@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/cli/review-command-definitions.mjs

@@ -0,0 +1,279 @@
+import { CASE_SCHEMA_VERSION, CLI_CASE_PACK_INPUT_CASE_VERSIONS, MAX_CASE_STORE_BYTES, MAX_EDITABLE_CASE_INPUT_BYTES } from "../packages/contracts/case-portability.mjs";
+import { MESSAGE_INTAKE_KINDS, MESSAGE_INTAKE_SCHEMA } from "../packages/contracts/message-intake.mjs";
+import { IDENTITY_EVENTS_INPUT_SCHEMA } from "../packages/contracts/identity-events.mjs";
+import { CONTEXT_INPUT_SCHEMAS, CONTEXT_REVIEW_SCHEMA } from "../packages/contracts/context-review.mjs";
+import { CASE_CONTAINMENT_INPUT_SCHEMA, CASE_CONTAINMENT_HANDOFF_SCHEMA } from "../packages/cases/case-containment-handoff.mjs";
+import { INTAKE_CONTEXT_SCHEMA } from "../packages/investigation/intake-context.mjs";
+import { MANAGED_INDICATOR_SET_SCHEMA, MAX_MANAGED_INDICATOR_SET_BYTES, MAX_MANAGED_INDICATOR_PLAN_BYTES } from "../packages/contracts/analyst-interchange.mjs";
+import { CLI_CASE_OPERATIONS, CLI_INDICATOR_OPERATIONS, positional, OPTIONAL_FILE_POSITIONAL, constraint, EMPTY_CONSTRAINTS, commandSeed } from "./command-definition.mjs";
+export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
+    "verify-artifact": commandSeed({
+        reference: {
+            description: 'Validate a supported archive, ordinary Case export, claim passport, packet, manifest, saved Lookup or Lookup-evidence export without printing evidence contents. Use --package for an evidence ZIP or encrypted package, with --passphrase-file to unlock it; use --folder ./evidence for an unencrypted evidence folder. Add --bagit with --package or --folder to verify BagIt 1.0.',
+            example: 'whoisleuth verify-artifact report.json --manifest manifest.json --manifest-entry artifact-2 --json --strict-exit',
+            boundary: 'Verification is offline and redacted. ZIP and folder entries are reported separately without importing them. Case exports are checked without repairing content; ordinary package review also counts original references with matching bytes. Ordinary folders allow only the declared layout; BagIt allows bounded nested payloads and checks SHA-256/SHA-512 manifests without interpreting payloads. Symbolic links are refused. BagIt fetch.txt is never fetched; missing files, mismatches and unsupported algorithms remain explicit. Package digests describe bytes, not filesystem metadata or authenticity. In scripts, use --strict-exit: incomplete verification returns 4. Unencrypted workspace archives always return 4 under --strict-exit because section digests do not cover mutable root metadata; structure-only formats can pass their narrower contract. Default exit 0 means the report was produced, not that its checks passed.',
+        },
+        collection: { scope: 'Reads one selected bounded artefact, ZIP or explicit evidence folder and, when explicitly supplied, one manifest whose selected entry is compared by exact bytes and canonical identity.' },
+        summary: 'Validate saved evidence offline',
+        options: ['--passphrase-file', '--manifest', '--manifest-entry', '--package', '--bagit', '--folder', '--json', '--strict-exit', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('source', 'file', 0, 1, [], 'argv_or_stdin', ['--package'])]),
+        constraints: Object.freeze([
+            constraint({ kind: 'requires_any', option: '--bagit', requiredOptions: ['--package', '--folder'] }),
+            constraint({ kind: 'excludes_all', option: '--bagit', excludedOptions: ['--passphrase-file', '--manifest', '--manifest-entry'] }),
+            constraint({ kind: 'requires_all', option: '--manifest', requiredOptions: ['--manifest-entry'] }),
+            constraint({ kind: 'requires_all', option: '--manifest-entry', requiredOptions: ['--manifest'] }),
+            constraint({ kind: 'excludes_all', option: '--package', excludedOptions: ['--manifest', '--manifest-entry'] }),
+            constraint({ kind: 'excludes_all', option: '--folder', excludedOptions: ['--package', '--manifest', '--manifest-entry', '--passphrase-file'] }),
+        ]),
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.offline-artifact-verification']),
+        primaryArtefacts: Object.freeze(['Offline verification report']),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "interchange-report": commandSeed({
+        reference: {
+            description: 'Report what one recognised portable artefact preserves, excludes, and supports across browser and CLI workflows.',
+            example: 'whoisleuth interchange-report workspace.json --json',
+            boundary: 'The report is offline and metadata-only. It does not echo targets, contacts, notes, passphrases, evidence values, or an unrecognised schema string.',
+        },
+        collection: { scope: 'Reads one selected bounded portable artefact and emits fixed compatibility metadata only.' },
+        summary: 'Report portable artefact fidelity offline',
+        options: ['--passphrase-file', '--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.interchange-fidelity-report']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "source-report": commandSeed({
+        reference: {
+            description: 'Create a target-free reliability summary from a saved lookup.',
+            example: 'whoisleuth source-report lookup.json --json',
+            boundary: 'The report retains source states and timings but excludes targets, queries, endpoints, and raw evidence.',
+        },
+        collection: { scope: 'Reads bounded saved evidence and emits target-free source reliability data.' },
+        summary: 'Build a target-free source report',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.source-reliability-report']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    compare: commandSeed({
+        reference: {
+            description: 'Compare separately attributed registry publications in a saved lookup.',
+            example: 'whoisleuth compare lookup.json --json',
+            boundary: 'Comparison is offline. Differences are review context and do not by themselves prove which publication is current.',
+        },
+        collection: { scope: 'Reads one saved Lookup and compares its separately attributed registry publications.' },
+        summary: 'Compare registry publications in one lookup',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.compare']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "page-compare": commandSeed({
+        reference: {
+            description: 'Compare static page identity, favicon, technology, and TLS evidence in two saved deep lookups.',
+            example: 'whoisleuth page-compare official.json candidate.json --json',
+            boundary: 'Comparison is offline and component-based. It executes no page code and produces no aggregate similarity or maliciousness score.',
+        },
+        collection: { scope: 'Reads two saved Lookup documents and executes no page code.' },
+        summary: 'Compare saved static page evidence',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('sources', 'file', 2, 2)]),
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.page-compare']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "mail-review": commandSeed({
+        reference: {
+            description: 'Review passive MX, null MX, SPF, DMARC, and shared mail-provider evidence from saved Bulk results.',
+            example: 'whoisleuth mail-review candidates.json --json',
+            boundary: 'Review is offline and sends no SMTP traffic. Missing or partial DNS evidence remains inconclusive.',
+        },
+        collection: { scope: 'Reads one saved Bulk result and sends no DNS or SMTP traffic.' },
+        summary: 'Review saved passive mail evidence',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.mail-review']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "mail-headers": commandSeed({
+        reference: {
+            description: 'Review identity, reported authentication, domain alignment, and Received routing from selected message headers.',
+            example: 'whoisleuth mail-headers message.eml --json',
+            boundary: 'Review is offline. It makes no DNS, SMTP, HTTP, registry, or provider request, and does not retain address local parts, display names, subjects, message bodies, attachments, or raw header values. Reported authentication is not independently validated.',
+        },
+        collection: { scope: 'Parses only the bounded header block from one selected message or standard input.' },
+        summary: 'Review message headers offline',
+        options: ['--trusted-auth-header', '--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.mail-header-review']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    intake: commandSeed({
+        reference: {
+            description: 'Review selected messages, indicators, document links, QR destinations, HTTP archives or identity events locally. Plain text offers phone candidates; --intake-context adds explicit selections and source declarations.',
+            example: 'whoisleuth intake email message.eml --json',
+            boundary: 'Offline only: no destination, embedded command, phone number or QR payload is opened, contacted or executed. Output omits original bodies, subjects, address local parts, URL paths, queries and fragments. Literal IPs and labelled hashes are bounded text observations, not lookup targets or verdicts; headers, URL contents, QR, HAR and identity-event fields are not scanned for them. Plain-text phone discovery writes only counts, source digest, ranges and status to stderr; --quiet suppresses it. Optional --intake-context reads one separate file up to 8 KiB, not stdin. Version 1 carries distribution declarations; version 2 can also bind explicit phone selections and a supplied destination pair to the exact input digest. Selected phone strings and source declarations enter output; unselected candidates and exact private URLs do not. Authentication headers remain attributed claims. Selected PDF and DOCX review retains part identities and extraction coverage; embedded raster QR support does not imply complete rendered-page review. HAR retains minimised request order and timings, never replay authority, headers, cookies or bodies. Use --strict-exit to return 4 for partial coverage.',
+        },
+        collection: { scope: 'Reads one selected text, MIME email, calendar, PNG, PDF, DOCX, HAR or identity-event JSON file and, only with --intake-context, one bounded declaration/selection file. No collection or automatic Case write.' },
+        summary: 'Review selected files and identity events offline',
+        options: ['--json', '--reported-action', '--trusted-auth-header', '--intake-context', '--strict-exit', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('kind', 'enum', 1, 1, MESSAGE_INTAKE_KINDS), positional('source', 'file', 0, 1, [], 'argv_or_stdin')]),
+        constraints: EMPTY_CONSTRAINTS, handlerOwner: 'review', networkEffect: 'offline', common: true,
+        schemaIdentifiers: Object.freeze([MESSAGE_INTAKE_SCHEMA, INTAKE_CONTEXT_SCHEMA, IDENTITY_EVENTS_INPUT_SCHEMA]), primaryArtefacts: Object.freeze([]),
+        planSupport: false, additionalOutputFormats: Object.freeze([]), bootstrapProfile: 'allowed',
+    }),
+    "review-evidence": commandSeed({
+        reference: {
+            description: 'Review versioned protocol evidence, source-qualified infrastructure snapshots/comparisons, incident sequences, domain history, platform objects, storefronts, connector configuration or an explicitly selected internal containment handoff offline.',
+            example: 'whoisleuth review-evidence domain-change.json --json --strict-exit',
+            boundary: 'The command reads only the supplied document and, with --mmdb, one explicitly selected local database up to 512 MiB. MMDB parsing and lookup run in one disposable worker with a ten-second processing deadline and an 8 KiB result limit. Version-2 MMDB queries require a justified age policy; unavailable or partial current reviews return 4 under --strict-exit. Historical version-1 MMDB queries preserve their output without freshness admission. Domain-history v2 accepts explicit source-linked registration boundaries; v1 retains its original semantics. Internal containment selects retained next-step assertions and supporting pins after explicit audience-disclosure review; it does not change their state or execute controls. No database is bundled, downloaded, updated or transmitted. It performs no DNS, RDAP, BGP, GeoIP-provider, TLS, HTTP, certificate-authority, or SMTP request.',
+        },
+        collection: { scope: 'Reads one bounded versioned evidence or request-planning document and, only with --mmdb, one selected bounded local database. Performs no collection.' },
+        summary: 'Review supplied evidence offline',
+        options: ['--mmdb', '--json', '--strict-exit', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: true,
+        schemaIdentifiers: Object.freeze([
+            CONTEXT_REVIEW_SCHEMA,
+            CASE_CONTAINMENT_INPUT_SCHEMA,
+            CASE_CONTAINMENT_HANDOFF_SCHEMA,
+            ...CONTEXT_INPUT_SCHEMAS,
+            'whoisleuth.cli.offline-evidence-review',
+            'whoisleuth.rdap-search-input',
+            'whoisleuth.dnssec-evidence-input',
+            'whoisleuth.tlsa-evidence-input',
+            'whoisleuth.rpki-route-input',
+            'whoisleuth.local-geoip-query',
+            'whoisleuth.local-mmdb-query',
+            'whoisleuth.local-mmdb-review',
+            'whoisleuth.encrypted-dns-plan-input',
+            'whoisleuth.infrastructure-observation',
+            'whoisleuth.infrastructure-comparison.input',
+        ]),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    brief: commandSeed({
+        reference: {
+            description: 'Turn one saved Lookup into a compact decision brief with facts, unknowns, contradictions, and next actions.',
+            example: 'whoisleuth brief lookup.json --json',
+            boundary: 'The command is offline, excludes raw upstream payloads, and does not create an analyst assertion or claim that the saved observation is current.',
+        },
+        collection: { scope: 'Reads one bounded saved Lookup and emits a compact source-attributed decision brief.' },
+        summary: 'Build a decision brief from a saved lookup',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.lookup-brief']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    case: commandSeed({
+        reference: {
+            description: 'Show or open a local Case, append a note or evidence pin, link evidence, record an assessment or offline recheck, retain an incident-link, create an action, append an action-event, save a recheck-question, or close-object. JSON mutations use --input; notes use --text or --note-file. Link input contains fromPinId, toPinId, kind and basis. Action-event input contains id and transition. Explicit responseObjects bind an action; a typed objectOutcome requires an explicit affected subset on its event. Object closure never closes other objects or the Case. Mutations require --output and write the complete current Case export.',
+            example: 'whoisleuth case open --domain example.test --output cases.json\n  whoisleuth case show cases.json\n  whoisleuth case note cases.json --text "Review the retained observation" --output cases.json --force',
+            boundary: 'No database, browser launch, request or external report is created. Select --case-id when a file contains multiple Cases. Existing files require --force; --expect-file-digest sha256:<digest> additionally checks the exact file reviewed earlier. Source and output leases reject concurrent changes. Interrupted .workflow.lock files require deliberate inspection. Recheck records supplied observations; it does not collect them. Not reproduced requires an existing saved question, a complete observation and comparable conditions. Working exports include private analyst content and file references, not attached file bytes.',
+        },
+        collection: { scope: `Reads exact Case schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')}. Input is bounded to ${MAX_EDITABLE_CASE_INPUT_BYTES / 1024 / 1024} MiB including formatting; the complete canonical Case store must fit ${MAX_CASE_STORE_BYTES / 1024 / 1024} MiB without pruning. Writes current schema ${CASE_SCHEMA_VERSION}.` },
+        summary: 'Review and update ordinary local Case files',
+        options: ['--case-id', '--domain', '--title', '--new-incident', '--text', '--note-file', '--input', '--expect-file-digest', '--json', '--no-color'],
+        positionals: Object.freeze([positional('operation', 'enum', 1, 1, CLI_CASE_OPERATIONS), positional('source', 'file', 0, 1)]),
+        constraints: Object.freeze([constraint({ kind: 'mutually_exclusive', options: ['--text', '--note-file'] })]),
+        handlerOwner: 'review', networkEffect: 'offline', common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.case-export']),
+        primaryArtefacts: Object.freeze(['Case export']), planSupport: false,
+        additionalOutputFormats: Object.freeze([]), bootstrapProfile: 'allowed',
+    }),
+    'indicator-set': commandSeed({
+        reference: {
+            description: 'Create or revise a file-based indicator set, inspect its identities and review windows, or export the exact revision as STIX or MISP JSON. Revise takes a plan containing basis, name, expiresAt, reviewed rows and selectedDomains; later plans embed previous and explicitly select renewIds, withdrawIds or reintroduceDomains. Use --json with revise to retain the manifest. STIX and MISP operations always output JSON.',
+            example: 'whoisleuth indicator-set revise indicator-plan.json --json --output indicators.json\n  whoisleuth indicator-set inspect indicators.json\n  whoisleuth indicator-set stix indicators.json --output indicators.stix.json',
+            boundary: 'Offline files only; no submission, feed synchronisation or automatic deletion. Missing candidates are unchanged. Renewal changes the review window, not the original observation. Withdrawn identities stay withdrawn; reintroduction requires a new identity. Keep prior manifests: a digest verifies content, not authorship or the complete revision chain. MISP expiry is a review deadline, not automatic enforcement.',
+        },
+        collection: { scope: `Reads a selected ${MAX_MANAGED_INDICATOR_PLAN_BYTES / 1024 / 1024} MiB revision plan or ${MAX_MANAGED_INDICATOR_SET_BYTES / 1024 / 1024} MiB manifest. Makes no requests and does not alter the source file.` },
+        summary: 'Manage reviewed indicator revisions offline',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('operation', 'enum', 1, 1, CLI_INDICATOR_OPERATIONS), positional('source', 'file', 0, 1)]),
+        constraints: EMPTY_CONSTRAINTS, handlerOwner: 'review', networkEffect: 'offline', common: false,
+        schemaIdentifiers: Object.freeze([MANAGED_INDICATOR_SET_SCHEMA]), primaryArtefacts: Object.freeze(['Managed indicator revision']),
+        planSupport: false, additionalOutputFormats: Object.freeze([]), bootstrapProfile: 'allowed',
+    }),
+    "case-pack": commandSeed({
+        reference: {
+            description: `Package browser-created Case records from schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')} as a reviewed, audience-specific Case-pack v2 with current schema ${CASE_SCHEMA_VERSION}.`,
+            example: 'whoisleuth case-pack cases.json --audience trusted --reviewed --json',
+            boundary: 'The command creates a separate offline package without changing the source or durable Cases and requires an explicit review acknowledgement. Every audience, including public, retains domain evidence, Case, pin and decision identifiers, tags, decision summaries and rationale. Review that analyst-authored content as well as the exclusions before sharing.',
+        },
+        collection: { scope: `Reads one bounded Case export from schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')} and writes a separate audience-specific Case-pack v2.` },
+        summary: 'Build a reviewed case package',
+        options: ['--audience', '--reviewed', '--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: Object.freeze([
+            constraint({ kind: 'required', options: ['--audience', '--reviewed'] }),
+        ]),
+        handlerOwner: 'review',
+        networkEffect: 'offline',
+        common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.case-pack', 'whoisleuth.case-report']),
+        primaryArtefacts: Object.freeze(['Reviewed Case-pack v2']),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+});

package/cli/review-command-runner.mjs

@@ -1,3 +1,6 @@
+import { runIntakeCommand } from "./intake-command.mjs";
+import { runIndicatorSetCommand } from "./indicator-set-command.mjs";
+import { CONTEXT_REVIEW_KINDS } from "../packages/contracts/context-review.mjs";
 import { readBoundedRegularFile } from "../lib/bounded-file.mjs";
 import { MAX_ENCRYPTED_INVESTIGATION_PACKAGE_BYTES } from "../packages/contracts/investigation-package-limits.mjs";
 import { verifyOfflineInvestigationFolder, verifyOfflineInvestigationPackage } from "./investigation-package-review.mjs";
@@ -9,6 +12,7 @@ import { MAX_OFFLINE_ARTIFACT_BYTES, formatOfflineArtifactVerification, isComple
 import { MAX_CASE_PACK_INPUT_BYTES, buildCliCasePack, formatCliCasePack } from "./case-pack.mjs";
 import { MAX_COMPARE_INPUT_BYTES, compareLookupDocument, parseCliLookupDocument, } from "./compare.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
+import { LOCAL_MMDB_REVIEW_SCHEMA, LOCAL_MMDB_REVIEW_VERSION } from "./local-mmdb-review.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 import { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, buildOfflineEvidenceReview, buildOfflineEvidenceReviewWithLocalResources, formatOfflineEvidenceReview, } from "./offline-evidence-review.mjs";
 import { buildCliLookupBrief, formatCliLookupBrief } from "./lookup-brief.mjs";
@@ -23,6 +27,28 @@ import { formatTerminalCompare } from "./formatters/terminal.mjs";
 import { MAX_SAVED_LOOKUP_INPUT_BYTES } from "./saved-lookup.mjs";
 import { REVIEW_INLINE_COMMANDS } from "./inline-command-families.mjs";
 import { runDiscriminatedCommandHandler } from "./discriminated-command-handlers.mjs";
+/** Readers retain their command-specific bounds and injection points. Only
+ * usage-error presentation and empty-input handling are shared. */
+async function readReviewInput(read, label, emptyMessage) {
+    let input;
+    try {
+        input = await read();
+    }
+    catch (error) {
+        if (error instanceof CliUsageError)
+            throw error;
+        throw new CliUsageError(`Could not read ${label}: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+    }
+    if (emptyMessage && !input.trim())
+        throw new CliUsageError(emptyMessage);
+    return input;
+}
+function writeReviewReport(context, args, report, format) {
+    if (!args.quiet)
+        context.writeStdout(args.output === 'json'
+            ? formatJsonDocument(report)
+            : context.terminal(format(report), args.color));
+}
 async function runVerifyArtifactCommand(args, dependencies, context) {
     context.setFailureLabel('Artefact verification');
     if (args.folder) {
@@ -37,8 +63,7 @@ async function runVerifyArtifactCommand(args, dependencies, context) {
         }
         const report = await (args.bagit ? verifyOfflineBagIt : verifyOfflineInvestigationFolder)(files);
         dependencies.signal?.throwIfAborted();
-        if (!args.quiet)
-            context.writeStdout(args.output === 'json' ? formatJsonDocument(report) : context.terminal(formatOfflineArtifactVerification(report), args.color));
+        writeReviewReport(context, args, report, formatOfflineArtifactVerification);
         return args.strictExit && !isCompleteOfflineArtifactVerification(report) ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
     }
     if (args.package) {
@@ -57,23 +82,12 @@ async function runVerifyArtifactCommand(args, dependencies, context) {
         const passphrase = args.passphraseSource ? await context.readPassphraseSource(args.passphraseSource) : undefined;
         const report = args.bagit ? await verifyOfflineBagIt(bytes) : await verifyOfflineInvestigationPackage(bytes, passphrase);
         dependencies.signal?.throwIfAborted();
-        if (!args.quiet)
-            context.writeStdout(args.output === 'json' ? formatJsonDocument(report) : context.terminal(formatOfflineArtifactVerification(report), args.color));
+        writeReviewReport(context, args, report, formatOfflineArtifactVerification);
         return args.strictExit && !isCompleteOfflineArtifactVerification(report) ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
     }
-    let input;
-    try {
-        input = dependencies.readArtifactInput
-            ? await dependencies.readArtifactInput(args.source)
-            : await context.readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Artefact input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read artifact input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
-    if (!input.trim())
-        throw new CliUsageError('verify-artifact requires one JSON file or an artefact on stdin.');
+    const input = await readReviewInput(async () => dependencies.readArtifactInput
+        ? await dependencies.readArtifactInput(args.source)
+        : await context.readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Artefact input'), 'artifact input', 'verify-artifact requires one JSON file or an artefact on stdin.');
     const passphrase = args.passphraseSource ? await context.readPassphraseSource(args.passphraseSource) : null;
     let manifest = null;
     if (args.manifestSource && args.manifestEntryId) {
@@ -93,90 +107,44 @@ async function runVerifyArtifactCommand(args, dependencies, context) {
         manifest = Object.freeze({ raw, entryId: args.manifestEntryId });
     }
     const report = await verifyOfflineArtifact(input, { passphrase, manifest });
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(report)
-            : context.terminal(formatOfflineArtifactVerification(report), args.color));
-    }
+    writeReviewReport(context, args, report, formatOfflineArtifactVerification);
     return args.strictExit && !isCompleteOfflineArtifactVerification(report)
         ? EXIT_CODES.PARTIAL_FAILURE
         : EXIT_CODES.SUCCESS;
 }
 async function runInterchangeReportCommand(args, dependencies, context) {
     context.setFailureLabel('Interchange fidelity report');
-    let input;
-    try {
-        input = dependencies.readArtifactInput
-            ? await dependencies.readArtifactInput(args.source)
-            : await context.readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Interchange input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read interchange input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
-    if (!input.trim())
-        throw new CliUsageError('interchange-report requires one JSON file or an artefact on stdin.');
+    const input = await readReviewInput(async () => dependencies.readArtifactInput
+        ? await dependencies.readArtifactInput(args.source)
+        : await context.readInput(args.source, MAX_OFFLINE_ARTIFACT_BYTES, 'Interchange input'), 'interchange input', 'interchange-report requires one JSON file or an artefact on stdin.');
     const passphrase = args.passphraseSource ? await context.readPassphraseSource(args.passphraseSource) : null;
     const report = await buildInterchangeFidelityReport(input, {
         generatedAt: context.now(),
         passphrase,
     });
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(report)
-            : context.terminal(formatInterchangeFidelityReport(report), args.color));
-    }
+    writeReviewReport(context, args, report, formatInterchangeFidelityReport);
     return EXIT_CODES.SUCCESS;
 }
 async function runSourceReportCommand(args, dependencies, context) {
     context.setFailureLabel('Source reliability report');
-    let input;
-    try {
-        input = dependencies.readSourceReliabilityInput
-            ? await dependencies.readSourceReliabilityInput(args.source)
-            : await context.readInput(args.source, MAX_SOURCE_RELIABILITY_INPUT_BYTES, 'Source reliability input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read source reliability input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
-    if (!input.trim())
-        throw new CliUsageError('source-report requires one JSON file or lookup documents on stdin.');
+    const input = await readReviewInput(async () => dependencies.readSourceReliabilityInput
+        ? await dependencies.readSourceReliabilityInput(args.source)
+        : await context.readInput(args.source, MAX_SOURCE_RELIABILITY_INPUT_BYTES, 'Source reliability input'), 'source reliability input', 'source-report requires one JSON file or lookup documents on stdin.');
     const report = buildSourceReliabilityReport(input, context.now());
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(report)
-            : context.terminal(formatSourceReliabilityReport(report), args.color));
-    }
+    writeReviewReport(context, args, report, formatSourceReliabilityReport);
     return EXIT_CODES.SUCCESS;
 }
 async function runCompareCommand(args, dependencies, context) {
     context.setFailureLabel('Registry comparison');
-    let input;
-    try {
-        input = dependencies.readCompareInput
-            ? await dependencies.readCompareInput(args.source)
-            : await context.readInput(args.source, MAX_COMPARE_INPUT_BYTES, 'Comparison input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read comparison input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
-    if (!input.trim())
-        throw new CliUsageError('compare requires one lookup JSON file or a lookup document on stdin.');
+    const input = await readReviewInput(async () => dependencies.readCompareInput
+        ? await dependencies.readCompareInput(args.source)
+        : await context.readInput(args.source, MAX_COMPARE_INPUT_BYTES, 'Comparison input'), 'comparison input', 'compare requires one lookup JSON file or a lookup document on stdin.');
     const parsed = parseCliLookupDocument(input);
     const loadComparison = dependencies.loadRegistryComparison || (() => import("../lib/registry-comparison.mjs"));
     const comparisonModule = await loadComparison();
     const result = compareLookupDocument(parsed, comparisonModule.compareRegistrySources, comparisonModule.compareRdapPublications);
     const document = buildCliCompareDocument(result, context.now());
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(document)
-            : context.terminal(formatTerminalCompare(document), args.color));
-    }
+    writeReviewReport(context, args, document, formatTerminalCompare);
     return EXIT_CODES.SUCCESS;
 }
 async function runPageCompareCommand(args, dependencies, context) {
@@ -197,80 +165,37 @@ async function runPageCompareCommand(args, dependencies, context) {
         throw new CliUsageError(`Could not read page comparison input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
     }
     const document = buildCliPageComparison(leftInput, rightInput, context.now());
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(document)
-            : context.terminal(formatCliPageComparison(document), args.color));
-    }
+    writeReviewReport(context, args, document, formatCliPageComparison);
     return EXIT_CODES.SUCCESS;
 }
 async function runMailReviewCommand(args, dependencies, context) {
     context.setFailureLabel('Passive mail review');
-    let input;
-    try {
-        input = dependencies.readMailReviewInput
-            ? await dependencies.readMailReviewInput(args.source)
-            : await context.readInput(args.source, MAX_MAIL_REVIEW_INPUT_BYTES, 'Mail review input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read mail review input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
+    const input = await readReviewInput(async () => dependencies.readMailReviewInput
+        ? await dependencies.readMailReviewInput(args.source)
+        : await context.readInput(args.source, MAX_MAIL_REVIEW_INPUT_BYTES, 'Mail review input'), 'mail review input');
     const document = buildCliMailReview(input, context.now());
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(document)
-            : context.terminal(formatCliMailReview(document), args.color));
-    }
+    writeReviewReport(context, args, document, formatCliMailReview);
     return EXIT_CODES.SUCCESS;
 }
 async function runMailHeadersCommand(args, dependencies, context) {
     context.setFailureLabel('Mail-header review');
-    let input;
-    try {
-        input = dependencies.readMailHeaderInput
-            ? await dependencies.readMailHeaderInput(args.source)
-            : await context.readHeaderInput(args.source, MAX_MAIL_HEADER_INPUT_BYTES, 'Mail-header input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read mail-header input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
-    if (!input.trim())
-        throw new CliUsageError('mail-headers requires one message or header file, or headers on stdin.');
-    const document = buildCliMailHeaderReview(input, context.now());
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(document)
-            : context.terminal(formatCliMailHeaderReview(document), args.color));
-    }
+    const input = await readReviewInput(async () => dependencies.readMailHeaderInput
+        ? await dependencies.readMailHeaderInput(args.source)
+        : await context.readHeaderInput(args.source, MAX_MAIL_HEADER_INPUT_BYTES, 'Mail-header input'), 'mail-header input', 'mail-headers requires one message or header file, or headers on stdin.');
+    const document = buildCliMailHeaderReview(input, context.now(), args.trustedAuthHeaders);
+    writeReviewReport(context, args, document, formatCliMailHeaderReview);
     return EXIT_CODES.SUCCESS;
 }
 async function runOfflineEvidenceReviewCommand(args, dependencies, context) {
     context.setFailureLabel('Offline evidence review');
-    let input;
-    try {
-        input = dependencies.readArtifactInput
-            ? await dependencies.readArtifactInput(args.source)
-            : await context.readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Offline evidence input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read offline evidence input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
-    if (!input.trim())
-        throw new CliUsageError('review-evidence requires one JSON file or a document on stdin.');
+    const input = await readReviewInput(async () => dependencies.readArtifactInput
+        ? await dependencies.readArtifactInput(args.source)
+        : await context.readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Offline evidence input'), 'offline evidence input', 'review-evidence requires one JSON file or a document on stdin.');
     const document = args.mmdbSource
-        ? await buildOfflineEvidenceReviewWithLocalResources(input, context.now(), { mmdbPath: args.mmdbSource })
+        ? await buildOfflineEvidenceReviewWithLocalResources(input, context.now(), { mmdbPath: args.mmdbSource, ...(dependencies.signal ? { signal: dependencies.signal } : {}) })
         : buildOfflineEvidenceReview(input, context.now());
-    if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(document)
-            : context.terminal(formatOfflineEvidenceReview(document), args.color));
-    }
+    dependencies.signal?.throwIfAborted();
+    writeReviewReport(context, args, document, formatOfflineEvidenceReview);
     if (args.strictExit) {
         const result = document.result && typeof document.result === 'object' && !Array.isArray(document.result)
             ? document.result
@@ -281,7 +206,11 @@ async function runOfflineEvidenceReviewCommand(args, dependencies, context) {
         const zoneMismatch = document.kind === 'zone_intent' && (result.complete !== true
             || (result.counts && typeof result.counts === 'object' && !Array.isArray(result.counts)
                 && ['different', 'missing', 'unexpected', 'incomplete'].some((key) => Number(result.counts[key]) > 0)));
-        if (gate?.pass === false || zoneMismatch)
+        const contextPartial = (CONTEXT_REVIEW_KINDS.includes(document.kind) || document.kind === 'internal_containment') && result.state === 'partial';
+        const mmdbIncomplete = result.schema === LOCAL_MMDB_REVIEW_SCHEMA && result.version === LOCAL_MMDB_REVIEW_VERSION && result.completeness !== 'complete';
+        const infrastructureIncomplete = document.kind === 'infrastructure' ? result.state !== 'complete'
+            : document.kind === 'infrastructure_comparison' && result.state !== 'compared';
+        if (gate?.pass === false || zoneMismatch || contextPartial || mmdbIncomplete || infrastructureIncomplete)
             return EXIT_CODES.PARTIAL_FAILURE;
     }
     return EXIT_CODES.SUCCESS;
@@ -289,34 +218,16 @@ async function runOfflineEvidenceReviewCommand(args, dependencies, context) {
 async function runBriefOrCasePackCommand(args, dependencies, context) {
     const isBrief = args.action === 'brief';
     context.setFailureLabel(isBrief ? 'Lookup brief' : 'Case pack');
-    let input;
-    try {
-        input = dependencies.readArtifactInput
-            ? await dependencies.readArtifactInput(args.source)
-            : await context.readInput(args.source, isBrief ? MAX_SAVED_LOOKUP_INPUT_BYTES : MAX_CASE_PACK_INPUT_BYTES, isBrief ? 'Lookup brief input' : 'Case-pack input');
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        throw new CliUsageError(`Could not read ${isBrief ? 'Lookup brief' : 'case-pack'} input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
-    }
-    if (!input.trim())
-        throw new CliUsageError(`${args.action} requires one JSON file or a document on stdin.`);
+    const input = await readReviewInput(async () => dependencies.readArtifactInput
+        ? await dependencies.readArtifactInput(args.source)
+        : await context.readInput(args.source, isBrief ? MAX_SAVED_LOOKUP_INPUT_BYTES : MAX_CASE_PACK_INPUT_BYTES, isBrief ? 'Lookup brief input' : 'Case-pack input'), `${isBrief ? 'Lookup brief' : 'case-pack'} input`, `${args.action} requires one JSON file or a document on stdin.`);
     if (args.action === 'brief') {
         const document = buildCliLookupBrief(input, context.now());
-        if (!args.quiet) {
-            context.writeStdout(args.output === 'json'
-                ? formatJsonDocument(document)
-                : context.terminal(formatCliLookupBrief(document), args.color));
-        }
+        writeReviewReport(context, args, document, formatCliLookupBrief);
     }
     else {
         const document = buildCliCasePack(input, { audience: args.audience, reviewed: args.reviewed }, context.now());
-        if (!args.quiet) {
-            context.writeStdout(args.output === 'json'
-                ? formatJsonDocument(document)
-                : context.terminal(formatCliCasePack(document), args.color));
-        }
+        writeReviewReport(context, args, document, formatCliCasePack);
     }
     return EXIT_CODES.SUCCESS;
 }
@@ -328,10 +239,12 @@ const REVIEW_COMMAND_HANDLERS = Object.freeze({
     'page-compare': runPageCompareCommand,
     'mail-review': runMailReviewCommand,
     'mail-headers': runMailHeadersCommand,
+    intake: runIntakeCommand,
     'review-evidence': runOfflineEvidenceReviewCommand,
     'brief': runBriefOrCasePackCommand,
     'case': runCaseCommand,
     'case-pack': runBriefOrCasePackCommand,
+    'indicator-set': runIndicatorSetCommand,
 });
 function runReviewCommand(args, dependencies, context) {
     return runDiscriminatedCommandHandler(REVIEW_COMMAND_HANDLERS, args, dependencies, context);