@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/cli/case-pack.mjs

@@ -1,22 +1,671 @@
 import { createHash } from 'node:crypto';
 import { Buffer } from 'node:buffer';
-import { canonicalArtifactJson } from "../frontend/src/lib/analysis/artifact-integrity.js";
-import { buildCaseReport } from "../frontend/src/lib/analysis/case-report.js";
-import { CASE_IMPORT_VERSIONS, MAX_CASE_IMPORT_BYTES, CASE_SCHEMA_VERSION, normalizeCaseStore, } from "../frontend/src/lib/analysis/case-model.js";
+import { canonicalArtifactJson, canonicalArtifactJsonFor, canonicalArtifactJsonV2, resolveArtifactCanonicalization, SORTED_JSON_V1, SORTED_JSON_V2, } from "../frontend/src/lib/analysis/artifact-integrity.js";
+import { buildCaseReport, CASE_REPORT_SCHEMA, CASE_REPORT_SCHEMA_VERSION, } from "../frontend/src/lib/analysis/case-report.js";
+import { WHOISLEUTH_APPLICATION_VERSION } from "../lib/application-version.mjs";
+import { CASE_IMPORT_VERSIONS, CONCLUSIVE_AVAILABILITY, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_CASE_IMPORT_BYTES, CASE_SCHEMA_VERSION, assertCaseBrandProfileIds, caseEvidenceIncomparableReasons, compareCaseEvidence, hashString, normalizeDomain, normalizeCaseStore, normalizeSnapshot, safeId, } from "../frontend/src/lib/analysis/case-model.js";
+import { buildPortableGeneratorMetadata } from "../lib/portable-generator.mjs";
+import { analystInteroperabilityTags } from "../lib/analyst-taxonomy.mjs";
 import { CliUsageError } from "./errors.mjs";
 export const CLI_CASE_PACK_SCHEMA = 'whoisleuth.cli.case-pack';
-export const CLI_CASE_PACK_VERSION = 1;
+export const CLI_CASE_PACK_VERSION = 2;
+export const LEGACY_CLI_CASE_PACK_VERSION = 1;
 export const MAX_CASE_PACK_INPUT_BYTES = 4 * 1024 * 1024;
 export const MAX_CASE_PACK_CASES = 25;
+const MAX_CASE_PACK_REFERENCE_SCAN_DEPTH = 64;
+const LEGACY_CASE_REPORT_VERSIONS = Object.freeze([1, 2, 3, 4, 5, 6, 7]);
+const INTERNAL_EXCLUSIONS = Object.freeze(['Raw upstream payloads and credentials are outside the case schema.']);
+const TRUSTED_EXCLUSIONS = Object.freeze(['Case notes', 'Recipient values', 'Manual trail targets', 'Raw upstream payloads and credentials']);
+const PUBLIC_EXCLUSIONS_V10 = Object.freeze(['Case notes', 'Actions and recipient values', 'Analyst assertions', 'Manual trail targets', 'Raw upstream payloads and credentials']);
+const PUBLIC_EXCLUSIONS_V11 = Object.freeze([...PUBLIC_EXCLUSIONS_V10.slice(0, 3), 'Investigation branches', ...PUBLIC_EXCLUSIONS_V10.slice(3)]);
+const PUBLIC_EXCLUSIONS = Object.freeze(['Case notes', 'Brand Profile references', ...PUBLIC_EXCLUSIONS_V11.slice(1)]);
+const SENSITIVE_CASE_PACK_FIELDS = Object.freeze(['brandProfileIds', 'notes', 'actions', 'assertions', 'manualTrail', 'branches', 'recipient', 'target']);
+const ROOT_KEYS = Object.freeze(['version', 'exportedAt', 'cases', 'packet', 'integrity']);
+const PACKET_KEYS = Object.freeze(['schema', 'version', 'audience', 'reviewed', 'reports', 'redactionManifest', 'limitations']);
+const REPORT_KEYS = Object.freeze(['schema', 'schemaVersion', 'generatedAt', 'application', 'case', 'currentAssessment', 'evidenceTimeline', 'analystResponse', 'limitations']);
+const INTEGRITY_KEYS = Object.freeze(['algorithm', 'canonicalization', 'digestSha256']);
+const PACKET_LIMITATIONS = Object.freeze([
+    'This local package is browser-importable through its top-level case collection and does not upload or submit evidence.',
+    'The reviewed flag records a deliberate CLI choice; it does not prove recipient authorisation, factual correctness, or legal sufficiency.',
+    'Importing the package does not restore fields excluded by its audience profile.',
+]);
+const LEGACY_RISK_MODEL_LIMITATION = 'This report contains normalized browser-local observations from WHOISleuth analyst cases. It is not a live lookup and does not contain raw WHOIS, RDAP, DNS, HTML, or responses collected during website checks. Absence of a signal (e.g. no MX record observed) does not prove nonexistence. It may not have been evaluated. Snapshot fingerprints are deduplication identifiers, not cryptographic evidence hashes. Scan-depth and risk-model gates prevent misleading comparisons; "incomparable" means observations differ materially but one or more fields cannot be compared reliably. Generated locally in the browser. Review the package before sharing it.';
+const LEGACY_SCORING_MODEL_LIMITATION = 'This report contains normalized browser-local observations from WHOISleuth analyst cases. It is not a live lookup and does not contain raw WHOIS, RDAP, DNS, HTML, or responses collected during website checks. Absence of a signal (e.g. no MX record observed) does not prove nonexistence. It may not have been evaluated. Snapshot fingerprints are deduplication identifiers, not cryptographic evidence hashes. Scan-depth and scoring-model gates prevent misleading comparisons; "incomparable" means observations differ materially but one or more fields cannot be compared reliably. Generated locally in the browser. Review the package before sharing it.';
+const LEGACY_PORTABLE_LIMITATION = 'This report contains normalised browser-local observations from WHOISleuth analyst cases. It is not a live lookup and does not contain raw WHOIS, RDAP, DNS, HTML, or responses collected during website checks. Absence of a signal (e.g. no MX record observed) does not prove nonexistence. It may not have been evaluated. Snapshot fingerprints are deduplication identifiers, not cryptographic evidence hashes. Scan-depth and scoring-model gates prevent misleading comparisons; "incomparable" means observations differ materially but one or more fields cannot be compared reliably. Generated locally in the browser. Review the package before sharing it.';
+const LEGACY_REPORT_LIMITATION_BY_VERSION = new Map([
+    [1, LEGACY_RISK_MODEL_LIMITATION],
+    [2, LEGACY_RISK_MODEL_LIMITATION],
+    [3, LEGACY_RISK_MODEL_LIMITATION],
+    [4, LEGACY_RISK_MODEL_LIMITATION],
+    [5, LEGACY_SCORING_MODEL_LIMITATION],
+    [6, LEGACY_PORTABLE_LIMITATION],
+    [7, LEGACY_PORTABLE_LIMITATION],
+]);
+const HISTORICAL_BASE_MATERIAL_FIELDS = Object.freeze([
+    'scanDepth',
+    'availability', 'confidence', 'riskModelVersion', 'riskScore', 'opportunityScore',
+    'riskFactors', 'opportunityFactors',
+    'registrar', 'createdDate', 'expiryDate', 'nameservers',
+    'hasMx', 'hasSpf', 'hasDmarc',
+    'activityStatus', 'websiteProbeDetail', 'pageTitle',
+    'httpSummaryVersion', 'httpEvidenceStatus', 'httpFinalOrigin', 'httpResponseStatus', 'httpTransportSecurity', 'httpRedirectCount',
+    'httpCrossOriginRedirect', 'httpHttpsDowngrade', 'httpContentType', 'httpSecurityHeaders',
+    'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets', 'hasPasswordField', 'phishingLanguageMatch',
+    'mutationTypes',
+]);
+const HISTORICAL_EXTERNAL_FORM_MATERIAL_FIELDS = Object.freeze([
+    ...HISTORICAL_BASE_MATERIAL_FIELDS.slice(0, -2),
+    'hasExternalFormAction',
+    ...HISTORICAL_BASE_MATERIAL_FIELDS.slice(-2),
+]);
+const HISTORICAL_CONTEXT_MATERIAL_FIELDS = Object.freeze([
+    'scanDepth',
+    'availability', 'confidence', 'riskModelVersion', 'riskScore', 'opportunityModelVersion', 'opportunityScore',
+    'riskFactors', 'opportunityFactors',
+    'registrar', 'createdDate', 'expiryDate', 'nameservers',
+    'hasMx', 'hasSpf', 'hasDmarc',
+    'activityStatus', 'websiteProbeDetail', 'pageTitle',
+    'httpSummaryVersion', 'httpEvidenceStatus', 'httpFinalOrigin', 'httpResponseStatus', 'httpTransportSecurity', 'httpRedirectCount',
+    'httpCrossOriginRedirect', 'httpHttpsDowngrade', 'httpContentType', 'httpSecurityHeaders',
+    'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets', 'hasPasswordField', 'hasExternalFormAction', 'phishingLanguageMatch',
+    'privacyProtected', 'idnReferenceMatch', 'pageBaselineMatch', 'hasActiveBrandProfile',
+    'mutationTypes',
+]);
+const HISTORICAL_CHANGE_ORDER = Object.freeze([
+    'availability', 'confidence', 'riskScore', 'riskFactors', 'opportunityScore', 'opportunityFactors',
+    'registrar', 'createdDate', 'expiryDate', 'nameservers', 'hasMx', 'hasSpf', 'hasDmarc',
+    'activityStatus', 'websiteProbeDetail', 'pageTitle', 'httpEvidenceStatus', 'httpFinalOrigin',
+    'httpResponseStatus', 'httpTransportSecurity', 'httpRedirectCount', 'httpCrossOriginRedirect',
+    'httpHttpsDowngrade', 'httpContentType', 'httpSecurityHeaders', 'faviconMatch', 'faviconNearMatch',
+    'reusesOfficialAssets', 'hasPasswordField', 'hasExternalFormAction', 'phishingLanguageMatch', 'mutationTypes',
+]);
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function expectedExclusions(audience, caseVersion) {
+    if (audience === 'internal')
+        return INTERNAL_EXCLUSIONS;
+    if (audience === 'trusted')
+        return TRUSTED_EXCLUSIONS;
+    if (caseVersion >= 12)
+        return PUBLIC_EXCLUSIONS;
+    return caseVersion === 11 ? PUBLIC_EXCLUSIONS_V11 : PUBLIC_EXCLUSIONS_V10;
+}
+function stringListsMatch(value, expected) {
+    return Array.isArray(value)
+        && value.length === expected.length
+        && value.every((item, index) => item === expected[index]);
+}
+function assertOnlyKeys(value, allowed, label) {
+    const allowedKeys = new Set(allowed);
+    if (Object.keys(value).some((key) => !allowedKeys.has(key))) {
+        throw new TypeError(`The CLI case pack contains an unexpected ${label} field.`);
+    }
+}
+function jsonNodeKind(value) {
+    if (value === null)
+        return 'null';
+    if (Array.isArray(value))
+        return 'array';
+    return typeof value === 'object' ? 'object' : 'scalar';
+}
+/** Historical records may omit later object fields, but every retained value must match the bounded projection. */
+function assertProjectionKeys(actual, projection, path, depth = 0) {
+    if (depth > MAX_CASE_PACK_REFERENCE_SCAN_DEPTH) {
+        throw new TypeError('The CLI case pack exceeds its bounded projection depth.');
+    }
+    const actualKind = jsonNodeKind(actual);
+    const projectionKind = jsonNodeKind(projection);
+    if (actualKind !== projectionKind) {
+        throw new TypeError(`The CLI case pack contains an invalid ${path} projection node.`);
+    }
+    if (actualKind === 'array') {
+        const actualArray = actual;
+        const projectionArray = projection;
+        if (actualArray.length > projectionArray.length) {
+            throw new TypeError(`The CLI case pack contains data outside its normalised ${path} projection.`);
+        }
+        for (let index = 0; index < actualArray.length; index++) {
+            const expected = projectionArray[index];
+            if (expected === undefined) {
+                throw new TypeError(`The CLI case pack contains data outside its normalised ${path} projection.`);
+            }
+            assertProjectionKeys(actualArray[index], expected, `${path}[${index}]`, depth + 1);
+        }
+        return;
+    }
+    if (actualKind === 'object') {
+        const actualRecord = actual;
+        const projectionRecord = record(projection);
+        if (!projectionRecord)
+            throw new TypeError(`The CLI case pack contains an invalid ${path} projection.`);
+        for (const key of Object.keys(actualRecord)) {
+            if (!Object.hasOwn(projectionRecord, key)) {
+                throw new TypeError(`The CLI case pack contains an unexpected ${path}.${key} field.`);
+            }
+            assertProjectionKeys(actualRecord[key], projectionRecord[key], `${path}.${key}`, depth + 1);
+        }
+        return;
+    }
+    if (!canonicalValuesMatch(actual, projection)) {
+        throw new TypeError(`The CLI case pack contains a changed or unbounded ${path} projection value.`);
+    }
+}
+function assertClosedEnvelopes(root, packet, integrity, redactionManifest, reports, current) {
+    assertOnlyKeys(root, ROOT_KEYS, 'root envelope');
+    assertOnlyKeys(packet, PACKET_KEYS, 'packet envelope');
+    assertOnlyKeys(integrity, INTEGRITY_KEYS, 'integrity envelope');
+    assertOnlyKeys(redactionManifest, current ? ['excluded', 'sourceCaseCount', 'brandProfileReferencesOmitted'] : ['excluded', 'sourceCaseCount'], 'redaction manifest');
+    if (!stringListsMatch(packet.limitations, PACKET_LIMITATIONS)) {
+        throw new TypeError('The CLI case pack contains an invalid packet limitation manifest.');
+    }
+    for (const value of reports) {
+        const report = record(value);
+        if (!report)
+            throw new TypeError('The CLI case pack contains an invalid Case report envelope.');
+        assertOnlyKeys(report, REPORT_KEYS, 'Case report envelope');
+    }
+}
+function topCasePath(path) {
+    return path.length === 2 && path[0] === 'cases' && typeof path[1] === 'number';
+}
+function reportCasePath(path) {
+    return path.length === 4 && path[0] === 'packet' && path[1] === 'reports'
+        && typeof path[2] === 'number' && path[3] === 'case';
+}
+function analystResponsePath(path) {
+    return path.length === 4 && path[0] === 'packet' && path[1] === 'reports'
+        && typeof path[2] === 'number' && path[3] === 'analystResponse';
+}
+function listItemPath(path, list) {
+    return (path.length === 4 && path[0] === 'cases' && typeof path[1] === 'number' && path[2] === list && typeof path[3] === 'number')
+        || (path.length === 6 && path[0] === 'packet' && path[1] === 'reports' && typeof path[2] === 'number'
+            && path[3] === 'analystResponse' && path[4] === list && typeof path[5] === 'number');
+}
+function allowedSensitiveFieldPath(key, path, current) {
+    if (key === 'brandProfileIds')
+        return current && (topCasePath(path) || reportCasePath(path));
+    if (key === 'notes')
+        return topCasePath(path) || reportCasePath(path);
+    if (key === 'actions' || key === 'assertions' || key === 'manualTrail' || key === 'branches') {
+        return topCasePath(path) || analystResponsePath(path);
+    }
+    if (key === 'recipient')
+        return listItemPath(path, 'actions');
+    if (key === 'target')
+        return listItemPath(path, 'manualTrail');
+    return true;
+}
+/** Rejects hidden audience-sensitive copies with a budget proven by the serialized byte bound. */
+function assertSensitiveFieldPlacement(root, current, serializedLength) {
+    const stack = [{ value: root, path: [], depth: 0 }];
+    const visited = new Set();
+    let inspected = 0;
+    while (stack.length) {
+        const entry = stack.pop();
+        if (!entry || !entry.value || typeof entry.value !== 'object')
+            continue;
+        for (const key of SENSITIVE_CASE_PACK_FIELDS) {
+            if (Object.hasOwn(entry.value, key) && !allowedSensitiveFieldPath(key, entry.path, current)) {
+                throw new TypeError('The CLI case pack contains audience-sensitive data outside its versioned case or report fields.');
+            }
+        }
+        if (visited.has(entry.value))
+            continue;
+        visited.add(entry.value);
+        inspected += 1;
+        if (inspected > serializedLength + 1 || entry.depth > MAX_CASE_PACK_REFERENCE_SCAN_DEPTH) {
+            throw new TypeError('The CLI case pack exceeds its bounded audience-field scan.');
+        }
+        if (Array.isArray(entry.value)) {
+            for (let index = entry.value.length - 1; index >= 0; index--) {
+                inspected += 1;
+                if (inspected > serializedLength + 1)
+                    throw new TypeError('The CLI case pack exceeds its bounded audience-field scan.');
+                stack.push({ value: entry.value[index], path: [...entry.path, index], depth: entry.depth + 1 });
+            }
+            continue;
+        }
+        try {
+            for (const key in entry.value) {
+                if (!Object.hasOwn(entry.value, key))
+                    continue;
+                inspected += 1;
+                if (inspected > serializedLength + 1)
+                    throw new TypeError('The CLI case pack exceeds its bounded audience-field scan.');
+                stack.push({ value: entry.value[key], path: [...entry.path, key], depth: entry.depth + 1 });
+            }
+        }
+        catch (cause) {
+            if (cause instanceof TypeError && /bounded audience-field scan/u.test(cause.message))
+                throw cause;
+            throw new TypeError('The CLI case pack could not be inspected safely for audience-sensitive data.');
+        }
+    }
+}
+function canonicalValuesMatch(left, right) {
+    try {
+        return canonicalArtifactJson(left) === canonicalArtifactJson(right);
+    }
+    catch {
+        return false;
+    }
+}
+function assertCanonicalCaseIdentities(cases, label) {
+    const ids = new Set();
+    const domains = new Set();
+    for (const value of cases) {
+        const item = record(value);
+        if (!item
+            || typeof item.id !== 'string'
+            || safeId(item.id) !== item.id
+            || typeof item.domain !== 'string'
+            || normalizeDomain(item.domain) !== item.domain
+            || ids.has(item.id)
+            || domains.has(item.domain)) {
+            throw new TypeError(`${label} contains a missing, unsafe, non-canonical, or duplicate Case identity.`);
+        }
+        ids.add(item.id);
+        domains.add(item.domain);
+    }
+}
+function assertCurrentCaseProjection(rawCases, normalised, label) {
+    if (rawCases.length !== normalised.length
+        || rawCases.some((item, index) => !canonicalValuesMatch(item, normalised[index]))) {
+        throw new TypeError(`${label} contains a schema 12 Case that would be repaired, truncated, or otherwise changed during normalisation.`);
+    }
+}
+function requiredHistoricalCaseKeys(caseVersion) {
+    return [
+        'id', 'domain', 'status', 'disposition', 'tags', 'notes', 'source', 'evidenceHistory', 'createdAt', 'updatedAt',
+        ...(caseVersion >= 3 ? ['evidencePins', 'decisions', 'actions'] : []),
+        ...(caseVersion >= 4 ? ['assertions', 'manualTrail'] : []),
+        ...(caseVersion >= 9 ? ['sightings'] : []),
+    ];
+}
+function assertHistoricalCaseOwnKeys(cases, caseVersion) {
+    const required = requiredHistoricalCaseKeys(caseVersion);
+    for (let index = 0; index < cases.length; index++) {
+        const item = record(cases[index]);
+        if (!item)
+            throw new TypeError(`The CLI case pack contains an invalid historical Case at cases[${index}].`);
+        const missing = required.find((key) => !Object.hasOwn(item, key));
+        if (missing) {
+            throw new TypeError(`The CLI case pack is missing required historical Case field cases[${index}].${missing}.`);
+        }
+    }
+}
+function reportVersionMatchesCase(caseVersion, reportVersion) {
+    if (!Number.isSafeInteger(reportVersion))
+        return false;
+    if (caseVersion === CASE_SCHEMA_VERSION)
+        return reportVersion === CASE_REPORT_SCHEMA_VERSION;
+    if (!LEGACY_CASE_REPORT_VERSIONS.includes(reportVersion))
+        return false;
+    if (caseVersion === 2)
+        return reportVersion === 1;
+    if (caseVersion === 3)
+        return reportVersion === 2;
+    if (caseVersion >= 4 && caseVersion <= 8)
+        return reportVersion === 3;
+    if (caseVersion === 9)
+        return reportVersion === 4;
+    if (caseVersion === 10)
+        return reportVersion === 5 || reportVersion === 6;
+    return caseVersion === 11 && reportVersion === 7;
+}
+function assertAudienceFields(value, audience, supportsBranches) {
+    if (!supportsBranches && Object.hasOwn(value, 'branches')) {
+        throw new TypeError('The CLI case pack contains an Investigation branch outside its versioned fields.');
+    }
+    if (audience === 'internal')
+        return;
+    if (Object.hasOwn(value, 'notes') && (!Array.isArray(value.notes) || value.notes.length !== 0)) {
+        throw new TypeError('The CLI case pack contains Case notes excluded by its audience.');
+    }
+    if (audience === 'public') {
+        for (const field of ['actions', 'assertions', ...(supportsBranches ? ['branches'] : [])]) {
+            if (Object.hasOwn(value, field) && (!Array.isArray(value[field]) || value[field].length !== 0)) {
+                throw new TypeError(`The public CLI case pack contains ${field} excluded by its audience.`);
+            }
+        }
+    }
+    else if (Object.hasOwn(value, 'actions')) {
+        if (!Array.isArray(value.actions) || value.actions.some((entry) => {
+            const action = record(entry);
+            return !action || (Object.hasOwn(action, 'recipient') && action.recipient !== '[redacted]');
+        })) {
+            throw new TypeError('The trusted CLI case pack contains an unredacted action recipient.');
+        }
+    }
+    if (Object.hasOwn(value, 'manualTrail')) {
+        if (!Array.isArray(value.manualTrail) || value.manualTrail.some((entry) => {
+            const event = record(entry);
+            return !event || (Object.hasOwn(event, 'target') && event.target !== null);
+        })) {
+            throw new TypeError('The CLI case pack contains a manual-trail target excluded by its audience.');
+        }
+    }
+}
+function reportApplicationVersion(report) {
+    return record(report.application)?.version;
+}
+function assertCurrentReportProjection(report, rawCase) {
+    if (typeof report.generatedAt !== 'string') {
+        throw new TypeError('The CLI case pack contains an invalid or mismatched Case report.');
+    }
+    const expected = buildCaseReport(rawCase, {
+        applicationVersion: reportApplicationVersion(report),
+        includeNotes: false,
+        generatedAt: report.generatedAt,
+    }).json;
+    if (!canonicalValuesMatch(report, expected)) {
+        throw new TypeError('The CLI case pack contains an invalid or mismatched Case report projection.');
+    }
+}
+function historicalMaterialFields(caseVersion) {
+    if (caseVersion <= 7)
+        return HISTORICAL_BASE_MATERIAL_FIELDS;
+    if (caseVersion <= 9)
+        return HISTORICAL_EXTERNAL_FORM_MATERIAL_FIELDS;
+    return HISTORICAL_CONTEXT_MATERIAL_FIELDS;
+}
+function historicalMaterialValue(field, snapshot) {
+    switch (field) {
+        case 'availability':
+            return typeof snapshot.availability === 'string' && CONCLUSIVE_AVAILABILITY.has(snapshot.availability)
+                ? snapshot.availability
+                : null;
+        case 'registrar':
+            return String(snapshot.registrar ?? '').toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim() || null;
+        case 'createdDate':
+        case 'expiryDate': {
+            const value = snapshot[field];
+            return typeof value === 'string' ? value.slice(0, 10) : null;
+        }
+        case 'riskFactors':
+        case 'opportunityFactors':
+            return snapshot[field].map((factor) => [factor.label, factor.points]);
+        default:
+            return snapshot[field] ?? null;
+    }
+}
+function historicalMaterialIsEmpty(value) {
+    if (value === null || value === undefined)
+        return true;
+    if (Array.isArray(value))
+        return value.length === 0;
+    return typeof value === 'string' ? value.trim() === '' : false;
+}
+/**
+ * Recreates the exact material identity used by each historical Case epoch.
+ * Current migration happens separately so adding schema-12 fields can never
+ * invalidate an authentic old fingerprint or make a forged one look valid.
+ */
+function normalizeHistoricalEvidenceHistory(rawHistory, caseVersion) {
+    if (!Array.isArray(rawHistory) || rawHistory.length > MAX_EVIDENCE_SNAPSHOTS_PER_CASE) {
+        throw new TypeError('The CLI case pack contains an invalid historical evidence collection.');
+    }
+    const fields = historicalMaterialFields(caseVersion);
+    const materialSeen = new Set();
+    const built = rawHistory.map((raw, index) => {
+        const rawSnapshot = record(raw);
+        const normalized = normalizeSnapshot(raw, { fallback: null, sourceVersion: caseVersion });
+        if (!rawSnapshot || !normalized) {
+            throw new TypeError(`The CLI case pack contains an invalid historical evidence snapshot ${index}.`);
+        }
+        const materialRecord = {};
+        let hasEvidence = false;
+        for (const field of fields) {
+            const value = historicalMaterialValue(field, normalized);
+            materialRecord[field] = value;
+            if (field !== 'scanDepth' && field !== 'confidence' && !historicalMaterialIsEmpty(value))
+                hasEvidence = true;
+        }
+        if (!hasEvidence) {
+            throw new TypeError(`The CLI case pack contains an empty historical evidence snapshot ${index}.`);
+        }
+        const material = JSON.stringify(materialRecord);
+        if (materialSeen.has(material)) {
+            throw new TypeError('The CLI case pack contains duplicate historical evidence material.');
+        }
+        materialSeen.add(material);
+        const fingerprint = hashString(material);
+        return {
+            material,
+            snapshot: {
+                id: `ev-${fingerprint}`,
+                fingerprint,
+                firstCapturedAt: normalized.firstCapturedAt,
+                capturedAt: normalized.capturedAt,
+                source: normalized.source,
+                ...Object.fromEntries(fields.map((field) => [field, normalized[field] ?? null])),
+            },
+            rawSnapshot,
+        };
+    });
+    built.sort((left, right) => (Date.parse(String(left.snapshot.capturedAt)) - Date.parse(String(right.snapshot.capturedAt))
+        || Date.parse(String(left.snapshot.firstCapturedAt)) - Date.parse(String(right.snapshot.firstCapturedAt))
+        || String(left.snapshot.fingerprint).localeCompare(String(right.snapshot.fingerprint))));
+    const usedIds = new Set();
+    for (const item of built) {
+        const base = String(item.snapshot.id);
+        let id = base;
+        let suffix = 2;
+        while (usedIds.has(id))
+            id = `${base}-${suffix++}`;
+        usedIds.add(id);
+        item.snapshot.id = id;
+    }
+    const projected = built.map((item) => item.snapshot);
+    assertProjectionKeys(rawHistory, projected, 'historical evidenceHistory');
+    for (let index = 0; index < built.length; index++) {
+        const item = built[index];
+        if (!item
+            || item.rawSnapshot.id !== item.snapshot.id
+            || item.rawSnapshot.fingerprint !== item.snapshot.fingerprint) {
+            throw new TypeError(`The CLI case pack contains an invalid historical evidence identity at snapshot ${index}.`);
+        }
+    }
+    return projected;
+}
+function historicalEvidenceChanges(previous, current, caseVersion) {
+    const previousSnapshot = previous;
+    const currentSnapshot = current;
+    const changes = compareCaseEvidence(previousSnapshot, currentSnapshot)
+        .filter((change) => caseVersion >= 10 || !['opportunityScore', 'opportunityFactors'].includes(change.field));
+    if (caseVersion <= 9 && previous.opportunityScore !== current.opportunityScore) {
+        changes.push({
+            field: 'opportunityScore',
+            label: 'Opportunity score',
+            before: previous.opportunityScore ?? null,
+            after: current.opportunityScore ?? null,
+            tone: 'neutral',
+        });
+    }
+    if (caseVersion <= 9 && !canonicalValuesMatch(previous.opportunityFactors, current.opportunityFactors)) {
+        changes.push({
+            field: 'opportunityFactors',
+            label: 'Opportunity factors',
+            before: previous.opportunityFactors,
+            after: current.opportunityFactors,
+            tone: 'neutral',
+        });
+    }
+    const order = new Map(HISTORICAL_CHANGE_ORDER.map((field, index) => [field, index]));
+    return changes
+        .sort((left, right) => (order.get(left.field) ?? Number.MAX_SAFE_INTEGER) - (order.get(right.field) ?? Number.MAX_SAFE_INTEGER))
+        .slice(0, 40);
+}
+function historicalEvidenceTimeline(history, caseVersion) {
+    return history.map((snapshot, index) => {
+        if (index === 0) {
+            return {
+                snapshot,
+                isBaseline: true,
+                hasRepeatedObservation: snapshot.firstCapturedAt !== snapshot.capturedAt,
+                changes: null,
+                hasIncomparableChange: false,
+                incomparableReasons: [],
+            };
+        }
+        const previous = history[index - 1];
+        if (!previous)
+            throw new TypeError('The CLI case pack contains an invalid historical evidence timeline.');
+        const changes = historicalEvidenceChanges(previous, snapshot, caseVersion);
+        let incomparableReasons = caseEvidenceIncomparableReasons(previous, snapshot).filter((reason) => caseVersion >= 10 || reason !== 'opportunity-model');
+        if (changes.length === 0 && snapshot.fingerprint !== previous.fingerprint && incomparableReasons.length === 0) {
+            incomparableReasons = ['other'];
+        }
+        return {
+            snapshot,
+            isBaseline: false,
+            hasRepeatedObservation: snapshot.firstCapturedAt !== snapshot.capturedAt,
+            changes: changes.length ? changes : null,
+            hasIncomparableChange: incomparableReasons.length > 0,
+            incomparableReasons,
+        };
+    });
+}
+function pickHistoricalFields(value, fields) {
+    return Object.fromEntries(fields.map((field) => [field, structuredClone(value[field])]));
+}
+function historicalAnalystResponse(caseRecord, caseVersion, reportVersion) {
+    if (reportVersion === 1)
+        return null;
+    const oldPinFields = ['id', 'label', 'value', 'source', 'observedAt', 'completeness', 'limitations', 'createdAt'];
+    const expandedPinFields = [
+        'id', 'checkpointId', 'field', 'category', 'label', 'value', 'source', 'sourceState', 'sourceSchema',
+        'observedAt', 'collectionDepth', 'completeness', 'truncated',
+        ...(caseVersion >= 7 ? ['transitionExpectation'] : []),
+        'limitations', 'createdAt',
+    ];
+    const evidencePins = caseRecord.evidencePins.map((item) => pickHistoricalFields(item, caseVersion >= 5 ? expandedPinFields : oldPinFields));
+    const decisions = caseRecord.decisions.map((item) => pickHistoricalFields(item, ['id', 'summary', 'rationale', 'evidencePinIds', 'createdAt']));
+    const actions = caseRecord.actions.map((item) => pickHistoricalFields(item, ['id', 'type', 'recipient', 'contactSource', 'contactLimitations', 'dueAt', 'state', 'reference', 'followUpAt', 'outcome', 'createdAt', 'updatedAt']));
+    const assertions = caseRecord.assertions.map((item) => {
+        const projected = pickHistoricalFields(item, [
+            'id', 'kind', 'statement', 'rationale', 'evidencePinIds',
+            ...(reportVersion >= 6 ? ['evidenceRelations'] : []),
+            'state', 'createdAt', 'updatedAt',
+        ]);
+        if (caseVersion >= 7 && item.provenance)
+            projected.provenance = structuredClone(item.provenance);
+        return projected;
+    });
+    const manualTrail = caseRecord.manualTrail.map((item) => pickHistoricalFields(item, ['id', 'kind', 'summary', 'target', 'createdAt']));
+    const sightings = caseRecord.sightings.map((item) => pickHistoricalFields(item, ['id', 'state', 'sourceClass', 'category', 'source', 'observedAt', 'completeness', 'evidencePinId', 'limitations', 'createdAt']));
+    const branches = (caseRecord.branches ?? []).map((item) => pickHistoricalFields(item, ['id', 'name', 'state', 'evidencePinIds', 'checkpointIds', 'assertionIds', 'actionIds', 'createdAt', 'updatedAt']));
+    return {
+        evidencePins,
+        decisions,
+        actions,
+        ...(reportVersion >= 3 ? { assertions, manualTrail } : {}),
+        ...(reportVersion >= 4 ? { sightings } : {}),
+        ...(reportVersion >= 7 ? { branches } : {}),
+    };
+}
+function assertHistoricalCaseResponseEpoch(rawCase, caseRecord, caseVersion, reportVersion, path) {
+    const expected = historicalAnalystResponse(caseRecord, caseVersion, reportVersion);
+    const introductions = new Map([
+        ['evidencePins', 3], ['decisions', 3], ['actions', 3],
+        ['assertions', 4], ['manualTrail', 4], ['sightings', 9], ['branches', 11],
+    ]);
+    for (const [field, introduced] of introductions) {
+        if (caseVersion < introduced) {
+            if (Object.hasOwn(rawCase, field)) {
+                throw new TypeError(`The CLI case pack contains ${path}.${field} outside its historical Case epoch.`);
+            }
+            continue;
+        }
+        if (Object.hasOwn(rawCase, field)) {
+            const projection = record(expected)?.[field];
+            assertProjectionKeys(rawCase[field], projection, `${path}.${field}`);
+        }
+    }
+    if (caseVersion < 10 && Object.hasOwn(rawCase, 'reviewReasonCode')) {
+        throw new TypeError(`The CLI case pack contains ${path}.reviewReasonCode outside its historical Case epoch.`);
+    }
+}
+function historicalReportProjection(caseRecord, evidenceHistory, report, caseVersion, reportVersion, generatedAt) {
+    const limitation = LEGACY_REPORT_LIMITATION_BY_VERSION.get(reportVersion);
+    if (!limitation)
+        throw new TypeError('The CLI case pack contains an unsupported historical Case report.');
+    const reportCase = {
+        id: caseRecord.id,
+        domain: caseRecord.domain,
+        status: caseRecord.status,
+        disposition: caseRecord.disposition,
+        ...(reportVersion >= 5 ? { reviewReasonCode: caseRecord.reviewReasonCode ?? null } : {}),
+        ...(reportVersion >= 6 ? { interoperabilityTags: analystInteroperabilityTags(caseRecord.disposition, caseRecord.reviewReasonCode) } : {}),
+        tags: [...caseRecord.tags],
+        source: caseRecord.source,
+        openedAt: caseRecord.createdAt,
+        updatedAt: caseRecord.updatedAt,
+        notesIncluded: false,
+    };
+    const response = historicalAnalystResponse(caseRecord, caseVersion, reportVersion);
+    return {
+        schema: CASE_REPORT_SCHEMA,
+        schemaVersion: reportVersion,
+        generatedAt,
+        application: reportVersion >= 6
+            ? buildPortableGeneratorMetadata(reportApplicationVersion(report))
+            : { name: 'WHOISleuth' },
+        case: reportCase,
+        currentAssessment: evidenceHistory.at(-1) ?? null,
+        evidenceTimeline: historicalEvidenceTimeline(evidenceHistory, caseVersion),
+        ...(response ? { analystResponse: response } : {}),
+        limitations: limitation,
+    };
+}
+function assertLegacyProfileContextEpoch(rawCase, report) {
+    const assertSnapshot = (value, path) => {
+        const snapshot = record(value);
+        if (snapshot && (Object.hasOwn(snapshot, 'profileContextState') || Object.hasOwn(snapshot, 'profileContextLimitation'))) {
+            throw new TypeError(`The CLI case pack contains schema-12 profile context fields outside the historical ${path} epoch.`);
+        }
+    };
+    if (Array.isArray(rawCase.evidenceHistory)) {
+        rawCase.evidenceHistory.forEach((snapshot, index) => assertSnapshot(snapshot, `cases evidence snapshot ${index}`));
+    }
+    assertSnapshot(report.currentAssessment, 'current assessment');
+    if (Array.isArray(report.evidenceTimeline)) {
+        report.evidenceTimeline.forEach((entry, index) => {
+            const timelineEntry = record(entry);
+            assertSnapshot(timelineEntry?.snapshot, `report timeline snapshot ${index}`);
+            if (!Array.isArray(timelineEntry?.changes))
+                return;
+            timelineEntry.changes.forEach((value, changeIndex) => {
+                const change = record(value);
+                if (!change)
+                    return;
+                const field = change.field;
+                const label = change.label;
+                const carriesProfileContextField = ['profileContextState', 'profileContextLimitation'].some((key) => (Object.hasOwn(change, key)
+                    || field === key
+                    || [change.before, change.after].some((candidate) => Boolean(record(candidate) && Object.hasOwn(record(candidate), key)))));
+                if (carriesProfileContextField
+                    || (typeof label === 'string' && /profile[ -]?context/iu.test(label))) {
+                    throw new TypeError(`The CLI case pack contains schema-12 profile context fields outside the historical report timeline change ${index}.${changeIndex} epoch.`);
+                }
+            });
+        });
+    }
+}
 function redactedCase(record, audience) {
     if (audience === 'internal')
         return structuredClone(record);
     return {
         ...structuredClone(record),
+        brandProfileIds: audience === 'public' ? [] : [...record.brandProfileIds],
         notes: [],
         actions: audience === 'public' ? [] : record.actions.map((item) => ({ ...item, recipient: '[redacted]' })),
         manualTrail: record.manualTrail.map((item) => ({ ...item, target: null })),
         assertions: audience === 'public' ? [] : structuredClone(record.assertions),
+        branches: audience === 'public' ? [] : structuredClone(record.branches ?? []),
     };
 }
 export function buildCliCasePack(input, options, generatedAt = new Date().toISOString()) {
@@ -35,6 +684,23 @@ export function buildCliCasePack(input, options, generatedAt = new Date().toISOS
     if (typeof root.version !== 'number' || !CASE_IMPORT_VERSIONS.includes(root.version) || !Array.isArray(root.cases)) {
         throw new CliUsageError(`Case-pack input must be a supported WHOISleuth case export through schema ${CASE_SCHEMA_VERSION}.`);
     }
+    if (root.version === CASE_SCHEMA_VERSION) {
+        try {
+            assertCanonicalCaseIdentities(root.cases, 'Case-pack input');
+            for (const item of root.cases) {
+                const rawCase = record(item);
+                if (!rawCase || !Object.hasOwn(rawCase, 'brandProfileIds'))
+                    throw new Error('missing');
+                assertCaseBrandProfileIds(rawCase.brandProfileIds);
+            }
+        }
+        catch (cause) {
+            if (cause instanceof TypeError && /Case identity/u.test(cause.message)) {
+                throw new CliUsageError(cause.message);
+            }
+            throw new CliUsageError('Case-pack schema 12 input requires exact canonical Case identities and an exact, unique, bounded brandProfileIds array on every case.');
+        }
+    }
     const normalised = normalizeCaseStore(root).cases;
     if (!normalised.length)
         throw new CliUsageError('Case-pack input did not contain a valid case.');
@@ -44,33 +710,44 @@ export function buildCliCasePack(input, options, generatedAt = new Date().toISOS
     if (normalised.length > MAX_CASE_PACK_CASES) {
         throw new CliUsageError(`Case packs are limited to ${MAX_CASE_PACK_CASES} reviewed cases. Export a smaller selected set so no case is silently omitted.`);
     }
+    if (root.version === CASE_SCHEMA_VERSION) {
+        try {
+            assertCurrentCaseProjection(root.cases, normalised, 'Case-pack input');
+        }
+        catch (cause) {
+            throw new CliUsageError(cause instanceof Error ? cause.message : 'Case-pack schema 12 input is not exact.');
+        }
+    }
     const cases = normalised.map((item) => redactedCase(item, options.audience));
-    const reports = cases.map((item) => buildCaseReport(item, { includeNotes: false, generatedAt }).json);
-    const exclusions = options.audience === 'internal'
-        ? ['Raw upstream payloads and credentials are outside the case schema.']
-        : options.audience === 'trusted'
-            ? ['Case notes', 'Recipient values', 'Manual trail targets', 'Raw upstream payloads and credentials']
-            : ['Case notes', 'Actions and recipient values', 'Analyst assertions', 'Manual trail targets', 'Raw upstream payloads and credentials'];
+    const brandProfileReferencesOmitted = options.audience === 'public'
+        ? normalised.reduce((count, item) => count + item.brandProfileIds.length, 0)
+        : 0;
+    const reports = cases.map((item) => buildCaseReport(item, {
+        applicationVersion: WHOISLEUTH_APPLICATION_VERSION,
+        includeNotes: false,
+        generatedAt,
+    }).json);
+    const exclusions = expectedExclusions(options.audience, CASE_SCHEMA_VERSION);
     const packet = Object.freeze({
         schema: CLI_CASE_PACK_SCHEMA,
         version: CLI_CASE_PACK_VERSION,
         audience: options.audience,
         reviewed: true,
         reports: Object.freeze(reports),
-        redactionManifest: Object.freeze({ excluded: Object.freeze(exclusions), sourceCaseCount: normalised.length }),
-        limitations: Object.freeze([
-            'This local package is browser-importable through its top-level case collection and does not upload or submit evidence.',
-            'The reviewed flag records a deliberate CLI choice; it does not prove recipient authorisation, factual correctness, or legal sufficiency.',
-            'Importing the package does not restore fields excluded by its audience profile.',
-        ]),
+        redactionManifest: Object.freeze({
+            excluded: Object.freeze(exclusions),
+            sourceCaseCount: normalised.length,
+            brandProfileReferencesOmitted,
+        }),
+        limitations: Object.freeze(PACKET_LIMITATIONS),
     });
     const unsigned = { version: CASE_SCHEMA_VERSION, exportedAt: generatedAt, cases, packet };
     const document = Object.freeze({
         ...unsigned,
         integrity: Object.freeze({
             algorithm: 'SHA-256',
-            canonicalization: 'sorted-json-v1',
-            digestSha256: `sha256:${createHash('sha256').update(canonicalArtifactJson(unsigned)).digest('hex')}`,
+            canonicalization: SORTED_JSON_V2,
+            digestSha256: `sha256:${createHash('sha256').update(canonicalArtifactJsonV2(unsigned)).digest('hex')}`,
         }),
     });
     if (Buffer.byteLength(JSON.stringify(document), 'utf8') > MAX_CASE_IMPORT_BYTES) {
@@ -79,47 +756,155 @@ export function buildCliCasePack(input, options, generatedAt = new Date().toISOS
     return document;
 }
 export function verifyCliCasePack(input) {
-    const root = input && typeof input === 'object' && !Array.isArray(input)
-        ? input
-        : null;
-    const packet = root?.packet && typeof root.packet === 'object' && !Array.isArray(root.packet)
-        ? root.packet
-        : null;
-    const integrity = root?.integrity && typeof root.integrity === 'object' && !Array.isArray(root.integrity)
-        ? root.integrity
-        : null;
+    const root = record(input);
+    let serialized;
+    try {
+        serialized = JSON.stringify(root);
+    }
+    catch {
+        throw new TypeError('The CLI case pack structure is not serializable.');
+    }
+    if (Buffer.byteLength(serialized, 'utf8') > MAX_CASE_IMPORT_BYTES) {
+        throw new TypeError('The CLI case pack exceeds the browser import limit.');
+    }
+    const packet = record(root?.packet);
+    const integrity = record(root?.integrity);
+    const redactionManifest = record(packet?.redactionManifest);
     if (!root
         || !packet
         || packet.schema !== CLI_CASE_PACK_SCHEMA
-        || packet.version !== CLI_CASE_PACK_VERSION
+        || (packet.version !== LEGACY_CLI_CASE_PACK_VERSION && packet.version !== CLI_CASE_PACK_VERSION)
         || packet.reviewed !== true
         || !['internal', 'public', 'trusted'].includes(String(packet.audience))
         || !Array.isArray(packet.reports)
+        || !redactionManifest
         || !Array.isArray(root.cases)
         || root.cases.length < 1
         || root.cases.length > MAX_CASE_PACK_CASES
         || packet.reports.length !== root.cases.length
+        || typeof root.exportedAt !== 'string'
         || typeof root.version !== 'number'
         || !CASE_IMPORT_VERSIONS.includes(root.version)
         || !integrity
         || integrity.algorithm !== 'SHA-256'
-        || integrity.canonicalization !== 'sorted-json-v1'
         || typeof integrity.digestSha256 !== 'string'
         || !/^sha256:[a-f0-9]{64}$/u.test(integrity.digestSha256)) {
         throw new TypeError('The CLI case pack structure or integrity envelope is invalid.');
     }
-    if (Buffer.byteLength(JSON.stringify(root), 'utf8') > MAX_CASE_IMPORT_BYTES) {
-        throw new TypeError('The CLI case pack exceeds the browser import limit.');
+    let canonicalization;
+    try {
+        canonicalization = resolveArtifactCanonicalization(packet.version, integrity.canonicalization, [
+            { version: LEGACY_CLI_CASE_PACK_VERSION, canonicalization: SORTED_JSON_V1, explicit: true },
+            { version: CLI_CASE_PACK_VERSION, canonicalization: SORTED_JSON_V2, explicit: true },
+        ], 'CLI case pack');
+    }
+    catch {
+        throw new TypeError('The CLI case pack structure or integrity envelope is invalid.');
     }
     const { integrity: _integrity, ...unsigned } = root;
-    const calculated = `sha256:${createHash('sha256').update(canonicalArtifactJson(unsigned)).digest('hex')}`;
-    if (calculated !== integrity.digestSha256) {
-        throw new TypeError('The CLI case pack failed its SHA-256 integrity check.');
+    const audience = packet.audience;
+    const current = root.version === CASE_SCHEMA_VERSION;
+    assertClosedEnvelopes(root, packet, integrity, redactionManifest, packet.reports, current);
+    assertSensitiveFieldPlacement(root, current, serialized.length);
+    if (!Number.isSafeInteger(redactionManifest.sourceCaseCount)
+        || Number(redactionManifest.sourceCaseCount) !== root.cases.length
+        || !stringListsMatch(redactionManifest.excluded, expectedExclusions(audience, root.version))) {
+        throw new TypeError('The CLI case pack has an invalid audience redaction manifest.');
     }
+    const caseReferenceLists = [];
+    const reportReferenceLists = [];
+    if (!current)
+        assertHistoricalCaseOwnKeys(root.cases, root.version);
+    assertCanonicalCaseIdentities(root.cases, 'The CLI case pack');
     const normalised = normalizeCaseStore(root).cases;
     if (normalised.length !== root.cases.length) {
         throw new TypeError('The CLI case pack contains an invalid case collection.');
     }
+    const normalisedByDomain = new Map(normalised.map((item) => [item.domain, item]));
+    if (current)
+        assertCurrentCaseProjection(root.cases, normalised, 'The CLI case pack');
+    for (let index = 0; index < root.cases.length; index++) {
+        const rawCase = record(root.cases[index]);
+        const report = record(packet.reports[index]);
+        const reportCase = record(report?.case);
+        const reportVersion = report?.schemaVersion;
+        if (!rawCase
+            || !report
+            || !reportCase
+            || typeof rawCase.domain !== 'string'
+            || report.schema !== CASE_REPORT_SCHEMA
+            || !reportVersionMatchesCase(root.version, reportVersion)
+            || reportCase.id !== rawCase.id
+            || reportCase.domain !== rawCase.domain) {
+            throw new TypeError('The CLI case pack contains an invalid or mismatched Case report.');
+        }
+        const normalisedCase = normalisedByDomain.get(rawCase.domain);
+        if (!normalisedCase)
+            throw new TypeError('The CLI case pack contains an invalid case collection.');
+        assertAudienceFields(rawCase, audience, root.version >= 11);
+        if (!current)
+            assertLegacyProfileContextEpoch(rawCase, report);
+        if (current) {
+            try {
+                if (!Object.hasOwn(rawCase, 'brandProfileIds') || !Object.hasOwn(reportCase, 'brandProfileIds'))
+                    throw new Error('missing');
+                caseReferenceLists.push(assertCaseBrandProfileIds(rawCase.brandProfileIds));
+                reportReferenceLists.push(assertCaseBrandProfileIds(reportCase.brandProfileIds));
+            }
+            catch {
+                throw new TypeError('The CLI case pack contains invalid Brand Profile references.');
+            }
+            assertCurrentReportProjection(report, rawCase);
+        }
+        else {
+            const historicalHistory = normalizeHistoricalEvidenceHistory(rawCase.evidenceHistory, root.version);
+            assertProjectionKeys(rawCase, { ...normalisedCase, evidenceHistory: historicalHistory }, `cases[${index}]`);
+            assertHistoricalCaseResponseEpoch(rawCase, normalisedCase, root.version, reportVersion, `cases[${index}]`);
+            if (report.generatedAt !== root.exportedAt) {
+                throw new TypeError('The CLI case pack contains an invalid or mismatched historical report generation time.');
+            }
+            const expectedReport = historicalReportProjection(normalisedCase, historicalHistory, report, root.version, reportVersion, root.exportedAt);
+            if (!canonicalValuesMatch(report, expectedReport)) {
+                throw new TypeError('The CLI case pack contains an invalid or mismatched historical Case report projection.');
+            }
+        }
+    }
+    if (current) {
+        const omitted = redactionManifest.brandProfileReferencesOmitted;
+        if (!Object.hasOwn(redactionManifest, 'brandProfileReferencesOmitted')
+            || !Number.isSafeInteger(omitted)
+            || Number(omitted) < 0
+            || Number(omitted) > MAX_CASE_PACK_CASES * 8) {
+            throw new TypeError('The CLI case pack has an invalid Brand Profile redaction manifest.');
+        }
+        const referencesMatch = caseReferenceLists.every((references, index) => {
+            const reportReferences = reportReferenceLists[index];
+            return reportReferences?.length === references.length
+                && references.every((reference, referenceIndex) => reportReferences[referenceIndex] === reference);
+        });
+        if (audience === 'public') {
+            if (caseReferenceLists.some((references) => references.length !== 0)
+                || reportReferenceLists.some((references) => references.length !== 0)) {
+                throw new TypeError('The public CLI case pack has an invalid Brand Profile redaction manifest.');
+            }
+        }
+        else if (Number(omitted) !== 0 || !referencesMatch) {
+            throw new TypeError('The trusted or internal CLI case pack has inconsistent Brand Profile references.');
+        }
+    }
+    else if (Object.hasOwn(redactionManifest, 'brandProfileReferencesOmitted')) {
+        throw new TypeError('The legacy CLI case pack has an invalid Brand Profile redaction manifest.');
+    }
+    let calculated;
+    try {
+        calculated = `sha256:${createHash('sha256').update(canonicalArtifactJsonFor(unsigned, canonicalization)).digest('hex')}`;
+    }
+    catch {
+        throw new TypeError('The CLI case pack structure is not serializable.');
+    }
+    if (calculated !== integrity.digestSha256) {
+        throw new TypeError('The CLI case pack failed its SHA-256 integrity check.');
+    }
     return Object.freeze({ caseCount: normalised.length });
 }
 export function formatCliCasePack(document) {