@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/cli/risk-calibration.mjs

@@ -1,14 +1,14 @@
 import { Buffer } from 'node:buffer';
 import { decodeBoundedUtf8 } from "../lib/bounded-file.mjs";
-import { isValidAsciiDomainName } from "../lib/hostname.mjs";
-import { scanBoundedJson } from "../lib/bounded-json.mjs";
-import { canonicalRegistrableDomain } from "../lib/registrable-domain.mjs";
-import { ANALYST_REVIEW_REASON_VALUES, analystInteroperabilityTags } from "../lib/analyst-taxonomy.mjs";
-import { buildRiskCalibrationSummaryReport, parseRiskCalibrationSummaryReport, RISK_CALIBRATION_SUMMARY_INTERPRETATION, RISK_CALIBRATION_SUMMARY_THRESHOLDS, } from "../lib/risk-calibration-summary.mjs";
+import { isValidAsciiDomainName } from "../packages/contracts/domain-name.mjs";
+import { scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
+import { canonicalRegistrableDomain } from "../packages/analysis/registrable-domain.mjs";
+import { ANALYST_REVIEW_REASON_VALUES, analystInteroperabilityTags } from "../packages/analysis/analyst-taxonomy.mjs";
+import { buildRiskCalibrationSummaryReport, parseRiskCalibrationSummaryReport, RISK_CALIBRATION_SUMMARY_INTERPRETATION, RISK_CALIBRATION_SUMMARY_THRESHOLDS, } from "../packages/analysis/risk-calibration-summary.mjs";
 import { MAX_RISK_CALIBRATION_ACTIVITY_LENGTH, MAX_RISK_CALIBRATION_AVAILABILITY_LENGTH, MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, MAX_RISK_CALIBRATION_DOMAIN_AGE_DAYS, MAX_RISK_CALIBRATION_DOMAIN_LENGTH, MAX_RISK_CALIBRATION_FINDING_CATEGORY_LENGTH, MAX_RISK_CALIBRATION_FINDINGS_PER_PROVIDER, MAX_RISK_CALIBRATION_INPUT_BYTES, MAX_RISK_CALIBRATION_JSON_CONTAINER_ITEMS, MAX_RISK_CALIBRATION_JSON_DEPTH, MAX_RISK_CALIBRATION_JSON_KEYS, MAX_RISK_CALIBRATION_JSON_VALUES, MAX_RISK_CALIBRATION_MUTATIONS, MAX_RISK_CALIBRATION_PROVIDER_ID_LENGTH, MAX_RISK_CALIBRATION_PROVIDER_STATE_LENGTH, MAX_RISK_CALIBRATION_PROVIDERS, MAX_RISK_CALIBRATION_RECORD_ID_LENGTH, MAX_RISK_CALIBRATION_RECORDS, MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH, MAX_RISK_CALIBRATION_SCAN_DEPTH_LENGTH, MAX_RISK_CALIBRATION_STRING_LENGTH, MAX_RISK_CALIBRATION_TIMESTAMP_LENGTH, RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_DATASET_VERSION, RISK_CALIBRATION_REPORT_SCHEMA, RISK_CALIBRATION_REPORT_VERSION, RISK_CALIBRATION_DISPOSITIONS, serializeRiskCalibrationSnapshot, snapshotRiskCalibrationReportForSerialization, SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS, } from "../packages/contracts/risk-calibration.mjs";
-import { CliUsageError } from "./arguments.mjs";
-import { RISK_MUTATION_TYPES } from "../lib/risk-scoring.mjs";
-import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_SCHEMA, } from "../lib/threat-intelligence-types.mjs";
+import { CliUsageError } from "./errors.mjs";
+import { RISK_MUTATION_TYPES } from "../packages/analysis/risk-scoring.mjs";
+import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_SCHEMA, } from "../packages/analysis/threat-intelligence-types.mjs";
 export { MAX_RISK_CALIBRATION_INPUT_BYTES, MAX_RISK_CALIBRATION_RECORDS, MAX_RISK_CALIBRATION_STRING_LENGTH, RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_DATASET_VERSION, RISK_CALIBRATION_REPORT_SCHEMA, RISK_CALIBRATION_REPORT_VERSION, SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS, } from "../packages/contracts/risk-calibration.mjs";
 export const RISK_CALIBRATION_THRESHOLDS = RISK_CALIBRATION_SUMMARY_THRESHOLDS;
 const CONTROL_RE = /[\x00-\x1f\x7f]/;

package/cli/runner.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from 'node:module';
 import { abortable } from "../lib/abort.mjs";
-import { parseCliArguments } from "./arguments.mjs";
+import { isCliCommandForOwner, parseCliArguments } from "./arguments.mjs";
 import { HELP, commandDefinition, commandHelp, } from "./command-reference.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import { evidenceCommandFailureLabel, isEvidenceCommand, runEvidenceCommand, } from "./evidence-command-runner.mjs";
@@ -9,7 +9,7 @@ import { readCliHeaderInput, readCliTextInput } from "./input.mjs";
 import { INLINE_CLI_COMMANDS, runInlineCommand } from "./inline-command-runner.mjs";
 import { canLaunchInteractiveCli, launchInteractiveCli, } from "./interactive-launcher.mjs";
 import { MAX_OFFLINE_PASSPHRASE_FILE_BYTES, } from "./artifact-verify.mjs";
-import { cleanupPendingOutputFiles, createBufferedOutput, writePrivateFile } from "./output-file.mjs";
+import { cleanupPendingOutputFiles, createBufferedOutput, writePrivateFile, MAX_CLI_OUTPUT_BYTES } from "./output-file.mjs";
 import { createTerminalProgress } from "./progress.mjs";
 import { presentTerminalOutput, terminalPresentation, } from "./terminal-presentation.mjs";
 const require = createRequire(import.meta.url);
@@ -40,16 +40,6 @@ function isCancellation(error, signal) {
     return signal?.aborted === true
         || Boolean(error && typeof error === 'object' && 'name' in error && error.name === 'AbortError');
 }
-function usageEventReason(error) {
-    const message = boundedCliErrorMessage(error, 'Invalid command input').toLowerCase();
-    if (message.includes('could not read'))
-        return 'input_unavailable';
-    if (message.includes('cannot be combined') || message.includes('mutually exclusive'))
-        return 'conflicting_options';
-    if (message.includes('requires') || message.includes('did not contain'))
-        return 'missing_input';
-    return 'invalid_input';
-}
 async function runParsedCli(args, dependencies = {}, writeBinaryOutput) {
     const stdout = dependencies.stdout || process.stdout;
     const stderr = dependencies.stderr || process.stderr;
@@ -113,7 +103,7 @@ async function runParsedCli(args, dependencies = {}, writeBinaryOutput) {
             catch (error) {
                 if (error instanceof CliUsageError)
                     throw error;
-                throw new CliUsageError(`Could not read passphrase file: ${boundedCliErrorMessage(error, 'File could not be read')}`);
+                throw new CliUsageError(`Could not read passphrase file: ${boundedCliErrorMessage(error, 'File could not be read')}`, 'input_unavailable');
             }
             const passphrase = passphraseText.replace(/\r?\n$/u, '');
             if (!passphrase || /[\r\n\u0000]/u.test(passphrase)) {
@@ -198,25 +188,9 @@ async function runParsedCli(args, dependencies = {}, writeBinaryOutput) {
             });
         }
         if (handlerOwner === 'network') {
-            if (args.action !== 'ct-search'
-                && args.action !== 'posture'
-                && args.action !== 'http'
-                && args.action !== 'tls'
-                && args.action !== 'dnssec-validate'
-                && args.action !== 'mail-transport') {
+            if (!isCliCommandForOwner(args, 'network')) {
                 throw new Error('Network command registry ownership is inconsistent.');
             }
-            failureLabel = args.action === 'ct-search'
-                ? 'Certificate Transparency search'
-                : args.action === 'posture'
-                    ? 'Domain posture audit'
-                    : args.action === 'http'
-                        ? 'HTTP probe'
-                        : args.action === 'tls'
-                            ? 'TLS evidence collection'
-                            : args.action === 'dnssec-validate'
-                                ? 'DNSSEC chain validation'
-                                : 'Mail transport review';
             const { runNetworkCommand } = await import("./network-command-runner.mjs");
             return await runNetworkCommand(args, dependencies, commandContext);
         }
@@ -244,7 +218,7 @@ async function runParsedCli(args, dependencies = {}, writeBinaryOutput) {
             eventProgress.current?.emit({
                 event: 'failed',
                 state: 'usage',
-                reason: usageEventReason(error),
+                reason: error.reason,
                 exitCode: EXIT_CODES.USAGE,
             });
             if (!eventProgress.current?.enabled)
@@ -331,12 +305,26 @@ async function runCliCommand(argv, dependencies = {}) {
             checkpoint = caseCheckpoint;
             capturedSource = caseCheckpoint.sourceInput;
         }
+        else if (args.action === 'indicator-set') {
+            const { prepareLocalDocumentWrite } = await import("./local-document-checkpoint.mjs");
+            const { MAX_MANAGED_INDICATOR_PLAN_BYTES, MAX_MANAGED_INDICATOR_SET_BYTES } = await import("../packages/contracts/analyst-interchange.mjs");
+            const indicatorCheckpoint = await prepareLocalDocumentWrite({
+                destination: args.destination, source: args.source,
+                force: args.force === true, label: 'Indicator revision', allowSourceReplacement: false,
+                maximumInputBytes: args.operation === 'revise' ? MAX_MANAGED_INDICATOR_PLAN_BYTES : MAX_MANAGED_INDICATOR_SET_BYTES,
+                maximumOutputBytes: MAX_CLI_OUTPUT_BYTES,
+                ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+            });
+            checkpoint = indicatorCheckpoint;
+            capturedSource = indicatorCheckpoint.sourceInput;
+        }
         const code = await runParsedCli(args, {
             ...dependencies, stdout: buffered.stream,
             ...(args.action === 'workflow-run' && args.resumeSource && capturedSource !== null
                 ? { workflowResumeInput: capturedSource }
                 : {}),
             ...(args.action === 'case' && capturedSource !== null ? { caseFileInput: capturedSource } : {}),
+            ...(args.action === 'indicator-set' && capturedSource !== null ? { readArtifactInput: async () => capturedSource } : {}),
         }, buffered.writeBinary);
         if (code !== EXIT_CODES.SUCCESS && code !== EXIT_CODES.PARTIAL_FAILURE)
             return code;
@@ -367,7 +355,7 @@ async function runCliCommand(argv, dependencies = {}) {
     }
     finally {
         if (checkpoint && await checkpoint.release() > 0) {
-            write(stderr, `${args.action === 'case' ? 'Case' : 'Workflow'} cleanup warning: File ownership changed or a lease could not be removed. Inspect the selected directory before resuming.\n`);
+            write(stderr, `${args.action === 'case' ? 'Case' : args.action === 'indicator-set' ? 'Indicator revision' : 'Workflow'} cleanup warning: File ownership changed or a lease could not be removed. Inspect the selected directory before resuming.\n`);
         }
     }
 }

package/cli/saved-lookup.mjs

@@ -1,9 +1,9 @@
 import { Buffer } from 'node:buffer';
 import { types as utilTypes } from 'node:util';
 import { classifyQuery } from "../lib/classify.mjs";
-import { isSafeJsonObjectKey, scanBoundedJson, } from "../lib/bounded-json.mjs";
+import { isSafeJsonObjectKey, scanBoundedJson, } from "../packages/analysis/bounded-json.mjs";
 import { decodeBoundedUtf8 } from "../lib/bounded-file.mjs";
-import { CliUsageError } from "./arguments.mjs";
+import { CliUsageError } from "./errors.mjs";
 import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "../lib/homepage-metadata-contract.mjs";
 import { registrarStandingObservedBy, resolveRegistrarIanaId, validRegistrarStanding, } from "../lib/registrar-standing-contract.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";

package/cli/selected-input-worker.mjs

@@ -0,0 +1,63 @@
+import { Worker, isMainThread, parentPort, workerData } from 'node:worker_threads';
+import { reviewSelectedInput } from "../packages/investigation/selected-input-review.mjs";
+import { assertMessageBytes } from "../packages/investigation/intake-report.mjs";
+import { DOCUMENT_REVIEW_DEADLINE_MS } from "../packages/contracts/document-intake.mjs";
+import { MESSAGE_INTAKE_SCHEMA, MESSAGE_INTAKE_VERSION } from "../packages/contracts/message-intake.mjs";
+if (!isMainThread && parentPort) {
+    const port = parentPort, request = workerData;
+    try {
+        port.postMessage({ result: await reviewSelectedInput(request.bytes, request.kind, request.reviewedAt) });
+    }
+    catch {
+        port.postMessage({ error: true });
+    }
+    finally {
+        if (request.bytes instanceof Uint8Array)
+            request.bytes.fill(0);
+        port.close();
+    }
+}
+/** A disposable worker makes synchronous parser work cancellable, not a sandbox. */
+export async function reviewSelectedInputInWorker(bytes, kind, reviewedAt, signal) {
+    assertMessageBytes(bytes);
+    signal?.throwIfAborted();
+    // Buffer.slice() can retain a pooled, non-transferable backing store.
+    const copy = Uint8Array.from(bytes);
+    const worker = new Worker(new URL(import.meta.url), { workerData: { bytes: copy, kind, reviewedAt },
+        transferList: [copy.buffer], env: {}, execArgv: [], stdout: true, stderr: true,
+        resourceLimits: { maxOldGenerationSizeMb: 512, maxYoungGenerationSizeMb: 32, stackSizeMb: 4 } });
+    worker.stdout.resume();
+    worker.stderr.resume();
+    try {
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            const finish = (value, cause) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                signal?.removeEventListener('abort', abort);
+                if (value)
+                    resolve(value);
+                else
+                    reject(cause ?? new TypeError('The selected input could not be reviewed within its format and processing bounds.'));
+            };
+            const abort = () => finish(undefined, new Error('Selected input review was cancelled. Nothing was saved.'));
+            const timer = setTimeout(() => finish(undefined, new Error('Selected input review exceeded its processing deadline. Nothing was saved.')), DOCUMENT_REVIEW_DEADLINE_MS);
+            worker.once('message', (reply) => {
+                if (reply && typeof reply === 'object' && 'result' in reply && reply.result?.report.schema === MESSAGE_INTAKE_SCHEMA && reply.result.report.schemaVersion === MESSAGE_INTAKE_VERSION)
+                    finish(reply.result);
+                else
+                    finish();
+            });
+            worker.once('error', () => finish());
+            worker.once('exit', () => finish());
+            signal?.addEventListener('abort', abort, { once: true });
+            if (signal?.aborted)
+                abort();
+        });
+    }
+    finally {
+        await worker.terminate();
+    }
+}

package/cli/sharing-review.mjs

@@ -1,79 +1,18 @@
 import { hasVerifiedWholeArtifactIntegrity, MAX_OFFLINE_ARTIFACT_BYTES, parseOfflineArtifactJson, UnsupportedOfflineArtifactError, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { TLP_MARKINGS, RECIPIENT_SCOPES, expectedScope, tlpLabel, scanSharingMetadata as scanArtifact } from "../packages/interchange/sharing-policy.mjs";
 const SHARING_REVIEW_SCHEMA = 'whoisleuth.cli.sharing-review';
 const SHARING_REVIEW_VERSION = 2;
 const MAX_SHARING_REVIEW_BYTES = MAX_OFFLINE_ARTIFACT_BYTES;
-const TLP_MARKINGS = ['clear', 'green', 'amber', 'amber-strict', 'red'];
-const RECIPIENT_SCOPES = ['public', 'community', 'organization', 'named-recipients'];
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
-const RISKY_KEYS = new Set([
-    'authorization', 'cookie', 'cookies', 'credential', 'credentials', 'email', 'emails',
-    'entities', 'password', 'phone', 'raw', 'rawrdap', 'rawwhois', 'registrant', 'session', 'token',
-]);
-const MARKING_KEYS = new Set([
-    'informationmarking', 'marking', 'markings', 'sharingmarking',
-    'tlp', 'tlplabel', 'tlpmarking', 'trafficlightprotocol',
-]);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
-function normalizedKey(value) {
-    return value.toLowerCase().replace(/[^a-z0-9]/gu, '');
-}
 function boundedMetadataText(value) {
     if (typeof value !== 'string' || value.length > 120 || CONTROL_RE.test(value))
         return null;
     const trimmed = value.trim();
     return trimmed || null;
 }
-function markingFromText(value) {
-    const normalized = value.toUpperCase().replace(/\s+/gu, '').replace('TLP:', '').replace('+STRICT', '-STRICT').toLowerCase();
-    return TLP_MARKINGS.includes(normalized) ? normalized : null;
-}
-function scanArtifact(root) {
-    // The caller has already enforced the JSON byte, node, nesting and container
-    // bounds. Scan that admitted tree in full without a second, smaller prefix.
-    const stack = [{ value: root, marking: false }];
-    const markings = new Set();
-    let riskyKeyCount = 0;
-    while (stack.length) {
-        const next = stack.pop();
-        if (typeof next.value === 'string') {
-            if (next.marking) {
-                const marking = markingFromText(next.value);
-                if (marking)
-                    markings.add(marking);
-            }
-            continue;
-        }
-        if (Array.isArray(next.value)) {
-            for (const value of next.value)
-                stack.push({ value, marking: next.marking });
-            continue;
-        }
-        const valueRecord = record(next.value);
-        if (!valueRecord)
-            continue;
-        for (const [key, value] of Object.entries(valueRecord)) {
-            const normalized = normalizedKey(key);
-            if (RISKY_KEYS.has(normalized))
-                riskyKeyCount += 1;
-            stack.push({ value, marking: MARKING_KEYS.has(normalized) });
-        }
-    }
-    return { importedMarkings: [...markings], riskyKeyCount };
-}
-function expectedScope(marking) {
-    if (marking === 'clear')
-        return 'public';
-    if (marking === 'green')
-        return 'community';
-    if (marking === 'red')
-        return 'named-recipients';
-    return 'organization';
-}
-function tlpLabel(marking) {
-    return `TLP:${marking === 'amber-strict' ? 'AMBER+STRICT' : marking.toUpperCase()}`;
-}
 async function buildSharingReview(raw, options, generatedAt = new Date().toISOString()) {
     if (Buffer.byteLength(raw, 'utf8') > MAX_SHARING_REVIEW_BYTES) {
         throw new TypeError(`Sharing review input is limited to ${MAX_SHARING_REVIEW_BYTES} bytes.`);
@@ -95,8 +34,10 @@ async function buildSharingReview(raw, options, generatedAt = new Date().toISOSt
     const importedRank = strictestImported === null ? -1 : TLP_MARKINGS.indexOf(strictestImported);
     const effective = importedRank > requestedRank ? strictestImported : options.marking;
     let integrity = 'unsupported';
+    let verifiedIdentity = null;
     try {
         const verification = await verifyOfflineArtifact(raw);
+        verifiedIdentity = verification.artifact;
         integrity = verification.state === 'verified' && hasVerifiedWholeArtifactIntegrity(verification)
             ? 'verified'
             : verification.state === 'integrity_valid'
@@ -141,8 +82,8 @@ async function buildSharingReview(raw, options, generatedAt = new Date().toISOSt
         caution: findings.filter((finding) => finding.state === 'caution').length,
         pass: findings.filter((finding) => finding.state === 'pass').length,
     };
-    const artifactSchema = boundedMetadataText(artifact.schema);
-    const rawArtifactVersion = artifact.version ?? artifact.schemaVersion;
+    const artifactSchema = boundedMetadataText(verifiedIdentity ? verifiedIdentity.schema : artifact.schema);
+    const rawArtifactVersion = verifiedIdentity ? verifiedIdentity.version : artifact.version ?? artifact.schemaVersion;
     const artifactVersion = Number.isSafeInteger(rawArtifactVersion)
         && Number(rawArtifactVersion) >= 1
         && Number(rawArtifactVersion) <= 10_000

package/cli/source-reliability.mjs

@@ -1,6 +1,6 @@
 import { Buffer } from 'node:buffer';
 import { canonicalArtifactJson } from "../packages/evidence/artifact-integrity.mjs";
-import { scanBoundedJson } from "../lib/bounded-json.mjs";
+import { scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
 import { LOOKUP_SOURCE_STATES, lookupDiagnosticStates } from "../lib/lookup-diagnostics.mjs";
 import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp, } from "../packages/evidence/observation.mjs";
 import { CLI_LOOKUP_SCHEMA, MAX_CLI_LOOKUP_BYTES, } from "../packages/contracts/cli-lookup.mjs";
@@ -8,7 +8,7 @@ import { normalizeCliLookupDocument } from "./saved-lookup.mjs";
 import { CLI_BULK_SCHEMA, CLI_BULK_ITEM_SCHEMA, CLI_BULK_SCHEMA_VERSION } from "./formatters/json.mjs";
 import { LOOKUP_THREAT_INTELLIGENCE_PROVIDERS } from "../lib/lookup-threat-provider-inventory.mjs";
 import { MAX_THREAT_INTELLIGENCE_PROVIDERS } from "../lib/lookup-response-contract.mjs";
-import { THREAT_INTELLIGENCE_SCHEMA, THREAT_INTELLIGENCE_CONTRACT_VERSION } from "../lib/threat-intelligence-types.mjs";
+import { THREAT_INTELLIGENCE_SCHEMA, THREAT_INTELLIGENCE_CONTRACT_VERSION } from "../packages/analysis/threat-intelligence-types.mjs";
 export const SOURCE_RELIABILITY_REPORT_SCHEMA = 'whoisleuth.source-reliability-report';
 export const SOURCE_RELIABILITY_REPORT_VERSION = 1;
 export const MAX_SOURCE_RELIABILITY_INPUT_BYTES = 12 * 1024 * 1024;

package/cli/support-arguments.mjs

@@ -0,0 +1,49 @@
+import {} from "./command-argument-grammar.mjs";
+import {} from "./command-reference.mjs";
+import { terminalOptions, jsonOutput, singleInputAction } from "./argument-values.mjs";
+export const SUPPORT_ARGUMENT_PARSERS = Object.freeze({
+    completion: (parsed) => ({
+        action: 'completion',
+        shell: parsed.positionalValue('shell'),
+    }),
+    doctor: (parsed) => ({
+        action: 'doctor',
+        network: parsed.hasOption('--network'),
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    }),
+    commands: (parsed) => ({
+        action: 'commands',
+        output: jsonOutput(parsed),
+        common: parsed.hasOption('--common'),
+        group: parsed.optionValue('--group'),
+        mode: parsed.optionValue('--mode'),
+        ...terminalOptions(parsed),
+    }),
+    manual: () => ({ action: 'manual' }),
+    'registry-support': (parsed) => ({
+        action: 'registry-support',
+        target: parsed.positionalValue('domain-or-suffix'),
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    }),
+    'registry-doctor': (parsed) => singleInputAction('registry-doctor', parsed),
+    'registry-cohort': (parsed) => singleInputAction('registry-cohort', parsed),
+    'registry-scaffold': (parsed) => ({
+        action: 'registry-scaffold',
+        profile: parsed.optionValue('--profile'),
+        suffix: parsed.optionValue('--suffix'),
+        scenario: parsed.optionValue('--scenario'),
+    }),
+    'risk-calibrate': (parsed) => ({
+        action: 'risk-calibrate',
+        source: parsed.positionalValue('source'),
+        output: parsed.hasOption('--json')
+            ? 'json'
+            : parsed.hasOption('--summary-json')
+                ? 'summary_json'
+                : 'terminal',
+        ...terminalOptions(parsed),
+    }),
+    'lookalike-calibrate': (parsed) => singleInputAction('lookalike-calibrate', parsed),
+});

package/cli/support-command-definitions.mjs

@@ -0,0 +1,209 @@
+import { RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_REPORT_SCHEMA } from "../packages/contracts/risk-calibration.mjs";
+import { positional, NO_POSITIONALS, OPTIONAL_FILE_POSITIONAL, constraint, EMPTY_CONSTRAINTS, commandSeed, text } from "./command-definition.mjs";
+export const SUPPORT_COMMAND_DEFINITIONS = Object.freeze({
+    completion: commandSeed({
+        reference: {
+            description: 'Print a static shell-completion script for the installed CLI.',
+            example: 'whoisleuth completion zsh > ~/.zfunc/_whoisleuth',
+            boundary: 'Generation is offline and writes only the script to stdout. The command never modifies shell configuration.',
+        },
+        collection: { scope: 'Prints one static script and changes no shell configuration.' },
+        summary: 'Print shell completion',
+        options: [],
+        positionals: Object.freeze([positional('shell', 'enum', 1, 1, ['bash', 'zsh', 'fish', 'powershell'])]),
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze([]),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    doctor: commandSeed({
+        reference: {
+            description: 'Check the supported runtime and local terminal capabilities.',
+            example: 'whoisleuth doctor --json',
+            boundary: 'The default check is offline. Public DNS and port 43 checks run only when --network is explicitly supplied.',
+        },
+        collection: { scope: 'Network access is opt-in with --network and is limited to fixed public DNS, HTTPS, and WHOIS diagnostics.' },
+        summary: 'Check the local CLI runtime',
+        options: ['--network', '--json', '--quiet', '--no-color'],
+        positionals: NO_POSITIONALS,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'conditional_network',
+        common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.doctor']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    commands: commandSeed({
+        reference: {
+            description: 'List the installed command contracts in terminal or versioned JSON form.',
+            example: 'whoisleuth commands --json',
+            boundary: 'Catalogue generation is offline. It reports declared command modes and limits without executing collection or inspecting local evidence.',
+        },
+        collection: { scope: 'Reads the embedded command catalogue and performs no collection.' },
+        summary: 'List installed command contracts',
+        options: ['--common', '--group', '--mode', '--json', '--quiet', '--no-color'],
+        positionals: NO_POSITIONALS,
+        constraints: Object.freeze([]),
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.command-catalogue']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    manual: commandSeed({
+        reference: {
+            description: 'Print a generated roff manual page for local installation.',
+            example: 'whoisleuth manual | man -l -',
+            boundary: 'Generation is offline and derives from the same command catalogue as focused help.',
+        },
+        collection: { scope: 'Builds documentation from the embedded command catalogue.' },
+        summary: 'Print the generated manual page',
+        options: [],
+        positionals: NO_POSITIONALS,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze([]),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "registry-support": commandSeed({
+        reference: {
+            description: 'Explain the local registry capability profile for one domain or suffix.',
+            example: 'whoisleuth registry-support example.test --json',
+            boundary: 'This command is offline. Catalogue coverage does not test live reachability or decide registration or availability.',
+        },
+        collection: { scope: 'Reads the embedded registry capability catalogue for one domain or suffix.' },
+        summary: 'Explain local registry coverage',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('domain-or-suffix', 'text', 0, 1, [], 'argv_or_stdin')]),
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.registry-support', 'whoisleuth.registry-standards-coverage']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "registry-doctor": commandSeed({
+        reference: {
+            description: 'Compare a saved Lookup registry result with the reviewed local capability profile.',
+            example: 'whoisleuth registry-doctor lookup.json --json',
+            boundary: 'The command is offline. It distinguishes expected access constraints from collection results and does not contact a live registry.',
+        },
+        collection: { scope: 'Reads one saved Lookup and the embedded registry capability catalogue.' },
+        summary: 'Diagnose saved registry collection',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.registry-doctor']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "registry-cohort": commandSeed({
+        reference: {
+            description: 'Build privacy-safe suffix and capability-profile timelines from saved observations or retained cohort reports.',
+            example: 'whoisleuth registry-cohort saved-lookups.jsonl --json',
+            boundary: 'This command is offline and omits domains, queries, and raw evidence. Input families cannot be mixed, and retained samples are never assumed independent.',
+        },
+        collection: { scope: 'Reads at most 500 saved Lookups or retained cohort reports from one unmixed family and emits bounded target-free timelines.' },
+        summary: 'Build target-free registry quality timelines',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.registry-cohort']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "registry-scaffold": commandSeed({
+        reference: {
+            description: 'Create a bounded synthetic WHOIS fixture scaffold for one existing capability profile.',
+            example: 'whoisleuth registry-scaffold --profile nic-io-colon --suffix ac --scenario registered',
+            boundary: 'The output is a sanitised template only. Its command-owned --profile selects fixture capability, --config is rejected, and contributors must not paste live responses or personal registration data into fixtures.',
+        },
+        collection: { scope: 'Reads the embedded registry capability catalogue and prints one synthetic fixture template.' },
+        summary: 'Create a sanitised registry fixture scaffold',
+        options: ['--profile', '--suffix', '--scenario'],
+        optionOverrides: { '--profile': text('Select a catalogue profile; find its ID with registry-support <suffix> --json.', true) },
+        positionals: NO_POSITIONALS,
+        constraints: Object.freeze([
+            constraint({ kind: 'required', options: ['--profile', '--suffix', '--scenario'] }),
+        ]),
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze([]),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'command_owned',
+    }),
+    "risk-calibrate": commandSeed({
+        reference: {
+            description: 'Replay reviewed labels against the current explainable Risk model.',
+            example: 'whoisleuth risk-calibrate calibration.json --summary-json',
+            boundary: 'Calibration is offline and diagnostic. The summary form omits record identifiers, domains, and evidence; neither form trains, tunes, or changes the scoring model automatically.',
+        },
+        collection: { scope: 'Reads one bounded reviewed-label dataset and changes no model or evidence.' },
+        summary: 'Replay reviewed Risk labels offline',
+        options: ['--json', '--summary-json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: Object.freeze([
+            constraint({ kind: 'mutually_exclusive', options: ['--json', '--summary-json'] }),
+        ]),
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze([RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_REPORT_SCHEMA]),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "lookalike-calibrate": commandSeed({
+        reference: {
+            description: 'Summarise reviewed candidate dispositions by mutation family without retaining domains.',
+            example: 'whoisleuth lookalike-calibrate reviewed-candidates.json --json',
+            boundary: 'Calibration is offline and diagnostic. It omits candidate identifiers, domains, notes, and evidence and never tunes generation or filtering automatically.',
+        },
+        collection: { scope: 'Reads at most 5,000 reviewed candidate labels from one dataset capped at 2 MiB.' },
+        summary: 'Summarise reviewed lookalike yield offline',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'support',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.lookalike-calibration-input', 'whoisleuth.lookalike-calibration']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+});

package/cli/support-command-runner.mjs

@@ -1,6 +1,6 @@
 import { REGISTRY_CAPABILITIES_VERSION, registryCapabilityFor } from "../lib/registry-capabilities.mjs";
-import { buildRiskCalibrationSummaryReport } from "../lib/risk-calibration-summary.mjs";
-import { explainRiskScore, explainRiskScoreV7, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../lib/risk-scoring.mjs";
+import { buildRiskCalibrationSummaryReport } from "../packages/analysis/risk-calibration-summary.mjs";
+import { explainRiskScore, explainRiskScoreV7, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../packages/analysis/risk-scoring.mjs";
 import { buildCliCommandCatalogue, formatCliCommandCatalogue, selectCliCommands } from "./command-catalogue.mjs";
 import { CLI_COMMAND_REGISTRY, CLI_COMMANDS, COMMAND_COLLECTION, COMMAND_DETAILS, COMMAND_USAGE, } from "./command-reference.mjs";
 import { buildShellCompletion } from "./completion.mjs";