@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/packages/evidence/png-pixels.mjs

@@ -0,0 +1,117 @@
+import { decode, convertIndexedToRgb, hasPngSignature } from 'fast-png';
+import { Unzlib } from 'fflate';
+import { updateCrc32 } from "../interchange/crc32.mjs";
+import { readEvidenceImageDimensions } from "./image-regions.mjs";
+/** Admit PNG structure and inflated work before the image library allocates it. */
+export function decodeEvidencePng(bytes) {
+    if (!(bytes instanceof Uint8Array) || !(bytes.buffer instanceof ArrayBuffer) || !hasPngSignature(bytes) || bytes.byteLength < 33)
+        throw new TypeError('Select a valid PNG image.');
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    if (view.getUint32(8) !== 13 || String.fromCharCode(...bytes.subarray(12, 16)) !== 'IHDR')
+        throw new TypeError('The PNG header is malformed.');
+    const { width, height } = readEvidenceImageDimensions(view.getUint32(16), view.getUint32(20));
+    if (bytes[24] < 8 && bytes[28] !== 0)
+        throw new TypeError('Convert this interlaced low-bit-depth PNG to a non-interlaced image before review.');
+    const maximumInflatedBytes = width * height * 8 + height * 8 + 64;
+    let inflatedBytes = 0;
+    const inflater = new Unzlib(chunk => {
+        inflatedBytes += chunk.byteLength;
+        if (inflatedBytes > maximumInflatedBytes)
+            throw new TypeError('The PNG exceeds its dimension-derived decompression bound.');
+    });
+    const selected = [bytes.subarray(0, 8)];
+    let offset = 8, total = 8, ended = false, imageData = false, dataEnded = false, header = false, palette = false, transparency = false;
+    while (offset < bytes.byteLength) {
+        if (bytes.byteLength - offset < 12)
+            throw new TypeError('The PNG contains a truncated chunk.');
+        const length = view.getUint32(offset), end = offset + length + 12;
+        if (end > bytes.byteLength)
+            throw new TypeError('The PNG contains a truncated chunk.');
+        const kind = String.fromCharCode(...bytes.subarray(offset + 4, offset + 8));
+        if (!/^[A-Za-z]{4}$/u.test(kind))
+            throw new TypeError('The PNG contains an invalid chunk type.');
+        const crc = (updateCrc32(0xffff_ffff, bytes.subarray(offset + 4, end - 4)) ^ 0xffff_ffff) >>> 0;
+        if (crc !== view.getUint32(end - 4))
+            throw new TypeError('The PNG chunk checksum does not match.');
+        if (kind === 'acTL' || kind === 'fcTL' || kind === 'fdAT')
+            throw new TypeError('Select a still PNG image; animated frames are not silently omitted.');
+        if (kind === 'IHDR') {
+            if (header || offset !== 8 || length !== 13)
+                throw new TypeError('The PNG has conflicting headers.');
+            header = true;
+        }
+        else if (kind === 'PLTE') {
+            if (palette || imageData || !length || length > 768 || length % 3)
+                throw new TypeError('The PNG palette is malformed.');
+            palette = true;
+        }
+        else if (kind === 'tRNS') {
+            if (transparency || imageData || length > 256)
+                throw new TypeError('The PNG transparency data is malformed.');
+            transparency = true;
+        }
+        else if (kind === 'IDAT') {
+            if (dataEnded)
+                throw new TypeError('The PNG image-data chunks are not consecutive.');
+            imageData = true;
+            // A small compressed slice bounds transient inflation before the callback.
+            for (let position = offset + 8; position < end - 4; position += 1_024)
+                inflater.push(bytes.subarray(position, Math.min(position + 1_024, end - 4)), false);
+        }
+        else if (kind === 'IEND') {
+            if (length || !imageData || end !== bytes.byteLength)
+                throw new TypeError('The PNG trailer is malformed.');
+            ended = true;
+        }
+        else if (kind[0] === kind[0].toUpperCase())
+            throw new TypeError('The PNG has an unsupported critical chunk.');
+        if (imageData && kind !== 'IDAT')
+            dataEnded = true;
+        // Colour-profile and text metadata are irrelevant to QR pixel analysis and
+        // may contain independent compressed payloads. Never decode those payloads.
+        if (['IHDR', 'PLTE', 'tRNS', 'IDAT', 'IEND'].includes(kind)) {
+            const part = bytes.subarray(offset, end);
+            selected.push(part);
+            total += part.byteLength;
+        }
+        offset = end;
+    }
+    if (!ended)
+        throw new TypeError('The PNG trailer is missing.');
+    inflater.push(new Uint8Array(), true);
+    const admitted = new Uint8Array(total);
+    let position = 0;
+    for (const part of selected) {
+        admitted.set(part, position);
+        position += part.byteLength;
+    }
+    let image = decode(admitted, { checkCrc: true });
+    if (image.width !== width || image.height !== height)
+        throw new TypeError('The decoded PNG dimensions changed.');
+    if (image.depth < 8 && !image.palette && image.channels === 1) {
+        const maximum = (1 << image.depth) - 1;
+        // Use the library's packed-sample conversion for grayscale as well as
+        // indexed images; a generated grayscale palette does not parse new bytes.
+        image = { ...image, palette: Array.from({ length: maximum + 1 }, (_, value) => {
+                const grey = Math.round(value * 255 / maximum);
+                return [grey, grey, grey, image.transparency?.[0] === value ? 0 : 255];
+            }) };
+    }
+    const indexed = Boolean(image.palette), samples = indexed ? convertIndexedToRgb(image) : image.data;
+    const channels = indexed ? image.palette[0].length : image.channels;
+    if (![1, 2, 3, 4].includes(channels) || samples.length !== width * height * channels)
+        throw new TypeError('The PNG pixel layout is unsupported.');
+    const pixels = new Uint8ClampedArray(width * height * 4);
+    const sample = (index) => image.depth === 16 && !indexed ? Math.round(samples[index] / 257) : samples[index];
+    for (let index = 0; index < width * height; index++) {
+        const source = index * channels, target = index * 4;
+        pixels[target] = sample(source);
+        pixels[target + 1] = channels <= 2 ? sample(source) : sample(source + 1);
+        pixels[target + 2] = channels <= 2 ? sample(source) : sample(source + 2);
+        pixels[target + 3] = channels === 2 || channels === 4 ? sample(source + channels - 1) : 255;
+        if (!indexed && image.transparency && (channels === 1 ? samples[source] === image.transparency[0]
+            : channels === 3 && [0, 1, 2].every(channel => samples[source + channel] === image.transparency[channel])))
+            pixels[target + 3] = 0;
+    }
+    return { width, height, pixels };
+}

package/packages/evidence/public-address-policy.mjs

@@ -0,0 +1,83 @@
+// Browser-safe canonical public-address policy for analyst-supplied address
+// evidence. This performs no resolution or network work; transport owners must
+// still revalidate and pin addresses before making a request.
+import { ipv6Groups } from "../contracts/ip-address.mjs";
+const IPV4_RE = /^\d{1,3}(?:\.\d{1,3}){3}$/u;
+const IPV6_RE = /^[0-9a-f:]+$/iu;
+function canonicalIpv4(value) {
+    if (typeof value !== 'string' || !IPV4_RE.test(value.trim()))
+        return null;
+    const octets = value.trim().split('.').map(Number);
+    if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255))
+        return null;
+    return octets.join('.');
+}
+function isPublicIpv4(value) {
+    const octets = value.split('.').map(Number);
+    const [first = -1, second = -1, third = -1] = octets;
+    return octets.length === 4
+        && first !== 0
+        && first !== 10
+        && first !== 127
+        && first < 224
+        && !(first === 100 && second >= 64 && second <= 127)
+        && !(first === 169 && second === 254)
+        && !(first === 172 && second >= 16 && second <= 31)
+        && !(first === 192 && second === 168)
+        && !(first === 198 && (second === 18 || second === 19))
+        && !(first === 192 && second === 0 && third === 0)
+        && !(first === 192 && second === 0 && third === 2)
+        && !(first === 192 && second === 88 && third === 99)
+        && !(first === 198 && second === 51 && third === 100)
+        && !(first === 203 && second === 0 && third === 113);
+}
+function canonicalIpv6(value) {
+    if (typeof value !== 'string')
+        return null;
+    const candidate = value.trim().toLowerCase();
+    if (!candidate.includes(':') || candidate.includes('%') || candidate.includes('.') || !IPV6_RE.test(candidate)) {
+        return null;
+    }
+    try {
+        const host = new URL(`https://[${candidate}]/`).hostname;
+        return host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isPublicIpv6(value) {
+    const groups = ipv6Groups(value);
+    if (groups.length !== 8)
+        return false;
+    const [first = '', second = '', third = ''] = groups;
+    if (groups.every((group) => group === '0000'))
+        return false;
+    if (groups.slice(0, 7).every((group) => group === '0000') && groups[7] === '0001')
+        return false;
+    if (first.startsWith('ff') || /^fe[89ab]/u.test(first) || /^fe[cdef]/u.test(first) || /^f[cd]/u.test(first))
+        return false;
+    if (first === '0100' && groups.slice(1, 4).every((group) => group === '0000'))
+        return false;
+    if (first === '2001' && second === '0db8')
+        return false;
+    if (first === '3fff' && Number.parseInt(second, 16) <= 0x0fff)
+        return false;
+    if (first === '2001' && second === '0002' && third === '0000')
+        return false;
+    if (first === '2001' && /^00[1-2][0-9a-f]$/u.test(second))
+        return false;
+    if (first === '2001' && second === '0000')
+        return false;
+    if (first === '2002')
+        return false;
+    const firstValue = Number.parseInt(first, 16);
+    return Number.isInteger(firstValue) && firstValue >= 0x2000 && firstValue <= 0x3fff;
+}
+export function canonicalPublicIpAddress(value) {
+    const ipv4 = canonicalIpv4(value);
+    if (ipv4)
+        return isPublicIpv4(ipv4) ? ipv4 : null;
+    const ipv6 = canonicalIpv6(value);
+    return ipv6 && isPublicIpv6(ipv6) ? ipv6 : null;
+}

package/packages/interchange/defensive-indicator-export.mjs

@@ -0,0 +1,264 @@
+// Pure defensive-domain export formatting for filtered Bulk findings. These
+// files are generated locally and never submitted or applied automatically.
+import { caseDispositionSupportsDefensiveResponse } from "../cases/case-record-decisions.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { DEFENSIVE_INDICATOR_EXPORT_VERSION, DEFENSIVE_INDICATOR_MANIFEST_SCHEMA, DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA, } from "../contracts/analyst-interchange.mjs";
+export { DEFENSIVE_INDICATOR_EXPORT_VERSION, DEFENSIVE_INDICATOR_MANIFEST_SCHEMA, DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA, } from "../contracts/analyst-interchange.mjs";
+export const MAX_DEFENSIVE_INDICATORS = 2000;
+export const MAX_DEFENSIVE_INDICATOR_INPUTS = MAX_DEFENSIVE_INDICATORS * 4;
+export const DEFENSIVE_INDICATOR_FORMATS = Object.freeze(['domains', 'hosts', 'dnsmasq', 'rpz']);
+const REGISTERED_STATES = new Set(['registered', 'for_sale', 'expiring']);
+const MINIMUM_RISK_SCORE = 70;
+const CONTROL_RE = /[\x00-\x1f\x7f]/;
+function plainRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function riskScore(record) {
+    const value = record.risk ?? record.riskScore;
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+/** Source metadata shared by interchange writers; export time is not evidence time. */
+export function defensiveIndicatorProvenance(value) {
+    const source = plainRecord(value) ?? {};
+    const saved = plainRecord(source.saved) ?? {};
+    const score = riskScore(source);
+    const version = source.riskModelVersion ?? saved.riskModelVersion;
+    const depth = source.scanDepth ?? saved.scanDepth;
+    return Object.freeze({
+        riskScore: score === null ? null : Math.max(0, Math.min(100, Math.round(score))),
+        riskModelVersion: typeof version === 'number' && Number.isSafeInteger(version) && version > 0 && version <= 1_000 ? version : null,
+        scanDepth: depth === 'fast' || depth === 'deep' ? depth : 'unknown',
+        observedAt: normalizeExplicitIsoTimestamp(source.observedAt) || normalizeExplicitIsoTimestamp(saved.observedAt),
+    });
+}
+function normalizedDomainSet(value) {
+    if (!Array.isArray(value))
+        return new Set();
+    return new Set(value.slice(0, MAX_DEFENSIVE_INDICATOR_INPUTS)
+        .map((item) => normalizeDomain(item))
+        .filter((item) => Boolean(item)));
+}
+function analystDisposition(record) {
+    return typeof record.analystDisposition === 'string'
+        ? record.analystDisposition
+        : typeof record.disposition === 'string'
+            ? record.disposition
+            : '';
+}
+function hasReadyProfileContext(record) {
+    const saved = plainRecord(record.saved);
+    const profileContext = plainRecord(saved?.profileContext ?? record.profileContext);
+    return profileContext?.sourceState === 'ready';
+}
+export function isDefensiveIndicatorCandidate(value) {
+    const record = plainRecord(value);
+    if (!record
+        || !hasReadyProfileContext(record)
+        || record.trusted
+        || record.status === 'error'
+        || typeof record.availability !== 'string'
+        || !REGISTERED_STATES.has(record.availability))
+        return false;
+    return Boolean(normalizeDomain(record.domain)) && (riskScore(record) ?? -1) >= MINIMUM_RISK_SCORE;
+}
+export function collectDefensiveIndicatorCandidates(records, limit = MAX_DEFENSIVE_INDICATORS) {
+    if (!Array.isArray(records))
+        throw new TypeError('Defensive indicator export requires an array of Bulk results.');
+    const retainedLimit = Number.isSafeInteger(limit) && limit > 0
+        ? Math.min(limit, MAX_DEFENSIVE_INDICATORS)
+        : MAX_DEFENSIVE_INDICATORS;
+    const byDomain = new Map();
+    for (const item of records.slice(0, MAX_DEFENSIVE_INDICATOR_INPUTS)) {
+        if (!isDefensiveIndicatorCandidate(item))
+            continue;
+        const record = plainRecord(item);
+        const domain = normalizeDomain(record?.domain);
+        if (record && domain && !byDomain.has(domain))
+            byDomain.set(domain, record);
+    }
+    const candidates = [...byDomain.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([domain, source]) => ({ domain, source }));
+    const entries = candidates.slice(0, retainedLimit);
+    return {
+        entries,
+        domains: entries.map((entry) => entry.domain),
+        truncated: records.length > MAX_DEFENSIVE_INDICATOR_INPUTS || candidates.length > retainedLimit,
+    };
+}
+export function prepareDefensiveIndicatorExport(records, options = {}, limit = MAX_DEFENSIVE_INDICATORS) {
+    if (!Array.isArray(records))
+        throw new TypeError('Defensive indicator export requires an array of Bulk results.');
+    const explicitSelection = Array.isArray(options.selectedDomains);
+    const selected = normalizedDomainSet(options.selectedDomains);
+    const official = normalizedDomainSet(options.officialDomains);
+    const allowlisted = normalizedDomainSet(options.allowlistedDomains);
+    const common = normalizedDomainSet(options.commonInfrastructureDomains);
+    const retainedLimit = Number.isSafeInteger(limit) && limit > 0
+        ? Math.min(limit, MAX_DEFENSIVE_INDICATORS)
+        : MAX_DEFENSIVE_INDICATORS;
+    const exclusions = [];
+    const seenExclusions = new Set();
+    const accepted = new Map();
+    const exclude = (domain, reason) => {
+        const key = `${domain}\u0000${reason}`;
+        if (!seenExclusions.has(key)) {
+            exclusions.push({ domain, reason });
+            seenExclusions.add(key);
+        }
+    };
+    for (const item of records.slice(0, MAX_DEFENSIVE_INDICATOR_INPUTS)) {
+        const source = plainRecord(item);
+        const domain = normalizeDomain(source?.domain);
+        if (!source || !domain)
+            continue;
+        if (explicitSelection && !selected.has(domain)) {
+            exclude(domain, 'not_selected');
+            continue;
+        }
+        if (!hasReadyProfileContext(source)) {
+            exclude(domain, 'profile_context_unavailable');
+            continue;
+        }
+        if (official.has(domain)) {
+            exclude(domain, 'official_domain');
+            continue;
+        }
+        if (allowlisted.has(domain)) {
+            exclude(domain, 'allowlisted_domain');
+            continue;
+        }
+        if (common.has(domain) || source.commonInfrastructure === true) {
+            exclude(domain, 'common_infrastructure');
+            continue;
+        }
+        if (!isDefensiveIndicatorCandidate(source)) {
+            exclude(domain, 'not_eligible');
+            continue;
+        }
+        const disposition = analystDisposition(source);
+        if (explicitSelection && !caseDispositionSupportsDefensiveResponse(disposition)) {
+            exclude(domain, 'unreviewed_disposition');
+            continue;
+        }
+        if (!accepted.has(domain))
+            accepted.set(domain, source);
+    }
+    const candidates = [...accepted.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([domain, source]) => ({ domain, source }));
+    const entries = candidates.slice(0, retainedLimit);
+    return {
+        entries,
+        domains: entries.map((entry) => entry.domain),
+        exclusions: exclusions.sort((left, right) => left.domain.localeCompare(right.domain) || left.reason.localeCompare(right.reason)),
+        truncated: records.length > MAX_DEFENSIVE_INDICATOR_INPUTS || candidates.length > retainedLimit,
+        explicitSelection,
+    };
+}
+function timestamp(value) {
+    if (typeof value !== 'string' || value.length > 64 || CONTROL_RE.test(value))
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+function header(prefix, generatedAt, count) {
+    return [
+        `${prefix} WHOISleuth defensive domain indicators v${DEFENSIVE_INDICATOR_EXPORT_VERSION}`,
+        `${prefix} Generated ${generatedAt}`,
+        `${prefix} ${count} high-risk registered domain${count === 1 ? '' : 's'}`,
+        `${prefix} Review before use. Heuristic findings can include false positives.`,
+    ];
+}
+function formatDomains(domains, generatedAt) {
+    return [...header('#', generatedAt, domains.length), ...domains].join('\n');
+}
+function formatHosts(domains, generatedAt) {
+    return [...header('#', generatedAt, domains.length), ...domains.map((domain) => `0.0.0.0 ${domain}`)].join('\n');
+}
+function formatDnsmasq(domains, generatedAt) {
+    return [...header('#', generatedAt, domains.length), ...domains.map((domain) => `address=/${domain}/0.0.0.0`)].join('\n');
+}
+function formatRpz(domains, generatedAt, includeWildcards) {
+    const serial = Math.floor(Date.parse(generatedAt) / 1000) >>> 0;
+    return [
+        ...header(';', generatedAt, domains.length),
+        '$TTL 60',
+        `@ IN SOA localhost. root.localhost. (${serial} 60 60 60 60)`,
+        '@ IN NS localhost.',
+        ...domains.flatMap((domain) => [
+            `${domain} CNAME .`,
+            ...(includeWildcards ? [`*.${domain} CNAME .`] : []),
+        ]),
+    ].join('\n');
+}
+function contentFor(format, domains, generatedAt, includeWildcards) {
+    if (format === 'hosts')
+        return formatHosts(domains, generatedAt);
+    if (format === 'dnsmasq')
+        return formatDnsmasq(domains, generatedAt);
+    if (format === 'rpz')
+        return formatRpz(domains, generatedAt, includeWildcards);
+    return formatDomains(domains, generatedAt);
+}
+export function buildDefensiveIndicatorExport(records, options = {}) {
+    const format = (typeof options.format === 'string'
+        && DEFENSIVE_INDICATOR_FORMATS.includes(options.format)) ? options.format : 'domains';
+    const generatedAt = timestamp(options.generatedAt) || new Date().toISOString();
+    const includeWildcards = options.includeWildcards === true;
+    const expiryDays = typeof options.expiryDays === 'number' && Number.isSafeInteger(options.expiryDays)
+        ? Math.max(1, Math.min(365, options.expiryDays))
+        : 30;
+    const collected = prepareDefensiveIndicatorExport(records, options);
+    const expiresAt = new Date(Date.parse(generatedAt) + expiryDays * 86_400_000).toISOString();
+    const manifest = {
+        schema: DEFENSIVE_INDICATOR_MANIFEST_SCHEMA,
+        version: DEFENSIVE_INDICATOR_EXPORT_VERSION,
+        generatedAt,
+        expiresAt,
+        reviewRequired: true,
+        explicitSelection: collected.explicitSelection,
+        includeWildcards,
+        entries: collected.entries.map(({ domain, source }) => ({
+            domain,
+            disposition: analystDisposition(source) || 'not_recorded',
+            reason: `High-risk registered Bulk finding (risk ${riskScore(source) ?? 'unknown'}).`,
+            source: 'bulk',
+            generatedAt,
+            expiresAt,
+        })),
+        exclusions: collected.exclusions,
+    };
+    const rollback = {
+        schema: DEFENSIVE_INDICATOR_ROLLBACK_SCHEMA,
+        version: DEFENSIVE_INDICATOR_EXPORT_VERSION,
+        generatedAt,
+        removes: collected.domains.map((domain) => ({
+            domain,
+            includeWildcard: includeWildcards,
+            reason: 'Remove the indicator generated by the paired reviewed manifest.',
+        })),
+    };
+    return {
+        version: DEFENSIVE_INDICATOR_EXPORT_VERSION,
+        format,
+        generatedAt,
+        expiresAt,
+        domains: collected.domains,
+        entries: collected.entries,
+        exclusions: collected.exclusions,
+        explicitSelection: collected.explicitSelection,
+        includeWildcards,
+        truncated: collected.truncated,
+        filename: `whoisleuth-defensive-domains-${generatedAt.slice(0, 10)}.${format === 'rpz' ? 'zone' : 'txt'}`,
+        manifestFilename: `whoisleuth-defensive-domains-${generatedAt.slice(0, 10)}.manifest.json`,
+        rollbackFilename: `whoisleuth-defensive-domains-${generatedAt.slice(0, 10)}.rollback.json`,
+        mimeType: 'text/plain;charset=utf-8',
+        content: `${contentFor(format, collected.domains, generatedAt, includeWildcards)}\n`,
+        manifestContent: `${JSON.stringify(manifest, null, 2)}\n`,
+        rollbackContent: `${JSON.stringify(rollback, null, 2)}\n`,
+    };
+}

package/packages/interchange/external-findings-import.mjs

@@ -1,5 +1,6 @@
-import { normalizeDomain, openOrCreateCase, updateCase, } from "../cases/case-model.mjs";
-import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { openOrCreateCase, updateCase } from "../cases/case-record-operations.mjs";
+import { canonicalRegistrableDomain } from "../analysis/registrable-domain.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { canonicalArtifactJsonV2 } from "../evidence/artifact-integrity.mjs";
 import { sha256IdentityHex } from "../evidence/record-identity.mjs";
@@ -182,16 +183,7 @@ function structuredObservation(value, index) {
     };
 }
 function findingKey(finding, sourceName) {
-    return [
-        finding.domain,
-        finding.category,
-        finding.evidenceClass,
-        finding.summary,
-        finding.observedAt,
-        finding.completeness,
-        sourceName,
-        finding.structuredObservation?.eventId ?? '',
-    ].join('\u0000');
+    return canonicalArtifactJsonV2({ sourceName, finding });
 }
 export function parseExternalFindingsDocument(value) {
     const root = record(value);

package/packages/interchange/managed-indicator-export.mjs

@@ -0,0 +1,35 @@
+import { readManagedIndicatorSet } from "./managed-indicator-set.mjs";
+import { stixIndicatorObjects, stixIndicatorProducer } from "./stix-indicator-export.mjs";
+import { mispIndicatorAttribute, mispIndicatorEvent } from "./misp-indicator-export.mjs";
+/** Re-exporting a revision is deterministic; revoked object versions never advance. */
+export async function exportManagedIndicators(input, format) {
+    const manifest = await readManagedIndicatorSet(input);
+    let document = manifest;
+    if (format === 'stix') {
+        const producer = `identity--${manifest.producerId}`;
+        document = { type: 'bundle', id: `bundle--${manifest.revisionId}`, objects: [
+                stixIndicatorProducer(producer, manifest.createdAt),
+                ...manifest.entries.flatMap(entry => stixIndicatorObjects(entry.domain, entry.observation.availability, entry.observation, entry.createdAt, producer, type => `${type}--${entry.id}`)
+                    .map(object => object.type !== 'indicator' ? object : { ...object,
+                    modified: entry.modifiedAt, valid_until: entry.expiresAt, revoked: entry.withdrawal !== null,
+                    x_whoisleuth_managed_set: manifest.id, x_whoisleuth_original_review_basis: entry.basis,
+                    x_whoisleuth_review_basis: entry.reviewBasis,
+                    ...(entry.withdrawal ? { x_whoisleuth_withdrawal_reason: entry.withdrawal.reason } : {}),
+                })),
+            ] };
+    }
+    else if (format === 'misp') {
+        const attributes = manifest.entries.map(entry => {
+            const attribute = mispIndicatorAttribute(entry.domain, entry.observation.availability, entry.observation, entry.id, entry.modifiedAt);
+            return { ...attribute, deleted: entry.withdrawal !== null,
+                comment: `${attribute.comment}; review-expires=${entry.expiresAt}; expiry requires recipient review, not automatic deletion; original-basis=${entry.basis}; latest-review=${entry.reviewBasis}${entry.withdrawal ? `; withdrawn=${entry.withdrawal.reason}` : ''}` };
+        });
+        document = { Event: { ...mispIndicatorEvent(manifest.id, manifest.createdAt, attributes),
+                info: `${manifest.name} · reviewed domain indicators`, timestamp: String(Math.floor(Date.parse(manifest.modifiedAt) / 1000)) } };
+    }
+    else if (format !== 'manifest')
+        throw new TypeError('Unsupported managed indicator export format.');
+    return { document, content: `${JSON.stringify(document, null, 2)}\n`,
+        filename: `whoisleuth-indicators-${manifest.id}-r${manifest.revision}.${format}.json`,
+        mimeType: format === 'stix' ? 'application/stix+json;charset=utf-8' : 'application/json;charset=utf-8' };
+}