@slicedearth/whoisleuth-cli 2.2.0 → 2.3.0

package/packages/cases/case-record-contracts.mjs

@@ -1,30 +1,15 @@
 import { ANALYST_REVIEW_REASONS } from "../../lib/analyst-taxonomy.mjs";
 import { CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, PUBLIC_CASE_SCHEMA_VERSION, MAX_CASE_BRAND_PROFILE_ID_CANDIDATES, MAX_CASE_BRAND_PROFILE_IDS, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_CASES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTE_LENGTH, MAX_NOTES_PER_CASE, MAX_TAG_LENGTH, MAX_TAGS_PER_CASE, } from "../contracts/case-portability.mjs";
+import { CASE_DISPOSITIONS, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_STATUS, } from "./case-record-decisions.mjs";
 export { CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, PUBLIC_CASE_SCHEMA_VERSION, MAX_CASE_BRAND_PROFILE_ID_CANDIDATES, MAX_CASE_BRAND_PROFILE_IDS, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_CASES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTE_LENGTH, MAX_NOTES_PER_CASE, MAX_TAG_LENGTH, MAX_TAGS_PER_CASE, };
-export const CASE_STATUSES = [
-    { value: 'new', label: 'New' },
-    { value: 'reviewing', label: 'Reviewing' },
-    { value: 'monitoring', label: 'Monitoring' },
-    { value: 'escalated', label: 'Escalated' },
-    { value: 'resolved', label: 'Resolved' },
-];
-export const CASE_DISPOSITIONS = [
-    { value: 'unreviewed', label: 'Unreviewed' },
-    { value: 'suspicious', label: 'Suspicious' },
-    { value: 'confirmed_abuse', label: 'Confirmed abuse' },
-    { value: 'false_positive', label: 'False positive' },
-    { value: 'expected', label: 'Expected' },
-    { value: 'closed_no_action', label: 'Closed without action' },
-];
+export { CASE_DISPOSITIONS, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_STATUS, };
 export const CASE_REVIEW_REASONS = ANALYST_REVIEW_REASONS.map((item) => ({ ...item }));
-export const CASE_SOURCES = [
+export const CASE_SOURCES = Object.freeze([
     { value: 'lookup', label: 'Lookup' },
     { value: 'bulk', label: 'Bulk' },
     { value: 'monitor', label: 'Monitor' },
     { value: 'manual', label: 'Manual' },
     { value: 'unknown', label: 'Unknown' },
-];
-export const EVIDENCE_SOURCES = ['lookup', 'bulk', 'monitor', 'import', 'unknown'];
-export const DEFAULT_STATUS = 'new';
-export const DEFAULT_DISPOSITION = 'unreviewed';
+]);
+export const EVIDENCE_SOURCES = Object.freeze(['lookup', 'bulk', 'monitor', 'import', 'unknown']);
 export const DEFAULT_SOURCE = 'unknown';

package/packages/cases/case-record-core.mjs

@@ -1,6 +1,7 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
-import { CASE_DISPOSITIONS, CASE_SCHEMA_VERSION, CASE_REVIEW_REASONS, CASE_SOURCES, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_DOMAIN_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.mjs";
+import { CASE_SCHEMA_VERSION, CASE_REVIEW_REASONS, CASE_SOURCES, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, EVIDENCE_SOURCES, MAX_DOMAIN_LENGTH, MAX_NOTES_PER_CASE, MAX_NOTE_LENGTH, MAX_TAGS_PER_CASE, MAX_TAG_LENGTH, } from "./case-record-contracts.mjs";
+import { dispositionLabel, isValidDisposition, isValidStatus, statusLabel, } from "./case-record-decisions.mjs";
 import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "../evidence/observation.mjs";
 import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
 // Forward-version policy (two distinct guarantees):
@@ -26,13 +27,9 @@ export const EVIDENCE_SOURCE_RANK = {
     import: 1,
     unknown: 0,
 };
-const STATUS_VALUES = new Set(CASE_STATUSES.map((item) => item.value));
-const DISPOSITION_VALUES = new Set(CASE_DISPOSITIONS.map((item) => item.value));
 const REVIEW_REASON_VALUES = new Set(CASE_REVIEW_REASONS.map((item) => item.value).filter(Boolean));
 const SOURCE_VALUES = new Set(CASE_SOURCES.map((item) => item.value));
-const STATUS_LABELS = Object.fromEntries(CASE_STATUSES.map((item) => [item.value, item.label]));
-const DISPOSITION_LABELS = Object.fromEntries(CASE_DISPOSITIONS.map((item) => [item.value, item.label]));
-const SOURCE_LABELS = Object.fromEntries(CASE_SOURCES.map((item) => [item.value, item.label]));
+const SOURCE_LABELS = new Map(CASE_SOURCES.map((item) => [item.value, item.label]));
 // Availability tokens that actually assert something about the domain. Anything
 // else ('unknown', 'error', empty) is not, on its own, material evidence.
 export const CONCLUSIVE_AVAILABILITY = new Set([
@@ -59,21 +56,13 @@ export function objectRecord(value) {
         ? value
         : {};
 }
-export function statusLabel(value) {
-    return (typeof value === 'string' ? STATUS_LABELS[value] : '') || String(value || '');
-}
-export function dispositionLabel(value) {
-    return (typeof value === 'string' ? DISPOSITION_LABELS[value] : '') || String(value || '');
-}
 export function sourceLabel(value) {
-    return (typeof value === 'string' ? SOURCE_LABELS[value] : '') || String(value || '');
-}
-export function isValidStatus(value) {
-    return typeof value === 'string' && STATUS_VALUES.has(value);
+    return isValidSource(value) ? SOURCE_LABELS.get(value) : String(value || '');
 }
-export function isValidDisposition(value) {
-    return typeof value === 'string' && DISPOSITION_VALUES.has(value);
+export function isValidSource(value) {
+    return typeof value === 'string' && SOURCE_VALUES.has(value);
 }
+export { dispositionLabel, isValidDisposition, isValidStatus, statusLabel, };
 /** Fresh, safe, effectively-unique id for a brand-new local record. */
 export function makeId() {
     if (typeof globalThis.crypto?.randomUUID === 'function')
@@ -147,16 +136,16 @@ export function normalizeEvidenceHostnameForCase(value, caseDomain) {
     return canonicalRegistrableDomain(hostname) === canonicalCase ? hostname : null;
 }
 export function normalizeStatus(value) {
-    return typeof value === 'string' && STATUS_VALUES.has(value) ? value : DEFAULT_STATUS;
+    return isValidStatus(value) ? value : DEFAULT_STATUS;
 }
 export function normalizeDisposition(value) {
-    return typeof value === 'string' && DISPOSITION_VALUES.has(value) ? value : DEFAULT_DISPOSITION;
+    return isValidDisposition(value) ? value : DEFAULT_DISPOSITION;
 }
 export function normalizeReviewReasonCode(value) {
     return typeof value === 'string' && REVIEW_REASON_VALUES.has(value) ? value : null;
 }
 export function normalizeSource(value) {
-    return typeof value === 'string' && SOURCE_VALUES.has(value) ? value : DEFAULT_SOURCE;
+    return isValidSource(value) ? value : DEFAULT_SOURCE;
 }
 /** Parsed ISO string, or null when missing/invalid (used for import ordering). */
 export function isoOrNull(value) {

package/packages/cases/case-record-decisions.mjs

@@ -0,0 +1,72 @@
+// Lightweight canonical Case status and disposition definitions. Persistence,
+// portability and presentation consumers derive these identities and policies
+// without importing the wider Case record or serialisation graph.
+export const CASE_STATUSES = Object.freeze([
+    { value: 'new', label: 'New' },
+    { value: 'reviewing', label: 'Reviewing' },
+    { value: 'monitoring', label: 'Monitoring' },
+    { value: 'escalated', label: 'Escalated' },
+    { value: 'resolved', label: 'Resolved' },
+]);
+export const CASE_DISPOSITIONS = Object.freeze([
+    { value: 'unreviewed', label: 'Unreviewed' },
+    { value: 'suspicious', label: 'Suspicious' },
+    { value: 'confirmed_abuse', label: 'Confirmed abuse' },
+    { value: 'false_positive', label: 'False positive' },
+    { value: 'expected', label: 'Expected' },
+    { value: 'closed_no_action', label: 'Closed without action' },
+]);
+export const DEFAULT_STATUS = 'new';
+export const DEFAULT_DISPOSITION = 'unreviewed';
+const CASE_STATUS_OPERATION_POLICIES = Object.freeze({
+    new: { closed: false, closureRequired: false, directEdit: 'allowed' },
+    reviewing: { closed: false, closureRequired: false, directEdit: 'allowed' },
+    monitoring: { closed: false, closureRequired: false, directEdit: 'allowed' },
+    escalated: { closed: false, closureRequired: false, directEdit: 'allowed' },
+    resolved: { closed: true, closureRequired: true, directEdit: 'existing_only' },
+});
+const CASE_DISPOSITION_DECISION_POLICIES = Object.freeze({
+    unreviewed: { reviewed: false, supportsDefensiveResponse: false },
+    suspicious: { reviewed: true, supportsDefensiveResponse: true },
+    confirmed_abuse: { reviewed: true, supportsDefensiveResponse: true },
+    false_positive: { reviewed: true, supportsDefensiveResponse: false },
+    expected: { reviewed: true, supportsDefensiveResponse: false },
+    closed_no_action: { reviewed: true, supportsDefensiveResponse: false },
+});
+function statusOption(value) {
+    return CASE_STATUSES.find((option) => option.value === value);
+}
+function dispositionOption(value) {
+    return CASE_DISPOSITIONS.find((option) => option.value === value);
+}
+export function isValidStatus(value) {
+    return Boolean(statusOption(value));
+}
+export function isValidDisposition(value) {
+    return Boolean(dispositionOption(value));
+}
+export function statusLabel(value) {
+    return statusOption(value)?.label ?? String(value || '');
+}
+export function dispositionLabel(value) {
+    return dispositionOption(value)?.label ?? String(value || '');
+}
+export function caseStatusRequiresClosure(value) {
+    const option = statusOption(value);
+    return option ? CASE_STATUS_OPERATION_POLICIES[option.value].closureRequired : false;
+}
+export function caseStatusIsClosed(value) {
+    const option = statusOption(value);
+    return option ? CASE_STATUS_OPERATION_POLICIES[option.value].closed : false;
+}
+export function isReviewedCaseDisposition(value) {
+    const option = dispositionOption(value);
+    return option ? CASE_DISPOSITION_DECISION_POLICIES[option.value].reviewed : false;
+}
+export function caseDispositionSupportsDefensiveResponse(value) {
+    const option = dispositionOption(value);
+    return option ? CASE_DISPOSITION_DECISION_POLICIES[option.value].supportsDefensiveResponse : false;
+}
+export function caseStatusOptionsForDirectEdit(currentStatus) {
+    return CASE_STATUSES.filter((option) => (CASE_STATUS_OPERATION_POLICIES[option.value].directEdit === 'allowed' || option.value === currentStatus));
+}

package/packages/cases/case-record-model.mjs

@@ -6,4 +6,5 @@ export * from "./case-record-core.mjs";
 export * from "./case-brand-profile-references.mjs";
 export * from "./case-evidence-model.mjs";
 export * from "./case-record-operations.mjs";
+export * from "./case-record-projection.mjs";
 export * from "./case-investigation-branch-model.mjs";

package/packages/cases/case-record-operations.mjs

@@ -3,10 +3,12 @@
 import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
 import { appendCaseAction, appendCaseAssertion, appendCaseClosure, appendCaseDecision, appendCaseEvidencePin, appendCaseEvidencePins, appendCaseManualTrailEvent, appendCaseObservedEffectReview, appendCaseSighting, buildCaseClosureLinkContext, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseClosureHistory, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseObservedEffectHistory, normalizeCaseSightings, updateCaseAction, updateCaseAssertion, } from "./case-response-model.mjs";
 import { CASE_SCHEMA_VERSION, MAX_CASES, MAX_NOTES_PER_CASE, } from "./case-record-contracts.mjs";
+import { caseDispositionSupportsDefensiveResponse, caseStatusIsClosed, caseStatusOptionsForDirectEdit, caseStatusRequiresClosure, isReviewedCaseDisposition, } from "./case-record-decisions.mjs";
 import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, caseTimestampOrNull, deterministicId, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeReviewReasonCode, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.mjs";
 import { assertCaseBrandProfileIds, normalizeCaseBrandProfileIds, } from "./case-brand-profile-references.mjs";
 import { normalizeEvidenceHistory, } from "./case-evidence-model.mjs";
 import { appendCaseInvestigationBranch, caseInvestigationBranchReferences, normalizeCaseInvestigationBranches, updateCaseInvestigationBranch, } from "./case-investigation-branch-model.mjs";
+export { caseDispositionSupportsDefensiveResponse, caseStatusIsClosed, caseStatusOptionsForDirectEdit, caseStatusRequiresClosure, isReviewedCaseDisposition, };
 export const MAX_CASE_OBJECTIVE_LENGTH = 320;
 export const MAX_CASE_INCIDENT_URL_LENGTH = 1_850;
 export const INCIDENT_CONTEXT_STATEMENT_PREFIX = 'Investigate incident URL: ';
@@ -156,7 +158,7 @@ export function normalizeCase(raw, existing, nowIso, sourceVersion) {
     return {
         id: existing ? existing.id : safeId(record.id) || deterministicId(domain),
         domain,
-        status: normalizedStatus === 'resolved'
+        status: caseStatusRequiresClosure(normalizedStatus)
             && closures.records.length === 0 && !closures.preV13HistoryUnavailable
             ? 'reviewing'
             : normalizedStatus,
@@ -214,7 +216,7 @@ export function createCase(input, nowIso) {
     const closures = input.closure !== undefined
         ? appendCaseClosure(normalizeCaseClosureHistory(undefined, now), input.closure, now, observedEffects, actions)
         : normalizeCaseClosureHistory(undefined, now);
-    if (normalizeStatus(input.status) === 'resolved' && input.closure === undefined) {
+    if (caseStatusRequiresClosure(normalizeStatus(input.status)) && input.closure === undefined) {
         throw new Error('Opening a resolved case requires a deliberate closure reason and its linked review context.');
     }
     return {
@@ -356,7 +358,7 @@ export function updateCase(cases, id, patch, nowIso) {
     if (patch.closure !== undefined) {
         closures = appendCaseClosure(closures, patch.closure, now, observedEffects, actions);
     }
-    if (patch.status === 'resolved' && patch.closure === undefined) {
+    if (caseStatusRequiresClosure(patch.status) && patch.closure === undefined) {
         throw new Error('Resolve this case through the deliberate closure review so the reason and evidence state remain explicit.');
     }
     const record = {
@@ -401,7 +403,7 @@ export function recordCaseConclusion(cases, id, input, nowIso) {
     const now = caseTimestampOrNull(nowIso) || new Date().toISOString();
     const disposition = normalizeDisposition(input.disposition);
     const reviewReasonCode = normalizeReviewReasonCode(input.reviewReasonCode);
-    if (disposition === 'unreviewed') {
+    if (!isReviewedCaseDisposition(disposition)) {
         throw new Error('Select a reviewed disposition before recording a conclusion.');
     }
     if (!reviewReasonCode) {

package/packages/cases/case-record-projection.mjs

@@ -0,0 +1,218 @@
+import { PUBLIC_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { caseStatusIsClosed } from "./case-record-decisions.mjs";
+const PRESERVE = Object.freeze({
+    durable: 'preserve', internal: 'preserve', trusted: 'preserve', public: 'preserve',
+});
+const PUBLIC_TRANSFORM = Object.freeze({ ...PRESERVE, public: 'transform' });
+const PUBLIC_EXCLUDE = Object.freeze({ ...PRESERVE, public: 'exclude' });
+const SHARED_EXCLUDE = Object.freeze({ ...PRESERVE, trusted: 'exclude', public: 'exclude' });
+const SHARED_REDACT = Object.freeze({ ...PRESERVE, trusted: 'redact', public: 'redact' });
+const TRUSTED_REDACT_PUBLIC_EXCLUDE = Object.freeze({
+    ...PRESERVE, trusted: 'redact', public: 'exclude',
+});
+const PUBLIC_REDACT = Object.freeze({ ...PRESERVE, public: 'redact' });
+function fieldRule(key, treatment, value, options = {}) {
+    const audienceExclusions = Object.freeze(Object.fromEntries(Object.entries(options.audienceExclusions ?? {}).map(([audience, exclusion]) => [
+        audience,
+        Object.freeze({ ...exclusion }),
+    ])));
+    for (const audience of ['internal', 'trusted', 'public']) {
+        const requiresExplanation = treatment[audience] === 'exclude' || treatment[audience] === 'redact';
+        if (requiresExplanation !== Boolean(audienceExclusions[audience])) {
+            throw new TypeError(`Case field ${key} must explain every redacted or excluded ${audience} treatment exactly once.`);
+        }
+    }
+    return Object.freeze({
+        key,
+        treatment,
+        value,
+        nestedSensitiveFields: Object.freeze([...(options.nestedSensitiveFields ?? [])]),
+        audienceExclusions,
+    });
+}
+function preservedField(key) {
+    return fieldRule(key, PRESERVE, (record) => record[key]);
+}
+const PUBLIC_OBSERVED_EFFECT_LIMITATION = 'Independent observed-effect review records were excluded from this public Case pack.';
+const PUBLIC_CLOSURE_LIMITATION = 'Deliberate closure records were excluded from this public Case pack.';
+function publicObservedEffectHistory(preV13HistoryUnavailable) {
+    return {
+        reviews: [],
+        omitted: 0,
+        preV13HistoryUnavailable,
+        limitations: [
+            ...(preV13HistoryUnavailable
+                ? ['Migrated from a pre-v13 Case; earlier independent observed-effect review history is unavailable.']
+                : []),
+            'Observed-effect reviews are independent point-in-time records; provider workflow events do not create or replace them.',
+            PUBLIC_OBSERVED_EFFECT_LIMITATION,
+        ].sort(),
+    };
+}
+function publicClosureHistory(preV13HistoryUnavailable) {
+    return {
+        records: [],
+        omitted: 0,
+        preV13HistoryUnavailable,
+        limitations: [
+            ...(preV13HistoryUnavailable
+                ? ['Migrated from a pre-v13 Case; earlier deliberate closure history is unavailable.']
+                : []),
+            'Closure records are deliberate analyst actions and do not establish absence, safety, provider performance, or legal sufficiency.',
+            PUBLIC_CLOSURE_LIMITATION,
+        ].sort(),
+    };
+}
+/**
+ * The complete current Case field policy. Browser persistence and ordinary
+ * exports deliberately share the `durable` projection. Case-pack audiences
+ * must classify every field here before a new Case property can compile.
+ */
+const CASE_FIELD_RULES = Object.freeze({
+    id: preservedField('id'),
+    domain: preservedField('domain'),
+    status: fieldRule('status', PUBLIC_TRANSFORM, (record, profile) => (profile === 'public' && caseStatusIsClosed(record.status) && record.closures.records.length
+        ? 'reviewing'
+        : record.status)),
+    disposition: preservedField('disposition'),
+    reviewReasonCode: fieldRule('reviewReasonCode', PRESERVE, (record) => record.reviewReasonCode ?? null),
+    brandProfileIds: fieldRule('brandProfileIds', PUBLIC_EXCLUDE, (record, profile) => (profile === 'public' ? [] : [...record.brandProfileIds]), {
+        audienceExclusions: { public: { label: 'Brand Profile references', order: 2 } },
+    }),
+    tags: fieldRule('tags', PRESERVE, (record) => [...record.tags]),
+    notes: fieldRule('notes', SHARED_EXCLUDE, (record, profile) => (profile === 'trusted' || profile === 'public'
+        ? []
+        : record.notes.map((item) => ({ ...item }))), {
+        audienceExclusions: {
+            trusted: { label: 'Case notes', order: 1 },
+            public: { label: 'Case notes', order: 1 },
+        },
+    }),
+    source: preservedField('source'),
+    evidenceHistory: fieldRule('evidenceHistory', PRESERVE, (record) => structuredClone(record.evidenceHistory)),
+    evidencePins: fieldRule('evidencePins', PRESERVE, (record) => structuredClone(record.evidencePins)),
+    decisions: fieldRule('decisions', PRESERVE, (record) => structuredClone(record.decisions)),
+    actions: fieldRule('actions', TRUSTED_REDACT_PUBLIC_EXCLUDE, (record, profile) => (profile === 'public'
+        ? []
+        : profile === 'trusted'
+            ? structuredClone(record.actions).map((item) => ({ ...item, recipient: '[redacted]' }))
+            : structuredClone(record.actions)), {
+        nestedSensitiveFields: ['recipient'],
+        audienceExclusions: {
+            trusted: { label: 'Recipient values', order: 2 },
+            public: { label: 'Actions and recipient values', order: 3 },
+        },
+    }),
+    assertions: fieldRule('assertions', PUBLIC_EXCLUDE, (record, profile) => (profile === 'public' ? [] : structuredClone(record.assertions)), {
+        audienceExclusions: { public: { label: 'Analyst assertions', order: 4 } },
+    }),
+    manualTrail: fieldRule('manualTrail', SHARED_REDACT, (record, profile) => (profile === 'trusted' || profile === 'public'
+        ? structuredClone(record.manualTrail).map((item) => ({ ...item, target: null }))
+        : structuredClone(record.manualTrail)), {
+        nestedSensitiveFields: ['target'],
+        audienceExclusions: {
+            trusted: { label: 'Manual trail targets', order: 3 },
+            public: { label: 'Manual trail targets', order: 6 },
+        },
+    }),
+    sightings: fieldRule('sightings', PRESERVE, (record) => structuredClone(record.sightings)),
+    observedEffects: fieldRule('observedEffects', PUBLIC_REDACT, (record, profile) => (profile === 'public'
+        ? publicObservedEffectHistory(record.observedEffects.preV13HistoryUnavailable)
+        : structuredClone(record.observedEffects)), {
+        audienceExclusions: {
+            public: { label: 'Independent observed-effect reviews and closure history', order: 8 },
+        },
+    }),
+    closures: fieldRule('closures', PUBLIC_REDACT, (record, profile) => (profile === 'public'
+        ? publicClosureHistory(record.closures.preV13HistoryUnavailable)
+        : structuredClone(record.closures)), {
+        audienceExclusions: {
+            public: { label: 'Independent observed-effect reviews and closure history', order: 8 },
+        },
+    }),
+    branches: fieldRule('branches', PUBLIC_EXCLUDE, (record, profile) => (profile === 'public' ? [] : structuredClone(record.branches ?? [])), {
+        audienceExclusions: { public: { label: 'Investigation branches', order: 5 } },
+    }),
+    createdAt: preservedField('createdAt'),
+    updatedAt: preservedField('updatedAt'),
+});
+function projectCase(record, profile) {
+    const projected = {};
+    for (const key of Object.keys(CASE_FIELD_RULES)) {
+        const rule = CASE_FIELD_RULES[key];
+        Object.defineProperty(projected, key, {
+            configurable: true,
+            enumerable: true,
+            value: rule.value(record, profile),
+            writable: true,
+        });
+    }
+    return projected;
+}
+export function projectCaseForDurableWrite(record) {
+    return projectCase(record, 'durable');
+}
+export function projectCaseForAudience(record, audience) {
+    return projectCase(record, audience);
+}
+/** Field names used by the bounded hidden-copy defence, derived from policy. */
+export const CASE_AUDIENCE_SENSITIVE_FIELD_NAMES = Object.freeze([...new Set(Object.entries(CASE_FIELD_RULES).flatMap(([key, rule]) => {
+        const audienceTreatments = [rule.treatment.trusted, rule.treatment.public];
+        const sensitive = audienceTreatments.some((value) => value === 'exclude' || value === 'redact');
+        return sensitive ? [key, ...rule.nestedSensitiveFields] : [];
+    }))]);
+export const CASE_RECORD_FIELD_NAMES = Object.freeze(Object.values(CASE_FIELD_RULES).map((rule) => rule.key));
+const OUTSIDE_SCHEMA_EXCLUSIONS = Object.freeze({
+    internal: Object.freeze({ label: 'Raw upstream payloads and credentials are outside the case schema.', order: 1 }),
+    trusted: Object.freeze({ label: 'Raw upstream payloads and credentials', order: 4 }),
+    public: Object.freeze({ label: 'Raw upstream payloads and credentials', order: 7 }),
+});
+function currentAudienceExclusions(audience) {
+    const entries = [
+        ...Object.values(CASE_FIELD_RULES).flatMap((rule) => (rule.audienceExclusions[audience] ? [rule.audienceExclusions[audience]] : [])),
+        OUTSIDE_SCHEMA_EXCLUSIONS[audience],
+    ];
+    const orderByLabel = new Map();
+    const labelByOrder = new Map();
+    for (const entry of entries) {
+        if (!entry.label || entry.label.length > 160 || entry.label.trim() !== entry.label
+            || !Number.isSafeInteger(entry.order) || entry.order < 1 || entry.order > 64) {
+            throw new TypeError('Case audience exclusion metadata is malformed or exceeds its bound.');
+        }
+        const prior = orderByLabel.get(entry.label);
+        if (prior !== undefined && prior !== entry.order) {
+            throw new TypeError(`Case audience exclusion ${entry.label} has conflicting presentation order.`);
+        }
+        const priorLabel = labelByOrder.get(entry.order);
+        if (priorLabel !== undefined && priorLabel !== entry.label) {
+            throw new TypeError(`Case audience exclusions ${priorLabel} and ${entry.label} share a presentation order.`);
+        }
+        orderByLabel.set(entry.label, entry.order);
+        labelByOrder.set(entry.order, entry.label);
+    }
+    return Object.freeze([...orderByLabel]
+        .sort((left, right) => left[1] - right[1])
+        .map(([label]) => label));
+}
+const CURRENT_AUDIENCE_EXCLUSIONS = Object.freeze({
+    internal: currentAudienceExclusions('internal'),
+    trusted: currentAudienceExclusions('trusted'),
+    public: currentAudienceExclusions('public'),
+});
+// Schema 12 is an immutable public compatibility contract and deliberately
+// remains independent of the current field-policy projection.
+const PUBLIC_V12_EXCLUSIONS = Object.freeze([
+    'Case notes',
+    'Brand Profile references',
+    'Actions and recipient values',
+    'Analyst assertions',
+    'Investigation branches',
+    'Manual trail targets',
+    'Raw upstream payloads and credentials',
+]);
+export function caseAudienceExclusions(audience, caseVersion) {
+    return audience === 'public' && caseVersion === PUBLIC_CASE_SCHEMA_VERSION
+        ? PUBLIC_V12_EXCLUSIONS
+        : CURRENT_AUDIENCE_EXCLUSIONS[audience];
+}
+export { CASE_FIELD_RULES };

package/packages/cases/case-report.mjs

@@ -182,10 +182,9 @@ export function buildCaseReport(caseRecord, options = {}) {
                 if (!previous)
                     continue;
                 const rawChanges = compareCaseEvidence(previous, snapshot);
-                const allIncomparableReasons = caseEvidenceIncomparableReasons(previous, snapshot);
-                const hostnameContextChanged = allIncomparableReasons.includes('observation-context');
-                incomparableReasons = allIncomparableReasons.filter((reason) => reason !== 'observation-context');
-                if (rawChanges.length > 0) {
+                incomparableReasons = caseEvidenceIncomparableReasons(previous, snapshot);
+                const hostnameContextChanged = incomparableReasons.includes('observation-context');
+                if (rawChanges.length > 0 && !hostnameContextChanged) {
                     changes = rawChanges.map((change) => ({
                         field: change.field,
                         label: change.label,
@@ -195,8 +194,7 @@ export function buildCaseReport(caseRecord, options = {}) {
                     }));
                 }
                 else if (snapshot.fingerprint !== previous.fingerprint
-                    && incomparableReasons.length === 0
-                    && !hostnameContextChanged) {
+                    && incomparableReasons.length === 0) {
                     incomparableReasons = ['other'];
                 }
                 hasIncomparableChange = incomparableReasons.length > 0;
@@ -452,6 +450,8 @@ function buildMarkdown(report, includeAttribution) {
             }
             if (entry.hasIncomparableChange) {
                 const reasons = Array.isArray(entry.incomparableReasons) ? entry.incomparableReasons : [];
+                if (reasons.includes('observation-context'))
+                    lines.push('> Observation targets differ or are unknown. Field-level additions, removals and beneficial changes are withheld because their scopes cannot be compared reliably. Exact hostnames remain excluded from this report.');
                 if (reasons.includes('risk-model'))
                     lines.push('> Risk scores and factors use different or unversioned models, so their numeric difference is not treated as a domain change.');
                 if (reasons.includes('opportunity-model'))
@@ -544,6 +544,7 @@ function buildMarkdown(report, includeAttribution) {
         for (const decision of response.decisions) {
             lines.push(`- **${escapeMarkdownInline(decision.summary)}** (${escapeMarkdownInline(decision.createdAt)})`);
             lines.push(`  ${escapeMarkdownInline(decision.rationale)}`);
+            lines.push(`  Analyst confidence: ${escapeMarkdownInline(decision.confidence)}${decision.confidenceBasis ? ` — ${escapeMarkdownInline(decision.confidenceBasis)}` : ''}.`);
             if (decision.evidencePinIds.length)
                 lines.push(`  Evidence pins: ${escapeMarkdownInline(decision.evidencePinIds.join(', '))}`);
         }
@@ -555,6 +556,10 @@ function buildMarkdown(report, includeAttribution) {
         for (const action of response.actions) {
             lines.push(`- **${escapeMarkdownInline(action.type.replaceAll('_', ' '))}:** ${escapeMarkdownInline(action.recipient)} (${escapeMarkdownInline(action.state)})`);
             lines.push(`  Contact source: ${escapeMarkdownInline(action.contactSource)}; updated ${escapeMarkdownInline(action.updatedAt)}.`);
+            if (action.routeObservedAt)
+                lines.push(`  Route reviewed: ${escapeMarkdownInline(action.routeObservedAt)}`);
+            if (action.routeReviewAfter)
+                lines.push(`  Route review due: ${escapeMarkdownInline(action.routeReviewAfter)}`);
             if (action.originActionId)
                 lines.push(`  Originating action: ${escapeMarkdownInline(action.originActionId)}`);
             if (action.dueAt)

package/packages/cases/case-response-model.mjs

@@ -13,9 +13,11 @@ export const CASE_ACTION_TYPES = [
     'registry_report',
     'network_hosting_report',
     'security_contact_report',
+    'platform_report',
     'defensive_control',
     'internal_review',
 ];
+export const CASE_DECISION_CONFIDENCE_LEVELS = ['unknown', 'low', 'moderate', 'high'];
 export const CASE_ACTION_STATES = [
     'drafting',
     'ready_for_review',
@@ -101,6 +103,7 @@ const CONTROL_REPLACE_RE = /[\u0000-\u001f\u007f]+/gu;
 const COMPLETENESS = new Set(CASE_PIN_COMPLETENESS);
 const TRANSITION_EXPECTATIONS = new Set(CASE_TRANSITION_EXPECTATIONS);
 const ACTION_TYPES = new Set(CASE_ACTION_TYPES);
+const DECISION_CONFIDENCE_LEVELS = new Set(CASE_DECISION_CONFIDENCE_LEVELS);
 const ACTION_STATES = new Set(CASE_ACTION_STATES);
 const PROVIDER_OUTCOMES = new Set(CASE_PROVIDER_OUTCOMES);
 const ACTION_EVENT_SOURCE_CLASSES = new Set(CASE_ACTION_EVENT_SOURCE_CLASSES);
@@ -337,6 +340,9 @@ export function normalizeCaseEvidencePins(raw, fallback, options = {}) {
         .slice(-MAX_CASE_EVIDENCE_PINS);
 }
 export function appendCaseEvidencePin(current, raw, now) {
+    if (current.length >= MAX_CASE_EVIDENCE_PINS) {
+        throw new Error(`A Case can retain at most ${MAX_CASE_EVIDENCE_PINS} evidence pins. No existing evidence was removed.`);
+    }
     const item = record(raw);
     const created = normalizePin({ ...item, id: freshId('pin'), createdAt: now }, now);
     if (!created)
@@ -363,10 +369,17 @@ function normalizeDecision(raw, fallback, validPinIds, options = {}) {
     if (!summary || !rationale)
         return null;
     const createdAt = iso(item.createdAt, fallback, options);
+    const currentConfidence = typeof item.confidence === 'string' && DECISION_CONFIDENCE_LEVELS.has(item.confidence)
+        ? item.confidence
+        : 'unknown';
     return {
         id: safeId(item.id, 'decision', { summary, rationale, createdAt }),
         summary,
         rationale,
+        confidence: options.sourceVersion != null && options.sourceVersion < 15 ? 'unknown' : currentConfidence,
+        confidenceBasis: options.sourceVersion != null && options.sourceVersion < 15
+            ? ''
+            : text(item.confidenceBasis, MAX_RESPONSE_RATIONALE_LENGTH),
         evidencePinIds: uniqueIds(item.evidencePinIds, validPinIds),
         createdAt,
     };
@@ -385,6 +398,9 @@ export function normalizeCaseDecisions(raw, fallback, validPinIds, options = {})
         .slice(-MAX_CASE_DECISIONS);
 }
 export function appendCaseDecision(current, raw, now, validPinIds) {
+    if (current.length >= MAX_CASE_DECISIONS) {
+        throw new Error(`A Case can retain at most ${MAX_CASE_DECISIONS} decisions. No existing decision was removed.`);
+    }
     const item = record(raw);
     const created = normalizeDecision({ ...item, id: freshId('decision'), createdAt: now }, now, validPinIds);
     if (!created)
@@ -661,16 +677,28 @@ function normalizeAction(raw, fallback, options = {}) {
     const latestEventAt = applied.at(-1)?.occurredAt ?? createdAt;
     const metadataUpdatedAt = iso(item.metadataUpdatedAt ?? item.updatedAt, createdAt, options);
     const updatedAt = Date.parse(latestEventAt) > Date.parse(metadataUpdatedAt) ? latestEventAt : metadataUpdatedAt;
+    const contactSource = text(item.contactSource, MAX_RESPONSE_LABEL_LENGTH) || 'analyst_supplied';
+    const legacyPlatformReview = options.sourceVersion != null && options.sourceVersion < 15
+        && item.type === 'security_contact_report'
+        ? /^Official .+, reviewed (\d{4}-\d{2}-\d{2})$/u.exec(contactSource)
+        : null;
     return {
         id: actionId,
-        type: typeof item.type === 'string' && ACTION_TYPES.has(item.type)
-            ? item.type
-            : 'internal_review',
+        type: legacyPlatformReview
+            ? 'platform_report'
+            : typeof item.type === 'string' && ACTION_TYPES.has(item.type)
+                ? item.type
+                : 'internal_review',
         recipient,
-        contactSource: text(item.contactSource, MAX_RESPONSE_LABEL_LENGTH) || 'analyst_supplied',
-        routeObservedAt: options.sourceVersion != null && options.sourceVersion < 14
+        contactSource,
+        routeObservedAt: legacyPlatformReview
+            ? normalizeExplicitIsoTimestamp(`${legacyPlatformReview[1]}T00:00:00.000Z`)
+            : options.sourceVersion != null && options.sourceVersion < 14
+                ? null
+                : optionalIso(item.routeObservedAt, options),
+        routeReviewAfter: options.sourceVersion != null && options.sourceVersion < 15
             ? null
-            : optionalIso(item.routeObservedAt, options),
+            : optionalIso(item.routeReviewAfter, options),
         contactLimitations: limitations(item.contactLimitations),
         dueAt: optionalIso(item.dueAt, options),
         state: history.state,
@@ -1112,6 +1140,9 @@ export function normalizeCaseAssertions(raw, fallback, validPinIds, options = {}
         .slice(-MAX_CASE_ASSERTIONS);
 }
 export function appendCaseAssertion(current, raw, now, validPinIds) {
+    if (current.length >= MAX_CASE_ASSERTIONS) {
+        throw new Error(`A Case can retain at most ${MAX_CASE_ASSERTIONS} assertions. No existing assertion was removed.`);
+    }
     const item = record(raw);
     const created = normalizeAssertion({
         ...item,
@@ -1170,6 +1201,9 @@ export function normalizeCaseManualTrail(raw, fallback, options = {}) {
         .slice(-MAX_CASE_MANUAL_TRAIL_EVENTS);
 }
 export function appendCaseManualTrailEvent(current, raw, now) {
+    if (current.length >= MAX_CASE_MANUAL_TRAIL_EVENTS) {
+        throw new Error(`A Case can retain at most ${MAX_CASE_MANUAL_TRAIL_EVENTS} investigation-trail entries. No existing entry was removed.`);
+    }
     const item = record(raw);
     const created = normalizeManualTrailEvent({ ...item, id: freshId('trail'), createdAt: now }, now);
     if (!created)
@@ -1234,6 +1268,9 @@ export function normalizeCaseSightings(raw, fallback, validPinIds, options = {})
         .slice(-MAX_CASE_SIGHTINGS);
 }
 export function appendCaseSighting(current, raw, now, validPinIds) {
+    if (current.length >= MAX_CASE_SIGHTINGS) {
+        throw new Error(`A Case can retain at most ${MAX_CASE_SIGHTINGS} sightings. No existing sighting was removed.`);
+    }
     const item = record(raw);
     const created = normalizeCaseSighting({
         ...item,