@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/cli/mail-header-review.mjs

@@ -1,20 +1,19 @@
 import { createHash } from 'node:crypto';
 import { Buffer } from 'node:buffer';
-import { isValidAsciiDomainName } from "../lib/hostname.mjs";
+import { MAX_MAIL_REVIEW_DOMAINS, addressDomains, messageIdDomains, authenticationServiceDomains, dkimSigningDomains, normalizeHeaderDomain } from "../packages/investigation/mail-header-identity.mjs";
+export { MAX_MAIL_REVIEW_DOMAINS } from "../packages/investigation/mail-header-identity.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { CliUsageError } from "./errors.mjs";
+import { reviewMailAuthentication, selectReceiverTrust, authenticationHeaderLabel, aggregateMailAuthentication } from "../packages/investigation/mail-authentication-review.mjs";
 export const CLI_MAIL_HEADER_REVIEW_SCHEMA = 'whoisleuth.cli.mail-header-review';
-export const CLI_MAIL_HEADER_REVIEW_VERSION = 1;
+export const CLI_MAIL_HEADER_REVIEW_VERSION = 2;
 export const MAX_MAIL_HEADER_INPUT_BYTES = 256 * 1024;
 export const MAX_MAIL_HEADER_FIELDS = 512;
 export const MAX_MAIL_HEADER_LINE_BYTES = 4 * 1024;
 export const MAX_MAIL_HEADER_VALUE_LENGTH = 16 * 1024;
 export const MAX_MAIL_RECEIVED_HOPS = 64;
-export const MAX_MAIL_REVIEW_DOMAINS = 128;
 const UNSAFE_HEADER_CONTROL_RE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f\u200b-\u200f\u202a-\u202e\u2060-\u206f]/u;
 const HEADER_NAME_RE = /^[A-Za-z0-9-]{1,78}$/u;
-const AUTHENTICATION_METHODS = Object.freeze(['spf', 'dkim', 'dmarc', 'arc']);
-const AUTHENTICATION_STATES = new Set(['fail', 'neutral', 'none', 'pass', 'permerror', 'softfail', 'temperror']);
 function boundedHeaderSection(value) {
     if (typeof value !== 'string' || !value)
         throw new CliUsageError('Mail-header review requires one UTF-8 message or header block.');
@@ -75,240 +74,6 @@ function parseHeaderFields(value) {
 function fieldsNamed(fields, name) {
     return fields.filter((field) => field.name === name).map((field) => field.value);
 }
-function normalizeHeaderDomain(value) {
-    const normalized = value.trim().toLowerCase().replace(/^\[|\]$/gu, '').replace(/\.$/u, '');
-    return isValidAsciiDomainName(normalized, { requireLowercase: true }) ? normalized : null;
-}
-function lexicalSegments(value, delimiter, trackAngles = false) {
-    const segments = [];
-    let start = 0;
-    let quoted = false;
-    let escaped = false;
-    let commentDepth = 0;
-    let angleDepth = 0;
-    for (let index = 0; index < value.length; index += 1) {
-        const character = value[index] ?? '';
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (character === '\\' && (quoted || commentDepth > 0)) {
-            escaped = true;
-            continue;
-        }
-        if (commentDepth > 0) {
-            if (character === '(')
-                commentDepth += 1;
-            else if (character === ')')
-                commentDepth -= 1;
-            continue;
-        }
-        if (quoted) {
-            if (character === '"')
-                quoted = false;
-            continue;
-        }
-        if (character === '"')
-            quoted = true;
-        else if (character === '(')
-            commentDepth = 1;
-        else if (character === ')')
-            return null;
-        else if (trackAngles && character === '<') {
-            if (angleDepth !== 0)
-                return null;
-            angleDepth = 1;
-        }
-        else if (trackAngles && character === '>') {
-            if (angleDepth !== 1)
-                return null;
-            angleDepth = 0;
-        }
-        else if (character === delimiter && angleDepth === 0) {
-            segments.push(value.slice(start, index));
-            start = index + 1;
-        }
-    }
-    if (escaped || quoted || commentDepth !== 0 || angleDepth !== 0)
-        return null;
-    segments.push(value.slice(start));
-    return segments;
-}
-function angleAddress(value) {
-    let quoted = false;
-    let escaped = false;
-    let commentDepth = 0;
-    let start = -1;
-    let end = -1;
-    for (let index = 0; index < value.length; index += 1) {
-        const character = value[index] ?? '';
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (character === '\\' && (quoted || commentDepth > 0)) {
-            escaped = true;
-            continue;
-        }
-        if (commentDepth > 0) {
-            if (character === '(')
-                commentDepth += 1;
-            else if (character === ')')
-                commentDepth -= 1;
-            continue;
-        }
-        if (quoted) {
-            if (character === '"')
-                quoted = false;
-            continue;
-        }
-        if (character === '"')
-            quoted = true;
-        else if (character === '(')
-            commentDepth = 1;
-        else if (character === ')')
-            return null;
-        else if (character === '<') {
-            if (start >= 0 || end >= 0)
-                return null;
-            start = index;
-        }
-        else if (character === '>') {
-            if (start < 0 || end >= 0)
-                return null;
-            end = index;
-        }
-    }
-    if (escaped || quoted || commentDepth !== 0 || (start >= 0) !== (end >= 0))
-        return null;
-    return start >= 0 ? value.slice(start + 1, end) : value;
-}
-function addressDomain(value) {
-    let candidate = '';
-    let quoted = false;
-    let escaped = false;
-    let commentDepth = 0;
-    const separators = [];
-    for (const character of value) {
-        if (escaped) {
-            candidate += character;
-            escaped = false;
-            continue;
-        }
-        if (character === '\\' && (quoted || commentDepth > 0)) {
-            if (quoted)
-                candidate += character;
-            escaped = true;
-            continue;
-        }
-        if (commentDepth > 0) {
-            if (character === '(')
-                commentDepth += 1;
-            else if (character === ')')
-                commentDepth -= 1;
-            continue;
-        }
-        if (quoted) {
-            candidate += character;
-            if (character === '"')
-                quoted = false;
-            continue;
-        }
-        if (character === '"') {
-            quoted = true;
-            candidate += character;
-        }
-        else if (character === '(')
-            commentDepth = 1;
-        else if (character === ')')
-            return null;
-        else {
-            if (character === '@')
-                separators.push(candidate.length);
-            candidate += character;
-        }
-    }
-    if (escaped || quoted || commentDepth !== 0 || separators.length !== 1)
-        return null;
-    const separator = separators[0] ?? -1;
-    const local = candidate.slice(0, separator).trim();
-    const domain = candidate.slice(separator + 1).trim();
-    const validLocal = /^(?:[^\s"<>(),:;@]+|"(?:[^"\\]|\\.)+")$/u.test(local);
-    if (!validLocal || !domain || /\s/u.test(domain))
-        return null;
-    return normalizeHeaderDomain(domain);
-}
-function addressDomains(values) {
-    const domains = new Set();
-    for (const value of values) {
-        const mailboxes = lexicalSegments(value, ',', true);
-        if (!mailboxes)
-            continue;
-        for (const mailbox of mailboxes) {
-            const selected = angleAddress(mailbox);
-            const domain = selected === null ? null : addressDomain(selected);
-            if (domain)
-                domains.add(domain);
-            if (domains.size >= MAX_MAIL_REVIEW_DOMAINS)
-                return [...domains].sort();
-        }
-    }
-    return [...domains].sort();
-}
-function messageIdDomains(values) {
-    return addressDomains(values.map((value) => value.replace(/[<>]/gu, '')));
-}
-function authenticationState(values, method, directValues = []) {
-    const states = new Set();
-    let observations = 0;
-    for (const value of values) {
-        const clauses = lexicalSegments(value, ';');
-        if (!clauses)
-            continue;
-        for (const clause of clauses) {
-            const match = /^\s*([a-z][a-z0-9_-]*)\s*=\s*([a-z0-9_-]+)(?=\s|$)/iu.exec(clause);
-            if (match?.[1]?.toLowerCase() === method) {
-                observations += 1;
-                const raw = (match[2] ?? '').toLowerCase();
-                states.add(AUTHENTICATION_STATES.has(raw) ? raw : 'unknown');
-            }
-        }
-    }
-    for (const value of directValues) {
-        const match = /^\s*([a-z0-9_-]+)(?=\s|\(|$)/iu.exec(value);
-        const raw = (match?.[1] ?? '').toLowerCase();
-        if (!raw)
-            continue;
-        observations += 1;
-        states.add(AUTHENTICATION_STATES.has(raw) ? raw : 'unknown');
-    }
-    return Object.freeze({
-        state: observations === 0 ? 'unknown' : states.size === 1 ? [...states][0] : 'mixed',
-        observations,
-    });
-}
-function authenticationServiceDomains(values) {
-    const output = new Set();
-    for (const value of values) {
-        const clauses = lexicalSegments(value, ';');
-        const service = normalizeHeaderDomain((clauses?.[0] ?? '').trim().split(/\s/u, 1)[0] ?? '');
-        if (service)
-            output.add(service);
-    }
-    return [...output].sort().slice(0, MAX_MAIL_REVIEW_DOMAINS);
-}
-function dkimSigningDomains(values) {
-    const output = new Set();
-    for (const value of values) {
-        for (const clause of lexicalSegments(value, ';') ?? []) {
-            const match = /^\s*d\s*=\s*([^\s;]+)/iu.exec(clause);
-            const domain = normalizeHeaderDomain(match?.[1] ?? '');
-            if (domain)
-                output.add(domain);
-        }
-    }
-    return [...output].sort().slice(0, MAX_MAIL_REVIEW_DOMAINS);
-}
 function reportedDate(values) {
     if (values.length !== 1 || values[0].length > 240)
         return null;
@@ -348,21 +113,26 @@ function addDomainRoles(store, domains, role) {
         store.set(domain, roles);
     }
 }
-export function buildCliMailHeaderReview(value, generatedAt = new Date().toISOString()) {
+export function buildCliMailHeaderReview(value, generatedAt = new Date().toISOString(), trustedHeaders = []) {
     const normalizedGeneratedAt = normalizeExplicitIsoTimestamp(generatedAt);
     if (!normalizedGeneratedAt)
         throw new CliUsageError('Mail-header review generation time must be a valid ISO 8601 timestamp.');
     const parsed = parseHeaderFields(value);
+    let authenticationReview;
+    try {
+        authenticationReview = selectReceiverTrust(reviewMailAuthentication(parsed.fields), trustedHeaders);
+    }
+    catch (cause) {
+        if (cause instanceof TypeError)
+            throw new CliUsageError(cause.message);
+        throw cause;
+    }
     const fromDomains = addressDomains(fieldsNamed(parsed.fields, 'from'));
     const replyToDomains = addressDomains(fieldsNamed(parsed.fields, 'reply-to'));
     const returnPathDomains = addressDomains(fieldsNamed(parsed.fields, 'return-path'));
     const messageIdentifierDomains = messageIdDomains(fieldsNamed(parsed.fields, 'message-id'));
     const authenticationResults = fieldsNamed(parsed.fields, 'authentication-results');
-    const receivedSpf = fieldsNamed(parsed.fields, 'received-spf');
-    const authentication = Object.fromEntries(AUTHENTICATION_METHODS.map((method) => [
-        method,
-        authenticationState(authenticationResults, method, method === 'spf' ? receivedSpf : []),
-    ]));
+    const authentication = aggregateMailAuthentication(authenticationReview);
     const authServiceDomains = authenticationServiceDomains(authenticationResults);
     const signerDomains = dkimSigningDomains(fieldsNamed(parsed.fields, 'dkim-signature'));
     const receivedValues = fieldsNamed(parsed.fields, 'received');
@@ -414,6 +184,7 @@ export function buildCliMailHeaderReview(value, generatedAt = new Date().toISOSt
             messageIdentifierDomains: Object.freeze(messageIdentifierDomains),
         }),
         authentication: Object.freeze(authentication),
+        authenticationReview,
         routing: Object.freeze({
             receivedHops: Object.freeze(receivedHops),
             omittedReceivedHops,
@@ -428,6 +199,7 @@ export function buildCliMailHeaderReview(value, generatedAt = new Date().toISOSt
         limitations: Object.freeze([
             'This review parses analyst-selected message headers offline. It makes no DNS, SMTP, HTTP, registry or provider request.',
             'Authentication results are claims reported in the supplied headers; they are not independently validated here.',
+            'Receiver trust is an explicit analyst selection for an exact header, not a conclusion from a matching service name. Aggregate counts combine all reported sources, not a trusted verdict.',
             'Exact-domain alignment is descriptive. Divergence can be legitimate and does not establish spoofing, abuse or maliciousness.',
             'Display names, subjects, address local parts, message bodies, attachments and raw header values are not retained in the output.',
             ...(omittedReceivedHops ? [`${omittedReceivedHops} older Received header${omittedReceivedHops === 1 ? ' was' : 's were'} omitted by the ${MAX_MAIL_RECEIVED_HOPS}-hop bound.`] : []),
@@ -444,8 +216,13 @@ export function formatCliMailHeaderReview(document) {
         `Reply-To domains   ${document.identity.replyToDomains.join(', ') || 'Unavailable'}`,
         `Return-Path        ${document.identity.returnPathDomains.join(', ') || 'Unavailable'}`,
         '',
-        'Reported authentication',
-        ...AUTHENTICATION_METHODS.map((method) => `  ${method.toUpperCase().padEnd(6)} ${document.authentication[method].state} (${document.authentication[method].observations} observation${document.authentication[method].observations === 1 ? '' : 's'})`),
+        'Authentication by source header',
+        ...document.authenticationReview.headers.flatMap(header => [
+            `  ${authenticationHeaderLabel(header)} · ${header.state} · receiver trust: ${header.receiverTrust.replaceAll('_', ' ')}`,
+            ...header.claims.map(claim => `    ${claim.method.toUpperCase()}/${claim.methodVersion}: ${claim.result}${claim.state === 'unsupported' ? ' (unsupported)' : ''}${claim.domains.map(value => ` · ${value.property}=${value.domain}`).join('')}${claim.duplicateProperties.length ? ` · ambiguous: ${claim.duplicateProperties.join(', ')}` : ''}`),
+            ...(header.duplicateOf ? [`    Duplicate of header ${header.duplicateOf} in this part.`] : []),
+            ...header.issues.map(issue => `    ${issue}`),
+        ]),
         '',
         'Exact-domain alignment',
         `  From / Reply-To     ${document.alignment.fromToReplyTo}`,

package/cli/mail-review.mjs

@@ -1,11 +1,13 @@
 import { Buffer } from 'node:buffer';
 import { getDomain } from 'tldts';
-import { scanBoundedJson } from "../lib/bounded-json.mjs";
-import { isValidAsciiDomainName } from "../lib/hostname.mjs";
+import { scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
+import { compareCodeUnits } from "../lib/bounded-contract-normalizers.mjs";
+import { isValidAsciiDomainName } from "../packages/contracts/domain-name.mjs";
 import { isRecord, recordOrEmpty } from "../lib/json-record.mjs";
 import { classifyQuery } from "../lib/classify.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { CliUsageError } from "./errors.mjs";
+import { PASSIVE_MAIL_INTERPRETATION, PASSIVE_MAIL_LABELS } from "../packages/contracts/passive-mail.mjs";
 export const CLI_MAIL_REVIEW_SCHEMA = 'whoisleuth.cli.mail-review';
 export const CLI_MAIL_REVIEW_VERSION = 4;
 export const MAX_MAIL_REVIEW_INPUT_BYTES = 16 * 1024 * 1024;
@@ -326,7 +328,7 @@ function buildCliMailReview(textValue, generatedAt = new Date().toISOString()) {
             limitation: 'Shared mail providers are common and do not establish common ownership, control, intent, safety, or maliciousness.',
         };
     })
-        .sort((left, right) => left.providerDomain.localeCompare(right.providerDomain));
+        .sort((left, right) => compareCodeUnits(left.providerDomain, right.providerDomain));
     const providerRelationships = allProviderRelationships.slice(0, 100);
     const rowsWithIncompleteDns = rows.filter((row) => row.dnsStatus !== 'success' || row.hasMx === null || row.hasNullMx === null).length;
     const providerCoverage = {
@@ -355,7 +357,7 @@ function buildCliMailReview(textValue, generatedAt = new Date().toISOString()) {
         providerCoverage,
         limitations: [
             'This review is passive and uses DNS evidence already retained in a WHOISleuth Bulk result; it makes no network request.',
-            'Null MX, no explicit MX, receiving mail, authentication gaps, and incomplete evidence remain separate states.',
+            PASSIVE_MAIL_INTERPRETATION,
             'SMTP delivery, mailbox existence, catch-all behaviour, banner collection, and message acceptance were not tested.',
             ...(failedRows.length ? [`${failedRows.length} input target${failedRows.length === 1 ? '' : 's'} failed collection and cannot contribute mail evidence. Input positions and normalised targets are retained; consult the original input for failure diagnostics.`] : []),
             ...(rowsWithIncompleteDns ? [`${rowsWithIncompleteDns} reviewed domain${rowsWithIncompleteDns === 1 ? ' has' : 's have'} incomplete DNS evidence; unobserved provider relationships remain unknown.`] : []),
@@ -371,15 +373,15 @@ function formatCliMailReview(document) {
         `Input targets    ${document.inputCoverage.inputRows}`,
         `Domains          ${document.rows.length}`,
         `Failed targets   ${document.inputCoverage.failedRows}`,
-        `Authenticated    ${document.counts.authenticated_mail}`,
-        `Auth gaps        ${document.counts.mail_auth_gap}`,
+        `MX + SPF + DMARC ${document.counts.authenticated_mail}`,
+        `DNS policy gaps  ${document.counts.mail_auth_gap}`,
         `Null MX          ${document.counts.null_mx}`,
         `No explicit MX   ${document.counts.no_explicit_mx}`,
         `Incomplete       ${document.counts.evidence_incomplete + document.counts.mail_auth_incomplete + document.inputCoverage.failedRows}`,
         '',
     ];
     for (const row of document.rows) {
-        lines.push(`${row.domain}  ${row.state.replaceAll('_', ' ')}`);
+        lines.push(`${row.domain}  ${PASSIVE_MAIL_LABELS[row.state]}`);
         lines.push(`  Observed      ${row.provenance.observedAt ?? 'unknown'} · ${row.provenance.collectionOrigin.replaceAll('_', ' ')}`);
         lines.push(`  DNS observed  ${row.provenance.dnsObservedAt ?? 'unknown'} · Source output ${row.provenance.sourceGeneratedAt}`);
         lines.push(`  MX providers  ${row.providerDomains.join(', ') || 'None observed'}${row.providerDomainsOmitted ? ` · +${row.providerDomainsOmitted} omitted` : ''}`);

package/cli/network-arguments.mjs

@@ -0,0 +1,51 @@
+import {} from "./command-argument-grammar.mjs";
+import { commandDefaultText } from "./command-reference.mjs";
+import { NETWORK_COMMAND_DEFINITIONS } from "./network-command-definitions.mjs";
+import { terminalOptions, jsonOutput, parseOutput, singleInputAction, } from "./argument-values.mjs";
+function parsePostureArguments(parsed) {
+    const mailProfile = parsed.optionValue('--mail-profile') ?? commandDefaultText('posture', '--mail-profile');
+    return {
+        action: 'posture',
+        domain: parsed.positionalValue('domain'),
+        output: parseOutput(parsed, NETWORK_COMMAND_DEFINITIONS.posture),
+        selectorText: parsed.optionValue('--selectors'),
+        retiredSelectorText: parsed.optionValue('--retired-selectors'),
+        mailProfile: mailProfile === 'defensive-no-mail'
+            ? 'defensive_no_mail'
+            : mailProfile,
+        ownedDomain: parsed.hasOption('--owned-domain'),
+        ...(parsed.hasOption('--include-inherited-dns') ? { includeInheritedDns: true } : {}),
+        ...terminalOptions(parsed),
+    };
+}
+function parseDnssecValidateArguments(parsed) {
+    return {
+        action: 'dnssec-validate',
+        target: parsed.positionalValue('domain'),
+        resolver: parsed.optionValue('--resolver'),
+        trustAnchorSource: parsed.optionValue('--trust-anchor'),
+        ownedOrAuthorized: true,
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    };
+}
+function parseMailTransportArguments(parsed) {
+    return {
+        action: 'mail-transport',
+        source: parsed.positionalValue('source'),
+        resolver: parsed.optionValue('--resolver'),
+        trustAnchorSource: parsed.optionValue('--trust-anchor'),
+        ownedOrAuthorized: true,
+        activeProbeAcknowledged: true,
+        output: jsonOutput(parsed),
+        ...terminalOptions(parsed),
+    };
+}
+export const NETWORK_ARGUMENT_PARSERS = Object.freeze({
+    'ct-search': (parsed) => singleInputAction('ct-search', parsed, 'keyword'),
+    posture: parsePostureArguments,
+    http: (parsed) => singleInputAction('http', parsed, 'domain'),
+    tls: (parsed) => singleInputAction('tls', parsed, 'hostname'),
+    'dnssec-validate': parseDnssecValidateArguments,
+    'mail-transport': parseMailTransportArguments,
+});

package/cli/network-command-definitions.mjs

@@ -0,0 +1,130 @@
+import { positional, OPTIONAL_FILE_POSITIONAL, constraint, EMPTY_CONSTRAINTS, commandSeed } from "./command-definition.mjs";
+export const NETWORK_COMMAND_DEFINITIONS = Object.freeze({
+    "ct-search": commandSeed({
+        reference: {
+            description: 'Search certificate-transparency observations for one bounded keyword.',
+            example: 'whoisleuth ct-search "example brand" --json',
+            boundary: 'Certificate observations do not prove website activity, registration ownership, or malicious intent.',
+        },
+        collection: { scope: 'Accepts one bounded search keyword and queries the fixed certificate-transparency source.' },
+        summary: 'Search certificate observations',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('keyword', 'text', 0, 1, [], 'argv_or_stdin')]),
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'network',
+        networkEffect: 'always_network',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.ct-search']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    posture: commandSeed({
+        reference: {
+            description: 'Review bounded DNS mail, delegation, and domain-control posture.',
+            example: 'whoisleuth posture example.test --mail-profile standard --json',
+            boundary: 'Missing or failed DNS observations remain inconclusive. --include-inherited-dns adds inherited policy and reporting-boundary reviews within 32 additional TXT queries and ten seconds, plus a direct parent-delegation sample. No message is sent and receiver enforcement is not inferred.',
+        },
+        collection: { scope: 'Accepts one domain and performs bounded RDAP, DNS, and conditional MTA-STS HTTPS requests. --include-inherited-dns separately adds ancestor and reporting-destination DMARC questions and direct DNS/TCP to sampled parent servers.' },
+        summary: 'Review DNS and mail posture',
+        options: ['--selectors', '--retired-selectors', '--mail-profile', '--include-inherited-dns', '--json', '--sarif', '--owned-domain', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('domain', 'text', 0, 1, [], 'argv_or_stdin')]),
+        constraints: Object.freeze([
+            constraint({ kind: 'mutually_exclusive', options: ['--json', '--sarif'] }),
+            constraint({ kind: 'requires_all', option: '--sarif', requiredOptions: ['--owned-domain'] }),
+        ]),
+        handlerOwner: 'network',
+        networkEffect: 'always_network',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.posture']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    http: commandSeed({
+        reference: {
+            description: 'Inspect one homepage request, redirects, and bounded response metadata.',
+            example: 'whoisleuth http example.test --json',
+            boundary: 'Requests use the shared public-address and redirect guards. Fixed content-coding and cache-policy metadata describes only the selected response, excludes raw header values, and does not prove caching, transfer savings, performance, privacy, or safety. This is not a rendered browser or vulnerability scan.',
+        },
+        collection: { scope: 'Accepts one domain and follows only the bounded SSRF-guarded homepage redirect workflow.' },
+        summary: 'Inspect one homepage request',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('domain', 'text', 0, 1, [], 'argv_or_stdin')]),
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'network',
+        networkEffect: 'always_network',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.http']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    tls: commandSeed({
+        reference: {
+            description: 'Inspect one hostname certificate through a bounded TLS connection.',
+            example: 'whoisleuth tls example.test --json',
+            boundary: 'One observed connection is point-in-time evidence and does not establish every address, edge, or historical certificate.',
+        },
+        collection: { scope: 'Accepts one public hostname and opens one bounded certificate connection.' },
+        summary: 'Inspect one TLS connection',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('hostname', 'text', 0, 1, [], 'argv_or_stdin')]),
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'network',
+        networkEffect: 'always_network',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.tls']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "dnssec-validate": commandSeed({
+        reference: {
+            description: 'Cryptographically validate one authorised DNSSEC chain from a supplied trust anchor through one selected public resolver.',
+            example: 'whoisleuth dnssec-validate example.test --resolver "$PUBLIC_RESOLVER_IP" --trust-anchor anchor.json --owned-or-authorized --json',
+            boundary: 'This isolated action is never invoked by Lookup, Bulk, monitoring, or recipes. It caps DNS queries, aliases, delegations, bytes, and duration; transport and validation failures remain separate, and secure is not a general safety verdict.',
+        },
+        collection: { scope: 'Accepts one authorised domain, one public resolver IP, and one local trust-anchor file; DNS-over-TCP validation is capped at 32 queries and 15 seconds.' },
+        summary: 'Validate an authorised DNSSEC chain',
+        options: ['--resolver', '--trust-anchor', '--owned-or-authorized', '--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('domain', 'text', 1, 1)]),
+        constraints: Object.freeze([
+            constraint({ kind: 'required', options: ['--resolver', '--trust-anchor', '--owned-or-authorized'] }),
+        ]),
+        handlerOwner: 'network',
+        networkEffect: 'always_network',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.dnssec-chain-validation', 'whoisleuth.dnssec-trust-anchor']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "mail-transport": commandSeed({
+        reference: {
+            description: 'Review selected authorised MX endpoints, DNSSEC-qualified TLSA evidence, SMTP capabilities, and optional STARTTLS certificates.',
+            example: 'whoisleuth mail-transport selected-mx.json --resolver "$PUBLIC_RESOLVER_IP" --trust-anchor anchor.json --owned-or-authorized --active-probe --json',
+            boundary: 'This isolated action probes at most three selected MX hosts sequentially, reports selection, public revalidation, connection, and address authentication separately, sends only EHLO and optional STARTTLS, never retries, and performs no authentication, relay, recipient, mailbox, catch-all, or message test. If a DANE-TA TLSA usage 2 association is published, active collection retains only the leaf certificate and leaves that comparison partial without certificate-path construction and trust-anchor path validation. SMTP relay PKIX-TA usage 0 and PKIX-EE usage 1 records remain unsupported and cannot complete SMTP DANE assurance; a separate usage 3 match remains eligible.',
+        },
+        collection: { scope: 'Accepts at most three selected authorised MX hosts, uses one public resolver, and performs sequential bounded SMTP connections with no retries.' },
+        summary: 'Review selected authorised SMTP transports',
+        options: ['--resolver', '--trust-anchor', '--owned-or-authorized', '--active-probe', '--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: Object.freeze([
+            constraint({ kind: 'required', options: ['--resolver', '--trust-anchor', '--owned-or-authorized', '--active-probe'] }),
+        ]),
+        handlerOwner: 'network',
+        networkEffect: 'always_network',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.mail-transport.input', 'whoisleuth.cli.mail-transport-review']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+});