@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/cli/assurance-command-definitions.mjs

@@ -0,0 +1,179 @@
+import { MAX_INVESTIGATION_MANIFEST_ARTIFACTS, MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES, MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES } from "../packages/investigation/investigation-manifest.mjs";
+import { positional, OPTIONAL_FILE_POSITIONAL, constraint, EMPTY_CONSTRAINTS, commandSeed, flag, file } from "./command-definition.mjs";
+export const ASSURANCE_COMMAND_DEFINITIONS = Object.freeze({
+    manifest: commandSeed({
+        reference: {
+            description: `Record an ordered, path-free manifest for up to ${MAX_INVESTIGATION_MANIFEST_ARTIFACTS} local files. Use --package --output evidence.zip for a ZIP, add --passphrase-file to encrypt the ordinary package, or use --folder ./evidence for a new unencrypted folder. Add --bagit to ZIP or folder output for BagIt 1.0 with SHA-512 checksums.`,
+            example: 'whoisleuth manifest lookup.json comparison.json --workflow "domain review" --json',
+            boundary: 'Ordinary output contains metadata only. ZIP and folder output include unchanged selected bytes and are private until reviewed for sharing. Folders must be new; existing destinations are never replaced and a failed write may leave explicit partial output. BagIt output is unencrypted; its checksums do not authenticate evidence. Filenames ending in .json are parsed as JSON; other files are opaque and never executed. Original paths are omitted. No network request is made.',
+        },
+        collection: { scope: `Reads 1 to ${MAX_INVESTIGATION_MANIFEST_ARTIFACTS} local files, at most ${MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES / 1024 / 1024} MiB each and ${MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES.toLocaleString('en-AU')} bytes combined; retains no source paths.` },
+        summary: 'Build an evidence manifest offline',
+        options: ['--workflow', '--configuration-digest', '--package', '--bagit', '--passphrase-file', '--folder', '--json', '--quiet', '--no-color'],
+        optionOverrides: {
+            '--package': flag('Create a portable evidence ZIP containing the selected files.'),
+            '--folder': file('Create a new evidence folder containing the selected files.'),
+            '--bagit': flag('Create a BagIt 1.0 package with SHA-512 checksums.'),
+        },
+        positionals: Object.freeze([positional('artefacts', 'file', 1, MAX_INVESTIGATION_MANIFEST_ARTIFACTS)]),
+        constraints: Object.freeze([
+            constraint({ kind: 'required', options: ['--workflow'] }),
+            constraint({ kind: 'requires_any', option: '--bagit', requiredOptions: ['--package', '--folder'] }),
+            constraint({ kind: 'excludes_all', option: '--bagit', excludedOptions: ['--passphrase-file'] }),
+            constraint({ kind: 'requires_all', option: '--package', requiredOptions: ['--output'] }),
+            constraint({ kind: 'requires_all', option: '--passphrase-file', requiredOptions: ['--package'] }),
+            constraint({ kind: 'mutually_exclusive', options: ['--package', '--json'] }),
+            constraint({ kind: 'excludes_all', option: '--folder', excludedOptions: ['--package', '--output', '--force'] }),
+        ]),
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.investigation-manifest']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "map-observations": commandSeed({
+        reference: {
+            description: 'Apply one bounded declarative field-mapping profile to local source observations.',
+            example: 'whoisleuth map-observations mapping.json --json',
+            boundary: 'Profiles select allowlisted dotted fields only. They execute no scripts, make no requests, and emit the browser-compatible external-findings contract.',
+        },
+        collection: { scope: 'Reads one mapping document capped at 4 MiB and executes no scripts or requests.' },
+        summary: 'Apply a declarative observation map offline',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.external-observation-mapping']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "oam-export": commandSeed({
+        reference: {
+            description: 'Project browser-compatible external findings into a bounded Open Asset Model bridge document.',
+            example: 'whoisleuth oam-export external-findings.json --json',
+            boundary: 'The projection is offline, preserves source completeness without inventing confidence, and covers only bounded FQDN, IP address, certificate, and related edge vocabulary.',
+        },
+        collection: { scope: 'Reads one browser-compatible external-findings document and projects bounded graph records locally.' },
+        summary: 'Project external findings to Open Asset Model',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.open-asset-model-bridge']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "ct-intake": commandSeed({
+        reference: {
+            description: 'Normalise source-qualified local certificate events into browser-compatible findings.',
+            example: 'whoisleuth ct-intake certificate-events.json --json',
+            boundary: 'The command is offline, caps output at 100 findings, and treats every event as a review lead rather than proof of serving or control.',
+        },
+        collection: { scope: 'Reads one source-qualified event batch capped at 4 MiB and makes no request.' },
+        summary: 'Normalise certificate observations offline',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.ct-event-batch', 'whoisleuth.external-findings']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "domain-control": commandSeed({
+        reference: {
+            description: 'Build an integrity-protected desired-state manifest or compare one with supplied observations.',
+            example: 'whoisleuth domain-control domain-control-input.json --json',
+            boundary: 'The command is offline and changes no registrar, DNS, mail, or certificate configuration. Only complete, recent source observations can establish drift or expected absence.',
+        },
+        collection: { scope: 'Reads one bounded desired-state or review document and performs no collection or configuration change.' },
+        summary: 'Build or review a domain control manifest',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.domain-control-review-input', 'whoisleuth.cli.domain-control-review']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    assurance: commandSeed({
+        reference: {
+            description: 'Review a versioned domain change, recovery-dependency, or retirement plan.',
+            example: 'whoisleuth assurance domain-assurance.json --json',
+            boundary: 'The command is offline and treats every provider label, readiness state, and evidence reference as analyst-authored input. It changes no configuration.',
+        },
+        collection: { scope: 'Reads one versioned plan capped at 2 MiB and makes no request or configuration change.' },
+        summary: 'Review domain change, recovery, or retirement plans',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.domain-assurance.input', 'whoisleuth.domain-assurance']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "change-packet": commandSeed({
+        reference: {
+            description: 'Assemble pre-change, post-change, and planning evidence into one integrity-protected packet.',
+            example: 'whoisleuth change-packet change-review.json --json',
+            boundary: 'Assembly is offline. Readiness reflects only the supplied bounded evidence and does not authorise or perform a domain change.',
+        },
+        collection: { scope: 'Reads one versioned packet input capped at 6 MiB and makes no request or configuration change.' },
+        summary: 'Build a reviewed change packet offline',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.domain-change-packet.input', 'whoisleuth.domain-change-packet']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    "sharing-review": commandSeed({
+        reference: {
+            description: 'Lint one reviewed artefact against local integrity, marking, recipient, personal-data, and redaction controls.',
+            example: 'whoisleuth sharing-review packet.json --marking amber --recipient-scope organization --purpose "Reviewed incident handoff" --human-reviewed --personal-data-reviewed --redactions-confirmed --json',
+            boundary: 'The command is offline and emits only bounded schema/version metadata, no content values, and no raw evidence. Its result is a review aid, not legal advice or recipient authorisation.',
+        },
+        collection: { scope: 'Reads one bounded artefact, emits only schema/version metadata and no content values, and performs no transmission.' },
+        summary: 'Lint an artefact before deliberate sharing',
+        options: ['--marking', '--recipient-scope', '--purpose', '--human-reviewed', '--personal-data-reviewed', '--redactions-confirmed', '--json', '--quiet', '--no-color'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: Object.freeze([
+            constraint({ kind: 'required', options: ['--marking', '--recipient-scope', '--purpose'] }),
+        ]),
+        handlerOwner: 'assurance',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.sharing-review']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+});

package/cli/assurance-command-runner.mjs

@@ -4,7 +4,7 @@ import { buildInvestigationPackage } from "../packages/investigation/investigati
 import { encryptInvestigationPackage } from "../packages/investigation/investigation-package-crypto.mjs";
 import { writeInvestigationFolder, writePreparedEvidenceFolder } from "./investigation-folder.mjs";
 import { buildInvestigationBagIt, prepareInvestigationBagIt } from "../packages/investigation/investigation-bagit.mjs";
-import { scanBoundedJson } from "../lib/bounded-json.mjs";
+import { scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
 import { MAX_ASSURANCE_INPUT_BYTES, buildDomainAssurance, formatDomainAssurance, } from "../lib/domain-assurance.mjs";
 import { MAX_DOMAIN_CHANGE_PACKET_INPUT_BYTES, buildDomainChangePacket, formatDomainChangePacket, } from "../lib/domain-change-packet.mjs";
 import { DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA, buildDomainControlFlightRecorder, formatDomainControlFlightRecorder, serializeDomainControlFlightRecorder, } from "../lib/domain-control-flight-recorder.mjs";

package/cli/bounded-json.mjs

@@ -1 +1 @@
-export { boundedJsonLimitsForBytes, MAX_BOUNDED_JSON_DEPTH, MAX_BOUNDED_JSON_KEYS, MAX_BOUNDED_JSON_VALUES, parseBoundedJson, parseBoundedJsonObject, scanBoundedJson, } from "../lib/bounded-json.mjs";
+export { boundedJsonLimitsForBytes, MAX_BOUNDED_JSON_DEPTH, MAX_BOUNDED_JSON_KEYS, MAX_BOUNDED_JSON_VALUES, parseBoundedJson, parseBoundedJsonObject, scanBoundedJson, } from "../packages/analysis/bounded-json.mjs";

package/cli/bulk-checkpoint.mjs

@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto';
 import { lstat } from 'node:fs/promises';
 import { recordOrNull } from "../lib/bounded-contract-normalizers.mjs";
 import { readBoundedRegularTextFile } from "../lib/bounded-file.mjs";
-import { scanBoundedJson } from "../lib/bounded-json.mjs";
+import { scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { boundedCliInputError, CliUsageError } from "./errors.mjs";
 import { writePrivateFile } from "./output-file.mjs";

package/cli/bulk-command-runner.mjs

@@ -28,12 +28,12 @@ async function runBulkCommand(args, dependencies, context) {
     catch (error) {
         if (error instanceof CliUsageError)
             throw error;
-        throw new CliUsageError(`Could not read bulk input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+        throw new CliUsageError(`Could not read bulk input: ${boundedCliErrorMessage(error, 'Input could not be read')}`, 'input_unavailable');
     }
     const parsed = parseBulkQueries(input, { deep: args.deep });
     if (args.plan) {
         const document = buildCollectionPreflight({
-            command: 'bulk', targetCount: parsed.queries.length, targetLimit: args.deep ? 50 : 500,
+            command: 'bulk', targetCount: parsed.queries.length,
             deep: args.deep, concurrency: args.concurrency, output: args.output, checkpoint: false,
         });
         context.writeStdout(args.output === 'json' ? formatJsonDocument(document) : context.terminal(formatCollectionPreflight(document), args.color));
@@ -93,6 +93,10 @@ async function runBulkCommand(args, dependencies, context) {
         }
         catch (error) {
             checkpointFailure = error;
+            eventProgress.emit({ event: 'warning', state: 'checkpoint_unavailable' });
+            if (!eventProgress.enabled) {
+                context.writeStderr(`Checkpoint warning: ${boundedCliErrorMessage(error, 'Checkpoint could not be written')}. The latest progress may not be saved.\n`);
+            }
         }
     }
     const metadata = {
@@ -122,12 +126,6 @@ async function runBulkCommand(args, dependencies, context) {
         else
             context.writeStdout(context.terminal(formatTerminalBulk(selectedItems, metadata), args.color));
     }
-    if (checkpointFailure) {
-        eventProgress.emit({ event: 'warning', state: 'checkpoint_unavailable' });
-        if (!eventProgress.enabled) {
-            context.writeStderr(`Checkpoint warning: ${boundedCliErrorMessage(checkpointFailure, 'Checkpoint could not be written')}. Completed output is still available.\n`);
-        }
-    }
     const policyFindings = evaluateCliFailPolicies(buildCliBulkDocument(items, { ...metadata, filter: 'all' }), args.failOn || []);
     if (policyFindings.length && !eventProgress.enabled)
         context.writeStderr(formatFailPolicyNotice(policyFindings));

package/cli/bulk.mjs

@@ -1,8 +1,7 @@
 import { Buffer } from 'node:buffer';
 import { abortable } from "../lib/abort.mjs";
 import { decodeBoundedUtf8 } from "../lib/bounded-file.mjs";
-import { CliUsageError } from "./arguments.mjs";
-import { hasUnsafeCliText } from "./errors.mjs";
+import { CliUsageError, hasUnsafeCliText } from "./errors.mjs";
 import { MAX_DEEP_BULK_QUERIES, MAX_FAST_BULK_QUERIES, } from "../lib/bulk-limits.mjs";
 const MAX_BULK_INPUT_BYTES = 1024 * 1024;
 async function readTextStreamBounded(stream, limit = MAX_BULK_INPUT_BYTES, signal) {
@@ -65,7 +64,7 @@ function parseBulkQueries(text, { deep = false } = {}) {
         }
     }
     if (!queries.length)
-        throw new CliUsageError('Bulk input did not contain any queries.');
+        throw new CliUsageError('Bulk input did not contain any queries.', 'missing_input');
     return { queries, duplicates, limit };
 }
 function boundedLookupError(error) {

package/cli/case-command.mjs

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { boundedJsonLimitsForBytes, parseBoundedJsonObject } from "../lib/bounded-json.mjs";
+import { boundedJsonLimitsForBytes, parseBoundedJsonObject } from "../packages/analysis/bounded-json.mjs";
 import { canonicalArtifactJsonV2 } from "../packages/evidence/artifact-integrity.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { MAX_CASE_CHECKPOINT_FACTS, MAX_CASE_OBJECTIVE_LENGTH, MAX_CASE_STORE_BYTES, MAX_EDITABLE_CASE_INPUT_BYTES, MAX_NOTE_LENGTH, MAX_RESPONSE_RATIONALE_LENGTH, MAX_RESPONSE_VALUE_LENGTH } from "../packages/contracts/case-portability.mjs";
@@ -8,6 +8,8 @@ import { createCaseIncident, openOrCreateCase, recordCaseConclusion, recordCaseR
 import { buildCaseExport, serializeCaseStore } from "../packages/cases/case-storage-model.mjs";
 import { appendCaseEvidencePin } from "../packages/cases/case-response-model.mjs";
 import { readCaseRecheckAnswerContext } from "../packages/cases/case-recheck-model.mjs";
+import { readCaseResponseObjects } from "../packages/cases/case-response-object.mjs";
+import { caseEvidenceLinkIssues, mergeCaseEvidenceLinks } from "../packages/cases/case-evidence-links.mjs";
 import { dispositionLabel, statusLabel } from "../packages/cases/case-record-decisions.mjs";
 import { normalizeDomain } from "../packages/cases/case-record-core.mjs";
 import { safeTerminalValue } from "./formatters/terminal.mjs";
@@ -52,9 +54,13 @@ function pin(input, now) {
     return raw;
 }
 function retainExistingEntries(before, after) {
+    if (canonicalArtifactJsonV2(mergeCaseEvidenceLinks(before.evidenceLinks, after.evidenceLinks) ?? [])
+        !== canonicalArtifactJsonV2(mergeCaseEvidenceLinks(undefined, after.evidenceLinks) ?? [])) {
+        throw new CliUsageError('The operation would remove retained evidence relationships. Nothing was written.');
+    }
     const pairs = [
         [before.notes, after.notes], [before.evidenceHistory, after.evidenceHistory], [before.evidencePins, after.evidencePins],
-        [before.decisions, after.decisions], [before.actions, after.actions], [before.assertions, after.assertions],
+        [before.decisions, after.decisions], [before.assertions, after.assertions],
         [before.manualTrail, after.manualTrail], [before.sightings, after.sightings],
         [before.observedEffects.reviews, after.observedEffects.reviews], [before.closures.records, after.closures.records],
         [before.branches ?? [], after.branches ?? []], [before.attachments ?? [], after.attachments ?? []],
@@ -65,8 +71,15 @@ function retainExistingEntries(before, after) {
             throw new CliUsageError('The operation would remove or alter earlier retained evidence. Export a smaller working set or review it in the console; nothing was written.');
         }
     }
+    for (const action of before.actions) {
+        const next = after.actions.find(candidate => candidate.id === action.id);
+        const events = new Set(next?.history.map(event => canonicalArtifactJsonV2(event)) ?? []);
+        if (!next || action.history.some(event => !events.has(canonicalArtifactJsonV2(event)))) {
+            throw new CliUsageError('The operation would alter retained response events. Nothing was written.');
+        }
+    }
 }
-function mutate(cases, args, input, note, now) {
+export function applyCliCaseOperation(cases, args, input, note, now) {
     if (args.operation === 'open') {
         const title = args.title === null ? undefined : prose(args.title, MAX_CASE_OBJECTIVE_LENGTH, 'Incident title');
         const result = args.newIncident
@@ -84,6 +97,70 @@ function mutate(cases, args, input, note, now) {
     else if (args.operation === 'pin') {
         result = updateCase(cases, current.id, { evidencePin: pin(input, now) }, now);
     }
+    else if (args.operation === 'link' || args.operation === 'withdraw-link') {
+        result = updateCase(cases, current.id, args.operation === 'link' ? { evidenceLink: input } : { evidenceLinkWithdrawal: input }, now);
+    }
+    else if (args.operation === 'incident-link') {
+        if (!input)
+            throw new CliUsageError('An incident link requires JSON input.');
+        fields(input, ['url'], 'Incident link');
+        result = updateCase(cases, current.id, { incidentTarget: input.url }, now);
+    }
+    else if (args.operation === 'action') {
+        if (!input)
+            throw new CliUsageError('A response action requires JSON input.');
+        fields(input, ['type', 'recipient', 'contactSource', 'routeObservedAt', 'routeReviewAfter', 'contactLimitations', 'dueAt', 'followUpAt', 'responseObjects', 'originActionId', 'amendment', 'correction'], 'Response action');
+        result = updateCase(cases, current.id, { action: input }, now);
+        const action = result.record.actions.find(candidate => !current.actions.some(prior => prior.id === candidate.id));
+        if (!action)
+            throw new CliUsageError('No new action was retained within the Case bounds; nothing was written.');
+        for (const [key, value] of Object.entries(input))
+            if (canonicalArtifactJsonV2(key === 'responseObjects' ? readCaseResponseObjects(value) : value) !== canonicalArtifactJsonV2(action[key])) {
+                throw new CliUsageError(`Action field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
+            }
+    }
+    else if (args.operation === 'action-event') {
+        if (!input || !input.transition || typeof input.transition !== 'object' || Array.isArray(input.transition))
+            throw new CliUsageError('An action event requires id and transition JSON.');
+        fields(input, ['id', 'transition'], 'Response action event');
+        const transition = input.transition;
+        fields(transition, ['nextState', 'occurredAt', 'sourceClass', 'provenance', 'reference', 'evidencePinId', 'limitations', 'providerOutcome', 'outcomeDetail', 'responseObjects', 'objectOutcome', 'evidenceRequest', 'packetReceipt'], 'Response transition');
+        result = updateCase(cases, current.id, { actionUpdate: input }, now);
+        const previous = current.actions.find(action => action.id === input.id);
+        const event = result.record.actions.find(action => action.id === input.id)?.history.find(candidate => !previous?.history.some(prior => prior.id === candidate.id));
+        if (!event)
+            throw new CliUsageError('The selected action is not retained. Nothing was written.');
+        for (const [key, value] of Object.entries(transition))
+            if (canonicalArtifactJsonV2(key === 'responseObjects' ? readCaseResponseObjects(value) : value) !== canonicalArtifactJsonV2(event[key])) {
+                throw new CliUsageError(`Transition field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
+            }
+    }
+    else if (args.operation === 'recheck-question') {
+        if (!input)
+            throw new CliUsageError('A recheck question requires JSON input.');
+        fields(input, ['statement', 'rationale', 'recheck', 'evidencePinIds'], 'Recheck question');
+        result = updateCase(cases, current.id, { assertion: { ...input, kind: 'next_step' } }, now);
+        const question = result.record.assertions.find(candidate => !current.assertions.some(prior => prior.id === candidate.id));
+        if (!question)
+            throw new CliUsageError('No new question was retained within the Case bounds; nothing was written.');
+        for (const [key, value] of Object.entries(input))
+            if (canonicalArtifactJsonV2(value) !== canonicalArtifactJsonV2(question[key])) {
+                throw new CliUsageError(`Question field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
+            }
+    }
+    else if (args.operation === 'close-object') {
+        if (!input?.responseObject)
+            throw new CliUsageError('Object closure requires one explicit responseObject; it cannot close the whole Case.');
+        fields(input, ['responseObject', 'reason', 'summary', 'observedEffectReviewId', 'actionId', 'limitations'], 'Object closure');
+        result = updateCase(cases, current.id, { closure: input }, now);
+        const closure = result.record.closures.records.find(candidate => !current.closures.records.some(prior => prior.id === candidate.id));
+        if (!closure)
+            throw new CliUsageError('No new closure was retained within the Case bounds; nothing was written.');
+        for (const [key, value] of Object.entries(input))
+            if (canonicalArtifactJsonV2(value) !== canonicalArtifactJsonV2(closure[key])) {
+                throw new CliUsageError(`Closure field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
+            }
+    }
     else if (args.operation === 'assess') {
         if (!input)
             throw new CliUsageError('An assessment requires JSON input.');
@@ -111,7 +188,7 @@ function mutate(cases, args, input, note, now) {
     else if (args.operation === 'recheck') {
         if (!input)
             throw new CliUsageError('A recheck requires JSON input.');
-        fields(input, ['state', 'observedAt', 'completeness', 'comparisonSummary', 'source', 'followUpAt', 'limitations', 'collectionDepth', 'recheck', 'observationHostname'], 'Recheck');
+        fields(input, ['state', 'observedAt', 'completeness', 'comparisonSummary', 'source', 'followUpAt', 'limitations', 'collectionDepth', 'recheck', 'observationHostname', 'responseObject', 'objectOutcome'], 'Recheck');
         const recheck = readCaseRecheckAnswerContext(input.recheck);
         if (input.state === 'not_reproduced' && !recheck) {
             throw new CliUsageError('Not reproduced requires a saved recheck question and confirmed comparable conditions. Import the planned Case or record unavailable for a limited observation.');
@@ -127,6 +204,8 @@ function mutate(cases, args, input, note, now) {
             comparisonSummary: comparison.value, source: review.source, followUpAt: review.followUpAt,
             limitations: review.limitations, collectionDepth: comparison.collectionDepth,
             ...(review.recheck ? { recheck: review.recheck } : {}),
+            ...(review.responseObject ? { responseObject: review.responseObject } : {}),
+            ...(review.objectOutcome ? { objectOutcome: review.objectOutcome } : {}),
             ...(comparison.observationHostname ? { observationHostname: comparison.observationHostname } : {}),
         };
         for (const [key, value] of Object.entries(input)) {
@@ -149,8 +228,22 @@ function formatCases(cases, digest) {
             lines.push(`Pin ${safeTerminalValue(pin.id)} · ${safeTerminalValue(pin.label)}`, safeTerminalValue(pin.value, '—', MAX_RESPONSE_VALUE_LENGTH), `  Source ${safeTerminalValue(pin.source)} · ${safeTerminalValue(pin.observedAt, 'time unavailable')} · ${pin.completeness}`);
         for (const decision of record.decisions)
             lines.push(`Assessment ${decision.createdAt}`, safeTerminalValue(decision.summary, '—', MAX_RESPONSE_VALUE_LENGTH), safeTerminalValue(decision.rationale, '—', MAX_RESPONSE_RATIONALE_LENGTH));
+        for (const { link, missingPinIds, cyclic } of caseEvidenceLinkIssues(record.evidenceLinks ?? [], record.evidencePins)) {
+            lines.push(`Evidence relationship ${safeTerminalValue(link.id)} · analyst declaration`, `  ${safeTerminalValue(link.fromPinId)} ${link.kind.replaceAll('_', ' ')} ${safeTerminalValue(link.toPinId)}`, `  ${safeTerminalValue(link.basis, '—', MAX_RESPONSE_RATIONALE_LENGTH)}`);
+            if (link.withdrawal)
+                lines.push(`  Withdrawn ${link.withdrawal.at}: ${safeTerminalValue(link.withdrawal.reason, '—', MAX_RESPONSE_RATIONALE_LENGTH)}`);
+            if (missingPinIds.length)
+                lines.push(`  Referenced pins not retained: ${missingPinIds.map(id => safeTerminalValue(id)).join(', ')}`);
+            if (cyclic)
+                lines.push('  Conflicting imported derivation cycle; no order is inferred.');
+        }
+        for (const action of record.actions) {
+            lines.push(`Action ${safeTerminalValue(action.id)} · ${action.type} · ${action.state}`, `  Objects: ${action.responseObjects?.map(object => `${object.kind}: ${safeTerminalValue(object.identifier)}`).join('; ') || 'unknown binding'}`);
+            for (const event of action.history)
+                lines.push(`  Event ${event.occurredAt} · ${event.sourceClass} · ${event.nextState}${event.objectOutcome ? ` · reported ${event.objectOutcome}` : ''}`, `    Scope: ${event.responseObjects?.map(object => `${object.kind}: ${safeTerminalValue(object.identifier)}`).join('; ') || 'unknown binding'}`);
+        }
         for (const review of record.observedEffects.reviews)
-            lines.push(`Recheck ${safeTerminalValue(review.observedAt, 'time unavailable')} · ${review.state} · ${review.completeness} · ${safeTerminalValue(review.source)}`);
+            lines.push(`Recheck ${safeTerminalValue(review.observedAt, 'time unavailable')} · ${review.state} · ${review.completeness} · ${safeTerminalValue(review.source)}`, `  Object: ${review.responseObject ? `${review.responseObject.kind}: ${safeTerminalValue(review.responseObject.identifier)}` : 'unknown binding'}${review.objectOutcome ? ` · observed ${review.objectOutcome}` : ''}`);
         lines.push(`Other retained records: ${record.evidenceHistory.length} snapshots, ${record.actions.length} actions, ${record.assertions.length} assertions, ${record.attachments?.length ?? 0} file references.`, '');
     }
     lines.push('Use --json for the full Case export. Attached file bytes remain separate. This command makes no request.', '');
@@ -176,7 +269,7 @@ export async function runCaseCommand(args, dependencies, context) {
             maximumBytes: MAX_EDITABLE_CASE_INPUT_BYTES, limits: boundedJsonLimitsForBytes(MAX_CASE_STORE_BYTES), label: 'Case operation input',
         }) : null;
         const note = args.noteSource ? await context.readInput(args.noteSource, MAX_NOTE_LENGTH * 4 + 4, 'Case note') : args.text;
-        const next = mutate(cases, args, input, note, now);
+        const next = applyCliCaseOperation(cases, args, input, note, now);
         if (Buffer.byteLength(serializeCaseStore(next)) > MAX_CASE_STORE_BYTES)
             throw new CliUsageError('The updated Case store exceeds its byte budget. No evidence was pruned and nothing was written.');
         const output = `${JSON.stringify(buildCaseExport(next, now))}\n`;

package/cli/case-pack.mjs

@@ -3,8 +3,12 @@ import { Buffer } from 'node:buffer';
 import { canonicalArtifactJson, canonicalArtifactJsonV2, SORTED_JSON_V2, } from "../packages/evidence/artifact-integrity.mjs";
 import { buildCaseReport, buildCaseReportVerificationProjection } from "../packages/cases/case-report.mjs";
 import { WHOISLEUTH_APPLICATION_VERSION } from "../lib/application-version.mjs";
-import { assertBoundedJsonStructure, scanBoundedJson } from "../lib/bounded-json.mjs";
-import { assertCaseBrandProfileIds, CASE_AUDIENCE_SENSITIVE_FIELD_NAMES, caseAudienceExclusions, normalizeDomain, normalizeCaseStore, projectCaseForAudience, safeId, } from "../packages/cases/case-model.mjs";
+import { assertBoundedJsonStructure, scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
+import { assertCaseBrandProfileIds } from "../packages/cases/case-brand-profile-references.mjs";
+import { CASE_AUDIENCE_SENSITIVE_FIELD_NAMES, caseAudienceExclusions, projectCaseForAudience, } from "../packages/cases/case-record-projection.mjs";
+import { normalizeDomain } from "../packages/evidence/domain-name.mjs";
+import { normalizeCaseStore } from "../packages/cases/case-migration-model.mjs";
+import { safeId } from "../packages/cases/case-record-core.mjs";
 import { CASE_REPORT_SCHEMA, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, CLI_CASE_PACK_SCHEMA, CLI_CASE_PACK_VERSION, CLI_CASE_PACK_INPUT_CASE_VERSIONS, CLI_CASE_PACK_CURRENT_REDACTION_KEYS, CLI_CASE_PACK_PUBLIC_REPORT_KEYS, CLI_CASE_PACK_INTEGRITY_KEYS as INTEGRITY_KEYS, CLI_CASE_PACK_LIMITATIONS as PACKET_LIMITATIONS, CLI_CASE_PACK_PACKET_KEYS as PACKET_KEYS, CLI_CASE_PACK_REPORT_KEYS as REPORT_KEYS, CLI_CASE_PACK_ROOT_KEYS as ROOT_KEYS, MAX_CASE_IMPORT_BYTES, MAX_CASE_PACK_CASES, MAX_CASE_PACK_INPUT_BYTES, PUBLIC_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION, caseReportVersionMatchesCase, } from "../packages/contracts/case-portability.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { canonicalCaseExportProjection as canonicalPackProjection } from "../packages/cases/case-export-input.mjs";
@@ -58,17 +62,27 @@ function listItemPath(path, list) {
             && path[3] === 'analystResponse' && path[4] === list && typeof path[5] === 'number');
 }
 function allowedSensitiveFieldPath(key, path) {
+    const deliveryReceipt = path.at(-1) === 'packetReceipt' && typeof path.at(-2) === 'number' && path.at(-3) === 'history' && listItemPath(path.slice(0, -3), 'actions');
     if (key === 'brandProfileIds')
         return topCasePath(path) || reportCasePath(path);
     if (key === 'notes')
         return topCasePath(path) || reportCasePath(path);
+    if (key === 'workflowMetadata')
+        return topCasePath(path) || analystResponsePath(path);
+    if (key === 'incidentTargets' || key === 'investigationContext') {
+        return path.at(-1) === 'workflowMetadata' && (topCasePath(path.slice(0, -1)) || analystResponsePath(path.slice(0, -1)));
+    }
     if (key === 'actions' || key === 'assertions' || key === 'manualTrail' || key === 'observedEffects' || key === 'closures' || key === 'branches') {
         return topCasePath(path) || analystResponsePath(path);
     }
     if (key === 'recipient')
-        return listItemPath(path, 'actions');
+        return listItemPath(path, 'actions') || deliveryReceipt;
     if (key === 'target')
-        return listItemPath(path, 'manualTrail');
+        return listItemPath(path, 'manualTrail') || deliveryReceipt;
+    if (key === 'correction')
+        return listItemPath(path, 'actions');
+    if (key === 'packetReceipt')
+        return typeof path.at(-1) === 'number' && path.at(-2) === 'history' && listItemPath(path.slice(0, -2), 'actions');
     return true;
 }
 /** Rejects hidden audience-sensitive copies with a budget proven by the serialized byte bound. */
@@ -473,6 +487,7 @@ export function formatCliCasePack(document) {
         `Cases      ${document.cases.length}`,
         `Reports    ${document.packet.reports.length}`,
         `Digest     ${document.integrity.digestSha256}`,
+        'Included for every audience: domain evidence, Case, pin and decision identifiers, tags, decision summaries and rationale. Review these before sharing.',
         '',
         ...document.packet.redactionManifest.excluded.map((item) => `Excluded: ${item}`),
         '',

package/cli/ci-report.mjs

@@ -1,4 +1,4 @@
-import { WHOISLEUTH_REQUEST_POLICY_URL } from "../lib/project-metadata.mjs";
+import { WHOISLEUTH_REQUEST_POLICY_URL } from "../packages/analysis/project-metadata.mjs";
 import { CLI_DOMAIN_CONTROL_MONITOR_SCHEMA } from "../packages/contracts/domain-control-monitor.mjs";
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
@@ -45,9 +45,12 @@ function junitCases(document) {
     return [{ name: 'WHOISleuth result', failure: 'Unsupported document for JUnit conversion.' }];
 }
 export function formatCliJunit(document) {
-    const cases = junitCases(record(document));
+    const root = record(document);
+    const cases = junitCases(root);
     const failures = cases.filter((item) => item.failure).length;
-    return `<?xml version="1.0" encoding="UTF-8"?>\n<testsuite name="WHOISleuth" tests="${cases.length}" failures="${failures}">\n${cases.map((item) => `  <testcase classname="whoisleuth" name="${xml(item.name)}">${item.failure ? `<failure message="${xml(item.failure)}" />` : ''}</testcase>`).join('\n')}\n</testsuite>\n`;
+    const reminders = root.schema === CLI_DOMAIN_CONTROL_MONITOR_SCHEMA
+        ? `\n  <system-out>${xml(`Renewal reviews due: ${Number(record(record(root.review).counts).due ?? 0)}`)}</system-out>` : '';
+    return `<?xml version="1.0" encoding="UTF-8"?>\n<testsuite name="WHOISleuth" tests="${cases.length}" failures="${failures}">\n${cases.map((item) => `  <testcase classname="whoisleuth" name="${xml(item.name)}">${item.failure ? `<failure message="${xml(item.failure)}" />` : ''}</testcase>`).join('\n')}${reminders}\n</testsuite>\n`;
 }
 export function buildPostureSarif(document) {
     const root = record(document);

package/cli/collection-arguments.mjs

@@ -0,0 +1,123 @@
+import {} from "./command-argument-grammar.mjs";
+import {} from "./fail-policy.mjs";
+import { commandDefaultNumber, commandDefaultText } from "./command-reference.mjs";
+import { COLLECTION_COMMAND_DEFINITIONS } from "./collection-command-definitions.mjs";
+import { terminalOptions, normalizedLabel, failPolicies, parseOutput, } from "./argument-values.mjs";
+function parseLookupArguments(parsed) {
+    const output = parseOutput(parsed, COLLECTION_COMMAND_DEFINITIONS.lookup);
+    const selectedFailPolicies = failPolicies(parsed, 'lookup');
+    return {
+        action: 'lookup',
+        query: parsed.positionalValue('target'),
+        output,
+        deep: parsed.hasOption('--deep'),
+        detail: parsed.hasOption('--summary')
+            ? 'summary'
+            : parsed.hasOption('--verbose')
+                ? 'verbose'
+                : 'standard',
+        strictExit: parsed.hasOption('--strict-exit'),
+        events: parsed.hasOption('--events'),
+        plan: parsed.hasOption('--plan'),
+        includeAttribution: !parsed.hasOption('--no-attribution'),
+        observerLabel: normalizedLabel(parsed, '--observer', 80),
+        vantageLabel: normalizedLabel(parsed, '--vantage', 80),
+        ...terminalOptions(parsed),
+        ...(parsed.hasOption('--browse') ? { browse: true } : {}),
+        ...(parsed.hasOption('--exact-url') ? { exactUrl: true } : {}),
+        ...(parsed.optionValue('--save-lookup')
+            ? { saveLookup: parsed.optionValue('--save-lookup') }
+            : {}),
+        ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
+    };
+}
+function parseBulkArguments(parsed) {
+    const deep = parsed.hasOption('--deep');
+    const selectedFailPolicies = failPolicies(parsed, 'bulk');
+    const output = parseOutput(parsed, COLLECTION_COMMAND_DEFINITIONS.bulk);
+    const filter = parsed.hasOption('--registered-only')
+        ? 'registered'
+        : parsed.hasOption('--inconclusive-only')
+            ? 'inconclusive'
+            : parsed.hasOption('--errors-only')
+                ? 'errors'
+                : 'all';
+    return {
+        action: 'bulk',
+        source: parsed.positionalValue('source'),
+        output,
+        deep,
+        concurrency: parsed.integerOption('--concurrency') ?? commandDefaultNumber('bulk', '--concurrency', deep),
+        checkpoint: parsed.optionValue('--checkpoint'),
+        resume: parsed.hasOption('--resume'),
+        events: parsed.hasOption('--events'),
+        plan: parsed.hasOption('--plan'),
+        filter,
+        ...terminalOptions(parsed),
+        ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
+    };
+}
+function parseDiscoverArguments(parsed) {
+    return {
+        action: 'discover',
+        seed: parsed.positionalValue('subject'),
+        output: parseOutput(parsed, COLLECTION_COMMAND_DEFINITIONS.discover),
+        ...discoveryValues(parsed),
+        snapshotSource: parsed.optionValue('--snapshot'),
+        ...terminalOptions(parsed),
+    };
+}
+function discoveryValues(parsed) {
+    const familyText = parsed.optionValue('--families');
+    return {
+        preset: (familyText
+            ? 'custom'
+            : (parsed.optionValue('--preset') ?? commandDefaultText('discover', '--preset'))),
+        keyboardLayout: (parsed.optionValue('--keyboard') ??
+            commandDefaultText('discover', '--keyboard')),
+        tldText: parsed.optionValue('--tlds'),
+        dictionarySource: parsed.optionValue('--dictionary'),
+        familyText,
+    };
+}
+function parseDiscoverScanArguments(parsed) {
+    const deep = parsed.hasOption('--deep');
+    const selectedFailPolicies = failPolicies(parsed, 'discover-scan');
+    const filter = parsed.hasOption('--registered-only')
+        ? 'registered'
+        : parsed.hasOption('--inconclusive-only')
+            ? 'inconclusive'
+            : parsed.hasOption('--acquisition-only')
+                ? 'acquisition'
+                : parsed.hasOption('--suppressed-only')
+                    ? 'suppressed'
+                    : 'all';
+    return {
+        action: 'discover-scan',
+        seed: parsed.positionalValue('subject'),
+        output: parseOutput(parsed, COLLECTION_COMMAND_DEFINITIONS['discover-scan']),
+        ...discoveryValues(parsed),
+        deep,
+        scanLimit: parsed.integerOption('--scan-limit') ??
+            commandDefaultNumber('discover-scan', '--scan-limit', deep),
+        chunkSize: parsed.integerOption('--chunk-size') ?? commandDefaultNumber('discover-scan', '--chunk-size'),
+        concurrency: parsed.integerOption('--concurrency') ??
+            commandDefaultNumber('discover-scan', '--concurrency', deep),
+        checkpoint: parsed.optionValue('--checkpoint'),
+        resume: parsed.hasOption('--resume'),
+        resolverText: parsed.optionValue('--resolver'),
+        observationSnapshot: parsed.optionValue('--observation-snapshot'),
+        allowlistSource: parsed.optionValue('--allowlist'),
+        filter,
+        events: parsed.hasOption('--events'),
+        plan: parsed.hasOption('--plan'),
+        ...terminalOptions(parsed),
+        ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
+    };
+}
+export const COLLECTION_ARGUMENT_PARSERS = Object.freeze({
+    lookup: parseLookupArguments,
+    bulk: parseBulkArguments,
+    discover: parseDiscoverArguments,
+    'discover-scan': parseDiscoverScanArguments,
+});