@slicedearth/whoisleuth-cli 2.0.1 → 2.1.0

package/cli/saved-lookup.mjs

@@ -5,6 +5,7 @@ import { isSafeJsonObjectKey, scanBoundedJson, } from "../lib/bounded-json.mjs";
 import { decodeBoundedUtf8 } from "../lib/bounded-file.mjs";
 import { CliUsageError } from "./arguments.mjs";
 import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "../lib/homepage-metadata-contract.mjs";
+import { registrarStandingObservedBy, resolveRegistrarIanaId, validRegistrarStanding, } from "../lib/registrar-standing-contract.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { CLI_LOOKUP_SCHEMA as SAVED_LOOKUP_SCHEMA, CLI_LOOKUP_VERSION as SAVED_LOOKUP_SCHEMA_VERSION, PUBLIC_CLI_LOOKUP_VERSION as PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION, MAX_CLI_LOOKUP_BYTES as MAX_SAVED_LOOKUP_INPUT_BYTES, MAX_CLI_LOOKUP_JSON_CONTAINER_ITEMS as MAX_BOUNDED_JSON_CONTAINER_ITEMS, MAX_CLI_LOOKUP_JSON_DEPTH as MAX_BOUNDED_JSON_DEPTH, MAX_CLI_LOOKUP_JSON_KEYS as MAX_BOUNDED_JSON_KEYS, MAX_CLI_LOOKUP_JSON_VALUES as MAX_BOUNDED_JSON_VALUES, MAX_CLI_LOOKUP_STRING_LENGTH as MAX_SAVED_LOOKUP_STRING_LENGTH, SUPPORTED_CLI_LOOKUP_VERSIONS as SUPPORTED_SAVED_LOOKUP_SCHEMA_VERSIONS, } from "../packages/contracts/cli-lookup.mjs";
 const RDAP_STATUSES = new Set([
@@ -315,9 +316,10 @@ function assertLookupEnvelope(document, label) {
     const httpResponse = objectOrNull(http?.response);
     const publicationMetadata = pageIdentity?.publicationMetadata;
     const deliveryMetadata = httpResponse?.deliveryMetadata;
+    const registrarStanding = document.registrarStanding;
     if (document.version === PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION
-        && (publicationMetadata !== undefined || deliveryMetadata !== undefined)) {
-        throw new TypeError(`${label} version ${PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION} cannot contain version ${SAVED_LOOKUP_SCHEMA_VERSION} homepage metadata.`);
+        && (publicationMetadata !== undefined || deliveryMetadata !== undefined || registrarStanding !== undefined)) {
+        throw new TypeError(`${label} version ${PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION} cannot contain version ${SAVED_LOOKUP_SCHEMA_VERSION} evidence fields.`);
     }
     if (document.version === SAVED_LOOKUP_SCHEMA_VERSION
         && (publicationMetadata !== undefined && (!['success', 'partial'].includes(String(pageIdentity?.status))
@@ -326,6 +328,16 @@ function assertLookupEnvelope(document, label) {
                 || !validHttpDeliveryMetadata(deliveryMetadata)))) {
         throw new TypeError(`${label} contains invalid homepage metadata.`);
     }
+    if (document.version === SAVED_LOOKUP_SCHEMA_VERSION
+        && registrarStanding !== undefined
+        && !validRegistrarStanding(registrarStanding)) {
+        throw new TypeError(`${label} contains invalid registrar standing.`);
+    }
+    if (document.version === SAVED_LOOKUP_SCHEMA_VERSION
+        && registrarStanding !== undefined
+        && !registrarStandingObservedBy(registrarStanding, generatedAt)) {
+        throw new TypeError(`${label} registrar standing was observed after the saved Lookup time.`);
+    }
     const rdapParsed = objectOrNull(rdap?.parsed);
     const whoisParsed = objectOrNull(whois?.parsed);
     if (rdapStatus === 'success' && !rdapParsed) {
@@ -334,6 +346,11 @@ function assertLookupEnvelope(document, label) {
     if ((whoisStatus === 'complete' || whoisStatus === 'partial') && !whoisParsed) {
         throw new TypeError('Successful WHOIS input is missing normalised parsed data.');
     }
+    if (document.version === SAVED_LOOKUP_SCHEMA_VERSION
+        && validRegistrarStanding(registrarStanding)
+        && registrarStanding.ianaId !== resolveRegistrarIanaId(rdapParsed, whoisParsed)) {
+        throw new TypeError(`${label} registrar standing does not match its retained registration sources.`);
+    }
     return generatedAt;
 }
 function normalizeCliLookupDocument(value, options = {}) {

package/cli/support-command-runner.mjs

@@ -0,0 +1,229 @@
+import { REGISTRY_CAPABILITIES_VERSION, registryCapabilityFor } from "../lib/registry-capabilities.mjs";
+import { buildRiskCalibrationSummaryReport } from "../lib/risk-calibration-summary.mjs";
+import { explainRiskScore, explainRiskScoreV7, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../lib/risk-scoring.mjs";
+import { buildCliCommandCatalogue, formatCliCommandCatalogue, selectCliCommands } from "./command-catalogue.mjs";
+import { CLI_COMMAND_REGISTRY, CLI_COMMANDS, COMMAND_COLLECTION, COMMAND_DETAILS, COMMAND_USAGE, } from "./command-reference.mjs";
+import { buildShellCompletion } from "./completion.mjs";
+import { buildDoctorReport, formatDoctorReport } from "./doctor.mjs";
+import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
+import EXIT_CODES from "./exit-codes.mjs";
+import { formatJsonDocument } from "./formatters/json.mjs";
+import { formatTerminalRegistrySupport, formatTerminalRiskCalibration, } from "./formatters/terminal.mjs";
+import { buildCliManual } from "./manual.mjs";
+import { MAX_LOOKALIKE_CALIBRATION_BYTES, buildLookalikeCalibration, formatLookalikeCalibration, } from "./lookalike-calibration.mjs";
+import { MAX_REGISTRY_COHORT_INPUT_BYTES, buildRegistryCohortReport, formatRegistryCohortReport, } from "./registry-cohort.mjs";
+import { buildRegistryDoctorReport, formatRegistryDoctorReport } from "./registry-doctor.mjs";
+import { buildRegistryFixtureScaffold } from "./registry-fixture-scaffold.mjs";
+import { buildRegistrySupportDocument } from "./registry-support.mjs";
+import { MAX_RISK_CALIBRATION_INPUT_BYTES, buildRiskCalibrationReport, parseRiskCalibrationDataset, serializeRiskCalibrationReport, } from "./risk-calibration.mjs";
+import { MAX_SAVED_LOOKUP_INPUT_BYTES } from "./saved-lookup.mjs";
+import { SUPPORT_INLINE_COMMANDS } from "./inline-command-families.mjs";
+import { runDiscriminatedCommandHandler } from "./discriminated-command-handlers.mjs";
+async function runCompletionCommand(args, dependencies, context) {
+    context.writeStdout(buildShellCompletion(args.shell));
+    return EXIT_CODES.SUCCESS;
+}
+async function runCommandCatalogueCommand(args, dependencies, context) {
+    const selectedCommands = selectCliCommands(CLI_COMMAND_REGISTRY, {
+        common: args.common,
+        group: args.group,
+        mode: args.mode,
+    });
+    const catalogue = buildCliCommandCatalogue({
+        commands: selectedCommands,
+        collections: COMMAND_COLLECTION,
+        details: COMMAND_DETAILS,
+        usage: COMMAND_USAGE,
+        packageVersion: context.packageVersion,
+    });
+    if (!args.quiet) {
+        context.writeStdout(args.output === 'json'
+            ? formatJsonDocument(catalogue)
+            : context.terminal(formatCliCommandCatalogue(catalogue), args.color));
+    }
+    return EXIT_CODES.SUCCESS;
+}
+async function runManualCommand(args, dependencies, context) {
+    context.writeStdout(buildCliManual({
+        commands: CLI_COMMANDS,
+        collections: COMMAND_COLLECTION,
+        details: COMMAND_DETAILS,
+        usage: COMMAND_USAGE,
+        version: context.packageVersion,
+    }));
+    return EXIT_CODES.SUCCESS;
+}
+async function runDoctorCommand(args, dependencies, context) {
+    context.setFailureLabel('CLI diagnostics');
+    const buildReport = () => buildDoctorReport({
+        version: context.packageVersion,
+        generatedAt: context.now(),
+        network: args.network,
+        presentation: context.presentation(args.color),
+        ...(dependencies.resolvePublicAddresses ? { resolveAddresses: dependencies.resolvePublicAddresses } : {}),
+        ...(dependencies.safeFetch ? { fetchHttps: dependencies.safeFetch } : {}),
+        ...(dependencies.whoisQuery ? { queryWhois: dependencies.whoisQuery } : {}),
+    });
+    const report = args.network
+        ? await context.withProgress('Checking public DNS, HTTPS, and WHOIS connectivity', buildReport)
+        : await buildReport();
+    if (!args.quiet) {
+        context.writeStdout(args.output === 'json'
+            ? formatJsonDocument(report)
+            : context.terminal(formatDoctorReport(report), args.color));
+    }
+    return report.state === 'partial' ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+}
+async function runRegistrySupportCommand(args, dependencies, context) {
+    context.setFailureLabel('Registry support');
+    const requestedInput = args.target || await context.readSingleInput();
+    if (!requestedInput)
+        throw new CliUsageError('registry-support requires one domain or suffix as an argument or on stdin.');
+    const lookupCapability = dependencies.registryCapabilityFor || registryCapabilityFor;
+    const capability = lookupCapability(requestedInput);
+    if (!capability)
+        throw new CliUsageError('registry-support requires a valid domain or suffix.');
+    const catalogueVersion = dependencies.registryCapabilitiesVersion || REGISTRY_CAPABILITIES_VERSION;
+    const document = buildRegistrySupportDocument(requestedInput, capability, catalogueVersion, context.now());
+    if (!args.quiet) {
+        context.writeStdout(args.output === 'json'
+            ? formatJsonDocument(document)
+            : context.terminal(formatTerminalRegistrySupport(document), args.color));
+    }
+    return EXIT_CODES.SUCCESS;
+}
+async function runRegistryDoctorCommand(args, dependencies, context) {
+    context.setFailureLabel('Registry compatibility diagnostic');
+    let input;
+    try {
+        input = dependencies.readCompareInput
+            ? await dependencies.readCompareInput(args.source)
+            : await context.readInput(args.source, MAX_SAVED_LOOKUP_INPUT_BYTES, 'Registry doctor input');
+    }
+    catch (error) {
+        if (error instanceof CliUsageError)
+            throw error;
+        throw new CliUsageError(`Could not read registry doctor input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+    }
+    if (!input.trim())
+        throw new CliUsageError('registry-doctor requires one saved Lookup JSON file or a document on stdin.');
+    const report = buildRegistryDoctorReport(input, context.now());
+    if (!args.quiet) {
+        context.writeStdout(args.output === 'json'
+            ? formatJsonDocument(report)
+            : context.terminal(formatRegistryDoctorReport(report), args.color));
+    }
+    return report.summary.investigate ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+}
+async function runRegistryCohortCommand(args, dependencies, context) {
+    context.setFailureLabel('Registry quality cohort');
+    let input;
+    try {
+        input = dependencies.readCompareInput
+            ? await dependencies.readCompareInput(args.source)
+            : await context.readInput(args.source, MAX_REGISTRY_COHORT_INPUT_BYTES, 'Registry cohort input');
+    }
+    catch (error) {
+        if (error instanceof CliUsageError)
+            throw error;
+        throw new CliUsageError(`Could not read registry cohort input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+    }
+    const report = buildRegistryCohortReport(input, context.now());
+    if (!args.quiet) {
+        context.writeStdout(args.output === 'json'
+            ? formatJsonDocument(report)
+            : context.terminal(formatRegistryCohortReport(report), args.color));
+    }
+    return report.cohorts.some((cohort) => cohort.state === 'review')
+        ? EXIT_CODES.PARTIAL_FAILURE
+        : EXIT_CODES.SUCCESS;
+}
+async function runRegistryScaffoldCommand(args, dependencies, context) {
+    context.setFailureLabel('Registry fixture scaffold');
+    try {
+        context.writeStdout(buildRegistryFixtureScaffold(args.profile, args.suffix, args.scenario));
+    }
+    catch (error) {
+        throw new CliUsageError(boundedCliErrorMessage(error, 'Registry fixture scaffold failed'));
+    }
+    return EXIT_CODES.SUCCESS;
+}
+async function runRiskCalibrationCommand(args, dependencies, context) {
+    context.setFailureLabel('Risk calibration');
+    let input;
+    try {
+        input = dependencies.readRiskCalibrationInput
+            ? await dependencies.readRiskCalibrationInput(args.source)
+            : await context.readInput(args.source, MAX_RISK_CALIBRATION_INPUT_BYTES, 'Risk calibration input');
+    }
+    catch (error) {
+        if (error instanceof CliUsageError)
+            throw error;
+        throw new CliUsageError(`Could not read Risk calibration input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+    }
+    if (!input.trim())
+        throw new CliUsageError('risk-calibrate requires one dataset JSON file or a dataset on stdin.');
+    const dataset = parseRiskCalibrationDataset(input);
+    const report = buildRiskCalibrationReport(dataset, dependencies.explainRiskScore || explainRiskScore, {
+        generatedAt: context.now(),
+        modelVersion: dependencies.riskModelVersion || RISK_MODEL_VERSION,
+        reviewThreshold: dependencies.riskReviewThreshold || RISK_REVIEW_THRESHOLD,
+        ...(!dependencies.explainRiskScore ? {
+            previousModelVersion: 7,
+            explainPreviousRiskScore: explainRiskScoreV7,
+        } : {}),
+    });
+    if (!args.quiet) {
+        context.writeStdout(args.output === 'summary_json'
+            ? serializeRiskCalibrationReport(buildRiskCalibrationSummaryReport(report))
+            : args.output === 'json'
+                ? serializeRiskCalibrationReport(report)
+                : context.terminal(formatTerminalRiskCalibration(report), args.color));
+    }
+    return EXIT_CODES.SUCCESS;
+}
+async function runLookalikeCalibrationCommand(args, dependencies, context) {
+    context.setFailureLabel('Lookalike review-yield calibration');
+    let input;
+    try {
+        input = dependencies.readRiskCalibrationInput
+            ? await dependencies.readRiskCalibrationInput(args.source)
+            : await context.readInput(args.source, MAX_LOOKALIKE_CALIBRATION_BYTES, 'Lookalike calibration input');
+    }
+    catch (error) {
+        if (error instanceof CliUsageError)
+            throw error;
+        throw new CliUsageError(`Could not read lookalike calibration input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+    }
+    if (!input.trim())
+        throw new CliUsageError('lookalike-calibrate requires one dataset JSON file or a document on stdin.');
+    let report;
+    try {
+        report = buildLookalikeCalibration(input, context.now());
+    }
+    catch (error) {
+        throw new CliUsageError(boundedCliErrorMessage(error, 'Lookalike calibration input is invalid'));
+    }
+    if (!args.quiet) {
+        context.writeStdout(args.output === 'json'
+            ? formatJsonDocument(report)
+            : context.terminal(formatLookalikeCalibration(report), args.color));
+    }
+    return EXIT_CODES.SUCCESS;
+}
+const SUPPORT_COMMAND_HANDLERS = Object.freeze({
+    'completion': runCompletionCommand,
+    'commands': runCommandCatalogueCommand,
+    'manual': runManualCommand,
+    'doctor': runDoctorCommand,
+    'registry-support': runRegistrySupportCommand,
+    'registry-doctor': runRegistryDoctorCommand,
+    'registry-cohort': runRegistryCohortCommand,
+    'registry-scaffold': runRegistryScaffoldCommand,
+    'risk-calibrate': runRiskCalibrationCommand,
+    'lookalike-calibrate': runLookalikeCalibrationCommand,
+});
+function runSupportCommand(args, dependencies, context) {
+    return runDiscriminatedCommandHandler(SUPPORT_COMMAND_HANDLERS, args, dependencies, context);
+}
+export { SUPPORT_COMMAND_HANDLERS, runSupportCommand };

package/cli/workflow-command-runner.mjs

@@ -0,0 +1,129 @@
+import { formatCliJunit } from "./ci-report.mjs";
+import { formatDomainControlMonitor, runDomainControlMonitor } from "./domain-control-monitor.mjs";
+import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
+import EXIT_CODES from "./exit-codes.mjs";
+import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
+import { formatJsonDocument } from "./formatters/json.mjs";
+import { buildInvestigationPlan, buildWorkflowRecipeCatalogue, formatInvestigationPlan, formatWorkflowRecipeCatalogue, } from "./investigation-plan.mjs";
+import { MAX_INVESTIGATION_RUN_BYTES, formatInvestigationRun, runInvestigationRecipe, } from "./investigation-run.mjs";
+import { MAX_OFFLINE_EVIDENCE_INPUT_BYTES } from "./offline-evidence-review.mjs";
+import { createBufferedOutput } from "./output-file.mjs";
+import { WORKFLOW_INLINE_COMMANDS } from "./inline-command-families.mjs";
+import { runDiscriminatedCommandHandler } from "./discriminated-command-handlers.mjs";
+async function runMonitorOnceCommand(args, dependencies, context) {
+    context.setFailureLabel('One-shot domain control review');
+    let manifestInput;
+    let previousInput = null;
+    try {
+        manifestInput = dependencies.readArtifactInput
+            ? await dependencies.readArtifactInput(args.source)
+            : await context.readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Domain-control manifest input');
+        if (args.previousSource) {
+            previousInput = dependencies.readDiffInput
+                ? await dependencies.readDiffInput(args.previousSource)
+                : await context.readInput(args.previousSource, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Prior monitor snapshot');
+        }
+    }
+    catch (error) {
+        if (error instanceof CliUsageError)
+            throw error;
+        throw new CliUsageError(`Could not read monitor input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+    }
+    if (!manifestInput.trim())
+        throw new CliUsageError('monitor-once requires one domain-control manifest file or a document on stdin.');
+    const executeLookup = dependencies.runUnifiedLookup || (await import("../lib/lookup.mjs")).runUnifiedLookup;
+    const progress = context.beginProgress('Collecting bounded domain-control evidence');
+    let document;
+    try {
+        document = await runDomainControlMonitor(manifestInput, previousInput, {
+            executeLookup,
+            now: context.now,
+            limit: args.limit,
+            concurrency: args.concurrency,
+            ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+            onSettled: (completed, total) => progress.update(`Collected ${completed} of ${total} owned domains`),
+        });
+    }
+    finally {
+        context.endProgress();
+    }
+    if (!args.quiet) {
+        context.writeStdout(args.output === 'json'
+            ? formatJsonDocument(document)
+            : args.output === 'junit'
+                ? formatCliJunit(document)
+                : context.terminal(formatDomainControlMonitor(document), args.color));
+    }
+    const policyFindings = evaluateCliFailPolicies(document, args.failOn || []);
+    if (policyFindings.length)
+        context.writeStderr(formatFailPolicyNotice(policyFindings));
+    return document.collection.failed || policyFindings.length
+        ? EXIT_CODES.PARTIAL_FAILURE
+        : EXIT_CODES.SUCCESS;
+}
+async function runWorkflowPlanCommand(args, dependencies, context) {
+    context.setFailureLabel('Investigation plan');
+    if ('discovery' in args) {
+        const catalogue = buildWorkflowRecipeCatalogue(args.discovery === 'explain' ? args.recipe : null);
+        if (!args.quiet) {
+            context.writeStdout(args.output === 'json'
+                ? formatJsonDocument(catalogue)
+                : context.terminal(formatWorkflowRecipeCatalogue(catalogue), args.color));
+        }
+        return EXIT_CODES.SUCCESS;
+    }
+    const document = buildInvestigationPlan(args.recipe, args.subject, context.now());
+    if (!args.quiet) {
+        context.writeStdout(args.output === 'json'
+            ? formatJsonDocument(document)
+            : context.terminal(formatInvestigationPlan(document), args.color));
+    }
+    return EXIT_CODES.SUCCESS;
+}
+async function runWorkflowRecipeCommand(args, dependencies, context) {
+    context.setFailureLabel('Investigation workflow');
+    let resumeInput = null;
+    if (args.resumeSource) {
+        try {
+            resumeInput = dependencies.readDiffInput
+                ? await dependencies.readDiffInput(args.resumeSource)
+                : await context.readInput(args.resumeSource, MAX_INVESTIGATION_RUN_BYTES, 'Investigation resume state');
+        }
+        catch (error) {
+            if (error instanceof CliUsageError)
+                throw error;
+            throw new CliUsageError(`Could not read investigation resume state: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+        }
+    }
+    const document = await runInvestigationRecipe(args.recipe, args.subject, {
+        approveNetwork: args.approveNetwork,
+        selections: args.selections,
+        resumeInput,
+        generatedAt: context.now(),
+        ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+        execute: async (command, stepArguments) => {
+            const stepStdout = createBufferedOutput();
+            const stepStderr = createBufferedOutput();
+            const exitCode = await context.executeCli([command, ...stepArguments], {
+                stdout: stepStdout.stream,
+                stderr: stepStderr.stream,
+            });
+            return { exitCode, stdout: stepStdout.value() };
+        },
+    });
+    if (!args.quiet) {
+        context.writeStdout(args.output === 'json'
+            ? formatJsonDocument(document)
+            : context.terminal(formatInvestigationRun(document), args.color));
+    }
+    return document.state === 'step_failed' ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+}
+const WORKFLOW_COMMAND_HANDLERS = Object.freeze({
+    'monitor-once': runMonitorOnceCommand,
+    'workflow-plan': runWorkflowPlanCommand,
+    'workflow-run': runWorkflowRecipeCommand,
+});
+function runWorkflowCommand(args, dependencies, context) {
+    return runDiscriminatedCommandHandler(WORKFLOW_COMMAND_HANDLERS, args, dependencies, context);
+}
+export { WORKFLOW_COMMAND_HANDLERS, runWorkflowCommand };

package/docs/cli-reference.md

@@ -12,7 +12,9 @@ contains the exhaustive recipient, retention and export metadata.
 
 ## Installation
 
-Public releases require Node.js 24 or later:
+Public releases require Node.js 24 or later. Release verification uses the
+exact Node.js 24 maintainer runtime and separately exercises the installed
+package on Node.js 26:
 
 ```bash
 npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli -- whoisleuth --help
@@ -107,15 +109,16 @@ Readers accept only their declared public and current versions. Unknown,
 unreleased historical and future schemas fail before partial interpretation;
 an invalid import is not treated as an empty document.
 
-`inspect-archive` reads current workspace archive v6 and exact public v5. It
+`inspect-archive` reads current workspace archive v7 and exact versions 5 and 6. It
 reports section metadata and digest-only search results unless `--reveal` is
 explicitly selected. It never searches notes, contacts or arbitrary raw fields.
 
 `export` reads supported saved Lookup v1 or v2 and writes current Lookup
-evidence schema 27. Exact public schema 26 remains readable and can contain
-public contact fields; current schema 27 excludes raw registration payloads,
-expanded contacts, credentials, complete query-bearing URLs and provider
-payloads.
+evidence schema 28. Published v2 schema 27 and exact v1 schema 26 remain
+readable. Versions 27 and 28 exclude raw registration payloads, expanded
+contacts, credentials, complete query-bearing URLs and provider payloads;
+schema 28 can also retain the bounded, separately attributed registrar-standing
+projection shown by Lookup.
 
 `verify-artifact` checks a recognised structure and its applicable integrity
 contract. `interchange-report` describes retained and omitted fields.
@@ -133,14 +136,18 @@ evidence is accurate, current, safe to share or attributable to a person.
   control, activity, intent or maliciousness.
 - Bulk applies one declared collection contract per target. Fast accepts up to
   500 targets and Deep up to 50; each target remains a separate request.
-- Respond commands prepare local Cases, packets and sharing reviews. They do not
-  submit, publish, notify or grant recipient authorisation.
+- Respond commands package browser-created Cases and prepare local packets,
+  reports and sharing reviews. They do not create durable Cases, submit,
+  publish, notify or grant recipient authorisation.
 - Assurance, comparison and calibration commands describe supplied or retained
   evidence. They do not tune the running model, change infrastructure or turn an
   analyst label into observed truth.
 - `workflow-plan` lists fixed installed recipes without executing them.
   `workflow-run` executes only installed steps, requires approval for network
-  work and pauses for analyst-selection placeholders.
+  work and pauses at unresolved analyst selections. Repeat
+  `--select <step-id>=<path-or-value>` in placeholder order to resume a selected
+  step; version-1 checkpoints remain readable and version 2 retains the exact
+  selections in the local checkpoint.
 
 Use the installed focused help for positional inputs, exact ceilings, options,
 network effects, outputs and command-specific exit behaviour.

package/docs/cli.md

@@ -12,7 +12,9 @@ lists the network, recipient, retention and export boundary for every command.
 
 ## Installation
 
-Public releases require Node.js 24 or later:
+Public releases require Node.js 24 or later. Release verification uses the
+exact Node.js 24 maintainer runtime and separately exercises the installed
+package on Node.js 26:
 
 ```bash
 npm exec --yes --ignore-scripts --package=@slicedearth/whoisleuth-cli -- whoisleuth --help
@@ -76,7 +78,7 @@ application:
 | Group | Common commands |
 | --- | --- |
 | Investigate | `lookup`, `bulk`, `discover`, `ct-search`, `posture`, `http`, `tls`, `compare`, `brief` |
-| Respond | `case-pack`, `change-packet`, `sharing-review`, `export` |
+| Respond | `case-pack`, `change-packet`, `sharing-review`, `export` (local handoff from browser-created Cases) |
 | Assure | `dnssec-validate`, `mail-transport`, `domain-control`, `assurance`, `workflow-plan`, `diff`, `inspect-archive`, `verify-artifact` |
 | Utilities | `doctor`, `commands`, `completion`, `manual`, `registry-scaffold` |
 

package/lib/availability.mjs

@@ -20,6 +20,7 @@ import { buildHttpObservation, failedHttpObservation, skippedHttpObservation } f
 import { collectTlsIntelligence, skippedTlsObservation } from "./tls-intelligence.mjs";
 import { parseRegistryDate, registryDateIso } from "./registry-dates.mjs";
 import { analyzeWebsiteSecurityPosture } from "./website-security-posture.mjs";
+import { analyzeWebsiteTechnology, captureTechnologyResponseHeaders, } from "./website-technology.mjs";
 import { analyzeResponsePolicyHeaders, qualifyResponsePolicyWithCspMeta, } from "./response-policy.mjs";
 import { nonEmptyErrorMessage } from "./error-detail.mjs";
 import { registryServiceAdmissionFor } from "./registry-capabilities.mjs";
@@ -250,15 +251,7 @@ async function fetchHomepage(domain, { fetcher = safeFetchDetailed, timeoutMs =
                     status: 'fetched',
                     detail: `Homepage responded over ${scheme.toUpperCase()} (HTTP ${res.status}).`,
                     responsePolicy: analyzeResponsePolicyHeaders(res.headers),
-                    technologyHeaders: {
-                        'cf-ray': res.headers.get('cf-ray') || '',
-                        'x-drupal-cache': res.headers.get('x-drupal-cache') || '',
-                        'x-served-by': res.headers.get('x-served-by') || '',
-                        'x-powered-by': res.headers.get('x-powered-by') || '',
-                        'x-shopify-stage': res.headers.get('x-shopify-stage') || '',
-                        'x-sorting-hat-podid': res.headers.get('x-sorting-hat-podid') || '',
-                        'x-vercel-id': res.headers.get('x-vercel-id') || '',
-                    },
+                    technologyHeaders: captureTechnologyResponseHeaders(res.headers),
                     http: buildHttpObservation({ ...detail, durationMs: Date.now() - attemptStartedAt }, {
                         previousAttempts: failures,
                         capturedBodyBytes: body.bytesRead,
@@ -280,6 +273,7 @@ async function fetchHomepage(domain, { fetcher = safeFetchDetailed, timeoutMs =
                 status: 'responded',
                 detail: `Web server responded over ${scheme.toUpperCase()} (HTTP ${res.status}); homepage content was not available for inspection.`,
                 responsePolicy: analyzeResponsePolicyHeaders(res.headers),
+                technologyHeaders: captureTechnologyResponseHeaders(res.headers),
                 http: buildHttpObservation({ ...detail, durationMs: Date.now() - attemptStartedAt }, {
                     previousAttempts: failures,
                     capturedBodyBytes: 0,
@@ -675,6 +669,15 @@ async function checkDomainAvailability(domain, options = {}) {
             });
         }
     }
+    if (options.includeTechnologyProfile !== false && htmlSignals.technologyProfile === null
+        && ['fetched', 'responded'].includes(homepage.status)) {
+        htmlSignals.technologyProfile = analyzeWebsiteTechnology({
+            htmlAvailable: false,
+            httpServer: homepage.http?.response?.server,
+            responseHeaders: homepage.technologyHeaders,
+            observedAt: homepage.http?.observedAt,
+        });
+    }
     const responsePolicy = qualifyResponsePolicyWithCspMeta(homepage.responsePolicy, htmlSignals.cspMetaPolicy);
     const retainedHttp = options.includeDeliveryMetadata === false
         ? withoutHttpDeliveryMetadata(homepage.http)

package/lib/bounded-contract-normalizers.mjs

@@ -3,15 +3,8 @@
 // bounded before a provider or connector result reaches its public model.
 import { domainToASCII } from 'node:url';
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
-export function isRecord(value) {
-    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
-}
-export function recordOrNull(value) {
-    return isRecord(value) ? value : null;
-}
-export function recordOrEmpty(value) {
-    return isRecord(value) ? value : {};
-}
+import { isRecord } from "./json-record.mjs";
+export { isRecord, recordOrEmpty, recordOrNull } from "./json-record.mjs";
 export function boundedString(value, maxLength) {
     if (typeof value !== 'string' || /[\u0000-\u001f\u007f]/u.test(value))
         return null;

package/lib/browser-library-profile.mjs

@@ -8,6 +8,7 @@ import { Worker } from 'node:worker_threads';
 import { RETIRE_BROWSER_CATALOG } from "./generated/retire-browser-catalog.mjs";
 import { CISA_KEV_CATALOG } from "./generated/cisa-kev-catalog.mjs";
 import { createObservation } from "../packages/evidence/observation.mjs";
+import { BROWSER_LIBRARY_PROFILE_VERSION, MAX_LIBRARY_FINDINGS, } from "./lookup-child-profile-contract.mjs";
 import { MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_STATIC_HTML_CHARS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 // Catalogue expressions are reviewed third-party inputs. Keep every individual
 // regular-expression evaluation and the aggregate inline-signature work small
@@ -17,9 +18,7 @@ const MAX_INLINE_LIBRARY_SCAN_CHARS = 1_024;
 const MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS = 4_096;
 const MAX_INLINE_LIBRARY_SCAN_MS = 750;
 const MAX_INLINE_LIBRARY_WORKER_BYTES = 64 * 1024;
-const BROWSER_LIBRARY_PROFILE_VERSION = 2;
 const MAX_LIBRARY_HTML_CHARS = MAX_STATIC_HTML_CHARS;
-const MAX_LIBRARY_FINDINGS = 16;
 const MAX_ADVISORY_IDENTIFIERS = 16;
 const MAX_WEAKNESS_CLASSES = 12;
 const MAX_MATCHES_PER_PATTERN = 4;

package/lib/client-behavior-profile.mjs

@@ -3,9 +3,8 @@
 // indicator identifiers, descriptions, evidence classes, and bounded counts
 // leave this module; script references and contents are discarded.
 import { createObservation } from "../packages/evidence/observation.mjs";
+import { CLIENT_BEHAVIOR_PROFILE_VERSION, MAX_CLIENT_BEHAVIOR_INDICATORS, } from "./lookup-child-profile-contract.mjs";
 import { analyzeStaticHtml, } from "./static-html-analysis.mjs";
-const CLIENT_BEHAVIOR_PROFILE_VERSION = 1;
-const MAX_CLIENT_BEHAVIOR_INDICATORS = 12;
 const MAX_INDICATOR_OCCURRENCES = 999;
 function boundedOccurrences(value) {
     return Math.max(1, Math.min(MAX_INDICATOR_OCCURRENCES, value));

package/lib/credential-surface-profile.mjs

@@ -4,8 +4,8 @@
 // names, values, labels, placeholders, arbitrary attributes, and action URLs
 // never enter this profile.
 import { createObservation } from "../packages/evidence/observation.mjs";
+import { CREDENTIAL_SURFACE_PROFILE_VERSION } from "./lookup-child-profile-contract.mjs";
 import { MAX_STATIC_FORMS, MAX_STATIC_INPUTS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
-const CREDENTIAL_SURFACE_PROFILE_VERSION = 1;
 function analyzeCredentialSurfaceProfile(input = {}) {
     const htmlAnalysis = input.htmlAnalysis ?? analyzeStaticHtml(input.html, { baseUrl: input.baseUrl });
     const forms = htmlAnalysis.forms;

package/lib/domain-posture-analysis.mjs

@@ -9,6 +9,13 @@ const SPF_MAX_DEPTH = 5;
 const SPF_MAX_BRANCHES = 32;
 const MAX_DMARC_DESTINATIONS = 10;
 const MAX_DEPENDENCIES = 64;
+const DEPENDENCY_KIND_ORDER = Object.freeze({
+    nameserver: 0,
+    mail_exchange: 1,
+    spf_include: 2,
+    spf_redirect: 3,
+    dmarc_reporting: 4,
+});
 function strictHostname(value) {
     const input = String(value || '').trim().replace(/\.+$/u, '');
     if (/[^\x00-\x7f]/u.test(input))
@@ -252,6 +259,8 @@ function buildExternalDependencies({ domain, nameservers, mx, spfExpansion, dmar
     for (const authorization of dmarcAuthorizations) {
         add('dmarc_reporting', authorization.destination, `DMARC ${authorization.reportType} reporting`, ['authorized', 'self'].includes(authorization.state) ? 'observed' : 'unavailable');
     }
-    return output;
+    return output.sort((left, right) => (DEPENDENCY_KIND_ORDER[left.kind] - DEPENDENCY_KIND_ORDER[right.kind]
+        || left.target.localeCompare(right.target)
+        || left.source.localeCompare(right.source)));
 }
 export { SPF_LOOKUP_LIMIT, SPF_MAX_DEPTH, SPF_VOID_LOOKUP_LIMIT, buildExternalDependencies, expandSpfPolicy, reportDestinationDomain, validateDmarcExternalReporting, };