@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/cli/evidence-signing.mjs

@@ -1,11 +1,15 @@
 import { Buffer } from 'node:buffer';
 import { createHash, createPrivateKey, createPublicKey, sign, verify, } from 'node:crypto';
-import { canonicalArtifactJson } from "../frontend/src/lib/analysis/artifact-integrity.js";
-import { MAX_OFFLINE_ARTIFACT_BYTES, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { canonicalArtifactJsonFor, SORTED_JSON_V2, } from "../packages/evidence/artifact-integrity.mjs";
+import { hasVerifiedApplicableIntegrity, hasVerifiedArtifactStructure, MAX_OFFLINE_ARTIFACT_BYTES, verifyOfflineArtifact, } from "./artifact-verify.mjs";
+import { parseBoundedJsonObject } from "./bounded-json.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 export const SIGNED_EVIDENCE_PACKAGE_SCHEMA = 'whoisleuth.signed-evidence-package';
-export const SIGNED_EVIDENCE_PACKAGE_VERSION = 1;
+export const SIGNED_EVIDENCE_PACKAGE_VERSION = 2;
+export const EVIDENCE_SIGNATURE_VERIFICATION_SCHEMA = 'whoisleuth.evidence-signature-verification';
+export const EVIDENCE_SIGNATURE_VERIFICATION_VERSION = 2;
 export const EVIDENCE_SIGNATURE_ALGORITHM = 'Ed25519';
-export const EVIDENCE_SIGNATURE_CANONICALIZATION = 'sorted-json-v1';
+export const EVIDENCE_SIGNATURE_CANONICALIZATION = SORTED_JSON_V2;
 export const MAX_SIGNING_KEY_FILE_BYTES = 16 * 1024;
 const SHA256_RE = /^[a-f0-9]{64}$/u;
 const BASE64_RE = /^[A-Za-z0-9+/]+={0,2}$/u;
@@ -23,36 +27,23 @@ function record(value) {
         : null;
 }
 function parseObject(raw, label) {
-    if (typeof raw !== 'string')
-        throw new TypeError(`${label} must be UTF-8 JSON text.`);
-    const bytes = Buffer.byteLength(raw, 'utf8');
-    if (bytes === 0 || bytes > MAX_OFFLINE_ARTIFACT_BYTES) {
-        throw new TypeError(`${label} must be between 1 byte and ${MAX_OFFLINE_ARTIFACT_BYTES} bytes.`);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new TypeError(`${label} must be valid JSON.`);
-    }
-    const value = record(parsed);
-    if (!value)
-        throw new TypeError(`${label} must contain one JSON object.`);
-    return value;
+    return parseBoundedJsonObject(raw, { label, maximumBytes: MAX_OFFLINE_ARTIFACT_BYTES });
 }
 function hasExactKeys(value, expected) {
     const keys = Object.keys(value);
     return keys.length === expected.size && keys.every((key) => expected.has(key));
 }
 function timestamp(value) {
-    if (typeof value !== 'string' || value.length > 64) {
-        throw new TypeError('Signature time must be a valid timestamp.');
-    }
-    const parsed = Date.parse(value);
-    if (!Number.isFinite(parsed))
-        throw new TypeError('Signature time must be a valid timestamp.');
-    return new Date(parsed).toISOString();
+    const normalized = normalizeExplicitIsoTimestamp(value);
+    if (!normalized)
+        throw new TypeError('Signature time must be a valid timestamp with an explicit timezone.');
+    return normalized;
+}
+function canonicalTimestamp(value) {
+    const normalized = timestamp(value);
+    if (value !== normalized)
+        throw new TypeError('Signature time must use canonical UTC timestamp text.');
+    return normalized;
 }
 function importPrivateKey(pem) {
     if (Buffer.byteLength(pem, 'utf8') > MAX_SIGNING_KEY_FILE_BYTES) {
@@ -96,8 +87,8 @@ function spkiDer(key) {
 function keyId(publicDer) {
     return createHash('sha256').update(publicDer).digest('hex');
 }
-function payloadBytes(payload) {
-    return Buffer.from(canonicalArtifactJson(payload), 'utf8');
+function payloadBytes(payload, canonicalization) {
+    return Buffer.from(canonicalArtifactJsonFor(payload, canonicalization), 'utf8');
 }
 async function signableArtifact(raw) {
     const artifact = parseObject(raw, 'Evidence artefact');
@@ -105,6 +96,9 @@ async function signableArtifact(raw) {
     if (!['case_response_packet', 'investigation_capsule', 'signed_review_artifact'].includes(verification.artifact.kind)) {
         throw new TypeError('Only reviewed response packets, investigation capsules, and supported review manifests can be signed.');
     }
+    if (!hasVerifiedArtifactStructure(verification) || !hasVerifiedApplicableIntegrity(verification)) {
+        throw new TypeError('Evidence signing requires verified structure and a verified applicable integrity contract.');
+    }
     return { artifact, verification };
 }
 export async function signEvidencePackage(raw, privateKeyPem, signedAt = new Date().toISOString()) {
@@ -124,7 +118,7 @@ export async function signEvidencePackage(raw, privateKeyPem, signedAt = new Dat
             canonicalization: EVIDENCE_SIGNATURE_CANONICALIZATION,
             publicKeySpkiDerBase64: publicDer.toString('base64'),
             keyIdSha256: keyId(publicDer),
-            valueBase64: sign(null, payloadBytes(payload), privateKey).toString('base64'),
+            valueBase64: sign(null, payloadBytes(payload, SORTED_JSON_V2), privateKey).toString('base64'),
         }),
     });
 }
@@ -139,7 +133,6 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
         || !signature
         || !hasExactKeys(signature, SIGNATURE_KEYS)
         || signature.algorithm !== EVIDENCE_SIGNATURE_ALGORITHM
-        || signature.canonicalization !== EVIDENCE_SIGNATURE_CANONICALIZATION
         || typeof signature.publicKeySpkiDerBase64 !== 'string'
         || signature.publicKeySpkiDerBase64.length > 4096
         || !BASE64_RE.test(signature.publicKeySpkiDerBase64)
@@ -150,7 +143,10 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
         || !SHA256_RE.test(signature.keyIdSha256)) {
         throw new TypeError('Signed evidence package has an unsupported or malformed envelope.');
     }
-    const signedAt = timestamp(value.signedAt);
+    if (signature.canonicalization !== EVIDENCE_SIGNATURE_CANONICALIZATION) {
+        throw new TypeError('Signed evidence package has an unsupported or malformed envelope.');
+    }
+    const signedAt = canonicalTimestamp(value.signedAt);
     const publicDer = Buffer.from(signature.publicKeySpkiDerBase64, 'base64');
     if (keyId(publicDer) !== signature.keyIdSha256) {
         throw new TypeError('Signed evidence package public-key identifier does not match its embedded key.');
@@ -164,10 +160,14 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
     };
     const signatureBytes = Buffer.from(signature.valueBase64, 'base64');
     if (signatureBytes.length !== 64
-        || !verify(null, payloadBytes(payload), embeddedPublicKey, signatureBytes)) {
+        || !verify(null, payloadBytes(payload, EVIDENCE_SIGNATURE_CANONICALIZATION), embeddedPublicKey, signatureBytes)) {
         throw new TypeError('Signed evidence package failed Ed25519 verification.');
     }
-    const artifactVerification = await verifyOfflineArtifact(JSON.stringify(artifact));
+    let artifactVerification = null;
+    try {
+        artifactVerification = await verifyOfflineArtifact(JSON.stringify(artifact));
+    }
+    catch { /* Signature validity remains independently reportable. */ }
     let publicKeyMatched = null;
     if (trustedPublicKeyPem) {
         const trustedDer = spkiDer(importPublicKey(trustedPublicKeyPem, 'Trusted public key file'));
@@ -176,24 +176,41 @@ export async function verifyEvidencePackageSignature(raw, trustedPublicKeyPem) {
             throw new TypeError('Signed evidence package does not match the trusted public key.');
     }
     return Object.freeze({
-        schema: 'whoisleuth.evidence-signature-verification',
-        version: 1,
-        valid: true,
+        schema: EVIDENCE_SIGNATURE_VERIFICATION_SCHEMA,
+        version: EVIDENCE_SIGNATURE_VERIFICATION_VERSION,
         state: 'signature_valid',
-        signerTrust: trustedPublicKeyPem ? 'trusted_key' : 'embedded_key_only',
-        signedAt,
-        keyIdSha256: signature.keyIdSha256,
-        publicKeyMatched,
+        signature: Object.freeze({
+            state: 'valid',
+            signerTrust: trustedPublicKeyPem ? 'trusted_key' : 'embedded_key_only',
+            signedAt,
+            keyIdSha256: signature.keyIdSha256,
+            publicKeyMatched,
+        }),
         artifact: Object.freeze({
-            schema: artifactVerification.artifact.schema,
-            version: artifactVerification.artifact.version,
-            kind: artifactVerification.artifact.kind,
+            schema: artifactVerification?.artifact.schema
+                ?? (typeof artifact.schema === 'string' && /^[a-z0-9.-]{1,160}$/u.test(artifact.schema) ? artifact.schema : null),
+            version: artifactVerification?.artifact.version
+                ?? (Number.isSafeInteger(artifact.version ?? artifact.schemaVersion)
+                    && Number(artifact.version ?? artifact.schemaVersion) >= 1
+                    && Number(artifact.version ?? artifact.schemaVersion) <= 1_000
+                    ? Number(artifact.version ?? artifact.schemaVersion)
+                    : null),
+            kind: artifactVerification?.artifact.kind ?? 'unverified_artifact',
+            assurance: Object.freeze({
+                state: artifactVerification?.state ?? 'not_verified',
+                structure: artifactVerification?.checks.structure ?? 'not_checked',
+                contentIntegrity: artifactVerification?.checks.contentIntegrity ?? 'not_checked',
+                contentIntegrityScope: artifactVerification?.checks.contentIntegrityScope ?? 'not_checked',
+            }),
         }),
         limitations: Object.freeze([
             trustedPublicKeyPem
                 ? 'The signature and supplied public key match; recipient trust still depends on obtaining that public key through an authenticated channel.'
                 : 'The signature is internally valid for the embedded public key, but signer identity was not authenticated because no trusted public key was supplied.',
             'The signature authenticates the canonical sorted-JSON content, not the original whitespace, indentation, or object-key order of the serialised file.',
+            ...(artifactVerification
+                ? [`Embedded-artifact assurance is reported separately as ${artifactVerification.state}; it does not change the cryptographic signature result.`]
+                : ['The embedded artefact did not pass a supported local assurance contract. The cryptographic signature remains valid for its bytes, but no structure or inner-integrity claim is made.']),
             'A valid signature proves the canonical package content has not changed since signing; it does not establish that the retained observations or analyst statements are accurate.',
             'WHOISleuth does not generate, store, recover, rotate, or publish signing keys.',
         ]),
@@ -203,11 +220,12 @@ export function formatEvidenceSignatureVerification(report) {
     const lines = [
         'WHOISleuth evidence signature verification',
         `State: ${report.state}`,
-        `Signer trust: ${report.signerTrust}`,
-        `Artifact: ${report.artifact.kind} · ${report.artifact.schema} v${report.artifact.version}`,
-        `Signed: ${report.signedAt}`,
-        `Key ID: sha256:${report.keyIdSha256}`,
-        `Trusted public key: ${report.publicKeyMatched === null ? 'not supplied' : 'matched'}`,
+        `Signer trust: ${report.signature.signerTrust}`,
+        `Artifact: ${report.artifact.kind} · ${report.artifact.schema ?? 'unrecognised'} v${report.artifact.version ?? 'unrecognised'}`,
+        `Artifact assurance: ${report.artifact.assurance.state}`,
+        `Signed: ${report.signature.signedAt}`,
+        `Key ID: sha256:${report.signature.keyIdSha256}`,
+        `Trusted public key: ${report.signature.publicKeyMatched === null ? 'not supplied' : 'matched'}`,
     ];
     for (const limitation of report.limitations)
         lines.push(`Limitation: ${limitation}`);

package/cli/export-evidence.mjs

@@ -1,8 +1,9 @@
-import { createRequire } from 'node:module';
 import { projectCliLookupComparisonInput } from "./compare.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
-const require = createRequire(import.meta.url);
-const { version: APPLICATION_VERSION } = require('../package.json');
+import { validateLookupEvidenceArtifactStructure } from "./artifact-structure.mjs";
+import { WHOISLEUTH_APPLICATION_VERSION } from "../lib/application-version.mjs";
+import { LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES, serializeLookupEvidence, } from "../lib/evidence-export.mjs";
+const APPLICATION_VERSION = WHOISLEUTH_APPLICATION_VERSION;
 function objectOrNull(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
@@ -27,9 +28,15 @@ function buildCliEvidenceExport(text, evidenceModule, generatedAt = new Date().t
         || result.schemaVersion !== dependency.LOOKUP_EVIDENCE_SCHEMA_VERSION) {
         throw new TypeError('Lookup evidence builder returned an unsupported report contract.');
     }
+    validateLookupEvidenceArtifactStructure(result);
+    serializeLookupEvidence(result);
     return result;
 }
 function formatCliEvidenceExport(document, compact = false) {
-    return `${JSON.stringify(document, null, compact ? 0 : 2)}\n`;
+    const output = `${serializeLookupEvidence(document, !compact)}\n`;
+    if (new TextEncoder().encode(output).byteLength > LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES) {
+        throw new TypeError('Lookup evidence exceeds the 5 MiB portable file limit.');
+    }
+    return output;
 }
 export { APPLICATION_VERSION, buildCliEvidenceExport, formatCliEvidenceExport };

package/cli/external-observation-mapping.mjs

@@ -1,6 +1,6 @@
 import { domainToASCII } from 'node:url';
 import { exactKeys, requireBoundedString, requireIsoTimestamp, requireRecord, } from "../lib/bounded-contract-normalizers.mjs";
-import { EXTERNAL_FINDING_CATEGORIES, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, MAX_EXTERNAL_FINDING_DOMAINS, parseExternalFindingsDocument, } from "../frontend/src/lib/analysis/external-findings-import.js";
+import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, EXTERNAL_FINDING_CATEGORIES, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, MAX_EXTERNAL_FINDING_DOMAINS, parseExternalFindingsDocument, } from "../packages/interchange/external-findings-import.mjs";
 export const EXTERNAL_OBSERVATION_MAPPING_SCHEMA = 'whoisleuth.external-observation-mapping';
 export const EXTERNAL_OBSERVATION_MAPPING_VERSION = 1;
 export const MAX_EXTERNAL_OBSERVATION_MAPPING_BYTES = 4 * 1024 * 1024;
@@ -135,8 +135,8 @@ export function mapExternalObservations(inputRaw) {
     }
     const truncated = selected.length < seen.size;
     const document = {
-        schema: 'whoisleuth.external-findings',
-        schemaVersion: 3,
+        schema: EXTERNAL_FINDINGS_SCHEMA,
+        schemaVersion: EXTERNAL_FINDINGS_VERSION,
         source,
         findings: selected.map((finding) => ({
             ...finding,

package/cli/formatters/html.mjs

@@ -26,8 +26,8 @@ function renderRegistrarComparison(comparison) {
         : '';
     return `<div class="table-scroll"><table><caption>Normalized registry and registrar RDAP publication comparison</caption><thead><tr><th scope="col">Field</th><th scope="col">Result</th><th scope="col">Registry RDAP</th><th scope="col">Registrar RDAP</th></tr></thead><tbody>${rows}</tbody></table></div>${omitted}`;
 }
-function formatLookupEvidenceHtml(document) {
-    const report = buildLookupEvidenceReport(document);
+function formatLookupEvidenceHtml(document, options = {}) {
+    const report = buildLookupEvidenceReport(document, options);
     const title = `Lookup evidence report: ${report.title}`;
     return `<!doctype html>
 <html lang="en">
@@ -60,7 +60,7 @@ function formatLookupEvidenceHtml(document) {
   <section class="block"><h2>Network evidence</h2>${renderGroups(report.networkGroups)}</section>
   <section class="block"><h2>Collection diagnostics</h2>${renderFields(report.diagnostics)}</section>
   <section class="block"><h2>Limitations</h2><ul>${report.limitations.map((item) => `<li>${escapeHtml(item)}</li>`).join('')}</ul></section>
-  <footer>Offline, self-contained report. No scripts, forms, external resources, or active links are included.</footer>
+  <footer>Offline, self-contained report. No scripts, forms, external resources, or active links are included.${report.attribution ? `<br>${escapeHtml(report.attribution)}` : ''}</footer>
 </main>
 </body>
 </html>

package/cli/formatters/json.mjs

@@ -1,5 +1,6 @@
 import { bulkDnsSummary } from "../bulk-output.mjs";
-const CLI_LOOKUP_SCHEMA = 'whoisleuth.cli.lookup';
+import { SAVED_LOOKUP_SCHEMA_VERSION, buildCliLookupDocument, } from "../saved-lookup.mjs";
+import { CLI_LOOKUP_SCHEMA } from "../../packages/contracts/cli-lookup.mjs";
 const CLI_BULK_SCHEMA = 'whoisleuth.cli.bulk';
 const CLI_BULK_ITEM_SCHEMA = 'whoisleuth.cli.bulk.item';
 const CLI_CT_SEARCH_SCHEMA = 'whoisleuth.cli.ct-search';
@@ -9,42 +10,29 @@ const CLI_POSTURE_SCHEMA = 'whoisleuth.cli.posture';
 const CLI_HTTP_SCHEMA = 'whoisleuth.cli.http';
 const CLI_TLS_SCHEMA = 'whoisleuth.cli.tls';
 const CLI_COMPARE_SCHEMA = 'whoisleuth.cli.compare';
-const CLI_LOOKUP_SCHEMA_VERSION = 1;
+const CLI_LOOKUP_SCHEMA_VERSION = SAVED_LOOKUP_SCHEMA_VERSION;
 const CLI_BULK_SCHEMA_VERSION = 3;
 const CLI_CT_SEARCH_SCHEMA_VERSION = 1;
 const CLI_DISCOVER_SCHEMA_VERSION = 2;
 const CLI_POSTURE_SCHEMA_VERSION = 1;
-const CLI_HTTP_SCHEMA_VERSION = 2;
+const CLI_HTTP_SCHEMA_VERSION = 3;
 const CLI_TLS_SCHEMA_VERSION = 1;
 const CLI_COMPARE_SCHEMA_VERSION = 3;
-function buildCliLookupDocument(query, classified, result, generatedAt = new Date().toISOString(), mode = 'fast', collectionContext = {}) {
-    const observerLabel = typeof collectionContext.observerLabel === 'string'
-        ? collectionContext.observerLabel
-        : null;
-    const vantageLabel = typeof collectionContext.vantageLabel === 'string'
-        ? collectionContext.vantageLabel
-        : null;
-    return {
-        ...result,
-        schema: CLI_LOOKUP_SCHEMA,
-        version: CLI_LOOKUP_SCHEMA_VERSION,
-        generatedAt,
-        mode: mode === 'deep' ? 'deep' : 'fast',
-        query,
-        type: classified.type,
-        inputHostname: classified.inputHostname,
-        registrableDomain: classified.registrableDomain,
-        isSubdomain: classified.isSubdomain,
-        ...((observerLabel || vantageLabel) ? {
-            collectionContext: {
-                ...(observerLabel ? { observerLabel } : {}),
-                ...(vantageLabel ? { vantageLabel } : {}),
-            },
-        } : {}),
-    };
+const TERMINAL_UNSAFE_JSON_RE = /[\u007f-\u009f\u2028\u2029]|\p{Default_Ignorable_Code_Point}/gu;
+function jsonUnicodeEscape(value) {
+    const codePoint = value.codePointAt(0);
+    if (codePoint <= 0xffff)
+        return `\\u${codePoint.toString(16).padStart(4, '0')}`;
+    const offset = codePoint - 0x10000;
+    const high = 0xd800 + (offset >> 10);
+    const low = 0xdc00 + (offset & 0x3ff);
+    return `\\u${high.toString(16).padStart(4, '0')}\\u${low.toString(16).padStart(4, '0')}`;
+}
+function terminalSafeJson(value, space) {
+    return JSON.stringify(value, null, space).replace(TERMINAL_UNSAFE_JSON_RE, jsonUnicodeEscape);
 }
 function formatJsonDocument(document) {
-    return `${JSON.stringify(document, null, 2)}\n`;
+    return `${terminalSafeJson(document, 2)}\n`;
 }
 function buildCliCtSearchDocument(keyword, result, generatedAt = new Date().toISOString()) {
     return { ...result, schema: CLI_CT_SEARCH_SCHEMA, version: CLI_CT_SEARCH_SCHEMA_VERSION, generatedAt, keyword };
@@ -83,7 +71,7 @@ function discoverJsonItem(candidate, metadata) {
 function formatDiscoverJsonLines(candidates, metadata) {
     if (!candidates.length)
         return '';
-    return `${candidates.map((candidate) => JSON.stringify(discoverJsonItem(candidate, metadata))).join('\n')}\n`;
+    return `${candidates.map((candidate) => terminalSafeJson(discoverJsonItem(candidate, metadata))).join('\n')}\n`;
 }
 function formatDiscoverDomainList(candidates) {
     const domains = [...new Set(candidates.flatMap((candidate) => (typeof candidate.domain === 'string' && candidate.domain ? [candidate.domain] : [])))];
@@ -149,7 +137,7 @@ function buildCliBulkDocument(items, metadata) {
 }
 function formatJsonLines(items, metadata) {
     return items.length
-        ? `${items.map((item) => JSON.stringify(bulkJsonItem(item, metadata))).join('\n')}\n`
+        ? `${items.map((item) => terminalSafeJson(bulkJsonItem(item, metadata))).join('\n')}\n`
         : '';
 }
-export { CLI_BULK_ITEM_SCHEMA, CLI_BULK_SCHEMA, CLI_BULK_SCHEMA_VERSION, CLI_COMPARE_SCHEMA, CLI_COMPARE_SCHEMA_VERSION, CLI_CT_SEARCH_SCHEMA, CLI_CT_SEARCH_SCHEMA_VERSION, CLI_DISCOVER_ITEM_SCHEMA, CLI_DISCOVER_SCHEMA, CLI_DISCOVER_SCHEMA_VERSION, CLI_HTTP_SCHEMA, CLI_HTTP_SCHEMA_VERSION, CLI_POSTURE_SCHEMA, CLI_POSTURE_SCHEMA_VERSION, CLI_TLS_SCHEMA, CLI_TLS_SCHEMA_VERSION, CLI_LOOKUP_SCHEMA, CLI_LOOKUP_SCHEMA_VERSION, buildCliBulkDocument, buildCliCompareDocument, buildCliCtSearchDocument, buildCliDiscoverDocument, buildCliHttpDocument, buildCliLookupDocument, buildCliPostureDocument, buildCliTlsDocument, bulkJsonItem, discoverJsonItem, formatDiscoverDomainList, formatDiscoverJsonLines, formatJsonDocument, formatJsonLines, };
+export { CLI_BULK_ITEM_SCHEMA, CLI_BULK_SCHEMA, CLI_BULK_SCHEMA_VERSION, CLI_COMPARE_SCHEMA, CLI_COMPARE_SCHEMA_VERSION, CLI_CT_SEARCH_SCHEMA, CLI_CT_SEARCH_SCHEMA_VERSION, CLI_DISCOVER_ITEM_SCHEMA, CLI_DISCOVER_SCHEMA, CLI_DISCOVER_SCHEMA_VERSION, CLI_HTTP_SCHEMA, CLI_HTTP_SCHEMA_VERSION, CLI_POSTURE_SCHEMA, CLI_POSTURE_SCHEMA_VERSION, CLI_TLS_SCHEMA, CLI_TLS_SCHEMA_VERSION, CLI_LOOKUP_SCHEMA, CLI_LOOKUP_SCHEMA_VERSION, buildCliBulkDocument, buildCliCompareDocument, buildCliCtSearchDocument, buildCliDiscoverDocument, buildCliHttpDocument, buildCliLookupDocument, buildCliPostureDocument, buildCliTlsDocument, bulkJsonItem, discoverJsonItem, formatDiscoverDomainList, formatDiscoverJsonLines, formatJsonDocument, formatJsonLines, terminalSafeJson, };