@slicedearth/whoisleuth-cli 2.5.1 → 2.6.0

package/DISCLOSURE

@@ -1,4 +1,4 @@
-WHOISleuth is a defensive domain investigation and brand-protection tool. Its
+WHOISleuth is a defensive domain investigation and brand protection tool. Its
 command-line package can collect bounded WHOIS, RDAP, DNS, HTTP, TLS,
 certificate-transparency, website, and related infrastructure evidence. It can
 also generate and review lookalike-domain candidates, compare saved evidence,

package/cli/artifact-validation/case-response.mjs

@@ -1,6 +1,11 @@
 import { createHash } from 'node:crypto';
 import { readCaseEvidenceRequest, readCasePacketAmendment, assertEvidenceRequestEvent, assertEvidenceRequestHistory, assertPacketAmendmentSelection } from "../../packages/cases/case-requested-evidence.mjs";
+import { readCaseDeliveryPacketReceipt, readCasePacketCorrection, assertDeliveryPacketReceipt, correctionDelivery } from "../../packages/cases/case-packet-correction.mjs";
+import { CASE_SELECTED_EVIDENCE_SOURCE_LIMITATION } from "../../packages/cases/case-evidence-links.mjs";
+import { OBJECT_RESPONSE_CASE_PACKET_VERSION, OBJECT_RESPONSE_CASE_REVIEW_INPUTS_VERSION } from "../../packages/contracts/case-portability.mjs";
 import { canonicalArtifactJsonV2 } from "../../packages/evidence/artifact-integrity.mjs";
+import { EVIDENCE_FOLLOW_UP_CASE_RESPONSE_PACKET_VERSION, EVIDENCE_FOLLOW_UP_CASE_RESPONSE_REVIEW_INPUTS_VERSION } from "../../packages/contracts/case-portability.mjs";
+import { readCaseResponseObject, readCaseResponseObjects, readCaseResponseObjectOutcome, assertCaseObjectOutcome } from "../../packages/cases/case-response-object.mjs";
 import { CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_2_CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_3_CASE_RESPONSE_PACKET_VERSION, PUBLIC_CASE_RESPONSE_PACKET_VERSION, PUBLISHED_V2_CASE_RESPONSE_PACKET_VERSION, CASE_RESPONSE_REVIEW_INPUTS_SCHEMA, CASE_RESPONSE_REVIEW_INPUTS_VERSION, LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION, LATEST_PUBLIC_CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_2_CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_3_CASE_RESPONSE_REVIEW_INPUTS_VERSION, PUBLISHED_V2_CASE_RESPONSE_REVIEW_INPUTS_VERSION, MAX_ABUSIVE_URLS, MAX_RESPONSE_ARTEFACT_REFERENCES, MAX_RESPONSE_AUTHORISATION_CLOCK_SKEW_MS, MAX_RESPONSE_ACTION_HISTORY, MAX_RESPONSE_CONTACTS, MAX_RESPONSE_CONTRADICTIONS, MAX_RESPONSE_SELECTED_EVIDENCE, RESPONSE_AUTHORISATION_CONFIRMATION_IDS, RESPONSE_PACKET_PROFILES, RESPONSE_CONTACT_KINDS, RESPONSE_PACKET_PROFILE_IDS, RESPONSE_READINESS_ROW_IDS, RESPONSE_READINESS_STATES, RESPONSE_ROUTE_STALE_AFTER_DAYS, } from "../../packages/cases/case-response-packet.mjs";
 import { CASE_ACTION_EVENT_SOURCE_CLASSES, CASE_ACTION_STATES, CASE_ACTION_TYPES, CASE_CLOSURE_REASONS, CASE_OBSERVED_EFFECT_SOURCE_CLASSES, CASE_OBSERVED_EFFECT_STATES, CASE_PROVIDER_OUTCOMES, isLegalCaseActionTransition, MAX_CASE_ACTION_EVENTS_PER_ACTION, MAX_CASE_ACTIONS, MAX_CASE_ASSERTIONS, MAX_CASE_DECISIONS, MAX_CASE_EVIDENCE_PINS, MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_LIMITATION_LENGTH, MAX_RESPONSE_LIMITATIONS, MAX_RESPONSE_RECIPIENT_LENGTH, } from "../../packages/cases/case-response-model.mjs";
 import { HEX_DIGEST_RE, array, boolean, domain, enumeration, exact, exactOptional, fail, integer, iso, optionalText, sameValues, strings, text, } from "./structure-primitives.mjs";
@@ -282,7 +287,8 @@ function validateVersionedCaseResponsePacket(value, version) {
         fail('Case-response abusive URLs');
     text(incident.observedHarm, 'Case-response observed harm', 2_000);
     iso(incident.observedAt, 'Case-response observedAt');
-    if (profile.subject !== `${selectedProfile?.subjectPrefix}: ${caseRecord.domain} (${incident.category})`)
+    if (profile.subject !== `${selectedProfile?.subjectPrefix}: ${caseRecord.domain} (${incident.category})`
+        && (version < 13 || profile.subject !== `Correction or retraction request: ${caseRecord.domain} (${incident.category})`))
         fail('Case-response profile subject');
     const contacts = array(root.contacts, 'Case-response contacts', MAX_RESPONSE_CONTACTS);
     const contactKeys = new Set();
@@ -379,7 +385,10 @@ function validateVersionedCaseResponsePacket(value, version) {
     const evidence = array(root.selectedEvidence, 'Case-response selected evidence', MAX_RESPONSE_SELECTED_EVIDENCE);
     const evidenceIds = new Set();
     for (const candidate of evidence) {
-        const item = exactOptional(candidate, ['id', 'label', 'source', 'observedAt', 'completeness', 'limitations'], version > PUBLISHED_V2_3_CASE_RESPONSE_PACKET_VERSION ? ['observationHostname'] : [], 'Case-response selected evidence');
+        const item = exactOptional(candidate, ['id', 'label', 'source', 'observedAt', 'completeness', 'limitations'], [...(version > PUBLISHED_V2_3_CASE_RESPONSE_PACKET_VERSION ? ['observationHostname', 'webObservationMode'] : []), ...(version >= 12 ? ['responseObject'] : [])], 'Case-response selected evidence');
+        readCaseResponseObject(item.responseObject);
+        if (item.webObservationMode !== undefined && item.webObservationMode !== 'selected_url')
+            fail('Case-response web observation mode');
         const id = text(item.id, 'Case-response evidence id', 64);
         if (evidenceIds.has(id))
             fail('Case-response selected evidence');
@@ -550,8 +559,11 @@ function validateVersionedCaseResponsePacket(value, version) {
             'historyLimitations', 'transitions', 'createdAt', 'updatedAt',
             ...(hasActionBinding ? ['routeObservedAt'] : []),
             ...(hasPlatformRoutes ? ['routeReviewAfter'] : []),
-        ], Number(root.schemaVersion) >= 11 ? ['amendment'] : [], 'Case-response escalation action');
+        ], [...(Number(root.schemaVersion) >= 11 ? ['amendment'] : []), ...(version >= 12 ? ['responseObjects'] : []), ...(version >= 13 ? ['correction'] : [])], 'Case-response escalation action');
+        readCaseResponseObjects(action.responseObjects);
         readCasePacketAmendment(action.amendment);
+        if (readCasePacketCorrection(action.correction) && action.amendment)
+            throw new TypeError('Correction and provider amendment must remain separate.');
         const actionId = text(action.actionId, 'Case-response action id', 64);
         if (actionIds.has(actionId))
             fail('Case-response action identity');
@@ -583,7 +595,19 @@ function validateVersionedCaseResponsePacket(value, version) {
         let previousTime = Number.NEGATIVE_INFINITY;
         let previousEventId = '';
         for (const eventCandidate of transitions) {
-            const event = exactOptional(eventCandidate, ['id', 'previousState', 'nextState', 'occurredAt', 'sourceClass', 'provenance', 'reference', 'evidencePinId', 'limitations', 'providerOutcome', 'outcomeDetail', 'originActionId', 'applied'], Number(root.schemaVersion) >= 11 ? ['evidenceRequest'] : [], 'Case-response action transition');
+            const event = exactOptional(eventCandidate, ['id', 'previousState', 'nextState', 'occurredAt', 'sourceClass', 'provenance', 'reference', 'evidencePinId', 'limitations', 'providerOutcome', 'outcomeDetail', 'originActionId', 'applied'], [...(Number(root.schemaVersion) >= 11 ? ['evidenceRequest'] : []), ...(version >= 12 ? ['responseObjects', 'objectOutcome'] : []), ...(version >= 13 ? ['packetReceipt'] : [])], 'Case-response action transition');
+            const receipt = readCaseDeliveryPacketReceipt(event.packetReceipt);
+            assertDeliveryPacketReceipt(receipt, event, actionId);
+            if (receipt && (receipt.caseId !== caseRecord.id || receipt.target !== caseRecord.domain || receipt.recipient !== action.recipient))
+                fail('Case-response receipt Case, target or recipient');
+            const responseObjects = readCaseResponseObjects(event.responseObjects);
+            const objectOutcome = readCaseResponseObjectOutcome(event.objectOutcome);
+            if (objectOutcome) {
+                if (!responseObjects?.length || !['submitted', 'acknowledged', 'terminal'].includes(String(event.nextState))
+                    || !['analyst', 'provider'].includes(String(event.sourceClass)) || event.previousState === 'authorised')
+                    fail('Case-response object outcome scope');
+                responseObjects.forEach(object => assertCaseObjectOutcome(objectOutcome, object));
+            }
             const evidenceRequest = readCaseEvidenceRequest(event.evidenceRequest);
             assertEvidenceRequestEvent(evidenceRequest, event);
             const eventId = text(event.id, 'Case-response action event id', 64);
@@ -679,6 +703,15 @@ function validateVersionedCaseResponsePacket(value, version) {
             const action = candidate;
             return { id: action.actionId, history: action.transitions, originActionId: action.originActionId, amendment: action.amendment };
         }), selectedActionId, evidenceIds);
+    if (version >= 13) {
+        const actions = history.map(candidate => { const action = candidate; return { ...action, id: action.actionId, history: action.transitions }; });
+        const selected = actions.find(action => action.id === selectedActionId);
+        if (selected?.correction)
+            correctionDelivery(actions, selected, { caseId: caseRecord.id, target: caseRecord.domain, profile: profile.id, selectedPinIds: evidenceIds });
+        const expectedPrefix = selected?.correction ? 'Correction or retraction request' : selectedProfile?.subjectPrefix;
+        if (profile.subject !== `${expectedPrefix}: ${caseRecord.domain} (${incident.category})`)
+            fail('Case-response correction subject');
+    }
     const lifecycle = exact(root.responseLifecycle, ['providerOutcomeState', 'latestProviderOutcome', 'observedChangeState', 'latestObservedEffect', 'latestObservedChangeAt', 'closure', 'limitations'], 'Case-response lifecycle');
     const providerOutcomeState = enumeration(lifecycle.providerOutcomeState, ['available', 'missing', 'ambiguous'], 'Case-response lifecycle provider state');
     let actualLatestProvider = null;
@@ -721,7 +754,10 @@ function validateVersionedCaseResponsePacket(value, version) {
         fail('Case-response lifecycle provider state');
     const observedChangeState = enumeration(lifecycle.observedChangeState, ['available', 'missing', 'ambiguous'], 'Case-response lifecycle observed-change state');
     if (lifecycle.latestObservedEffect !== null) {
-        const effect = exact(lifecycle.latestObservedEffect, ['reviewId', 'state', 'observedAt', 'sourceClass', 'source'], 'Case-response lifecycle observed effect');
+        const effect = exactOptional(lifecycle.latestObservedEffect, ['reviewId', 'state', 'observedAt', 'sourceClass', 'source'], version >= 12 ? ['responseObject', 'objectOutcome'] : [], 'Case-response lifecycle observed effect');
+        const responseObject = readCaseResponseObject(effect.responseObject);
+        const objectOutcome = readCaseResponseObjectOutcome(effect.objectOutcome);
+        assertCaseObjectOutcome(objectOutcome, responseObject);
         text(effect.reviewId, 'Case-response effect review id', 64);
         enumeration(effect.state, CASE_OBSERVED_EFFECT_STATES, 'Case-response effect state');
         iso(effect.observedAt, 'Case-response effect observedAt');
@@ -743,9 +779,11 @@ function validateVersionedCaseResponsePacket(value, version) {
         contract: CASE_RESPONSE_REVIEW_INPUTS_SCHEMA,
         version: version === CASE_RESPONSE_PACKET_VERSION
             ? CASE_RESPONSE_REVIEW_INPUTS_VERSION
-            : version === LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION ? LATEST_PUBLIC_CASE_RESPONSE_REVIEW_INPUTS_VERSION
-                : hasPlatformRoutes ? PUBLISHED_V2_3_CASE_RESPONSE_REVIEW_INPUTS_VERSION
-                    : hasActionBinding ? PUBLISHED_V2_2_CASE_RESPONSE_REVIEW_INPUTS_VERSION : PUBLISHED_V2_CASE_RESPONSE_REVIEW_INPUTS_VERSION,
+            : version === OBJECT_RESPONSE_CASE_PACKET_VERSION ? OBJECT_RESPONSE_CASE_REVIEW_INPUTS_VERSION
+                : version === EVIDENCE_FOLLOW_UP_CASE_RESPONSE_PACKET_VERSION ? EVIDENCE_FOLLOW_UP_CASE_RESPONSE_REVIEW_INPUTS_VERSION
+                    : version === LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION ? LATEST_PUBLIC_CASE_RESPONSE_REVIEW_INPUTS_VERSION
+                        : hasPlatformRoutes ? PUBLISHED_V2_3_CASE_RESPONSE_REVIEW_INPUTS_VERSION
+                            : hasActionBinding ? PUBLISHED_V2_2_CASE_RESPONSE_REVIEW_INPUTS_VERSION : PUBLISHED_V2_CASE_RESPONSE_REVIEW_INPUTS_VERSION,
         profile: {
             id: profile.id,
             label: profile.label,
@@ -768,6 +806,7 @@ function validateVersionedCaseResponsePacket(value, version) {
         escalationHistoryOmitted: root.escalationHistoryOmitted,
         escalationHistoryLimitations: root.escalationHistoryLimitations,
         responseLifecycle: root.responseLifecycle,
+        ...(version >= 13 ? { sourceQualifications: strings(root.provenance.limitations, 'Case-response limitations', 8, 600).filter(value => value === CASE_SELECTED_EVIDENCE_SOURCE_LIMITATION) } : {}),
     };
     const expectedReviewDigest = createHash('sha256')
         .update(canonicalArtifactJsonV2(reviewedInputs))
@@ -794,6 +833,10 @@ function validateVersionedCaseResponsePacket(value, version) {
         fail('Case-response integrity');
 }
 export function validateCaseResponsePacket(value) {
+    if (value.schemaVersion === OBJECT_RESPONSE_CASE_PACKET_VERSION)
+        return validateVersionedCaseResponsePacket(value, OBJECT_RESPONSE_CASE_PACKET_VERSION);
+    if (value.schemaVersion === EVIDENCE_FOLLOW_UP_CASE_RESPONSE_PACKET_VERSION)
+        return validateVersionedCaseResponsePacket(value, EVIDENCE_FOLLOW_UP_CASE_RESPONSE_PACKET_VERSION);
     if (value.schemaVersion === LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION)
         return validateVersionedCaseResponsePacket(value, LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION);
     if (value.schemaVersion === PUBLIC_CASE_RESPONSE_PACKET_VERSION)

package/cli/artifact-validation/lookup-evidence.mjs

@@ -1,6 +1,8 @@
 import { isDeepStrictEqual } from 'node:util';
 import { assertLookupEvidencePrivacySafeTree, assertLookupEvidencePortableTree, LOOKUP_EVIDENCE_SCHEMA, LOOKUP_EVIDENCE_SCHEMA_VERSION, HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION, PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION, REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION, V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION, projectLookupEvidenceAvailability, projectLookupEvidenceAvailabilityPublic, projectLookupEvidenceQuery, projectLookupEvidenceRdapPublication, projectLookupEvidenceRegistryInsights, projectLookupEvidenceWhoisPublication, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, } from "../../lib/evidence-export.mjs";
 import { validLookupObservationScope } from "../../packages/evidence/lookup-target.mjs";
+import { externalPasswordFormObservation } from "../../packages/evidence/credential-form-attribution.mjs";
+import { credentialSurfaceContractState } from "../../lib/lookup-child-profile-contract.mjs";
 import { registrarStandingObservedBy, resolveRegistrarIanaId, validRegistrarStanding, } from "../../lib/registrar-standing-contract.mjs";
 import { compareRegistrySources } from "../../lib/registry-comparison.mjs";
 import { buildRegistryInsights } from "../../lib/registry-insights.mjs";
@@ -24,7 +26,7 @@ const PUBLIC_LOOKUP_AVAILABILITY_ANALYSIS_KEYS = [
     'expiresInDays', 'privacyProtected', 'dnssec', 'activityStatus',
     'websiteProbeStatus', 'websiteProbeDetail', 'http', 'deepScanComplete',
     'faviconHash', 'faviconPHash', 'pageTitle', 'hasPasswordField',
-    'phishingLanguageMatch', 'hasExternalFormAction', 'externalAssetHosts',
+    'phishingLanguageMatch', 'hasExternalFormAction', 'hasExternalPasswordForm', 'externalAssetHosts',
     'pageIdentity', 'credentialSurfaceProfile', 'structuredDataIdentity',
     'technologyProfile', 'pageRoleProfile', 'clientBehaviorProfile',
     'securityPosture', 'dns', 'tls', 'hasMx', 'hasNullMx', 'mxHosts', 'hasSpf',
@@ -42,6 +44,18 @@ const LOOKUP_REGISTRAR_COMPARISON_STATUSES = [
     'registrar_unavailable', 'registry_incomplete', 'registrar_incomplete',
 ];
 function validateLookupEvidenceHomepageMetadata(availability, version) {
+    const credentialProfile = availability.credentialSurfaceProfile === null || availability.credentialSurfaceProfile === undefined
+        ? null : record(availability.credentialSurfaceProfile, 'Lookup evidence credential profile');
+    if (version < 30 && (Object.hasOwn(availability, 'hasExternalPasswordForm') || credentialProfile?.credentialSurfaceVersion === 2)) {
+        fail('Lookup evidence form-attribution epoch');
+    }
+    if (Object.hasOwn(availability, 'hasExternalPasswordForm') && availability.hasExternalPasswordForm !== null)
+        boolean(availability.hasExternalPasswordForm, 'Lookup evidence password-form destination');
+    if (credentialProfile?.credentialSurfaceVersion === 2 && credentialSurfaceContractState(credentialProfile) !== 'supported')
+        fail('Lookup evidence form-attribution profile');
+    if (credentialProfile?.credentialSurfaceVersion === 2 && availability.hasExternalPasswordForm !== undefined
+        && availability.hasExternalPasswordForm !== externalPasswordFormObservation(credentialProfile.formAttribution))
+        fail('Lookup evidence form-attribution consistency');
     const pageIdentity = availability.pageIdentity === null || availability.pageIdentity === undefined
         ? null
         : record(availability.pageIdentity, 'Lookup evidence page identity');

package/cli/artifact-validation/signed-review.mjs

@@ -1,4 +1,4 @@
-import { ACQUISITION_DECISIONS, ACQUISITION_MANUAL_CHECKS, ACQUISITION_DECISION_PACKET_SCHEMA, ACQUISITION_DECISION_PACKET_VERSION, } from "../../packages/investigation/acquisition-decision-packet.mjs";
+import { ACQUISITION_DECISION_PACKET_SCHEMA, validateAcquisitionDecisionPacketStructure, } from "../../packages/investigation/acquisition-decision-packet.mjs";
 import { BULK_DOMAIN_COMPARISON_EXPORT_VERSION, BULK_DOMAIN_COMPARISON_SCHEMA, } from "../../packages/investigation/bulk-domain-comparison.mjs";
 import { BULK_MAIL_EXPOSURE_EXPORT_VERSION, BULK_MAIL_EXPOSURE_SCHEMA, MAX_BULK_MAIL_EXPOSURE_ROWS, } from "../../packages/investigation/bulk-mail-exposure.mjs";
 import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS, } from "../../packages/contracts/investigation-portability.mjs";
@@ -26,55 +26,6 @@ const DOMAIN_COMPARISON_ROW_IDS = [
 ];
 const MAIL_STATES = ['authenticated_mail', 'evidence_incomplete', 'mail_auth_gap', 'mail_auth_incomplete', 'no_explicit_mx', 'null_mx'];
 const DNS_TYPES = ['A', 'AAAA', 'CAA', 'CDNSKEY', 'CDS', 'CNAME', 'CSYNC', 'HTTPS', 'MX', 'NS', 'SRV', 'SVCB', 'TLSA', 'TXT'];
-function validateAcquisitionItem(value, label) {
-    const item = exact(value, ['id', 'label', 'state', 'detail', 'provenance'], label);
-    const id = enumeration(item.id, ['availability', 'contacts', 'lifecycle', 'mail', 'nameservers', 'operations', 'policy_eligibility', 'policy_lifecycle', 'policy_transfer', 'tls', 'transfer', 'web'], label);
-    enumeration(item.state, ['authoritative', 'observed', 'review', 'unavailable'], label);
-    text(item.label, label, 200);
-    text(item.detail, label, 2_000);
-    text(item.provenance, label, 300);
-    return id;
-}
-function validateAcquisition(value) {
-    const root = exact(value, ['schema', 'version', 'generatedAt', 'target', 'synthetic', 'evidenceObservedAt', 'analystReview', 'evidenceReview', 'limitations', 'integrity'], 'Acquisition decision packet');
-    iso(root.generatedAt, 'Acquisition decision packet generatedAt');
-    domain(root.target, 'Acquisition decision packet target');
-    boolean(root.synthetic, 'Acquisition decision packet synthetic');
-    iso(root.evidenceObservedAt, 'Acquisition decision packet evidenceObservedAt', true);
-    const review = exact(root.analystReview, ['decision', 'rationale', 'reviewedChecks', 'outstandingChecks', 'state'], 'Acquisition analyst review');
-    const decision = enumeration(review.decision, ACQUISITION_DECISIONS, 'Acquisition analyst review decision');
-    text(review.rationale, 'Acquisition analyst review rationale', 2_000, true);
-    const reviewed = strings(review.reviewedChecks, 'Acquisition reviewed checks', ACQUISITION_MANUAL_CHECKS.length, 40);
-    const outstanding = strings(review.outstandingChecks, 'Acquisition outstanding checks', ACQUISITION_MANUAL_CHECKS.length, 40);
-    const expectedReviewed = ACQUISITION_MANUAL_CHECKS.filter((item) => reviewed.includes(item));
-    const expectedOutstanding = ACQUISITION_MANUAL_CHECKS.filter((item) => !reviewed.includes(item));
-    if (!sameValues(reviewed, expectedReviewed) || !sameValues(outstanding, expectedOutstanding))
-        fail('Acquisition analyst review checks');
-    const expectedState = decision === 'unresolved' || reviewed.length < ACQUISITION_MANUAL_CHECKS.length ? 'draft' : 'reviewed';
-    if (review.state !== expectedState)
-        fail('Acquisition analyst review state');
-    const evidence = exact(root.evidenceReview, ['version', 'label', 'state', 'items', 'transitionDependencies', 'policyChecks', 'nextSteps', 'limitations'], 'Acquisition evidence review');
-    if (evidence.version !== 2)
-        fail('Acquisition evidence review');
-    text(evidence.label, 'Acquisition evidence review label', 200);
-    enumeration(evidence.state, ['incomplete', 'registered', 'review_transition', 'sale_signal', 'unregistered_observation'], 'Acquisition evidence review state');
-    const expectedEvidenceIds = {
-        items: ['availability', 'lifecycle', 'transfer', 'operations', 'contacts'],
-        transitionDependencies: ['nameservers', 'web', 'mail', 'tls'],
-        policyChecks: ['policy_eligibility', 'policy_lifecycle', 'policy_transfer'],
-    };
-    for (const key of ['items', 'transitionDependencies', 'policyChecks']) {
-        const expected = expectedEvidenceIds[key];
-        const values = array(evidence[key], `Acquisition evidence review ${key}`, expected.length, expected.length);
-        const ids = values.map((item, index) => validateAcquisitionItem(item, `Acquisition evidence review ${key}[${index}]`));
-        if (!sameValues(ids, expected))
-            fail(`Acquisition evidence review ${key}`);
-    }
-    strings(evidence.nextSteps, 'Acquisition next steps', 6, 600);
-    strings(evidence.limitations, 'Acquisition evidence limitations', 12, 600);
-    strings(root.limitations, 'Acquisition limitations', 8, 600);
-    validateIntegrity(root.integrity, 'Acquisition integrity', root.version, ACQUISITION_DECISION_PACKET_VERSION);
-}
 function validateClaimPassportTarget(type, value) {
     const candidate = text(value, 'Claim passport target', 253);
     if (type === 'domain') {
@@ -656,7 +607,7 @@ export function validateSignedDigestArtifactStructure(schema, value) {
     if (value.schema !== schema)
         fail('Signed review artefact');
     if (schema === ACQUISITION_DECISION_PACKET_SCHEMA)
-        validateAcquisition(value);
+        validateAcquisitionDecisionPacketStructure(value);
     else if (schema === MANAGED_INDICATOR_SET_SCHEMA)
         validateManagedIndicatorSet(value);
     else if (schema === LOOKUP_CLAIM_PASSPORT_SCHEMA)

package/cli/artifact-verify.mjs

@@ -19,7 +19,7 @@ import { INVESTIGATION_MANIFEST_SCHEMA, SUPPORTED_INVESTIGATION_MANIFEST_VERSION
 import { verifyCliCasePack } from "./case-pack.mjs";
 import { LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES, LOOKUP_EVIDENCE_SCHEMA, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, } from "../lib/evidence-export.mjs";
 export const OFFLINE_ARTIFACT_VERIFICATION_SCHEMA = 'whoisleuth.offline-artifact-verification';
-export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 4;
+export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 5;
 export const MAX_OFFLINE_ARTIFACT_BYTES = Math.max(MAX_DOMAIN_CONTROL_MANIFEST_BYTES, MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES);
 export const MAX_OFFLINE_PASSPHRASE_FILE_BYTES = 1024;
 export class UnsupportedOfflineArtifactError extends TypeError {
@@ -590,8 +590,15 @@ export function formatOfflineArtifactVerification(report) {
     }
     if (report.package) {
         lines.push(`Package bytes: ${report.package.digestSha256}`, 'Storage: unchanged; inspection only', 'Audience: private; review selected file contents before sharing', 'Signature trust: not checked', 'Trusted timestamp: not checked', 'Factual accuracy: not established');
-        for (const entry of report.package.entries)
+        for (const entry of report.package.entries) {
             lines.push(`${entry.id}: ${entry.state} · ${entry.byteLength} bytes · ${entry.mediaType}${entry.issue ? ` · ${entry.issue}` : ''}`);
+            if (entry.imageDerivation) {
+                const declaration = entry.imageDerivation;
+                lines.push(`  Declared image derivation: ${declaration.method}; ${declaration.operations.join(', ')}`, `  Parent: ${declaration.source.digestSha256} · ${declaration.source.byteLength} bytes`);
+            }
+            else if (entry.mediaType.startsWith('image/'))
+                lines.push('  Editing history: not declared');
+        }
         for (const link of report.package.links)
             lines.push(`Source link ${link.capsuleEntryId}: ${link.state}${link.sourceEntryId ? ` (${link.sourceEntryId})` : ''}`);
         for (const capture of report.package.captureManifests) {

package/cli/bulk-command-runner.mjs

@@ -93,6 +93,10 @@ async function runBulkCommand(args, dependencies, context) {
         }
         catch (error) {
             checkpointFailure = error;
+            eventProgress.emit({ event: 'warning', state: 'checkpoint_unavailable' });
+            if (!eventProgress.enabled) {
+                context.writeStderr(`Checkpoint warning: ${boundedCliErrorMessage(error, 'Checkpoint could not be written')}. The latest progress may not be saved.\n`);
+            }
         }
     }
     const metadata = {
@@ -122,12 +126,6 @@ async function runBulkCommand(args, dependencies, context) {
         else
             context.writeStdout(context.terminal(formatTerminalBulk(selectedItems, metadata), args.color));
     }
-    if (checkpointFailure) {
-        eventProgress.emit({ event: 'warning', state: 'checkpoint_unavailable' });
-        if (!eventProgress.enabled) {
-            context.writeStderr(`Checkpoint warning: ${boundedCliErrorMessage(checkpointFailure, 'Checkpoint could not be written')}. Completed output is still available.\n`);
-        }
-    }
     const policyFindings = evaluateCliFailPolicies(buildCliBulkDocument(items, { ...metadata, filter: 'all' }), args.failOn || []);
     if (policyFindings.length && !eventProgress.enabled)
         context.writeStderr(formatFailPolicyNotice(policyFindings));

package/cli/case-command.mjs

@@ -8,6 +8,7 @@ import { createCaseIncident, openOrCreateCase, recordCaseConclusion, recordCaseR
 import { buildCaseExport, serializeCaseStore } from "../packages/cases/case-storage-model.mjs";
 import { appendCaseEvidencePin } from "../packages/cases/case-response-model.mjs";
 import { readCaseRecheckAnswerContext } from "../packages/cases/case-recheck-model.mjs";
+import { readCaseResponseObjects } from "../packages/cases/case-response-object.mjs";
 import { caseEvidenceLinkIssues, mergeCaseEvidenceLinks } from "../packages/cases/case-evidence-links.mjs";
 import { dispositionLabel, statusLabel } from "../packages/cases/case-record-decisions.mjs";
 import { normalizeDomain } from "../packages/cases/case-record-core.mjs";
@@ -59,7 +60,7 @@ function retainExistingEntries(before, after) {
     }
     const pairs = [
         [before.notes, after.notes], [before.evidenceHistory, after.evidenceHistory], [before.evidencePins, after.evidencePins],
-        [before.decisions, after.decisions], [before.actions, after.actions], [before.assertions, after.assertions],
+        [before.decisions, after.decisions], [before.assertions, after.assertions],
         [before.manualTrail, after.manualTrail], [before.sightings, after.sightings],
         [before.observedEffects.reviews, after.observedEffects.reviews], [before.closures.records, after.closures.records],
         [before.branches ?? [], after.branches ?? []], [before.attachments ?? [], after.attachments ?? []],
@@ -70,6 +71,13 @@ function retainExistingEntries(before, after) {
             throw new CliUsageError('The operation would remove or alter earlier retained evidence. Export a smaller working set or review it in the console; nothing was written.');
         }
     }
+    for (const action of before.actions) {
+        const next = after.actions.find(candidate => candidate.id === action.id);
+        const events = new Set(next?.history.map(event => canonicalArtifactJsonV2(event)) ?? []);
+        if (!next || action.history.some(event => !events.has(canonicalArtifactJsonV2(event)))) {
+            throw new CliUsageError('The operation would alter retained response events. Nothing was written.');
+        }
+    }
 }
 export function applyCliCaseOperation(cases, args, input, note, now) {
     if (args.operation === 'open') {
@@ -92,6 +100,67 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
     else if (args.operation === 'link' || args.operation === 'withdraw-link') {
         result = updateCase(cases, current.id, args.operation === 'link' ? { evidenceLink: input } : { evidenceLinkWithdrawal: input }, now);
     }
+    else if (args.operation === 'incident-link') {
+        if (!input)
+            throw new CliUsageError('An incident link requires JSON input.');
+        fields(input, ['url'], 'Incident link');
+        result = updateCase(cases, current.id, { incidentTarget: input.url }, now);
+    }
+    else if (args.operation === 'action') {
+        if (!input)
+            throw new CliUsageError('A response action requires JSON input.');
+        fields(input, ['type', 'recipient', 'contactSource', 'routeObservedAt', 'routeReviewAfter', 'contactLimitations', 'dueAt', 'followUpAt', 'responseObjects', 'originActionId', 'amendment', 'correction'], 'Response action');
+        result = updateCase(cases, current.id, { action: input }, now);
+        const action = result.record.actions.find(candidate => !current.actions.some(prior => prior.id === candidate.id));
+        if (!action)
+            throw new CliUsageError('No new action was retained within the Case bounds; nothing was written.');
+        for (const [key, value] of Object.entries(input))
+            if (canonicalArtifactJsonV2(key === 'responseObjects' ? readCaseResponseObjects(value) : value) !== canonicalArtifactJsonV2(action[key])) {
+                throw new CliUsageError(`Action field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
+            }
+    }
+    else if (args.operation === 'action-event') {
+        if (!input || !input.transition || typeof input.transition !== 'object' || Array.isArray(input.transition))
+            throw new CliUsageError('An action event requires id and transition JSON.');
+        fields(input, ['id', 'transition'], 'Response action event');
+        const transition = input.transition;
+        fields(transition, ['nextState', 'occurredAt', 'sourceClass', 'provenance', 'reference', 'evidencePinId', 'limitations', 'providerOutcome', 'outcomeDetail', 'responseObjects', 'objectOutcome', 'evidenceRequest', 'packetReceipt'], 'Response transition');
+        result = updateCase(cases, current.id, { actionUpdate: input }, now);
+        const previous = current.actions.find(action => action.id === input.id);
+        const event = result.record.actions.find(action => action.id === input.id)?.history.find(candidate => !previous?.history.some(prior => prior.id === candidate.id));
+        if (!event)
+            throw new CliUsageError('The selected action is not retained. Nothing was written.');
+        for (const [key, value] of Object.entries(transition))
+            if (canonicalArtifactJsonV2(key === 'responseObjects' ? readCaseResponseObjects(value) : value) !== canonicalArtifactJsonV2(event[key])) {
+                throw new CliUsageError(`Transition field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
+            }
+    }
+    else if (args.operation === 'recheck-question') {
+        if (!input)
+            throw new CliUsageError('A recheck question requires JSON input.');
+        fields(input, ['statement', 'rationale', 'recheck', 'evidencePinIds'], 'Recheck question');
+        result = updateCase(cases, current.id, { assertion: { ...input, kind: 'next_step' } }, now);
+        const question = result.record.assertions.find(candidate => !current.assertions.some(prior => prior.id === candidate.id));
+        if (!question)
+            throw new CliUsageError('No new question was retained within the Case bounds; nothing was written.');
+        for (const [key, value] of Object.entries(input))
+            if (canonicalArtifactJsonV2(value) !== canonicalArtifactJsonV2(question[key])) {
+                throw new CliUsageError(`Question field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
+            }
+    }
+    else if (args.operation === 'close-object') {
+        if (!input?.responseObject)
+            throw new CliUsageError('Object closure requires one explicit responseObject; it cannot close the whole Case.');
+        fields(input, ['responseObject', 'reason', 'summary', 'observedEffectReviewId', 'actionId', 'limitations'], 'Object closure');
+        result = updateCase(cases, current.id, { closure: input }, now);
+        const closure = result.record.closures.records.find(candidate => !current.closures.records.some(prior => prior.id === candidate.id));
+        if (!closure)
+            throw new CliUsageError('No new closure was retained within the Case bounds; nothing was written.');
+        for (const [key, value] of Object.entries(input))
+            if (canonicalArtifactJsonV2(value) !== canonicalArtifactJsonV2(closure[key])) {
+                throw new CliUsageError(`Closure field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
+            }
+    }
     else if (args.operation === 'assess') {
         if (!input)
             throw new CliUsageError('An assessment requires JSON input.');
@@ -119,7 +188,7 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
     else if (args.operation === 'recheck') {
         if (!input)
             throw new CliUsageError('A recheck requires JSON input.');
-        fields(input, ['state', 'observedAt', 'completeness', 'comparisonSummary', 'source', 'followUpAt', 'limitations', 'collectionDepth', 'recheck', 'observationHostname'], 'Recheck');
+        fields(input, ['state', 'observedAt', 'completeness', 'comparisonSummary', 'source', 'followUpAt', 'limitations', 'collectionDepth', 'recheck', 'observationHostname', 'responseObject', 'objectOutcome'], 'Recheck');
         const recheck = readCaseRecheckAnswerContext(input.recheck);
         if (input.state === 'not_reproduced' && !recheck) {
             throw new CliUsageError('Not reproduced requires a saved recheck question and confirmed comparable conditions. Import the planned Case or record unavailable for a limited observation.');
@@ -135,6 +204,8 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
             comparisonSummary: comparison.value, source: review.source, followUpAt: review.followUpAt,
             limitations: review.limitations, collectionDepth: comparison.collectionDepth,
             ...(review.recheck ? { recheck: review.recheck } : {}),
+            ...(review.responseObject ? { responseObject: review.responseObject } : {}),
+            ...(review.objectOutcome ? { objectOutcome: review.objectOutcome } : {}),
             ...(comparison.observationHostname ? { observationHostname: comparison.observationHostname } : {}),
         };
         for (const [key, value] of Object.entries(input)) {
@@ -166,8 +237,13 @@ function formatCases(cases, digest) {
             if (cyclic)
                 lines.push('  Conflicting imported derivation cycle; no order is inferred.');
         }
+        for (const action of record.actions) {
+            lines.push(`Action ${safeTerminalValue(action.id)} · ${action.type} · ${action.state}`, `  Objects: ${action.responseObjects?.map(object => `${object.kind}: ${safeTerminalValue(object.identifier)}`).join('; ') || 'unknown binding'}`);
+            for (const event of action.history)
+                lines.push(`  Event ${event.occurredAt} · ${event.sourceClass} · ${event.nextState}${event.objectOutcome ? ` · reported ${event.objectOutcome}` : ''}`, `    Scope: ${event.responseObjects?.map(object => `${object.kind}: ${safeTerminalValue(object.identifier)}`).join('; ') || 'unknown binding'}`);
+        }
         for (const review of record.observedEffects.reviews)
-            lines.push(`Recheck ${safeTerminalValue(review.observedAt, 'time unavailable')} · ${review.state} · ${review.completeness} · ${safeTerminalValue(review.source)}`);
+            lines.push(`Recheck ${safeTerminalValue(review.observedAt, 'time unavailable')} · ${review.state} · ${review.completeness} · ${safeTerminalValue(review.source)}`, `  Object: ${review.responseObject ? `${review.responseObject.kind}: ${safeTerminalValue(review.responseObject.identifier)}` : 'unknown binding'}${review.objectOutcome ? ` · observed ${review.objectOutcome}` : ''}`);
         lines.push(`Other retained records: ${record.evidenceHistory.length} snapshots, ${record.actions.length} actions, ${record.assertions.length} assertions, ${record.attachments?.length ?? 0} file references.`, '');
     }
     lines.push('Use --json for the full Case export. Attached file bytes remain separate. This command makes no request.', '');

package/cli/case-pack.mjs

@@ -62,6 +62,7 @@ function listItemPath(path, list) {
             && path[3] === 'analystResponse' && path[4] === list && typeof path[5] === 'number');
 }
 function allowedSensitiveFieldPath(key, path) {
+    const deliveryReceipt = path.at(-1) === 'packetReceipt' && typeof path.at(-2) === 'number' && path.at(-3) === 'history' && listItemPath(path.slice(0, -3), 'actions');
     if (key === 'brandProfileIds')
         return topCasePath(path) || reportCasePath(path);
     if (key === 'notes')
@@ -75,9 +76,13 @@ function allowedSensitiveFieldPath(key, path) {
         return topCasePath(path) || analystResponsePath(path);
     }
     if (key === 'recipient')
-        return listItemPath(path, 'actions');
+        return listItemPath(path, 'actions') || deliveryReceipt;
     if (key === 'target')
-        return listItemPath(path, 'manualTrail');
+        return listItemPath(path, 'manualTrail') || deliveryReceipt;
+    if (key === 'correction')
+        return listItemPath(path, 'actions');
+    if (key === 'packetReceipt')
+        return typeof path.at(-1) === 'number' && path.at(-2) === 'history' && listItemPath(path.slice(0, -2), 'actions');
     return true;
 }
 /** Rejects hidden audience-sensitive copies with a budget proven by the serialized byte bound. */

package/cli/command-definition.mjs

@@ -19,7 +19,7 @@ const LEGACY_WORKSPACE_ARCHIVE_SCOPE = LEGACY_WORKSPACE_ARCHIVE_VERSIONS
     .map((version) => `v${version}`)
     .join(' and ');
 const INLINE_COMMAND_FAMILIES = ['support', 'review', 'assurance', 'workflow', 'history'];
-const CLI_CASE_OPERATIONS = ['show', 'open', 'note', 'pin', 'link', 'withdraw-link', 'assess', 'recheck'];
+const CLI_CASE_OPERATIONS = ['show', 'open', 'note', 'pin', 'link', 'withdraw-link', 'assess', 'recheck', 'incident-link', 'action', 'action-event', 'recheck-question', 'close-object'];
 const CLI_INDICATOR_OPERATIONS = ['revise', 'inspect', 'stix', 'misp'];
 const CLI_META_ACTIONS = Object.freeze([
     Object.freeze({
@@ -130,6 +130,7 @@ const CLI_OPTION_DEFINITIONS = Object.freeze({
     '--json': flag('Write structured JSON to stdout or the selected output file.'),
     '--reported-action': optionDefinition('enum', 'Record an analyst-reported identity action; repeat for separate actions.', { values: IDENTITY_ACTIONS.map(action => action.id), occurrence: 'repeatable' }),
     '--trusted-auth-header': optionDefinition('text', 'Select a recognised receiver header by part:header-index. This records analyst trust, not independent authentication; repeat for separate headers.', { occurrence: 'repeatable' }),
+    '--intake-context': optionDefinition('file', 'Read one selected version-1 distribution declaration or version-2 digest-bound phone/destination selection file. Declarations remain attributed claims.'),
     '--package': flag('Verify a portable evidence ZIP or encrypted package rather than a single report.'),
     '--folder': file('Verify the evidence package within this selected folder.'),
     '--quiet': flag('Suppress ordinary terminal presentation.', 'idempotent'),

package/cli/discovery-scan-command-runner.mjs

@@ -135,6 +135,10 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
         }
         catch (error) {
             checkpointFailure = error;
+            eventProgress.emit({ event: 'warning', state: 'checkpoint_unavailable' });
+            if (!eventProgress.enabled) {
+                context.writeStderr(`Checkpoint warning: ${boundedCliErrorMessage(error, 'Checkpoint could not be written')}. The latest progress may not be saved.\n`);
+            }
         }
     }
     const snapshot = args.observationSnapshot
@@ -170,12 +174,6 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
         else
             context.writeStdout(context.terminal(formatTerminalDiscoveryScan(document), args.color));
     }
-    if (checkpointFailure) {
-        eventProgress.emit({ event: 'warning', state: 'checkpoint_unavailable' });
-        if (!eventProgress.enabled) {
-            context.writeStderr(`Checkpoint warning: ${boundedCliErrorMessage(checkpointFailure, 'Checkpoint could not be written')}. Completed output is still available.\n`);
-        }
-    }
     const policyFindings = evaluateCliFailPolicies(document, args.failOn || []);
     if (policyFindings.length && !eventProgress.enabled)
         context.writeStderr(formatFailPolicyNotice(policyFindings));

package/cli/domain-feed.mjs

@@ -0,0 +1,61 @@
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { DOMAIN_FEED_LIMITS, normalizeDomainFeedSelection } from "../packages/monitoring/domain-feed.mjs";
+import { CliUsageError } from "./errors.mjs";
+export function parseDomainFeedSelectors(values) {
+    const hosts = [], terms = [], negativeTerms = [];
+    for (const value of values) {
+        if (value.startsWith('host:'))
+            hosts.push(value.slice(5));
+        else if (value.startsWith('term:'))
+            terms.push(value.slice(5));
+        else if (value.startsWith('exclude:'))
+            negativeTerms.push(value.slice(8));
+        else
+            throw new CliUsageError('--select requires host:<plain-hostname>, term:<literal-text> or exclude:<literal-text>.');
+    }
+    const selection = normalizeDomainFeedSelection({ hosts, terms, ...(negativeTerms.length ? { negativeTerms } : {}) });
+    if (!selection.hosts.length && !selection.terms.length)
+        throw new CliUsageError('Select at least one exact host or literal term.');
+    return selection;
+}
+/** Stream one descriptor-bound local regular file; URLs, pipes and symlinks are not inputs. */
+export async function* readDomainFeedFile(source, signal) {
+    if (!source || /^[a-z][a-z0-9+.-]*:\/\//iu.test(source))
+        throw new CliUsageError('Domain feed review requires an explicit local regular file, not a URL.');
+    if (signal?.aborted)
+        throw new DOMException('Feed reading was cancelled.', 'AbortError');
+    const handle = await open(source, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+    let stream;
+    const abort = () => stream?.destroy(new DOMException('Feed reading was cancelled.', 'AbortError'));
+    try {
+        if (signal?.aborted)
+            throw new DOMException('Feed reading was cancelled.', 'AbortError');
+        const before = await handle.stat();
+        if (!before.isFile())
+            throw new CliUsageError('The domain feed must be a regular file.');
+        if (before.size > DOMAIN_FEED_LIMITS.bytes)
+            throw new CliUsageError('The domain feed exceeds its 256 MiB raw-byte ceiling.');
+        stream = handle.createReadStream({ autoClose: false, highWaterMark: 64 * 1024 });
+        signal?.addEventListener('abort', abort, { once: true });
+        if (signal?.aborted)
+            abort();
+        let bytes = 0;
+        for await (const chunk of stream) {
+            if (signal?.aborted)
+                throw new DOMException('Feed reading was cancelled.', 'AbortError');
+            if (!(chunk instanceof Uint8Array) || chunk.byteLength > DOMAIN_FEED_LIMITS.bytes - bytes)
+                throw new CliUsageError('The domain feed exceeds its raw-byte ceiling.');
+            bytes += chunk.byteLength;
+            yield chunk;
+        }
+        const after = await handle.stat();
+        if (bytes !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs)
+            throw new CliUsageError('The domain feed changed while it was being read; no review was produced.');
+    }
+    finally {
+        signal?.removeEventListener('abort', abort);
+        stream?.destroy();
+        await handle.close();
+    }
+}

package/cli/formatters/json.mjs

@@ -1,6 +1,7 @@
 import { bulkDnsSummary } from "../bulk-output.mjs";
 import { SAVED_LOOKUP_SCHEMA_VERSION, buildCliLookupDocument, } from "../saved-lookup.mjs";
 import { CLI_LOOKUP_SCHEMA } from "../../packages/contracts/cli-lookup.mjs";
+import { terminalSafeJson } from "../../packages/interchange/json-output.mjs";
 const CLI_BULK_SCHEMA = 'whoisleuth.cli.bulk';
 const CLI_BULK_ITEM_SCHEMA = 'whoisleuth.cli.bulk.item';
 const CLI_CT_SEARCH_SCHEMA = 'whoisleuth.cli.ct-search';
@@ -18,19 +19,6 @@ const CLI_POSTURE_SCHEMA_VERSION = 1;
 const CLI_HTTP_SCHEMA_VERSION = 3;
 const CLI_TLS_SCHEMA_VERSION = 1;
 const CLI_COMPARE_SCHEMA_VERSION = 3;
-const TERMINAL_UNSAFE_JSON_RE = /[\u007f-\u009f\u2028\u2029]|\p{Default_Ignorable_Code_Point}/gu;
-function jsonUnicodeEscape(value) {
-    const codePoint = value.codePointAt(0);
-    if (codePoint <= 0xffff)
-        return `\\u${codePoint.toString(16).padStart(4, '0')}`;
-    const offset = codePoint - 0x10000;
-    const high = 0xd800 + (offset >> 10);
-    const low = 0xdc00 + (offset & 0x3ff);
-    return `\\u${high.toString(16).padStart(4, '0')}\\u${low.toString(16).padStart(4, '0')}`;
-}
-function terminalSafeJson(value, space) {
-    return JSON.stringify(value, null, space).replace(TERMINAL_UNSAFE_JSON_RE, jsonUnicodeEscape);
-}
 function formatJsonDocument(document) {
     return `${terminalSafeJson(document, 2)}\n`;
 }

package/cli/indicator-set-command.mjs

@@ -1,7 +1,6 @@
 import { buildManagedIndicatorRevision, managedIndicatorState, parseManagedIndicatorJson, readManagedIndicatorSet } from "../packages/interchange/managed-indicator-set.mjs";
 import { exportManagedIndicators } from "../packages/interchange/managed-indicator-export.mjs";
 import { MAX_MANAGED_INDICATOR_PLAN_BYTES, MAX_MANAGED_INDICATOR_SET_BYTES } from "../packages/contracts/analyst-interchange.mjs";
-import { formatJsonDocument } from "./formatters/json.mjs";
 import { safeTerminalValue } from "./formatters/terminal.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 export async function runIndicatorSetCommand(args, dependencies, context) {
@@ -18,7 +17,7 @@ export async function runIndicatorSetCommand(args, dependencies, context) {
     if (args.operation === 'stix' || args.operation === 'misp')
         context.writeStdout((await exportManagedIndicators(manifest, args.operation)).content);
     else if (args.output === 'json')
-        context.writeStdout(formatJsonDocument(manifest));
+        context.writeStdout((await exportManagedIndicators(manifest, 'manifest')).content);
     else {
         const lines = [`${safeTerminalValue(manifest.name)} · revision ${manifest.revision}`, `Set ${manifest.id}`, `Content digest ${manifest.integrity.digestSha256}`,
             'Content verified; authorship and earlier revisions are not authenticated.'];