@slicedearth/whoisleuth-cli 2.1.0 → 2.2.0

package/docs/cli.md

@@ -56,6 +56,18 @@ whoisleuth lookup example.test --deep --browse
 whoisleuth lookup example.test --deep --markdown --output lookup.md
 ```
 
+To continue a reviewed terminal Lookup in the browser, save the completed
+private document from the interactive view:
+
+```bash
+whoisleuth lookup example.test --deep --browse --save-lookup lookup.json
+```
+
+In Console Lookup, open **Replay exported evidence**, select the file, verify
+its digest and source states, then create or update a browser-local Case. The
+file is not uploaded. Case classification, exact incident links, response
+actions and packet preparation remain deliberate browser steps.
+
 Process selected local input:
 
 ```bash

package/lib/evidence-export.mjs

@@ -10,8 +10,9 @@ import { REGISTRAR_STANDING_SCHEMA, REGISTRAR_STANDING_VERSION, registrarIanaIds
 export const LOOKUP_EVIDENCE_SCHEMA = 'whoisleuth.lookup-evidence';
 export const V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION = 26;
 export const PUBLISHED_V2_LOOKUP_EVIDENCE_SCHEMA_VERSION = 27;
+export const LATEST_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION = 28;
 export const PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION = PUBLISHED_V2_LOOKUP_EVIDENCE_SCHEMA_VERSION;
-export const LOOKUP_EVIDENCE_SCHEMA_VERSION = 28;
+export const LOOKUP_EVIDENCE_SCHEMA_VERSION = LATEST_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION;
 export const SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS = Object.freeze([
     V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION,
     PUBLISHED_V2_LOOKUP_EVIDENCE_SCHEMA_VERSION,
@@ -35,7 +36,7 @@ export const LOOKUP_EVIDENCE_COMPATIBILITY = defineSchemaCompatibility({
     writeSemantics: 'read_only',
     byteBudget: LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES,
     owner: 'lib/evidence-export.mts',
-    note: 'Exact v1.47.4 version 26 and published v2.0.1 version 27 remain replayable; version 28 adds a bounded official-source registrar-standing projection.',
+    note: 'Exact v1.47.4 version 26, published v2.0.1 version 27, and latest-public v2.1.0 version 28 remain replayable; version 28 adds a bounded official-source registrar-standing projection.',
 });
 const REGISTRAR_RDAP_STATUSES = new Set([
     'success', 'partial', 'error', 'unsupported', 'not_found', 'skipped', 'disabled',

package/package.json

@@ -33,7 +33,7 @@
   "bugs": {
     "url": "https://github.com/slicedearth/whoisleuth/issues"
   },
-  "version": "2.1.0",
+  "version": "2.2.0",
   "dependencies": {
     "@peculiar/x509": "2.0.0",
     "maxmind": "5.0.7",

package/packages/cases/case-record-operations.mjs

@@ -1,11 +1,101 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
+import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
 import { appendCaseAction, appendCaseAssertion, appendCaseClosure, appendCaseDecision, appendCaseEvidencePin, appendCaseEvidencePins, appendCaseManualTrailEvent, appendCaseObservedEffectReview, appendCaseSighting, buildCaseClosureLinkContext, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseClosureHistory, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseObservedEffectHistory, normalizeCaseSightings, updateCaseAction, updateCaseAssertion, } from "./case-response-model.mjs";
 import { CASE_SCHEMA_VERSION, MAX_CASES, MAX_NOTES_PER_CASE, } from "./case-record-contracts.mjs";
 import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, caseTimestampOrNull, deterministicId, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeReviewReasonCode, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.mjs";
 import { assertCaseBrandProfileIds, normalizeCaseBrandProfileIds, } from "./case-brand-profile-references.mjs";
 import { normalizeEvidenceHistory, } from "./case-evidence-model.mjs";
 import { appendCaseInvestigationBranch, caseInvestigationBranchReferences, normalizeCaseInvestigationBranches, updateCaseInvestigationBranch, } from "./case-investigation-branch-model.mjs";
+export const MAX_CASE_OBJECTIVE_LENGTH = 320;
+export const MAX_CASE_INCIDENT_URL_LENGTH = 1_850;
+export const INCIDENT_CONTEXT_STATEMENT_PREFIX = 'Investigate incident URL: ';
+const OBJECTIVE_PREFIX = 'Objective: ';
+const RETENTION_SEPARATOR = ' | URL retained: ';
+function boundedContextText(value, maximum) {
+    return typeof value === 'string'
+        ? value.replace(/[\u0000-\u001f\u007f]/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum)
+        : '';
+}
+export function normalizeCaseObjective(value) {
+    return boundedContextText(value, MAX_CASE_OBJECTIVE_LENGTH);
+}
+export function parseIncidentUrlContext(value) {
+    if (typeof value !== 'string' || !value || value.length > MAX_CASE_INCIDENT_URL_LENGTH)
+        return null;
+    if (/[\u0000-\u001f\u007f]/u.test(value) || value.trim() !== value)
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password || !parsed.hostname)
+        return null;
+    const hostname = parsed.hostname.toLowerCase().replace(/\.$/u, '');
+    const registrableDomain = canonicalRegistrableDomain(hostname);
+    if (!registrableDomain)
+        return null;
+    const exactUrl = parsed.toString();
+    if (exactUrl.length > MAX_CASE_INCIDENT_URL_LENGTH)
+        return null;
+    return Object.freeze({
+        exactUrl,
+        hostname,
+        registrableDomain,
+        originUrl: parsed.origin,
+        hasPath: parsed.pathname !== '/',
+        hasQuery: Boolean(parsed.search),
+        hasFragment: Boolean(parsed.hash),
+    });
+}
+export function caseInvestigationContext(record) {
+    if (!record)
+        return null;
+    for (const assertion of [...record.assertions].reverse()) {
+        if (assertion.kind !== 'next_step' || assertion.state !== 'open'
+            || !assertion.statement.startsWith(INCIDENT_CONTEXT_STATEMENT_PREFIX))
+            continue;
+        const incidentUrl = assertion.statement.slice(INCIDENT_CONTEXT_STATEMENT_PREFIX.length);
+        const parsed = parseIncidentUrlContext(incidentUrl);
+        if (!parsed || parsed.registrableDomain !== record.domain)
+            continue;
+        const rationale = assertion.rationale ?? '';
+        const separatorIndex = rationale.lastIndexOf(RETENTION_SEPARATOR);
+        const objective = separatorIndex > OBJECTIVE_PREFIX.length && rationale.startsWith(OBJECTIVE_PREFIX)
+            ? normalizeCaseObjective(rationale.slice(OBJECTIVE_PREFIX.length, separatorIndex))
+            : '';
+        const retention = separatorIndex >= 0 ? rationale.slice(separatorIndex + RETENTION_SEPARATOR.length) : '';
+        if (!objective || (retention !== 'exact' && retention !== 'origin_only'))
+            continue;
+        return Object.freeze({
+            objective,
+            incidentUrl: parsed.exactUrl,
+            urlRetention: retention,
+            assertionId: assertion.id,
+            updatedAt: assertion.updatedAt,
+        });
+    }
+    return null;
+}
+export function caseInvestigationContextAssertion(input) {
+    const objective = normalizeCaseObjective(input.objective);
+    if (!objective)
+        throw new Error('Enter the investigation objective before retaining Incident context.');
+    const parsed = parseIncidentUrlContext(input.incidentUrl);
+    if (!parsed)
+        throw new Error(`Enter one absolute HTTP(S) Incident URL of at most ${MAX_CASE_INCIDENT_URL_LENGTH} characters without credentials.`);
+    const retention = input.retainExactUrl ? 'exact' : 'origin_only';
+    const retainedUrl = input.retainExactUrl ? parsed.exactUrl : parsed.originUrl;
+    return Object.freeze({
+        statement: `${INCIDENT_CONTEXT_STATEMENT_PREFIX}${retainedUrl}`,
+        rationale: `${OBJECTIVE_PREFIX}${objective}${RETENTION_SEPARATOR}${retention}`,
+        retainedUrl,
+        retention,
+    });
+}
 // ---------------------------------------------------------------------------
 // Case normalization
 // ---------------------------------------------------------------------------
@@ -300,3 +390,148 @@ export function updateCase(cases, id, patch, nowIso) {
     next[index] = record;
     return { cases: next, record };
 }
+/**
+ * Records one reviewed conclusion as a single pure Case mutation. The selected
+ * observations become bounded Case pins before the decision is created, so the
+ * decision cannot point at absent evidence. Counterevidence is retained as a
+ * separate resolved contradiction assertion rather than being hidden inside a
+ * favourable disposition.
+ */
+export function recordCaseConclusion(cases, id, input, nowIso) {
+    const now = caseTimestampOrNull(nowIso) || new Date().toISOString();
+    const disposition = normalizeDisposition(input.disposition);
+    const reviewReasonCode = normalizeReviewReasonCode(input.reviewReasonCode);
+    if (disposition === 'unreviewed') {
+        throw new Error('Select a reviewed disposition before recording a conclusion.');
+    }
+    if (!reviewReasonCode) {
+        throw new Error('Select the reviewed reason before recording a conclusion.');
+    }
+    if (!Array.isArray(input.evidence) || !input.evidence.length) {
+        throw new Error('Select at least one observed fact for this conclusion.');
+    }
+    const invalidStance = input.evidence.find((item) => (!item || !['supports', 'contradicts', 'unresolved'].includes(item.stance)));
+    if (invalidStance)
+        throw new Error('A conclusion evidence relationship is invalid.');
+    if (!input.evidence.some((item) => item.stance === 'supports')) {
+        throw new Error('A conclusion requires at least one observed fact that supports it. Record only contradictory or unresolved material as an assertion instead.');
+    }
+    const current = cases.find((item) => item.id === id);
+    if (!current)
+        throw new Error('That case no longer exists.');
+    const existingPinIds = new Set(current.evidencePins.map((pin) => pin.id));
+    const withPins = updateCase(cases, id, {
+        evidencePins: input.evidence.map((item) => item.pin),
+    }, now);
+    const addedPins = withPins.record.evidencePins.filter((pin) => !existingPinIds.has(pin.id));
+    if (addedPins.length !== input.evidence.length) {
+        throw new Error('The selected conclusion evidence could not be retained completely.');
+    }
+    const supportingPinIds = addedPins.flatMap((pin, index) => (input.evidence[index]?.stance === 'supports' ? [pin.id] : []));
+    let concluded = updateCase(withPins.cases, id, {
+        disposition,
+        reviewReasonCode,
+        decision: {
+            summary: input.summary,
+            rationale: input.rationale,
+            evidencePinIds: supportingPinIds,
+        },
+    }, now);
+    const contradictionRelations = addedPins.flatMap((pin, index) => (input.evidence[index]?.stance === 'contradicts'
+        ? [{ evidencePinId: pin.id, stance: 'contradicts' }]
+        : []));
+    if (contradictionRelations.length) {
+        const retainedSummary = concluded.record.decisions.at(-1)?.summary ?? 'Analyst conclusion';
+        concluded = updateCase(concluded.cases, id, {
+            assertion: {
+                kind: 'contradiction',
+                statement: `Counterevidence considered for: ${retainedSummary}`,
+                rationale: input.rationale,
+                evidenceRelations: contradictionRelations,
+                state: 'resolved',
+            },
+        }, now);
+    }
+    const unresolvedRelations = addedPins.flatMap((pin, index) => (input.evidence[index]?.stance === 'unresolved'
+        ? [{ evidencePinId: pin.id, stance: 'unresolved' }]
+        : []));
+    if (unresolvedRelations.length) {
+        const retainedSummary = concluded.record.decisions.at(-1)?.summary ?? 'Analyst conclusion';
+        concluded = updateCase(concluded.cases, id, {
+            assertion: {
+                kind: 'unknown',
+                statement: `Unresolved evidence considered for: ${retainedSummary}`,
+                rationale: input.rationale,
+                evidenceRelations: unresolvedRelations,
+                state: 'open',
+            },
+        }, now);
+    }
+    return concluded;
+}
+export function recordCaseInvestigationContext(cases, id, input, nowIso) {
+    const current = cases.find((item) => item.id === id);
+    if (!current)
+        throw new Error('That case no longer exists.');
+    const parsed = parseIncidentUrlContext(input.incidentUrl);
+    if (!parsed || parsed.registrableDomain !== current.domain) {
+        throw new Error(`The Incident URL must belong to the Case domain ${current.domain}.`);
+    }
+    const context = caseInvestigationContextAssertion(input);
+    const existing = caseInvestigationContext(current);
+    return updateCase(cases, id, existing
+        ? {
+            assertionUpdate: {
+                id: existing.assertionId,
+                statement: context.statement,
+                rationale: context.rationale,
+                state: 'open',
+            },
+        }
+        : {
+            assertion: {
+                kind: 'next_step',
+                statement: context.statement,
+                rationale: context.rationale,
+                evidenceRelations: [],
+                state: 'open',
+            },
+        }, nowIso);
+}
+export function recordCaseRecheckOutcome(cases, id, input, nowIso) {
+    const now = caseTimestampOrNull(nowIso) || new Date().toISOString();
+    const current = cases.find((item) => item.id === id);
+    if (!current)
+        throw new Error('That case no longer exists.');
+    const beforePinIds = new Set(current.evidencePins.map((pin) => pin.id));
+    const withPin = updateCase(cases, id, {
+        evidencePin: {
+            field: 'case.recheck_comparison',
+            category: 'recheck',
+            label: 'Recheck comparison',
+            value: input.comparisonSummary,
+            source: input.source,
+            sourceState: 'reviewed',
+            observedAt: input.observedAt,
+            collectionDepth: input.collectionDepth,
+            completeness: input.completeness,
+            truncated: false,
+            limitations: input.limitations,
+        },
+    }, now);
+    const comparisonPin = withPin.record.evidencePins.find((pin) => !beforePinIds.has(pin.id));
+    if (!comparisonPin)
+        throw new Error('The recheck comparison could not be retained.');
+    return updateCase(withPin.cases, id, {
+        observedEffectReview: {
+            state: input.state,
+            observedAt: input.observedAt,
+            sourceClass: 'analyst',
+            source: input.source,
+            completeness: input.completeness,
+            evidencePinId: comparisonPin.id,
+            followUpAt: input.followUpAt,
+            limitations: input.limitations,
+        },
+    }, now);
+}

package/packages/contracts/case-portability.mjs

@@ -2,9 +2,14 @@ import { MAX_DOMAIN_NAME_LENGTH } from "./domain-name.mjs";
 import { defineSchemaCompatibility } from "./schema-compatibility.mjs";
 import { defineSchemaLifecycleFamily } from "./schema-lifecycle.mjs";
 export const CASE_CONTRACT_OWNER = 'packages/contracts/case-portability.mts';
-export const LATEST_PUBLIC_APPLICATION_VERSION = '2.0.1';
+export const LATEST_PUBLIC_APPLICATION_VERSION = '2.1.0';
 export const CASE_PORTABILITY_IDENTITY_CONSTANTS = Object.freeze([
     'LATEST_PUBLIC_APPLICATION_VERSION',
+    'LATEST_PUBLIC_CASE_SCHEMA_VERSION',
+    'LATEST_PUBLIC_CASE_REPORT_SCHEMA_VERSION',
+    'LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION',
+    'LATEST_PUBLIC_CASE_RESPONSE_REVIEW_INPUTS_VERSION',
+    'LATEST_PUBLIC_WORKSPACE_ARCHIVE_VERSION',
     'CASE_BROWSER_STORE_LIFECYCLE_SCHEMA',
     'CASE_EXPORT_LIFECYCLE_SCHEMA',
     'CASE_SCHEMA_VERSION',
@@ -127,6 +132,7 @@ export const CASE_EXPORT_LIFECYCLE_SCHEMA = 'whoisleuth.case-export';
 export const PUBLIC_CASE_SCHEMA_VERSION = 12;
 export const PUBLISHED_V2_CASE_SCHEMA_VERSION = 13;
 export const CASE_SCHEMA_VERSION = 14;
+export const LATEST_PUBLIC_CASE_SCHEMA_VERSION = 14;
 export const CASE_BROWSER_SUPPORTED_VERSIONS = Object.freeze([
     PUBLIC_CASE_SCHEMA_VERSION,
     PUBLISHED_V2_CASE_SCHEMA_VERSION,
@@ -137,6 +143,7 @@ export const CASE_REPORT_SCHEMA = 'whoisleuth.case-report';
 export const PUBLIC_CASE_REPORT_SCHEMA_VERSION = 8;
 export const PUBLISHED_V2_CASE_REPORT_SCHEMA_VERSION = 9;
 export const CASE_REPORT_SCHEMA_VERSION = 10;
+export const LATEST_PUBLIC_CASE_REPORT_SCHEMA_VERSION = 10;
 export const CASE_REPORT_OUTPUT_VERSIONS = Object.freeze([
     PUBLISHED_V2_CASE_REPORT_SCHEMA_VERSION,
     CASE_REPORT_SCHEMA_VERSION,
@@ -145,6 +152,7 @@ export const CASE_RESPONSE_PACKET_SCHEMA = 'whoisleuth.case-response-packet';
 export const PUBLIC_CASE_RESPONSE_PACKET_VERSION = 6;
 export const PUBLISHED_V2_CASE_RESPONSE_PACKET_VERSION = 7;
 export const CASE_RESPONSE_PACKET_VERSION = 8;
+export const LATEST_PUBLIC_CASE_RESPONSE_PACKET_VERSION = 8;
 export const CASE_RESPONSE_PACKET_OUTPUT_VERSIONS = Object.freeze([
     PUBLIC_CASE_RESPONSE_PACKET_VERSION,
     PUBLISHED_V2_CASE_RESPONSE_PACKET_VERSION,
@@ -154,6 +162,7 @@ export const SUPPORTED_CASE_RESPONSE_PACKET_VERSIONS = CASE_RESPONSE_PACKET_OUTP
 export const CASE_RESPONSE_REVIEW_INPUTS_SCHEMA = 'whoisleuth.case-response-review-inputs';
 export const PUBLISHED_V2_CASE_RESPONSE_REVIEW_INPUTS_VERSION = 1;
 export const CASE_RESPONSE_REVIEW_INPUTS_VERSION = 2;
+export const LATEST_PUBLIC_CASE_RESPONSE_REVIEW_INPUTS_VERSION = 2;
 export const SUPPORTED_CASE_RESPONSE_REVIEW_INPUTS_VERSIONS = Object.freeze([
     PUBLISHED_V2_CASE_RESPONSE_REVIEW_INPUTS_VERSION,
     CASE_RESPONSE_REVIEW_INPUTS_VERSION,
@@ -187,6 +196,7 @@ export const WORKSPACE_ARCHIVE_SCHEMA = 'whoisleuth.workspace-archive';
 export const PUBLIC_WORKSPACE_ARCHIVE_VERSION = 5;
 export const PUBLISHED_V2_WORKSPACE_ARCHIVE_VERSION = 6;
 export const WORKSPACE_ARCHIVE_VERSION = 7;
+export const LATEST_PUBLIC_WORKSPACE_ARCHIVE_VERSION = 7;
 export const SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS = Object.freeze([
     PUBLIC_WORKSPACE_ARCHIVE_VERSION,
     PUBLISHED_V2_WORKSPACE_ARCHIVE_VERSION,
@@ -595,8 +605,8 @@ const CASE_LIFECYCLE_FIXTURES = Object.freeze([
         id: 'cli-case-pack-v2-case-v14',
         path: 'test/fixtures/case-lifecycle/cli-case-pack-v2-case-v14.json',
         bytes: 9363,
-        sha256: 'b51f23bca2dc91715f2aeeb931b79e4f990d59c3564d7cd60a9abac7e0d687a6',
-        contentDigestSha256: 'sha256:82b88b1251c773a01823fccac9baf3e95f752570f091559c58dd0b1664444655',
+        sha256: 'e25e98602c92e696a50c9fd48924c6c13853a5c23ea6fe617abc0b89d8c9e8ee',
+        contentDigestSha256: 'sha256:50044835b0e7aa45137b2f75b9894aa35c71101c769062eb524078bfb55eecc0',
         schema: CLI_CASE_PACK_SCHEMA,
         version: CLI_CASE_PACK_VERSION,
         role: 'current',

package/packages/interchange/external-findings-import.mjs

@@ -1,4 +1,5 @@
 import { normalizeDomain, openOrCreateCase, updateCase, } from "../cases/case-model.mjs";
+import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { EXTERNAL_FINDINGS_SCHEMA, EXTERNAL_FINDINGS_VERSION, MAX_EXTERNAL_FINDING_DOMAINS, MAX_EXTERNAL_FINDINGS, MAX_EXTERNAL_FINDINGS_IMPORT_BYTES, MAX_EXTERNAL_FINDINGS_PER_DOMAIN, } from "../contracts/external-observation-interchange.mjs";
 import { hasUnsafeRetainedText } from "./retained-text.mjs";
@@ -311,6 +312,58 @@ function structuredPinFields(finding) {
         certificateObservation,
     };
 }
+function mergeExternalFindingIntoCase(current, caseId, finding, source, now) {
+    const target = current.find((candidate) => candidate.id === caseId) ?? null;
+    if (!target)
+        throw new Error('The selected Case is unavailable for this finding.');
+    if (existingPinKey(target, finding, source.name)) {
+        return { cases: [...current], record: target, added: false };
+    }
+    const sourceLimitations = [
+        finding.evidenceClass === 'deployment_observation'
+            ? `Imported as an observation made by ${source.name}; this browser session did not collect or independently verify it.`
+            : `Reported by ${source.name}; WHOISleuth did not collect or independently verify this provider finding.`,
+        ...(source.reference ? [`Source reference: ${source.reference}`] : []),
+        ...finding.limitations,
+    ];
+    const existingPinIds = new Set(target.evidencePins.map((pin) => pin.id));
+    let updated = updateCase([...current], target.id, {
+        evidencePin: {
+            ...structuredPinFields(finding),
+            label: `External ${finding.category} finding`,
+            value: finding.structuredObservation?.value ?? pinValue(finding),
+            source: importedSourceLabel(finding, source.name),
+            observedAt: finding.observedAt,
+            completeness: finding.completeness,
+            limitations: sourceLimitations,
+        },
+    }, now);
+    const addedPin = updated.record.evidencePins.find((pin) => !existingPinIds.has(pin.id)) ?? null;
+    if (!addedPin)
+        throw new Error('The imported finding could not be retained as Case evidence.');
+    updated = updateCase(updated.cases, target.id, {
+        sighting: {
+            state: finding.evidenceClass === 'deployment_observation'
+                ? 'observed_by_deployment'
+                : 'reported_by_provider',
+            category: finding.category === 'dns'
+                ? 'delegation'
+                : finding.category === 'certificate'
+                    ? 'certificate'
+                    : finding.category === 'registration'
+                        ? 'registration'
+                        : finding.category === 'http' || finding.category === 'page'
+                            ? 'website'
+                            : 'other',
+            source: source.name,
+            observedAt: finding.observedAt,
+            completeness: finding.completeness,
+            evidencePinId: addedPin.id,
+            limitations: sourceLimitations,
+        },
+    }, now);
+    return { cases: updated.cases, record: updated.record, added: true };
+}
 export function mergeExternalFindingsIntoCases(current, document, now = new Date().toISOString()) {
     let cases = [...current];
     const createdDomains = new Set();
@@ -322,54 +375,12 @@ export function mergeExternalFindingsIntoCases(current, document, now = new Date
         const opened = openOrCreateCase(cases, { domain: finding.domain, source: 'import' }, now);
         cases = opened.cases;
         const target = cases.find((candidate) => candidate.id === opened.record.id) ?? opened.record;
-        if (existingPinKey(target, finding, document.source.name)) {
+        const merged = mergeExternalFindingIntoCase(cases, target.id, finding, document.source, now);
+        cases = merged.cases;
+        if (!merged.added) {
             duplicatesSkipped += 1;
             continue;
         }
-        const sourceLimitations = [
-            finding.evidenceClass === 'deployment_observation'
-                ? `Imported as an observation made by ${document.source.name}; this browser session did not collect or independently verify it.`
-                : `Reported by ${document.source.name}; WHOISleuth did not collect or independently verify this provider finding.`,
-            ...(document.source.reference ? [`Source reference: ${document.source.reference}`] : []),
-            ...finding.limitations,
-        ];
-        const existingPinIds = new Set(target.evidencePins.map((pin) => pin.id));
-        const updated = updateCase(cases, target.id, {
-            evidencePin: {
-                ...structuredPinFields(finding),
-                label: `External ${finding.category} finding`,
-                value: finding.structuredObservation?.value ?? pinValue(finding),
-                source: importedSourceLabel(finding, document.source.name),
-                observedAt: finding.observedAt,
-                completeness: finding.completeness,
-                limitations: sourceLimitations,
-            },
-        }, now);
-        cases = updated.cases;
-        const addedPin = updated.record.evidencePins.find((pin) => !existingPinIds.has(pin.id)) ?? null;
-        if (addedPin) {
-            cases = updateCase(cases, updated.record.id, {
-                sighting: {
-                    state: finding.evidenceClass === 'deployment_observation'
-                        ? 'observed_by_deployment'
-                        : 'reported_by_provider',
-                    category: finding.category === 'dns'
-                        ? 'delegation'
-                        : finding.category === 'certificate'
-                            ? 'certificate'
-                            : finding.category === 'registration'
-                                ? 'registration'
-                                : finding.category === 'http' || finding.category === 'page'
-                                    ? 'website'
-                                    : 'other',
-                    source: document.source.name,
-                    observedAt: finding.observedAt,
-                    completeness: finding.completeness,
-                    evidencePinId: addedPin.id,
-                    limitations: sourceLimitations,
-                },
-            }, now).cases;
-        }
         findingsAdded += 1;
         if (existing)
             updatedDomains.add(finding.domain);
@@ -384,3 +395,60 @@ export function mergeExternalFindingsIntoCases(current, document, now = new Date
         duplicatesSkipped,
     };
 }
+function targetedFinding(finding, caseDomain) {
+    if (finding.domain === caseDomain)
+        return finding;
+    const prefix = `Captured hostname ${finding.domain}. `;
+    const maximumSummaryLength = 900;
+    const remaining = maximumSummaryLength - prefix.length;
+    const summary = remaining > 1 && finding.summary.length > remaining
+        ? `${prefix}${finding.summary.slice(0, remaining - 1).trimEnd()}…`
+        : `${prefix}${finding.summary}`;
+    return { ...finding, domain: caseDomain, summary };
+}
+export function externalFindingsCaseTargets(document, caseDomain) {
+    if (canonicalRegistrableDomain(caseDomain) !== caseDomain) {
+        throw new Error('The selected Case does not have a canonical registrable-domain identity.');
+    }
+    const targets = new Set();
+    for (const finding of document.findings) {
+        if (canonicalRegistrableDomain(finding.domain) !== caseDomain) {
+            throw new Error(`The imported finding for ${finding.domain} does not belong to the selected Case for ${caseDomain}.`);
+        }
+        targets.add(finding.domain);
+    }
+    return Object.freeze([...targets]);
+}
+/**
+ * Merges already-validated external findings into one selected Case. A Case is
+ * keyed to its registrable domain, while rendered captures may retain an exact
+ * hostname. Only same-domain findings are accepted, the exact hostname remains
+ * explicit in the retained evidence, and this operation can never open another
+ * Case as a side effect.
+ */
+export function mergeExternalFindingsIntoCase(current, caseId, document, now = new Date().toISOString()) {
+    const selected = current.find((candidate) => candidate.id === caseId) ?? null;
+    if (!selected)
+        throw new Error('Select an existing Case before importing rendered-capture evidence.');
+    externalFindingsCaseTargets(document, selected.domain);
+    let cases = [...current];
+    let record = selected;
+    let findingsAdded = 0;
+    let duplicatesSkipped = 0;
+    for (const original of document.findings) {
+        const finding = targetedFinding(original, selected.domain);
+        const merged = mergeExternalFindingIntoCase(cases, selected.id, finding, document.source, now);
+        cases = merged.cases;
+        record = merged.record;
+        if (merged.added)
+            findingsAdded += 1;
+        else
+            duplicatesSkipped += 1;
+    }
+    return {
+        cases,
+        record,
+        findingsAdded,
+        duplicatesSkipped,
+    };
+}