@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/cli/lookup-diff.mjs

@@ -4,6 +4,7 @@ import { buildBulkDomainComparison, } from "../packages/investigation/bulk-domai
 import { relationshipObservation } from "../packages/comparison/relationship-evidence.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
+import { lookupObservationHostname } from "../packages/evidence/lookup-target.mjs";
 export const CLI_LOOKUP_DIFF_SCHEMA = 'whoisleuth.cli.lookup-diff';
 export const CLI_LOOKUP_DIFF_VERSION = 1;
 function text(value, maximum = 300) {
@@ -129,19 +130,22 @@ function lookupComparisonInput(document) {
 function buildCliLookupDiff(leftText, rightText, generatedAt = new Date().toISOString(), options = {}) {
     const left = parseSavedLookupDocument(leftText, { label: 'Left lookup input' });
     const right = parseSavedLookupDocument(rightText, { label: 'Right lookup input' });
-    const domainMode = options.domainMode ?? 'different';
+    const domainMode = options.domainMode === 'auto'
+        ? left.registrableDomain === right.registrableDomain ? 'same' : 'different'
+        : options.domainMode ?? 'different';
     if (domainMode === 'different' && left.registrableDomain === right.registrableDomain) {
         throw new CliUsageError('Lookup diff requires documents for two different domains.');
     }
     if (domainMode === 'same' && left.registrableDomain !== right.registrableDomain) {
         throw new CliUsageError('Lookup history requires observations for the same domain.');
     }
-    const comparison = buildBulkDomainComparison(lookupComparisonInput(left), lookupComparisonInput(right), domainMode === 'same' ? right.generatedAt : null, {
+    const measuredComparison = buildBulkDomainComparison(lookupComparisonInput(left), lookupComparisonInput(right), domainMode === 'same' ? right.generatedAt : null, {
         allowSameDomain: domainMode === 'same',
         ...(domainMode === 'same' ? { now: Date.parse(right.generatedAt) } : {}),
     });
-    if (!comparison)
+    if (!measuredComparison)
         throw new CliUsageError('Lookup documents could not be compared.');
+    const comparison = qualifyLookupComparison(measuredComparison, left, right, domainMode === 'same');
     return {
         schema: CLI_LOOKUP_DIFF_SCHEMA,
         version: CLI_LOOKUP_DIFF_VERSION,
@@ -160,6 +164,36 @@ function buildCliLookupDiff(leftText, rightText, generatedAt = new Date().toISOS
         ],
     };
 }
+function qualifyLookupComparison(comparison, left, right, temporal) {
+    const leftScope = recordOrEmpty(left.availability);
+    const rightScope = recordOrEmpty(right.availability);
+    const hostnameChanged = temporal && lookupObservationHostname(leftScope) !== lookupObservationHostname(rightScope);
+    const selectedPage = leftScope.webObservationMode === 'selected_url' || rightScope.webObservationMode === 'selected_url';
+    if (!hostnameChanged && !selectedPage)
+        return comparison;
+    const limitation = 'The retained collection hostname differs or a selected URL has no retained complete path/query identity. Values remain visible, but those fields cannot establish change at the same target.';
+    const rows = comparison.rows.map((row) => {
+        const web = ['web', 'technology', 'identity'].includes(row.category);
+        const incomparable = hostnameChanged && !['registration', 'lifecycle', 'source'].includes(row.category)
+            || temporal && selectedPage && web;
+        return {
+            ...row,
+            ...(selectedPage && web ? { method: 'Bounded website observation; one or both captures concern a selected URL rather than the homepage' } : {}),
+            ...(incomparable ? {
+                state: 'not_recorded',
+                source: `${row.source}; comparable target identity not recorded`,
+                leftSourceState: 'not_recorded',
+                rightSourceState: 'not_recorded',
+                limitations: [...row.limitations, limitation],
+            } : {}),
+        };
+    });
+    return {
+        ...comparison, rows,
+        counts: Object.fromEntries(Object.keys(comparison.counts).map((state) => [state, rows.filter((row) => row.state === state).length])),
+        limitations: [...comparison.limitations, limitation],
+    };
+}
 function formatCliLookupDiff(document) {
     const rows = document.comparison.rows.filter((row) => row.state !== 'equal');
     const output = [

package/cli/lookup-plan.mjs

@@ -21,7 +21,7 @@ const FAST_DOMAIN_EVIDENCE = Object.freeze({
 const DEEP_DOMAIN_EVIDENCE = Object.freeze({
     source: 'domain_evidence',
     purpose: 'Collect bounded DNS, HTTP, TLS, page-identity, technology, and security-posture evidence.',
-    disclosure: 'DNS resolvers and the target website infrastructure receive the hostname through bounded probes.',
+    disclosure: 'DNS, TLS and website probes use the submitted hostname. Registration-delegation queries use the registrable domain.',
     conditional: false,
 });
 const REGISTRAR_RDAP = Object.freeze({
@@ -42,19 +42,23 @@ const REVERSE_DNS = Object.freeze({
     disclosure: 'A DNS resolver receives the reverse lookup for the normalised IP address.',
     conditional: false,
 });
-function plannedSources(classified, deep) {
+function plannedSources(classified, deep, selectedUrl) {
     if (!deep) {
         return Object.freeze(classified.type === 'domain' ? [RDAP, FAST_DOMAIN_EVIDENCE] : [RDAP]);
     }
     if (classified.type === 'domain') {
-        return Object.freeze([RDAP, WHOIS, DEEP_DOMAIN_EVIDENCE, REGISTRAR_RDAP, NETWORK_CONTEXT]);
+        const domainEvidence = selectedUrl ? Object.freeze({
+            ...DEEP_DOMAIN_EVIDENCE,
+            disclosure: 'The selected URL path and query are sent to the website and followed redirects. The fragment is not sent. DNS and TLS use its hostname; registration uses the registrable domain. Saved HTTP provenance omits queries, but page-derived text may contain sensitive information.',
+        }) : DEEP_DOMAIN_EVIDENCE;
+        return Object.freeze([RDAP, WHOIS, domainEvidence, REGISTRAR_RDAP, NETWORK_CONTEXT]);
     }
     if (classified.type === 'ipv4' || classified.type === 'ipv6') {
         return Object.freeze([RDAP, WHOIS, REVERSE_DNS]);
     }
     return Object.freeze([RDAP, WHOIS]);
 }
-function buildCliLookupPlan(query, classified, deep) {
+function buildCliLookupPlan(query, classified, deep, selectedUrl = false) {
     return Object.freeze({
         schema: CLI_LOOKUP_PLAN_SCHEMA,
         version: CLI_LOOKUP_PLAN_VERSION,
@@ -69,7 +73,7 @@ function buildCliLookupPlan(query, classified, deep) {
         planning: Object.freeze({
             networkRequestsMade: false,
             collectionRequiresNetwork: true,
-            sources: plannedSources(classified, deep),
+            sources: plannedSources(classified, deep, selectedUrl),
         }),
         limitations: Object.freeze([
             'This is a local preflight. It does not test source availability, feature configuration, cache state, redirects, referrals, or the exact number of requests a completed lookup may require.',
@@ -81,6 +85,8 @@ function formatCliLookupPlan(plan) {
     const lines = [
         'WHOISleuth lookup preflight',
         `Target: ${plan.target.normalized}`,
+        ...(plan.target.inputHostname && plan.target.inputHostname !== plan.target.normalized
+            ? [`Submitted hostname: ${plan.target.inputHostname}`] : []),
         `Type: ${plan.target.type}`,
         `Mode: ${plan.mode}`,
         'Network requests made: no',

package/cli/lookup-reconcile.mjs

@@ -1,6 +1,7 @@
 import { CliUsageError } from "./errors.mjs";
 import { buildCliLookupDiff } from "./lookup-diff.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
+import { compareObservationContexts } from "../packages/comparison/capture-context.mjs";
 const CLI_LOOKUP_RECONCILIATION_SCHEMA = 'whoisleuth.cli.lookup-reconciliation';
 const CLI_LOOKUP_RECONCILIATION_VERSION = 1;
 const MAX_LOOKUP_RECONCILIATION_INPUT_BYTES = 32 * 1024 * 1024;
@@ -79,15 +80,11 @@ function buildCliLookupReconciliation(inputs, generatedAt = new Date().toISOStri
         };
     });
     const observations = documents.map(observationContext);
-    const identities = observations.map((observation) => (observation.observerLabel && observation.vantageLabel
-        ? `${observation.observerLabel}\u0000${observation.vantageLabel}`
-        : null));
-    const labelsComplete = identities.every((identity) => identity !== null);
-    const labelsDistinct = labelsComplete && new Set(identities).size === identities.length;
-    const independence = labelsDistinct
+    const context = compareObservationContexts(observations.map(observation => ({ ...observation, observedAt: observation.generatedAt })));
+    const independence = context.labels === 'distinct'
         ? {
             state: 'verified_distinct_labels',
-            reason: 'Every observation carries a different analyst-supplied observer and vantage label.',
+            reason: 'Every observation carries a distinct analyst-supplied observer/vantage label pair. Actual collection independence is not verified.',
         }
         : {
             state: 'unverified',
@@ -117,15 +114,19 @@ function buildCliLookupReconciliation(inputs, generatedAt = new Date().toISOStri
     };
 }
 function formatCliLookupReconciliation(document) {
+    const context = compareObservationContexts(document.observations.map(observation => ({ ...observation, observedAt: observation.generatedAt })));
     const output = [
         'Lookup observation reconciliation',
         `Domain             ${document.domain}`,
         `Observations       ${document.summary.observationCount}`,
-        `Independence       ${document.independence.state.replaceAll('_', ' ')}`,
+        `Declared labels    ${context.labels}; collection independence not verified`,
+        `Capture time span  ${context.time.spanMilliseconds === null ? 'unknown' : `${context.time.spanMilliseconds / 1000} seconds`}`,
         `Agreement          ${document.summary.agreement}`,
         `Disagreement       ${document.summary.disagreement}`,
         `Non-comparable     ${document.summary.nonComparable}`,
         '',
+        ...document.observations.map((observation, index) => `Observation ${index + 1}: ${observation.generatedAt} · ${observation.mode} · observer ${observation.observerLabel ?? 'not declared'} · vantage ${observation.vantageLabel ?? 'not declared'}`),
+        '',
     ];
     for (const field of document.fields.filter((candidate) => candidate.state !== 'agreement')) {
         output.push(`${field.label} [${field.state.replaceAll('_', ' ')}]`);
@@ -136,6 +137,7 @@ function formatCliLookupReconciliation(document) {
     output.push('', 'Limitations:');
     for (const limitation of document.limitations)
         output.push(`  - ${limitation}`);
+    output.push('  - These selected observations do not establish worldwide availability, removal or takedown.');
     return `${output.join('\n')}\n`;
 }
 export { CLI_LOOKUP_RECONCILIATION_SCHEMA, CLI_LOOKUP_RECONCILIATION_VERSION, MAX_LOOKUP_RECONCILIATION_INPUT_BYTES, buildCliLookupReconciliation, formatCliLookupReconciliation, };

package/cli/mail-review.mjs

@@ -3,9 +3,11 @@ import { getDomain } from 'tldts';
 import { scanBoundedJson } from "../lib/bounded-json.mjs";
 import { isValidAsciiDomainName } from "../lib/hostname.mjs";
 import { isRecord, recordOrEmpty } from "../lib/json-record.mjs";
+import { classifyQuery } from "../lib/classify.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { CliUsageError } from "./errors.mjs";
 export const CLI_MAIL_REVIEW_SCHEMA = 'whoisleuth.cli.mail-review';
-export const CLI_MAIL_REVIEW_VERSION = 3;
+export const CLI_MAIL_REVIEW_VERSION = 4;
 export const MAX_MAIL_REVIEW_INPUT_BYTES = 16 * 1024 * 1024;
 export const MAX_MAIL_REVIEW_ROWS = 500;
 const UNSAFE_TEXT_RE = /[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u202a-\u202e\u2060-\u206f]/u;
@@ -20,10 +22,10 @@ function boolean(value) {
     return typeof value === 'boolean' ? value : null;
 }
 function timestamp(value, label) {
-    if (typeof value !== 'string' || value.length > 64 || !Number.isFinite(Date.parse(value))) {
-        throw new CliUsageError(`${label} must be a valid bounded timestamp.`);
-    }
-    return new Date(value).toISOString();
+    const result = normalizeExplicitIsoTimestamp(value);
+    if (!result)
+        throw new CliUsageError(`${label} must be a valid bounded timestamp with an explicit timezone.`);
+    return result;
 }
 function booleanOrNull(value, label) {
     if (value === null || typeof value === 'boolean')
@@ -87,8 +89,8 @@ function validateMxEvidence(availability, summary, label, hasMx, hasNullMx) {
 function validateMailRow(value, index, expectedVersion) {
     const item = record(value);
     const label = `Mail review row ${index + 1}`;
-    const version = Number(item.version);
-    if (item.schema !== 'whoisleuth.cli.bulk.item' || ![2, 3].includes(version)
+    const version = item.version;
+    if (item.schema !== 'whoisleuth.cli.bulk.item' || typeof version !== 'number' || ![2, 3].includes(version)
         || (expectedVersion !== null && version !== expectedVersion)) {
         throw new CliUsageError(`${label} must use the matching WHOISleuth Bulk item schema version 2 or 3.`);
     }
@@ -193,6 +195,7 @@ function normalizeMailRow(value) {
     const providers = providerDomains(hosts);
     return {
         domain,
+        provenance: mailRowProvenance(item),
         state,
         dnsStatus,
         hasMx,
@@ -210,6 +213,29 @@ function normalizeMailRow(value) {
         ],
     };
 }
+function mailRowProvenance(item) {
+    return Object.freeze({
+        sourceGeneratedAt: timestamp(item.generatedAt, 'Bulk row generation time'),
+        observedAt: item.version === 3 ? normalizeExplicitIsoTimestamp(item.observedAt) : null,
+        dnsObservedAt: item.ok === true ? normalizeExplicitIsoTimestamp(record(record(item.availability).dns).observedAt) : null,
+        collectionOrigin: item.version === 3
+            ? item.collectionOrigin
+            : 'unknown',
+    });
+}
+function failedMailRow(item, index) {
+    let target = null;
+    try {
+        target = classifyQuery(String(item.query)).value;
+    }
+    catch { /* Invalid targets remain identifiable by input position. */ }
+    return Object.freeze({
+        rowNumber: index + 1,
+        target,
+        state: 'collection_failed',
+        provenance: mailRowProvenance(item),
+    });
+}
 function parseInput(textValue) {
     if (typeof textValue !== 'string' || Buffer.byteLength(textValue, 'utf8') > MAX_MAIL_REVIEW_INPUT_BYTES) {
         throw new CliUsageError(`Mail review input is limited to ${MAX_MAIL_REVIEW_INPUT_BYTES} bytes.`);
@@ -223,12 +249,12 @@ function parseInput(textValue) {
         scanBoundedJson(textInput);
         const parsed = JSON.parse(textInput);
         const document = record(parsed);
-        if (document.schema === 'whoisleuth.cli.bulk' && [2, 3].includes(Number(document.version)) && Array.isArray(document.results)) {
+        if (document.schema === 'whoisleuth.cli.bulk' && typeof document.version === 'number' && [2, 3].includes(document.version) && Array.isArray(document.results)) {
             values = document.results;
             containerVersion = Number(document.version);
             timestamp(document.generatedAt, 'Mail review Bulk generation time');
         }
-        else if (document.schema === 'whoisleuth.cli.bulk.item' && [2, 3].includes(Number(document.version))) {
+        else if (document.schema === 'whoisleuth.cli.bulk.item' && typeof document.version === 'number' && [2, 3].includes(document.version)) {
             values = [document];
         }
         else {
@@ -258,6 +284,13 @@ function buildCliMailReview(textValue, generatedAt = new Date().toISOString()) {
     const rows = inputRows.map(normalizeMailRow).filter((row) => Boolean(row));
     if (!rows.length)
         throw new CliUsageError('Mail review input contains no completed domain results.');
+    const failedRows = inputRows.flatMap((row, index) => row.ok === false ? [failedMailRow(row, index)] : []);
+    const inputCoverage = Object.freeze({
+        inputRows: inputRows.length,
+        reviewedRows: rows.length,
+        failedRows: failedRows.length,
+        unmeasuredObservationRows: [...rows, ...failedRows].filter((row) => row.provenance.observedAt === null).length,
+    });
     const counts = {
         authenticated_mail: 0,
         evidence_incomplete: 0,
@@ -295,10 +328,14 @@ function buildCliMailReview(textValue, generatedAt = new Date().toISOString()) {
     })
         .sort((left, right) => left.providerDomain.localeCompare(right.providerDomain));
     const providerRelationships = allProviderRelationships.slice(0, 100);
+    const rowsWithIncompleteDns = rows.filter((row) => row.dnsStatus !== 'success' || row.hasMx === null || row.hasNullMx === null).length;
     const providerCoverage = {
-        complete: rows.every((row) => !row.providerDomainsTruncated)
+        complete: failedRows.length === 0 && rowsWithIncompleteDns === 0
+            && rows.every((row) => !row.providerDomainsTruncated)
             && allProviderRelationships.length <= 100
             && allProviderRelationships.every((relationship) => !relationship.domainsTruncated),
+        failedRows: failedRows.length,
+        rowsWithIncompleteDns,
         rowsWithOmittedProviders: rows.filter((row) => row.providerDomainsTruncated).length,
         omittedProviderDomains: rows.reduce((sum, row) => sum + row.providerDomainsOmitted, 0),
         relationshipCount: allProviderRelationships.length,
@@ -309,16 +346,20 @@ function buildCliMailReview(textValue, generatedAt = new Date().toISOString()) {
     return {
         schema: CLI_MAIL_REVIEW_SCHEMA,
         version: CLI_MAIL_REVIEW_VERSION,
-        generatedAt,
+        generatedAt: timestamp(generatedAt, 'Mail review generation time'),
         counts,
         rows,
+        failedRows,
+        inputCoverage,
         providerRelationships,
         providerCoverage,
         limitations: [
             'This review is passive and uses DNS evidence already retained in a WHOISleuth Bulk result; it makes no network request.',
             'Null MX, no explicit MX, receiving mail, authentication gaps, and incomplete evidence remain separate states.',
             'SMTP delivery, mailbox existence, catch-all behaviour, banner collection, and message acceptance were not tested.',
-            ...(!providerCoverage.complete
+            ...(failedRows.length ? [`${failedRows.length} input target${failedRows.length === 1 ? '' : 's'} failed collection and cannot contribute mail evidence. Input positions and normalised targets are retained; consult the original input for failure diagnostics.`] : []),
+            ...(rowsWithIncompleteDns ? [`${rowsWithIncompleteDns} reviewed domain${rowsWithIncompleteDns === 1 ? ' has' : 's have'} incomplete DNS evidence; unobserved provider relationships remain unknown.`] : []),
+            ...(providerCoverage.rowsWithOmittedProviders || providerCoverage.omittedRelationships || providerCoverage.omittedRelationshipDomains
                 ? ['Mail-provider relationship coverage reached a configured row, relationship, or domain bound; omitted relationships remain unknown.']
                 : []),
         ],
@@ -327,19 +368,30 @@ function buildCliMailReview(textValue, generatedAt = new Date().toISOString()) {
 function formatCliMailReview(document) {
     const lines = [
         'Passive mail exposure review',
+        `Input targets    ${document.inputCoverage.inputRows}`,
         `Domains          ${document.rows.length}`,
+        `Failed targets   ${document.inputCoverage.failedRows}`,
         `Authenticated    ${document.counts.authenticated_mail}`,
         `Auth gaps        ${document.counts.mail_auth_gap}`,
         `Null MX          ${document.counts.null_mx}`,
         `No explicit MX   ${document.counts.no_explicit_mx}`,
-        `Incomplete       ${document.counts.evidence_incomplete + document.counts.mail_auth_incomplete}`,
+        `Incomplete       ${document.counts.evidence_incomplete + document.counts.mail_auth_incomplete + document.inputCoverage.failedRows}`,
         '',
     ];
     for (const row of document.rows) {
         lines.push(`${row.domain}  ${row.state.replaceAll('_', ' ')}`);
+        lines.push(`  Observed      ${row.provenance.observedAt ?? 'unknown'} · ${row.provenance.collectionOrigin.replaceAll('_', ' ')}`);
+        lines.push(`  DNS observed  ${row.provenance.dnsObservedAt ?? 'unknown'} · Source output ${row.provenance.sourceGeneratedAt}`);
         lines.push(`  MX providers  ${row.providerDomains.join(', ') || 'None observed'}${row.providerDomainsOmitted ? ` · +${row.providerDomainsOmitted} omitted` : ''}`);
         lines.push(`  SPF / DMARC   ${row.hasSpf === null ? 'unknown' : row.hasSpf ? 'observed' : 'not observed'} / ${row.hasDmarc === null ? 'unknown' : row.hasDmarc ? 'observed' : 'not observed'}`);
     }
+    if (document.failedRows.length) {
+        lines.push('', 'Failed collection inputs');
+        for (const row of document.failedRows) {
+            lines.push(`Input ${row.rowNumber}  ${row.target ?? 'unrecognised target'} · collection failed`);
+            lines.push(`  Observed      ${row.provenance.observedAt ?? 'unknown'} · ${row.provenance.collectionOrigin.replaceAll('_', ' ')} · Source output ${row.provenance.sourceGeneratedAt}`);
+        }
+    }
     if (document.providerRelationships.length) {
         lines.push('', 'Shared mail-provider relationships');
         for (const relationship of document.providerRelationships) {
@@ -347,7 +399,7 @@ function formatCliMailReview(document) {
         }
     }
     if (!document.providerCoverage.complete) {
-        lines.push('', `Provider coverage partial  ${document.providerCoverage.omittedProviderDomains} row providers · ${document.providerCoverage.omittedRelationships} relationships · ${document.providerCoverage.omittedRelationshipDomains} relationship domains omitted`);
+        lines.push('', `Provider coverage partial  ${document.providerCoverage.failedRows} failed targets · ${document.providerCoverage.rowsWithIncompleteDns} incomplete DNS rows · ${document.providerCoverage.omittedProviderDomains} row providers · ${document.providerCoverage.omittedRelationships} relationships · ${document.providerCoverage.omittedRelationshipDomains} relationship domains omitted`);
     }
     lines.push('', 'Limitations:');
     for (const limitation of document.limitations)

package/cli/manual.mjs

@@ -24,6 +24,7 @@ ${commands}
 Human-readable output is the default. Versioned JSON and JSONL are available where documented. Diagnostics and optional progress events use standard error. Use --output and optional --force for atomic private file output. Use --palette auto, light, or dark for a fixed terminal palette. Lookup --browse provides an interactive terminal view.
 .SH EXIT STATUS
 0 indicates command completion, 2 invalid usage, 3 a collection or comparison failure, 4 an explicitly detected partial result, 70 an internal bootstrap failure, 130 analyst cancellation, and 143 service termination.
+For verify-artifact, use --strict-exit in scripts: incomplete verification then returns 4. Without it, producing a verification report can return 0 even when its checks fail. Read the report state and checks.
 .SH PRIVACY
 Network commands disclose the target to the sources named in focused help. Offline commands read local input only. Output files use private permissions and remain on the operator's machine.
 .SH LICENSE

package/cli/network-command-runner.mjs

@@ -44,6 +44,8 @@ async function runNetworkCommand(args, dependencies, context) {
             dkimSelectors,
             retiredDkimSelectors,
             mailProtectionProfile: args.mailProfile,
+            ...(args.includeInheritedDns ? { includeInheritedDns: true } : {}),
+            ...(dependencies.signal ? { signal: dependencies.signal } : {}),
         }));
         const document = buildCliPostureDocument(requestedDomain, report, context.now());
         if (!args.quiet) {

package/cli/output-file.mjs

@@ -3,6 +3,7 @@ import { unlinkSync } from 'node:fs';
 import { link, open, rename, unlink } from 'node:fs/promises';
 import { basename, dirname, join, resolve } from 'node:path';
 import { CliUsageError } from "./errors.mjs";
+import { MAX_ENCRYPTED_INVESTIGATION_PACKAGE_BYTES } from "../packages/contracts/investigation-package-limits.mjs";
 export const MAX_CLI_OUTPUT_BYTES = 32 * 1024 * 1024;
 const MAX_CLI_OUTPUT_PATH_LENGTH = 4096;
 const pendingOutputFiles = new Map();
@@ -22,14 +23,26 @@ function safeOutputPath(value) {
     }
     return resolve(value);
 }
-function createBufferedOutput() {
+function createBufferedOutput(options = { binary: false }) {
     const chunks = [];
+    const binaryChunks = [];
     let bytes = 0;
+    const writeBinary = (chunk) => {
+        if (!options.binary || !(chunk instanceof Uint8Array))
+            throw new CliUsageError('Binary output requires an explicit package destination.');
+        if (chunk.byteLength > MAX_ENCRYPTED_INVESTIGATION_PACKAGE_BYTES - bytes)
+            throw new CliUsageError('Binary package output exceeds its byte limit.');
+        bytes += chunk.byteLength;
+        binaryChunks.push(new Uint8Array(chunk));
+    };
     return Object.freeze({
+        writeBinary,
         stream: {
             isTTY: false,
             columns: 80,
             write(chunk) {
+                if (options.binary)
+                    throw new CliUsageError('Binary package output cannot contain terminal text.');
                 const value = typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8');
                 bytes += Buffer.byteLength(value, 'utf8');
                 if (bytes > MAX_CLI_OUTPUT_BYTES) {
@@ -39,14 +52,26 @@ function createBufferedOutput() {
                 return true;
             },
         },
-        value: () => chunks.join(''),
+        value: () => {
+            if (!options.binary)
+                return chunks.join('');
+            const result = new Uint8Array(bytes);
+            let offset = 0;
+            for (const chunk of binaryChunks) {
+                result.set(chunk, offset);
+                offset += chunk.byteLength;
+            }
+            return result;
+        },
     });
 }
 async function writePrivateFile(pathValue, content, options = {}, operations = OUTPUT_FILE_OPERATIONS) {
     const target = safeOutputPath(pathValue);
-    if (Buffer.byteLength(content, 'utf8') > MAX_CLI_OUTPUT_BYTES) {
-        throw new CliUsageError(`Generated output is limited to ${MAX_CLI_OUTPUT_BYTES} bytes.`);
+    const maximumBytes = typeof content === 'string' ? MAX_CLI_OUTPUT_BYTES : MAX_ENCRYPTED_INVESTIGATION_PACKAGE_BYTES;
+    if ((typeof content === 'string' ? Buffer.byteLength(content, 'utf8') : content.byteLength) > maximumBytes) {
+        throw new CliUsageError(`Generated output is limited to ${maximumBytes} bytes.`);
     }
+    const captured = typeof content === 'string' ? content : new Uint8Array(content);
     const directory = dirname(target);
     const temporary = join(directory, `.${basename(target)}.${process.pid}.${operations.randomUUID()}.tmp`);
     let temporaryCreated = false;
@@ -59,12 +84,13 @@ async function writePrivateFile(pathValue, content, options = {}, operations = O
             settled: false,
         });
         try {
-            await handle.writeFile(content, { encoding: 'utf8' });
+            await handle.writeFile(captured, { encoding: 'utf8' });
             await handle.sync();
         }
         finally {
             await handle.close();
         }
+        await options.beforePublish?.();
         if (options.force) {
             await operations.rename(temporary, target);
             temporaryCreated = false;

package/cli/registry-doctor.mjs

@@ -189,7 +189,9 @@ function buildRegistryDoctorReport(raw, generatedAt = new Date().toISOString())
         ...sources.filter((source) => source.alignment === 'investigate').map((source) => (source.expected === 'allowed'
             ? `Review ${source.source.toUpperCase()} source health, transport attempts, and fixture coverage; the catalogue expected collection to be available.`
             : `Review the ${source.source.toUpperCase()} result and capability profile; the observed state did not match the declared access constraint.`)),
-        ...sources.filter((source) => source.alignment === 'unexpected_observation').map((source) => (`Review why ${source.source.toUpperCase()} produced normalized evidence despite the declared ${source.expected.replaceAll('_', ' ')} access profile.`)),
+        ...sources.filter((source) => source.alignment === 'unexpected_observation').map((source) => (source.source === 'rdap' && source.expected === 'unsupported'
+            ? 'Review whether the retained no-service RDAP profile needs refreshing; current bootstrap discovery may identify a newly published service.'
+            : `Review why ${source.source.toUpperCase()} produced normalized evidence despite the declared ${source.expected.replaceAll('_', ' ')} access profile.`)),
         ...sources.filter((source) => source.alignment === 'observed' && source.objectIdentifier === 'not_observed').map((source) => (`${source.source.toUpperCase()} succeeded without a retained registry object identifier; this can be a valid publication omission and should remain unknown rather than an error.`)),
     ].slice(0, 12);
     return {

package/cli/registry-support.mjs

@@ -1,7 +1,7 @@
 import { registryStandardsCoverageSnapshot, } from "../lib/registry-capabilities.mjs";
+import { REGISTRY_STANDARDS_COVERAGE_SCHEMA } from "../lib/registry-capability-catalogue.mjs";
 const REGISTRY_SUPPORT_SCHEMA = 'whoisleuth.cli.registry-support';
 const REGISTRY_SUPPORT_SCHEMA_VERSION = 4;
-const REGISTRY_STANDARDS_COVERAGE_SCHEMA = 'whoisleuth.registry-standards-coverage';
 const MAX_REGISTRY_SUPPORT_TEXT_LENGTH = 2048;
 const MAX_REGISTRY_SUPPORT_REFERENCES = 20;
 const MAX_REGISTRY_SUPPORT_REFERENCE_LENGTH = 2048;

package/cli/retained-artifact-diff.mjs

@@ -62,7 +62,7 @@ function parseBulkExport(root) {
         const rawSession = record(candidate);
         const rawResults = Array.isArray(rawSession?.results) ? rawSession.results : null;
         const rawDomains = Array.isArray(rawSession?.domains) ? rawSession.domains : null;
-        const session = normalizeBulkSession(candidate);
+        const session = normalizeBulkSession(candidate, version);
         if (!session || !rawResults || !rawDomains
             || rawResults.length > MAX_BULK_SESSION_ROWS
             || rawResults.length !== session.results.length
@@ -338,7 +338,7 @@ export function buildCliRetainedArtifactDiff(leftRaw, rightRaw, options = {}, ge
     if (left.schema === SAVED_LOOKUP_SCHEMA) {
         if (options.leftSessionId || options.rightSessionId)
             throw new CliUsageError('Saved-session selectors apply only to Bulk session exports.');
-        return buildCliLookupDiff(leftRaw, rightRaw, generatedAt);
+        return buildCliLookupDiff(leftRaw, rightRaw, generatedAt, { domainMode: 'auto' });
     }
     if (left.schema === BULK_SESSION_SCHEMA)
         return buildBulkLedger(leftRaw, rightRaw, left, right, options, generatedAt);

package/cli/review-command-runner.mjs

@@ -1,3 +1,10 @@
+import { readBoundedRegularFile } from "../lib/bounded-file.mjs";
+import { MAX_ENCRYPTED_INVESTIGATION_PACKAGE_BYTES } from "../packages/contracts/investigation-package-limits.mjs";
+import { verifyOfflineInvestigationFolder, verifyOfflineInvestigationPackage } from "./investigation-package-review.mjs";
+import { readInvestigationFolder } from "./investigation-folder.mjs";
+import { readBagItFolder } from "./bagit-folder.mjs";
+import { verifyOfflineBagIt } from "./bagit-review.mjs";
+import { MAX_BAGIT_ZIP_BYTES } from "../packages/interchange/bagit.mjs";
 import { MAX_OFFLINE_ARTIFACT_BYTES, formatOfflineArtifactVerification, isCompleteOfflineArtifactVerification, verifyOfflineArtifact, } from "./artifact-verify.mjs";
 import { MAX_CASE_PACK_INPUT_BYTES, buildCliCasePack, formatCliCasePack } from "./case-pack.mjs";
 import { MAX_COMPARE_INPUT_BYTES, compareLookupDocument, parseCliLookupDocument, } from "./compare.mjs";
@@ -5,6 +12,7 @@ import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 import { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, } from "./offline-evidence-review.mjs";
 import { buildCliLookupBrief, formatCliLookupBrief } from "./lookup-brief.mjs";
+import { runCaseCommand } from "./case-command.mjs";
 import { MAX_MAIL_REVIEW_INPUT_BYTES, buildCliMailReview, formatCliMailReview, } from "./mail-review.mjs";
 import { MAX_MAIL_HEADER_INPUT_BYTES, buildCliMailHeaderReview, formatCliMailHeaderReview, } from "./mail-header-review.mjs";
 import { buildCliPageComparison, formatCliPageComparison } from "./page-compare.mjs";
@@ -17,6 +25,42 @@ import { REVIEW_INLINE_COMMANDS } from "./inline-command-families.mjs";
 import { runDiscriminatedCommandHandler } from "./discriminated-command-handlers.mjs";
 async function runVerifyArtifactCommand(args, dependencies, context) {
     context.setFailureLabel('Artefact verification');
+    if (args.folder) {
+        let files;
+        try {
+            files = await (args.bagit ? readBagItFolder : readInvestigationFolder)(args.folder, dependencies.signal);
+        }
+        catch (cause) {
+            dependencies.signal?.throwIfAborted();
+            const reason = cause instanceof TypeError ? boundedCliErrorMessage(cause) : 'The selected folder is unavailable or could not be read.';
+            throw new CliUsageError(`Could not read evidence folder: ${reason}`);
+        }
+        const report = await (args.bagit ? verifyOfflineBagIt : verifyOfflineInvestigationFolder)(files);
+        dependencies.signal?.throwIfAborted();
+        if (!args.quiet)
+            context.writeStdout(args.output === 'json' ? formatJsonDocument(report) : context.terminal(formatOfflineArtifactVerification(report), args.color));
+        return args.strictExit && !isCompleteOfflineArtifactVerification(report) ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+    }
+    if (args.package) {
+        if (!args.source || args.source === '-')
+            throw new CliUsageError('--package requires a selected ZIP file; binary stdin is not accepted.');
+        let bytes;
+        try {
+            bytes = dependencies.readBinaryArtifactInput ? await dependencies.readBinaryArtifactInput(args.source)
+                : await readBoundedRegularFile(args.source, { maximumBytes: args.bagit ? MAX_BAGIT_ZIP_BYTES : MAX_ENCRYPTED_INVESTIGATION_PACKAGE_BYTES, minimumBytes: 22, label: 'Investigation package', ...(dependencies.signal ? { signal: dependencies.signal } : {}) });
+        }
+        catch (error) {
+            if (error instanceof CliUsageError)
+                throw error;
+            throw new CliUsageError(`Could not read package input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+        }
+        const passphrase = args.passphraseSource ? await context.readPassphraseSource(args.passphraseSource) : undefined;
+        const report = args.bagit ? await verifyOfflineBagIt(bytes) : await verifyOfflineInvestigationPackage(bytes, passphrase);
+        dependencies.signal?.throwIfAborted();
+        if (!args.quiet)
+            context.writeStdout(args.output === 'json' ? formatJsonDocument(report) : context.terminal(formatOfflineArtifactVerification(report), args.color));
+        return args.strictExit && !isCompleteOfflineArtifactVerification(report) ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+    }
     let input;
     try {
         input = dependencies.readArtifactInput
@@ -286,6 +330,7 @@ const REVIEW_COMMAND_HANDLERS = Object.freeze({
     'mail-headers': runMailHeadersCommand,
     'review-evidence': runOfflineEvidenceReviewCommand,
     'brief': runBriefOrCasePackCommand,
+    'case': runCaseCommand,
     'case-pack': runBriefOrCasePackCommand,
 });
 function runReviewCommand(args, dependencies, context) {