequence += 1;
         },
     });

package/cli/progress.mjs

@@ -10,7 +10,7 @@ function safeProgressMessage(value) {
 }
 function createTerminalProgress(stream, options) {
     const environment = options.environment || process.env;
-    const presentation = terminalPresentation(stream, options.color, environment);
+    const presentation = terminalPresentation(stream, options.color, environment, options.palette);
     const enabled = options.enabled
         && presentation.interactive
         && environment.WHOISLEUTH_NO_PROGRESS !== '1';
@@ -23,8 +23,8 @@ function createTerminalProgress(stream, options) {
         if (!enabled || !stream)
             return;
         const elapsedSeconds = Math.max(0, Math.floor((now() - startedAt) / 1000));
-        const marker = tone(PROGRESS_FRAMES[frame % PROGRESS_FRAMES.length] || '·', 'accent', presentation.color);
-        const elapsed = tone(`${elapsedSeconds}s`, 'dim', presentation.color);
+        const marker = tone(PROGRESS_FRAMES[frame % PROGRESS_FRAMES.length] || '·', 'accent', presentation.color ? presentation.palette : false);
+        const elapsed = tone(`${elapsedSeconds}s`, 'dim', presentation.color ? presentation.palette : false);
         stream.write(`\r\u001b[2K${marker} ${message} · ${elapsed}`);
         frame += 1;
     }