@slicedearth/whoisleuth-cli 2.5.1 → 2.7.0

package/cli/doctor.mjs

@@ -1,12 +1,14 @@
 import { withTimeout } from "../lib/abort.mjs";
-export const DOCTOR_SCHEMA = 'whoisleuth.cli.doctor';
-export const DOCTOR_VERSION = 1;
+import { CLI_COMMAND_REGISTRY } from "./command-reference.mjs";
+import { DOCTOR_SCHEMA, DOCTOR_VERSION, DOCTOR_SUMMARY_SCHEMA, DOCTOR_SUMMARY_VERSION } from "../packages/contracts/cli-doctor.mjs";
+export { DOCTOR_SCHEMA, DOCTOR_VERSION, DOCTOR_SUMMARY_SCHEMA, DOCTOR_SUMMARY_VERSION };
 const MINIMUM_NODE_MAJOR = 24;
 const NETWORK_HOST = 'whois.iana.org';
 const NETWORK_QUERY = 'example.com';
 const NETWORK_HTTPS_URL = 'https://data.iana.org/rdap/dns.json';
 const NETWORK_TIMEOUT_MS = 6_000;
 const MAX_DOCTOR_DETAIL_LENGTH = 180;
+const DOCTOR_CHECK_IDS = ['runtime', 'platform', 'terminal', 'offline_features', 'network', 'public_dns', 'https_transport', 'whois_transport'];
 function boundedDetail(value, fallback) {
     return String(value || fallback)
         .replace(/[\u0000-\u001f\u007f]+/gu, ' ')
@@ -162,6 +164,38 @@ async function buildDoctorReport(options) {
         checks: Object.freeze(checks),
     });
 }
+function diagnosticVersion(value) {
+    return /^(\d{1,6}\.\d{1,6}\.\d{1,6})(?:[-+].*)?$/u.exec(value)?.[1] ?? null;
+}
+function buildDoctorSummary(report, nodeVersion = process.versions.node) {
+    const checkCodes = DOCTOR_CHECK_IDS.flatMap(id => {
+        const check = report.checks.find(item => item.id === id);
+        if (!check)
+            return [];
+        const state = check.state === 'pass' || check.state === 'partial' || check.state === 'skipped' ? check.state : 'unknown';
+        return [`${id}_${state}`];
+    });
+    const omittedCheckCount = report.checks.length - checkCodes.length;
+    return Object.freeze({
+        schema: DOCTOR_SUMMARY_SCHEMA,
+        version: DOCTOR_SUMMARY_VERSION,
+        cliVersion: diagnosticVersion(report.cliVersion),
+        nodeVersion: diagnosticVersion(nodeVersion),
+        state: report.state === 'pass' && omittedCheckCount === 0 ? 'pass' : 'partial',
+        networkRequested: report.networkRequested === true,
+        checkCodes: Object.freeze(checkCodes),
+        omittedCheckCount,
+        declaredFormatIdentifiers: Object.freeze([...new Set(CLI_COMMAND_REGISTRY.flatMap(command => command.documentation.supportedSchemaIdentifiers))].sort()),
+        formatScope: 'Public command declarations only; not an installed-package or input-compatibility test.',
+        omissions: Object.freeze([
+            'Targets, URLs, queries and fragments',
+            'File paths, folder names and user names',
+            'Launch tokens, cookies, credentials and headers',
+            'Input files, response content and free-form diagnostic details',
+            'Timestamps, platform details and version prerelease/build metadata',
+        ]),
+    });
+}
 function formatDoctorReport(report) {
     const lines = [
         'Runtime:',
@@ -175,4 +209,4 @@ function formatDoctorReport(report) {
     }
     return `${lines.join('\n')}\n`;
 }
-export { buildDoctorReport, formatDoctorReport, };
+export { buildDoctorReport, buildDoctorSummary, formatDoctorReport, };

package/cli/domain-feed.mjs

@@ -0,0 +1,61 @@
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { DOMAIN_FEED_LIMITS, normalizeDomainFeedSelection } from "../packages/monitoring/domain-feed.mjs";
+import { CliUsageError } from "./errors.mjs";
+export function parseDomainFeedSelectors(values) {
+    const hosts = [], terms = [], negativeTerms = [];
+    for (const value of values) {
+        if (value.startsWith('host:'))
+            hosts.push(value.slice(5));
+        else if (value.startsWith('term:'))
+            terms.push(value.slice(5));
+        else if (value.startsWith('exclude:'))
+            negativeTerms.push(value.slice(8));
+        else
+            throw new CliUsageError('--select requires host:<plain-hostname>, term:<literal-text> or exclude:<literal-text>.');
+    }
+    const selection = normalizeDomainFeedSelection({ hosts, terms, ...(negativeTerms.length ? { negativeTerms } : {}) });
+    if (!selection.hosts.length && !selection.terms.length)
+        throw new CliUsageError('Select at least one exact host or literal term.');
+    return selection;
+}
+/** Stream one descriptor-bound local regular file; URLs, pipes and symlinks are not inputs. */
+export async function* readDomainFeedFile(source, signal) {
+    if (!source || /^[a-z][a-z0-9+.-]*:\/\//iu.test(source))
+        throw new CliUsageError('Domain feed review requires an explicit local regular file, not a URL.');
+    if (signal?.aborted)
+        throw new DOMException('Feed reading was cancelled.', 'AbortError');
+    const handle = await open(source, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+    let stream;
+    const abort = () => stream?.destroy(new DOMException('Feed reading was cancelled.', 'AbortError'));
+    try {
+        if (signal?.aborted)
+            throw new DOMException('Feed reading was cancelled.', 'AbortError');
+        const before = await handle.stat();
+        if (!before.isFile())
+            throw new CliUsageError('The domain feed must be a regular file.');
+        if (before.size > DOMAIN_FEED_LIMITS.bytes)
+            throw new CliUsageError('The domain feed exceeds its 256 MiB raw-byte ceiling.');
+        stream = handle.createReadStream({ autoClose: false, highWaterMark: 64 * 1024 });
+        signal?.addEventListener('abort', abort, { once: true });
+        if (signal?.aborted)
+            abort();
+        let bytes = 0;
+        for await (const chunk of stream) {
+            if (signal?.aborted)
+                throw new DOMException('Feed reading was cancelled.', 'AbortError');
+            if (!(chunk instanceof Uint8Array) || chunk.byteLength > DOMAIN_FEED_LIMITS.bytes - bytes)
+                throw new CliUsageError('The domain feed exceeds its raw-byte ceiling.');
+            bytes += chunk.byteLength;
+            yield chunk;
+        }
+        const after = await handle.stat();
+        if (bytes !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs)
+            throw new CliUsageError('The domain feed changed while it was being read; no review was produced.');
+    }
+    finally {
+        signal?.removeEventListener('abort', abort);
+        stream?.destroy();
+        await handle.close();
+    }
+}

package/cli/formatters/html.mjs

@@ -40,6 +40,7 @@ function formatLookupEvidenceHtml(document, options = {}) {
   <style>
     :root{color-scheme:dark;--bg:#07110d;--panel:#0d1b15;--panel2:#10241b;--line:#254837;--text:#d8f5e4;--muted:#91b7a0;--accent:#6dff9d;--shadow:rgba(0,0,0,.28)}
     *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--text);font:15px/1.55 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}main{width:min(1120px,calc(100% - 32px));margin:0 auto;padding:42px 0 64px}header{border:1px solid var(--line);background:linear-gradient(145deg,var(--panel2),var(--panel));padding:28px;box-shadow:0 18px 50px var(--shadow)}h1,h2,h3{line-height:1.2;margin:0;color:var(--accent)}h1{font-size:clamp(1.5rem,4vw,2.35rem);overflow-wrap:anywhere}h2{font-size:1.22rem;margin-bottom:16px}h3{font-size:1rem;margin-bottom:12px}.eyebrow{margin:0 0 10px;color:var(--muted);letter-spacing:.12em;text-transform:uppercase}.notice{margin:18px 0 0;color:var(--muted);max-width:85ch}.block{margin-top:24px;border:1px solid var(--line);background:var(--panel);padding:22px}.fields{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:0 24px;margin:0}.fields div{display:grid;grid-template-columns:minmax(130px,.8fr) minmax(0,1.6fr);gap:12px;border-top:1px solid var(--line);padding:9px 0}.fields div:first-child,.fields div:nth-child(2){border-top:0}.fields dt{color:var(--muted)}.fields dd{margin:0;overflow-wrap:anywhere}.card-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,320px),1fr));gap:16px}.card{border:1px solid var(--line);background:var(--panel2);padding:18px}.card .fields{display:block}.card .fields div{grid-template-columns:minmax(120px,.8fr) minmax(0,1.4fr)}.card .fields div:nth-child(2){border-top:1px solid var(--line)}.table-scroll{overflow-x:auto}table{width:100%;border-collapse:collapse;min-width:720px}caption{text-align:left;color:var(--muted);padding:0 0 10px}th,td{border:1px solid var(--line);padding:9px 10px;text-align:left;vertical-align:top;overflow-wrap:anywhere}thead th{background:var(--panel2);color:var(--accent)}tbody th{color:var(--text)}.status{white-space:nowrap;color:var(--accent)}.empty,.omission{color:var(--muted)}ul{margin:0;padding-left:22px}li+li{margin-top:8px}footer{margin-top:24px;color:var(--muted);font-size:.88rem;text-align:center}
+    footer{overflow-wrap:anywhere}
     @media(max-width:700px){main{width:min(100% - 20px,1120px);padding-top:16px}header,.block{padding:17px}.fields{display:block}.fields div,.card .fields div{grid-template-columns:1fr;gap:2px}.fields div:nth-child(2){border-top:1px solid var(--line)}}
     @media print{:root{color-scheme:light;--bg:#fff;--panel:#fff;--panel2:#f5f7f5;--line:#b9c5bd;--text:#17231b;--muted:#46564b;--accent:#155c2f;--shadow:transparent}body{font:10pt/1.42 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}main{width:100%;padding:0}header,.block,.card{box-shadow:none;break-inside:avoid}.block{margin-top:12px}}
   </style>
@@ -55,6 +56,8 @@ function formatLookupEvidenceHtml(document, options = {}) {
   <section class="block"><h2>Query</h2>${renderFields(report.query)}</section>
   <section class="block"><h2>Assessment</h2>${renderFields(report.assessment)}</section>
   <section class="block"><h2>Registry sources</h2>${renderGroups(report.registryGroups)}</section>
+  ${report.registrarStanding.length ? `<section class="block"><h2>Registrar standing</h2>${renderFields(report.registrarStanding)}</section>` : ''}
+  ${report.registryInterpretation.length ? `<section class="block"><h2>Registry interpretation</h2>${renderFields(report.registryInterpretation)}</section>` : ''}
   <section class="block"><h2>Registry-source comparison</h2>${renderFields(report.comparison.health)}${renderComparison(report.comparison)}</section>
   ${report.registrarComparison.fields.length ? `<section class="block"><h2>Registry / registrar RDAP comparison</h2>${renderFields(report.registrarComparison.health)}${renderRegistrarComparison(report.registrarComparison)}</section>` : ''}
   <section class="block"><h2>Network evidence</h2>${renderGroups(report.networkGroups)}</section>

package/cli/formatters/json.mjs

@@ -1,6 +1,7 @@
 import { bulkDnsSummary } from "../bulk-output.mjs";
 import { SAVED_LOOKUP_SCHEMA_VERSION, buildCliLookupDocument, } from "../saved-lookup.mjs";
 import { CLI_LOOKUP_SCHEMA } from "../../packages/contracts/cli-lookup.mjs";
+import { terminalSafeJson } from "../../packages/interchange/json-output.mjs";
 const CLI_BULK_SCHEMA = 'whoisleuth.cli.bulk';
 const CLI_BULK_ITEM_SCHEMA = 'whoisleuth.cli.bulk.item';
 const CLI_CT_SEARCH_SCHEMA = 'whoisleuth.cli.ct-search';
@@ -18,19 +19,6 @@ const CLI_POSTURE_SCHEMA_VERSION = 1;
 const CLI_HTTP_SCHEMA_VERSION = 3;
 const CLI_TLS_SCHEMA_VERSION = 1;
 const CLI_COMPARE_SCHEMA_VERSION = 3;
-const TERMINAL_UNSAFE_JSON_RE = /[\u007f-\u009f\u2028\u2029]|\p{Default_Ignorable_Code_Point}/gu;
-function jsonUnicodeEscape(value) {
-    const codePoint = value.codePointAt(0);
-    if (codePoint <= 0xffff)
-        return `\\u${codePoint.toString(16).padStart(4, '0')}`;
-    const offset = codePoint - 0x10000;
-    const high = 0xd800 + (offset >> 10);
-    const low = 0xdc00 + (offset & 0x3ff);
-    return `\\u${high.toString(16).padStart(4, '0')}\\u${low.toString(16).padStart(4, '0')}`;
-}
-function terminalSafeJson(value, space) {
-    return JSON.stringify(value, null, space).replace(TERMINAL_UNSAFE_JSON_RE, jsonUnicodeEscape);
-}
 function formatJsonDocument(document) {
     return `${terminalSafeJson(document, 2)}\n`;
 }
@@ -81,7 +69,14 @@ function versionedResult(result, schema, version, generatedAt, requestedField, r
     return { ...result, schema, version, generatedAt, [requestedField]: requestedValue };
 }
 function buildCliPostureDocument(requestedDomain, report, generatedAt = new Date().toISOString()) {
-    return versionedResult(report, CLI_POSTURE_SCHEMA, CLI_POSTURE_SCHEMA_VERSION, generatedAt, 'requestedDomain', requestedDomain);
+    const checks = report.checks;
+    const retained = Array.isArray(checks) ? { ...report, checks: checks.map(check => {
+            if (!check || typeof check !== 'object' || Array.isArray(check))
+                return check;
+            const { dmarcPolicyContext: _transient, ...fields } = check;
+            return fields;
+        }) } : report;
+    return versionedResult(retained, CLI_POSTURE_SCHEMA, CLI_POSTURE_SCHEMA_VERSION, generatedAt, 'requestedDomain', requestedDomain);
 }
 function buildCliHttpDocument(requestedDomain, result, generatedAt = new Date().toISOString()) {
     return versionedResult(result, CLI_HTTP_SCHEMA, CLI_HTTP_SCHEMA_VERSION, generatedAt, 'requestedDomain', requestedDomain);

package/cli/formatters/terminal-lookup.mjs

@@ -1,5 +1,7 @@
 import { registryAccessProfileLabel } from "../registry-access.mjs";
+import { isSupportedRegistryInsightsVersion } from "../../packages/contracts/registry-insights.mjs";
 import { dnsAddressFamilyEvidence } from "../../packages/evidence/dns-query-outcome.mjs";
+import { lookupCollectionReceiptReview } from "../../packages/evidence/lookup-collection-review.mjs";
 import { appendTechnologyLines } from "./terminal-technology.mjs";
 import { appendDeliveryMetadataLines, appendPublicationMetadataLines } from "./terminal-metadata.mjs";
 import { securityPostureReview, summarizeSecurityPostureReview } from "../../lib/website-security-posture.mjs";
@@ -252,6 +254,14 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
         `RDAP           ${titleCase(rdapDiagnostics.status)}`,
         `WHOIS          ${titleCase(whoisDiagnostics.status)}`,
     ];
+    if (detail !== 'summary') {
+        for (const [source, status] of [['rdap', rdapDiagnostics.status], ['whois', whoisDiagnostics.status]]) {
+            const sourceDetail = terminalRecord(document[source]).detail;
+            if (['unsupported', 'skipped', 'disabled'].includes(String(status)) && typeof sourceDetail === 'string' && sourceDetail) {
+                registrationLines.push(`${source.toUpperCase()} detail    ${boundedTerminalComponent(sourceDetail, 300)}`);
+            }
+        }
+    }
     if (detail !== 'summary' && rdapDiagnostics.endpoint) {
         registrationLines.splice(1, 0, `RDAP source    ${safeTerminalValue(rdapDiagnostics.endpoint)}`);
     }
@@ -267,7 +277,7 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
         appendNetworkRegistrationLines(registrationLines, terminalRecord(rdap.parsed), document.type, detail);
     }
     const registryInsights = terminalRecord(document.registryInsights);
-    if (detail !== 'summary' && registryInsights.version === 1) {
+    if (detail !== 'summary' && isSupportedRegistryInsightsVersion(registryInsights.version)) {
         const lifecycle = terminalRecord(registryInsights.lifecycle);
         const disclosure = terminalRecord(registryInsights.contactDisclosure);
         const registryDisclosure = terminalRecord(disclosure.registryRdap);
@@ -712,6 +722,19 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
     const collectionLines = [];
     if (detail === 'verbose') {
         collectionLines.push(`Generated      ${safeTerminalValue(document.generatedAt, 'unknown')}`);
+        const receipt = lookupCollectionReceiptReview(document.collectionReceipt);
+        if (receipt) {
+            collectionLines.push(`Original plan  ${receipt.selection}`);
+            for (const choice of receipt.choices)
+                collectionLines.push(`${choice.label}: ${choice.selected ? 'selected' : 'not selected'}`);
+            for (const source of receipt.sources) {
+                collectionLines.push(`${source.label}: ${source.summary}; ${source.outcome}`);
+                collectionLines.push(`  ${source.explanation}`);
+            }
+            collectionLines.push('Collector start is local execution provenance, not proof of network delivery or complete evidence.');
+        }
+        else
+            collectionLines.push('Original plan  Not retained; original optional choices and collector starts are unknown.');
         const timing = terminalRecord(document.timing);
         if (Number(timing.totalMs) >= 0)
             collectionLines.push(`Total time     ${safeTerminalValue(timing.totalMs)} ms`);

package/cli/history-command-definitions.mjs

@@ -65,7 +65,7 @@ export const HISTORY_COMMAND_DEFINITIONS = Object.freeze({
         reference: {
             description: 'Convert one saved lookup into a versioned evidence report.',
             example: 'whoisleuth export lookup.json --markdown',
-            boundary: `Saved Lookup versions 1 and 2 are capped at 8 MiB and scanned for duplicate keys, the prototype-sensitive __proto__ key, and bounded nesting, key, value, and per-container counts before parsing. Current schema-${LOOKUP_EVIDENCE_SCHEMA_VERSION} exports preserve evidence-source attribution and limitations; published v2 schemas ${PUBLISHED_V2_LOOKUP_EVIDENCE_VERSIONS} and exact v1 schema ${V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION} remain readable, while other historical and unreleased shapes are unsupported. Markdown and HTML include a presentation-only generator footer unless --no-attribution is selected; JSON retains bounded generator provenance. Compact output intentionally omits raw registry payloads.`,
+            boundary: `Supported saved Lookups are capped at 8 MiB and scanned for duplicate keys, the prototype-sensitive __proto__ key, and bounded nesting, key, value, and per-container counts before parsing. Current schema-${LOOKUP_EVIDENCE_SCHEMA_VERSION} exports preserve evidence-source attribution and limitations; published v2 schemas ${PUBLISHED_V2_LOOKUP_EVIDENCE_VERSIONS} and exact v1 schema ${V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION} remain readable, while other historical and unreleased shapes are unsupported. Markdown and HTML include a presentation-only generator footer unless --no-attribution is selected; JSON retains bounded generator provenance. Compact output intentionally omits raw registry payloads.`,
         },
         collection: { scope: 'Reads one saved Lookup and writes one bounded report.' },
         summary: 'Convert a lookup to an evidence report',

package/cli/indicator-set-command.mjs

@@ -1,7 +1,6 @@
 import { buildManagedIndicatorRevision, managedIndicatorState, parseManagedIndicatorJson, readManagedIndicatorSet } from "../packages/interchange/managed-indicator-set.mjs";
 import { exportManagedIndicators } from "../packages/interchange/managed-indicator-export.mjs";
 import { MAX_MANAGED_INDICATOR_PLAN_BYTES, MAX_MANAGED_INDICATOR_SET_BYTES } from "../packages/contracts/analyst-interchange.mjs";
-import { formatJsonDocument } from "./formatters/json.mjs";
 import { safeTerminalValue } from "./formatters/terminal.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 export async function runIndicatorSetCommand(args, dependencies, context) {
@@ -18,7 +17,7 @@ export async function runIndicatorSetCommand(args, dependencies, context) {
     if (args.operation === 'stix' || args.operation === 'misp')
         context.writeStdout((await exportManagedIndicators(manifest, args.operation)).content);
     else if (args.output === 'json')
-        context.writeStdout(formatJsonDocument(manifest));
+        context.writeStdout((await exportManagedIndicators(manifest, 'manifest')).content);
     else {
         const lines = [`${safeTerminalValue(manifest.name)} · revision ${manifest.revision}`, `Set ${manifest.id}`, `Content digest ${manifest.integrity.digestSha256}`,
             'Content verified; authorship and earlier revisions are not authenticated.'];

package/cli/intake-command.mjs

@@ -2,6 +2,8 @@ import { readBoundedRegularFile } from "../lib/bounded-file.mjs";
 import { MAX_MESSAGE_INTAKE_BYTES, MESSAGE_INTAKE_INPUTS } from "../packages/contracts/message-intake.mjs";
 import { reviewSelectedInputInWorker } from "./selected-input-worker.mjs";
 import { reviewIdentityIncident } from "../packages/investigation/identity-incident-review.mjs";
+import { intakeIndicators, intakeIndicatorSource } from "../packages/investigation/intake-indicators.mjs";
+import { MAX_INTAKE_CONTEXT_BYTES, applyIntakeContextInput } from "../packages/investigation/intake-context.mjs";
 import { selectReceiverTrust, authenticationHeaderLabel } from "../packages/investigation/mail-authentication-review.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { formatJsonDocument } from "./formatters/json.mjs";
@@ -33,6 +35,28 @@ export function formatMessageIntake(report) {
                 lines.push(`  Ambiguous parameters: ${link.authorisation.duplicateParameters.join(', ')}`);
         }
     }
+    for (const indicator of intakeIndicators(report))
+        lines.push(`${indicator.id}: ${indicator.kind.toUpperCase()} ${indicator.value} · literal selected text · ${indicator.location.partId}${indicator.location.page ? ` page ${indicator.location.page}` : ''} · source ${intakeIndicatorSource(report, indicator)}`);
+    if (report.schemaVersion === 2) {
+        lines.push(`Indicator coverage: ${report.indicatorCoverage.state.replaceAll('_', ' ')}. Hashes require explicit algorithm labels; no indicator was resolved or reputation-checked.`);
+        const supplied = report.distributionContext;
+        if (supplied)
+            lines.push(`Analyst-declared distribution: ${supplied.channel} · ${supplied.sourceLabel} · observed ${supplied.observedAt ?? 'unknown'}`, `  Reference ${supplied.reference ?? 'not supplied'} · observer ${supplied.observerLabel ?? 'unknown'} · vantage ${supplied.vantageLabel ?? 'unknown'}`, 'Distribution, observation time and vantage are supplied claims, not verified capture conditions or independent collection.');
+        const selected = report.selectedEvidence;
+        if (selected) {
+            lines.push(`Deliberately selected phone groups: ${selected.phones.length}. Original spans use zero-based, end-exclusive UTF-16 code units.`);
+            lines.push(`Phone extraction coverage: ${selected.phoneCoverage.state.replaceAll('_', ' ')}; ${selected.phoneCoverage.candidatesShown} transient candidates shown, ${selected.phoneCoverage.candidatesReviewed} candidate runs reviewed.`);
+            for (const phone of selected.phones) {
+                lines.push(`  ${phone.canonical ?? 'No canonical number'} · ${phone.state.replaceAll('_', ' ')} · declared ${phone.declaration.role.replaceAll('_', ' ')} · ${phone.declaration.basis.replaceAll('_', ' ')} · country context ${phone.declaration.countryCallingCode ?? 'unknown'}`, `  Source ${phone.declaration.sourceLabel}; declared observation ${phone.declaration.observedAt ?? 'unknown'}; input ${selected.sourceDigestSha256}`);
+                for (const occurrence of phone.occurrences)
+                    lines.push(`    ${JSON.stringify(occurrence.original)} · [${occurrence.start}, ${occurrence.end})${phone.extension ? ` · separate extension ${phone.extension}` : ''}`);
+            }
+            const pair = selected.destinationPair;
+            if (pair)
+                lines.push(`Supplied destination pair: ${pair.state.replaceAll('_', ' ')} · displayed ${pair.displayed.hostname ?? pair.displayed.state} · destination ${pair.destination.hostname ?? pair.destination.state}`, `  Displayed source ${pair.displayedDeclaration.sourceLabel}; declared ${pair.displayedDeclaration.observedAt ?? 'unknown'}; ${pair.displayedDeclaration.basis}`, `  Destination role ${pair.destinationDeclaration.role}; source ${pair.destinationDeclaration.sourceLabel}; declared ${pair.destinationDeclaration.observedAt ?? 'unknown'}; ${pair.destinationDeclaration.basis}`);
+            lines.push(...selected.limitations);
+        }
+    }
     if (report.actionHints.length)
         lines.push(`Review wording: ${report.actionHints.map(value => value.replaceAll('_', ' ')).join(', ')}`);
     if (report.documentReview) {
@@ -70,7 +94,7 @@ export function formatMessageIntake(report) {
         lines.push(`Partial analysis: ${report.coverage.boundsReached.join('; ')}`);
     if (report.source.kind === 'qr' && !report.coverage.reviewedParts)
         lines.push('No QR text was decoded. This does not establish that the image contains no QR symbol.');
-    lines.push('Exact paths, queries, fragments and original message content are not included. Link relationships and authorisation parameters are supplied claims, not proof of a completed redirect or account compromise.');
+    lines.push('Exact paths, queries, fragments and surrounding message content are not included. Only deliberately selected phone substrings can be retained. Link relationships and authorisation parameters are supplied claims, not proof of a completed redirect or account compromise.');
     return `${lines.join('\n')}\n`;
 }
 export async function runIntakeCommand(args, dependencies, context) {
@@ -95,11 +119,27 @@ export async function runIntakeCommand(args, dependencies, context) {
                 throw new CliUsageError(cause.message);
             throw cause;
         }
-        const report = { ...result.report, authenticationReview, identityRecovery: reviewIdentityIncident({ reportedActions: args.reportedActions }) };
+        let report = { ...result.report, authenticationReview, identityRecovery: reviewIdentityIncident({ reportedActions: args.reportedActions }) };
+        if (args.intakeContextSource) {
+            if (args.intakeContextSource === '-')
+                throw new CliUsageError('Distribution context requires a separate selected file, not stdin.');
+            report = applyIntakeContextInput({ ...result, report }, await context.readInput(args.intakeContextSource, MAX_INTAKE_CONTEXT_BYTES, 'Intake context'));
+        }
         dependencies.signal?.throwIfAborted();
+        if (!args.quiet && result.phoneReview && (result.phoneReview.candidates.length || result.phoneReview.state === 'partial')) {
+            const phones = result.phoneReview;
+            context.writeStderr([
+                `Transient phone candidates: ${phones.candidates.length}; coverage ${phones.state}. Values are omitted until explicitly selected.`,
+                `Full source digest: ${phones.sourceDigestSha256}`,
+                ...phones.candidates.map(candidate => `${candidate.id}: UTF-16 span [${candidate.start}, ${candidate.end}) · ${candidate.state.replaceAll('_', ' ')}`),
+                'Review these spans in the original plaintext. Use --intake-context with version 2, review.sourceDigestSha256, and review.phones entries containing start, end and an explicit declaration. Offsets are zero-based UTF-16 code units, end exclusive; retain BOMs and supplementary characters when counting.',
+                'Only selected values enter the private report. Public/trusted Case summaries and STIX/MISP mappings omit phone values.',
+                '',
+            ].join('\n'));
+        }
         if (!args.quiet)
             context.writeStdout(args.output === 'json' ? formatJsonDocument(report) : context.terminal(formatMessageIntake(report), args.color));
-        return args.strictExit && report.coverage.state === 'partial' ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
+        return args.strictExit && (report.coverage.state === 'partial' || result.phoneReview?.state === 'partial') ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
     }
     finally {
         bytes.fill(0);

package/cli/investigation-artifacts.mjs

@@ -10,7 +10,7 @@ import { validateLookupEvidenceArtifactStructure } from "./artifact-validation/l
 import { CLI_DISCOVERY_SCAN_SCHEMA, CLI_DISCOVERY_SCAN_VERSION } from "./discovery-scan.mjs";
 import { CLI_DISCOVER_SCHEMA, CLI_DISCOVER_SCHEMA_VERSION, CLI_POSTURE_SCHEMA, CLI_POSTURE_SCHEMA_VERSION, CLI_CT_SEARCH_SCHEMA, CLI_CT_SEARCH_SCHEMA_VERSION, CLI_COMPARE_SCHEMA, CLI_COMPARE_SCHEMA_VERSION, } from "./formatters/json.mjs";
 import { CLI_LOOKUP_BRIEF_SCHEMA, CLI_LOOKUP_BRIEF_VERSION } from "../packages/contracts/cli-lookup-brief.mjs";
-import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, parseExternalFindingsDocument } from "../packages/interchange/external-findings-import.mjs";
+import { EXTERNAL_FINDINGS_SCHEMA, parseExternalFindingsDocument } from "../packages/interchange/external-findings-import.mjs";
 import { SOURCE_RELIABILITY_REPORT_SCHEMA, SOURCE_RELIABILITY_REPORT_VERSION } from "./source-reliability.mjs";
 import { CLI_CASE_PACK_SCHEMA, CLI_CASE_PACK_VERSION, verifyCliCasePack } from "./case-pack.mjs";
 import { SHARING_REVIEW_SCHEMA, SHARING_REVIEW_VERSION } from "./sharing-review.mjs";
@@ -59,8 +59,7 @@ export function validateWorkflowResult(step, result, retained) {
             break;
         case 'ct-intake':
             schema = EXTERNAL_FINDINGS_SCHEMA;
-            version = EXTERNAL_FINDINGS_VERSION;
-            parseExternalFindingsDocument(value);
+            version = parseExternalFindingsDocument(value).schemaVersion;
             break;
         case 'brief':
             schema = CLI_LOOKUP_BRIEF_SCHEMA;

package/cli/investigation-package-review.mjs

@@ -74,6 +74,7 @@ export async function verifyOfflineInvestigationPackage(input, passphrase) {
         }
         entries.push({ id: reviewed.entry.id, byteLength: reviewed.entry.byteLength,
             mediaType: 'mediaType' in reviewed.entry ? reviewed.entry.mediaType : 'application/json',
+            imageDerivation: 'imageDerivation' in reviewed.entry ? reviewed.entry.imageDerivation : null,
             state, identity: reviewed.state === 'identity_verified' ? 'verified' : 'failed', verification, issue });
     }
     const complete = entries.every((entry) => entry.state === 'admitted' || entry.state === 'opaque')
@@ -97,6 +98,7 @@ export async function verifyOfflineInvestigationPackage(input, passphrase) {
             'Capture attachment checks bind selected bytes to the capture manifest declaration, not to a trusted publisher or real website observation.',
             'Case-file checks match original references to other verified package bytes by length and digest, not by filename or claimed source. Missing originals make the package partial; no file is fetched or imported.',
             'Source declarations and packaging times are not authenticated. Signatures and timestamp tokens require their own verification and trust decisions.',
+            'Image derivation declares the immediate parent fingerprint and editing operations, not proof of transformation or complete redaction. Parent bytes are optional; missing declarations leave editing history unknown.',
             'This command does not import, overwrite or collect evidence. Unchanged bytes and valid source structure do not establish factual accuracy, currentness or safe sharing.',
         ]),
     });

package/cli/investigation-plan.mjs

@@ -75,6 +75,7 @@ export function formatWorkflowRecipeCatalogue(catalogue) {
             `${recipe.id} — ${recipe.label}`,
             `  Subject: ${recipe.subjectRequirement.replaceAll('_', ' ')}`,
             `  Workflow run: ${recipe.runnableByWorkflowRun ? 'supported' : 'plan and explanation only'}`,
+            ...formatWorkflowEffort(recipe.id, recipe.steps).map((line) => `  ${line}`),
             `  ${recipe.objective}`,
             ...recipe.steps.map((item, index) => `  ${index + 1}. ${item.label} [${item.mode}; ${item.approval.replaceAll('_', ' ')}]`),
             ...recipe.limitations.map((item) => `  Limitation: ${item}`),
@@ -84,6 +85,19 @@ export function formatWorkflowRecipeCatalogue(catalogue) {
         '',
     ].join('\n');
 }
+function formatWorkflowEffort(recipeId, steps) {
+    const counts = { network: 0, offline: 0 };
+    for (const step of steps)
+        counts[step.mode] += 1;
+    const reuse = workflowStandardInputs(recipeId).length;
+    return [
+        `Work planned: ${counts.network} networked step${counts.network === 1 ? '' : 's'}; ${counts.offline} offline step${counts.offline === 1 ? '' : 's'}.`,
+        reuse
+            ? `Evidence reuse: ${reuse} link${reuse === 1 ? '' : 's'} from earlier outputs to later steps.`
+            : 'Evidence reuse: no earlier-output links are declared.',
+        'Counts describe steps and reuse links, not requests. Saved files and cache state are not checked.',
+    ];
+}
 function validatedSteps(steps) {
     for (const step of steps) {
         const invocationEffect = cliInvocationNetworkEffect(step.command, step.arguments);
@@ -147,6 +161,7 @@ export function formatInvestigationPlan(plan) {
         `Investigation plan: ${plan.recipe.label}`,
         `Subject  ${plan.subject}`,
         `Mode     ${plan.execution}`,
+        ...formatWorkflowEffort(plan.recipe.id, plan.steps),
         '',
         ...plan.steps.flatMap((item, index) => [
             `${index + 1}. ${item.label}`,

package/cli/local-mmdb-review.mjs

@@ -31,26 +31,33 @@ function names(value) {
     const source = record(value);
     return boundedText(source.en, 120);
 }
-async function readStableMmdb(databasePath, openFile = open) {
+async function readStableMmdb(databasePath, openFile = open, signal) {
     let handle = null;
+    let database = null;
     try {
+        signal?.throwIfAborted();
         const resolvedPath = await realpath(databasePath);
+        signal?.throwIfAborted();
         handle = await openFile(resolvedPath, fsConstants.O_RDONLY | fsConstants.O_NONBLOCK | fsConstants.O_NOFOLLOW);
+        signal?.throwIfAborted();
         const before = await handle.stat();
+        signal?.throwIfAborted();
         if (!before.isFile() || before.size <= 0 || before.size > MAX_LOCAL_MMDB_BYTES) {
             throw new CliUsageError(`The supplied MMDB must be a file no larger than ${MAX_LOCAL_MMDB_BYTES} bytes.`);
         }
         // Dedicated backing storage can be transferred without copying a pooled
         // buffer or exposing bytes outside the stable file's exact length.
-        const database = Buffer.allocUnsafeSlow(before.size);
+        database = Buffer.allocUnsafeSlow(before.size);
         let offset = 0;
         while (offset < database.length) {
             const { bytesRead } = await handle.read(database, offset, database.length - offset, offset);
+            signal?.throwIfAborted();
             if (bytesRead === 0)
                 break;
             offset += bytesRead;
         }
         const after = await handle.stat();
+        signal?.throwIfAborted();
         if (offset !== database.length
             || before.dev !== after.dev
             || before.ino !== after.ino
@@ -62,6 +69,8 @@ async function readStableMmdb(databasePath, openFile = open) {
         return database;
     }
     catch (cause) {
+        database?.fill(0);
+        signal?.throwIfAborted();
         if (cause instanceof CliUsageError)
             throw cause;
         throw new CliUsageError('The supplied MMDB file could not be read.');
@@ -238,11 +247,17 @@ if (!isMainThread && parentPort && record(workerData).kind === LOCAL_MMDB_WORKER
 /** One disposable worker pre-empts the existing synchronous reader. It is not
  * a sandbox and never receives a database path or inherited environment. */
 export async function reviewLocalMmdb(input, databasePath, checkedAt = new Date().toISOString(), dependencies = {}) {
+    const { signal } = dependencies;
+    signal?.throwIfAborted();
     const query = prepareQuery(input, checkedAt);
     const deadlineMs = dependencies.deadlineMs ?? LOCAL_MMDB_REVIEW_DEADLINE_MS;
     if (!Number.isSafeInteger(deadlineMs) || deadlineMs <= 0 || deadlineMs > LOCAL_MMDB_REVIEW_DEADLINE_MS)
         throw new CliUsageError('Invalid local database processing deadline.');
-    const database = await readStableMmdb(databasePath, dependencies.openFile);
+    const database = await readStableMmdb(databasePath, dependencies.openFile, signal);
+    if (signal?.aborted) {
+        database.fill(0);
+        signal.throwIfAborted();
+    }
     const identity = { sha256: createHash('sha256').update(database).digest('hex'), byteLength: database.length };
     const options = { workerData: { kind: LOCAL_MMDB_WORKER_KIND, query, bytes: database, identity },
         transferList: [database.buffer], env: {}, execArgv: [], stdout: true, stderr: true,
@@ -254,6 +269,7 @@ export async function reviewLocalMmdb(input, databasePath, checkedAt = new Date(
     catch {
         if (database.byteLength)
             database.fill(0);
+        signal?.throwIfAborted();
         if (query.version === 2)
             return freezeResult(currentResult(query, identity, { metadata: null, ageDays: null, reason: 'invalid_metadata' }, 'processing_unavailable'));
         throw new CliUsageError('The supplied database could not be reviewed within its format and processing bounds.');
@@ -268,17 +284,24 @@ export async function reviewLocalMmdb(input, databasePath, checkedAt = new Date(
                     return;
                 settled = true;
                 clearTimeout(timer);
-                if (result)
+                signal?.removeEventListener('abort', onAbort);
+                if (signal?.aborted)
+                    reject(signal.reason);
+                else if (result)
                     resolve(freezeResult(result));
                 else if (query.version === 2)
                     resolve(freezeResult(currentResult(query, identity, { metadata: null, ageDays: null, reason: 'invalid_metadata' }, reason)));
                 else
                     reject(new CliUsageError('The supplied database could not be reviewed within its format and processing bounds.'));
             };
+            const onAbort = () => finish();
             const timer = setTimeout(() => finish(undefined, 'processing_deadline'), deadlineMs);
             worker.once('message', (reply) => reply && 'result' in reply ? finish(reply.result) : finish());
             worker.once('error', () => finish());
             worker.once('exit', () => finish());
+            signal?.addEventListener('abort', onAbort, { once: true });
+            if (signal?.aborted)
+                onAbort();
         });
     }
     finally {

package/cli/lookup-brief.mjs

@@ -214,23 +214,29 @@ export function buildCliLookupBrief(input, generatedAt = new Date().toISOString(
     });
 }
 export function formatCliLookupBrief(document) {
+    const sourceFacts = document.sourceHealth.flatMap((source) => {
+        const facts = document.facts.filter((item) => item.source.id === source.id);
+        return [
+            `  ${safeTerminalValue(source.label)} [${safeTerminalValue(source.state)}; ${source.observedAt ? `observed ${safeTerminalValue(source.observedAt)}` : 'source time not recorded'}]`,
+            ...(facts.length
+                ? facts.map((item) => `    ${safeTerminalValue(item.label)}: ${safeTerminalValue(item.value)}`)
+                : ['    No fact selected for this brief.']),
+        ];
+    });
     return [
         `Lookup brief: ${safeTerminalValue(document.target)}`,
         `Observed  ${safeTerminalValue(document.observedAt)}`,
         `Mode      ${safeTerminalValue(document.mode)}`,
         '',
         'Source-attributed facts',
-        ...(document.facts.length ? document.facts.map((item) => `  ${safeTerminalValue(item.label)}: ${safeTerminalValue(item.value)} (${safeTerminalValue(item.source.label)}; ${safeTerminalValue(item.source.state)}; ${item.source.observedAt ? `observed ${safeTerminalValue(item.source.observedAt)}` : 'source time not recorded'})`) : ['  No bounded fact was available.']),
+        ...sourceFacts,
         '',
         'Contradictions',
         ...(document.contradictions.length ? document.contradictions.flatMap((item) => [
             `  ${safeTerminalValue(item.field)}: ${safeTerminalValue(item.detail)}`,
-            ...item.observations.map((observation) => `    ${safeTerminalValue(observation.source.label)}: ${safeTerminalValue(observation.value)} (${safeTerminalValue(observation.state)}; ${observation.source.observedAt ? `observed ${safeTerminalValue(observation.source.observedAt)}` : 'source time not recorded'})`),
+            ...item.observations.map((observation) => `    ${safeTerminalValue(observation.source.label)}: ${safeTerminalValue(observation.value)} (value state: ${safeTerminalValue(observation.state)}; source state: ${safeTerminalValue(observation.source.state)}; ${observation.source.observedAt ? `observed ${safeTerminalValue(observation.source.observedAt)}` : 'source time not recorded'})`),
         ]) : ['  No conflicting publication field was retained.']),
         '',
-        'Unknown or incomplete',
-        ...(document.unknowns.length ? document.unknowns.map((item) => `  ${safeTerminalValue(item)}`) : ['  No incomplete source state was identified.']),
-        '',
         'Recommended manual actions',
         ...document.actionPlan.flatMap((item, index) => [
             `  ${index + 1}. ${safeTerminalValue(item.action)}`,

package/cli/lookup-command-runner.mjs

@@ -67,25 +67,32 @@ async function runLookupCommand(args, dependencies, context) {
         return EXIT_CODES.SUCCESS;
     }
     let documentGeneratedAt = '';
-    const buildDocument = (result) => {
+    const buildDocument = ({ result, collectionReceipt }) => {
         documentGeneratedAt = context.now();
         return buildCliLookupDocument(query, classified, result, documentGeneratedAt, args.deep ? 'deep' : 'fast', {
+            collectionReceipt,
             ...(args.observerLabel ? { observerLabel: args.observerLabel } : {}),
             ...(args.vantageLabel ? { vantageLabel: args.vantageLabel } : {}),
         });
     };
-    const collect = (signal, onSourceSettled) => abortable(() => executeLookup(classified, {
-        fast: !args.deep,
-        compact: false,
-        ...(signal ? { signal } : {}),
-        ...(args.deep ? {
-            ...(selectedUrl ? { selectedUrl } : {}),
-            onSourceSettled: settlement => {
-                onSourceSettled(settlement);
-                eventProgress.emit({ event: 'source_settled', source: settlement.source, state: settlement.state });
-            },
-        } : {}),
-    }), signal);
+    const collect = (signal, onSourceSettled) => abortable(async () => {
+        let collectionReceipt;
+        const result = await executeLookup(classified, {
+            fast: !args.deep,
+            compact: false,
+            onCollectionReceipt: value => { collectionReceipt = value; },
+            ...(signal ? { signal } : {}),
+            ...(args.deep ? {
+                ...(selectedUrl ? { selectedUrl } : {}),
+                onSourceSettled: settlement => {
+                    onSourceSettled(settlement);
+                    eventProgress.emit({ event: 'source_settled', source: settlement.source, state: settlement.state });
+                },
+            } : {}),
+        });
+        signal?.throwIfAborted();
+        return { result, collectionReceipt };
+    }, signal);
     let document;
     if (args.browse === true) {
         const browse = dependencies.browseLookupOperation || browseLookupOperation;
@@ -110,6 +117,7 @@ async function runLookupCommand(args, dependencies, context) {
             const save = dependencies.writePrivateFile || writePrivateFile;
             await save(args.saveLookup, serializeCliLookupDocument(document), {
                 existingFileMessage: 'Saved Lookup file already exists. Choose a new --save-lookup path or remove the existing file explicitly.',
+                beforePublish: async () => { dependencies.signal?.throwIfAborted(); },
             });
             context.writeStderr('Saved the completed private Lookup JSON. It can contain raw public registry and WHOIS responses plus target and collection context; review it before sharing.\n');
         }