@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/cli/history-command-definitions.mjs

@@ -0,0 +1,88 @@
+import { LOOKUP_EVIDENCE_SCHEMA_VERSION, V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION } from "../packages/contracts/lookup-evidence.mjs";
+import { PUBLISHED_V2_LOOKUP_EVIDENCE_VERSIONS, positional, OPTIONAL_FILE_POSITIONAL, constraint, EMPTY_CONSTRAINTS, commandSeed } from "./command-definition.mjs";
+export const HISTORY_COMMAND_DEFINITIONS = Object.freeze({
+    diff: commandSeed({
+        reference: {
+            description: 'Compare an earlier and later artefact from the same retained Lookup, Bulk-session, or domain-portfolio family.',
+            example: 'whoisleuth diff earlier.json later.json --json',
+            boundary: 'Comparison is offline: the left input is earlier and the right input is later. Inputs must belong to the same supported family. Saved Lookups can describe the same or different domains; same-domain comparisons preserve observation times and collection uncertainty. For a multi-session Bulk export, --left-session selects a session from the left file and --right-session selects one from the right; missing, unavailable, equal, and different evidence remain separate states.',
+        },
+        collection: { scope: 'Reads two compatible retained artefacts capped at 8 MiB each and retains no source paths.' },
+        summary: 'Compare two compatible retained artefacts',
+        options: ['--left-session', '--right-session', '--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('sources', 'file', 2, 2)]),
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'history',
+        networkEffect: 'offline',
+        common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.lookup-diff']),
+        primaryArtefacts: Object.freeze(['Retained-evidence comparison']),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    reconcile: commandSeed({
+        reference: {
+            description: 'Reconcile bounded values across independently labelled observations of one domain.',
+            example: 'whoisleuth reconcile office.json mobile.json external.json --json',
+            boundary: 'The command is offline, accepts 2 to 5 saved observations for one domain, and never treats labels as proof of network independence or majority agreement as truth.',
+        },
+        collection: { scope: 'Reads 2 to 5 saved observations for one domain, capped at 32 MiB in total.' },
+        summary: 'Reconcile independently labelled observations',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('sources', 'file', 2, 5)]),
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'history',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.lookup-reconciliation']),
+        primaryArtefacts: Object.freeze([]),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    timeline: commandSeed({
+        reference: {
+            description: 'Build an ordered same-domain history from saved Lookup observations.',
+            example: 'whoisleuth timeline first.json second.json latest.json --json',
+            boundary: 'The command is offline, accepts 2 to 20 bounded inputs for one domain, retains no filenames or raw registry payloads, and does not treat changed collection conditions as a domain change.',
+        },
+        collection: { scope: 'Reads 2 to 20 saved observations for one domain, capped at 32 MiB in total.' },
+        summary: 'Build same-domain history from saved lookups',
+        options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('sources', 'file', 2, 20)]),
+        constraints: EMPTY_CONSTRAINTS,
+        handlerOwner: 'history',
+        networkEffect: 'offline',
+        common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.cli.lookup-timeline']),
+        primaryArtefacts: Object.freeze(['Bounded retained-observation timeline']),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze([]),
+        bootstrapProfile: 'allowed',
+    }),
+    export: commandSeed({
+        reference: {
+            description: 'Convert one saved lookup into a versioned evidence report.',
+            example: 'whoisleuth export lookup.json --markdown',
+            boundary: `Saved Lookup versions 1 and 2 are capped at 8 MiB and scanned for duplicate keys, the prototype-sensitive __proto__ key, and bounded nesting, key, value, and per-container counts before parsing. Current schema-${LOOKUP_EVIDENCE_SCHEMA_VERSION} exports preserve evidence-source attribution and limitations; published v2 schemas ${PUBLISHED_V2_LOOKUP_EVIDENCE_VERSIONS} and exact v1 schema ${V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION} remain readable, while other historical and unreleased shapes are unsupported. Markdown and HTML include a presentation-only generator footer unless --no-attribution is selected; JSON retains bounded generator provenance. Compact output intentionally omits raw registry payloads.`,
+        },
+        collection: { scope: 'Reads one saved Lookup and writes one bounded report.' },
+        summary: 'Convert a lookup to an evidence report',
+        options: ['--markdown', '--html', '--compact', '--no-attribution'],
+        positionals: OPTIONAL_FILE_POSITIONAL,
+        constraints: Object.freeze([
+            constraint({ kind: 'mutually_exclusive', options: ['--markdown', '--html'] }),
+            constraint({ kind: 'excludes_all', option: '--compact', excludedOptions: ['--markdown', '--html'] }),
+            constraint({ kind: 'requires_any', option: '--no-attribution', requiredOptions: ['--markdown', '--html'] }),
+        ]),
+        handlerOwner: 'history',
+        networkEffect: 'offline',
+        common: true,
+        schemaIdentifiers: Object.freeze(['whoisleuth.lookup-evidence']),
+        primaryArtefacts: Object.freeze(['Portable evidence report']),
+        planSupport: false,
+        additionalOutputFormats: Object.freeze(['JSON']),
+        bootstrapProfile: 'allowed',
+    }),
+});

package/cli/indicator-set-command.mjs

@@ -0,0 +1,32 @@
+import { buildManagedIndicatorRevision, managedIndicatorState, parseManagedIndicatorJson, readManagedIndicatorSet } from "../packages/interchange/managed-indicator-set.mjs";
+import { exportManagedIndicators } from "../packages/interchange/managed-indicator-export.mjs";
+import { MAX_MANAGED_INDICATOR_PLAN_BYTES, MAX_MANAGED_INDICATOR_SET_BYTES } from "../packages/contracts/analyst-interchange.mjs";
+import { safeTerminalValue } from "./formatters/terminal.mjs";
+import EXIT_CODES from "./exit-codes.mjs";
+export async function runIndicatorSetCommand(args, dependencies, context) {
+    context.setFailureLabel('Indicator revision');
+    const raw = dependencies.readArtifactInput ? await dependencies.readArtifactInput(args.source)
+        : await context.readInput(args.source, args.operation === 'revise' ? MAX_MANAGED_INDICATOR_PLAN_BYTES : MAX_MANAGED_INDICATOR_SET_BYTES, 'Indicator input');
+    const input = parseManagedIndicatorJson(raw, args.operation === 'revise');
+    const now = context.now();
+    const revision = args.operation === 'revise' ? await buildManagedIndicatorRevision(input, now) : null;
+    const manifest = revision?.manifest ?? await readManagedIndicatorSet(input);
+    dependencies.signal?.throwIfAborted();
+    if (args.quiet)
+        return EXIT_CODES.SUCCESS;
+    if (args.operation === 'stix' || args.operation === 'misp')
+        context.writeStdout((await exportManagedIndicators(manifest, args.operation)).content);
+    else if (args.output === 'json')
+        context.writeStdout((await exportManagedIndicators(manifest, 'manifest')).content);
+    else {
+        const lines = [`${safeTerminalValue(manifest.name)} · revision ${manifest.revision}`, `Set ${manifest.id}`, `Content digest ${manifest.integrity.digestSha256}`,
+            'Content verified; authorship and earlier revisions are not authenticated.'];
+        if (revision)
+            lines.push(`Changes: ${revision.changes.length} · unchanged: ${revision.unchanged} · excluded candidates: ${revision.exclusions.length}`);
+        for (const entry of manifest.entries)
+            lines.push(`${entry.domain} · ${managedIndicatorState(entry, now)} · ${entry.id}`, `  Review expires ${entry.expiresAt} · source observed ${entry.observation.observedAt ?? 'time unavailable'}`, `  ${safeTerminalValue(entry.reviewBasis)}`);
+        lines.push('Save the manifest for the next revision. Nothing was submitted or applied.');
+        context.writeStdout(context.terminal(`${lines.join('\n')}\n`, args.color));
+    }
+    return EXIT_CODES.SUCCESS;
+}

package/cli/inline-command-families.mjs

@@ -1,47 +1,6 @@
-const SUPPORT_INLINE_COMMANDS = Object.freeze([
-    'completion',
-    'commands',
-    'manual',
-    'doctor',
-    'registry-support',
-    'registry-doctor',
-    'registry-cohort',
-    'registry-scaffold',
-    'risk-calibrate',
-    'lookalike-calibrate',
-]);
-const REVIEW_INLINE_COMMANDS = Object.freeze([
-    'verify-artifact',
-    'interchange-report',
-    'source-report',
-    'compare',
-    'page-compare',
-    'mail-review',
-    'mail-headers',
-    'review-evidence',
-    'brief',
-    'case',
-    'case-pack',
-]);
-const ASSURANCE_INLINE_COMMANDS = Object.freeze([
-    'manifest',
-    'map-observations',
-    'oam-export',
-    'domain-control',
-    'assurance',
-    'change-packet',
-    'sharing-review',
-    'ct-intake',
-]);
-const WORKFLOW_INLINE_COMMANDS = Object.freeze([
-    'monitor-once',
-    'workflow-plan',
-    'workflow-run',
-]);
-const HISTORY_INLINE_COMMANDS = Object.freeze([
-    'diff',
-    'reconcile',
-    'timeline',
-    'export',
-]);
-export { ASSURANCE_INLINE_COMMANDS, HISTORY_INLINE_COMMANDS, REVIEW_INLINE_COMMANDS, SUPPORT_INLINE_COMMANDS, WORKFLOW_INLINE_COMMANDS, };
+import { inlineCommandsFor } from "./command-reference.mjs";
+export const SUPPORT_INLINE_COMMANDS = inlineCommandsFor('support');
+export const REVIEW_INLINE_COMMANDS = inlineCommandsFor('review');
+export const ASSURANCE_INLINE_COMMANDS = inlineCommandsFor('assurance');
+export const WORKFLOW_INLINE_COMMANDS = inlineCommandsFor('workflow');
+export const HISTORY_INLINE_COMMANDS = inlineCommandsFor('history');

package/cli/inline-command-runner.mjs

@@ -1,35 +1,8 @@
-import { CLI_COMMANDS, commandDefinition } from "./command-reference.mjs";
-import { ASSURANCE_INLINE_COMMANDS, HISTORY_INLINE_COMMANDS, REVIEW_INLINE_COMMANDS, SUPPORT_INLINE_COMMANDS, WORKFLOW_INLINE_COMMANDS, } from "./inline-command-families.mjs";
-const FAMILY_COMMANDS = Object.freeze([
-    Object.freeze({ family: 'support', commands: SUPPORT_INLINE_COMMANDS }),
-    Object.freeze({ family: 'review', commands: REVIEW_INLINE_COMMANDS }),
-    Object.freeze({ family: 'assurance', commands: ASSURANCE_INLINE_COMMANDS }),
-    Object.freeze({ family: 'workflow', commands: WORKFLOW_INLINE_COMMANDS }),
-    Object.freeze({ family: 'history', commands: HISTORY_INLINE_COMMANDS }),
-]);
-function buildInlineCommandOwnership() {
-    const ownership = new Map();
-    for (const { family, commands } of FAMILY_COMMANDS) {
-        for (const command of commands) {
-            if (ownership.has(command))
-                throw new Error(`Inline CLI command ${command} has more than one command-family owner.`);
-            ownership.set(command, family);
-        }
-    }
-    return ownership;
-}
-const INLINE_COMMAND_OWNERSHIP = buildInlineCommandOwnership();
-const INLINE_CLI_COMMANDS = Object.freeze(CLI_COMMANDS.filter((command) => commandDefinition(command).execution.handlerOwner === 'inline'));
-function validateInlineCommandOwnership() {
-    const missing = INLINE_CLI_COMMANDS.filter((command) => !INLINE_COMMAND_OWNERSHIP.has(command));
-    const unexpected = [...INLINE_COMMAND_OWNERSHIP.keys()].filter((command) => !INLINE_CLI_COMMANDS.includes(command));
-    if (missing.length || unexpected.length) {
-        throw new Error(`Inline CLI command-family ownership is inconsistent (missing: ${missing.join(', ') || 'none'}; unexpected: ${unexpected.join(', ') || 'none'}).`);
-    }
-}
-validateInlineCommandOwnership();
+import { CLI_COMMANDS, INLINE_COMMAND_FAMILIES, inlineCommandFamily, inlineCommandsFor, } from "./command-reference.mjs";
+const FAMILY_COMMANDS = Object.freeze(INLINE_COMMAND_FAMILIES.map(family => Object.freeze({ family, commands: inlineCommandsFor(family) })));
+const INLINE_CLI_COMMANDS = Object.freeze(CLI_COMMANDS.filter((command) => inlineCommandFamily(command) !== null));
 async function runInlineCommand(args, dependencies, context) {
-    const family = INLINE_COMMAND_OWNERSHIP.get(args.action);
+    const family = inlineCommandFamily(args.action);
     if (family === 'support') {
         const { runSupportCommand } = await import("./support-command-runner.mjs");
         return runSupportCommand(args, dependencies, context);

package/cli/input.mjs

@@ -64,7 +64,7 @@ export async function readCliTextInput(source, stdin, options) {
             if (error instanceof CliUsageError)
                 throw error;
             const message = error instanceof Error ? error.message : `${options.label} could not be read.`;
-            throw new CliUsageError(message);
+            throw new CliUsageError(message, error instanceof TypeError ? 'invalid_input' : 'input_unavailable');
         }
     }
     if (!stdin || stdin.isTTY)
@@ -142,7 +142,7 @@ export async function readCliHeaderInput(source, stdin, options) {
             if (error instanceof CliUsageError || options.signal?.aborted)
                 throw error;
             const message = error instanceof Error ? error.message : `${options.label} could not be read.`;
-            throw new CliUsageError(message);
+            throw new CliUsageError(message, error instanceof TypeError ? 'invalid_input' : 'input_unavailable');
         }
         finally {
             await handle?.close();

package/cli/intake-command.mjs

@@ -0,0 +1,147 @@
+import { readBoundedRegularFile } from "../lib/bounded-file.mjs";
+import { MAX_MESSAGE_INTAKE_BYTES, MESSAGE_INTAKE_INPUTS } from "../packages/contracts/message-intake.mjs";
+import { reviewSelectedInputInWorker } from "./selected-input-worker.mjs";
+import { reviewIdentityIncident } from "../packages/investigation/identity-incident-review.mjs";
+import { intakeIndicators, intakeIndicatorSource } from "../packages/investigation/intake-indicators.mjs";
+import { MAX_INTAKE_CONTEXT_BYTES, applyIntakeContextInput } from "../packages/investigation/intake-context.mjs";
+import { selectReceiverTrust, authenticationHeaderLabel } from "../packages/investigation/mail-authentication-review.mjs";
+import { CliUsageError } from "./errors.mjs";
+import { formatJsonDocument } from "./formatters/json.mjs";
+import EXIT_CODES from "./exit-codes.mjs";
+export function formatMessageIntake(report) {
+    const lines = [`Offline ${report.source.kind} intake`, `Review: ${report.coverage.state} · Extracted links: ${report.links.length} · Reviewed parts: ${report.coverage.reviewedParts}`,
+        `Source: ${report.source.digestSha256} · ${report.source.byteLength} bytes`];
+    for (const identity of report.identities)
+        lines.push(`Part ${identity.part} ${identity.role.replaceAll('_', ' ')}: ${identity.domain}`);
+    for (const header of report.authenticationReview.headers) {
+        lines.push(`${authenticationHeaderLabel(header)} · ${header.state} · receiver trust: ${header.receiverTrust.replaceAll('_', ' ')}`);
+        for (const claim of header.claims)
+            lines.push(`  ${claim.method}/${claim.methodVersion}: ${claim.result} (${claim.state})${claim.domains.map(value => ` · ${value.property}=${value.domain}`).join('')}${claim.duplicateProperties.length ? ` · ambiguous properties: ${claim.duplicateProperties.join(', ')}` : ''}`);
+        if (header.duplicateOf)
+            lines.push(`  Duplicate of header ${header.duplicateOf} in this part.`);
+        lines.push(...header.issues.map(issue => `  ${issue}`));
+    }
+    for (const link of report.links) {
+        lines.push(`${link.id}: ${link.origin} · ${link.source.replaceAll('_', ' ')}${link.parentId ? ` · supplied inside ${link.parentId}` : ''}`);
+        if (link.displayedHostname)
+            lines.push(`  Displayed: ${link.displayedHostname} · ${link.displayedDestination.replaceAll('_', ' ')}`);
+        if (link.authorisation) {
+            lines.push(`  Authorisation: ${link.authorisation.kind.replaceAll('_', ' ')} · client ${link.authorisation.clientId ?? 'not retained or ambiguous'}`);
+            if (link.authorisation.scopes.length)
+                lines.push(`  Requested scopes: ${link.authorisation.scopes.join(', ')}`);
+            if (link.authorisation.redirectOrigin)
+                lines.push(`  Supplied return origin: ${link.authorisation.redirectOrigin}`);
+            if (link.authorisation.duplicateParameters.length)
+                lines.push(`  Ambiguous parameters: ${link.authorisation.duplicateParameters.join(', ')}`);
+        }
+    }
+    for (const indicator of intakeIndicators(report))
+        lines.push(`${indicator.id}: ${indicator.kind.toUpperCase()} ${indicator.value} · literal selected text · ${indicator.location.partId}${indicator.location.page ? ` page ${indicator.location.page}` : ''} · source ${intakeIndicatorSource(report, indicator)}`);
+    if (report.schemaVersion === 2) {
+        lines.push(`Indicator coverage: ${report.indicatorCoverage.state.replaceAll('_', ' ')}. Hashes require explicit algorithm labels; no indicator was resolved or reputation-checked.`);
+        const supplied = report.distributionContext;
+        if (supplied)
+            lines.push(`Analyst-declared distribution: ${supplied.channel} · ${supplied.sourceLabel} · observed ${supplied.observedAt ?? 'unknown'}`, `  Reference ${supplied.reference ?? 'not supplied'} · observer ${supplied.observerLabel ?? 'unknown'} · vantage ${supplied.vantageLabel ?? 'unknown'}`, 'Distribution, observation time and vantage are supplied claims, not verified capture conditions or independent collection.');
+        const selected = report.selectedEvidence;
+        if (selected) {
+            lines.push(`Deliberately selected phone groups: ${selected.phones.length}. Original spans use zero-based, end-exclusive UTF-16 code units.`);
+            lines.push(`Phone extraction coverage: ${selected.phoneCoverage.state.replaceAll('_', ' ')}; ${selected.phoneCoverage.candidatesShown} transient candidates shown, ${selected.phoneCoverage.candidatesReviewed} candidate runs reviewed.`);
+            for (const phone of selected.phones) {
+                lines.push(`  ${phone.canonical ?? 'No canonical number'} · ${phone.state.replaceAll('_', ' ')} · declared ${phone.declaration.role.replaceAll('_', ' ')} · ${phone.declaration.basis.replaceAll('_', ' ')} · country context ${phone.declaration.countryCallingCode ?? 'unknown'}`, `  Source ${phone.declaration.sourceLabel}; declared observation ${phone.declaration.observedAt ?? 'unknown'}; input ${selected.sourceDigestSha256}`);
+                for (const occurrence of phone.occurrences)
+                    lines.push(`    ${JSON.stringify(occurrence.original)} · [${occurrence.start}, ${occurrence.end})${phone.extension ? ` · separate extension ${phone.extension}` : ''}`);
+            }
+            const pair = selected.destinationPair;
+            if (pair)
+                lines.push(`Supplied destination pair: ${pair.state.replaceAll('_', ' ')} · displayed ${pair.displayed.hostname ?? pair.displayed.state} · destination ${pair.destination.hostname ?? pair.destination.state}`, `  Displayed source ${pair.displayedDeclaration.sourceLabel}; declared ${pair.displayedDeclaration.observedAt ?? 'unknown'}; ${pair.displayedDeclaration.basis}`, `  Destination role ${pair.destinationDeclaration.role}; source ${pair.destinationDeclaration.sourceLabel}; declared ${pair.destinationDeclaration.observedAt ?? 'unknown'}; ${pair.destinationDeclaration.basis}`);
+            lines.push(...selected.limitations);
+        }
+    }
+    if (report.actionHints.length)
+        lines.push(`Review wording: ${report.actionHints.map(value => value.replaceAll('_', ' ')).join(', ')}`);
+    if (report.documentReview) {
+        lines.push(`Document coverage: ${report.documentReview.state} · pages ${report.documentReview.reviewedPages}/${report.documentReview.pageCount ?? 'not a paginated review'}`);
+        for (const part of report.documentReview.parts)
+            lines.push(`  ${part.id}${part.page ? ` · page ${part.page}` : ''} · ${part.kind} · ${part.identity} · ${part.digestSha256}`);
+        lines.push(...report.documentReview.notes);
+    }
+    if (report.harReview) {
+        lines.push('Recorded HTTP sequence (not replayed)');
+        for (const entry of report.harReview.entries)
+            lines.push(`  ${entry.sequence}. ${entry.startedAt ?? 'time unavailable'} · ${entry.method} ${entry.origin ?? 'origin unavailable'} · status ${entry.status ?? 'unavailable'} · ${entry.mimeCategory} · ${entry.durationMs === null ? 'duration unavailable' : `${entry.durationMs} ms`}`);
+        if (report.harReview.invalidEntries)
+            lines.push(`Invalid request records omitted: ${report.harReview.invalidEntries}`);
+    }
+    if (report.identityEventReview) {
+        const review = report.identityEventReview;
+        const matches = new Map(review.comparison?.events.map(event => [event.sequence, event]));
+        lines.push(`Selected identity events: ${review.provider} · ${review.events.length} records · ${review.invalidEvents} invalid records omitted`);
+        for (const event of review.events) {
+            const match = matches.get(event.sequence);
+            lines.push(`  ${event.sequence}. ${event.occurredAt ?? 'time unavailable'} · ${event.actorLabel ?? 'actor unavailable'} · ${event.kind} · ${event.result}`, `    applications ${event.applicationIds.join(', ') || 'unavailable'} · resource tenant ${event.tenantId ?? 'unavailable'} · protocol ${event.protocol}`);
+            if (match)
+                lines.push(`    comparison ${match.state}: application ${match.application}, tenant ${match.tenant}, actor ${match.actor}, time ${match.time}`);
+        }
+        lines.push('Actor labels are file-local. Matching supplied fields does not establish account compromise.');
+    }
+    for (const step of report.identityRecovery.nextSteps)
+        lines.push(`Account response — ${step.title}: ${step.detail}`);
+    if (report.coverage.unreviewedAttachments)
+        lines.push(`Unreviewed attachments: ${report.coverage.unreviewedAttachments}`);
+    if (report.coverage.rejectedLinks)
+        lines.push(`Unsupported link values: ${report.coverage.rejectedLinks}`);
+    if (report.coverage.boundsReached.length)
+        lines.push(`Partial analysis: ${report.coverage.boundsReached.join('; ')}`);
+    if (report.source.kind === 'qr' && !report.coverage.reviewedParts)
+        lines.push('No QR text was decoded. This does not establish that the image contains no QR symbol.');
+    lines.push('Exact paths, queries, fragments and surrounding message content are not included. Only deliberately selected phone substrings can be retained. Link relationships and authorisation parameters are supplied claims, not proof of a completed redirect or account compromise.');
+    return `${lines.join('\n')}\n`;
+}
+export async function runIntakeCommand(args, dependencies, context) {
+    context.setFailureLabel('Message intake');
+    if (MESSAGE_INTAKE_INPUTS[args.kind].binary && (!args.source || args.source === '-'))
+        throw new CliUsageError('Binary intake requires a selected file; binary stdin is not accepted.');
+    let bytes;
+    if (dependencies.readBinaryArtifactInput && args.source && args.source !== '-')
+        bytes = await dependencies.readBinaryArtifactInput(args.source);
+    else if (args.source && args.source !== '-')
+        bytes = await readBoundedRegularFile(args.source, { maximumBytes: MAX_MESSAGE_INTAKE_BYTES, minimumBytes: 1, label: 'Selected input', ...(dependencies.signal ? { signal: dependencies.signal } : {}) });
+    else
+        bytes = new TextEncoder().encode(await context.readInput(args.source, MAX_MESSAGE_INTAKE_BYTES, 'Selected input'));
+    try {
+        const result = await reviewSelectedInputInWorker(bytes, args.kind, context.now(), dependencies.signal);
+        let authenticationReview;
+        try {
+            authenticationReview = selectReceiverTrust(result.report.authenticationReview, args.trustedAuthHeaders ?? []);
+        }
+        catch (cause) {
+            if (cause instanceof TypeError)
+                throw new CliUsageError(cause.message);
+            throw cause;
+        }
+        let report = { ...result.report, authenticationReview, identityRecovery: reviewIdentityIncident({ reportedActions: args.reportedActions }) };
+        if (args.intakeContextSource) {
+            if (args.intakeContextSource === '-')
+                throw new CliUsageError('Distribution context requires a separate selected file, not stdin.');
+            report = applyIntakeContextInput({ ...result, report }, await context.readInput(args.intakeContextSource, MAX_INTAKE_CONTEXT_BYTES, 'Intake context'));
+        }
+        dependencies.signal?.throwIfAborted();
+        if (!args.quiet && result.phoneReview && (result.phoneReview.candidates.length || result.phoneReview.state === 'partial')) {
+            const phones = result.phoneReview;
+            context.writeStderr([
+                `Transient phone candidates: ${phones.candidates.length}; coverage ${phones.state}. Values are omitted until explicitly selected.`,
+                `Full source digest: ${phones.sourceDigestSha256}`,
+                ...phones.candidates.map(candidate => `${candidate.id}: UTF-16 span [${candidate.start}, ${candidate.end}) · ${candidate.state.replaceAll('_', ' ')}`),
+                'Review these spans in the original plaintext. Use --intake-context with version 2, review.sourceDigestSha256, and review.phones entries containing start, end and an explicit declaration. Offsets are zero-based UTF-16 code units, end exclusive; retain BOMs and supplementary characters when counting.',
+                'Only selected values enter the private report. Public/trusted Case summaries and STIX/MISP mappings omit phone values.',
+                '',
+            ].join('\n'));
+        }
+        if (!args.quiet)
+            context.writeStdout(args.output === 'json' ? formatJsonDocument(report) : context.terminal(formatMessageIntake(report), args.color));
+        return args.strictExit && (report.coverage.state === 'partial' || result.phoneReview?.state === 'partial') ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+    }
+    finally {
+        bytes.fill(0);
+    }
+}

package/cli/interchange-report.mjs

@@ -89,6 +89,7 @@ export async function buildInterchangeFidelityReport(raw, options = {}) {
             }),
             limitations: Object.freeze([
                 'The file did not match a registered interchange contract. Its supplied schema text and contents are not echoed.',
+                'This is an import/export compatibility catalogue, not the complete verifier inventory. verify-artifact may support this file independently.',
                 'This report makes no request and does not establish that evidence is accurate, current, complete, or safe to share.',
             ]),
         });
@@ -185,6 +186,7 @@ export async function buildInterchangeFidelityReport(raw, options = {}) {
             blockedSectionCount, prunedRecordCount,
         }),
         limitations: Object.freeze([
+            ...(contract.id === 'lookup_evidence' ? ['CLI read support means offline verification and packaging. brief, export, compare, registry-doctor and source-report require a saved CLI Lookup, not this browser evidence export.'] : []),
             'Compatibility describes declared field groups and supported operations, not byte-for-byte equality or evidence truth.',
             'The report emits only registered metadata, counts, and fixed field-group identifiers. Targets, notes, contacts, passphrases, and evidence values are not included.',
             'A verified integrity envelope detects file changes but does not establish author identity, source accuracy, currency, completeness, or sharing authority.',
@@ -195,7 +197,7 @@ export function formatInterchangeFidelityReport(report) {
     const browser = report.compatibility.browser;
     const cli = report.compatibility.cli;
     const nextAction = !report.recognised
-        ? 'Choose a supported WHOISleuth export and run verify-artifact before trying to import it.'
+        ? 'Run verify-artifact for independent verification support. Import/export compatibility is not registered here.'
         : !report.artifact.versionSupported
             ? 'Use a WHOISleuth release that supports this exact version, or re-export it with its last supported release.'
             : !report.verification.assuranceSatisfied
@@ -209,7 +211,7 @@ export function formatInterchangeFidelityReport(report) {
                             : 'Retain the verification result and use only the operations declared above.';
     return [
         'Interchange fidelity report',
-        `Recognised     ${report.recognised ? 'yes' : 'no'}`,
+        `Interchange contract ${report.recognised ? 'registered' : 'not registered'}`,
         `Artifact       ${report.artifact.id ?? 'unrecognised'}`,
         `Version        ${report.artifact.version ?? 'unavailable'}${report.artifact.versionSupported ? '' : ' (unsupported)'}`,
         `Verification   ${report.verification.state}`,

package/cli/investigation-artifacts.mjs

@@ -9,8 +9,8 @@ import { OFFLINE_ARTIFACT_VERIFICATION_SCHEMA, OFFLINE_ARTIFACT_VERIFICATION_VER
 import { validateLookupEvidenceArtifactStructure } from "./artifact-validation/lookup-evidence.mjs";
 import { CLI_DISCOVERY_SCAN_SCHEMA, CLI_DISCOVERY_SCAN_VERSION } from "./discovery-scan.mjs";
 import { CLI_DISCOVER_SCHEMA, CLI_DISCOVER_SCHEMA_VERSION, CLI_POSTURE_SCHEMA, CLI_POSTURE_SCHEMA_VERSION, CLI_CT_SEARCH_SCHEMA, CLI_CT_SEARCH_SCHEMA_VERSION, CLI_COMPARE_SCHEMA, CLI_COMPARE_SCHEMA_VERSION, } from "./formatters/json.mjs";
-import { CLI_LOOKUP_BRIEF_SCHEMA, CLI_LOOKUP_BRIEF_VERSION } from "./lookup-brief.mjs";
-import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, parseExternalFindingsDocument } from "../packages/interchange/external-findings-import.mjs";
+import { CLI_LOOKUP_BRIEF_SCHEMA, CLI_LOOKUP_BRIEF_VERSION } from "../packages/contracts/cli-lookup-brief.mjs";
+import { EXTERNAL_FINDINGS_SCHEMA, parseExternalFindingsDocument } from "../packages/interchange/external-findings-import.mjs";
 import { SOURCE_RELIABILITY_REPORT_SCHEMA, SOURCE_RELIABILITY_REPORT_VERSION } from "./source-reliability.mjs";
 import { CLI_CASE_PACK_SCHEMA, CLI_CASE_PACK_VERSION, verifyCliCasePack } from "./case-pack.mjs";
 import { SHARING_REVIEW_SCHEMA, SHARING_REVIEW_VERSION } from "./sharing-review.mjs";
@@ -59,8 +59,7 @@ export function validateWorkflowResult(step, result, retained) {
             break;
         case 'ct-intake':
             schema = EXTERNAL_FINDINGS_SCHEMA;
-            version = EXTERNAL_FINDINGS_VERSION;
-            parseExternalFindingsDocument(value);
+            version = parseExternalFindingsDocument(value).schemaVersion;
             break;
         case 'brief':
             schema = CLI_LOOKUP_BRIEF_SCHEMA;

package/cli/investigation-package-review.mjs

@@ -74,6 +74,7 @@ export async function verifyOfflineInvestigationPackage(input, passphrase) {
         }
         entries.push({ id: reviewed.entry.id, byteLength: reviewed.entry.byteLength,
             mediaType: 'mediaType' in reviewed.entry ? reviewed.entry.mediaType : 'application/json',
+            imageDerivation: 'imageDerivation' in reviewed.entry ? reviewed.entry.imageDerivation : null,
             state, identity: reviewed.state === 'identity_verified' ? 'verified' : 'failed', verification, issue });
     }
     const complete = entries.every((entry) => entry.state === 'admitted' || entry.state === 'opaque')
@@ -97,6 +98,7 @@ export async function verifyOfflineInvestigationPackage(input, passphrase) {
             'Capture attachment checks bind selected bytes to the capture manifest declaration, not to a trusted publisher or real website observation.',
             'Case-file checks match original references to other verified package bytes by length and digest, not by filename or claimed source. Missing originals make the package partial; no file is fetched or imported.',
             'Source declarations and packaging times are not authenticated. Signatures and timestamp tokens require their own verification and trust decisions.',
+            'Image derivation declares the immediate parent fingerprint and editing operations, not proof of transformation or complete redaction. Parent bytes are optional; missing declarations leave editing history unknown.',
             'This command does not import, overwrite or collect evidence. Unchanged bytes and valid source structure do not establish factual accuracy, currentness or safe sharing.',
         ]),
     });