@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/frontend/src/lib/analysis/case-migration-model.js

@@ -1,8 +1,11 @@
 import { CASE_DISPOSITIONS, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, MAX_CASES, MAX_NOTES_PER_CASE, deterministicId, isoOrNull, normalizeCase, normalizeDomain, normalizeEvidenceHistory, normalizeNotes, normalizeReviewReasonCode, normalizeTags, objectRecord, safeId, } from "./case-record-model.js";
+import { inspectCaseBrandProfileIds, unionCaseBrandProfileIds, } from "./case-brand-profile-references.js";
+import { caseInvestigationBranchReferences, mergeCaseInvestigationBranches, normalizeCaseInvestigationBranches, } from "./case-investigation-branch-model.js";
 import { mergeCaseActions, mergeCaseAssertions, mergeCaseDecisions, mergeCaseEvidencePins, mergeCaseManualTrail, mergeCaseSightings, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseSightings, } from "./case-response-model.js";
 const STATUS_VALUES = new Set(CASE_STATUSES.map((item) => item.value));
 const DISPOSITION_VALUES = new Set(CASE_DISPOSITIONS.map((item) => item.value));
 const SOURCE_VALUES = new Set(CASE_SOURCES.map((item) => item.value));
+export const MAX_CASE_INPUT_RECORDS = 2_000;
 function assignUniqueIds(cases) {
     const used = new Set();
     for (const record of [...cases].sort((a, b) => a.domain.localeCompare(b.domain))) {
@@ -28,11 +31,16 @@ function assignUniqueIds(cases) {
  */
 export function normalizeCaseStore(raw) {
     const now = new Date().toISOString();
+    const sourceVersion = parseStoreVersion(raw);
+    const acceptsBrandProfileIds = Array.isArray(raw)
+        || sourceVersion === CASE_SCHEMA_VERSION;
     const byDomain = new Map();
-    for (const item of asCaseList(raw)) {
-        const normalized = normalizeCase(item, undefined, now);
+    for (const item of boundedCaseList(raw).items) {
+        const normalized = normalizeCase(item, undefined, now, Array.isArray(raw) ? CASE_SCHEMA_VERSION : sourceVersion);
         if (!normalized)
             continue;
+        if (!acceptsBrandProfileIds)
+            normalized.brandProfileIds = [];
         const existing = byDomain.get(normalized.domain);
         if (!existing || Date.parse(normalized.updatedAt) >= Date.parse(existing.updatedAt)) {
             byDomain.set(normalized.domain, normalized);
@@ -64,6 +72,13 @@ function asCaseList(raw) {
         return cases;
     return [];
 }
+function boundedCaseList(raw) {
+    const source = asCaseList(raw);
+    return {
+        items: source.slice(0, MAX_CASE_INPUT_RECORDS),
+        omitted: Math.max(0, source.length - MAX_CASE_INPUT_RECORDS),
+    };
+}
 /**
  * @param {{ domain: unknown, status?: unknown, disposition?: unknown, source?: unknown, tags?: unknown, evidence?: unknown, note?: unknown }} input
  * @param {string} [nowIso]
@@ -82,7 +97,7 @@ function importScalar(value, valid) {
  * @param {unknown} raw
  * @returns {ImportPatch | null}
  */
-function extractImportPatch(raw) {
+function extractImportPatch(raw, importedVersion) {
     const record = objectRecord(raw);
     const domain = normalizeDomain(record.domain);
     if (!domain)
@@ -90,8 +105,16 @@ function extractImportPatch(raw) {
     const importFallback = isoOrNull(record.updatedAt) || isoOrNull(record.createdAt) || null;
     const normalizedFallback = importFallback || '1970-01-01T00:00:00.000Z';
     const rawEvidence = Array.isArray(record.evidenceHistory) ? record.evidenceHistory : [];
-    const evidencePins = normalizeCaseEvidencePins(record.evidencePins, normalizedFallback);
+    const evidencePins = normalizeCaseEvidencePins(record.evidencePins, normalizedFallback, {
+        allowCertificateObservation: importedVersion >= 11,
+    });
     const pinIds = new Set(evidencePins.map((item) => item.id));
+    const actions = normalizeCaseActions(record.actions, normalizedFallback);
+    const assertions = normalizeCaseAssertions(record.assertions, normalizedFallback, pinIds);
+    const branchReferences = caseInvestigationBranchReferences({ evidencePins, actions, assertions });
+    const brandProfileReferences = importedVersion >= 12
+        ? inspectCaseBrandProfileIds(record.brandProfileIds)
+        : { ids: [], omitted: 0 };
     return {
         domain,
         rawId: typeof record.id === 'string' ? record.id : null,
@@ -100,14 +123,23 @@ function extractImportPatch(raw) {
         reviewReasonCode: Object.hasOwn(record, 'reviewReasonCode')
             ? normalizeReviewReasonCode(record.reviewReasonCode)
             : undefined,
+        brandProfileIds: brandProfileReferences.ids,
+        brandProfileReferencesOmitted: brandProfileReferences.omitted,
         source: importScalar(record.source, SOURCE_VALUES),
-        evidenceHistory: normalizeEvidenceHistory(rawEvidence, { source: 'import', fallback: importFallback }),
+        evidenceHistory: normalizeEvidenceHistory(rawEvidence, {
+            source: 'import',
+            fallback: importFallback,
+            sourceVersion: importedVersion,
+        }),
         evidencePins,
         decisions: normalizeCaseDecisions(record.decisions, normalizedFallback, pinIds),
-        actions: normalizeCaseActions(record.actions, normalizedFallback),
-        assertions: normalizeCaseAssertions(record.assertions, normalizedFallback, pinIds),
+        actions,
+        assertions,
         manualTrail: normalizeCaseManualTrail(record.manualTrail, normalizedFallback),
         sightings: normalizeCaseSightings(record.sightings, normalizedFallback, pinIds),
+        branches: importedVersion >= 11
+            ? normalizeCaseInvestigationBranches(record.branches, normalizedFallback, branchReferences)
+            : [],
         tags: normalizeTags(record.tags),
         // Imported notes fall back only to the imported record's own timestamps
         // (never "now"), so a timestamp-less note gets a stable, deterministic time
@@ -143,6 +175,7 @@ function caseFromPatch(patch, now) {
         status: patch.status ?? DEFAULT_STATUS,
         disposition: patch.disposition ?? DEFAULT_DISPOSITION,
         reviewReasonCode: patch.reviewReasonCode ?? null,
+        brandProfileIds: patch.brandProfileIds,
         tags: patch.tags,
         notes: patch.notes,
         source: patch.source ?? DEFAULT_SOURCE,
@@ -153,6 +186,7 @@ function caseFromPatch(patch, now) {
         assertions: patch.assertions,
         manualTrail: patch.manualTrail,
         sightings: patch.sightings,
+        branches: patch.branches,
         createdAt: patch.createdAt || patch.updatedAt || now,
         updatedAt: patch.updatedAt || patch.createdAt || now,
     };
@@ -171,24 +205,30 @@ function applyImportPatch(local, patch) {
     const fallback = patch.updatedAt || local.updatedAt;
     const evidencePins = mergeCaseEvidencePins(local.evidencePins, patch.evidencePins, fallback);
     const pinIds = new Set(evidencePins.map((item) => item.id));
-    return {
-        ...local,
-        status: patch.status !== undefined && importNewer ? patch.status : local.status,
-        disposition: patch.disposition !== undefined && importNewer ? patch.disposition : local.disposition,
-        reviewReasonCode: patch.reviewReasonCode !== undefined && importNewer ? patch.reviewReasonCode : local.reviewReasonCode ?? null,
-        source: patch.source !== undefined && importNewer ? patch.source : local.source,
-        evidenceHistory: mergeEvidenceHistories(local.evidenceHistory, patch.evidenceHistory),
-        evidencePins,
-        decisions: mergeCaseDecisions(local.decisions, patch.decisions, fallback, pinIds),
-        actions: mergeCaseActions(local.actions, patch.actions, fallback),
-        assertions: mergeCaseAssertions(local.assertions, patch.assertions, fallback, pinIds),
-        manualTrail: mergeCaseManualTrail(local.manualTrail, patch.manualTrail, fallback),
-        sightings: mergeCaseSightings(local.sightings, patch.sightings, fallback, pinIds),
-        tags: normalizeTags([...local.tags, ...patch.tags]),
-        notes: unionNotes(local.notes, patch.notes),
-        createdAt: patch.createdAt && Date.parse(patch.createdAt) < Date.parse(local.createdAt) ? patch.createdAt : local.createdAt,
-        updatedAt: importNewer ? (patch.updatedAt ?? local.updatedAt) : local.updatedAt,
-    };
+    const actions = mergeCaseActions(local.actions, patch.actions, fallback);
+    const assertions = mergeCaseAssertions(local.assertions, patch.assertions, fallback, pinIds);
+    const branchReferences = caseInvestigationBranchReferences({ evidencePins, actions, assertions });
+    const brandProfileReferences = unionCaseBrandProfileIds(local.brandProfileIds, patch.brandProfileIds);
+    return { record: {
+            ...local,
+            status: patch.status !== undefined && importNewer ? patch.status : local.status,
+            disposition: patch.disposition !== undefined && importNewer ? patch.disposition : local.disposition,
+            reviewReasonCode: patch.reviewReasonCode !== undefined && importNewer ? patch.reviewReasonCode : local.reviewReasonCode ?? null,
+            brandProfileIds: brandProfileReferences.ids,
+            source: patch.source !== undefined && importNewer ? patch.source : local.source,
+            evidenceHistory: mergeEvidenceHistories(local.evidenceHistory, patch.evidenceHistory),
+            evidencePins,
+            decisions: mergeCaseDecisions(local.decisions, patch.decisions, fallback, pinIds),
+            actions,
+            assertions,
+            manualTrail: mergeCaseManualTrail(local.manualTrail, patch.manualTrail, fallback),
+            sightings: mergeCaseSightings(local.sightings, patch.sightings, fallback, pinIds),
+            branches: mergeCaseInvestigationBranches(local.branches ?? [], patch.branches, fallback, branchReferences),
+            tags: normalizeTags([...local.tags, ...patch.tags]),
+            notes: unionNotes(local.notes, patch.notes),
+            createdAt: patch.createdAt && Date.parse(patch.createdAt) < Date.parse(local.createdAt) ? patch.createdAt : local.createdAt,
+            updatedAt: importNewer ? (patch.updatedAt ?? local.updatedAt) : local.updatedAt,
+        }, brandProfileReferencesOmitted: brandProfileReferences.omitted };
 }
 function pickFreeId(preferred, domain, used) {
     const wanted = safeId(preferred);
@@ -208,7 +248,7 @@ function pickFreeId(preferred, domain, used) {
  * reinterpreted.
  * @param {CaseRecord[]} localCases
  * @param {unknown} importedRaw
- * @returns {{ cases: CaseRecord[], added: number, updated: number, skipped: number }}
+ * @returns {{ cases: CaseRecord[], added: number, updated: number, skipped: number, brandProfileReferencesOmitted: number }}
  */
 export function mergeCases(localCases, importedRaw) {
     const importedVersion = parseStoreVersion(importedRaw);
@@ -221,21 +261,26 @@ export function mergeCases(localCases, importedRaw) {
         throw new Error(`Expected a WHOISleuth case export using schema ${CASE_IMPORT_VERSIONS.join(' or ')}.`);
     }
     const local = normalizeCaseStore(localCases).cases;
+    const supportedImportedVersion = importedVersion ?? 0;
     const byDomain = new Map(local.map((item) => [item.domain, item]));
     const usedIds = new Set(local.map((item) => item.id));
     let added = 0;
     let updated = 0;
-    let skipped = 0;
+    const imported = boundedCaseList(importedRaw);
+    let skipped = imported.omitted;
+    let brandProfileReferencesOmitted = 0;
     const now = new Date().toISOString();
-    for (const item of asCaseList(importedRaw)) {
-        const patch = extractImportPatch(item);
+    for (const item of imported.items) {
+        const patch = extractImportPatch(item, supportedImportedVersion);
         if (!patch) {
             skipped += 1;
             continue;
         }
         const existing = byDomain.get(patch.domain);
         if (existing) {
-            byDomain.set(patch.domain, applyImportPatch(existing, patch));
+            const merged = applyImportPatch(existing, patch);
+            byDomain.set(patch.domain, merged.record);
+            brandProfileReferencesOmitted += patch.brandProfileReferencesOmitted + merged.brandProfileReferencesOmitted;
             updated += 1;
         }
         else if (byDomain.size < MAX_CASES) {
@@ -243,11 +288,18 @@ export function mergeCases(localCases, importedRaw) {
             record.id = pickFreeId(patch.rawId, patch.domain, usedIds);
             usedIds.add(record.id);
             byDomain.set(patch.domain, record);
+            brandProfileReferencesOmitted += patch.brandProfileReferencesOmitted;
             added += 1;
         }
         else {
             skipped += 1;
         }
     }
-    return { cases: normalizeCaseStore([...byDomain.values()]).cases, added, updated, skipped };
+    return {
+        cases: normalizeCaseStore([...byDomain.values()]).cases,
+        added,
+        updated,
+        skipped,
+        brandProfileReferencesOmitted,
+    };
 }

package/frontend/src/lib/analysis/case-record-contracts.js

@@ -1,6 +1,6 @@
 import { ANALYST_REVIEW_REASONS } from "../../../../lib/analyst-taxonomy.mjs";
-export const CASE_SCHEMA_VERSION = 10;
-export const CASE_IMPORT_VERSIONS = [3, 4, 5, 6, 7, 8, 9, CASE_SCHEMA_VERSION];
+export const CASE_SCHEMA_VERSION = 12;
+export const CASE_IMPORT_VERSIONS = [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, CASE_SCHEMA_VERSION];
 export const MAX_CASES = 500;
 export const MAX_NOTES_PER_CASE = 50;
 export const MAX_NOTE_LENGTH = 2000;
@@ -17,6 +17,8 @@ export const MAX_EVIDENCE_TITLE_LENGTH = 200;
 export const MAX_EVIDENCE_DETAIL_LENGTH = 200;
 export const MAX_EVIDENCE_CHANGES = 40;
 export const MAX_CASE_STORE_BYTES = 4 * 1024 * 1024;
+export const MAX_CASE_BRAND_PROFILE_IDS = 8;
+export const MAX_CASE_BRAND_PROFILE_ID_CANDIDATES = 32;
 export const CASE_STATUSES = [
     { value: 'new', label: 'New' },
     { value: 'reviewing', label: 'Reviewing' },

package/frontend/src/lib/analysis/case-record-model.js

@@ -3,5 +3,7 @@
 // testable while existing consumers keep one compatibility import.
 export * from "./case-record-contracts.js";
 export * from "./case-record-core.js";
+export * from "./case-brand-profile-references.js";
 export * from "./case-evidence-model.js";
 export * from "./case-record-operations.js";
+export * from "./case-investigation-branch-model.js";

package/frontend/src/lib/analysis/case-record-operations.js

@@ -3,7 +3,9 @@
 import { appendCaseAction, appendCaseAssertion, appendCaseDecision, appendCaseEvidencePin, appendCaseEvidencePins, appendCaseManualTrailEvent, appendCaseSighting, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseSightings, updateCaseAction, updateCaseAssertion, } from "./case-response-model.js";
 import { MAX_CASES, MAX_NOTES_PER_CASE, } from "./case-record-contracts.js";
 import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, deterministicId, isoOrNow, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeReviewReasonCode, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.js";
+import { assertCaseBrandProfileIds, normalizeCaseBrandProfileIds, } from "./case-brand-profile-references.js";
 import { normalizeEvidenceHistory, } from "./case-evidence-model.js";
+import { appendCaseInvestigationBranch, caseInvestigationBranchReferences, normalizeCaseInvestigationBranches, updateCaseInvestigationBranch, } from "./case-investigation-branch-model.js";
 // ---------------------------------------------------------------------------
 // Case normalization
 // ---------------------------------------------------------------------------
@@ -16,10 +18,14 @@ function inferCaptureSource(caseSource) {
 }
 // Builds a case's bounded current-schema evidence history. Uses a lenient
 // local fallback timestamp so recoverable current data always loads.
-function normalizeCaseEvidence(record, createdAt, updatedAt, now) {
+function normalizeCaseEvidence(record, createdAt, updatedAt, now, sourceVersion) {
     const localFallback = updatedAt || createdAt || now;
     if (Array.isArray(record.evidenceHistory)) {
-        return normalizeEvidenceHistory(record.evidenceHistory, { source: DEFAULT_EVIDENCE_SOURCE, fallback: localFallback });
+        return normalizeEvidenceHistory(record.evidenceHistory, {
+            source: DEFAULT_EVIDENCE_SOURCE,
+            fallback: localFallback,
+            ...(sourceVersion === undefined ? {} : { sourceVersion }),
+        });
     }
     return [];
 }
@@ -34,7 +40,7 @@ function normalizeCaseEvidence(record, createdAt, updatedAt, now) {
  * @param {string} [nowIso]
  * @returns {CaseRecord | null}
  */
-export function normalizeCase(raw, existing, nowIso) {
+export function normalizeCase(raw, existing, nowIso, sourceVersion) {
     const now = nowIso || new Date().toISOString();
     const record = objectRecord(raw);
     const domain = normalizeDomain(existing ? existing.domain : record.domain);
@@ -44,22 +50,27 @@ export function normalizeCase(raw, existing, nowIso) {
     const updatedAt = isoOrNow(record.updatedAt, now);
     const evidencePins = normalizeCaseEvidencePins(record.evidencePins, updatedAt);
     const pinIds = new Set(evidencePins.map((item) => item.id));
+    const actions = normalizeCaseActions(record.actions, updatedAt);
+    const assertions = normalizeCaseAssertions(record.assertions, updatedAt, pinIds);
+    const branchReferences = caseInvestigationBranchReferences({ evidencePins, actions, assertions });
     return {
         id: existing ? existing.id : safeId(record.id) || deterministicId(domain),
         domain,
         status: normalizeStatus(record.status),
         disposition: normalizeDisposition(record.disposition),
         reviewReasonCode: normalizeReviewReasonCode(record.reviewReasonCode),
+        brandProfileIds: normalizeCaseBrandProfileIds(record.brandProfileIds),
         tags: normalizeTags(record.tags),
         notes: normalizeNotes(record.notes, now),
         source: normalizeSource(record.source),
-        evidenceHistory: normalizeCaseEvidence(record, createdAt, updatedAt, now),
+        evidenceHistory: normalizeCaseEvidence(record, createdAt, updatedAt, now, sourceVersion),
         evidencePins,
         decisions: normalizeCaseDecisions(record.decisions, updatedAt, pinIds),
-        actions: normalizeCaseActions(record.actions, updatedAt),
-        assertions: normalizeCaseAssertions(record.assertions, updatedAt, pinIds),
+        actions,
+        assertions,
         manualTrail: normalizeCaseManualTrail(record.manualTrail, updatedAt),
         sightings: normalizeCaseSightings(record.sightings, updatedAt, pinIds),
+        branches: normalizeCaseInvestigationBranches(record.branches, updatedAt, branchReferences),
         createdAt,
         updatedAt,
     };
@@ -82,12 +93,20 @@ export function createCase(input, nowIso) {
             ? appendCaseEvidencePin([], input.evidencePin, now)
             : [];
     const pinIds = new Set(evidencePins.map((item) => item.id));
+    const actions = input.action !== undefined
+        ? appendCaseAction([], input.action, now)
+        : [];
+    const assertions = input.assertion !== undefined
+        ? appendCaseAssertion([], input.assertion, now)
+        : [];
+    const branchReferences = caseInvestigationBranchReferences({ evidencePins, actions, assertions });
     return {
         id: makeId(),
         domain,
         status: normalizeStatus(input.status),
         disposition: normalizeDisposition(input.disposition),
         reviewReasonCode: normalizeReviewReasonCode(input.reviewReasonCode),
+        brandProfileIds: input.brandProfileIds === undefined ? [] : assertCaseBrandProfileIds(input.brandProfileIds),
         tags: normalizeTags(input.tags),
         notes: noteBody ? [{ id: makeId(), body: noteBody, createdAt: now }] : [],
         source,
@@ -99,18 +118,17 @@ export function createCase(input, nowIso) {
         decisions: input.decision !== undefined
             ? appendCaseDecision([], input.decision, now)
             : [],
-        actions: input.action !== undefined
-            ? appendCaseAction([], input.action, now)
-            : [],
-        assertions: input.assertion !== undefined
-            ? appendCaseAssertion([], input.assertion, now)
-            : [],
+        actions,
+        assertions,
         manualTrail: input.trailEvent !== undefined
             ? appendCaseManualTrailEvent([], input.trailEvent, now)
             : [],
         sightings: input.sighting !== undefined
             ? appendCaseSighting([], input.sighting, now, pinIds)
             : [],
+        branches: input.branch !== undefined
+            ? appendCaseInvestigationBranch([], input.branch, now, branchReferences)
+            : [],
         createdAt: now,
         updatedAt: now,
     };
@@ -196,6 +214,14 @@ export function updateCase(cases, id, patch, nowIso) {
     if (patch.assertionUpdate !== undefined) {
         assertions = updateCaseAssertion(assertions, patch.assertionUpdate, now, pinIds);
     }
+    const branchReferences = caseInvestigationBranchReferences({ evidencePins, actions, assertions });
+    let branches = normalizeCaseInvestigationBranches(current.branches ?? [], current.updatedAt, branchReferences);
+    if (patch.branch !== undefined) {
+        branches = appendCaseInvestigationBranch(branches, patch.branch, now, branchReferences);
+    }
+    if (patch.branchUpdate !== undefined) {
+        branches = updateCaseInvestigationBranch(branches, patch.branchUpdate, now, branchReferences);
+    }
     let manualTrail = current.manualTrail;
     if (patch.trailEvent !== undefined) {
         manualTrail = appendCaseManualTrailEvent(current.manualTrail, patch.trailEvent, now);
@@ -211,6 +237,9 @@ export function updateCase(cases, id, patch, nowIso) {
         reviewReasonCode: patch.reviewReasonCode !== undefined
             ? normalizeReviewReasonCode(patch.reviewReasonCode)
             : current.reviewReasonCode ?? null,
+        brandProfileIds: patch.brandProfileIds !== undefined
+            ? assertCaseBrandProfileIds(patch.brandProfileIds)
+            : current.brandProfileIds,
         tags: patch.tags !== undefined ? normalizeTags(patch.tags) : current.tags,
         source,
         evidenceHistory,
@@ -220,6 +249,7 @@ export function updateCase(cases, id, patch, nowIso) {
         assertions,
         manualTrail,
         sightings,
+        branches,
         notes,
         updatedAt: now,
     };

package/frontend/src/lib/analysis/case-report.js

@@ -11,19 +11,21 @@
 import { caseEvidenceIncomparableReasons, compareCaseEvidence, latestCaseEvidence } from "./case-model.js";
 import { httpSecurityHeaderLabel } from "./http-summary.js";
 import { analystInteroperabilityTags } from "../../../../lib/analyst-taxonomy.mjs";
+import { buildPortableGeneratorMetadata, portableGeneratorAttribution, } from "../../../../lib/portable-generator.mjs";
 import { CASE_EVIDENCE_RELATION_STANCES } from "./case-response-model.js";
+import { normalizeCaseBrandProfileIds } from "./case-brand-profile-references.js";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
 export const CASE_REPORT_SCHEMA = 'whoisleuth.case-report';
-export const CASE_REPORT_SCHEMA_VERSION = 6;
-const APPLICATION_NAME = 'WHOISleuth';
+export const CASE_REPORT_SCHEMA_VERSION = 8;
 const LIMITATIONS_TEXT = [
     'This report contains normalised browser-local observations from WHOISleuth analyst cases.',
     'It is not a live lookup and does not contain raw WHOIS, RDAP, DNS, HTML, or responses collected during website checks.',
     'Absence of a signal (e.g. no MX record observed) does not prove nonexistence. It may not have been evaluated.',
     'Snapshot fingerprints are deduplication identifiers, not cryptographic evidence hashes.',
     'Scan-depth and scoring-model gates prevent misleading comparisons; "incomparable" means observations differ materially but one or more fields cannot be compared reliably.',
+    'Brand Profile references record an explicit analyst-selected association only; they do not establish ownership, attribution, intent, safety, or maliciousness.',
     'Generated locally in the browser. Review the package before sharing it.',
 ].join(' ');
 function escapeMarkdownInline(text) {
@@ -139,6 +141,8 @@ function pickKnownSnapshotFields(snapshot) {
         idnReferenceMatch: snapshot.idnReferenceMatch ?? null,
         pageBaselineMatch: snapshot.pageBaselineMatch ?? null,
         hasActiveBrandProfile: snapshot.hasActiveBrandProfile ?? null,
+        profileContextState: snapshot.profileContextState ?? null,
+        profileContextLimitation: snapshot.profileContextLimitation ?? null,
         mutationTypes: Array.isArray(snapshot.mutationTypes) ? [...snapshot.mutationTypes] : [],
     };
 }
@@ -158,6 +162,7 @@ export function buildCaseReport(caseRecord, options = {}) {
     const { generatedAt } = options;
     const includeNotes = options.includeNotes === true;
     const now = generatedAt || new Date().toISOString();
+    const generator = buildPortableGeneratorMetadata(options.applicationVersion);
     // --- Build JSON report ---
     const timelineEntries = [];
     if (Array.isArray(caseRecord.evidenceHistory) && caseRecord.evidenceHistory.length > 0) {
@@ -207,13 +212,14 @@ export function buildCaseReport(caseRecord, options = {}) {
         schema: CASE_REPORT_SCHEMA,
         schemaVersion: CASE_REPORT_SCHEMA_VERSION,
         generatedAt: now,
-        application: { name: APPLICATION_NAME },
+        application: generator,
         case: {
             id: caseRecord.id,
             domain: caseRecord.domain,
             status: caseRecord.status,
             disposition: caseRecord.disposition,
             reviewReasonCode: caseRecord.reviewReasonCode ?? null,
+            brandProfileIds: normalizeCaseBrandProfileIds(caseRecord.brandProfileIds),
             interoperabilityTags: analystInteroperabilityTags(caseRecord.disposition, caseRecord.reviewReasonCode),
             tags: Array.isArray(caseRecord.tags) ? [...caseRecord.tags] : [],
             source: caseRecord.source,
@@ -242,11 +248,18 @@ export function buildCaseReport(caseRecord, options = {}) {
             })),
             manualTrail: caseRecord.manualTrail.map((item) => ({ ...item })),
             sightings: caseRecord.sightings.map((item) => ({ ...item, limitations: [...item.limitations] })),
+            branches: (caseRecord.branches ?? []).map((item) => ({
+                ...item,
+                evidencePinIds: [...item.evidencePinIds],
+                checkpointIds: [...item.checkpointIds],
+                assertionIds: [...item.assertionIds],
+                actionIds: [...item.actionIds],
+            })),
         },
         limitations: LIMITATIONS_TEXT,
     };
     // --- Build Markdown ---
-    const md = buildMarkdown(json);
+    const md = buildMarkdown(json, options.includeAttribution !== false);
     return { json, markdown: md };
 }
 // ---------------------------------------------------------------------------
@@ -257,7 +270,7 @@ export function buildCaseReport(caseRecord, options = {}) {
  * @param {object} report
  * @returns {string}
  */
-function buildMarkdown(report) {
+function buildMarkdown(report, includeAttribution) {
     const lines = [];
     // Title
     const domain = escapeMarkdownInline(report.case.domain || 'unknown');
@@ -276,6 +289,7 @@ function buildMarkdown(report) {
     lines.push(`| Disposition | ${escapeMarkdownInline(report.case.disposition)} |`);
     if (report.case.reviewReasonCode)
         lines.push(`| Review reason | ${escapeMarkdownInline(report.case.reviewReasonCode.replaceAll('_', ' '))} |`);
+    lines.push(`| Brand Profile references | ${report.case.brandProfileIds.length ? escapeMarkdownInline(report.case.brandProfileIds.join(', ')) : 'None'} |`);
     lines.push(`| Source | ${escapeMarkdownInline(report.case.source)} |`);
     lines.push(`| Opened | ${escapeMarkdownInline(report.case.openedAt)} |`);
     lines.push(`| Updated | ${escapeMarkdownInline(report.case.updatedAt)} |`);
@@ -292,6 +306,9 @@ function buildMarkdown(report) {
         lines.push(`- **Availability:** ${escapeMarkdownInline(formatReportValue(a.availability))}`);
         lines.push(`- **Risk score:** ${escapeMarkdownInline(formatReportValue(a.riskScore))}`);
         lines.push(`- **Risk model:** ${a.riskModelVersion === null ? 'Unversioned' : `v${escapeMarkdownInline(formatReportValue(a.riskModelVersion))}`}`);
+        lines.push(`- **Brand Profile context:** ${escapeMarkdownInline(formatReportValue(a.profileContextState))}`);
+        if (a.profileContextLimitation)
+            lines.push(`- **Profile-context limitation:** ${escapeMarkdownInline(a.profileContextLimitation)}`);
         lines.push(`- **Opportunity model:** ${a.opportunityModelVersion == null ? 'Unversioned' : `v${escapeMarkdownInline(formatReportValue(a.opportunityModelVersion))}`}`);
         lines.push(`- **Registrar:** ${escapeMarkdownInline(formatReportValue(a.registrar))}`);
         lines.push(`- **Website activity:** ${escapeMarkdownInline(formatReportValue(a.activityStatus))}`);
@@ -342,6 +359,9 @@ function buildMarkdown(report) {
             lines.push(`- Availability: ${escapeMarkdownInline(formatReportValue(snap.availability))}`);
             lines.push(`- Risk score: ${escapeMarkdownInline(formatReportValue(snap.riskScore))}`);
             lines.push(`- Risk model: ${snap.riskModelVersion === null ? 'Unversioned' : `v${escapeMarkdownInline(formatReportValue(snap.riskModelVersion))}`}`);
+            lines.push(`- Brand Profile context: ${escapeMarkdownInline(formatReportValue(snap.profileContextState))}`);
+            if (snap.profileContextLimitation)
+                lines.push(`- Profile-context limitation: ${escapeMarkdownInline(snap.profileContextLimitation)}`);
             lines.push(`- Registrar: ${escapeMarkdownInline(formatReportValue(snap.registrar))}`);
             lines.push(`- Website activity: ${escapeMarkdownInline(formatReportValue(snap.activityStatus))}`);
             if (snap.httpResponseStatus != null)
@@ -411,7 +431,7 @@ function buildMarkdown(report) {
     lines.push('## Analyst Decision Packet');
     lines.push('');
     const response = report.analystResponse;
-    if (!response.evidencePins.length && !response.sightings.length && !response.decisions.length && !response.actions.length && !response.assertions.length && !response.manualTrail.length) {
+    if (!response.evidencePins.length && !response.sightings.length && !response.decisions.length && !response.actions.length && !response.assertions.length && !response.manualTrail.length && !response.branches.length) {
         lines.push('No evidence pins, source-qualified sightings, structured assertions, decision records, case actions, or manual investigation steps recorded.');
         lines.push('');
     }
@@ -511,6 +531,15 @@ function buildMarkdown(report) {
                 lines.push(`  Contact limitations: ${escapeMarkdownInline(action.contactLimitations.join('; '))}`);
         }
         lines.push('');
+        lines.push('### Investigation branches');
+        lines.push('');
+        if (!response.branches.length)
+            lines.push('No named investigation branches recorded.');
+        for (const branch of response.branches) {
+            lines.push(`- **${escapeMarkdownInline(branch.name)}** (${escapeMarkdownInline(branch.state)}; updated ${escapeMarkdownInline(branch.updatedAt)})`);
+            lines.push(`  References: ${branch.evidencePinIds.length} evidence pins; ${branch.checkpointIds.length} checkpoints; ${branch.assertionIds.length} assertions; ${branch.actionIds.length} actions.`);
+        }
+        lines.push('');
         lines.push('### Explicit investigation trail');
         lines.push('');
         if (!response.manualTrail.length)
@@ -542,6 +571,10 @@ function buildMarkdown(report) {
     lines.push('');
     lines.push(LIMITATIONS_TEXT);
     lines.push('');
+    if (includeAttribution) {
+        lines.push(portableGeneratorAttribution(report.application));
+        lines.push('');
+    }
     return lines.join('\n');
 }
 // ---------------------------------------------------------------------------

package/frontend/src/lib/analysis/case-response-model.js

@@ -89,6 +89,7 @@ const ASSERTION_EXTERNAL_ENTITY_TYPES = new Set(CASE_ASSERTION_EXTERNAL_ENTITY_T
 const TRAIL_KINDS = new Set(CASE_MANUAL_TRAIL_KINDS);
 const SIGHTING_STATES = new Set(CASE_SIGHTING_STATES);
 const SIGHTING_CATEGORIES = new Set(CASE_SIGHTING_CATEGORIES);
+const SHA256_RE = /^[a-f0-9]{64}$/u;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -159,6 +160,54 @@ function sourceSchema(value) {
         : null;
     return collection && schema && version !== null ? { collection, schema, version } : null;
 }
+function certificateObservation(value, pin) {
+    const item = record(value);
+    if (!Object.keys(item).length)
+        return null;
+    const keys = new Set([
+        'eventId',
+        'logId',
+        'certificateSha256',
+        'issuer',
+        'notAfter',
+        'dnsNameCount',
+        'namesComplete',
+    ]);
+    if (Object.keys(item).some((key) => !keys.has(key)))
+        return null;
+    if (pin.sourceSchema?.collection !== 'external_observations'
+        || pin.sourceSchema.schema !== 'whoisleuth.certificate-observation-rows'
+        || (pin.field !== 'certificateSha256' && pin.field !== 'fingerprintSha256'))
+        return null;
+    const eventId = text(item.eventId, 64);
+    const logId = text(item.logId, 200);
+    const certificateSha256 = text(item.certificateSha256, 64).toLowerCase();
+    const issuer = item.issuer === null ? null : text(item.issuer, 160) || null;
+    const notAfter = item.notAfter === null ? null : optionalIso(item.notAfter);
+    const dnsNameCount = typeof item.dnsNameCount === 'number'
+        && Number.isSafeInteger(item.dnsNameCount)
+        && item.dnsNameCount >= 1
+        && item.dnsNameCount <= 100
+        ? item.dnsNameCount
+        : null;
+    if (!SAFE_ID_RE.test(eventId)
+        || !logId
+        || !SHA256_RE.test(certificateSha256)
+        || certificateSha256 !== pin.value.toLowerCase()
+        || dnsNameCount === null
+        || typeof item.namesComplete !== 'boolean'
+        || (item.notAfter !== null && notAfter === null))
+        return null;
+    return {
+        eventId,
+        logId,
+        certificateSha256,
+        issuer,
+        notAfter,
+        dnsNameCount,
+        namesComplete: item.namesComplete,
+    };
+}
 function uniqueIds(value, validIds) {
     if (!Array.isArray(value))
         return [];
@@ -196,25 +245,27 @@ function normalizeEvidenceRelations(value, legacyIds, validIds) {
     }
     return [...output].map(([evidencePinId, stance]) => ({ evidencePinId, stance }));
 }
-function normalizePin(raw, fallback) {
+function normalizePin(raw, fallback, options = {}) {
     const item = record(raw);
     const label = text(item.label, MAX_RESPONSE_LABEL_LENGTH);
     const value = text(item.value, MAX_RESPONSE_VALUE_LENGTH);
     if (!label || !value)
         return null;
     const createdAt = iso(item.createdAt, fallback);
-    return {
+    const normalizedSourceSchema = sourceSchema(item.sourceSchema);
+    const normalizedField = text(item.field, 120) || null;
+    const normalized = {
         id: safeId(item.id, 'pin', { label, value, createdAt }),
         checkpointId: typeof item.checkpointId === 'string' && SAFE_ID_RE.test(item.checkpointId)
             ? item.checkpointId
             : null,
-        field: text(item.field, 120) || null,
+        field: normalizedField,
         category: text(item.category, 80) || null,
         label,
         value,
         source: text(item.source, MAX_RESPONSE_LABEL_LENGTH) || 'analyst_selected',
         sourceState: text(item.sourceState, 40) || null,
-        sourceSchema: sourceSchema(item.sourceSchema),
+        sourceSchema: normalizedSourceSchema,
         observedAt: iso(item.observedAt, createdAt),
         collectionDepth: item.collectionDepth === 'deep' || item.collectionDepth === 'fast'
             ? item.collectionDepth
@@ -230,13 +281,21 @@ function normalizePin(raw, fallback) {
         limitations: limitations(item.limitations),
         createdAt,
     };
-}
-export function normalizeCaseEvidencePins(raw, fallback) {
+    normalized.certificateObservation = options.allowCertificateObservation === false
+        ? null
+        : certificateObservation(item.certificateObservation, {
+            field: normalizedField,
+            value,
+            sourceSchema: normalizedSourceSchema,
+        });
+    return normalized;
+}
+export function normalizeCaseEvidencePins(raw, fallback, options = {}) {
     if (!Array.isArray(raw))
         return [];
     const byId = new Map();
     for (const item of raw.slice(0, MAX_CASE_EVIDENCE_PINS * 2)) {
-        const normalized = normalizePin(item, fallback);
+        const normalized = normalizePin(item, fallback, options);
         if (normalized && !byId.has(normalized.id))
             byId.set(normalized.id, normalized);
     }