pqcheck 0.7.9 → 0.10.0

package/README.md

@@ -8,7 +8,7 @@ npx pqcheck stripe.com
 
 Zero install. Works in any terminal with Node 18+. Free, no signup, no API key.
 
-The same scanner that powers [quantapact.com](https://quantapact.com), the browser extension, and the GitHub Action.
+The same scanner that powers [cipherwake.io](https://cipherwake.io), the browser extension, and the GitHub Action.
 
 ---
 
@@ -42,10 +42,11 @@ Plus a full ASM check suite for credibility:
 
 ```
 npx pqcheck <domain>                          Scan + print human-readable report
-npx pqcheck lock <domain>                     Generate quantapact.lock (QXM) committable manifest
+npx pqcheck lock <domain>                     Generate cipherwake.lock (QXM) committable manifest
 npx pqcheck deps <domain>                     Scan all third-party origins on the page (supply-chain HNDL)
 npx pqcheck diff <old.lock> <new.lock>        Compare two QXM lockfiles; exit 2 on regression
 npx pqcheck history <domain>                  Show 90-day score history (sparkline + samples)
+npx pqcheck changes <domain>                  Summarize public attack-surface changes in last 14 days
 npx pqcheck cert <file.pem>                   Analyze a local PEM/CRT cert file (offline, no network)
 ```
 
@@ -81,7 +82,7 @@ npx pqcheck --file domains.txt                Bulk scan from a newline-separated
 ### Subcommand-specific flags
 
 **`pqcheck deps`:**
-- `--lock` — Also write `quantapact-deps.lock` + `.md`
+- `--lock` — Also write `cipherwake-deps.lock` + `.md`
 - `-o <dir>` — Output directory for `--lock` files
 - `--max=<N>` — Max third parties to scan (default 20)
 - `--allowlist <file>` — Exit **3** if any third-party not in allowlist (CI vendor-risk gate)
@@ -160,13 +161,15 @@ Like SBOM, `package-lock.json`, or `cargo audit` outputs — track quantum expos
 ```bash
 npx pqcheck lock yourcompany.com
 # Writes:
-#   quantapact.lock          — stable JSON manifest
-#   quantapact-report.md     — human-readable summary (renders on GitHub)
+#   cipherwake.lock          — stable JSON manifest
+#   cipherwake-report.md     — human-readable summary (renders on GitHub)
 ```
 
 Commit both files. Use `npx pqcheck diff old.lock new.lock` in CI to surface regressions in PR comments.
 
-Schema documented at [quantapact.com/schemas/qxm/v1](https://quantapact.com/methodology/qxm).
+> **Filename history.** This tool was previously named Quantapact and earlier versions wrote `quantapact.lock` + `quantapact-report.md`. Both names work forever — `pqcheck lock` auto-detects an existing legacy lockfile and overwrites it in place rather than silently creating a second file in your repo. New repos get the new `cipherwake.lock` default. No migration required.
+
+Schema documented at [cipherwake.io/schemas/qxm/v1](https://cipherwake.io/methodology/qxm).
 
 ### Supply-chain dependency scanning
 
@@ -175,41 +178,41 @@ npx pqcheck deps stripe.com
 # Output: every third-party origin on stripe.com (analytics, CDN, fonts, etc.) graded for quantum risk
 ```
 
-Add `--lock` to write `quantapact-deps.lock` + `.md` for committing or PR comparison. Add `--allowlist file.txt` to gate CI on vendor approval.
+Add `--lock` to write `cipherwake-deps.lock` + `.md` for committing or PR comparison. Add `--allowlist file.txt` to gate CI on vendor approval.
 
 ## Companion surfaces
 
-This CLI is one of four ways to consume the [Decryption Blast Radius API](https://quantapact.com/api):
+This CLI is one of four ways to consume the [Decryption Blast Radius API](https://cipherwake.io/api):
 
 | Surface | Where |
 |---|---|
 | **CLI** (this package) | `npx pqcheck` |
 | **Browser extension** | Chrome Web Store / Firefox AMO / Edge — toolbar badge per tab + dependency analysis |
-| **GitHub Action** | [`quantapact/pqcheck/action@main`](https://github.com/quantapact/pqcheck/tree/main/action) — PR comments, SARIF upload, lockfile generation |
-| **Slack `/pqcheck`** | [Install on workspace](https://quantapact.com/install-slack) |
-| **Web** | [quantapact.com](https://quantapact.com) — share-friendly URLs at `/r/<domain>` |
+| **GitHub Action** | [`cipherwake-io/pqcheck/action@main`](https://github.com/cipherwake-io/pqcheck/tree/main/action) — PR comments, SARIF upload, lockfile generation |
+| **Slack `/pqcheck`** | [Install on workspace](https://cipherwake.io/install-slack) |
+| **Web** | [cipherwake.io](https://cipherwake.io) — share-friendly URLs at `/r/<domain>` |
 
 ## Public API
 
-`pqcheck` is a wrapper around the public Quantapact API. You can also call the API directly:
+`pqcheck` is a wrapper around the public Cipherwake API. You can also call the API directly:
 
 ```bash
-curl -s "https://www.quantapact.com/api/scan?domain=stripe.com" | jq '.grade, .score'
+curl -s "https://www.cipherwake.io/api/scan?domain=stripe.com" | jq '.grade, .score'
 ```
 
-Full API reference at [quantapact.com/api](https://quantapact.com/api).
+Full API reference at [cipherwake.io/api](https://cipherwake.io/api).
 
-**Rate limits:** 300 scans per hour per IP, 20 `--fresh` (force-refresh) scans per hour per IP. No API key required. Returns HTTP 429 if exceeded — back off and retry, or [let us know via the feedback form](https://quantapact.com/feedback) if you need higher limits (we're prioritizing the API tier based on real demand).
+**Rate limits:** 300 scans per hour per IP, 20 `--fresh` (force-refresh) scans per hour per IP. No API key required. Returns HTTP 429 if exceeded — back off and retry, or [let us know via the feedback form](https://cipherwake.io/feedback) if you need higher limits (we're prioritizing the API tier based on real demand).
 
 ## Methodology
 
 Decryption Blast Radius scoring methodology is fully open. Component weights, PQC discount math, the "what we DON'T claim" sections, edge cases — all documented:
 
-- [Decryption Blast Radius](https://quantapact.com/methodology/decryption-blast-radius) — core methodology
-- [Score components](https://quantapact.com/methodology/score-components) — the 4-bar weighted breakdown + PQC discount
-- [QXM lockfile schema](https://quantapact.com/methodology/qxm) — committable manifest format
-- [Browser extension methodology](https://quantapact.com/methodology/browser-extension) — supply-chain HNDL detection logic
-- [Methodology library](https://quantapact.com/methodology) — full index
+- [Decryption Blast Radius](https://cipherwake.io/methodology/decryption-blast-radius) — core methodology
+- [Score components](https://cipherwake.io/methodology/score-components) — the 4-bar weighted breakdown + PQC discount
+- [QXM lockfile schema](https://cipherwake.io/methodology/qxm) — committable manifest format
+- [Browser extension methodology](https://cipherwake.io/methodology/browser-extension) — supply-chain HNDL detection logic
+- [Methodology library](https://cipherwake.io/methodology) — full index
 
 ## Versioning + stability
 
@@ -219,20 +222,20 @@ The CLI follows the same policy — output formats are stable across minor versi
 
 ## Privacy
 
-`pqcheck` sends the domain you scan to `quantapact.com/api/scan` (so the TLS handshake can be performed from the public internet). No other data is sent — no email, no client-side identifier. The server logs anonymized analytics: domain, hashed IP (for rate limiting), user-agent. We don't track individual users across scans. See [quantapact.com/privacy](https://quantapact.com/privacy).
+`pqcheck` sends the domain you scan to `cipherwake.io/api/scan` (so the TLS handshake can be performed from the public internet). No other data is sent — no email, no client-side identifier. The server logs anonymized analytics: domain, hashed IP (for rate limiting), user-agent. We don't track individual users across scans. See [cipherwake.io/privacy](https://cipherwake.io/privacy).
 
 ## CI integration
 
 ```yaml
 # .github/workflows/quantum-risk-gate.yml
-- name: Quantapact public-surface gate
+- name: Cipherwake public-surface gate
   run: npx pqcheck@latest mycompany.com --threshold 7
 ```
 
-For richer integration (sticky PR comments, SARIF upload to Code Scanning, lockfile diff on regression), use the [GitHub Action](https://github.com/quantapact/pqcheck/tree/main/action):
+For richer integration (sticky PR comments, SARIF upload to Code Scanning, lockfile diff on regression), use the [GitHub Action](https://github.com/cipherwake-io/pqcheck/tree/main/action):
 
 ```yaml
-- uses: quantapact/pqcheck/action@main
+- uses: cipherwake-io/pqcheck/action@main
   with:
     domain: mycompany.com
     threshold: '7'
@@ -249,12 +252,12 @@ For richer integration (sticky PR comments, SARIF upload to Code Scanning, lockf
 
 ## License
 
-MIT. © 2026 Quantapact.
+MIT. © 2026 Cipherwake.
 
 ---
 
-**Source:** [github.com/quantapact/pqcheck](https://github.com/quantapact/pqcheck)
+**Source:** [github.com/cipherwake-io/pqcheck](https://github.com/cipherwake-io/pqcheck)
 
 **Changelog:** [CHANGELOG.md](./CHANGELOG.md) for version-by-version release notes.
 
-**Issues / feedback:** [quantapact.com/feedback](https://quantapact.com/feedback) or open an issue on the repo.
+**Issues / feedback:** [cipherwake.io/feedback](https://cipherwake.io/feedback) or open an issue on the repo.

package/bin/pqcheck.js

@@ -2,12 +2,48 @@
 // =============================================================================
 // pqcheck CLI — npx pqcheck <domain>
 // =============================================================================
-// Tiny wrapper around the public scan API at quantapact.com.
+// Tiny wrapper around the public scan API at cipherwake.io.
 // Zero deps (uses node:fetch). Works under `npx pqcheck` without installation.
 // =============================================================================
 
-const API_BASE = process.env.PQCHECK_API_BASE || "https://quantapact.com";
-const VERSION = "0.7.9";
+const API_BASE = process.env.PQCHECK_API_BASE || "https://cipherwake.io";
+const VERSION = "0.10.0";
+
+// API-key support — paid tiers (Starter $29 / Growth $79 / Scale $199) get
+// per-account monthly quotas instead of the per-IP rate limit. Set via:
+//   export CIPHERWAKE_API_KEY=qpk_<32-hex>
+// Anonymous CLI use still works (no env var → falls back to IP rate limit).
+//
+// QUANTAPACT_API_KEY is honored as a deprecated fallback for existing users
+// (rebrand 2026-05-15). Will be removed in v1.0; in the meantime no break.
+const QP_API_KEY = (process.env.CIPHERWAKE_API_KEY || process.env.QUANTAPACT_API_KEY || "").trim();
+
+// Builds headers with optional Authorization. Use for every CLI → API call
+// so a single env-var toggle authenticates every endpoint at once.
+function apiHeaders(extra = {}) {
+  const h = { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION}`, ...extra };
+  if (QP_API_KEY) h.authorization = `Bearer ${QP_API_KEY}`;
+  return h;
+}
+
+// Helpful messaging when the server tells us auth/quota failed.
+async function handleAuthError(resp) {
+  if (resp.status === 401) {
+    const body = await safeJSON(resp);
+    if (body?.error === "invalid_api_key") {
+      console.error(color("red", "CIPHERWAKE_API_KEY is invalid or revoked. Check https://cipherwake.io/account to rotate."));
+      return true;
+    }
+  }
+  if (resp.status === 429) {
+    const body = await safeJSON(resp);
+    if (body?.error === "monthly_quota_exceeded") {
+      console.error(color("red", `Monthly quota exceeded${body.detail ? ` — ${body.detail}` : ""}. Upgrade tier at https://cipherwake.io/pricing or wait until the 1st.`));
+      return true;
+    }
+  }
+  return false;
+}
 
 const ANSI = {
   reset:   "\x1b[0m",
@@ -25,9 +61,17 @@ const color = (c, s) => (supportsColor ? `${ANSI[c]}${s}${ANSI.reset}` : s);
 async function main() {
   const args = process.argv.slice(2);
 
-  if (args.length === 0 || args.includes("--help") || args.includes("-h")) {
+  // No-args entry: show a layman's quick-start before the full usage block.
+  // Behavior: argv.length === 0 prints the friendly intro then usage and exits 1.
+  // --help / -h prints only usage (no intro) and exits 0.
+  if (args.length === 0) {
+    printQuickStart();
     printUsage();
-    process.exit(args.length === 0 ? 1 : 0);
+    process.exit(1);
+  }
+  if (args.includes("--help") || args.includes("-h")) {
+    printUsage();
+    process.exit(0);
   }
   if (args.includes("--version") || args.includes("-v")) {
     console.log(`pqcheck ${VERSION}`);
@@ -47,9 +91,15 @@ async function main() {
   if (args[0] === "history") {
     return runHistoryCommand(args.slice(1));
   }
+  if (args[0] === "changes") {
+    return runChangesCommand(args.slice(1));
+  }
   if (args[0] === "cert") {
     return runCertCommand(args.slice(1));
   }
+  if (args[0] === "watch") {
+    return runWatchCommand(args.slice(1));
+  }
 
   // Multi-domain support: positional args are domains.
   // --file reads additional domains from a newline-delimited file.
@@ -133,7 +183,7 @@ async function runOneScan({ domain, format, quiet, threshold, webhookUrl, multi,
     const qs = fresh ? `?domain=${encodeURIComponent(domain)}&force=1` : `?domain=${encodeURIComponent(domain)}`;
     const resp = await fetch(`${API_BASE}/api/scan${qs}`, {
       method: "GET",
-      headers: { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION} (scan)` },
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (scan)` }),
     });
     if (!quiet && format === "text") process.stderr.write("\r\x1b[K");
     if (!resp.ok) {
@@ -232,7 +282,7 @@ async function runWatch({ domains, format, quiet, threshold, webhookUrl, interva
       try {
         const resp = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(domain)}`, {
           method: "GET",
-          headers: { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION} (watch)` },
+          headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (watch)` }),
         });
         if (!resp.ok) continue;
         const report = await resp.json();
@@ -357,7 +407,14 @@ function printCsvRow(r) {
   console.log(cells.join(","));
 }
 function csvEscape(s) {
-  const v = String(s ?? "");
+  // Spreadsheet-formula-injection defense (R2 finding): cells starting
+  // with =, +, -, @, TAB, or CR get treated as formulas by Excel/Sheets.
+  // Prefix with a literal-string ' to neutralize. Defense-in-depth even
+  // though domains are shape-validated upstream.
+  let v = String(s ?? "");
+  if (/^[=+\-@\t\r\n]/.test(v)) {
+    v = "'" + v;
+  }
   if (v.includes(",") || v.includes('"') || v.includes("\n")) {
     return '"' + v.replace(/"/g, '""') + '"';
   }
@@ -393,6 +450,13 @@ function printMarkdown(r, multi) {
   lines.push(`> ⚠ Public surface only. Internal Blast Radius is typically 12–40× this score.`);
   lines.push("");
   lines.push(`Full report: ${API_BASE}/?check=${encodeURIComponent(r.domain)} · Share: ${API_BASE}/r/${encodeURIComponent(r.domain)}`);
+  // Conversion CTA (generalbusiness.md principle #15): one-line activation
+  // path on every value-delivery moment. Pointed at /watch/<domain>.
+  // Audit-required 2026-05-14: copy matches current locked plan ($29 Starter
+  // not the old "watch free / weekly digest"). PR-comment context plants
+  // team-invitation idea for the eventual Growth tier upgrade.
+  lines.push(`📌 **Monitor ${r.domain} continuously?** ${API_BASE}/watch/${encodeURIComponent(r.domain)}`);
+  lines.push(`Cipherwake Starter $29/mo · 5 domains · daily scans + email alerts on cert/script/posture changes. Invite your team on Growth ($79/mo) when ready.`);
   if (multi) lines.push("\n---\n");
   console.log(lines.join("\n"));
 }
@@ -506,7 +570,25 @@ function printReport(r) {
     console.log("");
   }
 
-  console.log(color("violet", `  → Full report: ${API_BASE}/?check=${encodeURIComponent(r.domain)}`));
+  // Provenance pill — "Tracked by Cipherwake since X · N observations". Trust
+  // signal that this isn't a one-shot probe but a historical record. Only
+  // renders if we actually have prior observations for the domain.
+  if (r.trackedSince) {
+    const trackedDate = String(r.trackedSince).slice(0, 10);
+    const obs = typeof r.observations === "number" && r.observations > 0 ? r.observations : null;
+    const obsLine = obs ? ` · ${obs} observation${obs === 1 ? "" : "s"}` : "";
+    console.log(color("dim", `  Tracked by Cipherwake since ${trackedDate}${obsLine}`));
+    console.log("");
+  }
+
+  // Conversion CTA (generalbusiness.md principle #15): every value-delivery
+  // moment surfaces the same /watch/<domain> activation path. Audit-required
+  // 2026-05-14: copy must match current locked revenue plan ($29 Starter,
+  // not the old "free 1-domain weekly digest").
+  console.log(color("violet", `  📌 Monitor ${r.domain} daily: ${API_BASE}/watch/${encodeURIComponent(r.domain)}`));
+  console.log(color("dim",    `     Cipherwake Starter $29/mo · 5 watched domains · email alerts · cancel anytime`));
+  console.log("");
+  console.log(color("dim",    `  → Full report: ${API_BASE}/?check=${encodeURIComponent(r.domain)}`));
   console.log(color("dim",    `  → Share this:  ${API_BASE}/r/${encodeURIComponent(r.domain)}`));
   console.log(color("dim",    `  → Compare two: ${API_BASE}/compare?a=${encodeURIComponent(r.domain)}&b=`));
   console.log("");
@@ -531,6 +613,31 @@ async function safeJSON(resp) {
   try { return await resp.json(); } catch { return null; }
 }
 
+// Friendly first-time intro shown when the CLI is invoked with no args.
+// Goal: tell a brand-new user what this tool does + give them ONE
+// command to copy-paste, before the full usage block. Modeled on
+// `curl`/`gh`/`vercel` first-run output (concise, action-oriented).
+function printQuickStart() {
+  console.log(`
+${color("bold", "👋 Welcome to pqcheck")} ${color("dim", `(v${VERSION})`)}
+
+Cipherwake's CLI grades any website's quantum-decryption risk —
+the chance that a harvest-now-decrypt-later attack could read its
+TLS traffic once quantum decryption arrives.
+
+${color("bold", "Try it:")}
+  ${color("dim", "$")} npx pqcheck chase.com
+
+${color("bold", "What you'll see:")} a single letter grade (A–F), the score components
+(cipher class, cert lifetime, key rotation history, subdomain exposure),
+top findings, and a link to the full interactive report.
+
+${color("bold", "Free + open methodology.")} No account needed for single-domain scans.
+Add ${color("dim", "QUANTAPACT_API_KEY")} env var for higher rate limits + private results
+(create one at ${color("dim", "https://cipherwake.io/signin")}).
+`);
+}
+
 function printUsage() {
   console.log(`
 ${color("bold", "pqcheck")} ${color("dim", `v${VERSION}`)}
@@ -539,11 +646,13 @@ Public Surface Blast Radius — quantum-decryption risk for any domain.
 
 ${color("bold", "Commands:")}
   npx pqcheck <domain>                          Scan + print human-readable report
-  npx pqcheck lock <domain>                     Generate quantapact.lock (QXM) committable manifest
+  npx pqcheck lock <domain>                     Generate cipherwake.lock (QXM) committable manifest
   npx pqcheck deps <domain>                     Scan all third-party origins on the page (supply-chain HNDL)
   npx pqcheck diff <old.lock> <new.lock>        Compare two QXM lockfiles; exit 2 on regression
   npx pqcheck history <domain>                  Show 90-day score history (sparkline + samples)
+  npx pqcheck changes <domain>                  Summarize public attack-surface changes in last 14 days
   npx pqcheck cert <file.pem>                   Analyze a local PEM/CRT cert file (offline, no network)
+  npx pqcheck watch <domain>                    Add a domain to your watched-domain list (requires CIPHERWAKE_API_KEY)
 
 ${color("bold", "Multi-domain:")}
   npx pqcheck a.com b.com c.com                 Multi-domain scan (positional)
@@ -568,7 +677,7 @@ ${color("bold", "Common flags:")}
 
 ${color("bold", "Subcommand-specific:")}
   pqcheck deps:
-    --lock                                       Also write quantapact-deps.lock + .md
+    --lock                                       Also write cipherwake-deps.lock + .md
     -o <dir>                                     Output directory for --lock files
     --max=<N>                                    Max third parties to scan (default 20)
     --allowlist <file>                           Exit 3 if any third-party not in allowlist (CI gate)
@@ -597,14 +706,14 @@ ${color("bold", "Examples:")}
   npx pqcheck deps acme.com --baseline .pqcheck-baseline.json --write-baseline   ${color("dim", "# capture initial state")}
   npx pqcheck deps acme.com --baseline .pqcheck-baseline.json --fail-on-new      ${color("dim", "# fail PR on new third party")}
   npx pqcheck diff main.lock pr.lock        ${color("dim", "# regression detection in PR")}
-  npx pqcheck history quantapact.com
+  npx pqcheck history cipherwake.io
   npx pqcheck cert ./mycert.pem             ${color("dim", "# offline cert analysis")}
   npx pqcheck --file domains.txt --format json > scans.ndjson
   npx pqcheck mybank.com --format sarif > pqcheck.sarif   ${color("dim", "# upload to Code Scanning")}
   npx pqcheck mybank.com --gh-action        ${color("dim", "# inline PR annotations")}
 
 Backed by the patented Decryption Blast Radius methodology.
-${color("violet", "https://quantapact.com")}
+${color("violet", "https://cipherwake.io")}
 `);
 }
 
@@ -612,20 +721,46 @@ ${color("violet", "https://quantapact.com")}
 // `pqcheck lock` — QXM (Quantum Exposure Manifest) generator
 // =============================================================================
 // Generates two files committable to a git repo:
-//   quantapact.lock          — stable JSON manifest (machine-readable)
-//   quantapact-report.md     — human-readable summary (renders on GitHub)
+//   cipherwake.lock          — stable JSON manifest (machine-readable)
+//   cipherwake-report.md     — human-readable summary (renders on GitHub)
 //
 // Like SBOM / package-lock.json / cargo audit / snyk test outputs — devs commit
 // these to track quantum exposure as a first-class technical concern.
 //
+// Filename history: this tool was previously named Quantapact, and earlier
+// versions wrote `quantapact.lock` / `quantapact-report.md`. We permanently
+// support reading EITHER filename; existing repos with the old name keep
+// working forever. When re-locking in a directory that has the legacy file,
+// we overwrite it in place rather than silently creating a new file alongside.
+// New repos (no existing lockfile) get the new default `cipherwake.lock`.
+//
 // Usage:
-//   npx pqcheck lock <domain>           Write to ./quantapact.lock + .md
+//   npx pqcheck lock <domain>           Write to ./cipherwake.lock + .md
+//                                       (or preserves ./quantapact.lock if present)
 //   npx pqcheck lock <domain> -o dir/   Write into a specific directory
 //   npx pqcheck lock <domain> --stdout  Print JSON to stdout (no files)
 //   npx pqcheck lock                    Read domain from existing
-//                                       quantapact.lock if present, else error
+//                                       cipherwake.lock OR quantapact.lock, else error
 // =============================================================================
 
+// Discover an existing lockfile in `dir`, preferring the new name but
+// accepting the legacy name. Returns { lockPath, mdPath, isLegacy } if found,
+// or null if neither exists. Read-anywhere, write-back-to-same-name policy.
+async function discoverExistingLockfile(fs, path, dir) {
+  const candidates = [
+    { lockName: "cipherwake.lock", mdName: "cipherwake-report.md", isLegacy: false },
+    { lockName: "quantapact.lock", mdName: "quantapact-report.md", isLegacy: true },
+  ];
+  for (const c of candidates) {
+    const lockPath = path.join(dir, c.lockName);
+    try {
+      await fs.access(lockPath);
+      return { lockPath, mdPath: path.join(dir, c.mdName), isLegacy: c.isLegacy };
+    } catch { /* try next */ }
+  }
+  return null;
+}
+
 async function runLockCommand(args) {
   const fs = await import("node:fs/promises");
   const path = await import("node:path");
@@ -639,16 +774,26 @@ async function runLockCommand(args) {
   const positional = args.filter((a) => !a.startsWith("-") && a !== outDir);
   let domain = positional.length > 0 ? normalizeDomain(positional[0]) : null;
 
+  // Discover any existing lockfile (new or legacy). Used both for re-lock
+  // domain auto-detection AND to preserve the filename on write.
+  const existing = await discoverExistingLockfile(fs, path, outDir);
+
   if (!domain) {
-    try {
-      const existing = await fs.readFile(path.join(outDir, "quantapact.lock"), "utf8");
-      const parsed = JSON.parse(existing);
-      domain = parsed.domain;
-      if (!stdout) {
-        console.error(color("dim", `Re-locking from existing quantapact.lock (domain: ${domain})`));
+    if (existing) {
+      try {
+        const content = await fs.readFile(existing.lockPath, "utf8");
+        const parsed = JSON.parse(content);
+        domain = parsed.domain;
+        if (!stdout) {
+          const baseName = path.basename(existing.lockPath);
+          console.error(color("dim", `Re-locking from existing ${baseName} (domain: ${domain})`));
+        }
+      } catch {
+        console.error(color("red", `error: could not parse existing ${path.basename(existing.lockPath)}`));
+        process.exit(1);
       }
-    } catch {
-      console.error(color("red", "error: no domain provided and no existing quantapact.lock found"));
+    } else {
+      console.error(color("red", "error: no domain provided and no existing cipherwake.lock found"));
       console.error(color("dim", "Usage: npx pqcheck lock <domain>"));
       process.exit(1);
     }
@@ -665,7 +810,7 @@ async function runLockCommand(args) {
   try {
     const resp = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(domain)}`, {
       method: "GET",
-      headers: { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION} (lock)` },
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (lock)` }),
     });
     if (!stdout) process.stderr.write("\r\x1b[K");
     if (!resp.ok) {
@@ -688,9 +833,16 @@ async function runLockCommand(args) {
     return;
   }
 
-  // Write both files
-  const lockPath = path.join(outDir, "quantapact.lock");
-  const mdPath = path.join(outDir, "quantapact-report.md");
+  // Write both files. Filename policy: if a legacy quantapact.lock already
+  // exists in this directory, overwrite it in place (preserve user's
+  // committed filename — no surprise renames in their repo). Otherwise
+  // default to the new cipherwake.lock.
+  const lockPath = existing
+    ? existing.lockPath
+    : path.join(outDir, "cipherwake.lock");
+  const mdPath = existing
+    ? existing.mdPath
+    : path.join(outDir, "cipherwake-report.md");
   const md = renderQxmMarkdown(manifest);
 
   try {
@@ -736,7 +888,7 @@ function buildQxmManifest(report, crypto) {
   );
 
   return {
-    schema: "https://quantapact.com/schemas/qxm/v1",
+    schema: "https://cipherwake.io/schemas/qxm/v1",
     schemaVersion: 1,
     generator: `pqcheck-cli/${VERSION}`,
     generatedAt: report.generatedAt || new Date().toISOString(),
@@ -756,13 +908,13 @@ function buildQxmManifest(report, crypto) {
     components: report.components || null,
     evidence: {
       evidenceHash,
-      methodology: "https://quantapact.com/methodology",
-      shareableReport: `https://quantapact.com/r/${encodeURIComponent(report.domain)}`,
-      badge: `https://quantapact.com/badge/${encodeURIComponent(report.domain)}.svg`,
+      methodology: "https://cipherwake.io/methodology",
+      shareableReport: `https://cipherwake.io/r/${encodeURIComponent(report.domain)}`,
+      badge: `https://cipherwake.io/badge/${encodeURIComponent(report.domain)}.svg`,
     },
     remediation: {
       tessera: tesseraNeeded ? "join-waitlist" : "not-needed",
-      tesseraWaitlist: "https://quantapact.com/feedback?source=qxm-tessera-interest",
+      tesseraWaitlist: "https://cipherwake.io/feedback?source=qxm-tessera-interest",
       notes: tesseraNeeded
         ? "Findings include cryptographic exposure that Tessera SDK is being designed to remediate. Tessera is in development; join the waitlist to be notified when ready."
         : "No quantum-decryption-relevant findings requiring Tessera remediation at this time.",
@@ -775,7 +927,7 @@ function renderQxmMarkdown(m) {
   lines.push(`# Quantum Exposure Manifest — \`${m.domain}\``);
   lines.push("");
   lines.push(`> **Decryption Blast Radius:** ${m.score} / 10 (Grade ${m.grade}, ${m.scoreLabel})`);
-  lines.push(`> Generated by [pqcheck](https://quantapact.com) at ${m.generatedAt}`);
+  lines.push(`> Generated by [pqcheck](https://cipherwake.io) at ${m.generatedAt}`);
   lines.push("");
   if (!m.reachable) {
     lines.push(`*${m.domain} was not reachable at scan time.*`);
@@ -852,7 +1004,8 @@ function renderQxmMarkdown(m) {
 // Fetches the public HTML of the target domain, extracts third-party origins
 // referenced via <script src>, <iframe src>, <link href>, <img src>, then runs
 // /api/scan against each unique third party. Outputs a sorted summary + an
-// optional committable lockfile (quantapact-deps.lock).
+// optional committable lockfile (cipherwake-deps.lock; legacy quantapact-deps.lock
+// is overwritten in place if present, see write-path comments below).
 //
 // Parallel to the browser extension's Dependencies tab, exposed as a CLI for
 // CI integration: gate PR builds on third-party crypto posture.
@@ -860,7 +1013,7 @@ function renderQxmMarkdown(m) {
 // Usage:
 //   npx pqcheck deps <domain>           Scan + print summary table
 //   npx pqcheck deps <domain> --json    JSON output (pipe to jq, etc.)
-//   npx pqcheck deps <domain> --lock    Also write quantapact-deps.lock + .md
+//   npx pqcheck deps <domain> --lock    Also write cipherwake-deps.lock + .md
 //   npx pqcheck deps <domain> -o dir/   Output directory for --lock files
 //   npx pqcheck deps <domain> --max=20  Cap on third parties scanned (default 20)
 // =============================================================================
@@ -980,7 +1133,7 @@ async function runDepsCommand(args) {
       batch.map(async (h) => {
         try {
           const r = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(h.host)}&source=cli-deps`, {
-            headers: { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION} (deps)` },
+            headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (deps)` }),
           });
           if (!r.ok) return { ...h, types: Array.from(h.types), scan: null, error: `${r.status}` };
           const body = await r.json();
@@ -1034,7 +1187,7 @@ async function runDepsCommand(args) {
 
   // Build manifest
   const manifest = {
-    $schema: "https://quantapact.com/schemas/deps/v1",
+    $schema: "https://cipherwake.io/schemas/deps/v1",
     schemaVersion: "1.2", // bumped for CSP + vendor classification fields
     domain,
     scannedAt: new Date().toISOString(),
@@ -1074,7 +1227,7 @@ async function runDepsCommand(args) {
     try {
       const fs2 = await import("node:fs/promises");
       const baselinePayload = {
-        $schema: "https://quantapact.com/schemas/deps-baseline/v1",
+        $schema: "https://cipherwake.io/schemas/deps-baseline/v1",
         domain,
         capturedAt: new Date().toISOString(),
         toolVersion: VERSION,
@@ -1143,10 +1296,19 @@ async function runDepsCommand(args) {
     const types = r.types.join(",");
     // Vendor classification — "(New Relic · errors)" beats "bam.nr-data.net"
     // for comprehension. Padded to 22 chars so the table columns stay aligned.
+    // Heuristic matches return `name: null` and just a category — render as
+    // "(cdn — inferred)" to signal we're guessing without claiming certainty.
     const vendor = classifyVendor(r.host);
-    const vendorStrRaw = vendor ? `${vendor.name} (${vendor.category})` : "—";
+    let vendorStrRaw;
+    if (vendor?.name) {
+      vendorStrRaw = `${vendor.name} (${vendor.category})`;
+    } else if (vendor?.category) {
+      vendorStrRaw = `(${vendor.category} — inferred)`;
+    } else {
+      vendorStrRaw = "—";
+    }
     const vendorTruncated = vendorStrRaw.length > 22 ? vendorStrRaw.slice(0, 21) + "…" : vendorStrRaw.padEnd(22, " ");
-    const vendorColored = vendor ? color("dim", vendorTruncated) : color("dim", vendorTruncated);
+    const vendorColored = color("dim", vendorTruncated);
     console.log(`  ${gradeColored.padEnd(8, " ")}  ${host}  ${vendorColored}  ${pqc}  ${sriCell}  ${color("dim", types)}`);
   }
   console.log("");
@@ -1158,8 +1320,19 @@ async function runDepsCommand(args) {
   console.log("");
 
   if (lock) {
-    const lockPath = path.join(outDir, "quantapact-deps.lock");
-    const mdPath = path.join(outDir, "quantapact-deps-report.md");
+    // Filename policy mirrors `pqcheck lock`: prefer the new cipherwake-deps.lock,
+    // but if a legacy quantapact-deps.lock exists in this dir, overwrite that one
+    // in place so the user's repo doesn't suddenly grow a second lockfile.
+    const fsSync = await import("node:fs");
+    const legacyDepsLock = path.join(outDir, "quantapact-deps.lock");
+    const legacyDepsMd = path.join(outDir, "quantapact-deps-report.md");
+    const hasLegacy = fsSync.existsSync(legacyDepsLock);
+    const lockPath = hasLegacy
+      ? legacyDepsLock
+      : path.join(outDir, "cipherwake-deps.lock");
+    const mdPath = hasLegacy
+      ? legacyDepsMd
+      : path.join(outDir, "cipherwake-deps-report.md");
     try {
       await fs.mkdir(outDir, { recursive: true });
       await fs.writeFile(lockPath, JSON.stringify(manifest, null, 2));
@@ -1199,7 +1372,7 @@ async function fetchPageHTML(domain) {
       method: "GET",
       redirect: "follow",
       signal: ctrl.signal,
-      headers: { "User-Agent": `pqcheck-cli/${VERSION} (deps; +https://quantapact.com)` },
+      headers: { "User-Agent": `pqcheck-cli/${VERSION} (deps; +https://cipherwake.io)` },
     });
     clearTimeout(t);
     if (!resp.ok) return null;
@@ -1303,6 +1476,39 @@ const SERVICE_CATALOG = {
   "tiktok.com": { name: "TikTok", category: "social" },
 };
 
+// Conservative heuristic patterns — same as lib/serviceCatalog.ts + popup.js.
+// Used when a host isn't in the explicit catalog. Doesn't name the vendor
+// (we don't know), but assigns a high-confidence category like "cdn" or
+// "ads" so unknown hosts aren't blank.
+const HEURISTIC_PATTERNS = [
+  // CDN
+  { re: /^cdn[.-]/, category: "cdn" },
+  { re: /^static\./, category: "cdn" },
+  { re: /^assets\./, category: "cdn" },
+  { re: /\.cloudfront\.net$/, category: "cdn" },
+  { re: /\.akamai(?:edge|hd|ized)?\.net$/, category: "cdn" },
+  { re: /\.fastly\.net$/, category: "cdn" },
+  { re: /\.azureedge\.net$/, category: "cdn" },
+  // Analytics / RUM
+  { re: /^analytics?\./, category: "analytics" },
+  { re: /^metrics?\./, category: "analytics" },
+  { re: /^telemetry\./, category: "analytics" },
+  { re: /^rum\./, category: "analytics" },
+  // Ads
+  { re: /^ads?[.-]/, category: "ads" },
+  { re: /^adserver\./, category: "ads" },
+  { re: /^pubads\./, category: "ads" },
+  { re: /\.advertising\./, category: "ads" },
+  // Consent / cookies
+  { re: /^consent\./, category: "consent" },
+  { re: /^cookies?\./, category: "consent" },
+  { re: /^gdpr\./, category: "consent" },
+  // Fonts
+  { re: /^fonts?\./, category: "fonts" },
+  // Errors / monitoring
+  { re: /^sentry[.-]/, category: "errors" },
+];
+
 function classifyVendor(host) {
   if (!host) return null;
   const lower = host.toLowerCase();
@@ -1312,6 +1518,14 @@ function classifyVendor(host) {
       return SERVICE_CATALOG[pattern];
     }
   }
+  for (const { re, category } of HEURISTIC_PATTERNS) {
+    if (re.test(lower)) {
+      // Inferred — no vendor name, just the category. CLI consumers (the
+      // pretty table + JSON output) check `name === null` to distinguish
+      // from explicit catalog matches.
+      return { name: null, category };
+    }
+  }
   return null;
 }
 
@@ -1451,6 +1665,67 @@ function depsManifestToMarkdown(m) {
 // SARIF + GitHub Action output formats
 // =============================================================================
 
+// Derive a SARIF-stable rule ID from a finding. Prefer the registry's stable
+// `id` (e.g., "tls.rsa_kex_fallback") so the same finding gets the same
+// ruleId every run — without it, GitHub Code Scanning treats a reordered
+// finding list as a fresh batch of new findings, blowing up the triage UX.
+// Short non-crypto hash for SARIF rule-ID disambiguation. djb2-style.
+// Pure JS so it works in both Node and the CLI bundle. 8-char hex output
+// is enough entropy to disambiguate distinct legacy findings without
+// becoming churn-prone — same input string always produces the same hash.
+function shortHash(input) {
+  let h = 5381;
+  for (let i = 0; i < input.length; i++) {
+    h = ((h << 5) + h + input.charCodeAt(i)) >>> 0;
+  }
+  return h.toString(16).padStart(8, "0");
+}
+
+function stableRuleId(f) {
+  if (f && typeof f.id === "string" && f.id.length > 0) {
+    // Normalize: if a registry ID already carries the `pqcheck.` prefix
+    // (which happened before this helper existed), don't double-prefix
+    // it into `pqcheck.pqcheck.tls...`. Strip and reattach.
+    const id = f.id.replace(/^pqcheck\./i, "");
+    return `pqcheck.${id}`;
+  }
+  // Fallback for legacy findings emitted without the registry — slug the
+  // title. Still stable across runs (same input → same output).
+  const title = f?.title || "finding";
+  const detail = f?.detail || "";
+  const slug = title
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "_")
+    .replace(/^_+|_+$/g, "")
+    .slice(0, 48);
+  // GPT adversarial review 2026-05-12: legacy findings with similar
+  // titles ("No HSTS header" vs "No HSTS Header!") both slug to
+  // "no_hsts_header" and would collide in SARIF, causing GitHub Code
+  // Scanning to merge unrelated findings. Append a short hash of the
+  // full (title + detail) so semantically-different findings get
+  // distinct rule IDs even when their slugged titles match.
+  const disambiguator = shortHash(`${title}|${detail}`);
+  if (slug.length === 0) {
+    return `pqcheck.legacy.unnamed.${disambiguator}`;
+  }
+  return `pqcheck.legacy.${slug}.${disambiguator}`;
+}
+
+// Deduplicate the `rules` array — multiple findings can share the same
+// underlying rule (e.g., two cert findings both pinned to `cert.expired`).
+// SARIF's rule list must contain each rule once.
+function dedupeRules(findings) {
+  const seen = new Set();
+  const out = [];
+  for (const f of findings) {
+    const id = stableRuleId(f);
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push(f);
+  }
+  return out;
+}
+
 function reportToSarif(report) {
   // SARIF 2.1.0 minimal schema for security findings.
   // Spec: https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html
@@ -1464,9 +1739,15 @@ function reportToSarif(report) {
         driver: {
           name: "pqcheck",
           version: VERSION,
-          informationUri: "https://quantapact.com",
-          rules: findings.map((f, i) => ({
-            id: `pqcheck-${i + 1}`,
+          informationUri: "https://cipherwake.io",
+          // Stable rule IDs — anchored to the finding's registry id (e.g.
+          // "tls.rsa_kex_fallback") when present, otherwise a slug derived
+          // from the title. Previously used positional pqcheck-${i+1} which
+          // made GitHub Code Scanning see every reorder as a "new" finding,
+          // poisoning the dedup/triage UX. Stable IDs let Code Scanning
+          // recognize the same rule across runs.
+          rules: dedupeRules(findings).map((f) => ({
+            id: stableRuleId(f),
             name: (f.title || "finding").replace(/[^A-Za-z0-9]/g, "_"),
             shortDescription: { text: f.title || "finding" },
             fullDescription: { text: f.detail || f.title || "finding" },
@@ -1474,8 +1755,8 @@ function reportToSarif(report) {
           })),
         },
       },
-      results: findings.map((f, i) => ({
-        ruleId: `pqcheck-${i + 1}`,
+      results: findings.map((f) => ({
+        ruleId: stableRuleId(f),
         level: sevMap[f.severity] || "note",
         message: { text: `${f.title || "finding"}${f.detail ? ` — ${f.detail}` : ""}` },
         // GitHub Code Scanning requires file: scheme (or relative path) for
@@ -1483,7 +1764,7 @@ function reportToSarif(report) {
         // relative path so findings show up cleanly in the Security tab.
         locations: [{
           physicalLocation: {
-            artifactLocation: { uri: `quantapact-scan/${report.domain || "unknown"}.txt` },
+            artifactLocation: { uri: `cipherwake-scan/${report.domain || "unknown"}.txt` },
             region: { startLine: 1, startColumn: 1 },
           },
         }],
@@ -1492,7 +1773,7 @@ function reportToSarif(report) {
           score: report.score,
           grade: report.grade,
           severity: f.severity,
-          reportUrl: `https://www.quantapact.com/r/${report.domain || ""}`,
+          reportUrl: `https://www.cipherwake.io/r/${report.domain || ""}`,
         },
       })),
       properties: {
@@ -1513,10 +1794,10 @@ function printGitHubActionAnnotations(report) {
   if (report._meta?.degraded) {
     const reason = String(report._meta.degradedReason || "live probe failed").replace(/[\r\n]/g, " ").replace(/::/g, ":");
     const since = String(report._meta.lastUpdated || "unknown");
-    console.log(`::warning title=Quantapact: cached score (live probe failed)::Showing last known-good score from ${since}. Reason: ${reason}. Re-run shortly for a fresh probe.`);
+    console.log(`::warning title=Cipherwake: cached score (live probe failed)::Showing last known-good score from ${since}. Reason: ${reason}. Re-run shortly for a fresh probe.`);
   }
   // Top-line score/grade as a notice
-  console.log(`::notice title=Quantapact: ${report.domain}::Grade ${report.grade || "?"} · score ${report.score ?? "?"} / 10`);
+  console.log(`::notice title=Cipherwake: ${report.domain}::Grade ${report.grade || "?"} · score ${report.score ?? "?"} / 10`);
   for (const f of findings) {
     const cmd = sevMap[f.severity] || "notice";
     const title = (f.title || "finding").replace(/[\r\n]/g, " ");
@@ -1548,7 +1829,7 @@ async function runHistoryCommand(args) {
   let h;
   try {
     const r = await fetch(`${API_BASE}/api/history?domain=${encodeURIComponent(domain)}&days=${days}`, {
-      headers: { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION} (history)` },
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (history)` }),
     });
     if (!r.ok) {
       console.error(color("red", `error: ${r.status} ${r.statusText}`));
@@ -1608,6 +1889,84 @@ async function runHistoryCommand(args) {
   console.log("");
 }
 
+// =============================================================================
+// `pqcheck changes <domain>` — surface observation-table deltas for a domain
+// =============================================================================
+// Hits /api/changes-summary which aggregates the new observation tables
+// shipped 2026-05-13 (subdomain_observations, script_observations,
+// posture_snapshots, cert_observations). Returns "N attack-surface changes
+// in last 14d" + breakdown. Devs use this in CI ("did anything change since
+// yesterday?") and in PR descriptions ("attached: 3 changes detected since
+// last week").
+
+async function runChangesCommand(args) {
+  const json = args.includes("--json");
+  const positional = args.filter((a) => !a.startsWith("-"));
+  const domain = positional.length > 0 ? normalizeDomain(positional[0]) : null;
+  if (!domain || !isValidDomain(domain)) {
+    console.error(color("red", "error: pqcheck changes requires a valid domain"));
+    console.error(color("dim", "Usage: npx pqcheck changes <domain> [--json]"));
+    process.exit(1);
+  }
+
+  let summary;
+  try {
+    const r = await fetch(`${API_BASE}/api/changes-summary?domain=${encodeURIComponent(domain)}`, {
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (changes)` }),
+    });
+    if (!r.ok) {
+      console.error(color("red", `error: ${r.status} ${r.statusText}`));
+      process.exit(1);
+    }
+    summary = await r.json();
+  } catch (err) {
+    console.error(color("red", `error: ${err.message}`));
+    process.exit(1);
+  }
+
+  if (json) {
+    console.log(JSON.stringify(summary, null, 2));
+    return;
+  }
+
+  const tracked = summary.trackedSince;
+  const total = summary.changes?.last14d ?? 0;
+  const b = summary.breakdown ?? {};
+  console.log("");
+  console.log(`  ${color("bold", domain)} ${color("dim", "·")} attack-surface change summary`);
+
+  if (!tracked) {
+    console.log(color("dim", "  No observation history yet. Run `npx pqcheck " + domain + "` to start accumulating."));
+    console.log("");
+    return;
+  }
+
+  const trackedDate = String(tracked).slice(0, 10);
+  console.log(color("dim", `  Tracking since ${trackedDate}`));
+  console.log("");
+
+  if (total === 0) {
+    console.log(`  ${color("green", "✓")} No public attack-surface changes detected in the last 14 days.`);
+    console.log("");
+    return;
+  }
+
+  console.log(`  ${color("yellow", "⚠")} ${color("bold", total)} change${total === 1 ? "" : "s"} detected in the last 14 days:`);
+  console.log("");
+  if (b.newSubdomains14d) {
+    console.log(`    ${color("violet", "•")} ${color("bold", b.newSubdomains14d)} new subdomain${b.newSubdomains14d === 1 ? "" : "s"} observed in CT logs or live scans`);
+  }
+  if (b.newScripts14d) {
+    console.log(`    ${color("violet", "•")} ${color("bold", b.newScripts14d)} new third-party script host${b.newScripts14d === 1 ? "" : "s"} loaded`);
+  }
+  if (b.newCertKeys14d) {
+    console.log(`    ${color("violet", "•")} ${color("bold", b.newCertKeys14d)} new SPKI fingerprint${b.newCertKeys14d === 1 ? "" : "s"} (cert rotation with new key)`);
+  }
+  console.log("");
+  console.log(color("dim", `  Full changelog: ${API_BASE}/domain/${domain}/security-changelog`));
+  console.log("");
+}
+
 // =============================================================================
 // `pqcheck diff` — diff two QXM lockfiles
 // =============================================================================
@@ -1637,7 +1996,7 @@ async function runDiffCommand(args) {
   }
 
   console.log("");
-  console.log(`  ${color("bold", "Quantapact lockfile diff")}`);
+  console.log(`  ${color("bold", "Cipherwake lockfile diff")}`);
   console.log(`  ${color("dim", `${positional[0]} → ${positional[1]}`)}`);
   console.log("");
   if (diff.scoreChange !== null) {
@@ -1708,6 +2067,114 @@ function computeLockDiff(oldLock, newLock) {
 // `pqcheck cert <pem-file>` — analyze a local cert file (offline)
 // =============================================================================
 
+// `pqcheck watch <domain>` — adds the given domain to the user's watched-
+// domain list via the authenticated /api/watched-domains POST. Requires
+// QUANTAPACT_API_KEY env var. Closes the CLI ↔ account loop: developers
+// who use the CLI can now opt into persistent monitoring from the same
+// surface without leaving the terminal.
+async function runWatchCommand(args) {
+  const positional = args.filter((a) => !a.startsWith("-"));
+  if (positional.length === 0) {
+    console.error(color("red", "error: pqcheck watch requires a domain"));
+    console.error(color("dim", "Usage: npx pqcheck watch <domain>"));
+    console.error("");
+    console.error(color("dim", "Example: npx pqcheck watch chase.com"));
+    process.exit(1);
+  }
+  if (!QP_API_KEY) {
+    const rawDomain = positional[0] ? String(positional[0]).trim().toLowerCase() : "";
+    const looksLikeDomain = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/.test(rawDomain);
+    console.error(color("red", "error: pqcheck watch requires CIPHERWAKE_API_KEY (paid tier)"));
+    console.error("");
+    console.error(color("dim", "Two ways to add this domain:"));
+    if (looksLikeDomain) {
+      console.error(color("dim", `  1. Sign up + click "Watch" in your browser:`));
+      console.error(color("dim", `       ${API_BASE}/watch/${rawDomain}`));
+    } else {
+      console.error(color("dim", `  1. Sign up + click "Watch" in your browser:`));
+      console.error(color("dim", `       ${API_BASE}/watch/<your-domain>`));
+    }
+    console.error(color("dim", `  2. Stay on the CLI — sign up + rotate an API key:`));
+    console.error(color("dim", `       ${API_BASE}/signin`));
+    console.error(color("dim", `       ${API_BASE}/account  (rotate key)`));
+    console.error(color("dim", `       export CIPHERWAKE_API_KEY=qpk_...`));
+    process.exit(1);
+  }
+
+  const raw = positional[0];
+  const domain = normalizeDomain(raw);
+  if (!isValidDomain(domain)) {
+    console.error(color("red", `error: '${raw}' is not a valid domain`));
+    process.exit(1);
+  }
+
+  console.log("");
+  console.log(color("violet", `  📌 Adding ${domain} to your watched-domain list…`));
+
+  let resp;
+  try {
+    resp = await fetch(`${API_BASE}/api/watched-domains`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "authorization": "Bearer " + QP_API_KEY,
+      },
+      body: JSON.stringify({ domain }),
+    });
+  } catch (err) {
+    console.error(color("red", `  network error: ${err.message ?? err}`));
+    process.exit(1);
+  }
+
+  if (resp.status === 401 || resp.status === 403) {
+    console.error(color("red", `  authentication failed (HTTP ${resp.status})`));
+    console.error(color("dim", `  Your API key may be invalid or revoked. Regenerate at ${API_BASE}/account`));
+    process.exit(1);
+  }
+
+  let out = {};
+  try { out = await resp.json(); } catch { /* ignore */ }
+
+  if (!resp.ok) {
+    if (out.error === "domain_already_watched") {
+      console.log(color("dim", `  ${domain} is already on your watched-domain list.`));
+      console.log(color("dim", `  Manage at: ${API_BASE}/account`));
+      process.exit(0);
+    }
+    if (out.error === "tier_cap_exceeded") {
+      console.error(color("red", `  ${out.message || "Tier cap reached."}`));
+      console.error(color("dim", `  See pricing: ${API_BASE}/pricing`));
+      process.exit(1);
+    }
+    if (out.error === "invalid_domain") {
+      console.error(color("red", `  ${domain} is not a valid hostname.`));
+      process.exit(1);
+    }
+    console.error(color("red", `  add failed: ${out.message || out.error || `HTTP ${resp.status}`}`));
+    process.exit(1);
+  }
+
+  console.log("");
+  console.log(color("green", `  ✓ Now watching ${domain}.`));
+  console.log("");
+  if (out.verificationInstructions) {
+    const v = out.verificationInstructions;
+    console.log(color("bold", "  Next: verify ownership"));
+    console.log(color("dim", `  Pick ONE method:`));
+    console.log("");
+    console.log(color("dim", `    DNS TXT     — name:  ${v.dnsTxt?.recordName}`));
+    console.log(color("dim", `                  value: ${v.dnsTxt?.recordValue}`));
+    console.log("");
+    console.log(color("dim", `    HTTP file   — url:   ${v.wellKnown?.url}`));
+    console.log(color("dim", `                  body:  ${v.wellKnown?.body}`));
+    console.log("");
+    console.log(color("dim", `  After adding the record, click 'Verify now' at ${API_BASE}/account`));
+    console.log(color("dim", `  or run: npx pqcheck watch ${domain} --verify  (coming soon)`));
+  }
+  console.log("");
+  process.exit(0);
+}
+
 async function runCertCommand(args) {
   const fs = await import("node:fs/promises");
   const crypto = await import("node:crypto");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pqcheck",
-  "version": "0.7.9",
+  "version": "0.10.0",
   "description": "Decryption Blast Radius scanner — find out how much of your data unlocks when quantum decryption arrives.",
   "keywords": [
     "post-quantum",
@@ -17,15 +17,15 @@
     "crypto-audit",
     "crypto-inventory"
   ],
-  "homepage": "https://quantapact.com",
-  "bugs": "https://quantapact.com",
+  "homepage": "https://cipherwake.io",
+  "bugs": "https://cipherwake.io",
   "repository": {
     "type": "git",
-    "url": "https://github.com/quantapact/pqcheck.git",
+    "url": "https://github.com/cipherwake-io/pqcheck.git",
     "directory": "cli"
   },
   "license": "MIT",
-  "author": "Quantapact",
+  "author": "Cipherwake",
   "type": "module",
   "engines": {
     "node": ">=18"