@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/cli/support-command-definitions.mjs

@@ -0,0 +1,209 @@
+import { RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_REPORT_SCHEMA } from "../packages/contracts/risk-calibration.mjs";
+import { positional, NO_POSITIONALS, OPTIONAL_FILE_POSITIONAL, constraint, EMPTY_CONSTRAINTS, commandSeed, text } from "./command-definition.mjs";
+export const SUPPORT_COMMAND_DEFINITIONS = Object.freeze({
+    completion: commandSeed({
+        reference: {
+            description: 'Print a static shell-completion script for the installed CLI.',
+            example: 'whoisleuth completion zsh > ~/.zfunc/_whoisleuth',
+            boundary: 'Generation is offline and writes only the script to stdout. The command never modifies shell configuration.',
+        },
+        collection: { scope: 'Prints one static script and changes no shell configuration.' },
+        summary: 'Print shell completion',
+        options: [],
+        positionals: Object.freeze([positional('shell', 'enum', 1, 1, ['bash', 'zsh', 'fish', 'powershell'])]),
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze([]),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    doctor: commandSeed({
+        reference: {
+            description: 'Check the supported runtime and local terminal capabilities.',
+            example: 'whoisleuth doctor --json',
+            boundary: 'The default check is offline. Public DNS and port 43 checks run only when --network is explicitly supplied.',
+        },
+        collection: { scope: 'Network access is opt-in with --network and is limited to fixed public DNS, HTTPS, and WHOIS diagnostics.' },
+        summary: 'Check the local CLI runtime',
+        options: ['--network', '--json', '--quiet', '--no-color'],
+        positionals: NO_POSITIONALS,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'conditional_network',
+        common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.doctor']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    commands: commandSeed({
+        reference: {
+            description: 'List the installed command contracts in terminal or versioned JSON form.',
+            example: 'whoisleuth commands --json',
+            boundary: 'Catalogue generation is offline. It reports declared command modes and limits without executing collection or inspecting local evidence.',
+        },
+        collection: { scope: 'Reads the embedded command catalogue and performs no collection.' },
+        summary: 'List installed command contracts',
+        options: ['--common', '--group', '--mode', '--json', '--quiet', '--no-color'],
+        positionals: NO_POSITIONALS,
+        constraints: Object.freeze([]),
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.command-catalogue']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    manual: commandSeed({
+        reference: {
+            description: 'Print a generated roff manual page for local installation.',
+            example: 'whoisleuth manual | man -l -',
+            boundary: 'Generation is offline and derives from the same command catalogue as focused help.',
+        },
+        collection: { scope: 'Builds documentation from the embedded command catalogue.' },
+        summary: 'Print the generated manual page',
+        options: [],
+        positionals: NO_POSITIONALS,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze([]),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "registry-support": commandSeed({
+        reference: {
+            description: 'Explain the local registry capability profile for one domain or suffix.',
+            example: 'whoisleuth registry-support example.test --json',
+            boundary: 'This command is offline. Catalogue coverage does not test live reachability or decide registration or availability.',
+        },
+        collection: { scope: 'Reads the embedded registry capability catalogue for one domain or suffix.' },
+        summary: 'Explain local registry coverage',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('domain-or-suffix', 'text', 0, 1, [], 'argv_or_stdin')]),
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.registry-support', 'whoisleuth.registry-standards-coverage']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "registry-doctor": commandSeed({
+        reference: {
+            description: 'Compare a saved Lookup registry result with the reviewed local capability profile.',
+            example: 'whoisleuth registry-doctor lookup.json --json',
+            boundary: 'The command is offline. It distinguishes expected access constraints from collection results and does not contact a live registry.',
+        },
+        collection: { scope: 'Reads one saved Lookup and the embedded registry capability catalogue.' },
+        summary: 'Diagnose saved registry collection',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.registry-doctor']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "registry-cohort": commandSeed({
+        reference: {
+            description: 'Build privacy-safe suffix and capability-profile timelines from saved observations or retained cohort reports.',
+            example: 'whoisleuth registry-cohort saved-lookups.jsonl --json',
+            boundary: 'This command is offline and omits domains, queries, and raw evidence. Input families cannot be mixed, and retained samples are never assumed independent.',
+        },
+        collection: { scope: 'Reads at most 500 saved Lookups or retained cohort reports from one unmixed family and emits bounded target-free timelines.' },
+        summary: 'Build target-free registry quality timelines',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.registry-cohort']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "registry-scaffold": commandSeed({
+        reference: {
+            description: 'Create a bounded synthetic WHOIS fixture scaffold for one existing capability profile.',
+            example: 'whoisleuth registry-scaffold --profile nic-io-colon --suffix ac --scenario registered',
+            boundary: 'The output is a sanitised template only. Its command-owned --profile selects fixture capability, --config is rejected, and contributors must not paste live responses or personal registration data into fixtures.',
+        },
+        collection: { scope: 'Reads the embedded registry capability catalogue and prints one synthetic fixture template.' },
+        summary: 'Create a sanitised registry fixture scaffold',
+        options: ['--profile', '--suffix', '--scenario'],
+        optionOverrides: { '--profile': text('Select a catalogue profile; find its ID with registry-support <suffix> --json.', true) },
+        positionals: NO_POSITIONALS,
+        constraints: Object.freeze([
+            constraint({ kind: 'required', options: ['--profile', '--suffix', '--scenario'] }),
+        ]),
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze([]),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'command_owned',
+    }),
+    "risk-calibrate": commandSeed({
+        reference: {
+            description: 'Replay reviewed labels against the current explainable Risk model.',
+            example: 'whoisleuth risk-calibrate calibration.json --summary-json',
+            boundary: 'Calibration is offline and diagnostic. The summary form omits record identifiers, domains, and evidence; neither form trains, tunes, or changes the scoring model automatically.',
+        },
+        collection: { scope: 'Reads one bounded reviewed-label dataset and changes no model or evidence.' },
+        summary: 'Replay reviewed Risk labels offline',
+        options: ['--json', '--summary-json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: Object.freeze([
+            constraint({ kind: 'mutually_exclusive', options: ['--json', '--summary-json'] }),
+        ]),
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze([RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_REPORT_SCHEMA]),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "lookalike-calibrate": commandSeed({
+        reference: {
+            description: 'Summarise reviewed candidate dispositions by mutation family without retaining domains.',
+            example: 'whoisleuth lookalike-calibrate reviewed-candidates.json --json',
+            boundary: 'Calibration is offline and diagnostic. It omits candidate identifiers, domains, notes, and evidence and never tunes generation or filtering automatically.',
+        },
+        collection: { scope: 'Reads at most 5,000 reviewed candidate labels from one dataset capped at 2 MiB.' },
+        summary: 'Summarise reviewed lookalike yield offline',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.lookalike-calibration-input', 'whoisleuth.lookalike-calibration']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+});

package/cli/support-command-runner.mjs

@@ -1,6 +1,6 @@
 import { REGISTRY_CAPABILITIES_VERSION, registryCapabilityFor } from "../lib/registry-capabilities.mjs";
-import { buildRiskCalibrationSummaryReport } from "../lib/risk-calibration-summary.mjs";
-import { explainRiskScore, explainRiskScoreV7, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../lib/risk-scoring.mjs";
+import { buildRiskCalibrationSummaryReport } from "../packages/analysis/risk-calibration-summary.mjs";
+import { explainRiskScore, explainRiskScoreV7, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../packages/analysis/risk-scoring.mjs";
 import { buildCliCommandCatalogue, formatCliCommandCatalogue, selectCliCommands } from "./command-catalogue.mjs";
 import { CLI_COMMAND_REGISTRY, CLI_COMMANDS, COMMAND_COLLECTION, COMMAND_DETAILS, COMMAND_USAGE, } from "./command-reference.mjs";
 import { buildShellCompletion } from "./completion.mjs";

package/cli/terminal-input.mjs

@@ -0,0 +1,168 @@
+import { StringDecoder } from 'node:string_decoder';
+import { CliUsageError, hasUnsafeCliText } from "./errors.mjs";
+export function canReadInteractiveLine(input, output, environment = process.env) {
+    return input?.isTTY === true && output?.isTTY === true
+        && typeof input.setRawMode === 'function' && typeof input.resume === 'function'
+        && typeof input.pause === 'function' && typeof input.on === 'function'
+        && typeof input.off === 'function' && typeof output.write === 'function'
+        && !environment.CI;
+}
+const MAX_INTERACTIVE_ANSWER_SCALARS = 1_024;
+const MAX_INTERACTIVE_ANSWER_BYTES = 4_096;
+function boundedInteractiveAnswer(value) {
+    const supplied = typeof value === 'string' ? value : '';
+    if (Buffer.byteLength(supplied, 'utf8') > MAX_INTERACTIVE_ANSWER_BYTES
+        || Array.from(supplied).length > MAX_INTERACTIVE_ANSWER_SCALARS
+        || hasUnsafeCliText(supplied)) {
+        throw new CliUsageError('Interactive input must be bounded text without control characters.');
+    }
+    return supplied.trim();
+}
+function abortError() {
+    return new DOMException('Aborted', 'AbortError');
+}
+function readBoundedInteractiveLine(prompt, options) {
+    const { input, output, signal } = options;
+    if (signal?.aborted)
+        return Promise.reject(signal.reason || abortError());
+    const previousRaw = input.isRaw === true;
+    const wasPaused = input.isPaused?.() === true;
+    let receivedBytes = 0;
+    let receivedScalars = 0;
+    let settled = false;
+    let characters = [];
+    const decoder = new StringDecoder('utf8');
+    return new Promise((resolve, reject) => {
+        const cleanup = () => {
+            let failure = null;
+            const attempt = (operation) => {
+                try {
+                    operation();
+                }
+                catch (error) {
+                    failure ||= error instanceof Error ? error : new Error('Interactive terminal cleanup failed.');
+                }
+            };
+            attempt(() => input.off?.('data', onData));
+            attempt(() => input.off?.('end', onEnd));
+            attempt(() => signal?.removeEventListener('abort', onAbort));
+            attempt(() => input.setRawMode?.(previousRaw));
+            if (wasPaused)
+                attempt(() => input.pause?.());
+            return failure;
+        };
+        const finish = (value, error) => {
+            if (settled)
+                return;
+            settled = true;
+            const cleanupFailure = cleanup();
+            characters = [];
+            if (error && cleanupFailure) {
+                reject(new AggregateError([error, cleanupFailure], `${error.message}; terminal cleanup also failed: ${cleanupFailure.message}`));
+            }
+            else if (error || cleanupFailure)
+                reject(error || cleanupFailure);
+            else
+                resolve(value || '');
+        };
+        const rejectUsage = () => finish(undefined, new CliUsageError('Interactive input must be bounded text without control characters.'));
+        const onData = (chunk) => {
+            if (settled)
+                return;
+            let rawChunk;
+            if (Buffer.isBuffer(chunk)) {
+                if (chunk.length > MAX_INTERACTIVE_ANSWER_BYTES - receivedBytes) {
+                    rejectUsage();
+                    return;
+                }
+                rawChunk = chunk;
+            }
+            else {
+                const supplied = String(chunk ?? '');
+                if (supplied.length > MAX_INTERACTIVE_ANSWER_BYTES - receivedBytes
+                    || Buffer.byteLength(supplied, 'utf8') > MAX_INTERACTIVE_ANSWER_BYTES - receivedBytes) {
+                    rejectUsage();
+                    return;
+                }
+                rawChunk = Buffer.from(supplied, 'utf8');
+            }
+            receivedBytes += rawChunk.length;
+            const value = decoder.write(rawChunk);
+            receivedScalars += Array.from(value).length;
+            if (receivedBytes > MAX_INTERACTIVE_ANSWER_BYTES
+                || receivedScalars > MAX_INTERACTIVE_ANSWER_SCALARS
+                || value.includes('\ufffd')) {
+                rejectUsage();
+                return;
+            }
+            for (const character of value) {
+                if (character === '\r' || character === '\n') {
+                    try {
+                        output.write('\n');
+                    }
+                    catch (error) {
+                        finish(undefined, error instanceof Error ? error : new Error('Interactive terminal output failed.'));
+                        return;
+                    }
+                    finish(characters.join(''));
+                    return;
+                }
+                if (character === '\u0003' || character === '\u0004' || character === '\u001b') {
+                    finish(undefined, abortError());
+                    return;
+                }
+                if (character === '\u0008' || character === '\u007f') {
+                    if (characters.length) {
+                        characters.pop();
+                        try {
+                            output.write('\b \b');
+                        }
+                        catch (error) {
+                            finish(undefined, error instanceof Error ? error : new Error('Interactive terminal output failed.'));
+                            return;
+                        }
+                    }
+                    continue;
+                }
+                if (hasUnsafeCliText(character)) {
+                    rejectUsage();
+                    return;
+                }
+                characters.push(character);
+                try {
+                    output.write(character);
+                }
+                catch (error) {
+                    finish(undefined, error instanceof Error ? error : new Error('Interactive terminal output failed.'));
+                    return;
+                }
+            }
+        };
+        const onEnd = () => {
+            const remainder = decoder.end();
+            if (remainder)
+                rejectUsage();
+            else
+                finish(undefined, abortError());
+        };
+        const onAbort = () => finish(undefined, signal?.reason instanceof Error ? signal.reason : abortError());
+        try {
+            output.write(prompt);
+            input.on?.('data', onData);
+            input.on?.('end', onEnd);
+            signal?.addEventListener('abort', onAbort, { once: true });
+            if (signal?.aborted) {
+                onAbort();
+                return;
+            }
+            input.setRawMode?.(true);
+            if (settled)
+                return;
+            input.resume?.();
+        }
+        catch (error) {
+            finish(undefined, error instanceof Error ? error : new Error('Interactive terminal input failed.'));
+        }
+    });
+}
+export { MAX_INTERACTIVE_ANSWER_BYTES, MAX_INTERACTIVE_ANSWER_SCALARS, boundedInteractiveAnswer, readBoundedInteractiveLine };

package/cli/workflow-arguments.mjs

@@ -0,0 +1,86 @@
+import {} from "./command-argument-grammar.mjs";
+import { CliUsageError } from "./errors.mjs";
+import {} from "./fail-policy.mjs";
+import { commandDefaultNumber } from "./command-reference.mjs";
+import { WORKFLOW_COMMAND_DEFINITIONS } from "./workflow-command-definitions.mjs";
+import { terminalOptions, jsonOutput, failPolicies, parseOutput, } from "./argument-values.mjs";
+function parseMonitorOnceArguments(parsed) {
+    const selectedFailPolicies = failPolicies(parsed, 'monitor-once');
+    return {
+        action: 'monitor-once',
+        source: parsed.positionalValue('source'),
+        previousSource: parsed.optionValue('--previous'),
+        output: parseOutput(parsed, WORKFLOW_COMMAND_DEFINITIONS['monitor-once']),
+        limit: parsed.integerOption('--limit') ?? commandDefaultNumber('monitor-once', '--limit'),
+        concurrency: parsed.integerOption('--concurrency') ??
+            commandDefaultNumber('monitor-once', '--concurrency'),
+        ...terminalOptions(parsed),
+        ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
+    };
+}
+function parseWorkflowPlanArguments(parsed) {
+    const options = { output: jsonOutput(parsed), ...terminalOptions(parsed) };
+    if (parsed.hasOption('--list')) {
+        if (parsed.allPositionals.length > 0)
+            throw new CliUsageError('workflow-plan discovery options do not accept a subject.');
+        return { action: 'workflow-plan', discovery: 'list', ...options };
+    }
+    if (parsed.hasOption('--explain')) {
+        if (parsed.allPositionals.length > 0)
+            throw new CliUsageError('workflow-plan discovery options do not accept a subject.');
+        return {
+            action: 'workflow-plan',
+            discovery: 'explain',
+            recipe: parsed.optionValue('--explain'),
+            ...options,
+        };
+    }
+    if (parsed.allPositionals.length !== 2) {
+        throw new CliUsageError('workflow-plan requires one fixed recipe and one subject, --list, or --explain <recipe>.');
+    }
+    return {
+        action: 'workflow-plan',
+        recipe: parsed.positionalValue('recipe'),
+        subject: parsed.positionalValue('subject'),
+        ...options,
+    };
+}
+function parseWorkflowRunArguments(parsed) {
+    const artifactBindings = parsed.optionValues('--use-artifact').map((value) => {
+        const match = /^([a-z0-9]+(?:-[a-z0-9]+)*):([1-9][0-9]?)=([a-z0-9]+(?:-[a-z0-9]+)*)$/u.exec(value);
+        if (!match)
+            throw new CliUsageError('--use-artifact requires <step-id>:<input-number>=<earlier-step-id>.');
+        return Object.freeze({ stepId: match[1], input: Number(match[2]), sourceStepId: match[3] });
+    });
+    const selections = parsed.optionValues('--select').map((value) => {
+        const separator = value.indexOf('=');
+        const stepId = separator === -1 ? '' : value.slice(0, separator);
+        const selection = separator === -1 ? '' : value.slice(separator + 1);
+        if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(stepId) || !selection.trim()) {
+            throw new CliUsageError('--select requires <step-id>=<path-or-value>.');
+        }
+        if (selection.startsWith('-')) {
+            throw new CliUsageError('--select values cannot start with a hyphen; prefix a file path with ./ when needed.');
+        }
+        return Object.freeze({ stepId, value: selection });
+    });
+    return {
+        action: 'workflow-run',
+        recipe: parsed.positionalValue('recipe'),
+        subject: parsed.positionalValue('subject'),
+        resumeSource: parsed.optionValue('--resume'),
+        selections: Object.freeze(selections),
+        artifactBindings: Object.freeze(artifactBindings),
+        confirmedReviews: Object.freeze(parsed.optionValues('--confirm-review')),
+        approveNetwork: parsed.hasOption('--approve-network'),
+        interactive: parsed.hasOption('--interactive'),
+        ...(parsed.hasOption('--preview') ? { preview: true } : {}),
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    };
+}
+export const WORKFLOW_ARGUMENT_PARSERS = Object.freeze({
+    'monitor-once': parseMonitorOnceArguments,
+    'workflow-plan': parseWorkflowPlanArguments,
+    'workflow-run': parseWorkflowRunArguments,
+});

package/cli/workflow-command-definitions.mjs

@@ -0,0 +1,78 @@
+import { INVESTIGATION_PLAN_RECIPES, RUNNABLE_INVESTIGATION_PLAN_RECIPES } from "./investigation-recipes.mjs";
+import { positional, OPTIONAL_FILE_POSITIONAL, constraint, commandSeed, integer, BASE_INTEGER_RANGE, file } from "./command-definition.mjs";
+export const WORKFLOW_COMMAND_DEFINITIONS = Object.freeze({
+    "monitor-once": commandSeed({
+        reference: {
+            description: 'Collect one bounded owned-domain review and compare it with an optional prior checkpoint.',
+            example: 'whoisleuth monitor-once manifest.json --previous previous.json --json --output next.json',
+            boundary: 'This is an operator-scheduled one-shot collection, not a daemon. It caps targets and concurrency, retains normalised observations, and never changes domain configuration.',
+        },
+        collection: { scope: 'Runs deep collection for at most 20 manifest domains with concurrency capped at 3.' },
+        summary: 'Run one bounded domain control review',
+        options: ['--previous', '--limit', '--concurrency', '--fail-on', '--json', '--junit', '--quiet', '--no-color'],
+        optionOverrides: {
+            '--concurrency': integer('Set the maximum number of concurrent collection tasks.', () => Object.freeze([BASE_INTEGER_RANGE(1, 3)]), () => 2),
+        },
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: Object.freeze([
+            constraint({ kind: 'mutually_exclusive', options: ['--json', '--junit'] }),
+        ]),
+        handlerOwner: 'workflow',
+        networkEffect: 'always_network',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.domain-control-monitor', 'whoisleuth.domain-control-flight-recorder.input']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "workflow-plan": commandSeed({
+        reference: {
+            description: 'Build a fixed domain-investigation plan from existing bounded CLI commands.',
+            example: 'whoisleuth workflow-plan domain-triage example.test --json',
+            boundary: 'Planning is offline and plan-only. It does not execute commands, expand placeholders, read files, make requests, or submit evidence.',
+        },
+        collection: { scope: 'Builds a fixed typed recipe and executes none of its network or file steps.' },
+        summary: 'Plan a fixed investigation recipe',
+        options: ['--list', '--explain', '--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([
+            positional('recipe', 'enum', 0, 1, INVESTIGATION_PLAN_RECIPES),
+            positional('subject', 'text', 0, 1),
+        ]),
+        constraints: Object.freeze([
+            constraint({ kind: 'mutually_exclusive', options: ['--list', '--explain'] }),
+        ]),
+        handlerOwner: 'workflow',
+        networkEffect: 'offline',
+        common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.investigation-plan', 'whoisleuth.cli.workflow-recipe-catalogue']),
+        primaryArtefacts: Object.freeze(['Plan-only workflow document']),
+        planSupport: true,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "workflow-run": commandSeed({
+        reference: {
+            description: 'Execute approved steps from a fixed investigation recipe and emit a resumable checkpoint.',
+            example: 'whoisleuth workflow-run domain-triage example.test --approve-network --json --output run.json',
+            boundary: '--preview validates the checkpoint and shows retained outputs, unresolved inputs and remaining approvals without executing or writing. It cannot be combined with approval, interactive, quiet or output-file flags. Only installed recipe commands can run. Network steps require explicit approval for each invocation. New runs connect compatible earlier outputs using the recipe defaults. Use --use-artifact <step-id>:<input-number>=<earlier-step-id> to override a connection; input numbers start at 1. Repeat --select for remaining placeholders in order, or supply every input for a step to replace its connections with files. Values stay literal and cannot start with a hyphen or invoke a shell. Optional --interactive prompts on terminal stderr for missing inputs; a blank answer pauses. It grants neither network approval nor human-review confirmation. A step declaring human review still requires --confirm-review <step-id> for that invocation. Checkpoints do not grant later approvals. Resumes preserve recorded connections. Content digests identify retained output, not authenticity or freshness. Partial collections pause for review and are not recollected on resume; failed validation or export steps remain retryable. Diagnostics go to stderr. File output holds exclusive adjacent locks and refuses concurrently changed state files.',
+        },
+        collection: { scope: 'Runs only fixed-recipe steps; network collection requires --approve-network and unresolved analyst selections pause.' },
+        summary: 'Execute approved fixed-recipe steps',
+        options: ['--select', '--use-artifact', '--confirm-review', '--approve-network', '--resume', '--interactive', '--preview', '--json', '--quiet', '--no-color'],
+        optionOverrides: { '--resume': file('Resume the selected workflow checkpoint; approvals must be supplied again.') },
+        positionals: Object.freeze([
+            positional('recipe', 'enum', 1, 1, RUNNABLE_INVESTIGATION_PLAN_RECIPES),
+            positional('subject', 'text', 1, 1),
+        ]),
+        constraints: Object.freeze([constraint({ kind: 'excludes_all', option: '--preview', excludedOptions: ['--approve-network', '--confirm-review', '--interactive', '--output', '--force', '--quiet'] })]),
+        handlerOwner: 'workflow',
+        networkEffect: 'conditional_network',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.investigation-run', 'whoisleuth.cli.investigation-preview']),
+        primaryArtefacts: Object.freeze(['Resumable workflow state', 'Offline resume preview']),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+});