@slicedearth/whoisleuth-cli 1.47.4 → 2.0.1

package/{frontend/src/lib/analysis/case-record-core.js → packages/cases/case-record-core.mjs}

@@ -1,6 +1,8 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
-import { CASE_DISPOSITIONS, CASE_REVIEW_REASONS, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_DOMAIN_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.js";
+import { CASE_DISPOSITIONS, CASE_SCHEMA_VERSION, CASE_REVIEW_REASONS, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_DOMAIN_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.mjs";
+import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "../evidence/observation.mjs";
+import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
 // Forward-version policy (two distinct guarantees):
 //   - A locally-stored envelope that declares a version greater than this is
 //     still read best-effort on load (known fields kept, unknown dropped), but
@@ -47,6 +49,11 @@ export const REGISTERED_LIKE = new Set([
 // URL/DOM/query-string-safe id shape. UUIDs satisfy this; anything else is
 // treated as untrusted and deterministically repaired.
 const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+// Unicode U-labels can be substantially longer than their canonical A-label
+// representation (for example, decomposed combining sequences). Keep the raw
+// work bound finite, then enforce DNS' 253/63-byte limits on the URL parser's
+// canonical ASCII hostname below.
+export const MAX_EVIDENCE_DOMAIN_INPUT_LENGTH = 1024;
 export function objectRecord(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -89,47 +96,56 @@ export function hashString(value) {
 export function deterministicId(domain) {
     return `c-${hashString(domain)}`;
 }
+export { normalizeDomain } from "../evidence/domain-name.mjs";
 /**
- * Strict, canonical domain normalization. Parses through the WHATWG URL host
- * (which strips scheme/path/port/userinfo and applies IDNA/punycode so Unicode
- * and its punycode form collapse to one value), lowercases, drops a single
- * terminal root dot, and validates LDH hostname labels. Rejects IPs, ASNs,
- * whitespace/control characters, underscores, empty/overlong/hyphen-edged
- * labels, and undotted names. Returns '' for anything unusable.
- * @param {unknown} value
- * @returns {string}
+ * Canonicalizes a hostname supplied as source evidence without applying the
+ * analyst-input conveniences in normalizeDomain. URI syntax, credentials,
+ * ports, paths, queries, fragments, separators, whitespace, and controls make
+ * the observation invalid rather than being silently discarded.
  */
-export function normalizeDomain(value) {
-    const raw = String(value == null ? '' : value).trim();
-    if (!raw || /[\s\x00-\x1f\x7f]/.test(raw))
+export function normalizeEvidenceDomain(value) {
+    if (typeof value !== 'string' || !value || value !== value.trim())
+        return '';
+    if (value.length > MAX_EVIDENCE_DOMAIN_INPUT_LENGTH)
+        return '';
+    if (/[\s\x00-\x1f\x7f%@/:?#\\]/u.test(value))
         return '';
-    let hostname;
+    const withoutRootDot = value.endsWith('.') ? value.slice(0, -1) : value;
+    if (!withoutRootDot || withoutRootDot.endsWith('.'))
+        return '';
+    let hostname = '';
     try {
-        const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(raw);
-        hostname = new URL(hasScheme ? raw : `http://${raw}`).hostname;
+        hostname = new URL(`http://${withoutRootDot}`).hostname.toLowerCase();
     }
     catch {
         return '';
     }
-    hostname = hostname.toLowerCase().replace(/\.$/, '');
-    if (!hostname || hostname.length > MAX_DOMAIN_LENGTH)
-        return '';
-    // A leftover ':' or '[' means a port/IPv6 the host parser preserved.
-    if (hostname.includes(':') || hostname.startsWith('['))
+    if (!hostname || hostname.length > MAX_DOMAIN_LENGTH || hostname !== hostname.replace(/\.$/u, ''))
         return '';
     const labels = hostname.split('.');
     if (labels.length < 2)
         return '';
-    const labelPattern = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-    for (const label of labels) {
-        if (!label || label.length > 63 || !labelPattern.test(label))
-            return '';
-    }
-    // An all-numeric final label is an IPv4 address, never a hostname TLD.
-    if (/^[0-9]+$/.test(labels.at(-1) ?? ''))
+    const labelPattern = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
+    if (labels.some((label) => !label || label.length > 63 || !labelPattern.test(label)))
+        return '';
+    if (/^[0-9]+$/u.test(labels.at(-1) ?? ''))
         return '';
     return hostname;
 }
+/**
+ * Retains an exact submitted hostname only when it is strict evidence input
+ * for the Case's canonical registrable identity. This boundary deliberately
+ * does not repair URI syntax or infer a hostname from other evidence.
+ */
+export function normalizeEvidenceHostnameForCase(value, caseDomain) {
+    const hostname = normalizeEvidenceDomain(value);
+    const canonicalCase = normalizeEvidenceDomain(caseDomain);
+    if (!hostname || !canonicalCase)
+        return null;
+    if (canonicalRegistrableDomain(canonicalCase) !== canonicalCase)
+        return null;
+    return canonicalRegistrableDomain(hostname) === canonicalCase ? hostname : null;
+}
 export function normalizeStatus(value) {
     return typeof value === 'string' && STATUS_VALUES.has(value) ? value : DEFAULT_STATUS;
 }
@@ -151,6 +167,17 @@ export function isoOrNull(value) {
     }
     return null;
 }
+/** Canonical instant for versioned case data; current schemas require a zone. */
+export function caseTimestampOrNull(value, sourceVersion) {
+    const explicit = normalizeExplicitIsoTimestamp(value);
+    if (explicit)
+        return explicit;
+    return sourceVersion !== undefined
+        && sourceVersion !== null
+        && sourceVersion < CASE_SCHEMA_VERSION
+        ? normalizeLegacyIsoTimestamp(value)
+        : null;
+}
 export function isoOrNow(value, fallback) {
     return isoOrNull(value) || fallback;
 }
@@ -194,12 +221,12 @@ export function normalizeNoteBody(body) {
  * @param {string | null} fallback
  * @returns {CaseNote | null}
  */
-function normalizeNote(raw, fallback) {
+function normalizeNote(raw, fallback, sourceVersion) {
     const record = objectRecord(raw);
     const body = normalizeNoteBody(record.body);
     if (!body)
         return null;
-    const createdAt = isoOrNull(record.createdAt) || fallback;
+    const createdAt = caseTimestampOrNull(record.createdAt, sourceVersion) || fallback;
     if (!createdAt)
         return null;
     return {
@@ -215,13 +242,13 @@ function normalizeNote(raw, fallback) {
  *   updatedAt for imports, never the current time)
  * @returns {CaseNote[]}
  */
-export function normalizeNotes(value, fallback) {
+export function normalizeNotes(value, fallback, sourceVersion) {
     if (!Array.isArray(value))
         return [];
     const seen = new Set();
     const notes = [];
     for (const raw of value) {
-        const note = normalizeNote(raw, fallback);
+        const note = normalizeNote(raw, fallback, sourceVersion);
         if (!note || seen.has(note.id))
             continue;
         seen.add(note.id);

package/packages/cases/case-record-model.mjs

@@ -0,0 +1,9 @@
+// Stable case-record facade. Core validation, evidence history/comparison,
+// and analyst-record operations remain framework-neutral and independently
+// testable while existing consumers keep one compatibility import.
+export * from "./case-record-contracts.mjs";
+export * from "./case-record-core.mjs";
+export * from "./case-brand-profile-references.mjs";
+export * from "./case-evidence-model.mjs";
+export * from "./case-record-operations.mjs";
+export * from "./case-investigation-branch-model.mjs";

package/{frontend/src/lib/analysis/case-record-operations.js → packages/cases/case-record-operations.mjs}

@@ -1,11 +1,11 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
-import { appendCaseAction, appendCaseAssertion, appendCaseDecision, appendCaseEvidencePin, appendCaseEvidencePins, appendCaseManualTrailEvent, appendCaseSighting, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseSightings, updateCaseAction, updateCaseAssertion, } from "./case-response-model.js";
-import { MAX_CASES, MAX_NOTES_PER_CASE, } from "./case-record-contracts.js";
-import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, deterministicId, isoOrNow, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeReviewReasonCode, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.js";
-import { assertCaseBrandProfileIds, normalizeCaseBrandProfileIds, } from "./case-brand-profile-references.js";
-import { normalizeEvidenceHistory, } from "./case-evidence-model.js";
-import { appendCaseInvestigationBranch, caseInvestigationBranchReferences, normalizeCaseInvestigationBranches, updateCaseInvestigationBranch, } from "./case-investigation-branch-model.js";
+import { appendCaseAction, appendCaseAssertion, appendCaseClosure, appendCaseDecision, appendCaseEvidencePin, appendCaseEvidencePins, appendCaseManualTrailEvent, appendCaseObservedEffectReview, appendCaseSighting, buildCaseClosureLinkContext, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseClosureHistory, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseObservedEffectHistory, normalizeCaseSightings, updateCaseAction, updateCaseAssertion, } from "./case-response-model.mjs";
+import { CASE_SCHEMA_VERSION, MAX_CASES, MAX_NOTES_PER_CASE, } from "./case-record-contracts.mjs";
+import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, caseTimestampOrNull, deterministicId, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeReviewReasonCode, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.mjs";
+import { assertCaseBrandProfileIds, normalizeCaseBrandProfileIds, } from "./case-brand-profile-references.mjs";
+import { normalizeEvidenceHistory, } from "./case-evidence-model.mjs";
+import { appendCaseInvestigationBranch, caseInvestigationBranchReferences, normalizeCaseInvestigationBranches, updateCaseInvestigationBranch, } from "./case-investigation-branch-model.mjs";
 // ---------------------------------------------------------------------------
 // Case normalization
 // ---------------------------------------------------------------------------
@@ -18,12 +18,13 @@ function inferCaptureSource(caseSource) {
 }
 // Builds a case's bounded current-schema evidence history. Uses a lenient
 // local fallback timestamp so recoverable current data always loads.
-function normalizeCaseEvidence(record, createdAt, updatedAt, now, sourceVersion) {
+function normalizeCaseEvidence(record, domain, createdAt, updatedAt, now, sourceVersion) {
     const localFallback = updatedAt || createdAt || now;
     if (Array.isArray(record.evidenceHistory)) {
         return normalizeEvidenceHistory(record.evidenceHistory, {
             source: DEFAULT_EVIDENCE_SOURCE,
             fallback: localFallback,
+            caseDomain: domain,
             ...(sourceVersion === undefined ? {} : { sourceVersion }),
         });
     }
@@ -41,36 +42,50 @@ function normalizeCaseEvidence(record, createdAt, updatedAt, now, sourceVersion)
  * @returns {CaseRecord | null}
  */
 export function normalizeCase(raw, existing, nowIso, sourceVersion) {
-    const now = nowIso || new Date().toISOString();
+    const now = caseTimestampOrNull(nowIso) || new Date().toISOString();
     const record = objectRecord(raw);
     const domain = normalizeDomain(existing ? existing.domain : record.domain);
     if (!domain)
         return null;
-    const createdAt = existing ? existing.createdAt : isoOrNow(record.createdAt, now);
-    const updatedAt = isoOrNow(record.updatedAt, now);
-    const evidencePins = normalizeCaseEvidencePins(record.evidencePins, updatedAt);
+    const createdAt = existing ? existing.createdAt : caseTimestampOrNull(record.createdAt, sourceVersion) || now;
+    const updatedAt = caseTimestampOrNull(record.updatedAt, sourceVersion) || createdAt;
+    const timestampOptions = {
+        legacyTimestamps: sourceVersion != null && sourceVersion < CASE_SCHEMA_VERSION,
+        ...(sourceVersion === undefined ? {} : { sourceVersion }),
+    };
+    const evidencePins = normalizeCaseEvidencePins(record.evidencePins, updatedAt, timestampOptions);
     const pinIds = new Set(evidencePins.map((item) => item.id));
-    const actions = normalizeCaseActions(record.actions, updatedAt);
-    const assertions = normalizeCaseAssertions(record.assertions, updatedAt, pinIds);
+    const actions = normalizeCaseActions(record.actions, updatedAt, { ...timestampOptions, validEvidencePinIds: pinIds });
+    const assertions = normalizeCaseAssertions(record.assertions, updatedAt, pinIds, timestampOptions);
+    const sightings = normalizeCaseSightings(record.sightings, updatedAt, pinIds, timestampOptions);
+    const sightingIds = new Set(sightings.map((item) => item.id));
+    const observedEffects = normalizeCaseObservedEffectHistory(sourceVersion != null && sourceVersion < 13 ? undefined : record.observedEffects, updatedAt, pinIds, sightingIds, timestampOptions);
+    const closures = normalizeCaseClosureHistory(sourceVersion != null && sourceVersion < 13 ? undefined : record.closures, updatedAt, new Set(observedEffects.reviews.map((item) => item.id)), new Set(actions.map((item) => item.id)), timestampOptions, buildCaseClosureLinkContext(observedEffects, actions));
+    const normalizedStatus = normalizeStatus(record.status);
     const branchReferences = caseInvestigationBranchReferences({ evidencePins, actions, assertions });
     return {
         id: existing ? existing.id : safeId(record.id) || deterministicId(domain),
         domain,
-        status: normalizeStatus(record.status),
+        status: normalizedStatus === 'resolved'
+            && closures.records.length === 0 && !closures.preV13HistoryUnavailable
+            ? 'reviewing'
+            : normalizedStatus,
         disposition: normalizeDisposition(record.disposition),
         reviewReasonCode: normalizeReviewReasonCode(record.reviewReasonCode),
         brandProfileIds: normalizeCaseBrandProfileIds(record.brandProfileIds),
         tags: normalizeTags(record.tags),
-        notes: normalizeNotes(record.notes, now),
+        notes: normalizeNotes(record.notes, now, sourceVersion),
         source: normalizeSource(record.source),
-        evidenceHistory: normalizeCaseEvidence(record, createdAt, updatedAt, now, sourceVersion),
+        evidenceHistory: normalizeCaseEvidence(record, domain, createdAt, updatedAt, now, sourceVersion),
         evidencePins,
-        decisions: normalizeCaseDecisions(record.decisions, updatedAt, pinIds),
+        decisions: normalizeCaseDecisions(record.decisions, updatedAt, pinIds, timestampOptions),
         actions,
         assertions,
-        manualTrail: normalizeCaseManualTrail(record.manualTrail, updatedAt),
-        sightings: normalizeCaseSightings(record.sightings, updatedAt, pinIds),
-        branches: normalizeCaseInvestigationBranches(record.branches, updatedAt, branchReferences),
+        manualTrail: normalizeCaseManualTrail(record.manualTrail, updatedAt, timestampOptions),
+        sightings,
+        observedEffects,
+        closures,
+        branches: normalizeCaseInvestigationBranches(record.branches, updatedAt, branchReferences, timestampOptions),
         createdAt,
         updatedAt,
     };
@@ -81,7 +96,7 @@ export function normalizeCase(raw, existing, nowIso, sourceVersion) {
  * @returns {CaseRecord}
  */
 export function createCase(input, nowIso) {
-    const now = nowIso || new Date().toISOString();
+    const now = caseTimestampOrNull(nowIso) || new Date().toISOString();
     const domain = normalizeDomain(input.domain);
     if (!domain)
         throw new Error('A valid domain is required to open a case.');
@@ -100,10 +115,22 @@ export function createCase(input, nowIso) {
         ? appendCaseAssertion([], input.assertion, now)
         : [];
     const branchReferences = caseInvestigationBranchReferences({ evidencePins, actions, assertions });
+    const sightings = input.sighting !== undefined
+        ? appendCaseSighting([], input.sighting, now, pinIds)
+        : [];
+    const observedEffects = input.observedEffectReview !== undefined
+        ? appendCaseObservedEffectReview(normalizeCaseObservedEffectHistory(undefined, now), input.observedEffectReview, now, pinIds, new Set(sightings.map((item) => item.id)))
+        : normalizeCaseObservedEffectHistory(undefined, now);
+    const closures = input.closure !== undefined
+        ? appendCaseClosure(normalizeCaseClosureHistory(undefined, now), input.closure, now, observedEffects, actions)
+        : normalizeCaseClosureHistory(undefined, now);
+    if (normalizeStatus(input.status) === 'resolved' && input.closure === undefined) {
+        throw new Error('Opening a resolved case requires a deliberate closure reason and its linked review context.');
+    }
     return {
         id: makeId(),
         domain,
-        status: normalizeStatus(input.status),
+        status: input.closure !== undefined ? 'resolved' : normalizeStatus(input.status),
         disposition: normalizeDisposition(input.disposition),
         reviewReasonCode: normalizeReviewReasonCode(input.reviewReasonCode),
         brandProfileIds: input.brandProfileIds === undefined ? [] : assertCaseBrandProfileIds(input.brandProfileIds),
@@ -113,6 +140,7 @@ export function createCase(input, nowIso) {
         evidenceHistory: normalizeEvidenceHistory(input.evidence ? [input.evidence] : [], {
             source: inferCaptureSource(source),
             fallback: now,
+            caseDomain: domain,
         }),
         evidencePins,
         decisions: input.decision !== undefined
@@ -123,9 +151,9 @@ export function createCase(input, nowIso) {
         manualTrail: input.trailEvent !== undefined
             ? appendCaseManualTrailEvent([], input.trailEvent, now)
             : [],
-        sightings: input.sighting !== undefined
-            ? appendCaseSighting([], input.sighting, now, pinIds)
-            : [],
+        sightings,
+        observedEffects,
+        closures,
         branches: input.branch !== undefined
             ? appendCaseInvestigationBranch([], input.branch, now, branchReferences)
             : [],
@@ -166,7 +194,7 @@ export function openOrCreateCase(cases, input, nowIso) {
  * @returns {{ cases: CaseRecord[], record: CaseRecord }}
  */
 export function updateCase(cases, id, patch, nowIso) {
-    const now = nowIso || new Date().toISOString();
+    const now = caseTimestampOrNull(nowIso) || new Date().toISOString();
     const index = cases.findIndex((item) => item.id === id);
     if (index < 0)
         throw new Error('That case no longer exists.');
@@ -186,7 +214,7 @@ export function updateCase(cases, id, patch, nowIso) {
     const source = patch.source !== undefined ? normalizeSource(patch.source) : current.source;
     let evidenceHistory = current.evidenceHistory;
     if (patch.evidence !== undefined) {
-        evidenceHistory = normalizeEvidenceHistory([...current.evidenceHistory, ...(patch.evidence ? [patch.evidence] : [])], { source: inferCaptureSource(source), fallback: now });
+        evidenceHistory = normalizeEvidenceHistory([...current.evidenceHistory, ...(patch.evidence ? [patch.evidence] : [])], { source: inferCaptureSource(source), fallback: now, caseDomain: current.domain });
     }
     let evidencePins = current.evidencePins;
     if (patch.evidencePins !== undefined) {
@@ -205,7 +233,7 @@ export function updateCase(cases, id, patch, nowIso) {
         actions = appendCaseAction(current.actions, patch.action, now);
     }
     if (patch.actionUpdate !== undefined) {
-        actions = updateCaseAction(actions, patch.actionUpdate, now);
+        actions = updateCaseAction(actions, patch.actionUpdate, now, pinIds);
     }
     let assertions = current.assertions;
     if (patch.assertion !== undefined) {
@@ -230,9 +258,22 @@ export function updateCase(cases, id, patch, nowIso) {
     if (patch.sighting !== undefined) {
         sightings = appendCaseSighting(current.sightings, patch.sighting, now, pinIds);
     }
+    let observedEffects = normalizeCaseObservedEffectHistory(current.observedEffects, current.updatedAt, pinIds, new Set(sightings.map((item) => item.id)));
+    if (patch.observedEffectReview !== undefined) {
+        observedEffects = appendCaseObservedEffectReview(observedEffects, patch.observedEffectReview, now, pinIds, new Set(sightings.map((item) => item.id)));
+    }
+    let closures = normalizeCaseClosureHistory(current.closures, current.updatedAt, new Set(observedEffects.reviews.map((item) => item.id)), new Set(actions.map((item) => item.id)), {}, buildCaseClosureLinkContext(observedEffects, actions));
+    if (patch.closure !== undefined) {
+        closures = appendCaseClosure(closures, patch.closure, now, observedEffects, actions);
+    }
+    if (patch.status === 'resolved' && patch.closure === undefined) {
+        throw new Error('Resolve this case through the deliberate closure review so the reason and evidence state remain explicit.');
+    }
     const record = {
         ...current,
-        status: patch.status !== undefined ? normalizeStatus(patch.status) : current.status,
+        status: patch.closure !== undefined
+            ? 'resolved'
+            : patch.status !== undefined ? normalizeStatus(patch.status) : current.status,
         disposition: patch.disposition !== undefined ? normalizeDisposition(patch.disposition) : current.disposition,
         reviewReasonCode: patch.reviewReasonCode !== undefined
             ? normalizeReviewReasonCode(patch.reviewReasonCode)
@@ -249,6 +290,8 @@ export function updateCase(cases, id, patch, nowIso) {
         assertions,
         manualTrail,
         sightings,
+        observedEffects,
+        closures,
         branches,
         notes,
         updatedAt: now,

package/{frontend/src/lib/analysis/case-report.js → packages/cases/case-report.mjs}

@@ -8,17 +8,17 @@
 // contains raw RDAP/WHOIS material. This module deliberately excludes all raw
 // registry/web responses, contacts, cookies, screenshots, and authentication
 // data. Reports contain only the normalized case record.
-import { caseEvidenceIncomparableReasons, compareCaseEvidence, latestCaseEvidence } from "./case-model.js";
-import { httpSecurityHeaderLabel } from "./http-summary.js";
-import { analystInteroperabilityTags } from "../../../../lib/analyst-taxonomy.mjs";
-import { buildPortableGeneratorMetadata, portableGeneratorAttribution, } from "../../../../lib/portable-generator.mjs";
-import { CASE_EVIDENCE_RELATION_STANCES } from "./case-response-model.js";
-import { normalizeCaseBrandProfileIds } from "./case-brand-profile-references.js";
+import { caseEvidenceIncomparableReasons, compareCaseEvidence, latestCaseEvidence } from "./case-model.mjs";
+import { httpSecurityHeaderLabel } from "./http-summary.mjs";
+import { analystInteroperabilityTags } from "../../lib/analyst-taxonomy.mjs";
+import { buildPortableGeneratorMetadata, portableGeneratorAttribution, } from "../../lib/portable-generator.mjs";
+import { buildCaseResponseLifecycleSummary, CASE_EVIDENCE_RELATION_STANCES } from "./case-response-model.mjs";
+import { normalizeCaseBrandProfileIds } from "./case-brand-profile-references.mjs";
+import { CASE_REPORT_SCHEMA, CASE_REPORT_SCHEMA_VERSION, } from "../contracts/case-portability.mjs";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
-export const CASE_REPORT_SCHEMA = 'whoisleuth.case-report';
-export const CASE_REPORT_SCHEMA_VERSION = 8;
+export { CASE_REPORT_SCHEMA, CASE_REPORT_SCHEMA_VERSION };
 const LIMITATIONS_TEXT = [
     'This report contains normalised browser-local observations from WHOISleuth analyst cases.',
     'It is not a live lookup and does not contain raw WHOIS, RDAP, DNS, HTML, or responses collected during website checks.',
@@ -26,6 +26,7 @@ const LIMITATIONS_TEXT = [
     'Snapshot fingerprints are deduplication identifiers, not cryptographic evidence hashes.',
     'Scan-depth and scoring-model gates prevent misleading comparisons; "incomparable" means observations differ materially but one or more fields cannot be compared reliably.',
     'Brand Profile references record an explicit analyst-selected association only; they do not establish ownership, attribution, intent, safety, or maliciousness.',
+    'Provider workflow outcomes and independently observed technical effects remain separately attributed. A provider outcome does not establish independent remediation, absence, or safety; neither evidence family establishes legal sufficiency or provider performance.',
     'Generated locally in the browser. Review the package before sharing it.',
 ].join(' ');
 function escapeMarkdownInline(text) {
@@ -181,7 +182,9 @@ export function buildCaseReport(caseRecord, options = {}) {
                 if (!previous)
                     continue;
                 const rawChanges = compareCaseEvidence(previous, snapshot);
-                incomparableReasons = caseEvidenceIncomparableReasons(previous, snapshot);
+                const allIncomparableReasons = caseEvidenceIncomparableReasons(previous, snapshot);
+                const hostnameContextChanged = allIncomparableReasons.includes('observation-context');
+                incomparableReasons = allIncomparableReasons.filter((reason) => reason !== 'observation-context');
                 if (rawChanges.length > 0) {
                     changes = rawChanges.map((change) => ({
                         field: change.field,
@@ -191,7 +194,9 @@ export function buildCaseReport(caseRecord, options = {}) {
                         tone: change.tone,
                     }));
                 }
-                else if (snapshot.fingerprint !== previous.fingerprint && incomparableReasons.length === 0) {
+                else if (snapshot.fingerprint !== previous.fingerprint
+                    && incomparableReasons.length === 0
+                    && !hostnameContextChanged) {
                     incomparableReasons = ['other'];
                 }
                 hasIncomparableChange = incomparableReasons.length > 0;
@@ -208,6 +213,19 @@ export function buildCaseReport(caseRecord, options = {}) {
     }
     const latest = latestCaseEvidence({ evidenceHistory: caseRecord.evidenceHistory ?? undefined });
     const currentAssessment = latest ? pickKnownSnapshotFields(latest) : null;
+    const responseLifecycle = buildCaseResponseLifecycleSummary(caseRecord);
+    const observedEffects = caseRecord.observedEffects ?? {
+        reviews: [],
+        omitted: 0,
+        preV13HistoryUnavailable: false,
+        limitations: ['Observed-effect reviews are independent point-in-time records; provider workflow events do not create or replace them.'],
+    };
+    const closures = caseRecord.closures ?? {
+        records: [],
+        omitted: 0,
+        preV13HistoryUnavailable: false,
+        limitations: ['Closure records are deliberate analyst actions and do not establish absence, safety, provider performance, or legal sufficiency.'],
+    };
     const json = {
         schema: CASE_REPORT_SCHEMA,
         schemaVersion: CASE_REPORT_SCHEMA_VERSION,
@@ -233,7 +251,12 @@ export function buildCaseReport(caseRecord, options = {}) {
         analystResponse: {
             evidencePins: caseRecord.evidencePins.map((item) => ({ ...item, limitations: [...item.limitations] })),
             decisions: caseRecord.decisions.map((item) => ({ ...item, evidencePinIds: [...item.evidencePinIds] })),
-            actions: caseRecord.actions.map((item) => ({ ...item, contactLimitations: [...item.contactLimitations] })),
+            actions: caseRecord.actions.map((item) => ({
+                ...item,
+                contactLimitations: [...item.contactLimitations],
+                history: item.history.map((event) => ({ ...event, limitations: [...event.limitations] })),
+                historyLimitations: [...item.historyLimitations],
+            })),
             assertions: caseRecord.assertions.map((item) => ({
                 ...item,
                 evidencePinIds: [...item.evidencePinIds],
@@ -248,6 +271,18 @@ export function buildCaseReport(caseRecord, options = {}) {
             })),
             manualTrail: caseRecord.manualTrail.map((item) => ({ ...item })),
             sightings: caseRecord.sightings.map((item) => ({ ...item, limitations: [...item.limitations] })),
+            observedEffects: {
+                reviews: observedEffects.reviews.map((item) => ({ ...item, limitations: [...item.limitations] })),
+                omitted: observedEffects.omitted,
+                preV13HistoryUnavailable: observedEffects.preV13HistoryUnavailable,
+                limitations: [...observedEffects.limitations],
+            },
+            closures: {
+                records: closures.records.map((item) => ({ ...item, limitations: [...item.limitations] })),
+                omitted: closures.omitted,
+                preV13HistoryUnavailable: closures.preV13HistoryUnavailable,
+                limitations: [...closures.limitations],
+            },
             branches: (caseRecord.branches ?? []).map((item) => ({
                 ...item,
                 evidencePinIds: [...item.evidencePinIds],
@@ -256,6 +291,7 @@ export function buildCaseReport(caseRecord, options = {}) {
                 actionIds: [...item.actionIds],
             })),
         },
+        responseLifecycle,
         limitations: LIMITATIONS_TEXT,
     };
     // --- Build Markdown ---
@@ -431,8 +467,8 @@ function buildMarkdown(report, includeAttribution) {
     lines.push('## Analyst Decision Packet');
     lines.push('');
     const response = report.analystResponse;
-    if (!response.evidencePins.length && !response.sightings.length && !response.decisions.length && !response.actions.length && !response.assertions.length && !response.manualTrail.length && !response.branches.length) {
-        lines.push('No evidence pins, source-qualified sightings, structured assertions, decision records, case actions, or manual investigation steps recorded.');
+    if (!response.evidencePins.length && !response.sightings.length && !response.decisions.length && !response.actions.length && !response.assertions.length && !response.manualTrail.length && !response.observedEffects.reviews.length && !response.closures.records.length && !response.branches.length) {
+        lines.push('No evidence pins, source-qualified sightings, structured assertions, decision records, response actions, independent effect reviews, closures, or manual investigation steps recorded.');
         lines.push('');
     }
     else {
@@ -519,16 +555,35 @@ function buildMarkdown(report, includeAttribution) {
         for (const action of response.actions) {
             lines.push(`- **${escapeMarkdownInline(action.type.replaceAll('_', ' '))}:** ${escapeMarkdownInline(action.recipient)} (${escapeMarkdownInline(action.state)})`);
             lines.push(`  Contact source: ${escapeMarkdownInline(action.contactSource)}; updated ${escapeMarkdownInline(action.updatedAt)}.`);
+            if (action.originActionId)
+                lines.push(`  Originating action: ${escapeMarkdownInline(action.originActionId)}`);
             if (action.dueAt)
                 lines.push(`  Due: ${escapeMarkdownInline(action.dueAt)}`);
             if (action.followUpAt)
                 lines.push(`  Follow-up: ${escapeMarkdownInline(action.followUpAt)}`);
             if (action.reference)
                 lines.push(`  Reference: ${escapeMarkdownInline(action.reference)}`);
+            if (action.providerOutcome)
+                lines.push(`  Latest typed provider outcome: ${escapeMarkdownInline(action.providerOutcome.replaceAll('_', ' '))}`);
             if (action.outcome)
-                lines.push(`  Outcome: ${escapeMarkdownInline(action.outcome)}`);
+                lines.push(`  ${action.providerOutcome ? 'Provider' : 'Legacy recorded'} outcome detail: ${escapeMarkdownInline(action.outcome)}`);
             if (action.contactLimitations.length)
                 lines.push(`  Contact limitations: ${escapeMarkdownInline(action.contactLimitations.join('; '))}`);
+            for (const event of action.history) {
+                lines.push(`  - ${escapeMarkdownInline(event.occurredAt)} · ${escapeMarkdownInline(event.previousState ?? 'none')} → ${escapeMarkdownInline(event.nextState)} · ${escapeMarkdownInline(event.sourceClass)} · ${event.applied ? 'applied' : 'retained conflict'}`);
+                if (event.providerOutcome)
+                    lines.push(`    Provider outcome at this time: ${escapeMarkdownInline(event.providerOutcome.replaceAll('_', ' '))}`);
+                if (event.reference)
+                    lines.push(`    Event reference: ${escapeMarkdownInline(event.reference)}`);
+                if (event.evidencePinId)
+                    lines.push(`    Evidence pin: ${escapeMarkdownInline(event.evidencePinId)}`);
+                if (event.limitations.length)
+                    lines.push(`    Limitations: ${escapeMarkdownInline(event.limitations.join('; '))}`);
+            }
+            if (action.historyOmitted)
+                lines.push(`  Earlier transition events omitted by bound: ${action.historyOmitted}`);
+            if (action.historyLimitations.length)
+                lines.push(`  History limitations: ${escapeMarkdownInline(action.historyLimitations.join('; '))}`);
         }
         lines.push('');
         lines.push('### Investigation branches');
@@ -551,6 +606,45 @@ function buildMarkdown(report, includeAttribution) {
         }
         lines.push('');
     }
+    lines.push('### Independent remediation review and closure');
+    lines.push('');
+    const providerOutcome = report.responseLifecycle.latestProviderOutcome;
+    const observedEffect = report.responseLifecycle.latestObservedEffect;
+    lines.push(providerOutcome
+        ? `- Latest provider outcome time: ${escapeMarkdownInline(providerOutcome.occurredAt)} (${escapeMarkdownInline(providerOutcome.outcome.replaceAll('_', ' '))})`
+        : `- Latest provider outcome time: Withheld because the typed event state is ${escapeMarkdownInline(report.responseLifecycle.providerOutcomeState)}.`);
+    lines.push(report.responseLifecycle.latestObservedChangeAt
+        ? `- Latest independently observed change time: ${escapeMarkdownInline(report.responseLifecycle.latestObservedChangeAt)}`
+        : `- Latest independently observed change time: Withheld because the independent change state is ${escapeMarkdownInline(report.responseLifecycle.observedChangeState)}.`);
+    if (observedEffect)
+        lines.push(`- Latest independent review: ${escapeMarkdownInline(observedEffect.state.replaceAll('_', ' '))} at ${escapeMarkdownInline(observedEffect.observedAt)} from ${escapeMarkdownInline(observedEffect.source)}.`);
+    if (!response.observedEffects.reviews.length)
+        lines.push('- No independent observed-effect review recorded.');
+    for (const review of response.observedEffects.reviews) {
+        lines.push(`- **${escapeMarkdownInline(review.state.replaceAll('_', ' '))}** (${escapeMarkdownInline(review.observedAt)}): ${escapeMarkdownInline(review.source)}; class ${escapeMarkdownInline(review.sourceClass)}; completeness ${escapeMarkdownInline(review.completeness)}.`);
+        if (review.evidencePinId)
+            lines.push(`  Evidence pin: ${escapeMarkdownInline(review.evidencePinId)}`);
+        if (review.sightingId)
+            lines.push(`  Sighting: ${escapeMarkdownInline(review.sightingId)}`);
+        if (review.followUpAt)
+            lines.push(`  Scheduled local follow-up: ${escapeMarkdownInline(review.followUpAt)}`);
+        if (review.limitations.length)
+            lines.push(`  Limitations: ${escapeMarkdownInline(review.limitations.join('; '))}`);
+    }
+    if (response.observedEffects.omitted)
+        lines.push(`- Earlier independent reviews omitted by bound: ${response.observedEffects.omitted}`);
+    if (!response.closures.records.length)
+        lines.push('- No deliberate analyst closure recorded.');
+    for (const closure of response.closures.records) {
+        lines.push(`- **Closure · ${escapeMarkdownInline(closure.reason.replaceAll('_', ' '))}** (${escapeMarkdownInline(closure.createdAt)}): ${escapeMarkdownInline(closure.summary)}`);
+        if (closure.observedEffectReviewId)
+            lines.push(`  Independent review: ${escapeMarkdownInline(closure.observedEffectReviewId)}`);
+        if (closure.actionId)
+            lines.push(`  Provider action: ${escapeMarkdownInline(closure.actionId)}`);
+        if (closure.limitations.length)
+            lines.push(`  Limitations: ${escapeMarkdownInline(closure.limitations.join('; '))}`);
+    }
+    lines.push('');
     // Analyst notes (only when included)
     if (report.case.notesIncluded && Array.isArray(report.case.notes) && report.case.notes.length > 0) {
         lines.push('## Analyst Notes');