@slicedearth/whoisleuth-cli 1.47.4 → 2.0.0

package/cli/case-pack.mjs

@@ -1,97 +1,44 @@
 import { createHash } from 'node:crypto';
 import { Buffer } from 'node:buffer';
-import { canonicalArtifactJson, canonicalArtifactJsonFor, canonicalArtifactJsonV2, resolveArtifactCanonicalization, SORTED_JSON_V1, SORTED_JSON_V2, } from "../frontend/src/lib/analysis/artifact-integrity.js";
-import { buildCaseReport, CASE_REPORT_SCHEMA, CASE_REPORT_SCHEMA_VERSION, } from "../frontend/src/lib/analysis/case-report.js";
+import { canonicalArtifactJson, canonicalArtifactJsonV2, SORTED_JSON_V2, } from "../packages/evidence/artifact-integrity.mjs";
+import { buildCaseReport } from "../packages/cases/case-report.mjs";
 import { WHOISLEUTH_APPLICATION_VERSION } from "../lib/application-version.mjs";
-import { CASE_IMPORT_VERSIONS, CONCLUSIVE_AVAILABILITY, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_CASE_IMPORT_BYTES, CASE_SCHEMA_VERSION, assertCaseBrandProfileIds, caseEvidenceIncomparableReasons, compareCaseEvidence, hashString, normalizeDomain, normalizeCaseStore, normalizeSnapshot, safeId, } from "../frontend/src/lib/analysis/case-model.js";
-import { buildPortableGeneratorMetadata } from "../lib/portable-generator.mjs";
-import { analystInteroperabilityTags } from "../lib/analyst-taxonomy.mjs";
+import { assertBoundedJsonStructure, scanBoundedJson } from "../lib/bounded-json.mjs";
+import { assertCaseBrandProfileIds, normalizeDomain, normalizeCaseStore, safeId, } from "../packages/cases/case-model.mjs";
+import { CASE_REPORT_SCHEMA, CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, CLI_CASE_PACK_SCHEMA, CLI_CASE_PACK_VERSION, CLI_CASE_PACK_CURRENT_REDACTION_KEYS, CLI_CASE_PACK_PUBLIC_REPORT_KEYS, CLI_CASE_PACK_INTEGRITY_KEYS as INTEGRITY_KEYS, CLI_CASE_PACK_LIMITATIONS as PACKET_LIMITATIONS, CLI_CASE_PACK_PACKET_KEYS as PACKET_KEYS, CLI_CASE_PACK_REPORT_KEYS as REPORT_KEYS, CLI_CASE_PACK_ROOT_KEYS as ROOT_KEYS, MAX_CASE_IMPORT_BYTES, MAX_CASE_PACK_CASES, MAX_CASE_PACK_INPUT_BYTES, PUBLIC_CASE_SCHEMA_VERSION, caseReportVersionMatchesCase, } from "../packages/contracts/case-portability.mjs";
 import { CliUsageError } from "./errors.mjs";
-export const CLI_CASE_PACK_SCHEMA = 'whoisleuth.cli.case-pack';
-export const CLI_CASE_PACK_VERSION = 2;
-export const LEGACY_CLI_CASE_PACK_VERSION = 1;
-export const MAX_CASE_PACK_INPUT_BYTES = 4 * 1024 * 1024;
-export const MAX_CASE_PACK_CASES = 25;
+export { CLI_CASE_PACK_SCHEMA, CLI_CASE_PACK_VERSION, MAX_CASE_PACK_CASES, MAX_CASE_PACK_INPUT_BYTES, };
 const MAX_CASE_PACK_REFERENCE_SCAN_DEPTH = 64;
-const LEGACY_CASE_REPORT_VERSIONS = Object.freeze([1, 2, 3, 4, 5, 6, 7]);
 const INTERNAL_EXCLUSIONS = Object.freeze(['Raw upstream payloads and credentials are outside the case schema.']);
 const TRUSTED_EXCLUSIONS = Object.freeze(['Case notes', 'Recipient values', 'Manual trail targets', 'Raw upstream payloads and credentials']);
-const PUBLIC_EXCLUSIONS_V10 = Object.freeze(['Case notes', 'Actions and recipient values', 'Analyst assertions', 'Manual trail targets', 'Raw upstream payloads and credentials']);
-const PUBLIC_EXCLUSIONS_V11 = Object.freeze([...PUBLIC_EXCLUSIONS_V10.slice(0, 3), 'Investigation branches', ...PUBLIC_EXCLUSIONS_V10.slice(3)]);
-const PUBLIC_EXCLUSIONS = Object.freeze(['Case notes', 'Brand Profile references', ...PUBLIC_EXCLUSIONS_V11.slice(1)]);
-const SENSITIVE_CASE_PACK_FIELDS = Object.freeze(['brandProfileIds', 'notes', 'actions', 'assertions', 'manualTrail', 'branches', 'recipient', 'target']);
-const ROOT_KEYS = Object.freeze(['version', 'exportedAt', 'cases', 'packet', 'integrity']);
-const PACKET_KEYS = Object.freeze(['schema', 'version', 'audience', 'reviewed', 'reports', 'redactionManifest', 'limitations']);
-const REPORT_KEYS = Object.freeze(['schema', 'schemaVersion', 'generatedAt', 'application', 'case', 'currentAssessment', 'evidenceTimeline', 'analystResponse', 'limitations']);
-const INTEGRITY_KEYS = Object.freeze(['algorithm', 'canonicalization', 'digestSha256']);
-const PACKET_LIMITATIONS = Object.freeze([
-    'This local package is browser-importable through its top-level case collection and does not upload or submit evidence.',
-    'The reviewed flag records a deliberate CLI choice; it does not prove recipient authorisation, factual correctness, or legal sufficiency.',
-    'Importing the package does not restore fields excluded by its audience profile.',
+const PUBLIC_EXCLUSIONS = Object.freeze([
+    'Case notes',
+    'Brand Profile references',
+    'Actions and recipient values',
+    'Analyst assertions',
+    'Investigation branches',
+    'Manual trail targets',
+    'Raw upstream payloads and credentials',
+    'Independent observed-effect reviews and closure history',
 ]);
-const LEGACY_RISK_MODEL_LIMITATION = 'This report contains normalized browser-local observations from WHOISleuth analyst cases. It is not a live lookup and does not contain raw WHOIS, RDAP, DNS, HTML, or responses collected during website checks. Absence of a signal (e.g. no MX record observed) does not prove nonexistence. It may not have been evaluated. Snapshot fingerprints are deduplication identifiers, not cryptographic evidence hashes. Scan-depth and risk-model gates prevent misleading comparisons; "incomparable" means observations differ materially but one or more fields cannot be compared reliably. Generated locally in the browser. Review the package before sharing it.';
-const LEGACY_SCORING_MODEL_LIMITATION = 'This report contains normalized browser-local observations from WHOISleuth analyst cases. It is not a live lookup and does not contain raw WHOIS, RDAP, DNS, HTML, or responses collected during website checks. Absence of a signal (e.g. no MX record observed) does not prove nonexistence. It may not have been evaluated. Snapshot fingerprints are deduplication identifiers, not cryptographic evidence hashes. Scan-depth and scoring-model gates prevent misleading comparisons; "incomparable" means observations differ materially but one or more fields cannot be compared reliably. Generated locally in the browser. Review the package before sharing it.';
-const LEGACY_PORTABLE_LIMITATION = 'This report contains normalised browser-local observations from WHOISleuth analyst cases. It is not a live lookup and does not contain raw WHOIS, RDAP, DNS, HTML, or responses collected during website checks. Absence of a signal (e.g. no MX record observed) does not prove nonexistence. It may not have been evaluated. Snapshot fingerprints are deduplication identifiers, not cryptographic evidence hashes. Scan-depth and scoring-model gates prevent misleading comparisons; "incomparable" means observations differ materially but one or more fields cannot be compared reliably. Generated locally in the browser. Review the package before sharing it.';
-const LEGACY_REPORT_LIMITATION_BY_VERSION = new Map([
-    [1, LEGACY_RISK_MODEL_LIMITATION],
-    [2, LEGACY_RISK_MODEL_LIMITATION],
-    [3, LEGACY_RISK_MODEL_LIMITATION],
-    [4, LEGACY_RISK_MODEL_LIMITATION],
-    [5, LEGACY_SCORING_MODEL_LIMITATION],
-    [6, LEGACY_PORTABLE_LIMITATION],
-    [7, LEGACY_PORTABLE_LIMITATION],
-]);
-const HISTORICAL_BASE_MATERIAL_FIELDS = Object.freeze([
-    'scanDepth',
-    'availability', 'confidence', 'riskModelVersion', 'riskScore', 'opportunityScore',
-    'riskFactors', 'opportunityFactors',
-    'registrar', 'createdDate', 'expiryDate', 'nameservers',
-    'hasMx', 'hasSpf', 'hasDmarc',
-    'activityStatus', 'websiteProbeDetail', 'pageTitle',
-    'httpSummaryVersion', 'httpEvidenceStatus', 'httpFinalOrigin', 'httpResponseStatus', 'httpTransportSecurity', 'httpRedirectCount',
-    'httpCrossOriginRedirect', 'httpHttpsDowngrade', 'httpContentType', 'httpSecurityHeaders',
-    'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets', 'hasPasswordField', 'phishingLanguageMatch',
-    'mutationTypes',
-]);
-const HISTORICAL_EXTERNAL_FORM_MATERIAL_FIELDS = Object.freeze([
-    ...HISTORICAL_BASE_MATERIAL_FIELDS.slice(0, -2),
-    'hasExternalFormAction',
-    ...HISTORICAL_BASE_MATERIAL_FIELDS.slice(-2),
-]);
-const HISTORICAL_CONTEXT_MATERIAL_FIELDS = Object.freeze([
-    'scanDepth',
-    'availability', 'confidence', 'riskModelVersion', 'riskScore', 'opportunityModelVersion', 'opportunityScore',
-    'riskFactors', 'opportunityFactors',
-    'registrar', 'createdDate', 'expiryDate', 'nameservers',
-    'hasMx', 'hasSpf', 'hasDmarc',
-    'activityStatus', 'websiteProbeDetail', 'pageTitle',
-    'httpSummaryVersion', 'httpEvidenceStatus', 'httpFinalOrigin', 'httpResponseStatus', 'httpTransportSecurity', 'httpRedirectCount',
-    'httpCrossOriginRedirect', 'httpHttpsDowngrade', 'httpContentType', 'httpSecurityHeaders',
-    'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets', 'hasPasswordField', 'hasExternalFormAction', 'phishingLanguageMatch',
-    'privacyProtected', 'idnReferenceMatch', 'pageBaselineMatch', 'hasActiveBrandProfile',
-    'mutationTypes',
-]);
-const HISTORICAL_CHANGE_ORDER = Object.freeze([
-    'availability', 'confidence', 'riskScore', 'riskFactors', 'opportunityScore', 'opportunityFactors',
-    'registrar', 'createdDate', 'expiryDate', 'nameservers', 'hasMx', 'hasSpf', 'hasDmarc',
-    'activityStatus', 'websiteProbeDetail', 'pageTitle', 'httpEvidenceStatus', 'httpFinalOrigin',
-    'httpResponseStatus', 'httpTransportSecurity', 'httpRedirectCount', 'httpCrossOriginRedirect',
-    'httpHttpsDowngrade', 'httpContentType', 'httpSecurityHeaders', 'faviconMatch', 'faviconNearMatch',
-    'reusesOfficialAssets', 'hasPasswordField', 'hasExternalFormAction', 'phishingLanguageMatch', 'mutationTypes',
+const PUBLIC_V12_EXCLUSIONS = Object.freeze(PUBLIC_EXCLUSIONS.slice(0, -1));
+const SENSITIVE_CASE_PACK_FIELDS = Object.freeze([
+    'brandProfileIds', 'notes', 'actions', 'assertions', 'manualTrail', 'observedEffects',
+    'closures', 'branches', 'recipient', 'target',
 ]);
+const PUBLIC_OBSERVED_EFFECT_LIMITATION = 'Independent observed-effect review records were excluded from this public Case pack.';
+const PUBLIC_CLOSURE_LIMITATION = 'Deliberate closure records were excluded from this public Case pack.';
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
         : null;
 }
-function expectedExclusions(audience, caseVersion) {
+function expectedExclusions(audience, caseVersion = CASE_SCHEMA_VERSION) {
     if (audience === 'internal')
         return INTERNAL_EXCLUSIONS;
     if (audience === 'trusted')
         return TRUSTED_EXCLUSIONS;
-    if (caseVersion >= 12)
-        return PUBLIC_EXCLUSIONS;
-    return caseVersion === 11 ? PUBLIC_EXCLUSIONS_V11 : PUBLIC_EXCLUSIONS_V10;
+    return caseVersion === PUBLIC_CASE_SCHEMA_VERSION ? PUBLIC_V12_EXCLUSIONS : PUBLIC_EXCLUSIONS;
 }
 function stringListsMatch(value, expected) {
     return Array.isArray(value)
@@ -104,60 +51,11 @@ function assertOnlyKeys(value, allowed, label) {
         throw new TypeError(`The CLI case pack contains an unexpected ${label} field.`);
     }
 }
-function jsonNodeKind(value) {
-    if (value === null)
-        return 'null';
-    if (Array.isArray(value))
-        return 'array';
-    return typeof value === 'object' ? 'object' : 'scalar';
-}
-/** Historical records may omit later object fields, but every retained value must match the bounded projection. */
-function assertProjectionKeys(actual, projection, path, depth = 0) {
-    if (depth > MAX_CASE_PACK_REFERENCE_SCAN_DEPTH) {
-        throw new TypeError('The CLI case pack exceeds its bounded projection depth.');
-    }
-    const actualKind = jsonNodeKind(actual);
-    const projectionKind = jsonNodeKind(projection);
-    if (actualKind !== projectionKind) {
-        throw new TypeError(`The CLI case pack contains an invalid ${path} projection node.`);
-    }
-    if (actualKind === 'array') {
-        const actualArray = actual;
-        const projectionArray = projection;
-        if (actualArray.length > projectionArray.length) {
-            throw new TypeError(`The CLI case pack contains data outside its normalised ${path} projection.`);
-        }
-        for (let index = 0; index < actualArray.length; index++) {
-            const expected = projectionArray[index];
-            if (expected === undefined) {
-                throw new TypeError(`The CLI case pack contains data outside its normalised ${path} projection.`);
-            }
-            assertProjectionKeys(actualArray[index], expected, `${path}[${index}]`, depth + 1);
-        }
-        return;
-    }
-    if (actualKind === 'object') {
-        const actualRecord = actual;
-        const projectionRecord = record(projection);
-        if (!projectionRecord)
-            throw new TypeError(`The CLI case pack contains an invalid ${path} projection.`);
-        for (const key of Object.keys(actualRecord)) {
-            if (!Object.hasOwn(projectionRecord, key)) {
-                throw new TypeError(`The CLI case pack contains an unexpected ${path}.${key} field.`);
-            }
-            assertProjectionKeys(actualRecord[key], projectionRecord[key], `${path}.${key}`, depth + 1);
-        }
-        return;
-    }
-    if (!canonicalValuesMatch(actual, projection)) {
-        throw new TypeError(`The CLI case pack contains a changed or unbounded ${path} projection value.`);
-    }
-}
-function assertClosedEnvelopes(root, packet, integrity, redactionManifest, reports, current) {
+function assertClosedEnvelopes(root, packet, integrity, redactionManifest, reports, caseVersion) {
     assertOnlyKeys(root, ROOT_KEYS, 'root envelope');
     assertOnlyKeys(packet, PACKET_KEYS, 'packet envelope');
     assertOnlyKeys(integrity, INTEGRITY_KEYS, 'integrity envelope');
-    assertOnlyKeys(redactionManifest, current ? ['excluded', 'sourceCaseCount', 'brandProfileReferencesOmitted'] : ['excluded', 'sourceCaseCount'], 'redaction manifest');
+    assertOnlyKeys(redactionManifest, CLI_CASE_PACK_CURRENT_REDACTION_KEYS, 'redaction manifest');
     if (!stringListsMatch(packet.limitations, PACKET_LIMITATIONS)) {
         throw new TypeError('The CLI case pack contains an invalid packet limitation manifest.');
     }
@@ -165,7 +63,7 @@ function assertClosedEnvelopes(root, packet, integrity, redactionManifest, repor
         const report = record(value);
         if (!report)
             throw new TypeError('The CLI case pack contains an invalid Case report envelope.');
-        assertOnlyKeys(report, REPORT_KEYS, 'Case report envelope');
+        assertOnlyKeys(report, caseVersion === PUBLIC_CASE_SCHEMA_VERSION ? CLI_CASE_PACK_PUBLIC_REPORT_KEYS : REPORT_KEYS, 'Case report envelope');
     }
 }
 function topCasePath(path) {
@@ -184,12 +82,12 @@ function listItemPath(path, list) {
         || (path.length === 6 && path[0] === 'packet' && path[1] === 'reports' && typeof path[2] === 'number'
             && path[3] === 'analystResponse' && path[4] === list && typeof path[5] === 'number');
 }
-function allowedSensitiveFieldPath(key, path, current) {
+function allowedSensitiveFieldPath(key, path) {
     if (key === 'brandProfileIds')
-        return current && (topCasePath(path) || reportCasePath(path));
+        return topCasePath(path) || reportCasePath(path);
     if (key === 'notes')
         return topCasePath(path) || reportCasePath(path);
-    if (key === 'actions' || key === 'assertions' || key === 'manualTrail' || key === 'branches') {
+    if (key === 'actions' || key === 'assertions' || key === 'manualTrail' || key === 'observedEffects' || key === 'closures' || key === 'branches') {
         return topCasePath(path) || analystResponsePath(path);
     }
     if (key === 'recipient')
@@ -199,7 +97,7 @@ function allowedSensitiveFieldPath(key, path, current) {
     return true;
 }
 /** Rejects hidden audience-sensitive copies with a budget proven by the serialized byte bound. */
-function assertSensitiveFieldPlacement(root, current, serializedLength) {
+function assertSensitiveFieldPlacement(root, serializedLength) {
     const stack = [{ value: root, path: [], depth: 0 }];
     const visited = new Set();
     let inspected = 0;
@@ -208,7 +106,7 @@ function assertSensitiveFieldPlacement(root, current, serializedLength) {
         if (!entry || !entry.value || typeof entry.value !== 'object')
             continue;
         for (const key of SENSITIVE_CASE_PACK_FIELDS) {
-            if (Object.hasOwn(entry.value, key) && !allowedSensitiveFieldPath(key, entry.path, current)) {
+            if (Object.hasOwn(entry.value, key) && !allowedSensitiveFieldPath(key, entry.path)) {
                 throw new TypeError('The CLI case pack contains audience-sensitive data outside its versioned case or report fields.');
             }
         }
@@ -274,63 +172,61 @@ function assertCanonicalCaseIdentities(cases, label) {
 function assertCurrentCaseProjection(rawCases, normalised, label) {
     if (rawCases.length !== normalised.length
         || rawCases.some((item, index) => !canonicalValuesMatch(item, normalised[index]))) {
-        throw new TypeError(`${label} contains a schema 12 Case that would be repaired, truncated, or otherwise changed during normalisation.`);
+        throw new TypeError(`${label} contains a schema ${CASE_SCHEMA_VERSION} Case that would be repaired, truncated, or otherwise changed during normalisation.`);
     }
 }
-function requiredHistoricalCaseKeys(caseVersion) {
-    return [
-        'id', 'domain', 'status', 'disposition', 'tags', 'notes', 'source', 'evidenceHistory', 'createdAt', 'updatedAt',
-        ...(caseVersion >= 3 ? ['evidencePins', 'decisions', 'actions'] : []),
-        ...(caseVersion >= 4 ? ['assertions', 'manualTrail'] : []),
-        ...(caseVersion >= 9 ? ['sightings'] : []),
-    ];
-}
-function assertHistoricalCaseOwnKeys(cases, caseVersion) {
-    const required = requiredHistoricalCaseKeys(caseVersion);
-    for (let index = 0; index < cases.length; index++) {
-        const item = record(cases[index]);
-        if (!item)
-            throw new TypeError(`The CLI case pack contains an invalid historical Case at cases[${index}].`);
-        const missing = required.find((key) => !Object.hasOwn(item, key));
-        if (missing) {
-            throw new TypeError(`The CLI case pack is missing required historical Case field cases[${index}].${missing}.`);
-        }
-    }
+function publicObservedEffectHistory(preV13HistoryUnavailable) {
+    return {
+        reviews: [],
+        omitted: 0,
+        preV13HistoryUnavailable,
+        limitations: [
+            ...(preV13HistoryUnavailable
+                ? ['Migrated from a pre-v13 Case; earlier independent observed-effect review history is unavailable.']
+                : []),
+            'Observed-effect reviews are independent point-in-time records; provider workflow events do not create or replace them.',
+            PUBLIC_OBSERVED_EFFECT_LIMITATION,
+        ].sort(),
+    };
 }
-function reportVersionMatchesCase(caseVersion, reportVersion) {
-    if (!Number.isSafeInteger(reportVersion))
-        return false;
-    if (caseVersion === CASE_SCHEMA_VERSION)
-        return reportVersion === CASE_REPORT_SCHEMA_VERSION;
-    if (!LEGACY_CASE_REPORT_VERSIONS.includes(reportVersion))
-        return false;
-    if (caseVersion === 2)
-        return reportVersion === 1;
-    if (caseVersion === 3)
-        return reportVersion === 2;
-    if (caseVersion >= 4 && caseVersion <= 8)
-        return reportVersion === 3;
-    if (caseVersion === 9)
-        return reportVersion === 4;
-    if (caseVersion === 10)
-        return reportVersion === 5 || reportVersion === 6;
-    return caseVersion === 11 && reportVersion === 7;
+function publicClosureHistory(preV13HistoryUnavailable) {
+    return {
+        records: [],
+        omitted: 0,
+        preV13HistoryUnavailable,
+        limitations: [
+            ...(preV13HistoryUnavailable
+                ? ['Migrated from a pre-v13 Case; earlier deliberate closure history is unavailable.']
+                : []),
+            'Closure records are deliberate analyst actions and do not establish absence, safety, provider performance, or legal sufficiency.',
+            PUBLIC_CLOSURE_LIMITATION,
+        ].sort(),
+    };
 }
-function assertAudienceFields(value, audience, supportsBranches) {
-    if (!supportsBranches && Object.hasOwn(value, 'branches')) {
-        throw new TypeError('The CLI case pack contains an Investigation branch outside its versioned fields.');
-    }
+function assertAudienceFields(value, audience) {
     if (audience === 'internal')
         return;
     if (Object.hasOwn(value, 'notes') && (!Array.isArray(value.notes) || value.notes.length !== 0)) {
         throw new TypeError('The CLI case pack contains Case notes excluded by its audience.');
     }
     if (audience === 'public') {
-        for (const field of ['actions', 'assertions', ...(supportsBranches ? ['branches'] : [])]) {
+        for (const field of ['actions', 'assertions', 'branches']) {
             if (Object.hasOwn(value, field) && (!Array.isArray(value[field]) || value[field].length !== 0)) {
                 throw new TypeError(`The public CLI case pack contains ${field} excluded by its audience.`);
             }
         }
+        for (const [field, list] of [['observedEffects', 'reviews'], ['closures', 'records']]) {
+            if (Object.hasOwn(value, field)) {
+                const history = record(value[field]);
+                const expected = field === 'observedEffects'
+                    ? publicObservedEffectHistory(history?.preV13HistoryUnavailable === true)
+                    : publicClosureHistory(history?.preV13HistoryUnavailable === true);
+                if (!history || !Array.isArray(history[list]) || history[list].length !== 0
+                    || !canonicalValuesMatch(history, expected)) {
+                    throw new TypeError(`The public CLI case pack contains ${field} excluded by its audience.`);
+                }
+            }
+        }
     }
     else if (Object.hasOwn(value, 'actions')) {
         if (!Array.isArray(value.actions) || value.actions.some((entry) => {
@@ -365,306 +261,25 @@ function assertCurrentReportProjection(report, rawCase) {
         throw new TypeError('The CLI case pack contains an invalid or mismatched Case report projection.');
     }
 }
-function historicalMaterialFields(caseVersion) {
-    if (caseVersion <= 7)
-        return HISTORICAL_BASE_MATERIAL_FIELDS;
-    if (caseVersion <= 9)
-        return HISTORICAL_EXTERNAL_FORM_MATERIAL_FIELDS;
-    return HISTORICAL_CONTEXT_MATERIAL_FIELDS;
-}
-function historicalMaterialValue(field, snapshot) {
-    switch (field) {
-        case 'availability':
-            return typeof snapshot.availability === 'string' && CONCLUSIVE_AVAILABILITY.has(snapshot.availability)
-                ? snapshot.availability
-                : null;
-        case 'registrar':
-            return String(snapshot.registrar ?? '').toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim() || null;
-        case 'createdDate':
-        case 'expiryDate': {
-            const value = snapshot[field];
-            return typeof value === 'string' ? value.slice(0, 10) : null;
-        }
-        case 'riskFactors':
-        case 'opportunityFactors':
-            return snapshot[field].map((factor) => [factor.label, factor.points]);
-        default:
-            return snapshot[field] ?? null;
-    }
-}
-function historicalMaterialIsEmpty(value) {
-    if (value === null || value === undefined)
-        return true;
-    if (Array.isArray(value))
-        return value.length === 0;
-    return typeof value === 'string' ? value.trim() === '' : false;
-}
-/**
- * Recreates the exact material identity used by each historical Case epoch.
- * Current migration happens separately so adding schema-12 fields can never
- * invalidate an authentic old fingerprint or make a forged one look valid.
- */
-function normalizeHistoricalEvidenceHistory(rawHistory, caseVersion) {
-    if (!Array.isArray(rawHistory) || rawHistory.length > MAX_EVIDENCE_SNAPSHOTS_PER_CASE) {
-        throw new TypeError('The CLI case pack contains an invalid historical evidence collection.');
-    }
-    const fields = historicalMaterialFields(caseVersion);
-    const materialSeen = new Set();
-    const built = rawHistory.map((raw, index) => {
-        const rawSnapshot = record(raw);
-        const normalized = normalizeSnapshot(raw, { fallback: null, sourceVersion: caseVersion });
-        if (!rawSnapshot || !normalized) {
-            throw new TypeError(`The CLI case pack contains an invalid historical evidence snapshot ${index}.`);
-        }
-        const materialRecord = {};
-        let hasEvidence = false;
-        for (const field of fields) {
-            const value = historicalMaterialValue(field, normalized);
-            materialRecord[field] = value;
-            if (field !== 'scanDepth' && field !== 'confidence' && !historicalMaterialIsEmpty(value))
-                hasEvidence = true;
-        }
-        if (!hasEvidence) {
-            throw new TypeError(`The CLI case pack contains an empty historical evidence snapshot ${index}.`);
-        }
-        const material = JSON.stringify(materialRecord);
-        if (materialSeen.has(material)) {
-            throw new TypeError('The CLI case pack contains duplicate historical evidence material.');
-        }
-        materialSeen.add(material);
-        const fingerprint = hashString(material);
-        return {
-            material,
-            snapshot: {
-                id: `ev-${fingerprint}`,
-                fingerprint,
-                firstCapturedAt: normalized.firstCapturedAt,
-                capturedAt: normalized.capturedAt,
-                source: normalized.source,
-                ...Object.fromEntries(fields.map((field) => [field, normalized[field] ?? null])),
-            },
-            rawSnapshot,
-        };
-    });
-    built.sort((left, right) => (Date.parse(String(left.snapshot.capturedAt)) - Date.parse(String(right.snapshot.capturedAt))
-        || Date.parse(String(left.snapshot.firstCapturedAt)) - Date.parse(String(right.snapshot.firstCapturedAt))
-        || String(left.snapshot.fingerprint).localeCompare(String(right.snapshot.fingerprint))));
-    const usedIds = new Set();
-    for (const item of built) {
-        const base = String(item.snapshot.id);
-        let id = base;
-        let suffix = 2;
-        while (usedIds.has(id))
-            id = `${base}-${suffix++}`;
-        usedIds.add(id);
-        item.snapshot.id = id;
-    }
-    const projected = built.map((item) => item.snapshot);
-    assertProjectionKeys(rawHistory, projected, 'historical evidenceHistory');
-    for (let index = 0; index < built.length; index++) {
-        const item = built[index];
-        if (!item
-            || item.rawSnapshot.id !== item.snapshot.id
-            || item.rawSnapshot.fingerprint !== item.snapshot.fingerprint) {
-            throw new TypeError(`The CLI case pack contains an invalid historical evidence identity at snapshot ${index}.`);
-        }
-    }
-    return projected;
-}
-function historicalEvidenceChanges(previous, current, caseVersion) {
-    const previousSnapshot = previous;
-    const currentSnapshot = current;
-    const changes = compareCaseEvidence(previousSnapshot, currentSnapshot)
-        .filter((change) => caseVersion >= 10 || !['opportunityScore', 'opportunityFactors'].includes(change.field));
-    if (caseVersion <= 9 && previous.opportunityScore !== current.opportunityScore) {
-        changes.push({
-            field: 'opportunityScore',
-            label: 'Opportunity score',
-            before: previous.opportunityScore ?? null,
-            after: current.opportunityScore ?? null,
-            tone: 'neutral',
-        });
-    }
-    if (caseVersion <= 9 && !canonicalValuesMatch(previous.opportunityFactors, current.opportunityFactors)) {
-        changes.push({
-            field: 'opportunityFactors',
-            label: 'Opportunity factors',
-            before: previous.opportunityFactors,
-            after: current.opportunityFactors,
-            tone: 'neutral',
-        });
-    }
-    const order = new Map(HISTORICAL_CHANGE_ORDER.map((field, index) => [field, index]));
-    return changes
-        .sort((left, right) => (order.get(left.field) ?? Number.MAX_SAFE_INTEGER) - (order.get(right.field) ?? Number.MAX_SAFE_INTEGER))
-        .slice(0, 40);
-}
-function historicalEvidenceTimeline(history, caseVersion) {
-    return history.map((snapshot, index) => {
-        if (index === 0) {
-            return {
-                snapshot,
-                isBaseline: true,
-                hasRepeatedObservation: snapshot.firstCapturedAt !== snapshot.capturedAt,
-                changes: null,
-                hasIncomparableChange: false,
-                incomparableReasons: [],
-            };
-        }
-        const previous = history[index - 1];
-        if (!previous)
-            throw new TypeError('The CLI case pack contains an invalid historical evidence timeline.');
-        const changes = historicalEvidenceChanges(previous, snapshot, caseVersion);
-        let incomparableReasons = caseEvidenceIncomparableReasons(previous, snapshot).filter((reason) => caseVersion >= 10 || reason !== 'opportunity-model');
-        if (changes.length === 0 && snapshot.fingerprint !== previous.fingerprint && incomparableReasons.length === 0) {
-            incomparableReasons = ['other'];
-        }
-        return {
-            snapshot,
-            isBaseline: false,
-            hasRepeatedObservation: snapshot.firstCapturedAt !== snapshot.capturedAt,
-            changes: changes.length ? changes : null,
-            hasIncomparableChange: incomparableReasons.length > 0,
-            incomparableReasons,
-        };
-    });
-}
-function pickHistoricalFields(value, fields) {
-    return Object.fromEntries(fields.map((field) => [field, structuredClone(value[field])]));
-}
-function historicalAnalystResponse(caseRecord, caseVersion, reportVersion) {
-    if (reportVersion === 1)
-        return null;
-    const oldPinFields = ['id', 'label', 'value', 'source', 'observedAt', 'completeness', 'limitations', 'createdAt'];
-    const expandedPinFields = [
-        'id', 'checkpointId', 'field', 'category', 'label', 'value', 'source', 'sourceState', 'sourceSchema',
-        'observedAt', 'collectionDepth', 'completeness', 'truncated',
-        ...(caseVersion >= 7 ? ['transitionExpectation'] : []),
-        'limitations', 'createdAt',
-    ];
-    const evidencePins = caseRecord.evidencePins.map((item) => pickHistoricalFields(item, caseVersion >= 5 ? expandedPinFields : oldPinFields));
-    const decisions = caseRecord.decisions.map((item) => pickHistoricalFields(item, ['id', 'summary', 'rationale', 'evidencePinIds', 'createdAt']));
-    const actions = caseRecord.actions.map((item) => pickHistoricalFields(item, ['id', 'type', 'recipient', 'contactSource', 'contactLimitations', 'dueAt', 'state', 'reference', 'followUpAt', 'outcome', 'createdAt', 'updatedAt']));
-    const assertions = caseRecord.assertions.map((item) => {
-        const projected = pickHistoricalFields(item, [
-            'id', 'kind', 'statement', 'rationale', 'evidencePinIds',
-            ...(reportVersion >= 6 ? ['evidenceRelations'] : []),
-            'state', 'createdAt', 'updatedAt',
-        ]);
-        if (caseVersion >= 7 && item.provenance)
-            projected.provenance = structuredClone(item.provenance);
-        return projected;
-    });
-    const manualTrail = caseRecord.manualTrail.map((item) => pickHistoricalFields(item, ['id', 'kind', 'summary', 'target', 'createdAt']));
-    const sightings = caseRecord.sightings.map((item) => pickHistoricalFields(item, ['id', 'state', 'sourceClass', 'category', 'source', 'observedAt', 'completeness', 'evidencePinId', 'limitations', 'createdAt']));
-    const branches = (caseRecord.branches ?? []).map((item) => pickHistoricalFields(item, ['id', 'name', 'state', 'evidencePinIds', 'checkpointIds', 'assertionIds', 'actionIds', 'createdAt', 'updatedAt']));
-    return {
-        evidencePins,
-        decisions,
-        actions,
-        ...(reportVersion >= 3 ? { assertions, manualTrail } : {}),
-        ...(reportVersion >= 4 ? { sightings } : {}),
-        ...(reportVersion >= 7 ? { branches } : {}),
-    };
-}
-function assertHistoricalCaseResponseEpoch(rawCase, caseRecord, caseVersion, reportVersion, path) {
-    const expected = historicalAnalystResponse(caseRecord, caseVersion, reportVersion);
-    const introductions = new Map([
-        ['evidencePins', 3], ['decisions', 3], ['actions', 3],
-        ['assertions', 4], ['manualTrail', 4], ['sightings', 9], ['branches', 11],
-    ]);
-    for (const [field, introduced] of introductions) {
-        if (caseVersion < introduced) {
-            if (Object.hasOwn(rawCase, field)) {
-                throw new TypeError(`The CLI case pack contains ${path}.${field} outside its historical Case epoch.`);
-            }
-            continue;
-        }
-        if (Object.hasOwn(rawCase, field)) {
-            const projection = record(expected)?.[field];
-            assertProjectionKeys(rawCase[field], projection, `${path}.${field}`);
-        }
-    }
-    if (caseVersion < 10 && Object.hasOwn(rawCase, 'reviewReasonCode')) {
-        throw new TypeError(`The CLI case pack contains ${path}.reviewReasonCode outside its historical Case epoch.`);
-    }
-}
-function historicalReportProjection(caseRecord, evidenceHistory, report, caseVersion, reportVersion, generatedAt) {
-    const limitation = LEGACY_REPORT_LIMITATION_BY_VERSION.get(reportVersion);
-    if (!limitation)
-        throw new TypeError('The CLI case pack contains an unsupported historical Case report.');
-    const reportCase = {
-        id: caseRecord.id,
-        domain: caseRecord.domain,
-        status: caseRecord.status,
-        disposition: caseRecord.disposition,
-        ...(reportVersion >= 5 ? { reviewReasonCode: caseRecord.reviewReasonCode ?? null } : {}),
-        ...(reportVersion >= 6 ? { interoperabilityTags: analystInteroperabilityTags(caseRecord.disposition, caseRecord.reviewReasonCode) } : {}),
-        tags: [...caseRecord.tags],
-        source: caseRecord.source,
-        openedAt: caseRecord.createdAt,
-        updatedAt: caseRecord.updatedAt,
-        notesIncluded: false,
-    };
-    const response = historicalAnalystResponse(caseRecord, caseVersion, reportVersion);
-    return {
-        schema: CASE_REPORT_SCHEMA,
-        schemaVersion: reportVersion,
-        generatedAt,
-        application: reportVersion >= 6
-            ? buildPortableGeneratorMetadata(reportApplicationVersion(report))
-            : { name: 'WHOISleuth' },
-        case: reportCase,
-        currentAssessment: evidenceHistory.at(-1) ?? null,
-        evidenceTimeline: historicalEvidenceTimeline(evidenceHistory, caseVersion),
-        ...(response ? { analystResponse: response } : {}),
-        limitations: limitation,
-    };
-}
-function assertLegacyProfileContextEpoch(rawCase, report) {
-    const assertSnapshot = (value, path) => {
-        const snapshot = record(value);
-        if (snapshot && (Object.hasOwn(snapshot, 'profileContextState') || Object.hasOwn(snapshot, 'profileContextLimitation'))) {
-            throw new TypeError(`The CLI case pack contains schema-12 profile context fields outside the historical ${path} epoch.`);
-        }
-    };
-    if (Array.isArray(rawCase.evidenceHistory)) {
-        rawCase.evidenceHistory.forEach((snapshot, index) => assertSnapshot(snapshot, `cases evidence snapshot ${index}`));
-    }
-    assertSnapshot(report.currentAssessment, 'current assessment');
-    if (Array.isArray(report.evidenceTimeline)) {
-        report.evidenceTimeline.forEach((entry, index) => {
-            const timelineEntry = record(entry);
-            assertSnapshot(timelineEntry?.snapshot, `report timeline snapshot ${index}`);
-            if (!Array.isArray(timelineEntry?.changes))
-                return;
-            timelineEntry.changes.forEach((value, changeIndex) => {
-                const change = record(value);
-                if (!change)
-                    return;
-                const field = change.field;
-                const label = change.label;
-                const carriesProfileContextField = ['profileContextState', 'profileContextLimitation'].some((key) => (Object.hasOwn(change, key)
-                    || field === key
-                    || [change.before, change.after].some((candidate) => Boolean(record(candidate) && Object.hasOwn(record(candidate), key)))));
-                if (carriesProfileContextField
-                    || (typeof label === 'string' && /profile[ -]?context/iu.test(label))) {
-                    throw new TypeError(`The CLI case pack contains schema-12 profile context fields outside the historical report timeline change ${index}.${changeIndex} epoch.`);
-                }
-            });
-        });
-    }
-}
 function redactedCase(record, audience) {
     if (audience === 'internal')
         return structuredClone(record);
     return {
         ...structuredClone(record),
+        status: audience === 'public' && record.status === 'resolved' && record.closures.records.length
+            ? 'reviewing'
+            : record.status,
         brandProfileIds: audience === 'public' ? [] : [...record.brandProfileIds],
         notes: [],
         actions: audience === 'public' ? [] : record.actions.map((item) => ({ ...item, recipient: '[redacted]' })),
         manualTrail: record.manualTrail.map((item) => ({ ...item, target: null })),
         assertions: audience === 'public' ? [] : structuredClone(record.assertions),
+        observedEffects: audience === 'public'
+            ? publicObservedEffectHistory(record.observedEffects.preV13HistoryUnavailable)
+            : structuredClone(record.observedEffects),
+        closures: audience === 'public'
+            ? publicClosureHistory(record.closures.preV13HistoryUnavailable)
+            : structuredClone(record.closures),
         branches: audience === 'public' ? [] : structuredClone(record.branches ?? []),
     };
 }
@@ -673,33 +288,39 @@ export function buildCliCasePack(input, options, generatedAt = new Date().toISOS
         throw new CliUsageError('case-pack requires --reviewed after the audience-specific output has been checked.');
     if (Buffer.byteLength(input, 'utf8') > MAX_CASE_PACK_INPUT_BYTES)
         throw new CliUsageError('Case-pack input is limited to 4 MiB.');
+    const normalized = input.replace(/^\uFEFF/u, '');
     let parsed;
     try {
-        parsed = JSON.parse(input.replace(/^\uFEFF/u, ''));
+        scanBoundedJson(normalized);
+        parsed = JSON.parse(normalized);
     }
     catch {
-        throw new CliUsageError('Case-pack input must be valid JSON.');
+        throw new CliUsageError('Case-pack input must be valid bounded JSON without duplicate keys.');
     }
     const root = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
-    if (typeof root.version !== 'number' || !CASE_IMPORT_VERSIONS.includes(root.version) || !Array.isArray(root.cases)) {
-        throw new CliUsageError(`Case-pack input must be a supported WHOISleuth case export through schema ${CASE_SCHEMA_VERSION}.`);
+    if (Number.isSafeInteger(root.version) && root.version < CASE_SCHEMA_VERSION) {
+        throw new CliUsageError(`Case schema ${String(root.version)} is retired. Export it as schema ${CASE_SCHEMA_VERSION} with the last broad-reader release before packaging; no data was changed.`);
     }
-    if (root.version === CASE_SCHEMA_VERSION) {
-        try {
-            assertCanonicalCaseIdentities(root.cases, 'Case-pack input');
-            for (const item of root.cases) {
-                const rawCase = record(item);
-                if (!rawCase || !Object.hasOwn(rawCase, 'brandProfileIds'))
-                    throw new Error('missing');
-                assertCaseBrandProfileIds(rawCase.brandProfileIds);
-            }
+    if (Number.isSafeInteger(root.version) && root.version > CASE_SCHEMA_VERSION) {
+        throw new CliUsageError(`Case schema ${String(root.version)} is newer than the supported schema ${CASE_SCHEMA_VERSION}; no data was changed.`);
+    }
+    if (root.version !== CASE_SCHEMA_VERSION || !Array.isArray(root.cases)) {
+        throw new CliUsageError(`Case-pack input must be a well-formed WHOISleuth Case schema ${CASE_SCHEMA_VERSION} export.`);
+    }
+    try {
+        assertCanonicalCaseIdentities(root.cases, 'Case-pack input');
+        for (const item of root.cases) {
+            const rawCase = record(item);
+            if (!rawCase || !Object.hasOwn(rawCase, 'brandProfileIds'))
+                throw new Error('missing');
+            assertCaseBrandProfileIds(rawCase.brandProfileIds);
         }
-        catch (cause) {
-            if (cause instanceof TypeError && /Case identity/u.test(cause.message)) {
-                throw new CliUsageError(cause.message);
-            }
-            throw new CliUsageError('Case-pack schema 12 input requires exact canonical Case identities and an exact, unique, bounded brandProfileIds array on every case.');
+    }
+    catch (cause) {
+        if (cause instanceof TypeError && /Case identity/u.test(cause.message)) {
+            throw new CliUsageError(cause.message);
         }
+        throw new CliUsageError(`Case-pack schema ${CASE_SCHEMA_VERSION} input requires exact canonical Case identities and an exact, unique, bounded brandProfileIds array on every case.`);
     }
     const normalised = normalizeCaseStore(root).cases;
     if (!normalised.length)
@@ -710,13 +331,11 @@ export function buildCliCasePack(input, options, generatedAt = new Date().toISOS
     if (normalised.length > MAX_CASE_PACK_CASES) {
         throw new CliUsageError(`Case packs are limited to ${MAX_CASE_PACK_CASES} reviewed cases. Export a smaller selected set so no case is silently omitted.`);
     }
-    if (root.version === CASE_SCHEMA_VERSION) {
-        try {
-            assertCurrentCaseProjection(root.cases, normalised, 'Case-pack input');
-        }
-        catch (cause) {
-            throw new CliUsageError(cause instanceof Error ? cause.message : 'Case-pack schema 12 input is not exact.');
-        }
+    try {
+        assertCurrentCaseProjection(root.cases, normalised, 'Case-pack input');
+    }
+    catch (cause) {
+        throw new CliUsageError(cause instanceof Error ? cause.message : `Case-pack schema ${CASE_SCHEMA_VERSION} input is not exact.`);
     }
     const cases = normalised.map((item) => redactedCase(item, options.audience));
     const brandProfileReferencesOmitted = options.audience === 'public'
@@ -727,7 +346,7 @@ export function buildCliCasePack(input, options, generatedAt = new Date().toISOS
         includeNotes: false,
         generatedAt,
     }).json);
-    const exclusions = expectedExclusions(options.audience, CASE_SCHEMA_VERSION);
+    const exclusions = expectedExclusions(options.audience);
     const packet = Object.freeze({
         schema: CLI_CASE_PACK_SCHEMA,
         version: CLI_CASE_PACK_VERSION,
@@ -756,10 +375,31 @@ export function buildCliCasePack(input, options, generatedAt = new Date().toISOS
     return document;
 }
 export function verifyCliCasePack(input) {
+    assertBoundedJsonStructure(input, 'CLI case pack');
     const root = record(input);
+    const packet = record(root?.packet);
+    const packetVersion = packet?.version;
+    if (packet?.schema === CLI_CASE_PACK_SCHEMA && Number.isSafeInteger(packetVersion)) {
+        if (packetVersion < CLI_CASE_PACK_VERSION) {
+            throw new TypeError(`CLI case-pack version ${String(packetVersion)} is retired. Export it again as version ${CLI_CASE_PACK_VERSION} before importing; no data was changed.`);
+        }
+        if (packetVersion > CLI_CASE_PACK_VERSION) {
+            throw new TypeError(`CLI case-pack version ${String(packetVersion)} is newer than the supported version ${CLI_CASE_PACK_VERSION}; no data was changed.`);
+        }
+    }
+    const caseVersion = root?.version;
+    if (Number.isSafeInteger(caseVersion)) {
+        if (caseVersion < CASE_SCHEMA_VERSION
+            && !CASE_IMPORT_VERSIONS.includes(caseVersion)) {
+            throw new TypeError(`Case schema ${String(caseVersion)} in this CLI case pack is not part of the public compatibility boundary; no data was changed.`);
+        }
+        if (caseVersion > CASE_SCHEMA_VERSION) {
+            throw new TypeError(`Case schema ${String(caseVersion)} in this CLI case pack is newer than the supported schema ${CASE_SCHEMA_VERSION}; no data was changed.`);
+        }
+    }
     let serialized;
     try {
-        serialized = JSON.stringify(root);
+        serialized = JSON.stringify(input);
     }
     catch {
         throw new TypeError('The CLI case pack structure is not serializable.');
@@ -767,15 +407,16 @@ export function verifyCliCasePack(input) {
     if (Buffer.byteLength(serialized, 'utf8') > MAX_CASE_IMPORT_BYTES) {
         throw new TypeError('The CLI case pack exceeds the browser import limit.');
     }
-    const packet = record(root?.packet);
     const integrity = record(root?.integrity);
     const redactionManifest = record(packet?.redactionManifest);
     if (!root
         || !packet
         || packet.schema !== CLI_CASE_PACK_SCHEMA
-        || (packet.version !== LEGACY_CLI_CASE_PACK_VERSION && packet.version !== CLI_CASE_PACK_VERSION)
+        || packet.version !== CLI_CASE_PACK_VERSION
+        || typeof root.version !== 'number'
+        || !CASE_IMPORT_VERSIONS.includes(root.version)
         || packet.reviewed !== true
-        || !['internal', 'public', 'trusted'].includes(String(packet.audience))
+        || (packet.audience !== 'internal' && packet.audience !== 'public' && packet.audience !== 'trusted')
         || !Array.isArray(packet.reports)
         || !redactionManifest
         || !Array.isArray(root.cases)
@@ -783,121 +424,84 @@ export function verifyCliCasePack(input) {
         || root.cases.length > MAX_CASE_PACK_CASES
         || packet.reports.length !== root.cases.length
         || typeof root.exportedAt !== 'string'
-        || typeof root.version !== 'number'
-        || !CASE_IMPORT_VERSIONS.includes(root.version)
         || !integrity
         || integrity.algorithm !== 'SHA-256'
+        || integrity.canonicalization !== SORTED_JSON_V2
         || typeof integrity.digestSha256 !== 'string'
         || !/^sha256:[a-f0-9]{64}$/u.test(integrity.digestSha256)) {
-        throw new TypeError('The CLI case pack structure or integrity envelope is invalid.');
-    }
-    let canonicalization;
-    try {
-        canonicalization = resolveArtifactCanonicalization(packet.version, integrity.canonicalization, [
-            { version: LEGACY_CLI_CASE_PACK_VERSION, canonicalization: SORTED_JSON_V1, explicit: true },
-            { version: CLI_CASE_PACK_VERSION, canonicalization: SORTED_JSON_V2, explicit: true },
-        ], 'CLI case pack');
+        throw new TypeError('The CLI case pack structure or integrity envelope is malformed.');
     }
-    catch {
-        throw new TypeError('The CLI case pack structure or integrity envelope is invalid.');
-    }
-    const { integrity: _integrity, ...unsigned } = root;
+    assertClosedEnvelopes(root, packet, integrity, redactionManifest, packet.reports, root.version);
+    assertSensitiveFieldPlacement(root, serialized.length);
     const audience = packet.audience;
-    const current = root.version === CASE_SCHEMA_VERSION;
-    assertClosedEnvelopes(root, packet, integrity, redactionManifest, packet.reports, current);
-    assertSensitiveFieldPlacement(root, current, serialized.length);
     if (!Number.isSafeInteger(redactionManifest.sourceCaseCount)
-        || Number(redactionManifest.sourceCaseCount) !== root.cases.length
+        || redactionManifest.sourceCaseCount !== root.cases.length
         || !stringListsMatch(redactionManifest.excluded, expectedExclusions(audience, root.version))) {
         throw new TypeError('The CLI case pack has an invalid audience redaction manifest.');
     }
-    const caseReferenceLists = [];
-    const reportReferenceLists = [];
-    if (!current)
-        assertHistoricalCaseOwnKeys(root.cases, root.version);
     assertCanonicalCaseIdentities(root.cases, 'The CLI case pack');
     const normalised = normalizeCaseStore(root).cases;
     if (normalised.length !== root.cases.length) {
         throw new TypeError('The CLI case pack contains an invalid case collection.');
     }
-    const normalisedByDomain = new Map(normalised.map((item) => [item.domain, item]));
-    if (current)
+    if (root.version === CASE_SCHEMA_VERSION)
         assertCurrentCaseProjection(root.cases, normalised, 'The CLI case pack');
-    for (let index = 0; index < root.cases.length; index++) {
+    const normalisedByDomain = new Map(normalised.map((item) => [item.domain, item]));
+    const caseReferenceLists = [];
+    const reportReferenceLists = [];
+    for (let index = 0; index < root.cases.length; index += 1) {
         const rawCase = record(root.cases[index]);
         const report = record(packet.reports[index]);
         const reportCase = record(report?.case);
-        const reportVersion = report?.schemaVersion;
         if (!rawCase
             || !report
             || !reportCase
             || typeof rawCase.domain !== 'string'
             || report.schema !== CASE_REPORT_SCHEMA
-            || !reportVersionMatchesCase(root.version, reportVersion)
+            || !caseReportVersionMatchesCase(root.version, report.schemaVersion)
             || reportCase.id !== rawCase.id
-            || reportCase.domain !== rawCase.domain) {
+            || reportCase.domain !== rawCase.domain
+            || !normalisedByDomain.has(rawCase.domain)) {
             throw new TypeError('The CLI case pack contains an invalid or mismatched Case report.');
         }
-        const normalisedCase = normalisedByDomain.get(rawCase.domain);
-        if (!normalisedCase)
-            throw new TypeError('The CLI case pack contains an invalid case collection.');
-        assertAudienceFields(rawCase, audience, root.version >= 11);
-        if (!current)
-            assertLegacyProfileContextEpoch(rawCase, report);
-        if (current) {
-            try {
-                if (!Object.hasOwn(rawCase, 'brandProfileIds') || !Object.hasOwn(reportCase, 'brandProfileIds'))
-                    throw new Error('missing');
-                caseReferenceLists.push(assertCaseBrandProfileIds(rawCase.brandProfileIds));
-                reportReferenceLists.push(assertCaseBrandProfileIds(reportCase.brandProfileIds));
-            }
-            catch {
-                throw new TypeError('The CLI case pack contains invalid Brand Profile references.');
-            }
-            assertCurrentReportProjection(report, rawCase);
+        assertAudienceFields(rawCase, audience);
+        try {
+            if (!Object.hasOwn(rawCase, 'brandProfileIds') || !Object.hasOwn(reportCase, 'brandProfileIds'))
+                throw new Error('missing');
+            caseReferenceLists.push(assertCaseBrandProfileIds(rawCase.brandProfileIds));
+            reportReferenceLists.push(assertCaseBrandProfileIds(reportCase.brandProfileIds));
         }
-        else {
-            const historicalHistory = normalizeHistoricalEvidenceHistory(rawCase.evidenceHistory, root.version);
-            assertProjectionKeys(rawCase, { ...normalisedCase, evidenceHistory: historicalHistory }, `cases[${index}]`);
-            assertHistoricalCaseResponseEpoch(rawCase, normalisedCase, root.version, reportVersion, `cases[${index}]`);
-            if (report.generatedAt !== root.exportedAt) {
-                throw new TypeError('The CLI case pack contains an invalid or mismatched historical report generation time.');
-            }
-            const expectedReport = historicalReportProjection(normalisedCase, historicalHistory, report, root.version, reportVersion, root.exportedAt);
-            if (!canonicalValuesMatch(report, expectedReport)) {
-                throw new TypeError('The CLI case pack contains an invalid or mismatched historical Case report projection.');
-            }
+        catch {
+            throw new TypeError('The CLI case pack contains invalid Brand Profile references.');
         }
+        if (root.version === CASE_SCHEMA_VERSION)
+            assertCurrentReportProjection(report, rawCase);
     }
-    if (current) {
-        const omitted = redactionManifest.brandProfileReferencesOmitted;
-        if (!Object.hasOwn(redactionManifest, 'brandProfileReferencesOmitted')
-            || !Number.isSafeInteger(omitted)
-            || Number(omitted) < 0
-            || Number(omitted) > MAX_CASE_PACK_CASES * 8) {
-            throw new TypeError('The CLI case pack has an invalid Brand Profile redaction manifest.');
-        }
-        const referencesMatch = caseReferenceLists.every((references, index) => {
-            const reportReferences = reportReferenceLists[index];
-            return reportReferences?.length === references.length
-                && references.every((reference, referenceIndex) => reportReferences[referenceIndex] === reference);
-        });
-        if (audience === 'public') {
-            if (caseReferenceLists.some((references) => references.length !== 0)
-                || reportReferenceLists.some((references) => references.length !== 0)) {
-                throw new TypeError('The public CLI case pack has an invalid Brand Profile redaction manifest.');
-            }
-        }
-        else if (Number(omitted) !== 0 || !referencesMatch) {
-            throw new TypeError('The trusted or internal CLI case pack has inconsistent Brand Profile references.');
+    const omitted = redactionManifest.brandProfileReferencesOmitted;
+    if (!Object.hasOwn(redactionManifest, 'brandProfileReferencesOmitted')
+        || !Number.isSafeInteger(omitted)
+        || omitted < 0
+        || omitted > MAX_CASE_PACK_CASES * 8) {
+        throw new TypeError('The CLI case pack has an invalid Brand Profile redaction manifest.');
+    }
+    const referencesMatch = caseReferenceLists.every((references, index) => {
+        const reportReferences = reportReferenceLists[index];
+        return reportReferences?.length === references.length
+            && references.every((reference, referenceIndex) => reportReferences[referenceIndex] === reference);
+    });
+    if (audience === 'public') {
+        if (caseReferenceLists.some((references) => references.length !== 0)
+            || reportReferenceLists.some((references) => references.length !== 0)) {
+            throw new TypeError('The public CLI case pack has an invalid Brand Profile redaction manifest.');
         }
     }
-    else if (Object.hasOwn(redactionManifest, 'brandProfileReferencesOmitted')) {
-        throw new TypeError('The legacy CLI case pack has an invalid Brand Profile redaction manifest.');
+    else if (omitted !== 0 || !referencesMatch) {
+        throw new TypeError('The trusted or internal CLI case pack has inconsistent Brand Profile references.');
     }
+    const { integrity: _integrity, ...unsigned } = root;
     let calculated;
     try {
-        calculated = `sha256:${createHash('sha256').update(canonicalArtifactJsonFor(unsigned, canonicalization)).digest('hex')}`;
+        calculated = `sha256:${createHash('sha256').update(canonicalArtifactJsonV2(unsigned)).digest('hex')}`;
     }
     catch {
         throw new TypeError('The CLI case pack structure is not serializable.');