@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/packages/interchange/external-findings-import.mjs

@@ -1,11 +1,13 @@
-import { normalizeDomain, openOrCreateCase, updateCase, } from "../cases/case-model.mjs";
-import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { openOrCreateCase, updateCase } from "../cases/case-record-operations.mjs";
+import { canonicalRegistrableDomain } from "../analysis/registrable-domain.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { canonicalArtifactJsonV2 } from "../evidence/artifact-integrity.mjs";
 import { sha256IdentityHex } from "../evidence/record-identity.mjs";
 import { MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_VALUE_LENGTH, MAX_RESPONSE_LIMITATION_LENGTH, normalizeCaseEvidencePins, normalizeCaseSightings, } from "../cases/case-response-model.mjs";
 import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDING_LIMITATIONS, MAX_EXTERNAL_FINDING_LIMITATION_LENGTH, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, } from "../contracts/external-observation-interchange.mjs";
 import { hasUnsafeRetainedText } from "./retained-text.mjs";
+import { readInfrastructureObservation } from "../investigation/infrastructure-observation.mjs";
 export { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDING_LIMITATIONS, MAX_EXTERNAL_FINDING_LIMITATION_LENGTH, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, };
 export const EXTERNAL_FINDING_CATEGORIES = [
     'certificate',
@@ -32,6 +34,7 @@ const FINDING_KEYS = new Set([
     'limitations',
     'reference',
     'structuredObservation',
+    'infrastructureObservation',
 ]);
 const STRUCTURED_OBSERVATION_KEYS = new Set([
     'sourceSchema',
@@ -182,16 +185,7 @@ function structuredObservation(value, index) {
     };
 }
 function findingKey(finding, sourceName) {
-    return [
-        finding.domain,
-        finding.category,
-        finding.evidenceClass,
-        finding.summary,
-        finding.observedAt,
-        finding.completeness,
-        sourceName,
-        finding.structuredObservation?.eventId ?? '',
-    ].join('\u0000');
+    return canonicalArtifactJsonV2({ sourceName, finding });
 }
 export function parseExternalFindingsDocument(value) {
     const root = record(value);
@@ -199,8 +193,8 @@ export function parseExternalFindingsDocument(value) {
         throw new Error('External findings must use the documented object shape without additional top-level fields.');
     }
     if (root.schema !== EXTERNAL_FINDINGS_SCHEMA
-        || root.schemaVersion !== EXTERNAL_FINDINGS_VERSION) {
-        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version ${EXTERNAL_FINDINGS_VERSION}.`);
+        || (root.schemaVersion !== 4 && root.schemaVersion !== 5)) {
+        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version 4 or 5.`);
     }
     const sourceValue = record(root.source);
     if (!sourceValue || !hasOnlyKeys(sourceValue, SOURCE_KEYS)) {
@@ -215,6 +209,7 @@ export function parseExternalFindingsDocument(value) {
         throw new Error(`External findings must contain between 1 and ${MAX_EXTERNAL_FINDINGS} findings.`);
     }
     const normalized = [];
+    let retainedBytes = new TextEncoder().encode(JSON.stringify({ schema: root.schema, schemaVersion: root.schemaVersion, source, findings: [] })).byteLength + 1;
     const seen = new Set();
     const domainCounts = new Map();
     for (const [index, raw] of root.findings.entries()) {
@@ -236,7 +231,7 @@ export function parseExternalFindingsDocument(value) {
         if (evidenceClass !== 'deployment_observation' && evidenceClass !== 'provider_report') {
             throw new Error(`Finding ${index + 1} evidence class is unsupported.`);
         }
-        const finding = {
+        let finding = {
             domain,
             category: item.category,
             evidenceClass,
@@ -247,6 +242,21 @@ export function parseExternalFindingsDocument(value) {
             reference: optionalText(item.reference, 500, `Finding ${index + 1} reference`),
             structuredObservation: structuredObservation(item.structuredObservation, index),
         };
+        if (Object.hasOwn(item, 'infrastructureObservation')) {
+            if (root.schemaVersion !== 5)
+                throw new TypeError('Infrastructure observations require external-findings version 5.');
+            const infrastructureObservation = readInfrastructureObservation(item.infrastructureObservation);
+            if (infrastructureObservation.target !== domain || infrastructureObservation.observedAt !== finding.observedAt)
+                throw new TypeError('Infrastructure snapshot must match its finding target and observation time.');
+            if (finding.structuredObservation)
+                throw new TypeError('Infrastructure snapshots cannot also declare a single structured observation.');
+            finding = { ...finding, infrastructureObservation };
+        }
+        if (root.schemaVersion === 5) {
+            retainedBytes += new TextEncoder().encode(JSON.stringify(finding)).byteLength + 1;
+            if (retainedBytes > MAX_EXTERNAL_FINDINGS_IMPORT_BYTES)
+                throw new TypeError('External findings exceed the retained aggregate byte bound.');
+        }
         const key = findingKey(finding, source.name);
         if (seen.has(key))
             continue;
@@ -265,12 +275,14 @@ export function parseExternalFindingsDocument(value) {
         throw new Error('External findings did not contain a unique valid finding.');
     return {
         schema: EXTERNAL_FINDINGS_SCHEMA,
-        schemaVersion: EXTERNAL_FINDINGS_VERSION,
+        schemaVersion: root.schemaVersion,
         source,
         findings: normalized,
     };
 }
 export function serializeExternalFindingsDocument(value) {
+    if (record(value)?.schemaVersion === 5)
+        return `${JSON.stringify(parseExternalFindingsDocument(value))}\n`;
     const serialised = JSON.stringify(value, null, 2);
     if (typeof serialised !== 'string') {
         throw new TypeError('External findings must be JSON-serialisable.');
@@ -302,6 +314,12 @@ function alreadyRetained(recordValue, projection) {
     });
 }
 function structuredPinFields(finding) {
+    if (finding.infrastructureObservation)
+        return {
+            field: 'infrastructure.snapshot', category: 'infrastructure',
+            sourceSchema: { collection: 'external_observations', schema: finding.infrastructureObservation.schema, version: finding.infrastructureObservation.version },
+            infrastructureObservation: finding.infrastructureObservation,
+        };
     const observation = finding.structuredObservation;
     if (!observation)
         return {};
@@ -356,6 +374,7 @@ export function externalFindingCaseProjection(finding, source) {
     const omittedLimitations = finding.limitations.filter((item) => !sourceLimitations.includes(item)).length;
     const pin = normalizeCaseEvidencePins([{
             ...structuredPinFields(finding),
+            observationHostname: finding.domain,
             importContentSha256: identitySha256,
             label: `External ${finding.category} finding`,
             value,
@@ -436,17 +455,6 @@ export function mergeExternalFindingsIntoCases(current, document, now = new Date
         duplicatesSkipped,
     };
 }
-function targetedFinding(finding, caseDomain) {
-    if (finding.domain === caseDomain)
-        return finding;
-    const prefix = `Captured hostname ${finding.domain}. `;
-    const maximumSummaryLength = MAX_EXTERNAL_FINDING_SUMMARY_LENGTH;
-    const remaining = maximumSummaryLength - prefix.length;
-    const summary = remaining > 1 && finding.summary.length > remaining
-        ? `${prefix}${finding.summary.slice(0, remaining - 1).trimEnd()}…`
-        : `${prefix}${finding.summary}`;
-    return { ...finding, domain: caseDomain, summary };
-}
 export function externalFindingsCaseTargets(document, caseDomain) {
     if (canonicalRegistrableDomain(caseDomain) !== caseDomain) {
         throw new Error('The selected Case does not have a canonical registrable-domain identity.');
@@ -476,8 +484,7 @@ export function mergeExternalFindingsIntoCase(current, caseId, document, now = n
     let record = selected;
     let findingsAdded = 0;
     let duplicatesSkipped = 0;
-    for (const original of document.findings) {
-        const finding = targetedFinding(original, selected.domain);
+    for (const finding of document.findings) {
         const merged = mergeExternalFindingIntoCase(cases, selected.id, finding, document.source, now);
         cases = merged.cases;
         record = merged.record;

package/packages/interchange/json-output.mjs

@@ -0,0 +1,14 @@
+const TERMINAL_UNSAFE_JSON_RE = /[\u007f-\u009f\u2028\u2029]|\p{Default_Ignorable_Code_Point}/gu;
+function jsonUnicodeEscape(value) {
+    const codePoint = value.codePointAt(0);
+    if (codePoint <= 0xffff)
+        return `\\u${codePoint.toString(16).padStart(4, '0')}`;
+    const offset = codePoint - 0x10000;
+    const high = 0xd800 + (offset >> 10);
+    const low = 0xdc00 + (offset & 0x3ff);
+    return `\\u${high.toString(16).padStart(4, '0')}\\u${low.toString(16).padStart(4, '0')}`;
+}
+/** Escape display controls without changing the parsed JSON values. */
+export function terminalSafeJson(value, space) {
+    return JSON.stringify(value, null, space).replace(TERMINAL_UNSAFE_JSON_RE, jsonUnicodeEscape);
+}

package/packages/interchange/managed-indicator-export.mjs

@@ -0,0 +1,36 @@
+import { readManagedIndicatorSet, serializeManagedIndicatorSet } from "./managed-indicator-set.mjs";
+import { terminalSafeJson } from "./json-output.mjs";
+import { stixIndicatorObjects, stixIndicatorProducer } from "./stix-indicator-export.mjs";
+import { mispIndicatorAttribute, mispIndicatorEvent } from "./misp-indicator-export.mjs";
+/** Re-exporting a revision is deterministic; revoked object versions never advance. */
+export async function exportManagedIndicators(input, format) {
+    const manifest = await readManagedIndicatorSet(input);
+    let document = manifest;
+    if (format === 'stix') {
+        const producer = `identity--${manifest.producerId}`;
+        document = { type: 'bundle', id: `bundle--${manifest.revisionId}`, objects: [
+                stixIndicatorProducer(producer, manifest.createdAt),
+                ...manifest.entries.flatMap(entry => stixIndicatorObjects(entry.domain, entry.observation.availability, entry.observation, entry.createdAt, producer, type => `${type}--${entry.id}`)
+                    .map(object => object.type !== 'indicator' ? object : { ...object,
+                    modified: entry.modifiedAt, valid_until: entry.expiresAt, revoked: entry.withdrawal !== null,
+                    x_whoisleuth_managed_set: manifest.id, x_whoisleuth_original_review_basis: entry.basis,
+                    x_whoisleuth_review_basis: entry.reviewBasis,
+                    ...(entry.withdrawal ? { x_whoisleuth_withdrawal_reason: entry.withdrawal.reason } : {}),
+                })),
+            ] };
+    }
+    else if (format === 'misp') {
+        const attributes = manifest.entries.map(entry => {
+            const attribute = mispIndicatorAttribute(entry.domain, entry.observation.availability, entry.observation, entry.id, entry.modifiedAt);
+            return { ...attribute, deleted: entry.withdrawal !== null,
+                comment: `${attribute.comment}; review-expires=${entry.expiresAt}; expiry requires recipient review, not automatic deletion; original-basis=${entry.basis}; latest-review=${entry.reviewBasis}${entry.withdrawal ? `; withdrawn=${entry.withdrawal.reason}` : ''}` };
+        });
+        document = { Event: { ...mispIndicatorEvent(manifest.id, manifest.createdAt, attributes),
+                info: `${manifest.name} · reviewed domain indicators`, timestamp: String(Math.floor(Date.parse(manifest.modifiedAt) / 1000)) } };
+    }
+    else if (format !== 'manifest')
+        throw new TypeError('Unsupported managed indicator export format.');
+    return { document, content: format === 'manifest' ? serializeManagedIndicatorSet(manifest) : `${terminalSafeJson(document, 2)}\n`,
+        filename: `whoisleuth-indicators-${manifest.id}-r${manifest.revision}.${format}.json`,
+        mimeType: format === 'stix' ? 'application/stix+json;charset=utf-8' : 'application/json;charset=utf-8' };
+}

package/packages/interchange/managed-indicator-set.mjs

@@ -0,0 +1,223 @@
+import { array, digest, domain, enumeration, exact, exactOptional, integer, iso, text, validateIntegrity } from "../evidence/artifact-structure.mjs";
+import { canonicalArtifactJsonV2, sha256ArtifactDigestV2, SORTED_JSON_V2 } from "../evidence/artifact-integrity.mjs";
+import { assertWorkspaceInputGraph } from "../workspace/hostile-input.mjs";
+import { parseBoundedJson, boundedJsonLimitsForBytes } from "../analysis/bounded-json.mjs";
+import { MANAGED_INDICATOR_SET_SCHEMA, MANAGED_INDICATOR_SET_VERSION, MAX_MANAGED_INDICATOR_SET_BYTES, MAX_MANAGED_INDICATOR_PLAN_BYTES } from "../contracts/analyst-interchange.mjs";
+import { defensiveIndicatorProvenance, prepareDefensiveIndicatorExport, MAX_DEFENSIVE_INDICATOR_INPUTS } from "./defensive-indicator-export.mjs";
+import { MAX_STIX_INDICATORS } from "./stix-indicator-export.mjs";
+import { terminalSafeJson } from "./json-output.mjs";
+export const MAX_MANAGED_INDICATORS = MAX_STIX_INDICATORS;
+export const MAX_INDICATOR_REVIEW_BASIS = 1_000;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+const AVAILABILITY = ['registered', 'for_sale', 'expiring'];
+function uuid(value) {
+    if (typeof value !== 'string' || !UUID.test(value))
+        throw new TypeError('Indicator identities must be lowercase version-4 UUIDs.');
+    return value;
+}
+function timestamp(value, label) { iso(value, label); return value; }
+function basis(value) {
+    const result = text(value, 'Indicator review basis', MAX_INDICATOR_REVIEW_BASIS).trim();
+    if (!result)
+        throw new TypeError('Explain the indicator revision.');
+    return result;
+}
+function bounded(value, maximumBytes) {
+    assertWorkspaceInputGraph(value, 'Indicator input', { maximumBytes });
+    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > maximumBytes)
+        throw new TypeError('Indicator input exceeds its byte limit.');
+}
+/** Structural validation is independent of digest verification and author trust. */
+export function validateManagedIndicatorSet(value) {
+    bounded(value, MAX_MANAGED_INDICATOR_SET_BYTES);
+    const root = exact(value, ['schema', 'version', 'id', 'producerId', 'revisionId', 'name', 'revision', 'createdAt', 'modifiedAt', 'previous', 'entries', 'integrity'], 'Managed indicator set');
+    if (root.schema !== MANAGED_INDICATOR_SET_SCHEMA || root.version !== MANAGED_INDICATOR_SET_VERSION)
+        throw new TypeError('Unsupported managed indicator set schema or version.');
+    const identities = [uuid(root.id), uuid(root.producerId), uuid(root.revisionId)];
+    if (!text(root.name, 'Indicator set name', 120).trim())
+        throw new TypeError('Name the indicator set.');
+    const revision = integer(root.revision, 'Indicator revision', 1);
+    const created = Date.parse(timestamp(root.createdAt, 'Set creation time')), modified = Date.parse(timestamp(root.modifiedAt, 'Set modification time'));
+    if (modified < created || (revision === 1 && modified !== created))
+        throw new TypeError('Indicator revision times are inconsistent.');
+    if (revision === 1) {
+        if (root.previous !== null)
+            throw new TypeError('An initial indicator revision has no predecessor.');
+    }
+    else {
+        const previous = exact(root.previous, ['revisionId', 'digestSha256'], 'Preceding indicator revision');
+        identities.push(uuid(previous.revisionId));
+        digest(previous.digestSha256, 'Preceding revision digest');
+    }
+    const activeDomains = new Set();
+    for (const item of array(root.entries, 'Managed indicators', MAX_MANAGED_INDICATORS, 1)) {
+        const entry = exact(item, ['id', 'domain', 'createdAt', 'modifiedAt', 'expiresAt', 'basis', 'reviewBasis', 'observation', 'withdrawal'], 'Managed indicator');
+        identities.push(uuid(entry.id));
+        domain(entry.domain, 'Managed indicator domain');
+        const first = Date.parse(timestamp(entry.createdAt, 'Indicator creation time'));
+        const last = Date.parse(timestamp(entry.modifiedAt, 'Indicator modification time'));
+        const expires = Date.parse(timestamp(entry.expiresAt, 'Indicator review expiry'));
+        if (first < created || last < first || last > modified || expires <= first || (entry.withdrawal === null && expires <= last))
+            throw new TypeError('Indicator entry times are inconsistent.');
+        basis(entry.basis);
+        basis(entry.reviewBasis);
+        const observation = exact(entry.observation, ['availability', 'riskScore', 'riskModelVersion', 'scanDepth', 'observedAt'], 'Indicator observation');
+        enumeration(observation.availability, AVAILABILITY, 'Indicator registration observation');
+        if (observation.riskScore !== null)
+            integer(observation.riskScore, 'Retained risk score', 0, 100);
+        if (observation.riskModelVersion !== null)
+            integer(observation.riskModelVersion, 'Retained risk model', 1, 1_000);
+        enumeration(observation.scanDepth, ['fast', 'deep', 'unknown'], 'Retained scan depth');
+        iso(observation.observedAt, 'Retained observation time', true);
+        if (entry.withdrawal === null) {
+            if (activeDomains.has(entry.domain))
+                throw new TypeError('Only one active identity per domain is allowed in a managed set.');
+            activeDomains.add(entry.domain);
+        }
+        else {
+            const withdrawal = exact(entry.withdrawal, ['at', 'reason'], 'Indicator withdrawal');
+            if (timestamp(withdrawal.at, 'Withdrawal time') !== entry.modifiedAt)
+                throw new TypeError('Withdrawal must be the final indicator modification.');
+            basis(withdrawal.reason);
+        }
+    }
+    if (new Set(identities).size !== identities.length)
+        throw new TypeError('Managed indicator identities must be distinct.');
+    validateIntegrity(root.integrity, 'Managed indicator integrity', root.version, MANAGED_INDICATOR_SET_VERSION);
+    return value;
+}
+export async function readManagedIndicatorSet(value) {
+    const checked = structuredClone(validateManagedIndicatorSet(value));
+    const { integrity, ...unsigned } = checked;
+    if (await sha256ArtifactDigestV2(unsigned) !== integrity.digestSha256)
+        throw new TypeError('Managed indicator content does not match its recorded digest.');
+    return checked;
+}
+export function parseManagedIndicatorJson(raw, plan = false) {
+    const maximumBytes = plan ? MAX_MANAGED_INDICATOR_PLAN_BYTES : MAX_MANAGED_INDICATOR_SET_BYTES;
+    return parseBoundedJson(raw, { maximumBytes, label: 'Managed indicator input', limits: boundedJsonLimitsForBytes(maximumBytes) });
+}
+/** Both writers enforce the reader's budget on final UTF-8 bytes, including escapes. */
+export function serializeManagedIndicatorSet(manifest) {
+    const pretty = `${terminalSafeJson(manifest, 2)}\n`;
+    if (new TextEncoder().encode(pretty).byteLength <= MAX_MANAGED_INDICATOR_SET_BYTES)
+        return pretty;
+    const compact = terminalSafeJson(manifest);
+    if (new TextEncoder().encode(compact).byteLength > MAX_MANAGED_INDICATOR_SET_BYTES) {
+        throw new TypeError('The indicator revision exceeds the file byte limit after safe JSON encoding; no partial file was created.');
+    }
+    return compact;
+}
+export function managedIndicatorState(entry, at) {
+    iso(at, 'Review time');
+    return entry.withdrawal ? 'withdrawn' : Date.parse(entry.expiresAt) <= Date.parse(at) ? 'expired' : 'active';
+}
+/** A known predecessor detects removal, rollback and edits to original observations. */
+export function compareManagedIndicatorRevisions(previous, next) {
+    validateManagedIndicatorSet(previous);
+    validateManagedIndicatorSet(next);
+    if (previous.id !== next.id || previous.producerId !== next.producerId || previous.name !== next.name || previous.createdAt !== next.createdAt
+        || next.revision !== previous.revision + 1 || next.previous?.revisionId !== previous.revisionId || next.previous.digestSha256 !== previous.integrity.digestSha256
+        || Math.floor(Date.parse(next.modifiedAt) / 1000) <= Math.floor(Date.parse(previous.modifiedAt) / 1000)) {
+        throw new TypeError('This is not the next revision of the selected indicator set. Keep both files and review the predecessor.');
+    }
+    const old = new Map(previous.entries.map(entry => [entry.id, entry]));
+    const changes = [];
+    for (const entry of next.entries) {
+        const retained = old.get(entry.id);
+        if (!retained) {
+            if (entry.createdAt !== next.modifiedAt || entry.modifiedAt !== next.modifiedAt || entry.withdrawal)
+                throw new TypeError('A new indicator must start in the new revision.');
+            changes.push({ id: entry.id, domain: entry.domain, kind: 'added' });
+            continue;
+        }
+        old.delete(entry.id);
+        if (canonicalArtifactJsonV2(retained) === canonicalArtifactJsonV2(entry))
+            continue;
+        if (retained.withdrawal || entry.modifiedAt !== next.modifiedAt || retained.domain !== entry.domain || retained.createdAt !== entry.createdAt
+            || retained.basis !== entry.basis || canonicalArtifactJsonV2(retained.observation) !== canonicalArtifactJsonV2(entry.observation)
+            || (entry.withdrawal && retained.expiresAt !== entry.expiresAt))
+            throw new TypeError('A revision cannot rewrite observations or modify a withdrawn identity.');
+        changes.push({ id: entry.id, domain: entry.domain, kind: entry.withdrawal ? 'withdrawn' : 'renewed' });
+    }
+    if (old.size)
+        throw new TypeError('A revision cannot remove retained indicator history.');
+    if (!changes.length)
+        throw new TypeError('No indicator change was selected.');
+    return changes;
+}
+export async function buildManagedIndicatorRevision(input, now = new Date().toISOString()) {
+    bounded(input, MAX_MANAGED_INDICATOR_PLAN_BYTES);
+    const plan = exactOptional(structuredClone(input), ['basis'], ['name', 'previous', 'rows', 'selectedDomains', 'officialDomains', 'allowlistedDomains', 'commonInfrastructureDomains', 'renewIds', 'withdrawIds', 'reintroduceDomains', 'expiresAt'], 'Indicator revision plan');
+    const previous = plan.previous === undefined ? null : await readManagedIndicatorSet(plan.previous);
+    const generatedAt = timestamp(now, 'Revision time');
+    const reviewBasis = basis(plan.basis);
+    const name = plan.name === undefined && previous ? previous.name : text(plan.name, 'Indicator set name', 120).trim();
+    if (!name || (previous && name !== previous.name))
+        throw new TypeError('A revision retains the original set name.');
+    function values(key, maximum, read) {
+        const result = array(plan[key] ?? [], key, maximum).map(read);
+        if (new Set(result).size !== result.length)
+            throw new TypeError('Revision selections must not contain duplicates.');
+        return result;
+    }
+    const domains = (key) => values(key, MAX_DEFENSIVE_INDICATOR_INPUTS, item => { domain(item, 'Selected domain'); return item; });
+    const selectedDomains = domains('selectedDomains');
+    const preflight = prepareDefensiveIndicatorExport(array(plan.rows ?? [], 'Reviewed rows', MAX_DEFENSIVE_INDICATOR_INPUTS), {
+        selectedDomains, officialDomains: domains('officialDomains'), allowlistedDomains: domains('allowlistedDomains'), commonInfrastructureDomains: domains('commonInfrastructureDomains'),
+    }, MAX_MANAGED_INDICATORS);
+    if (preflight.truncated)
+        throw new TypeError('The selected revision exceeds the managed-set entry limit; no partial revision was created.');
+    const renew = new Set(values('renewIds', MAX_MANAGED_INDICATORS, uuid));
+    const withdraw = new Set(values('withdrawIds', MAX_MANAGED_INDICATORS, uuid));
+    const reintroduce = new Set(domains('reintroduceDomains'));
+    if ([...renew].some(id => withdraw.has(id)))
+        throw new TypeError('An indicator cannot be renewed and withdrawn in one revision.');
+    const entries = structuredClone(previous?.entries ?? []);
+    const known = new Map(entries.map(entry => [entry.id, entry]));
+    for (const id of [...renew, ...withdraw])
+        if (!known.has(id) || known.get(id).withdrawal)
+            throw new TypeError('Select an existing, non-withdrawn indicator identity.');
+    const active = new Set(entries.filter(entry => !entry.withdrawal).map(entry => entry.domain));
+    const withdrawn = new Set(entries.filter(entry => entry.withdrawal).map(entry => entry.domain));
+    const additions = preflight.entries.filter(entry => !active.has(entry.domain));
+    if ([...reintroduce].some(value => !withdrawn.has(value) || !additions.some(entry => entry.domain === value)))
+        throw new TypeError('Reintroduction must select a withdrawn domain being added with a new identity.');
+    for (const entry of additions)
+        if (withdrawn.has(entry.domain) && !reintroduce.has(entry.domain))
+            throw new TypeError('Explicitly approve a new identity before reintroducing a withdrawn domain.');
+    let expiresAt = null;
+    if (additions.length || renew.size) {
+        expiresAt = timestamp(plan.expiresAt, 'New review expiry');
+        if (Date.parse(expiresAt) <= Date.parse(generatedAt))
+            throw new TypeError('The new review expiry must be in the future.');
+    }
+    else if (plan.expiresAt !== undefined)
+        timestamp(plan.expiresAt, 'New review expiry');
+    for (const entry of entries) {
+        if (renew.has(entry.id)) {
+            entry.expiresAt = expiresAt;
+            entry.modifiedAt = generatedAt;
+            entry.reviewBasis = reviewBasis;
+        }
+        if (withdraw.has(entry.id)) {
+            entry.withdrawal = { at: generatedAt, reason: reviewBasis };
+            entry.modifiedAt = generatedAt;
+            entry.reviewBasis = reviewBasis;
+        }
+    }
+    const randomId = () => globalThis.crypto.randomUUID();
+    for (const entry of additions)
+        entries.push({ id: randomId(), domain: entry.domain, createdAt: generatedAt, modifiedAt: generatedAt, expiresAt: expiresAt, basis: reviewBasis, reviewBasis,
+            observation: { availability: entry.source.availability, ...defensiveIndicatorProvenance(entry.source) }, withdrawal: null });
+    if (!additions.length && !renew.size && !withdraw.size)
+        throw new TypeError('No eligible addition, renewal or withdrawal was selected.');
+    const unsigned = { schema: MANAGED_INDICATOR_SET_SCHEMA, version: MANAGED_INDICATOR_SET_VERSION,
+        id: previous?.id ?? randomId(), producerId: previous?.producerId ?? randomId(), revisionId: randomId(), name,
+        revision: (previous?.revision ?? 0) + 1, createdAt: previous?.createdAt ?? generatedAt, modifiedAt: generatedAt,
+        previous: previous ? { revisionId: previous.revisionId, digestSha256: previous.integrity.digestSha256 } : null, entries };
+    const manifest = validateManagedIndicatorSet({ ...unsigned, integrity: { algorithm: 'SHA-256', canonicalization: SORTED_JSON_V2, digestSha256: await sha256ArtifactDigestV2(unsigned) } });
+    serializeManagedIndicatorSet(manifest);
+    const changes = previous ? compareManagedIndicatorRevisions(previous, manifest) : manifest.entries.map(entry => ({ id: entry.id, domain: entry.domain, kind: 'added' }));
+    return { manifest, changes, unchanged: manifest.entries.length - changes.length, exclusions: preflight.exclusions };
+}

package/packages/interchange/misp-indicator-export.mjs

@@ -0,0 +1,93 @@
+// Pure MISP event JSON for local analyst import. The event stays unpublished,
+// organization-only, non-IDS, and non-correlating until a MISP user reviews it.
+import { collectDefensiveIndicatorCandidates, defensiveIndicatorProvenance, MAX_DEFENSIVE_INDICATORS, } from "./defensive-indicator-export.mjs";
+import { MISP_INDICATOR_EXPORT_VERSION } from "../contracts/analyst-interchange.mjs";
+export { MISP_INDICATOR_EXPORT_VERSION } from "../contracts/analyst-interchange.mjs";
+export const MAX_MISP_ATTRIBUTES = MAX_DEFENSIVE_INDICATORS;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const CONTROL_RE = /[\x00-\x1f\x7f]/;
+const WARNING = 'Review before operational use; false positives are possible.';
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function isoTimestamp(value) {
+    if (typeof value !== 'string' || value.length > 64 || CONTROL_RE.test(value))
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+function defaultUuidFactory() {
+    const uuid = globalThis.crypto?.randomUUID?.();
+    if (!uuid)
+        throw new Error('Secure random identifiers are unavailable for the MISP export.');
+    return uuid;
+}
+function nextUuid(uuidFactory, used) {
+    const value = uuidFactory();
+    if (typeof value !== 'string' || !UUID_RE.test(value)) {
+        throw new Error('The MISP identifier factory returned an invalid UUID.');
+    }
+    const uuid = value.toLowerCase();
+    if (used.has(uuid))
+        throw new Error('The MISP identifier factory returned a duplicate UUID.');
+    used.add(uuid);
+    return uuid;
+}
+function attributeComment(availability, provenance) {
+    const { riskScore: score, riskModelVersion: modelVersion, scanDepth, observedAt } = provenance;
+    return [
+        'Heuristic Bulk finding',
+        `availability=${availability}`,
+        `risk=${score ?? 'unknown'}`,
+        ...(modelVersion === null ? [] : [`risk-model=v${modelVersion}`]),
+        `scan-depth=${scanDepth}`,
+        `observed-at=${observedAt ?? 'unknown'}`,
+        `timestamp-basis=${observedAt ? 'scan' : 'unknown'}`,
+        WARNING,
+    ].join('; ');
+}
+export function mispIndicatorAttribute(domain, availability, provenance, uuid, modifiedAt) {
+    return {
+        uuid, type: 'domain', category: 'Network activity', value: domain,
+        to_ids: false, distribution: '5', timestamp: String(Math.floor(Date.parse(modifiedAt) / 1000)),
+        ...(provenance.observedAt ? { first_seen: provenance.observedAt, last_seen: provenance.observedAt } : {}),
+        comment: attributeComment(availability, provenance), disable_correlation: true, deleted: false,
+    };
+}
+export function mispIndicatorEvent(uuid, generatedAt, attributes) {
+    return { uuid, date: generatedAt.slice(0, 10),
+        info: `WHOISleuth heuristic defensive-domain candidates for analyst review (export v${MISP_INDICATOR_EXPORT_VERSION})`,
+        threat_level_id: '4', analysis: '0', distribution: '0', published: false,
+        timestamp: String(Math.floor(Date.parse(generatedAt) / 1000)), publish_timestamp: '0', disable_correlation: true, Attribute: attributes };
+}
+export function buildMispIndicatorExport(records, options = {}) {
+    const generatedAt = isoTimestamp(options.generatedAt) || new Date().toISOString();
+    const uuidFactory = typeof options.uuidFactory === 'function'
+        ? options.uuidFactory
+        : defaultUuidFactory;
+    let collected;
+    try {
+        collected = collectDefensiveIndicatorCandidates(records, MAX_MISP_ATTRIBUTES);
+    }
+    catch (cause) {
+        if (cause instanceof TypeError)
+            throw new TypeError('MISP indicator export requires an array of Bulk results.');
+        throw cause;
+    }
+    const used = new Set();
+    const eventUuid = nextUuid(uuidFactory, used);
+    const attributes = collected.entries.map(({ domain, source }) => mispIndicatorAttribute(domain, record(source).availability, defensiveIndicatorProvenance(source), nextUuid(uuidFactory, used), generatedAt));
+    const payload = { Event: mispIndicatorEvent(eventUuid, generatedAt, attributes) };
+    return {
+        version: MISP_INDICATOR_EXPORT_VERSION,
+        format: 'misp',
+        generatedAt,
+        domains: collected.domains,
+        truncated: collected.truncated,
+        filename: `whoisleuth-defensive-domains-${generatedAt.slice(0, 10)}.misp.json`,
+        mimeType: 'application/json;charset=utf-8',
+        content: `${JSON.stringify(payload, null, 2)}\n`,
+    };
+}

package/packages/interchange/sharing-policy.mjs

@@ -0,0 +1,56 @@
+/** Sharing declarations are not encryption, redaction or an authority to disclose. */
+export const TLP_MARKINGS = ['clear', 'green', 'amber', 'amber-strict', 'red'];
+export const RECIPIENT_SCOPES = ['public', 'community', 'organization', 'named-recipients'];
+const RISKY_KEYS = new Set([
+    'authorization', 'cookie', 'cookies', 'credential', 'credentials', 'email', 'emails',
+    'entities', 'password', 'phone', 'raw', 'rawrdap', 'rawwhois', 'registrant', 'session', 'token',
+]);
+const MARKING_KEYS = new Set([
+    'informationmarking', 'marking', 'markings', 'sharingmarking',
+    'tlp', 'tlplabel', 'tlpmarking', 'trafficlightprotocol',
+]);
+export function markingFromText(value) {
+    const normalized = value.toUpperCase().replace(/\s+/gu, '').replace('TLP:', '').replace('+STRICT', '-STRICT').toLowerCase();
+    return TLP_MARKINGS.includes(normalized) ? normalized : null;
+}
+export function expectedScope(marking) {
+    if (marking === 'clear')
+        return 'public';
+    if (marking === 'green')
+        return 'community';
+    if (marking === 'red')
+        return 'named-recipients';
+    return 'organization';
+}
+export function tlpLabel(marking) {
+    return `TLP:${marking === 'amber-strict' ? 'AMBER+STRICT' : marking.toUpperCase()}`;
+}
+/** Scan an already admitted, byte/node/depth-bounded JSON tree, not arbitrary objects. */
+export function scanSharingMetadata(root) {
+    const stack = [{ value: root, marking: false }];
+    const markings = new Set();
+    let riskyKeyCount = 0;
+    while (stack.length) {
+        const next = stack.pop();
+        if (typeof next.value === 'string') {
+            if (next.marking) {
+                const marking = markingFromText(next.value);
+                if (marking)
+                    markings.add(marking);
+            }
+        }
+        else if (Array.isArray(next.value)) {
+            for (const value of next.value)
+                stack.push({ value, marking: next.marking });
+        }
+        else if (next.value && typeof next.value === 'object') {
+            for (const [key, value] of Object.entries(next.value)) {
+                const normalized = key.toLowerCase().replace(/[^a-z0-9]/gu, '');
+                if (RISKY_KEYS.has(normalized))
+                    riskyKeyCount++;
+                stack.push({ value, marking: MARKING_KEYS.has(normalized) });
+            }
+        }
+    }
+    return { importedMarkings: [...markings], riskyKeyCount };
+}