@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/cli/output-file.mjs

@@ -3,6 +3,7 @@ import { unlinkSync } from 'node:fs';
 import { link, open, rename, unlink } from 'node:fs/promises';
 import { basename, dirname, join, resolve } from 'node:path';
 import { CliUsageError } from "./errors.mjs";
+import { MAX_ENCRYPTED_INVESTIGATION_PACKAGE_BYTES } from "../packages/contracts/investigation-package-limits.mjs";
 export const MAX_CLI_OUTPUT_BYTES = 32 * 1024 * 1024;
 const MAX_CLI_OUTPUT_PATH_LENGTH = 4096;
 const pendingOutputFiles = new Map();
@@ -22,14 +23,26 @@ function safeOutputPath(value) {
     }
     return resolve(value);
 }
-function createBufferedOutput() {
+function createBufferedOutput(options = { binary: false }) {
     const chunks = [];
+    const binaryChunks = [];
     let bytes = 0;
+    const writeBinary = (chunk) => {
+        if (!options.binary || !(chunk instanceof Uint8Array))
+            throw new CliUsageError('Binary output requires an explicit package destination.');
+        if (chunk.byteLength > MAX_ENCRYPTED_INVESTIGATION_PACKAGE_BYTES - bytes)
+            throw new CliUsageError('Binary package output exceeds its byte limit.');
+        bytes += chunk.byteLength;
+        binaryChunks.push(new Uint8Array(chunk));
+    };
     return Object.freeze({
+        writeBinary,
         stream: {
             isTTY: false,
             columns: 80,
             write(chunk) {
+                if (options.binary)
+                    throw new CliUsageError('Binary package output cannot contain terminal text.');
                 const value = typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8');
                 bytes += Buffer.byteLength(value, 'utf8');
                 if (bytes > MAX_CLI_OUTPUT_BYTES) {
@@ -39,14 +52,26 @@ function createBufferedOutput() {
                 return true;
             },
         },
-        value: () => chunks.join(''),
+        value: () => {
+            if (!options.binary)
+                return chunks.join('');
+            const result = new Uint8Array(bytes);
+            let offset = 0;
+            for (const chunk of binaryChunks) {
+                result.set(chunk, offset);
+                offset += chunk.byteLength;
+            }
+            return result;
+        },
     });
 }
 async function writePrivateFile(pathValue, content, options = {}, operations = OUTPUT_FILE_OPERATIONS) {
     const target = safeOutputPath(pathValue);
-    if (Buffer.byteLength(content, 'utf8') > MAX_CLI_OUTPUT_BYTES) {
-        throw new CliUsageError(`Generated output is limited to ${MAX_CLI_OUTPUT_BYTES} bytes.`);
+    const maximumBytes = typeof content === 'string' ? MAX_CLI_OUTPUT_BYTES : MAX_ENCRYPTED_INVESTIGATION_PACKAGE_BYTES;
+    if ((typeof content === 'string' ? Buffer.byteLength(content, 'utf8') : content.byteLength) > maximumBytes) {
+        throw new CliUsageError(`Generated output is limited to ${maximumBytes} bytes.`);
     }
+    const captured = typeof content === 'string' ? content : new Uint8Array(content);
     const directory = dirname(target);
     const temporary = join(directory, `.${basename(target)}.${process.pid}.${operations.randomUUID()}.tmp`);
     let temporaryCreated = false;
@@ -59,12 +84,13 @@ async function writePrivateFile(pathValue, content, options = {}, operations = O
             settled: false,
         });
         try {
-            await handle.writeFile(content, { encoding: 'utf8' });
+            await handle.writeFile(captured, { encoding: 'utf8' });
             await handle.sync();
         }
         finally {
             await handle.close();
         }
+        await options.beforePublish?.();
         if (options.force) {
             await operations.rename(temporary, target);
             temporaryCreated = false;

package/cli/posture.mjs

@@ -1,4 +1,4 @@
-import { CliUsageError } from "./arguments.mjs";
+import { CliUsageError } from "./errors.mjs";
 const MAX_POSTURE_SELECTORS = 10;
 function normalizePostureSelectors(raw, normalizeSelectors) {
     if (raw === null || raw === undefined || raw === '')

package/cli/registry-doctor.mjs

@@ -189,7 +189,9 @@ function buildRegistryDoctorReport(raw, generatedAt = new Date().toISOString())
         ...sources.filter((source) => source.alignment === 'investigate').map((source) => (source.expected === 'allowed'
             ? `Review ${source.source.toUpperCase()} source health, transport attempts, and fixture coverage; the catalogue expected collection to be available.`
             : `Review the ${source.source.toUpperCase()} result and capability profile; the observed state did not match the declared access constraint.`)),
-        ...sources.filter((source) => source.alignment === 'unexpected_observation').map((source) => (`Review why ${source.source.toUpperCase()} produced normalized evidence despite the declared ${source.expected.replaceAll('_', ' ')} access profile.`)),
+        ...sources.filter((source) => source.alignment === 'unexpected_observation').map((source) => (source.source === 'rdap' && source.expected === 'unsupported'
+            ? 'Review whether the retained no-service RDAP profile needs refreshing; current bootstrap discovery may identify a newly published service.'
+            : `Review why ${source.source.toUpperCase()} produced normalized evidence despite the declared ${source.expected.replaceAll('_', ' ')} access profile.`)),
         ...sources.filter((source) => source.alignment === 'observed' && source.objectIdentifier === 'not_observed').map((source) => (`${source.source.toUpperCase()} succeeded without a retained registry object identifier; this can be a valid publication omission and should remain unknown rather than an error.`)),
     ].slice(0, 12);
     return {

package/cli/registry-fixture-scaffold.mjs

@@ -14,7 +14,7 @@ export function buildRegistryFixtureScaffold(profileIdInput, suffixInput, scenar
         throw new TypeError('Scenario must be registered, not_found, or inconclusive.');
     const matchingProfiles = registryCompatibilityMatrix().filter((item) => item.id === profileId);
     if (!matchingProfiles.length)
-        throw new TypeError('The capability profile is not present in the registry catalogue.');
+        throw new TypeError('The capability profile is not present in the registry catalogue. Run registry-support <suffix> --json to find its profile ID.');
     const profile = matchingProfiles.find((item) => item.suffixes.includes(suffix));
     if (!profile)
         throw new TypeError(`The capability profile does not cover .${suffix}.`);

package/cli/registry-support.mjs

@@ -1,7 +1,7 @@
 import { registryStandardsCoverageSnapshot, } from "../lib/registry-capabilities.mjs";
+import { REGISTRY_STANDARDS_COVERAGE_SCHEMA } from "../lib/registry-capability-catalogue.mjs";
 const REGISTRY_SUPPORT_SCHEMA = 'whoisleuth.cli.registry-support';
 const REGISTRY_SUPPORT_SCHEMA_VERSION = 4;
-const REGISTRY_STANDARDS_COVERAGE_SCHEMA = 'whoisleuth.registry-standards-coverage';
 const MAX_REGISTRY_SUPPORT_TEXT_LENGTH = 2048;
 const MAX_REGISTRY_SUPPORT_REFERENCES = 20;
 const MAX_REGISTRY_SUPPORT_REFERENCE_LENGTH = 2048;

package/cli/retained-artifact-diff.mjs

@@ -9,6 +9,7 @@ import { parseBoundedJsonObject } from "./bounded-json.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { buildCliLookupDiff, formatCliLookupDiff } from "./lookup-diff.mjs";
 import { SAVED_LOOKUP_SCHEMA } from "./saved-lookup.mjs";
+import { safeTerminalValue } from "./formatters/terminal-shared.mjs";
 import { CLI_COMPARISON_LEDGER_SCHEMA, CLI_COMPARISON_LEDGER_VERSION, MAX_RETAINED_ARTIFACT_DIFF_BYTES, } from "../packages/contracts/offline-comparison.mjs";
 export { CLI_COMPARISON_LEDGER_SCHEMA, CLI_COMPARISON_LEDGER_VERSION, MAX_RETAINED_ARTIFACT_DIFF_BYTES };
 const BULK_ROOT_KEYS = new Set(['schema', 'version', 'generatedAt', 'sessions', 'limitations']);
@@ -62,7 +63,7 @@ function parseBulkExport(root) {
         const rawSession = record(candidate);
         const rawResults = Array.isArray(rawSession?.results) ? rawSession.results : null;
         const rawDomains = Array.isArray(rawSession?.domains) ? rawSession.domains : null;
-        const session = normalizeBulkSession(candidate);
+        const session = normalizeBulkSession(candidate, version);
         if (!session || !rawResults || !rawDomains
             || rawResults.length > MAX_BULK_SESSION_ROWS
             || rawResults.length !== session.results.length
@@ -338,7 +339,7 @@ export function buildCliRetainedArtifactDiff(leftRaw, rightRaw, options = {}, ge
     if (left.schema === SAVED_LOOKUP_SCHEMA) {
         if (options.leftSessionId || options.rightSessionId)
             throw new CliUsageError('Saved-session selectors apply only to Bulk session exports.');
-        return buildCliLookupDiff(leftRaw, rightRaw, generatedAt);
+        return buildCliLookupDiff(leftRaw, rightRaw, generatedAt, { domainMode: 'auto' });
     }
     if (left.schema === BULK_SESSION_SCHEMA)
         return buildBulkLedger(leftRaw, rightRaw, left, right, options, generatedAt);
@@ -354,22 +355,22 @@ export function formatCliRetainedArtifactDiff(document) {
         return formatCliLookupDiff(document);
     const lines = [
         'Retained artifact comparison ledger',
-        `Family           ${document.artifactFamily.replaceAll('_', ' ')}`,
-        `Left             ${document.left.label} · ${document.left.id}`,
-        `Right            ${document.right.label} · ${document.right.id}`,
+        `Family           ${safeTerminalValue(document.artifactFamily).replaceAll('_', ' ')}`,
+        `Left             ${safeTerminalValue(document.left.label)} · ${safeTerminalValue(document.left.id)}`,
+        `Right            ${safeTerminalValue(document.right.label)} · ${safeTerminalValue(document.right.id)}`,
         `Candidates       ${document.index.counts.retained}`,
         `Exact rows       ${document.details.rows.length} of ${document.details.totalRows}`,
         '',
     ];
     for (const row of document.details.rows) {
-        lines.push(`${row.entityId} · ${row.field} [${row.state.replaceAll('_', ' ')}]`);
-        lines.push(`  Earlier: ${row.earlier.value ?? 'not retained'} · ${row.earlier.sourceState}`);
-        lines.push(`  Later:   ${row.later.value ?? 'not retained'} · ${row.later.sourceState}`);
+        lines.push(`${safeTerminalValue(row.entityId)} · ${safeTerminalValue(row.field)} [${safeTerminalValue(row.state).replaceAll('_', ' ')}]`);
+        lines.push(`  Earlier: ${safeTerminalValue(row.earlier.value, 'not retained')} · ${safeTerminalValue(row.earlier.sourceState)}`);
+        lines.push(`  Later:   ${safeTerminalValue(row.later.value, 'not retained')} · ${safeTerminalValue(row.later.sourceState)}`);
     }
     if (document.details.omissions.detailRows)
         lines.push(`Omitted exact rows: ${document.details.omissions.detailRows}`);
     lines.push('', 'Limitations:');
     for (const limitation of document.limitations)
-        lines.push(`  - ${limitation}`);
+        lines.push(`  - ${safeTerminalValue(limitation)}`);
     return `${lines.join('\n')}\n`;
 }

package/cli/review-arguments.mjs

@@ -0,0 +1,131 @@
+import {} from "./command-argument-grammar.mjs";
+import { CliUsageError } from "./errors.mjs";
+import { CLI_CASE_OPERATIONS, CLI_INDICATOR_OPERATIONS } from "./command-reference.mjs";
+import { terminalOptions, jsonOutput, parseTwoFileComparisonArguments, singleInputAction, } from "./argument-values.mjs";
+function parseVerifyArtifactArguments(parsed) {
+    if (parsed.hasOption('--folder') && parsed.positionalValue('source'))
+        throw new CliUsageError('--folder selects its own input; do not also supply a file or stdin marker.');
+    return {
+        action: 'verify-artifact',
+        source: parsed.positionalValue('source'),
+        passphraseSource: parsed.optionValue('--passphrase-file'),
+        manifestSource: parsed.optionValue('--manifest'),
+        manifestEntryId: parsed.optionValue('--manifest-entry'),
+        ...(parsed.hasOption('--package') ? { package: true } : {}),
+        ...(parsed.hasOption('--bagit') ? { bagit: true } : {}),
+        ...(parsed.optionValue('--folder') ? { folder: parsed.optionValue('--folder') } : {}),
+        output: jsonOutput(parsed),
+        strictExit: parsed.hasOption('--strict-exit'),
+        ...terminalOptions(parsed),
+    };
+}
+function parseCaseArguments(parsed) {
+    const operation = parsed.positionalValue('operation');
+    const source = parsed.positionalValue('source');
+    const domain = parsed.optionValue('--domain');
+    const caseId = parsed.optionValue('--case-id');
+    const title = parsed.optionValue('--title');
+    const newIncident = parsed.hasOption('--new-incident');
+    const text = parsed.optionValue('--text');
+    const noteSource = parsed.optionValue('--note-file');
+    const inputSource = parsed.optionValue('--input');
+    const expectedFileDigest = parsed.optionValue('--expect-file-digest');
+    if (source === '-' || inputSource === '-' || noteSource === '-')
+        throw new CliUsageError('Case operations require selected files, not stdin.');
+    if (operation !== 'open' && !source)
+        throw new CliUsageError(`${operation} requires a Case file.`);
+    if (operation !== 'show' && !parsed.hasOption('--output'))
+        throw new CliUsageError('Case mutations require --output; nothing was changed.');
+    if (operation === 'open' && !domain)
+        throw new CliUsageError('case open requires --domain.');
+    if (operation !== 'open' && (title || newIncident))
+        throw new CliUsageError('--title and --new-incident belong to case open.');
+    if (newIncident && (!title || caseId))
+        throw new CliUsageError('--new-incident requires a distinguishing --title and cannot select an existing --case-id.');
+    if (operation === 'note' ? text === null && !noteSource : text !== null || noteSource !== null) {
+        throw new CliUsageError('Only case note accepts and requires --text or --note-file.');
+    }
+    if (['pin', 'link', 'withdraw-link', 'assess', 'recheck'].includes(operation)
+        ? !inputSource
+        : inputSource !== null) {
+        throw new CliUsageError('Only case pin, link, withdraw-link, assess and recheck accept and require --input.');
+    }
+    if (expectedFileDigest !== null && (!source || !/^sha256:[a-f0-9]{64}$/u.test(expectedFileDigest))) {
+        throw new CliUsageError('--expect-file-digest requires a source file and sha256:<64 lowercase hexadecimal characters>.');
+    }
+    return {
+        action: 'case',
+        operation,
+        source,
+        caseId,
+        domain,
+        title,
+        newIncident,
+        text,
+        noteSource,
+        inputSource,
+        expectedFileDigest,
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    };
+}
+export const REVIEW_ARGUMENT_PARSERS = Object.freeze({
+    'verify-artifact': parseVerifyArtifactArguments,
+    'interchange-report': (parsed) => ({
+        action: 'interchange-report',
+        source: parsed.positionalValue('source'),
+        passphraseSource: parsed.optionValue('--passphrase-file'),
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    }),
+    'source-report': (parsed) => singleInputAction('source-report', parsed),
+    compare: (parsed) => singleInputAction('compare', parsed),
+    'page-compare': (parsed) => ({
+        action: 'page-compare',
+        ...parseTwoFileComparisonArguments(parsed, 'page-compare'),
+    }),
+    'mail-review': (parsed) => singleInputAction('mail-review', parsed),
+    'mail-headers': (parsed) => ({
+        ...singleInputAction('mail-headers', parsed),
+        ...(parsed.hasOption('--trusted-auth-header')
+            ? { trustedAuthHeaders: parsed.optionValues('--trusted-auth-header') }
+            : {}),
+    }),
+    intake: (parsed) => ({
+        action: 'intake',
+        kind: parsed.positionalValue('kind'),
+        reportedActions: parsed.optionValues('--reported-action'),
+        ...(parsed.hasOption('--trusted-auth-header')
+            ? { trustedAuthHeaders: parsed.optionValues('--trusted-auth-header') }
+            : {}),
+        source: parsed.positionalValue('source'),
+        output: jsonOutput(parsed),
+        strictExit: parsed.hasOption('--strict-exit'),
+        ...terminalOptions(parsed),
+    }),
+    'review-evidence': (parsed) => ({
+        action: 'review-evidence',
+        source: parsed.positionalValue('source'),
+        mmdbSource: parsed.optionValue('--mmdb'),
+        output: jsonOutput(parsed),
+        strictExit: parsed.hasOption('--strict-exit'),
+        ...terminalOptions(parsed),
+    }),
+    brief: (parsed) => singleInputAction('brief', parsed),
+    case: parseCaseArguments,
+    'indicator-set': (parsed) => ({
+        action: 'indicator-set',
+        operation: parsed.positionalValue('operation'),
+        source: parsed.positionalValue('source'),
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    }),
+    'case-pack': (parsed) => ({
+        action: 'case-pack',
+        source: parsed.positionalValue('source'),
+        output: jsonOutput(parsed),
+        audience: parsed.optionValue('--audience'),
+        reviewed: true,
+        ...terminalOptions(parsed),
+    }),
+});

package/cli/review-command-definitions.mjs

@@ -0,0 +1,273 @@
+import { CASE_SCHEMA_VERSION, CLI_CASE_PACK_INPUT_CASE_VERSIONS, MAX_CASE_STORE_BYTES, MAX_EDITABLE_CASE_INPUT_BYTES } from "../packages/contracts/case-portability.mjs";
+import { MESSAGE_INTAKE_KINDS, MESSAGE_INTAKE_SCHEMA } from "../packages/contracts/message-intake.mjs";
+import { IDENTITY_EVENTS_INPUT_SCHEMA } from "../packages/contracts/identity-events.mjs";
+import { CONTEXT_INPUT_SCHEMAS, CONTEXT_REVIEW_SCHEMA } from "../packages/contracts/context-review.mjs";
+import { MANAGED_INDICATOR_SET_SCHEMA, MAX_MANAGED_INDICATOR_SET_BYTES, MAX_MANAGED_INDICATOR_PLAN_BYTES } from "../packages/contracts/analyst-interchange.mjs";
+import { CLI_CASE_OPERATIONS, CLI_INDICATOR_OPERATIONS, positional, OPTIONAL_FILE_POSITIONAL, constraint, EMPTY_CONSTRAINTS, commandSeed } from "./command-definition.mjs";
+export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
+    "verify-artifact": commandSeed({
+        reference: {
+            description: 'Validate a supported archive, ordinary Case export, claim passport, packet, manifest, saved Lookup or Lookup-evidence export without printing evidence contents. Use --package for an evidence ZIP or encrypted package, with --passphrase-file to unlock it; use --folder ./evidence for an unencrypted evidence folder. Add --bagit with --package or --folder to verify BagIt 1.0.',
+            example: 'whoisleuth verify-artifact report.json --manifest manifest.json --manifest-entry artifact-2 --json --strict-exit',
+            boundary: 'Verification is offline and redacted. ZIP and folder entries are reported separately without importing them. Case exports are checked without repairing content; ordinary package review also counts original references with matching bytes. Ordinary folders allow only the declared layout; BagIt allows bounded nested payloads and checks SHA-256/SHA-512 manifests without interpreting payloads. Symbolic links are refused. BagIt fetch.txt is never fetched; missing files, mismatches and unsupported algorithms remain explicit. Package digests describe bytes, not filesystem metadata or authenticity. In scripts, use --strict-exit: incomplete verification returns 4. Unencrypted workspace archives always return 4 under --strict-exit because section digests do not cover mutable root metadata; structure-only formats can pass their narrower contract. Default exit 0 means the report was produced, not that its checks passed.',
+        },
+        collection: { scope: 'Reads one selected bounded artefact, ZIP or explicit evidence folder and, when explicitly supplied, one manifest whose selected entry is compared by exact bytes and canonical identity.' },
+        summary: 'Validate saved evidence offline',
+        options: ['--passphrase-file', '--manifest', '--manifest-entry', '--package', '--bagit', '--folder', '--json', '--strict-exit', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('source', 'file', 0, 1, [], 'argv_or_stdin', ['--package'])]),
+        constraints: Object.freeze([
+            constraint({ kind: 'requires_any', option: '--bagit', requiredOptions: ['--package', '--folder'] }),
+            constraint({ kind: 'excludes_all', option: '--bagit', excludedOptions: ['--passphrase-file', '--manifest', '--manifest-entry'] }),
+            constraint({ kind: 'requires_all', option: '--manifest', requiredOptions: ['--manifest-entry'] }),
+            constraint({ kind: 'requires_all', option: '--manifest-entry', requiredOptions: ['--manifest'] }),
+            constraint({ kind: 'excludes_all', option: '--package', excludedOptions: ['--manifest', '--manifest-entry'] }),
+            constraint({ kind: 'excludes_all', option: '--folder', excludedOptions: ['--package', '--manifest', '--manifest-entry', '--passphrase-file'] }),
+        ]),
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.offline-artifact-verification']),
+        primaryArtefacts: Object.freeze(['Offline verification report']),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "interchange-report": commandSeed({
+        reference: {
+            description: 'Report what one recognised portable artefact preserves, excludes, and supports across browser and CLI workflows.',
+            example: 'whoisleuth interchange-report workspace.json --json',
+            boundary: 'The report is offline and metadata-only. It does not echo targets, contacts, notes, passphrases, evidence values, or an unrecognised schema string.',
+        },
+        collection: { scope: 'Reads one selected bounded portable artefact and emits fixed compatibility metadata only.' },
+        summary: 'Report portable artefact fidelity offline',
+        options: ['--passphrase-file', '--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.interchange-fidelity-report']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "source-report": commandSeed({
+        reference: {
+            description: 'Create a target-free reliability summary from a saved lookup.',
+            example: 'whoisleuth source-report lookup.json --json',
+            boundary: 'The report retains source states and timings but excludes targets, queries, endpoints, and raw evidence.',
+        },
+        collection: { scope: 'Reads bounded saved evidence and emits target-free source reliability data.' },
+        summary: 'Build a target-free source report',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.source-reliability-report']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    compare: commandSeed({
+        reference: {
+            description: 'Compare separately attributed registry publications in a saved lookup.',
+            example: 'whoisleuth compare lookup.json --json',
+            boundary: 'Comparison is offline. Differences are review context and do not by themselves prove which publication is current.',
+        },
+        collection: { scope: 'Reads one saved Lookup and compares its separately attributed registry publications.' },
+        summary: 'Compare registry publications in one lookup',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.compare']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "page-compare": commandSeed({
+        reference: {
+            description: 'Compare static page identity, favicon, technology, and TLS evidence in two saved deep lookups.',
+            example: 'whoisleuth page-compare official.json candidate.json --json',
+            boundary: 'Comparison is offline and component-based. It executes no page code and produces no aggregate similarity or maliciousness score.',
+        },
+        collection: { scope: 'Reads two saved Lookup documents and executes no page code.' },
+        summary: 'Compare saved static page evidence',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('sources', 'file', 2, 2)]),
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.page-compare']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "mail-review": commandSeed({
+        reference: {
+            description: 'Review passive MX, null MX, SPF, DMARC, and shared mail-provider evidence from saved Bulk results.',
+            example: 'whoisleuth mail-review candidates.json --json',
+            boundary: 'Review is offline and sends no SMTP traffic. Missing or partial DNS evidence remains inconclusive.',
+        },
+        collection: { scope: 'Reads one saved Bulk result and sends no DNS or SMTP traffic.' },
+        summary: 'Review saved passive mail evidence',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.mail-review']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "mail-headers": commandSeed({
+        reference: {
+            description: 'Review identity, reported authentication, domain alignment, and Received routing from selected message headers.',
+            example: 'whoisleuth mail-headers message.eml --json',
+            boundary: 'Review is offline. It makes no DNS, SMTP, HTTP, registry, or provider request, and does not retain address local parts, display names, subjects, message bodies, attachments, or raw header values. Reported authentication is not independently validated.',
+        },
+        collection: { scope: 'Parses only the bounded header block from one selected message or standard input.' },
+        summary: 'Review message headers offline',
+        options: ['--trusted-auth-header', '--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.mail-header-review']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    intake: commandSeed({
+        reference: {
+            description: 'Review message identities, document links, QR destinations, HTTP archives or selected identity events locally.',
+            example: 'whoisleuth intake email message.eml --json',
+            boundary: 'Offline only: no destination, embedded command or QR payload is opened or executed. Output omits original bodies, subjects, address local parts, URL paths, queries and fragments. Authentication headers remain attributed claims. Selected PDF and DOCX review retains part identities and extraction coverage; embedded raster QR support does not imply complete rendered-page review. HAR retains minimised request order and timings, never replay authority, headers, cookies or bodies. Use --strict-exit to return 4 for partial coverage.',
+        },
+        collection: { scope: 'Reads one selected text, MIME email, calendar, PNG, PDF, DOCX, HAR or identity-event JSON file. No collection or automatic Case write.' },
+        summary: 'Review selected files and identity events offline',
+        options: ['--json', '--reported-action', '--trusted-auth-header', '--strict-exit', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('kind', 'enum', 1, 1, MESSAGE_INTAKE_KINDS), positional('source', 'file', 0, 1, [], 'argv_or_stdin')]),
+        constraints: EMPTY_CONSTRAINTS, handlerOwner: 'review', networkEffect: 'offline', common: true,
+        schemaIdentifiers: Object.freeze([MESSAGE_INTAKE_SCHEMA, IDENTITY_EVENTS_INPUT_SCHEMA]), primaryArtefacts: Object.freeze([]),
+        planSupport: false, additionalOutputFormats: Object.freeze([]), bootstrapProfile: 'allowed',
+    }),
+    "review-evidence": commandSeed({
+        reference: {
+            description: 'Review versioned protocol evidence, incident sequences, domain history, platform objects, storefronts or connector configuration offline.',
+            example: 'whoisleuth review-evidence domain-change.json --json --strict-exit',
+            boundary: 'The command reads only the supplied document and, with --mmdb, one explicitly selected local database up to 512 MiB. MMDB parsing and lookup run in one disposable worker with a ten-second processing deadline and an 8 KiB result limit. Version-2 MMDB queries require a justified age policy; unavailable or partial current reviews return 4 under --strict-exit. Historical version-1 MMDB queries preserve their output without freshness admission. No database is bundled, downloaded, updated or transmitted. It performs no DNS, RDAP, BGP, GeoIP-provider, TLS, HTTP, certificate-authority, or SMTP request.',
+        },
+        collection: { scope: 'Reads one bounded versioned evidence or request-planning document and, only with --mmdb, one selected bounded local database. Performs no collection.' },
+        summary: 'Review supplied evidence offline',
+        options: ['--mmdb', '--json', '--strict-exit', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: true,
+        schemaIdentifiers: Object.freeze([
+            CONTEXT_REVIEW_SCHEMA,
+            ...CONTEXT_INPUT_SCHEMAS,
+            'whoisleuth.cli.offline-evidence-review',
+            'whoisleuth.rdap-search-input',
+            'whoisleuth.dnssec-evidence-input',
+            'whoisleuth.tlsa-evidence-input',
+            'whoisleuth.rpki-route-input',
+            'whoisleuth.local-geoip-query',
+            'whoisleuth.local-mmdb-query',
+            'whoisleuth.local-mmdb-review',
+            'whoisleuth.encrypted-dns-plan-input',
+        ]),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    brief: commandSeed({
+        reference: {
+            description: 'Turn one saved Lookup into a compact decision brief with facts, unknowns, contradictions, and next actions.',
+            example: 'whoisleuth brief lookup.json --json',
+            boundary: 'The command is offline, excludes raw upstream payloads, and does not create an analyst assertion or claim that the saved observation is current.',
+        },
+        collection: { scope: 'Reads one bounded saved Lookup and emits a compact source-attributed decision brief.' },
+        summary: 'Build a decision brief from a saved lookup',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.lookup-brief']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    case: commandSeed({
+        reference: {
+            description: 'Show or open a local Case, append a note or evidence pin, link evidence, withdraw a link, record an assessment, or retain an offline recheck. Use --input for pin, link, withdraw-link, assessment and recheck JSON; --text or --note-file for a note. Link input contains fromPinId, toPinId, kind (derived_from or shared_source), and basis. Withdrawal input contains id and reason. Mutations require --output and always write the complete current Case export.',
+            example: 'whoisleuth case open --domain example.test --output cases.json\n  whoisleuth case show cases.json\n  whoisleuth case note cases.json --text "Review the retained observation" --output cases.json --force',
+            boundary: 'No database, browser launch, request or external report is created. Select --case-id when a file contains multiple Cases. Existing files require --force; --expect-file-digest sha256:<digest> additionally checks the exact file reviewed earlier. Source and output leases reject concurrent changes. Interrupted .workflow.lock files require deliberate inspection. Recheck records supplied observations; it does not collect them. Not reproduced requires an existing saved question, a complete observation and comparable conditions. Working exports include private analyst content and file references, not attached file bytes.',
+        },
+        collection: { scope: `Reads exact Case schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')}. Input is bounded to ${MAX_EDITABLE_CASE_INPUT_BYTES / 1024 / 1024} MiB including formatting; the complete canonical Case store must fit ${MAX_CASE_STORE_BYTES / 1024 / 1024} MiB without pruning. Writes current schema ${CASE_SCHEMA_VERSION}.` },
+        summary: 'Review and update ordinary local Case files',
+        options: ['--case-id', '--domain', '--title', '--new-incident', '--text', '--note-file', '--input', '--expect-file-digest', '--json', '--no-color'],
+        positionals: Object.freeze([positional('operation', 'enum', 1, 1, CLI_CASE_OPERATIONS), positional('source', 'file', 0, 1)]),
+        constraints: Object.freeze([constraint({ kind: 'mutually_exclusive', options: ['--text', '--note-file'] })]),
+        handlerOwner: 'review', networkEffect: 'offline', common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.case-export']),
+        primaryArtefacts: Object.freeze(['Case export']), planSupport: false,
+        additionalOutputFormats: Object.freeze([]), bootstrapProfile: 'allowed',
+    }),
+    'indicator-set': commandSeed({
+        reference: {
+            description: 'Create or revise a file-based indicator set, inspect its identities and review windows, or export the exact revision as STIX or MISP JSON. Revise takes a plan containing basis, name, expiresAt, reviewed rows and selectedDomains; later plans embed previous and explicitly select renewIds, withdrawIds or reintroduceDomains. Use --json with revise to retain the manifest. STIX and MISP operations always output JSON.',
+            example: 'whoisleuth indicator-set revise indicator-plan.json --json --output indicators.json\n  whoisleuth indicator-set inspect indicators.json\n  whoisleuth indicator-set stix indicators.json --output indicators.stix.json',
+            boundary: 'Offline files only; no submission, feed synchronisation or automatic deletion. Missing candidates are unchanged. Renewal changes the review window, not the original observation. Withdrawn identities stay withdrawn; reintroduction requires a new identity. Keep prior manifests: a digest verifies content, not authorship or the complete revision chain. MISP expiry is a review deadline, not automatic enforcement.',
+        },
+        collection: { scope: `Reads a selected ${MAX_MANAGED_INDICATOR_PLAN_BYTES / 1024 / 1024} MiB revision plan or ${MAX_MANAGED_INDICATOR_SET_BYTES / 1024 / 1024} MiB manifest. Makes no requests and does not alter the source file.` },
+        summary: 'Manage reviewed indicator revisions offline',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('operation', 'enum', 1, 1, CLI_INDICATOR_OPERATIONS), positional('source', 'file', 0, 1)]),
+        constraints: EMPTY_CONSTRAINTS, handlerOwner: 'review', networkEffect: 'offline', common: false,
+        schemaIdentifiers: Object.freeze([MANAGED_INDICATOR_SET_SCHEMA]), primaryArtefacts: Object.freeze(['Managed indicator revision']),
+        planSupport: false, additionalOutputFormats: Object.freeze([]), bootstrapProfile: 'allowed',
+    }),
+    "case-pack": commandSeed({
+        reference: {
+            description: `Package browser-created Case records from schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')} as a reviewed, audience-specific Case-pack v2 with current schema ${CASE_SCHEMA_VERSION}.`,
+            example: 'whoisleuth case-pack cases.json --audience trusted --reviewed --json',
+            boundary: 'The command creates a separate offline package without changing the source or durable Cases and requires an explicit review acknowledgement. Every audience, including public, retains domain evidence, Case, pin and decision identifiers, tags, decision summaries and rationale. Review that analyst-authored content as well as the exclusions before sharing.',
+        },
+        collection: { scope: `Reads one bounded Case export from schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')} and writes a separate audience-specific Case-pack v2.` },
+        summary: 'Build a reviewed case package',
+        options: ['--audience', '--reviewed', '--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: Object.freeze([
+            constraint({ kind: 'required', options: ['--audience', '--reviewed'] }),
+        ]),
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.case-pack', 'whoisleuth.case-report']),
+        primaryArtefacts: Object.freeze(['Reviewed Case-pack v2']),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+});