@slicedearth/whoisleuth-cli 2.0.1 → 2.2.0

package/cli/formatters/terminal-command-formats.mjs

@@ -0,0 +1,437 @@
+import { unicodeDomainFromAscii } from "../../lib/idn-confusables.mjs";
+import { registryAccessProfileLabel } from "../registry-access.mjs";
+import { appendDeliveryMetadataLines } from "./terminal-metadata.mjs";
+import { MAX_TLS_TERMINAL_ALT_NAMES, MAX_TLS_TERMINAL_PURPOSES, safeTerminalValue, terminalCount, terminalCountSummary, terminalRecord, titleCase, } from "./terminal-shared.mjs";
+const MAX_CT_TERMINAL_MATCHES = 100;
+const MAX_CT_TERMINAL_HOSTNAMES = 5;
+const MAX_DISCOVER_TERMINAL_CANDIDATES = 200;
+const MAX_POSTURE_TERMINAL_RECORDS = 5;
+const MAX_RISK_CALIBRATION_TERMINAL_RECORDS = 100;
+function formatTerminalRegistrySupport(document) {
+    const profile = terminalRecord(document.profile);
+    const rdap = terminalRecord(profile.rdap);
+    const whois = terminalRecord(profile.whois);
+    const verification = terminalRecord(document.verification);
+    const fixtures = Array.isArray(verification.fixtureScenarios) ? verification.fixtureScenarios : [];
+    const files = Array.isArray(verification.files) ? verification.files : [];
+    const documentation = Array.isArray(verification.documentationUrls) ? verification.documentationUrls : [];
+    const standards = terminalRecord(document.standardsCoverage);
+    const genericCoverage = terminalRecord(standards.genericAndRestricted);
+    const supportLabel = (value) => titleCase(safeTerminalValue(value, 'unknown').replaceAll('-', '_'));
+    const lines = [
+        `Input          ${safeTerminalValue(document.requestedInput)}`,
+        `Suffix         .${safeTerminalValue(document.suffix)}`,
+        `Catalogue      Version ${safeTerminalValue(document.catalogueVersion, '0')}`,
+        `gTLD RDAP      ${safeTerminalValue(genericCoverage.rdapCovered, '0')} / ${safeTerminalValue(genericCoverage.total, '0')}`,
+        `Coverage date  ${safeTerminalValue(standards.verifiedAt, 'unknown')}`,
+        `Profile        ${profile.explicitSuffixProfile ? 'Explicit suffix profile' : 'Generic IANA discovery profile'}`,
+        `Profile ID     ${safeTerminalValue(profile.id)}`,
+        `Registry class ${supportLabel(profile.registryClass)}`,
+        `Coverage       ${supportLabel(profile.coverageState)}`,
+        `RDAP discovery ${registryAccessProfileLabel(rdap.discovery)}`,
+        `RDAP access    ${registryAccessProfileLabel(rdap.accessProfile)}`,
+        `WHOIS discovery ${registryAccessProfileLabel(whois.discovery)}`,
+        `WHOIS access   ${registryAccessProfileLabel(whois.accessProfile)}`,
+        `WHOIS query    ${supportLabel(whois.queryProfile)}`,
+        `WHOIS scope    ${supportLabel(whois.queryScope)}`,
+        `WHOIS encoding ${supportLabel(whois.encodingProfile)}`,
+        `WHOIS parser   ${supportLabel(whois.parserProfile)}`,
+        ...(typeof profile.officialLookupUrl === 'string' && profile.officialLookupUrl
+            ? [`Official lookup ${safeTerminalValue(profile.officialLookupUrl)}`]
+            : []),
+        `Fixture states ${fixtures.length ? fixtures.map((value) => supportLabel(value)).join(', ') : 'None documented'}`,
+    ];
+    for (const file of files)
+        lines.push(`Verified by    ${safeTerminalValue(file)}`);
+    for (const url of documentation)
+        lines.push(`Documentation  ${safeTerminalValue(url)}`);
+    lines.push(`Limitation     ${safeTerminalValue(document.limitation)}`, '', safeTerminalValue(terminalRecord(document.interpretation).statement));
+    return `${lines.join('\n')}\n`;
+}
+function formatTerminalBulk(items, metadata) {
+    const lines = items.map((item) => {
+        if (!item.ok)
+            return `! ${safeTerminalValue(item.query)}: ${safeTerminalValue(item.error, 'Lookup failed')}`;
+        const result = terminalRecord(item.result);
+        const availability = terminalRecord(result.availability);
+        const state = titleCase(availability.state);
+        const confidence = titleCase(availability.confidence);
+        return `✓ ${safeTerminalValue(item.query)}: ${state} (${confidence} confidence)`;
+    });
+    const succeeded = items.filter((item) => item.ok).length;
+    lines.push('');
+    const collected = metadata.collectedTotal ?? items.length;
+    const filter = metadata.filter && metadata.filter !== 'all'
+        ? ` · ${items.length} matched ${metadata.filter}`
+        : '';
+    lines.push(`${collected} collected${filter} · ${succeeded} succeeded · ${items.length - succeeded} failed in output · ${metadata.duplicates || 0} duplicates removed`);
+    return `${lines.join('\n')}\n`;
+}
+function formatTerminalCtSearch(document) {
+    const matches = Array.isArray(document.matches) ? document.matches : [];
+    const certificateGroups = Array.isArray(document.certificateGroups) ? document.certificateGroups : [];
+    const crossDomainGroups = certificateGroups.filter((value) => {
+        const group = terminalRecord(value);
+        return Array.isArray(group.domains) && group.domains.length > 1;
+    });
+    const visible = matches.slice(0, MAX_CT_TERMINAL_MATCHES);
+    const observation = terminalRecord(document.observation);
+    const lines = [
+        `Keyword        ${safeTerminalValue(document.keyword)}`,
+        `CT status      ${titleCase(observation.status || (document.truncated ? 'partial' : 'success'))}`,
+        `Certificates   ${safeTerminalValue(document.certCount, '0')}`,
+        `Observed hosts ${safeTerminalValue(Array.isArray(document.domains) ? document.domains.length : 0, '0')}`,
+        `Matches        ${safeTerminalValue(matches.length, '0')}`,
+        `Issuance groups ${safeTerminalValue(certificateGroups.length, '0')} (${safeTerminalValue(crossDomainGroups.length, '0')} cross-domain)`,
+        `Truncated      ${document.truncated ? 'Yes' : 'No'}`,
+        `Group cap      ${document.certificateGroupsTruncated ? 'Reached' : 'Not reached'}`,
+        '',
+    ];
+    if (!visible.length) {
+        lines.push('No structured registrable-domain matches.');
+    }
+    else {
+        for (const value of visible) {
+            const match = terminalRecord(value);
+            const hostnames = Array.isArray(match.hostnames) ? match.hostnames : [];
+            const shownHosts = hostnames.slice(0, MAX_CT_TERMINAL_HOSTNAMES).map((value) => safeTerminalValue(value));
+            const omitted = hostnames.length - shownHosts.length;
+            lines.push(safeTerminalValue(match.domain));
+            lines.push(`  Certificates ${safeTerminalValue(match.certificateCount, '0')}`);
+            lines.push(`  Hostnames     ${shownHosts.join(', ')}${omitted > 0 ? ` (+${omitted} more)` : ''}`);
+            lines.push(`  Observed      ${safeTerminalValue(match.firstObservedAt)} → ${safeTerminalValue(match.lastObservedAt)}`);
+        }
+    }
+    if (matches.length > visible.length) {
+        lines.push('', `Showing ${visible.length} of ${matches.length} structured matches in terminal output; use --json for the complete bounded result.`);
+    }
+    return `${lines.join('\n')}\n`;
+}
+function formatTerminalDiscover(document, mutationLabels = {}) {
+    const candidates = Array.isArray(document.candidates) ? document.candidates : [];
+    const visible = candidates.slice(0, MAX_DISCOVER_TERMINAL_CANDIDATES);
+    const advanced = terminalRecord(document.advancedConfusable);
+    const snapshot = terminalRecord(document.snapshot);
+    const lines = [
+        `Seed           ${safeTerminalValue(document.seed)}`,
+        `Preset         ${safeTerminalValue(document.preset)}`,
+        `Keyboard       ${safeTerminalValue(document.keyboardLayout)}`,
+        `TLDs           ${(Array.isArray(document.tlds) ? document.tlds : []).map((value) => safeTerminalValue(value)).join(', ')}`,
+        `Families       ${(Array.isArray(document.mutationFamilies) && document.mutationFamilies.length) ? document.mutationFamilies.map((value) => safeTerminalValue(value)).join(', ') : 'Preset defaults'}`,
+        `Dictionary     ${safeTerminalValue(document.dictionaryTermCount, '0')} accepted custom terms${Number(document.rejectedDictionaryTermCount) > 0 ? `, ${safeTerminalValue(document.rejectedDictionaryTermCount)} rejected` : ''}`,
+        `Candidates     ${safeTerminalValue(candidates.length, '0')}`,
+        `Truncated      ${document.truncated ? 'Yes' : 'No'}`,
+    ];
+    if (Object.keys(advanced).length) {
+        lines.push(`Advanced IDN   ${safeTerminalValue(advanced.generated, '0')} generated, ${safeTerminalValue(advanced.omittedByPolicy, '0')} policy-omitted, ${safeTerminalValue(advanced.omittedByBudget, '0')} budget-omitted`);
+    }
+    if (Object.keys(snapshot).length) {
+        lines.push(`Snapshot       ${snapshot.baselineCreated ? 'Baseline created' : `${safeTerminalValue(Array.isArray(snapshot.added) ? snapshot.added.length : 0, '0')} added · ${safeTerminalValue(Array.isArray(snapshot.removed) ? snapshot.removed.length : 0, '0')} removed`}`);
+    }
+    lines.push('');
+    for (const value of visible) {
+        const candidate = terminalRecord(value);
+        const labels = (Array.isArray(candidate.mutationTypes) ? candidate.mutationTypes : [])
+            .map((mutationType) => {
+            const value = safeTerminalValue(mutationType);
+            return safeTerminalValue(mutationLabels[value] || value);
+        });
+        const candidateDomain = safeTerminalValue(candidate.domain, '');
+        const unicodeDomain = unicodeDomainFromAscii(candidateDomain);
+        const unicodeDetail = unicodeDomain && unicodeDomain !== candidateDomain
+            ? ` [Unicode: ${safeTerminalValue(unicodeDomain)}]`
+            : '';
+        lines.push(`${safeTerminalValue(candidateDomain)}${unicodeDetail}: ${labels.join(', ') || 'Generated variant'}`);
+    }
+    if (!visible.length)
+        lines.push('No candidates were generated.');
+    if (candidates.length > visible.length) {
+        lines.push('', `Showing ${visible.length} of ${candidates.length} candidates in terminal output; use --json or --jsonl for the complete bounded result.`);
+    }
+    return `${lines.join('\n')}\n`;
+}
+function formatTerminalPosture(document) {
+    const summary = terminalRecord(document.summary);
+    const spfExpansion = terminalRecord(document.spfExpansion);
+    const selectors = Array.isArray(document.dkimSelectors) ? document.dkimSelectors : [];
+    const checks = Array.isArray(document.checks) ? document.checks : [];
+    const dependencies = Array.isArray(document.externalDependencies) ? document.externalDependencies : [];
+    const dmarcAuthorizations = Array.isArray(document.dmarcAuthorizations) ? document.dmarcAuthorizations : [];
+    const lines = [
+        `Domain         ${safeTerminalValue(document.domain)}`,
+        `Checked        ${safeTerminalValue(document.checkedAt)}`,
+        `DKIM selectors ${selectors.length ? selectors.map((value) => safeTerminalValue(value)).join(', ') : 'None supplied'}`,
+        `Summary        ${safeTerminalValue(summary.danger, '0')} action · ${safeTerminalValue(summary.warning, '0')} review · ${safeTerminalValue(summary.pass, '0')} pass · ${safeTerminalValue(summary.info, '0')} info`,
+        ...(Object.keys(spfExpansion).length ? [
+            `SPF expansion  ${safeTerminalValue(spfExpansion.state)} · ${safeTerminalValue(spfExpansion.lookupsUsed, '0')}/${safeTerminalValue(spfExpansion.lookupLimit, '0')} policy queries · ${safeTerminalValue(spfExpansion.dnsLookupTerms, '0')} DNS terms`,
+        ] : []),
+        `Dependencies   ${dependencies.length} observed · ${dmarcAuthorizations.length} DMARC reporting destination${dmarcAuthorizations.length === 1 ? '' : 's'} checked`,
+        '',
+    ];
+    for (const value of checks) {
+        const item = terminalRecord(value);
+        lines.push(`[${safeTerminalValue(item.status, 'info').toUpperCase()}] ${safeTerminalValue(item.label)}: ${safeTerminalValue(item.summary)}`);
+        if (item.detail)
+            lines.push(`  Detail  ${safeTerminalValue(item.detail)}`);
+        if (item.remediation)
+            lines.push(`  Next    ${safeTerminalValue(item.remediation)}`);
+        const records = Array.isArray(item.records) ? item.records : [];
+        for (const record of records.slice(0, MAX_POSTURE_TERMINAL_RECORDS)) {
+            lines.push(`  Record  ${safeTerminalValue(record)}`);
+        }
+        if (records.length > MAX_POSTURE_TERMINAL_RECORDS) {
+            lines.push(`  Records ${records.length - MAX_POSTURE_TERMINAL_RECORDS} more omitted from terminal output; use --json for the complete bounded report.`);
+        }
+    }
+    if (!checks.length)
+        lines.push('No posture checks were returned.');
+    return `${lines.join('\n')}\n`;
+}
+function formatTerminalHttp(document) {
+    const http = terminalRecord(document.http);
+    const response = terminalRecord(http.response);
+    const attempts = Array.isArray(http.attempts) ? http.attempts : [];
+    const limitations = Array.isArray(http.limitations) ? http.limitations : [];
+    const securityHeadersRecord = terminalRecord(response.securityHeaders);
+    const securityHeaders = Object.keys(securityHeadersRecord).length
+        ? Object.entries(securityHeadersRecord).filter(([, value]) => Boolean(value)).map(([name]) => name)
+        : [];
+    const lines = [
+        `Domain         ${safeTerminalValue(document.domain)}`,
+        `Probe          ${titleCase(document.probeStatus)}`,
+        `Assessment     ${titleCase(document.assessment ?? document.activityStatus)}`,
+        `Evidence       ${titleCase(http.status)}`,
+        `Final URL      ${safeTerminalValue(http.finalUrl)}`,
+        `HTTP status    ${safeTerminalValue(response.status)}`,
+        `Transport      ${safeTerminalValue(http.transportSecurity)}`,
+        `Redirects      ${safeTerminalValue(http.redirectCount, '0')}`,
+        `Content type   ${safeTerminalValue(response.contentType)}`,
+        `Body inspected ${response.bodyInspected === true ? 'Yes' : response.bodyInspected === false ? 'No' : '—'}`,
+        `Security       ${securityHeaders.length ? securityHeaders.join(', ') : 'No selected headers observed'}`,
+    ];
+    if (document.detail)
+        lines.push(`Detail         ${safeTerminalValue(document.detail)}`);
+    appendDeliveryMetadataLines(lines, response.deliveryMetadata, true);
+    const bodyHash = terminalRecord(response.bodyHash);
+    if (bodyHash.value) {
+        lines.push(`Body hash      ${safeTerminalValue(`${bodyHash.algorithm}:${bodyHash.value} (${bodyHash.scope})`)}`);
+    }
+    for (const value of attempts) {
+        const attempt = terminalRecord(value);
+        const outcome = attempt.httpStatus ? `HTTP ${attempt.httpStatus}` : attempt.error || attempt.outcome;
+        lines.push(`Attempt        ${safeTerminalValue(attempt.url)}: ${safeTerminalValue(outcome)}`);
+    }
+    for (const limitation of limitations)
+        lines.push(`Limitation     ${safeTerminalValue(limitation)}`);
+    return `${lines.join('\n')}\n`;
+}
+function formatTerminalTls(document) {
+    const certificate = terminalRecord(document.certificate);
+    const subject = terminalRecord(certificate.subject);
+    const issuer = terminalRecord(certificate.issuer);
+    const altNames = terminalRecord(certificate.subjectAltNames);
+    const dnsNames = Array.isArray(altNames.dnsNames) ? altNames.dnsNames : [];
+    const ipAddresses = Array.isArray(altNames.ipAddresses) ? altNames.ipAddresses : [];
+    const visibleAltNames = [...dnsNames, ...ipAddresses].slice(0, MAX_TLS_TERMINAL_ALT_NAMES);
+    const omittedAltNames = dnsNames.length + ipAddresses.length - visibleAltNames.length;
+    const cipher = terminalRecord(document.cipher);
+    const publicKey = terminalRecord(certificate.publicKey);
+    const signature = terminalRecord(certificate.signature);
+    const purposes = terminalRecord(certificate.extendedKeyUsage);
+    const purposeValues = Array.isArray(purposes.values)
+        ? purposes.values.slice(0, MAX_TLS_TERMINAL_PURPOSES).map(terminalRecord)
+        : [];
+    const sanClasses = terminalCountSummary(altNames.classes, [
+        ['dns', 'DNS'],
+        ['ip', 'IP'],
+        ['email', 'email'],
+        ['uri', 'URI'],
+        ['directoryName', 'directory name'],
+        ['registeredId', 'registered ID'],
+        ['otherName', 'other name'],
+        ['unclassified', 'other'],
+    ]);
+    const aia = terminalRecord(certificate.authorityInformationAccess);
+    const ocsp = terminalRecord(aia.ocsp);
+    const caIssuers = terminalRecord(aia.caIssuers);
+    const authorization = terminalRecord(document.authorization);
+    const hostname = terminalRecord(document.hostname);
+    const validity = terminalRecord(document.validity);
+    const diagnostics = terminalRecord(document.diagnostics);
+    const findings = Array.isArray(document.findings) ? document.findings : [];
+    const limitations = Array.isArray(document.limitations) ? document.limitations : [];
+    const lines = [
+        `Hostname       ${safeTerminalValue(document.sniHost)}`,
+        `Evidence       ${titleCase(document.status)}`,
+        `Observed       ${safeTerminalValue(document.observedAt)}`,
+        `Address        ${safeTerminalValue(document.connectedAddress)}`,
+        `Protocol       ${safeTerminalValue(document.protocol)}`,
+        `ALPN           ${safeTerminalValue(document.alpnProtocol)}`,
+        `Cipher         ${safeTerminalValue(cipher.standardName || cipher.name)}`,
+        `Authorized     ${authorization.authorized === true ? 'Yes' : authorization.authorized === false ? 'No' : 'Unknown'}`,
+        `Hostname match ${hostname.matches === true ? 'Yes' : hostname.matches === false ? 'No' : 'Unknown'}`,
+        `Validity       ${titleCase(validity.status)}`,
+        `Subject        ${safeTerminalValue(Array.isArray(subject.commonNames) ? subject.commonNames.join(', ') : null)}`,
+        `Issuer         ${safeTerminalValue(Array.isArray(issuer.commonNames) ? issuer.commonNames.join(', ') : null)}`,
+        `Valid from     ${safeTerminalValue(certificate.validFrom)}`,
+        `Valid to       ${safeTerminalValue(certificate.validTo)}`,
+        `Fingerprint    ${safeTerminalValue(certificate.fingerprintSha256)}`,
+        `Public key     ${safeTerminalValue([publicKey.type, publicKey.bits ? `${publicKey.bits} bits` : null, publicKey.curve].filter(Boolean).join(' '))}`,
+        ...(signature.algorithm || signature.oid
+            ? [`Signature      ${safeTerminalValue([signature.algorithm, signature.oid ? `(${signature.oid})` : null].filter(Boolean).join(' '))}`]
+            : []),
+        ...(Object.keys(purposes).length
+            ? [`Purposes       ${purposeValues.length
+                    ? purposeValues.map((purpose) => safeTerminalValue(`${purpose.name || 'Unrecognized purpose'} (${purpose.oid || 'unknown OID'})`)).join(', ')
+                    : 'None declared'}${Array.isArray(purposes.values) && purposes.values.length > purposeValues.length ? ` (+${purposes.values.length - purposeValues.length} more)` : ''}${purposes.truncated ? ' (source truncated)' : ''}`]
+            : []),
+        `Alt names      ${visibleAltNames.length ? visibleAltNames.map((value) => safeTerminalValue(value)).join(', ') : '—'}${omittedAltNames > 0 ? ` (+${omittedAltNames} more)` : ''}`,
+        ...(Object.keys(terminalRecord(altNames.classes)).length
+            ? [`SAN classes    ${sanClasses || 'None observed'}${altNames.truncated ? ' (truncated)' : ''}`]
+            : []),
+        ...(Object.keys(aia).length
+            ? [`AIA presence   ${[
+                    terminalCount(ocsp.total) > 0
+                        ? `OCSP ${terminalCount(ocsp.total)} (${terminalCount(ocsp.https)} HTTPS, ${terminalCount(ocsp.http)} HTTP, ${terminalCount(ocsp.other)} other)`
+                        : null,
+                    terminalCount(caIssuers.total) > 0
+                        ? `CA issuers ${terminalCount(caIssuers.total)} (${terminalCount(caIssuers.https)} HTTPS, ${terminalCount(caIssuers.http)} HTTP, ${terminalCount(caIssuers.other)} other)`
+                        : null,
+                    terminalCount(aia.unknownMethods) > 0 ? `unknown methods ${terminalCount(aia.unknownMethods)}` : null,
+                ].filter(Boolean).join(' · ') || 'None declared'}${aia.truncated ? ' (truncated)' : ''}`]
+            : []),
+        `Chain          ${safeTerminalValue(Array.isArray(document.chain) ? document.chain.length : 0, '0')} certificate${Array.isArray(document.chain) && document.chain.length === 1 ? '' : 's'}${document.chainTruncated ? ' (truncated)' : ''}`,
+    ];
+    if (authorization.error)
+        lines.push(`Trust detail   ${safeTerminalValue(authorization.error)}`);
+    if (hostname.error)
+        lines.push(`Name detail    ${safeTerminalValue(hostname.error)}`);
+    if (diagnostics.error)
+        lines.push(`Error          ${safeTerminalValue(diagnostics.error)}`);
+    for (const value of findings) {
+        const finding = terminalRecord(value);
+        lines.push(`Finding        ${safeTerminalValue(finding.label)}: ${safeTerminalValue(finding.detail)}`);
+    }
+    for (const limitation of limitations)
+        lines.push(`Limitation     ${safeTerminalValue(limitation)}`);
+    return `${lines.join('\n')}\n`;
+}
+function comparisonStatusLabel(status) {
+    const labels = {
+        equivalent: 'Equivalent',
+        conflict: 'Conflict',
+        rdap_only: 'RDAP only',
+        whois_only: 'WHOIS only',
+        rdap_redacted: 'RDAP redacted',
+        whois_redacted: 'WHOIS redacted',
+        rdap_unavailable: 'RDAP unavailable',
+        whois_unavailable: 'WHOIS unavailable',
+        rdap_incomplete: 'RDAP incomplete',
+        whois_incomplete: 'WHOIS incomplete',
+        registry_only: 'Registry only',
+        registrar_only: 'Registrar only',
+        registry_redacted: 'Registry redacted',
+        registrar_redacted: 'Registrar redacted',
+        registry_unavailable: 'Registry unavailable',
+        registrar_unavailable: 'Registrar unavailable',
+        registry_incomplete: 'Registry incomplete',
+        registrar_incomplete: 'Registrar incomplete',
+    };
+    return labels[String(status)] || titleCase(status);
+}
+function formatTerminalCompare(document) {
+    const fields = Array.isArray(document.fields) ? document.fields : [];
+    const counts = terminalRecord(document.counts);
+    const sourceHealth = terminalRecord(document.sourceHealth);
+    const rdapHealth = terminalRecord(sourceHealth.rdap);
+    const whoisHealth = terminalRecord(sourceHealth.whois);
+    const registryAccess = terminalRecord(document.registryAccess);
+    const differenceCount = fields.length - (Number(counts.equivalent) || 0);
+    const lines = [
+        `Query          ${safeTerminalValue(document.query || document.registrableDomain)}`,
+        `Lookup mode    ${titleCase(document.lookupMode)}`,
+        `Lookup saved   ${safeTerminalValue(document.lookupGeneratedAt)}`,
+        `RDAP source    ${comparisonStatusLabel(rdapHealth.status)}`,
+        `WHOIS source   ${comparisonStatusLabel(whoisHealth.status)}`,
+        `Compared       ${safeTerminalValue(fields.length, '0')} field${fields.length === 1 ? '' : 's'}`,
+        `Equivalent     ${safeTerminalValue(counts.equivalent, '0')}`,
+        `Differences    ${safeTerminalValue(differenceCount, '0')}`,
+    ];
+    if (Object.keys(registryAccess).length) {
+        lines.push(`Registry access .${safeTerminalValue(registryAccess.suffix)}`, `WHOIS access   ${registryAccessProfileLabel(registryAccess.whoisAccessProfile)}`, `RDAP access    ${registryAccessProfileLabel(registryAccess.rdapAccessProfile)}`, `Access note    ${safeTerminalValue(registryAccess.limitation)}`);
+    }
+    lines.push('');
+    if (!fields.length) {
+        lines.push('Neither source published a comparable normalised field.');
+    }
+    else {
+        for (const value of fields) {
+            const field = terminalRecord(value);
+            lines.push(`[${comparisonStatusLabel(field.status).toUpperCase()}] ${safeTerminalValue(field.label)}`);
+            lines.push(`  RDAP   ${safeTerminalValue(field.rdapDisplay)}`);
+            lines.push(`  WHOIS  ${safeTerminalValue(field.whoisDisplay)}`);
+        }
+    }
+    const registrarComparison = terminalRecord(document.registrarPublicationComparison);
+    if (Object.keys(registrarComparison).length) {
+        const publicationFields = Array.isArray(registrarComparison.fields) ? registrarComparison.fields : [];
+        const publicationCounts = terminalRecord(registrarComparison.counts);
+        const publicationHealth = terminalRecord(registrarComparison.sourceHealth);
+        const registryHealth = terminalRecord(publicationHealth.registry);
+        const registrarHealth = terminalRecord(publicationHealth.registrar);
+        const publicationDifferences = publicationFields.length - (Number(publicationCounts.equivalent) || 0);
+        lines.push('', 'Registry / registrar RDAP publication', `Registry RDAP  ${comparisonStatusLabel(registryHealth.status)}`, `Registrar RDAP ${comparisonStatusLabel(registrarHealth.status)}`, `Compared       ${safeTerminalValue(publicationFields.length, '0')} field${publicationFields.length === 1 ? '' : 's'}`, `Equivalent     ${safeTerminalValue(publicationCounts.equivalent, '0')}`, `Differences    ${safeTerminalValue(publicationDifferences, '0')}`, '');
+        if (!publicationFields.length) {
+            lines.push('Neither RDAP publication exposed a comparable normalised field.');
+        }
+        else {
+            for (const value of publicationFields) {
+                const field = terminalRecord(value);
+                lines.push(`[${comparisonStatusLabel(field.status).toUpperCase()}] ${safeTerminalValue(field.label)}`);
+                lines.push(`  Registry   ${safeTerminalValue(field.registryDisplay)}`);
+                lines.push(`  Registrar  ${safeTerminalValue(field.registrarDisplay)}`);
+            }
+        }
+    }
+    lines.push('', 'Comparison is source reconciliation, not an availability or ownership decision.');
+    if (Object.keys(registryAccess).length) {
+        lines.push('Registry access describes collection reachability only; it does not decide registration, availability, ownership, safety, or maliciousness.');
+    }
+    return `${lines.join('\n')}\n`;
+}
+function formatTerminalRiskCalibration(document) {
+    const summary = terminalRecord(document.summary);
+    const bands = terminalRecord(summary.scoreBands);
+    const thresholds = Array.isArray(document.thresholds) ? document.thresholds : [];
+    const records = Array.isArray(document.records) ? document.records : [];
+    const comparison = terminalRecord(document.modelComparison);
+    const visible = records.slice(0, MAX_RISK_CALIBRATION_TERMINAL_RECORDS);
+    const lines = [
+        `Risk model     v${safeTerminalValue(document.riskModelVersion)}`,
+        `Review band    ${safeTerminalValue(document.currentReviewThreshold)}+`,
+        `Records        ${safeTerminalValue(summary.total, '0')}`,
+        `Metric labels  ${safeTerminalValue((Number(summary.positive) || 0) + (Number(summary.negative) || 0), '0')}`,
+        `Excluded       ${safeTerminalValue(summary.excluded, '0')}`,
+        `Score bands    0-39 ${safeTerminalValue(bands['0_39'], '0')} · 40-69 ${safeTerminalValue(bands['40_69'], '0')} · 70-100 ${safeTerminalValue(bands['70_100'], '0')} · not scored ${safeTerminalValue(bands.not_scored, '0')}`,
+        '',
+        'Threshold replay',
+    ];
+    for (const value of thresholds) {
+        const threshold = terminalRecord(value);
+        lines.push(`${String(safeTerminalValue(threshold.threshold)).padStart(3)}+  TP ${safeTerminalValue(threshold.truePositive, '0')}  FP ${safeTerminalValue(threshold.falsePositive, '0')}  TN ${safeTerminalValue(threshold.trueNegative, '0')}  FN ${safeTerminalValue(threshold.falseNegative, '0')}  precision ${safeTerminalValue(threshold.precision)}  recall ${safeTerminalValue(threshold.recall)}  F1 ${safeTerminalValue(threshold.f1)}`);
+    }
+    if (comparison.available === true) {
+        lines.push('', `Model comparison  v${safeTerminalValue(comparison.previousModelVersion)} → v${safeTerminalValue(comparison.currentModelVersion)} · ${safeTerminalValue(comparison.scoresChanged, '0')} score changes · ${safeTerminalValue(comparison.thresholdClassificationsChanged, '0')} review-band changes`);
+    }
+    lines.push('', 'Records');
+    for (const value of visible) {
+        const record = terminalRecord(value);
+        const score = record.score === null ? 'not scored' : String(record.score);
+        lines.push(`${safeTerminalValue(record.id)}  ${safeTerminalValue(record.domain)}  ${titleCase(record.analystDisposition)}  ${score}`);
+    }
+    if (records.length > visible.length)
+        lines.push(`… ${records.length - visible.length} additional records omitted from terminal output; use --json for the complete bounded report.`);
+    lines.push('', safeTerminalValue(terminalRecord(document.interpretation).statement));
+    return `${lines.join('\n')}\n`;
+}
+export { MAX_CT_TERMINAL_HOSTNAMES, MAX_CT_TERMINAL_MATCHES, MAX_DISCOVER_TERMINAL_CANDIDATES, MAX_POSTURE_TERMINAL_RECORDS, MAX_RISK_CALIBRATION_TERMINAL_RECORDS, formatTerminalBulk, formatTerminalCompare, formatTerminalCtSearch, formatTerminalDiscover, formatTerminalHttp, formatTerminalPosture, formatTerminalRegistrySupport, formatTerminalRiskCalibration, formatTerminalTls, };