@slicedearth/whoisleuth-cli 1.47.4 → 2.0.0

package/lib/tls-intelligence.mjs

@@ -1,4 +1,4 @@
-// Bounded, one-connection TLS and certificate intelligence for deep scans.
+// Bounded, one-connection TLS and certificate evidence for deep scans.
 //
 // The collector resolves the submitted hostname once through the same public-
 // address guard used by safe-fetch, validates every returned address again at
@@ -10,7 +10,7 @@ import * as crypto from 'node:crypto';
 import * as net from 'node:net';
 import * as tls from 'node:tls';
 import { domainToASCII } from 'node:url';
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_LOOKUP_TLS_ALT_NAMES, MAX_LOOKUP_TLS_CHAIN_CERTIFICATES, MAX_LOOKUP_TLS_FINDINGS, MAX_LOOKUP_TLS_NAME_VALUES, } from "./lookup-network-evidence-bounds.mjs";
 import { isPrivateAddress, resolvePublicAddresses } from "./safe-fetch.mjs";
 import { parseCertificateExtensionProfile, } from "./certificate-extension-profile.mjs";
@@ -671,7 +671,7 @@ function failedTlsObservation(error, options = {}) {
             source: 'tls',
             durationMs: options.durationMs,
             complete: false,
-            limitations: ['TLS intelligence was inconclusive; DNS, connection, timeout, policy, or handshake failure is not proof that no TLS service exists.'],
+            limitations: ['TLS evidence collection was inconclusive; DNS, connection, timeout, policy, or handshake failure is not proof that no TLS service exists.'],
             diagnostics: { connectionAttempts: options.connectionAttempts || 0, error: detail },
         }),
         profileVersion: TLS_PROFILE_VERSION,
@@ -692,7 +692,7 @@ function failedTlsObservation(error, options = {}) {
         findings: [],
     };
 }
-function skippedTlsObservation(detail = 'TLS intelligence is disabled by deployment policy.') {
+function skippedTlsObservation(detail = 'TLS evidence collection is disabled by deployment policy.') {
     return {
         ...failedTlsObservation(detail, { connectionAttempts: 0 }),
         ...createObservation({

package/lib/urlhaus-intelligence.mjs

@@ -9,6 +9,7 @@ import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
 import { providerPolicyAdmission } from "./provider-policy-admission.mjs";
 import { createThreatIntelligenceResult, defineThreatIntelligenceProvider, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-contract.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 const URLHAUS_HOST_ENDPOINT = 'https://urlhaus-api.abuse.ch/v1/host/';
 const URLHAUS_MAX_RESULTS = 20;
 const URLHAUS_MAX_INPUT_RESULTS = 100;
@@ -82,8 +83,7 @@ function isoTimestamp(value) {
     const normalized = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(?: UTC)?$/u.test(trimmed)
         ? `${trimmed.slice(0, 10)}T${trimmed.slice(11, 19)}Z`
         : trimmed;
-    const timestamp = Date.parse(normalized);
-    return Number.isFinite(timestamp) ? new Date(timestamp).toISOString() : null;
+    return normalizeExplicitIsoTimestamp(normalized);
 }
 function retryAfterSeconds(response) {
     const value = response.headers.get('retry-after');
@@ -151,6 +151,8 @@ function normalizeHostFinding(value, targetDomain) {
         || exactDomainFromUrl(value.url) !== targetDomain)
         return null;
     const observedAt = isoTimestamp(value.date_added);
+    if (value.date_added !== undefined && value.date_added !== null && !observedAt)
+        return null;
     const tags = normalizedTags(value.tags);
     tags.push(`url-status:${status}`);
     return {

package/lib/urlscan-intelligence.mjs

@@ -7,6 +7,7 @@ import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
 import { providerPolicyAdmission } from "./provider-policy-admission.mjs";
 import { createThreatIntelligenceResult, defineThreatIntelligenceProvider, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-contract.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 const URLSCAN_SEARCH_ENDPOINT = 'https://urlscan.io/api/v1/search/';
 const URLSCAN_SEARCH_DAYS = 90;
 const URLSCAN_MAX_RESULTS = 20;
@@ -80,10 +81,7 @@ function boundedText(value, maxLength) {
     return normalized ? normalized.slice(0, maxLength) : null;
 }
 function isoTimestamp(value) {
-    if (typeof value !== 'string' || value.length > 64 || /[\u0000-\u001f\u007f]/u.test(value))
-        return null;
-    const timestamp = Date.parse(value);
-    return Number.isFinite(timestamp) ? new Date(timestamp).toISOString() : null;
+    return normalizeExplicitIsoTimestamp(value);
 }
 function retryAfterSeconds(response) {
     for (const name of ['retry-after', 'x-rate-limit-reset-after']) {
@@ -148,7 +146,10 @@ function normalizeSearchFinding(value, targetDomain) {
     if (verdicts.malicious !== true)
         return undefined;
     const categories = normalizedCategories(verdicts.categories);
-    const observedAt = isoTimestamp(task.time) || isoTimestamp(value.date);
+    const rawObservedAt = task.time ?? value.date;
+    const observedAt = isoTimestamp(rawObservedAt);
+    if (rawObservedAt !== undefined && rawObservedAt !== null && !observedAt)
+        return null;
     const title = boundedText(page.title, 180);
     return {
         id,

package/lib/website-security-posture.mjs

@@ -2,7 +2,7 @@
 // HTTP, static page, TLS, and DNS evidence already collected by a deep Lookup.
 // Findings use fixed explanatory text and bounded counts; upstream header
 // values, certificate errors, URLs, and DNS record contents are not copied.
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 const WEBSITE_SECURITY_POSTURE_VERSION = 2;
 const MAX_SECURITY_POSTURE_FINDINGS = 32;
 const MAX_RETAINED_ORIGINS = 30;

package/lib/website-technology.mjs

@@ -5,7 +5,7 @@
 // markup, header values, URL paths, and arbitrary upstream strings are never
 // retained.
 import { analyzeBrowserLibraries } from "./browser-library-profile.mjs";
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_STATIC_HTML_CHARS, MAX_TAG_LENGTH, MAX_TECHNOLOGY_TAGS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 const TECHNOLOGY_PROFILE_VERSION = 10;
 const MAX_TECHNOLOGY_HTML_CHARS = MAX_STATIC_HTML_CHARS;

package/lib/whois-authority.mjs

@@ -1,10 +1,21 @@
-// Authority-aware interpretation of WHOIS referral chains. The first
-// definitive non-root response decides existence; later registrar output is
-// diagnostic and cannot override the registry.
+// Authority-aware interpretation of WHOIS referral chains. Only the first
+// registry response referred by IANA can decide existence; later registrar
+// output is diagnostic and cannot replace an inconclusive registry result.
 import { normalizeWhoisChain } from "./whois-normalization.mjs";
 import { parseIndentedWhoisValue, whoisFieldLimit, } from "./whois-values.mjs";
-const NOT_FOUND_RE = /no match for|no match\b|not found|no entries found|domain not found|no object found|not registered|status\s*:\s*(?:available|free)\b|registered\s*:\s*(?:no|false)\b|is available for registration/i;
 const LINE_NOT_FOUND_PATTERNS = Object.freeze([
+    /^[ \t]*(?:%{1,2}[ \t]*)?(?:error(?::\d+)?[ \t:.-]*)?no match(?:[ \t]+for(?:[ \t]+domain)?(?:[ \t]+["']?[a-z0-9.-]{1,253}["']?)?)?[.!]?[ \t]*$/im,
+    /^[ \t]*(?:%{1,2}[ \t]*)?(?:error(?::\d+)?[ \t:.-]*)?no entries found(?:[ \t]+(?:for(?:[ \t]+(?:the[ \t]+)?(?:selected source\(s\)|this query|query[ \t]+["']?[a-z0-9.-]{1,253}["']?))|in[ \t]+the[ \t]+\.[a-z0-9-]{1,63}[ \t]+database))?[.!]?[ \t]*$/im,
+    /^[ \t]*[a-z0-9.-]{1,253}[ \t]*:[ \t]*no entries found\.?[ \t]*$/im,
+    /^[ \t]*(?:%{1,2}[ \t]*)?(?:domain[ \t]+)?not found(?::[ \t]*[a-z0-9.-]{1,253})?[.!]?[ \t]*$/im,
+    /^[ \t]*(?:the[ \t]+)?domain[ \t]+["']?[a-z0-9.-]{1,253}["']?[ \t]+(?:was[ \t]+)?not found\.?[ \t]*$/im,
+    /^[ \t]*(?:domain[ \t]+status|the queried object does not exist)[ \t]*:[ \t]*(?:domain[ \t]+not found|no object found)[.!]?[ \t]*$/im,
+    /^[ \t]*no object found!?[ \t]*$/im,
+    /^[ \t]*(?:%{1,2}[ \t]*)?(?:error(?::\d+)?[ \t:.-]*)?(?:the[ \t]+)?domain(?:[ \t]+is|[ \t]+has)?[ \t]+not[ \t]+(?:been[ \t]+)?registered\.?[ \t]*$/im,
+    /^[ \t]*(?:domain[ \t]+)?status[ \t]*:[ \t]*(?:available|free)[ \t]*$/im,
+    /^[ \t]*registration[ \t]+status[ \t]*:[ \t]*available[ \t]*$/im,
+    /^[ \t]*registered[ \t]*:[ \t]*(?:no|false)[ \t]*$/im,
+    /^[ \t]*[a-z0-9.-]{1,253}[ \t]+is[ \t]+(?:available[ \t]+for[ \t]+(?:purchase|registration)|free)[.!]?[ \t]*$/im,
     /^[ \t]*%[ \t]*nothing found[ \t]*$/im,
     /^[ \t]*[a-z0-9](?:[a-z0-9.-]{0,252})[ \t]+is free[ \t]*$/im,
     /^[ \t]*el dominio no se encuentra registrado en nic argentina[ \t]*$/im,
@@ -48,8 +59,7 @@ function classifyHopEvidence(hop, index) {
         return 'rate_limited';
     if (NZ_NOT_FOUND_RE.test(text))
         return 'negative';
-    if (NOT_FOUND_RE.test(text)
-        || LINE_NOT_FOUND_PATTERNS.some((pattern) => pattern.test(text))) {
+    if (LINE_NOT_FOUND_PATTERNS.some((pattern) => pattern.test(text))) {
         return 'negative';
     }
     if (index > 0
@@ -62,6 +72,26 @@ function classifyHopEvidence(hop, index) {
     }
     return 'inconclusive';
 }
+function normalizedWhoisServer(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.trim().toLowerCase().replace(/\.+$/u, '');
+    return /^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/u.test(normalized) ? normalized : null;
+}
+function ianaRegistryReferral(hop) {
+    if (!hop || normalizedWhoisServer(hop.server) !== 'whois.iana.org' || typeof hop.response !== 'string')
+        return null;
+    for (const pattern of [
+        /^[ \t]*refer:[ \t]*([a-zA-Z0-9.\-]+)/mi,
+        /^[ \t]*ReferralServer:[ \t]*whois:\/\/([a-zA-Z0-9.\-]+)/mi,
+        /^[ \t]*whois:[ \t]*([a-zA-Z0-9.\-]+)/mi,
+    ]) {
+        const referral = normalizedWhoisServer(hop.response.match(pattern)?.[1]);
+        if (referral)
+            return referral;
+    }
+    return null;
+}
 export function analyzeWhoisChainAuthority(chain) {
     const source = normalizeWhoisChain(chain);
     const evidence = source.map((hop, index) => ({
@@ -70,8 +100,13 @@ export function analyzeWhoisChainAuthority(chain) {
         kind: classifyHopEvidence(hop, index),
     }));
     const failed = evidence.filter((item) => item.kind === 'error' || item.kind === 'rate_limited');
-    const authoritative = evidence.find((item) => item.index > 0
-        && (item.kind === 'positive' || item.kind === 'negative'));
+    const registryReferral = ianaRegistryReferral(source[0]);
+    const registryServer = normalizedWhoisServer(source[1]?.server);
+    const registryEvidence = registryReferral && registryServer === registryReferral ? evidence[1] : null;
+    const authoritative = registryEvidence
+        && (registryEvidence.kind === 'positive' || registryEvidence.kind === 'negative')
+        ? registryEvidence
+        : null;
     const conflict = authoritative
         ? evidence.find((item) => item.index > authoritative.index
             && (item.kind === 'positive' || item.kind === 'negative')

package/lib/whois-chain.mjs

@@ -8,6 +8,17 @@ import { whoisQuery } from "./whois-transport.mjs";
 const IANA_WHOIS = 'whois.iana.org';
 const WHOIS_HOP_DEADLINE_MS = 12_000;
 const WHOIS_CHAIN_DEADLINE_MS = 25_000;
+const MAX_WHOIS_QUERY_HOPS = 6;
+function incompleteReferralHop(server, reason) {
+    return {
+        server,
+        queryProfile: 'not-issued',
+        responseEncoding: 'utf-8',
+        error: reason === 'hop_limit'
+            ? 'WHOIS referral chain reached the bounded hop limit; this referral was not queried.'
+            : 'WHOIS referral chain repeated a previously queried server; this referral was not queried.',
+    };
+}
 const WHOIS_QUERY_FORMATTERS = {
     'plain-domain': (domain) => domain,
     'denic-domain-ace': (domain) => `-T dn,ace ${domain}`,
@@ -65,9 +76,11 @@ export async function buildWhoisChainUncached(query, options = {}) {
     const visited = new Set();
     let currentServer = IANA_WHOIS;
     const startedAt = now();
-    for (let hop = 0; hop < 6; hop += 1) {
-        if (visited.has(currentServer.toLowerCase()))
+    for (let hop = 0; hop < MAX_WHOIS_QUERY_HOPS; hop += 1) {
+        if (visited.has(currentServer.toLowerCase())) {
+            chain.push(incompleteReferralHop(currentServer, 'referral_loop'));
             break;
+        }
         visited.add(currentServer.toLowerCase());
         const transport = whoisTransportForHop(query, hop);
         const remainingMs = chainDeadlineMs - (now() - startedAt);
@@ -112,8 +125,17 @@ export async function buildWhoisChainUncached(query, options = {}) {
             response: responseText,
         });
         const referral = extractReferral(responseText);
-        if (!referral || referral.toLowerCase() === currentServer.toLowerCase())
+        if (!referral)
             break;
+        const referralKey = referral.toLowerCase();
+        if (visited.has(referralKey)) {
+            chain.push(incompleteReferralHop(referral, 'referral_loop'));
+            break;
+        }
+        if (hop + 1 >= MAX_WHOIS_QUERY_HOPS) {
+            chain.push(incompleteReferralHop(referral, 'hop_limit'));
+            break;
+        }
         currentServer = referral;
     }
     return chain;

package/lib/whois-normalization.mjs

@@ -2,7 +2,9 @@
 // Keeping this separate lets authority analysis and field parsing share the
 // exact same defensive input boundary.
 import { MAX_WHOIS_BYTES } from "./whois-transport.mjs";
-const MAX_WHOIS_HOPS = 6;
+// Collection performs at most six network queries and may retain one seventh,
+// non-issued hop explaining a loop or hop-limit termination.
+const MAX_WHOIS_HOPS = 7;
 export function normalizeWhoisChain(value) {
     if (!Array.isArray(value))
         return [];

package/lib/whois-transport.mjs

@@ -47,9 +47,18 @@ function queryWhoisAddress(address, server, query, { port = 43, timeoutMs = 1000
             }
             chunks.push(buffer);
         });
-        const responseText = () => Buffer.concat(chunks, totalBytes).toString('utf8');
-        socket.on('end', () => settle(resolve, responseText()));
-        socket.on('close', () => settle(resolve, responseText()));
+        const settleResponse = () => {
+            try {
+                const responseText = new TextDecoder('utf-8', { fatal: true })
+                    .decode(Buffer.concat(chunks, totalBytes));
+                settle(resolve, responseText);
+            }
+            catch {
+                settle(reject, new Error(`WHOIS response from ${server} was not valid UTF-8`));
+            }
+        };
+        socket.on('end', settleResponse);
+        socket.on('close', settleResponse);
         socket.on('timeout', () => {
             socket.destroy();
             settle(reject, new Error(`WHOIS request to ${server} timed out`));

package/lib/zone-intent-review.mjs

@@ -175,7 +175,7 @@ export function normaliseRdata(type, rawValue, origin, nameMode = 'absolute') {
         };
     }
     if (type === 'CDNSKEY') {
-        if (tokens.length !== 4 || !/^[a-z0-9+/=]{1,4096}$/iu.test(tokens[3] ?? ''))
+        if (tokens.length !== 4 || !/^[A-Za-z0-9+/=]{1,4096}$/u.test(tokens[3] ?? ''))
             throw new TypeError('CDNSKEY data is invalid.');
         return {
             value: `${integerToken(tokens[0], 0, 65_535, 'CDNSKEY flags')} ${integerToken(tokens[1], 0, 255, 'CDNSKEY protocol')} ${integerToken(tokens[2], 0, 255, 'CDNSKEY algorithm')} ${tokens[3]}`,

package/package.json

@@ -33,20 +33,28 @@
   "bugs": {
     "url": "https://github.com/slicedearth/whoisleuth/issues"
   },
-  "version": "1.47.4",
+  "version": "2.0.0",
   "dependencies": {
     "@peculiar/x509": "2.0.0",
     "maxmind": "5.0.7",
     "parse5": "8.0.1",
     "reflect-metadata": "0.2.2",
-    "tldts": "7.4.10",
-    "undici": "8.9.0"
+    "tldts": "7.4.11",
+    "undici": "8.10.0"
   },
   "files": [
     "bin/**/*.mjs",
     "cli/**/*.mjs",
     "lib/**/*.mjs",
-    "frontend/src/lib/analysis/**/*.js",
+    "frontend/src/lib/**/*.js",
+    "packages/cases/**/*.mjs",
+    "packages/comparison/**/*.mjs",
+    "packages/contracts/**/*.mjs",
+    "packages/evidence/**/*.mjs",
+    "packages/interchange/**/*.mjs",
+    "packages/investigation/**/*.mjs",
+    "packages/monitoring/**/*.mjs",
+    "packages/workspace/**/*.mjs",
     "docs/cli.md",
     "docs/cli-reference.md",
     "DISCLOSURE",

package/{frontend/src/lib/analysis/case-brand-profile-references.js → packages/cases/case-brand-profile-references.mjs}

@@ -1,5 +1,5 @@
-import { MAX_CASE_BRAND_PROFILE_ID_CANDIDATES, MAX_CASE_BRAND_PROFILE_IDS, } from "./case-record-contracts.js";
-import { normalizeOpaqueReferenceId } from "./opaque-reference-id.js";
+import { MAX_CASE_BRAND_PROFILE_ID_CANDIDATES, MAX_CASE_BRAND_PROFILE_IDS, } from "./case-record-contracts.mjs";
+import { normalizeOpaqueReferenceId } from "./opaque-reference-id.mjs";
 /**
  * Reads an untrusted stored or imported reference list without repairing any
  * identifier. At most 32 candidates are inspected and at most eight unique,

package/{frontend/src/lib/analysis/case-evidence-model.js → packages/cases/case-evidence-model.mjs}

@@ -1,9 +1,10 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
-import { normalizeHttpSummary } from "./http-summary.js";
-import { normalizeOpportunityModelVersion, normalizeRiskModelVersion } from "./scoring.js";
-import { MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, } from "./case-record-contracts.js";
-import { CONCLUSIVE_AVAILABILITY, DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_RANK, EVIDENCE_SOURCE_SET, REGISTERED_LIKE, hashString, isoOrNull, objectRecord, safeId, } from "./case-record-core.js";
+import { normalizeHttpSummary } from "./http-summary.mjs";
+import { normalizeOpportunityModelVersion } from "../../lib/opportunity-scoring.mjs";
+import { normalizeRiskModelVersion } from "../../lib/risk-scoring.mjs";
+import { MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, } from "./case-record-contracts.mjs";
+import { CONCLUSIVE_AVAILABILITY, DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_RANK, EVIDENCE_SOURCE_SET, REGISTERED_LIKE, caseTimestampOrNull, hashString, isoOrNull, normalizeEvidenceHostnameForCase, objectRecord, safeId, } from "./case-record-core.mjs";
 function evidenceString(value, max = MAX_EVIDENCE_STRING_LENGTH) {
     if (value == null)
         return null;
@@ -81,6 +82,12 @@ function dayOf(value) {
     const iso = isoOrNull(value);
     return iso ? iso.slice(0, 10) : null;
 }
+function lifecycleTimestamp(value, sourceVersion) {
+    if (typeof value === 'string' && /^\d{4}-\d{2}-\d{2}$/u.test(value)) {
+        return caseTimestampOrNull(`${value}T00:00:00Z`);
+    }
+    return caseTimestampOrNull(value, sourceVersion);
+}
 // Capture completeness is recorded explicitly, never inferred from whether a
 // boolean happens to be false. 'fast' captures skip the DNS/site/HTML probes;
 // 'deep' evaluates them; 'unknown' is for migrated/imported evidence whose depth
@@ -104,6 +111,7 @@ const DEEP_SIGNAL_FIELDS = [
 // included so captures of differing completeness can never be confused for one
 // another. Deterministic ordering here is what makes the fingerprint stable.
 const MATERIAL_FIELD_ORDER = [
+    'inputHostname',
     'scanDepth',
     'availability', 'confidence', 'riskModelVersion', 'riskScore', 'opportunityModelVersion', 'opportunityScore',
     'riskFactors', 'opportunityFactors',
@@ -157,7 +165,7 @@ function isEmptyMaterial(value) {
 }
 // Fields that describe the capture rather than assert evidence, so they never
 // on their own keep an otherwise-empty snapshot alive.
-const NON_EVIDENCE_MATERIAL = new Set(['scanDepth', 'confidence']);
+const NON_EVIDENCE_MATERIAL = new Set(['inputHostname', 'scanDepth', 'confidence']);
 // A snapshot with no material evidence (only timestamps/source/depth, or only a
 // bare confidence/unknown-availability) is dropped rather than added to a
 // timeline.
@@ -173,8 +181,15 @@ function hasMaterialEvidence(snapshot) {
 // Deterministic string form of the material identity, keys in fixed order.
 function canonicalMaterialString(snapshot) {
     const canonical = {};
-    for (const field of MATERIAL_FIELD_ORDER)
-        canonical[field] = materialValue(field, snapshot);
+    for (const field of MATERIAL_FIELD_ORDER) {
+        const value = materialValue(field, snapshot);
+        // Preserve historical fingerprints when the new v14 observation-context
+        // field is absent. A retained hostname is still material and therefore
+        // separates otherwise-identical captures.
+        if (field === 'inputHostname' && value === null)
+            continue;
+        canonical[field] = value;
+    }
     return JSON.stringify(canonical);
 }
 /**
@@ -186,7 +201,7 @@ function canonicalMaterialString(snapshot) {
  * pass a real fallback; the import path deliberately passes an older case
  * timestamp (never "now") so malformed imported evidence can't appear newest.
  * @param {unknown} raw
- * @param {{ source?: string, fallback?: string | null }} [options]
+ * @param {{ source?: string, fallback?: string | null, sourceVersion?: number | null, caseDomain?: string | null }} [options]
  * @returns {CaseEvidenceSnapshot | null}
  */
 export function normalizeSnapshot(raw, options = {}) {
@@ -201,7 +216,11 @@ function buildSnapshot(raw, options) {
     const scanDepth = normalizeScanDepth(record.scanDepth);
     const httpSummary = normalizeHttpSummary(record);
     const acceptsProfileContext = options.sourceVersion === undefined || Number(options.sourceVersion) >= 12;
+    const acceptsInputHostname = options.sourceVersion === undefined || Number(options.sourceVersion) >= 13;
     const fields = {
+        inputHostname: acceptsInputHostname
+            ? normalizeEvidenceHostnameForCase(record.inputHostname, options.caseDomain)
+            : null,
         scanDepth,
         availability: evidenceString(record.availability),
         confidence: evidenceString(record.confidence),
@@ -212,8 +231,8 @@ function buildSnapshot(raw, options) {
         riskFactors: normalizeFactors(record.riskFactors),
         opportunityFactors: normalizeFactors(record.opportunityFactors),
         registrar: evidenceString(record.registrar),
-        createdDate: isoOrNull(record.createdDate),
-        expiryDate: isoOrNull(record.expiryDate),
+        createdDate: lifecycleTimestamp(record.createdDate, options.sourceVersion),
+        expiryDate: lifecycleTimestamp(record.expiryDate, options.sourceVersion),
         nameservers: normalizeNameserverList(record.nameservers),
         hasMx: boolOrNull(record.hasMx),
         hasSpf: boolOrNull(record.hasSpf),
@@ -286,10 +305,10 @@ function buildSnapshot(raw, options) {
     }
     if (!hasMaterialEvidence(fields))
         return null;
-    const capturedAt = isoOrNull(record.capturedAt) || options.fallback || null;
+    const capturedAt = caseTimestampOrNull(record.capturedAt, options.sourceVersion) || options.fallback || null;
     if (!capturedAt)
         return null; // an evidence entry with no placeable time is skipped
-    let firstCapturedAt = isoOrNull(record.firstCapturedAt) || capturedAt;
+    let firstCapturedAt = caseTimestampOrNull(record.firstCapturedAt, options.sourceVersion) || capturedAt;
     if (Date.parse(firstCapturedAt) > Date.parse(capturedAt))
         firstCapturedAt = capturedAt;
     const source = typeof record.source === 'string' && EVIDENCE_SOURCE_SET.has(record.source)
@@ -351,7 +370,7 @@ function compareSnapshotChrono(a, b) {
  * snapshots are retained up to the per-case bound; ids are made unique within
  * the case.
  * @param {unknown} rawList
- * @param {{ source?: string, fallback?: string | null }} [options]
+ * @param {{ source?: string, fallback?: string | null, sourceVersion?: number | null, caseDomain?: string | null }} [options]
  * @returns {CaseEvidenceSnapshot[]}
  */
 export function normalizeEvidenceHistory(rawList, options = {}) {
@@ -461,12 +480,14 @@ function valuesMateriallyEqual(field, previous, current) {
  * in the same observation produced an ordinary material change.
  * @param {CaseEvidenceSnapshot | null | undefined} previous
  * @param {CaseEvidenceSnapshot | null | undefined} current
- * @returns {Array<'scan-depth' | 'risk-model'>}
+ * @returns {Array<'observation-context' | 'opportunity-model' | 'scan-depth' | 'risk-model'>}
  */
 export function caseEvidenceIncomparableReasons(previous, current) {
     if (!previous || !current || previous.fingerprint === current.fingerprint)
         return [];
     const reasons = [];
+    if (previous.inputHostname !== current.inputHostname)
+        reasons.push('observation-context');
     const hasRiskEvidence = previous.riskScore !== null || current.riskScore !== null
         || previous.riskFactors.length > 0 || current.riskFactors.length > 0;
     if (hasRiskEvidence && !riskModelComparable(previous, current))

package/{frontend/src/lib/analysis/case-investigation-branch-model.js → packages/cases/case-investigation-branch-model.mjs}

@@ -1,3 +1,4 @@
+import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "../evidence/observation.mjs";
 export const MAX_CASE_INVESTIGATION_BRANCHES = 8;
 export const MAX_CASE_BRANCH_NAME_LENGTH = 80;
 export const MAX_CASE_BRANCH_REFERENCES = 12;
@@ -12,13 +13,10 @@ function text(value, maximum) {
         ? value.replace(CONTROL_REPLACE_RE, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum)
         : '';
 }
-function iso(value, fallback) {
-    if (typeof value === 'string' && value.length <= 64 && !/[\u0000-\u001f\u007f]/u.test(value)) {
-        const parsed = Date.parse(value);
-        if (Number.isFinite(parsed))
-            return new Date(parsed).toISOString();
-    }
-    return fallback;
+function iso(value, fallback, options = {}) {
+    return normalizeExplicitIsoTimestamp(value)
+        ?? (options.legacyTimestamps ? normalizeLegacyIsoTimestamp(value) : null)
+        ?? fallback;
 }
 function hash(value) {
     let output = 2166136261 >>> 0;
@@ -48,12 +46,12 @@ function ids(value, valid) {
     }
     return [...output];
 }
-function normalizeBranch(value, fallback, references) {
+function normalizeBranch(value, fallback, references, options = {}) {
     const item = record(value);
     const name = text(item.name, MAX_CASE_BRANCH_NAME_LENGTH);
     if (!name)
         return null;
-    const createdAt = iso(item.createdAt, fallback);
+    const createdAt = iso(item.createdAt, fallback, options);
     const branch = Object.freeze({
         id: safeId(item.id, { name, createdAt }),
         name,
@@ -63,7 +61,7 @@ function normalizeBranch(value, fallback, references) {
         assertionIds: Object.freeze(ids(item.assertionIds, references.assertionIds)),
         actionIds: Object.freeze(ids(item.actionIds, references.actionIds)),
         createdAt,
-        updatedAt: iso(item.updatedAt, createdAt),
+        updatedAt: iso(item.updatedAt, createdAt, options),
     });
     return branch.evidencePinIds.length || branch.checkpointIds.length || branch.assertionIds.length || branch.actionIds.length
         ? branch
@@ -77,12 +75,12 @@ export function caseInvestigationBranchReferences(input) {
         actionIds: new Set(input.actions.map((item) => item.id)),
     });
 }
-export function normalizeCaseInvestigationBranches(value, fallback, references) {
+export function normalizeCaseInvestigationBranches(value, fallback, references, options = {}) {
     if (!Array.isArray(value))
         return [];
     const byId = new Map();
     for (const item of value.slice(0, MAX_CASE_INVESTIGATION_BRANCHES * 2)) {
-        const normalized = normalizeBranch(item, fallback, references);
+        const normalized = normalizeBranch(item, fallback, references, options);
         if (!normalized)
             continue;
         const current = byId.get(normalized.id);