@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/cli/indicator-set-command.mjs

@@ -0,0 +1,33 @@
+import { buildManagedIndicatorRevision, managedIndicatorState, parseManagedIndicatorJson, readManagedIndicatorSet } from "../packages/interchange/managed-indicator-set.mjs";
+import { exportManagedIndicators } from "../packages/interchange/managed-indicator-export.mjs";
+import { MAX_MANAGED_INDICATOR_PLAN_BYTES, MAX_MANAGED_INDICATOR_SET_BYTES } from "../packages/contracts/analyst-interchange.mjs";
+import { formatJsonDocument } from "./formatters/json.mjs";
+import { safeTerminalValue } from "./formatters/terminal.mjs";
+import EXIT_CODES from "./exit-codes.mjs";
+export async function runIndicatorSetCommand(args, dependencies, context) {
+    context.setFailureLabel('Indicator revision');
+    const raw = dependencies.readArtifactInput ? await dependencies.readArtifactInput(args.source)
+        : await context.readInput(args.source, args.operation === 'revise' ? MAX_MANAGED_INDICATOR_PLAN_BYTES : MAX_MANAGED_INDICATOR_SET_BYTES, 'Indicator input');
+    const input = parseManagedIndicatorJson(raw, args.operation === 'revise');
+    const now = context.now();
+    const revision = args.operation === 'revise' ? await buildManagedIndicatorRevision(input, now) : null;
+    const manifest = revision?.manifest ?? await readManagedIndicatorSet(input);
+    dependencies.signal?.throwIfAborted();
+    if (args.quiet)
+        return EXIT_CODES.SUCCESS;
+    if (args.operation === 'stix' || args.operation === 'misp')
+        context.writeStdout((await exportManagedIndicators(manifest, args.operation)).content);
+    else if (args.output === 'json')
+        context.writeStdout(formatJsonDocument(manifest));
+    else {
+        const lines = [`${safeTerminalValue(manifest.name)} · revision ${manifest.revision}`, `Set ${manifest.id}`, `Content digest ${manifest.integrity.digestSha256}`,
+            'Content verified; authorship and earlier revisions are not authenticated.'];
+        if (revision)
+            lines.push(`Changes: ${revision.changes.length} · unchanged: ${revision.unchanged} · excluded candidates: ${revision.exclusions.length}`);
+        for (const entry of manifest.entries)
+            lines.push(`${entry.domain} · ${managedIndicatorState(entry, now)} · ${entry.id}`, `  Review expires ${entry.expiresAt} · source observed ${entry.observation.observedAt ?? 'time unavailable'}`, `  ${safeTerminalValue(entry.reviewBasis)}`);
+        lines.push('Save the manifest for the next revision. Nothing was submitted or applied.');
+        context.writeStdout(context.terminal(`${lines.join('\n')}\n`, args.color));
+    }
+    return EXIT_CODES.SUCCESS;
+}

package/cli/inline-command-families.mjs

@@ -1,47 +1,6 @@
-const SUPPORT_INLINE_COMMANDS = Object.freeze([
-    'completion',
-    'commands',
-    'manual',
-    'doctor',
-    'registry-support',
-    'registry-doctor',
-    'registry-cohort',
-    'registry-scaffold',
-    'risk-calibrate',
-    'lookalike-calibrate',
-]);
-const REVIEW_INLINE_COMMANDS = Object.freeze([
-    'verify-artifact',
-    'interchange-report',
-    'source-report',
-    'compare',
-    'page-compare',
-    'mail-review',
-    'mail-headers',
-    'review-evidence',
-    'brief',
-    'case',
-    'case-pack',
-]);
-const ASSURANCE_INLINE_COMMANDS = Object.freeze([
-    'manifest',
-    'map-observations',
-    'oam-export',
-    'domain-control',
-    'assurance',
-    'change-packet',
-    'sharing-review',
-    'ct-intake',
-]);
-const WORKFLOW_INLINE_COMMANDS = Object.freeze([
-    'monitor-once',
-    'workflow-plan',
-    'workflow-run',
-]);
-const HISTORY_INLINE_COMMANDS = Object.freeze([
-    'diff',
-    'reconcile',
-    'timeline',
-    'export',
-]);
-export { ASSURANCE_INLINE_COMMANDS, HISTORY_INLINE_COMMANDS, REVIEW_INLINE_COMMANDS, SUPPORT_INLINE_COMMANDS, WORKFLOW_INLINE_COMMANDS, };
+import { inlineCommandsFor } from "./command-reference.mjs";
+export const SUPPORT_INLINE_COMMANDS = inlineCommandsFor('support');
+export const REVIEW_INLINE_COMMANDS = inlineCommandsFor('review');
+export const ASSURANCE_INLINE_COMMANDS = inlineCommandsFor('assurance');
+export const WORKFLOW_INLINE_COMMANDS = inlineCommandsFor('workflow');
+export const HISTORY_INLINE_COMMANDS = inlineCommandsFor('history');

package/cli/inline-command-runner.mjs

@@ -1,35 +1,8 @@
-import { CLI_COMMANDS, commandDefinition } from "./command-reference.mjs";
-import { ASSURANCE_INLINE_COMMANDS, HISTORY_INLINE_COMMANDS, REVIEW_INLINE_COMMANDS, SUPPORT_INLINE_COMMANDS, WORKFLOW_INLINE_COMMANDS, } from "./inline-command-families.mjs";
-const FAMILY_COMMANDS = Object.freeze([
-    Object.freeze({ family: 'support', commands: SUPPORT_INLINE_COMMANDS }),
-    Object.freeze({ family: 'review', commands: REVIEW_INLINE_COMMANDS }),
-    Object.freeze({ family: 'assurance', commands: ASSURANCE_INLINE_COMMANDS }),
-    Object.freeze({ family: 'workflow', commands: WORKFLOW_INLINE_COMMANDS }),
-    Object.freeze({ family: 'history', commands: HISTORY_INLINE_COMMANDS }),
-]);
-function buildInlineCommandOwnership() {
-    const ownership = new Map();
-    for (const { family, commands } of FAMILY_COMMANDS) {
-        for (const command of commands) {
-            if (ownership.has(command))
-                throw new Error(`Inline CLI command ${command} has more than one command-family owner.`);
-            ownership.set(command, family);
-        }
-    }
-    return ownership;
-}
-const INLINE_COMMAND_OWNERSHIP = buildInlineCommandOwnership();
-const INLINE_CLI_COMMANDS = Object.freeze(CLI_COMMANDS.filter((command) => commandDefinition(command).execution.handlerOwner === 'inline'));
-function validateInlineCommandOwnership() {
-    const missing = INLINE_CLI_COMMANDS.filter((command) => !INLINE_COMMAND_OWNERSHIP.has(command));
-    const unexpected = [...INLINE_COMMAND_OWNERSHIP.keys()].filter((command) => !INLINE_CLI_COMMANDS.includes(command));
-    if (missing.length || unexpected.length) {
-        throw new Error(`Inline CLI command-family ownership is inconsistent (missing: ${missing.join(', ') || 'none'}; unexpected: ${unexpected.join(', ') || 'none'}).`);
-    }
-}
-validateInlineCommandOwnership();
+import { CLI_COMMANDS, INLINE_COMMAND_FAMILIES, inlineCommandFamily, inlineCommandsFor, } from "./command-reference.mjs";
+const FAMILY_COMMANDS = Object.freeze(INLINE_COMMAND_FAMILIES.map(family => Object.freeze({ family, commands: inlineCommandsFor(family) })));
+const INLINE_CLI_COMMANDS = Object.freeze(CLI_COMMANDS.filter((command) => inlineCommandFamily(command) !== null));
 async function runInlineCommand(args, dependencies, context) {
-    const family = INLINE_COMMAND_OWNERSHIP.get(args.action);
+    const family = inlineCommandFamily(args.action);
     if (family === 'support') {
         const { runSupportCommand } = await import("./support-command-runner.mjs");
         return runSupportCommand(args, dependencies, context);

package/cli/input.mjs

@@ -64,7 +64,7 @@ export async function readCliTextInput(source, stdin, options) {
             if (error instanceof CliUsageError)
                 throw error;
             const message = error instanceof Error ? error.message : `${options.label} could not be read.`;
-            throw new CliUsageError(message);
+            throw new CliUsageError(message, error instanceof TypeError ? 'invalid_input' : 'input_unavailable');
         }
     }
     if (!stdin || stdin.isTTY)
@@ -142,7 +142,7 @@ export async function readCliHeaderInput(source, stdin, options) {
             if (error instanceof CliUsageError || options.signal?.aborted)
                 throw error;
             const message = error instanceof Error ? error.message : `${options.label} could not be read.`;
-            throw new CliUsageError(message);
+            throw new CliUsageError(message, error instanceof TypeError ? 'invalid_input' : 'input_unavailable');
         }
         finally {
             await handle?.close();

package/cli/intake-command.mjs

@@ -0,0 +1,107 @@
+import { readBoundedRegularFile } from "../lib/bounded-file.mjs";
+import { MAX_MESSAGE_INTAKE_BYTES, MESSAGE_INTAKE_INPUTS } from "../packages/contracts/message-intake.mjs";
+import { reviewSelectedInputInWorker } from "./selected-input-worker.mjs";
+import { reviewIdentityIncident } from "../packages/investigation/identity-incident-review.mjs";
+import { selectReceiverTrust, authenticationHeaderLabel } from "../packages/investigation/mail-authentication-review.mjs";
+import { CliUsageError } from "./errors.mjs";
+import { formatJsonDocument } from "./formatters/json.mjs";
+import EXIT_CODES from "./exit-codes.mjs";
+export function formatMessageIntake(report) {
+    const lines = [`Offline ${report.source.kind} intake`, `Review: ${report.coverage.state} · Extracted links: ${report.links.length} · Reviewed parts: ${report.coverage.reviewedParts}`,
+        `Source: ${report.source.digestSha256} · ${report.source.byteLength} bytes`];
+    for (const identity of report.identities)
+        lines.push(`Part ${identity.part} ${identity.role.replaceAll('_', ' ')}: ${identity.domain}`);
+    for (const header of report.authenticationReview.headers) {
+        lines.push(`${authenticationHeaderLabel(header)} · ${header.state} · receiver trust: ${header.receiverTrust.replaceAll('_', ' ')}`);
+        for (const claim of header.claims)
+            lines.push(`  ${claim.method}/${claim.methodVersion}: ${claim.result} (${claim.state})${claim.domains.map(value => ` · ${value.property}=${value.domain}`).join('')}${claim.duplicateProperties.length ? ` · ambiguous properties: ${claim.duplicateProperties.join(', ')}` : ''}`);
+        if (header.duplicateOf)
+            lines.push(`  Duplicate of header ${header.duplicateOf} in this part.`);
+        lines.push(...header.issues.map(issue => `  ${issue}`));
+    }
+    for (const link of report.links) {
+        lines.push(`${link.id}: ${link.origin} · ${link.source.replaceAll('_', ' ')}${link.parentId ? ` · supplied inside ${link.parentId}` : ''}`);
+        if (link.displayedHostname)
+            lines.push(`  Displayed: ${link.displayedHostname} · ${link.displayedDestination.replaceAll('_', ' ')}`);
+        if (link.authorisation) {
+            lines.push(`  Authorisation: ${link.authorisation.kind.replaceAll('_', ' ')} · client ${link.authorisation.clientId ?? 'not retained or ambiguous'}`);
+            if (link.authorisation.scopes.length)
+                lines.push(`  Requested scopes: ${link.authorisation.scopes.join(', ')}`);
+            if (link.authorisation.redirectOrigin)
+                lines.push(`  Supplied return origin: ${link.authorisation.redirectOrigin}`);
+            if (link.authorisation.duplicateParameters.length)
+                lines.push(`  Ambiguous parameters: ${link.authorisation.duplicateParameters.join(', ')}`);
+        }
+    }
+    if (report.actionHints.length)
+        lines.push(`Review wording: ${report.actionHints.map(value => value.replaceAll('_', ' ')).join(', ')}`);
+    if (report.documentReview) {
+        lines.push(`Document coverage: ${report.documentReview.state} · pages ${report.documentReview.reviewedPages}/${report.documentReview.pageCount ?? 'not a paginated review'}`);
+        for (const part of report.documentReview.parts)
+            lines.push(`  ${part.id}${part.page ? ` · page ${part.page}` : ''} · ${part.kind} · ${part.identity} · ${part.digestSha256}`);
+        lines.push(...report.documentReview.notes);
+    }
+    if (report.harReview) {
+        lines.push('Recorded HTTP sequence (not replayed)');
+        for (const entry of report.harReview.entries)
+            lines.push(`  ${entry.sequence}. ${entry.startedAt ?? 'time unavailable'} · ${entry.method} ${entry.origin ?? 'origin unavailable'} · status ${entry.status ?? 'unavailable'} · ${entry.mimeCategory} · ${entry.durationMs === null ? 'duration unavailable' : `${entry.durationMs} ms`}`);
+        if (report.harReview.invalidEntries)
+            lines.push(`Invalid request records omitted: ${report.harReview.invalidEntries}`);
+    }
+    if (report.identityEventReview) {
+        const review = report.identityEventReview;
+        const matches = new Map(review.comparison?.events.map(event => [event.sequence, event]));
+        lines.push(`Selected identity events: ${review.provider} · ${review.events.length} records · ${review.invalidEvents} invalid records omitted`);
+        for (const event of review.events) {
+            const match = matches.get(event.sequence);
+            lines.push(`  ${event.sequence}. ${event.occurredAt ?? 'time unavailable'} · ${event.actorLabel ?? 'actor unavailable'} · ${event.kind} · ${event.result}`, `    applications ${event.applicationIds.join(', ') || 'unavailable'} · resource tenant ${event.tenantId ?? 'unavailable'} · protocol ${event.protocol}`);
+            if (match)
+                lines.push(`    comparison ${match.state}: application ${match.application}, tenant ${match.tenant}, actor ${match.actor}, time ${match.time}`);
+        }
+        lines.push('Actor labels are file-local. Matching supplied fields does not establish account compromise.');
+    }
+    for (const step of report.identityRecovery.nextSteps)
+        lines.push(`Account response — ${step.title}: ${step.detail}`);
+    if (report.coverage.unreviewedAttachments)
+        lines.push(`Unreviewed attachments: ${report.coverage.unreviewedAttachments}`);
+    if (report.coverage.rejectedLinks)
+        lines.push(`Unsupported link values: ${report.coverage.rejectedLinks}`);
+    if (report.coverage.boundsReached.length)
+        lines.push(`Partial analysis: ${report.coverage.boundsReached.join('; ')}`);
+    if (report.source.kind === 'qr' && !report.coverage.reviewedParts)
+        lines.push('No QR text was decoded. This does not establish that the image contains no QR symbol.');
+    lines.push('Exact paths, queries, fragments and original message content are not included. Link relationships and authorisation parameters are supplied claims, not proof of a completed redirect or account compromise.');
+    return `${lines.join('\n')}\n`;
+}
+export async function runIntakeCommand(args, dependencies, context) {
+    context.setFailureLabel('Message intake');
+    if (MESSAGE_INTAKE_INPUTS[args.kind].binary && (!args.source || args.source === '-'))
+        throw new CliUsageError('Binary intake requires a selected file; binary stdin is not accepted.');
+    let bytes;
+    if (dependencies.readBinaryArtifactInput && args.source && args.source !== '-')
+        bytes = await dependencies.readBinaryArtifactInput(args.source);
+    else if (args.source && args.source !== '-')
+        bytes = await readBoundedRegularFile(args.source, { maximumBytes: MAX_MESSAGE_INTAKE_BYTES, minimumBytes: 1, label: 'Selected input', ...(dependencies.signal ? { signal: dependencies.signal } : {}) });
+    else
+        bytes = new TextEncoder().encode(await context.readInput(args.source, MAX_MESSAGE_INTAKE_BYTES, 'Selected input'));
+    try {
+        const result = await reviewSelectedInputInWorker(bytes, args.kind, context.now(), dependencies.signal);
+        let authenticationReview;
+        try {
+            authenticationReview = selectReceiverTrust(result.report.authenticationReview, args.trustedAuthHeaders ?? []);
+        }
+        catch (cause) {
+            if (cause instanceof TypeError)
+                throw new CliUsageError(cause.message);
+            throw cause;
+        }
+        const report = { ...result.report, authenticationReview, identityRecovery: reviewIdentityIncident({ reportedActions: args.reportedActions }) };
+        dependencies.signal?.throwIfAborted();
+        if (!args.quiet)
+            context.writeStdout(args.output === 'json' ? formatJsonDocument(report) : context.terminal(formatMessageIntake(report), args.color));
+        return args.strictExit && report.coverage.state === 'partial' ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+    }
+    finally {
+        bytes.fill(0);
+    }
+}

package/cli/interchange-report.mjs

@@ -89,6 +89,7 @@ export async function buildInterchangeFidelityReport(raw, options = {}) {
             }),
             limitations: Object.freeze([
                 'The file did not match a registered interchange contract. Its supplied schema text and contents are not echoed.',
+                'This is an import/export compatibility catalogue, not the complete verifier inventory. verify-artifact may support this file independently.',
                 'This report makes no request and does not establish that evidence is accurate, current, complete, or safe to share.',
             ]),
         });
@@ -185,6 +186,7 @@ export async function buildInterchangeFidelityReport(raw, options = {}) {
             blockedSectionCount, prunedRecordCount,
         }),
         limitations: Object.freeze([
+            ...(contract.id === 'lookup_evidence' ? ['CLI read support means offline verification and packaging. brief, export, compare, registry-doctor and source-report require a saved CLI Lookup, not this browser evidence export.'] : []),
             'Compatibility describes declared field groups and supported operations, not byte-for-byte equality or evidence truth.',
             'The report emits only registered metadata, counts, and fixed field-group identifiers. Targets, notes, contacts, passphrases, and evidence values are not included.',
             'A verified integrity envelope detects file changes but does not establish author identity, source accuracy, currency, completeness, or sharing authority.',
@@ -195,7 +197,7 @@ export function formatInterchangeFidelityReport(report) {
     const browser = report.compatibility.browser;
     const cli = report.compatibility.cli;
     const nextAction = !report.recognised
-        ? 'Choose a supported WHOISleuth export and run verify-artifact before trying to import it.'
+        ? 'Run verify-artifact for independent verification support. Import/export compatibility is not registered here.'
         : !report.artifact.versionSupported
             ? 'Use a WHOISleuth release that supports this exact version, or re-export it with its last supported release.'
             : !report.verification.assuranceSatisfied
@@ -209,7 +211,7 @@ export function formatInterchangeFidelityReport(report) {
                             : 'Retain the verification result and use only the operations declared above.';
     return [
         'Interchange fidelity report',
-        `Recognised     ${report.recognised ? 'yes' : 'no'}`,
+        `Interchange contract ${report.recognised ? 'registered' : 'not registered'}`,
         `Artifact       ${report.artifact.id ?? 'unrecognised'}`,
         `Version        ${report.artifact.version ?? 'unavailable'}${report.artifact.versionSupported ? '' : ' (unsupported)'}`,
         `Verification   ${report.verification.state}`,

package/cli/investigation-artifacts.mjs

@@ -9,7 +9,7 @@ import { OFFLINE_ARTIFACT_VERIFICATION_SCHEMA, OFFLINE_ARTIFACT_VERIFICATION_VER
 import { validateLookupEvidenceArtifactStructure } from "./artifact-validation/lookup-evidence.mjs";
 import { CLI_DISCOVERY_SCAN_SCHEMA, CLI_DISCOVERY_SCAN_VERSION } from "./discovery-scan.mjs";
 import { CLI_DISCOVER_SCHEMA, CLI_DISCOVER_SCHEMA_VERSION, CLI_POSTURE_SCHEMA, CLI_POSTURE_SCHEMA_VERSION, CLI_CT_SEARCH_SCHEMA, CLI_CT_SEARCH_SCHEMA_VERSION, CLI_COMPARE_SCHEMA, CLI_COMPARE_SCHEMA_VERSION, } from "./formatters/json.mjs";
-import { CLI_LOOKUP_BRIEF_SCHEMA, CLI_LOOKUP_BRIEF_VERSION } from "./lookup-brief.mjs";
+import { CLI_LOOKUP_BRIEF_SCHEMA, CLI_LOOKUP_BRIEF_VERSION } from "../packages/contracts/cli-lookup-brief.mjs";
 import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, parseExternalFindingsDocument } from "../packages/interchange/external-findings-import.mjs";
 import { SOURCE_RELIABILITY_REPORT_SCHEMA, SOURCE_RELIABILITY_REPORT_VERSION } from "./source-reliability.mjs";
 import { CLI_CASE_PACK_SCHEMA, CLI_CASE_PACK_VERSION, verifyCliCasePack } from "./case-pack.mjs";

package/cli/investigation-plan.mjs

@@ -1,156 +1,20 @@
 import { domainToASCII } from 'node:url';
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
-import { CLI_DOMAIN_CONTROL_MONITOR_SCHEMA } from "../packages/contracts/domain-control-monitor.mjs";
-import { DOMAIN_CONTROL_REVIEW_SCHEMA } from "../packages/contracts/domain-control-review.mjs";
-import { EXTERNAL_FINDINGS_SCHEMA } from "../packages/interchange/external-findings-import.mjs";
-import { CLI_LOOKUP_BRIEF_SCHEMA } from "./lookup-brief.mjs";
-import { INVESTIGATION_PLAN_RECIPES, RUNNABLE_INVESTIGATION_PLAN_RECIPES, cliInvocationNetworkEffect, } from "./command-reference.mjs";
+import { cliInvocationNetworkEffect } from "./command-reference.mjs";
+import { INVESTIGATION_RECIPE_DEFINITIONS, INVESTIGATION_PLAN_RECIPES, RUNNABLE_INVESTIGATION_PLAN_RECIPES, } from "./investigation-recipes.mjs";
 export const CLI_INVESTIGATION_PLAN_SCHEMA = 'whoisleuth.cli.investigation-plan';
 export const CLI_INVESTIGATION_PLAN_VERSION = 1;
 export const CLI_WORKFLOW_RECIPE_CATALOGUE_SCHEMA = 'whoisleuth.cli.workflow-recipe-catalogue';
 export const CLI_WORKFLOW_RECIPE_CATALOGUE_VERSION = 1;
 export { INVESTIGATION_PLAN_RECIPES, RUNNABLE_INVESTIGATION_PLAN_RECIPES };
-const RECIPES = Object.freeze({
-    'domain-triage': Object.freeze({
-        id: 'domain-triage',
-        label: 'New domain triage',
-        standardInputs: Object.freeze([
-            { stepId: 'export', input: 1, sourceStepId: 'collect' },
-            { stepId: 'verify', input: 1, sourceStepId: 'export' },
-        ]),
-        subjectRequirement: 'domain',
-        objective: 'Collect and preserve separately attributed registration, DNS, HTTP, TLS, page, and network-context evidence.',
-        limitations: Object.freeze([
-            'Collection remains analyst-triggered and source limitations remain explicit.',
-            'Disposition, reviewed response actions, monitoring, and closure continue in the saved Case workspace; this CLI recipe does not submit reports.',
-        ]),
-        steps: (domain) => Object.freeze([
-            step('collect', 'Collect a Deep lookup', 'lookup', [domain, '--deep', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.lookup', 'Review source health and limitations before using missing fields.'),
-            step('export', 'Create a portable evidence report', 'export', ['<saved-lookup.json>'], 'offline', 'analyst_selection', 'whoisleuth.lookup-evidence', 'Reuse the collected Lookup by default, or select a different reviewed Lookup file.'),
-            step('verify', 'Verify the exported artefact', 'verify-artifact', ['<evidence.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.offline-artifact-verification', 'Keep verification distinct from a claim that the observations are correct or current.'),
-        ]),
-    }),
-    'lookalike-review': Object.freeze({
-        id: 'lookalike-review',
-        label: 'Lookalike candidate review',
-        subjectRequirement: 'brand_or_domain',
-        objective: 'Generate a bounded candidate queue, collect only the selected scope, and retain a reviewed candidate lookup.',
-        limitations: Object.freeze([
-            'Candidate generation does not establish registration, control, intent, or maliciousness.',
-            'Official-reference collection and page comparison require analyst-selected saved evidence; use page-compare after retaining the reference and candidate observations.',
-        ]),
-        steps: (subject) => Object.freeze([
-            step('generate', 'Generate candidates offline', 'discover', [subject, '--preset', 'all', '--json'], 'offline', 'none', 'whoisleuth.cli.discover', 'Review mutation families and suppressions before collection.'),
-            step('scan', 'Collect a bounded candidate queue', 'discover-scan', [subject, '--fast', '--scan-limit', '50', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.discovery-scan', 'Fast collection is a triage boundary; partial or inconclusive authority evidence remains explicit.'),
-            step('inspect', 'Deep-review one selected candidate', 'lookup', ['<selected-domain>', '--deep', '--json'], 'network', 'analyst_selection', 'whoisleuth.cli.lookup', 'Select a candidate deliberately; generation does not prove registration, control, intent, or maliciousness.'),
-        ]),
-    }),
-    'owned-domain-review': Object.freeze({
-        id: 'owned-domain-review',
-        label: 'Owned domain posture review',
-        subjectRequirement: 'domain',
-        objective: 'Review current passive posture and compare supplied observations with an analyst-authored control manifest.',
-        limitations: Object.freeze(['Use only for a domain the analyst owns or is authorised to review.']),
-        steps: (domain) => Object.freeze([
-            step('posture', 'Collect bounded DNS posture', 'posture', [domain, '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.posture', 'Review mail profile and delegation evidence before interpreting missing records.'),
-            step('lookup', 'Collect supporting Deep evidence', 'lookup', [domain, '--deep', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.lookup', 'Retain separately attributed registration, DNS, TLS, and page observations.'),
-            step('manifest', 'Review the domain control manifest', 'domain-control', ['<review-input.json>', '--json'], 'offline', 'analyst_selection', DOMAIN_CONTROL_REVIEW_SCHEMA, 'Only complete supplied observations may produce drift.'),
-        ]),
-    }),
-    'historical-comparison': Object.freeze({
-        id: 'historical-comparison',
-        label: 'Historical observation comparison',
-        standardInputs: Object.freeze([
-            { stepId: 'diff', input: 2, sourceStepId: 'current' },
-            { stepId: 'timeline', input: 3, sourceStepId: 'current' },
-        ]),
-        subjectRequirement: 'domain',
-        objective: 'Collect a current observation and compare it with analyst-selected saved observations without merging source states.',
-        limitations: Object.freeze(['A later observation does not retroactively refresh retained evidence.']),
-        steps: (domain) => Object.freeze([
-            step('current', 'Collect the current lookup', 'lookup', [domain, '--deep', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.lookup', 'A current request does not refresh or validate older provider-reported history.'),
-            step('diff', 'Compare two selected observations', 'diff', ['<previous.json>', '<current.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.cli.lookup-diff', 'Equal, different, conflicting, and unavailable evidence remain separate.'),
-            step('timeline', 'Build a bounded local timeline', 'timeline', ['<oldest.json>', '<newer.json>', '<current.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.cli.lookup-timeline', 'Choose two to twenty same-domain files in chronological scope.'),
-        ]),
-    }),
-    'campaign-review': Object.freeze({
-        id: 'campaign-review',
-        label: 'Campaign candidate review',
-        subjectRequirement: 'brand_or_domain',
-        objective: 'Prepare a bounded candidate set, collect a deliberately selected queue, and review retained evidence without asserting campaign attribution.',
-        limitations: Object.freeze(['Grouping candidates is analyst triage and does not prove common ownership, control, infrastructure, or intent.']),
-        steps: (subject) => Object.freeze([
-            step('prepare', 'Prepare candidates offline', 'discover', [subject, '--preset', 'all', '--json'], 'offline', 'none', 'whoisleuth.cli.discover', 'Review mutation families and bounded omissions before selecting a collection scope.'),
-            step('collect', 'Collect the selected candidate queue', 'discover-scan', [subject, '--fast', '--scan-limit', '50', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.discovery-scan', 'Treat partial and inconclusive authority results as explicit outcomes.'),
-            step('review', 'Prepare a selected candidate brief', 'brief', ['<saved-lookup.json>', '--json'], 'offline', 'analyst_selection', CLI_LOOKUP_BRIEF_SCHEMA, 'Select a saved candidate Lookup; keep any campaign grouping analyst-authored.'),
-        ]),
-    }),
-    'certificate-anomaly': Object.freeze({
-        id: 'certificate-anomaly',
-        label: 'Certificate anomaly review',
-        subjectRequirement: 'domain',
-        objective: 'Review bounded certificate observations alongside current source-qualified domain evidence without treating issuance as proof of control or intent.',
-        limitations: Object.freeze(['Certificate observations are separately attributed and do not establish current service control.']),
-        steps: (domain) => Object.freeze([
-            step('search', 'Collect bounded certificate observations', 'ct-search', [domain, '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.ct-search', 'Review source availability, truncation, and observation timing.'),
-            step('intake', 'Normalise the selected observations', 'ct-intake', ['<certificate-events.json>', '--json'], 'offline', 'analyst_selection', EXTERNAL_FINDINGS_SCHEMA, 'Select a certificate-event batch; a certificate-search report is not interchangeable with that input.'),
-            step('corroborate', 'Collect supporting domain evidence', 'lookup', [domain, '--deep', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.lookup', 'Compare evidence families without collapsing certificate and registration identities.'),
-        ]),
-    }),
-    'registry-disagreement': Object.freeze({
-        id: 'registry-disagreement',
-        label: 'Registry disagreement review',
-        standardInputs: Object.freeze([
-            { stepId: 'compare', input: 1, sourceStepId: 'collect' },
-            { stepId: 'report', input: 1, sourceStepId: 'collect' },
-        ]),
-        subjectRequirement: 'domain',
-        objective: 'Collect separately attributed registration evidence and review conflicting publications without selecting an arbitrary source as truth.',
-        limitations: Object.freeze(['Only authority-aware registration evidence may decide availability; disagreement remains explicit.']),
-        steps: (domain) => Object.freeze([
-            step('collect', 'Collect source-qualified registration evidence', 'lookup', [domain, '--deep', '--json'], 'network', 'network_disclosure', 'whoisleuth.cli.lookup', 'Retain RDAP, registrar RDAP, WHOIS, and authority states separately.'),
-            step('compare', 'Compare registry publications offline', 'compare', ['<saved-lookup.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.cli.compare', 'Do not convert conflicting or unavailable publications into equivalence.'),
-            step('report', 'Prepare a target-free source report', 'source-report', ['<saved-lookup.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.source-reliability-report', 'The report describes source behaviour, not ownership, safety, or legal status.'),
-        ]),
-    }),
-    'evidence-handoff': Object.freeze({
-        id: 'evidence-handoff',
-        label: 'Reviewed evidence handoff',
-        standardInputs: Object.freeze([{ stepId: 'lint', input: 1, sourceStepId: 'package' }]),
-        subjectRequirement: 'review_label',
-        objective: 'Verify, minimise, and package analyst-selected evidence for a deliberate handoff without transmitting or submitting it.',
-        limitations: Object.freeze(['The recipe prepares local material only; sharing remains a separate deliberate action.']),
-        steps: () => Object.freeze([
-            step('verify', 'Verify the selected artefact', 'verify-artifact', ['<evidence.json>', '--json', '--strict-exit'], 'offline', 'analyst_selection', 'whoisleuth.offline-artifact-verification', 'Verification checks structure and integrity, not the truth or currency of observations.'),
-            step('package', 'Build a reviewed public Case-pack', 'case-pack', ['<cases.json>', '--audience', 'public', '--reviewed', '--json'], 'offline', 'analyst_selection', 'whoisleuth.cli.case-pack', 'Review minimisation and audience projection before retaining the separate package.'),
-            step('lint', 'Review deliberate-sharing metadata', 'sharing-review', ['<package.json>', '--marking', 'clear', '--recipient-scope', 'public', '--purpose', 'reviewed evidence handoff', '--human-reviewed', '--personal-data-reviewed', '--redactions-confirmed', '--json'], 'offline', 'analyst_selection', 'whoisleuth.cli.sharing-review', 'A clear lint result does not send, upload, publish, or authorise the artefact.'),
-        ]),
-    }),
-    'planned-domain-change': Object.freeze({
-        id: 'planned-domain-change',
-        label: 'Planned domain change',
-        subjectRequirement: 'domain',
-        objective: 'Review an analyst-authored desired state and prepare bounded change material without changing DNS, registry, mail, or hosted configuration.',
-        limitations: Object.freeze(['Planning and packaging never apply, submit, schedule, or enforce a change.']),
-        steps: () => Object.freeze([
-            step('control', 'Review the desired-state manifest', 'domain-control', ['<review-input.json>', '--json'], 'offline', 'analyst_selection', DOMAIN_CONTROL_REVIEW_SCHEMA, 'Only supplied complete observations may produce drift.'),
-            step('assure', 'Review change and recovery assumptions', 'assurance', ['<assurance-input.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.domain-assurance', 'Record uncertainty, rollback dependencies, and unavailable evidence explicitly.'),
-            step('package', 'Build a reviewed change packet', 'change-packet', ['<change-packet-input.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.domain-change-packet', 'The packet is local reviewed material and performs no submission or enforcement.'),
-        ]),
-    }),
-    'post-change-verification': Object.freeze({
-        id: 'post-change-verification',
-        label: 'Post-change verification',
-        subjectRequirement: 'domain',
-        objective: 'Perform one explicit later observation and compare it with analyst-selected retained evidence after an authorised change.',
-        limitations: Object.freeze(['This is a one-time recheck, not monitoring setup or proof that every resolver or service has converged.']),
-        steps: () => Object.freeze([
-            step('recheck', 'Run one bounded retained-manifest review', 'monitor-once', ['<manifest.json>', '--limit', '1', '--json'], 'network', 'network_disclosure', CLI_DOMAIN_CONTROL_MONITOR_SCHEMA, 'One later observation may remain partial, unavailable, stale, or conflicting.'),
-            step('compare', 'Compare selected before and after evidence', 'diff', ['<before.json>', '<after.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.cli.lookup-diff', 'Materiality is derived from compatible retained evidence and does not infer intent.'),
-            step('record', 'Record reviewed completion material', 'change-packet', ['<post-change-input.json>', '--json'], 'offline', 'analyst_selection', 'whoisleuth.domain-change-packet', 'Recording reviewed material does not submit it or start automatic monitoring.'),
-        ]),
+const RECIPES = Object.freeze(Object.fromEntries(INVESTIGATION_PLAN_RECIPES.map((id) => [
+    id,
+    Object.freeze({
+        ...INVESTIGATION_RECIPE_DEFINITIONS[id],
+        id,
+        steps: (subject) => validatedSteps(INVESTIGATION_RECIPE_DEFINITIONS[id].steps(subject)),
     }),
-});
+])));
 export const INVESTIGATION_RECIPE_REGISTRY = RECIPES;
 export function workflowStandardInputs(recipe) {
     return RECIPES[recipe].standardInputs ?? [];
@@ -160,7 +24,12 @@ export function isRunnableInvestigationRecipe(value) {
     return RUNNABLE_INVESTIGATION_PLAN_RECIPES.includes(value);
 }
 export function workflowReviewDeclarations(step) {
-    return step.arguments.filter(argument => ['--reviewed', '--human-reviewed', '--personal-data-reviewed', '--redactions-confirmed'].includes(argument));
+    return step.arguments.filter((argument) => [
+        '--reviewed',
+        '--human-reviewed',
+        '--personal-data-reviewed',
+        '--redactions-confirmed',
+    ].includes(argument));
 }
 function recipeCatalogueEntry(recipe) {
     const exampleSubject = recipe.subjectRequirement === 'domain' ? 'example.test' : 'Example Organisation';
@@ -215,15 +84,20 @@ export function formatWorkflowRecipeCatalogue(catalogue) {
         '',
     ].join('\n');
 }
-function step(id, label, command, args, mode, approval, produces, completion) {
-    const invocationEffect = cliInvocationNetworkEffect(command, args);
-    if ((mode === 'network') !== (invocationEffect === 'network')) {
-        throw new Error(`Investigation step ${id} does not match the registered network effect for ${command}.`);
+function validatedSteps(steps) {
+    for (const step of steps) {
+        const invocationEffect = cliInvocationNetworkEffect(step.command, step.arguments);
+        if ((step.mode === 'network') !== (invocationEffect === 'network')) {
+            throw new Error(`Investigation step ${step.id} does not match the registered network effect for ${step.command}.`);
+        }
     }
-    return Object.freeze({ id, label, command, arguments: Object.freeze([...args]), mode, approval, produces, completion });
+    return steps;
 }
 function boundedSubject(value) {
-    if (typeof value !== 'string' || !value.trim() || value.length > 253 || /[\u0000-\u001f\u007f]/u.test(value)) {
+    if (typeof value !== 'string' ||
+        !value.trim() ||
+        value.length > 253 ||
+        /[\u0000-\u001f\u007f]/u.test(value)) {
         throw new TypeError('Investigation-plan subject must be bounded text without control characters.');
     }
     return value.replace(/\s+/gu, ' ').trim();
@@ -232,7 +106,9 @@ function normalizedDomain(value) {
     const candidate = domainToASCII(value.toLowerCase().replace(/\.$/u, ''));
     if (!candidate || candidate.length > 253 || !candidate.includes('.'))
         return null;
-    return candidate.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label))
+    return candidate
+        .split('.')
+        .every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label))
         ? candidate
         : null;
 }
@@ -241,7 +117,9 @@ export function buildInvestigationPlan(recipeId, subjectValue, generatedAtValue
     if (!recipe)
         throw new TypeError('Investigation-plan recipe is unsupported.');
     const suppliedSubject = boundedSubject(subjectValue);
-    const subject = recipe.subjectRequirement === 'domain' ? normalizedDomain(suppliedSubject) : suppliedSubject.toLowerCase();
+    const subject = recipe.subjectRequirement === 'domain'
+        ? normalizedDomain(suppliedSubject)
+        : suppliedSubject.toLowerCase();
     if (!subject)
         throw new TypeError('This investigation-plan recipe requires one valid domain.');
     const generatedAt = normalizeExplicitIsoTimestamp(generatedAtValue);