@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/packages/cases/case-record-projection.mjs

@@ -1,4 +1,4 @@
-import { PUBLIC_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { PUBLIC_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
 import { caseStatusIsClosed } from "./case-record-decisions.mjs";
 const PRESERVE = Object.freeze({
     durable: 'preserve', internal: 'preserve', trusted: 'preserve', public: 'preserve',
@@ -71,6 +71,12 @@ function publicClosureHistory(preV13HistoryUnavailable) {
 const CASE_FIELD_RULES = Object.freeze({
     id: preservedField('id'),
     domain: preservedField('domain'),
+    title: fieldRule('title', SHARED_EXCLUDE, (record, profile) => (profile === 'trusted' || profile === 'public' ? '' : record.title ?? ''), {
+        audienceExclusions: {
+            trusted: { label: 'Case titles', order: 1, sinceVersion: INCIDENT_CASE_SCHEMA_VERSION },
+            public: { label: 'Case titles', order: 1, sinceVersion: INCIDENT_CASE_SCHEMA_VERSION },
+        },
+    }),
     status: fieldRule('status', PUBLIC_TRANSFORM, (record, profile) => (profile === 'public' && caseStatusIsClosed(record.status) && record.closures.records.length
         ? 'reviewing'
         : record.status)),
@@ -133,6 +139,12 @@ const CASE_FIELD_RULES = Object.freeze({
     branches: fieldRule('branches', PUBLIC_EXCLUDE, (record, profile) => (profile === 'public' ? [] : structuredClone(record.branches ?? [])), {
         audienceExclusions: { public: { label: 'Investigation branches', order: 5 } },
     }),
+    attachments: fieldRule('attachments', SHARED_EXCLUDE, (record, profile) => (profile === 'trusted' || profile === 'public' ? undefined : structuredClone(record.attachments)), {
+        audienceExclusions: {
+            trusted: { label: 'Retained file references and provenance', order: 5, sinceVersion: INCIDENT_CASE_SCHEMA_VERSION },
+            public: { label: 'Retained file references and provenance', order: 5, sinceVersion: INCIDENT_CASE_SCHEMA_VERSION },
+        },
+    }),
     createdAt: preservedField('createdAt'),
     updatedAt: preservedField('updatedAt'),
 });
@@ -140,10 +152,13 @@ function projectCase(record, profile) {
     const projected = {};
     for (const key of Object.keys(CASE_FIELD_RULES)) {
         const rule = CASE_FIELD_RULES[key];
+        const value = rule.value(record, profile);
+        if (value === undefined)
+            continue;
         Object.defineProperty(projected, key, {
             configurable: true,
             enumerable: true,
-            value: rule.value(record, profile),
+            value,
             writable: true,
         });
     }
@@ -167,38 +182,26 @@ const OUTSIDE_SCHEMA_EXCLUSIONS = Object.freeze({
     trusted: Object.freeze({ label: 'Raw upstream payloads and credentials', order: 4 }),
     public: Object.freeze({ label: 'Raw upstream payloads and credentials', order: 7 }),
 });
-function currentAudienceExclusions(audience) {
+function currentAudienceExclusions(audience, caseVersion) {
     const entries = [
         ...Object.values(CASE_FIELD_RULES).flatMap((rule) => (rule.audienceExclusions[audience] ? [rule.audienceExclusions[audience]] : [])),
         OUTSIDE_SCHEMA_EXCLUSIONS[audience],
     ];
     const orderByLabel = new Map();
-    const labelByOrder = new Map();
     for (const entry of entries) {
+        if (entry.sinceVersion !== undefined && caseVersion < entry.sinceVersion)
+            continue;
         if (!entry.label || entry.label.length > 160 || entry.label.trim() !== entry.label
             || !Number.isSafeInteger(entry.order) || entry.order < 1 || entry.order > 64) {
             throw new TypeError('Case audience exclusion metadata is malformed or exceeds its bound.');
         }
         const prior = orderByLabel.get(entry.label);
-        if (prior !== undefined && prior !== entry.order) {
-            throw new TypeError(`Case audience exclusion ${entry.label} has conflicting presentation order.`);
-        }
-        const priorLabel = labelByOrder.get(entry.order);
-        if (priorLabel !== undefined && priorLabel !== entry.label) {
-            throw new TypeError(`Case audience exclusions ${priorLabel} and ${entry.label} share a presentation order.`);
-        }
-        orderByLabel.set(entry.label, entry.order);
-        labelByOrder.set(entry.order, entry.label);
+        orderByLabel.set(entry.label, Math.min(prior ?? entry.order, entry.order));
     }
     return Object.freeze([...orderByLabel]
-        .sort((left, right) => left[1] - right[1])
+        .sort((left, right) => left[1] - right[1] || (left[0] < right[0] ? -1 : left[0] > right[0] ? 1 : 0))
         .map(([label]) => label));
 }
-const CURRENT_AUDIENCE_EXCLUSIONS = Object.freeze({
-    internal: currentAudienceExclusions('internal'),
-    trusted: currentAudienceExclusions('trusted'),
-    public: currentAudienceExclusions('public'),
-});
 // Schema 12 is an immutable public compatibility contract and deliberately
 // remains independent of the current field-policy projection.
 const PUBLIC_V12_EXCLUSIONS = Object.freeze([
@@ -213,6 +216,6 @@ const PUBLIC_V12_EXCLUSIONS = Object.freeze([
 export function caseAudienceExclusions(audience, caseVersion) {
     return audience === 'public' && caseVersion === PUBLIC_CASE_SCHEMA_VERSION
         ? PUBLIC_V12_EXCLUSIONS
-        : CURRENT_AUDIENCE_EXCLUSIONS[audience];
+        : currentAudienceExclusions(audience, caseVersion);
 }
 export { CASE_FIELD_RULES };

package/packages/cases/case-report.mjs

@@ -8,18 +8,19 @@
 // contains raw RDAP/WHOIS material. This module deliberately excludes all raw
 // registry/web responses, contacts, cookies, screenshots, and authentication
 // data. Reports contain only the normalized case record.
-import { caseEvidenceIncomparableReasons, compareCaseEvidence, latestCaseEvidence } from "./case-model.mjs";
+import { caseEvidenceTimeline, compareCaseEvidence, currentCaseEvidence } from "./case-model.mjs";
 import { httpSecurityHeaderLabel } from "./http-summary.mjs";
 import { analystInteroperabilityTags } from "../../lib/analyst-taxonomy.mjs";
 import { buildPortableGeneratorMetadata, portableGeneratorAttribution, } from "../../lib/portable-generator.mjs";
 import { buildCaseResponseLifecycleSummary, CASE_EVIDENCE_RELATION_STANCES } from "./case-response-model.mjs";
 import { normalizeCaseBrandProfileIds } from "./case-brand-profile-references.mjs";
-import { CASE_REPORT_SCHEMA, CASE_REPORT_SCHEMA_VERSION, } from "../contracts/case-portability.mjs";
+import { CASE_RECHECK_CONDITIONS } from "./case-recheck-model.mjs";
+import { CASE_REPORT_SCHEMA, CASE_REPORT_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_REPORT_SCHEMA_VERSION, } from "../contracts/case-portability.mjs";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
 export { CASE_REPORT_SCHEMA, CASE_REPORT_SCHEMA_VERSION };
-const LIMITATIONS_TEXT = [
+const PUBLISHED_V2_3_LIMITATIONS = Object.freeze([
     'This report contains normalised browser-local observations from WHOISleuth analyst cases.',
     'It is not a live lookup and does not contain raw WHOIS, RDAP, DNS, HTML, or responses collected during website checks.',
     'Absence of a signal (e.g. no MX record observed) does not prove nonexistence. It may not have been evaluated.',
@@ -28,6 +29,11 @@ const LIMITATIONS_TEXT = [
     'Brand Profile references record an explicit analyst-selected association only; they do not establish ownership, attribution, intent, safety, or maliciousness.',
     'Provider workflow outcomes and independently observed technical effects remain separately attributed. A provider outcome does not establish independent remediation, absence, or safety; neither evidence family establishes legal sufficiency or provider performance.',
     'Generated locally in the browser. Review the package before sharing it.',
+]);
+const LIMITATIONS_TEXT = [
+    ...PUBLISHED_V2_3_LIMITATIONS.slice(0, 2),
+    'Snapshot hostnames are excluded; supporting DNS, TLS and web observations need not concern the Case registration domain.',
+    ...PUBLISHED_V2_3_LIMITATIONS.slice(2),
 ].join(' ');
 function escapeMarkdownInline(text) {
     return String(text)
@@ -100,6 +106,7 @@ function pickKnownSnapshotFields(snapshot) {
     return {
         id: snapshot.id,
         fingerprint: snapshot.fingerprint,
+        ...(snapshot.factorOrder ? { factorOrder: snapshot.factorOrder } : {}),
         firstCapturedAt: snapshot.firstCapturedAt,
         capturedAt: snapshot.capturedAt,
         source: snapshot.source,
@@ -165,51 +172,17 @@ export function buildCaseReport(caseRecord, options = {}) {
     const now = generatedAt || new Date().toISOString();
     const generator = buildPortableGeneratorMetadata(options.applicationVersion);
     // --- Build JSON report ---
-    const timelineEntries = [];
-    if (Array.isArray(caseRecord.evidenceHistory) && caseRecord.evidenceHistory.length > 0) {
-        const chronological = [...caseRecord.evidenceHistory];
-        for (let i = 0; i < chronological.length; i++) {
-            const snapshot = chronological[i];
-            if (!snapshot)
-                continue;
-            const isBaseline = i === 0;
-            const hasRepeatedObservation = snapshot.firstCapturedAt !== snapshot.capturedAt;
-            let changes = null;
-            let hasIncomparableChange = false;
-            let incomparableReasons = [];
-            if (!isBaseline) {
-                const previous = chronological[i - 1];
-                if (!previous)
-                    continue;
-                const rawChanges = compareCaseEvidence(previous, snapshot);
-                incomparableReasons = caseEvidenceIncomparableReasons(previous, snapshot);
-                const hostnameContextChanged = incomparableReasons.includes('observation-context');
-                if (rawChanges.length > 0 && !hostnameContextChanged) {
-                    changes = rawChanges.map((change) => ({
-                        field: change.field,
-                        label: change.label,
-                        before: change.before,
-                        after: change.after,
-                        tone: change.tone,
-                    }));
-                }
-                else if (snapshot.fingerprint !== previous.fingerprint
-                    && incomparableReasons.length === 0) {
-                    incomparableReasons = ['other'];
-                }
-                hasIncomparableChange = incomparableReasons.length > 0;
-            }
-            timelineEntries.push({
-                snapshot: pickKnownSnapshotFields(snapshot),
-                isBaseline,
-                hasRepeatedObservation,
-                changes,
-                hasIncomparableChange,
-                incomparableReasons,
-            });
-        }
-    }
-    const latest = latestCaseEvidence({ evidenceHistory: caseRecord.evidenceHistory ?? undefined });
+    const timeline = caseEvidenceTimeline(caseRecord.evidenceHistory);
+    const timelineEntries = timeline.map((entry) => ({
+        snapshot: pickKnownSnapshotFields(entry.snapshot),
+        isBaseline: entry.isBaseline,
+        hasRepeatedObservation: entry.hasRepeatedObservation,
+        changes: entry.changes?.map(({ field, label, before, after, tone }) => ({ field, label, before, after, tone })) ?? null,
+        hasIncomparableChange: entry.hasIncomparableChange,
+        incomparableReasons: [...entry.incomparableReasons],
+    }));
+    const selection = currentCaseEvidence(caseRecord);
+    const latest = selection.snapshot;
     const currentAssessment = latest ? pickKnownSnapshotFields(latest) : null;
     const responseLifecycle = buildCaseResponseLifecycleSummary(caseRecord);
     const observedEffects = caseRecord.observedEffects ?? {
@@ -231,6 +204,7 @@ export function buildCaseReport(caseRecord, options = {}) {
         application: generator,
         case: {
             id: caseRecord.id,
+            title: caseRecord.title ?? '',
             domain: caseRecord.domain,
             status: caseRecord.status,
             disposition: caseRecord.disposition,
@@ -290,12 +264,28 @@ export function buildCaseReport(caseRecord, options = {}) {
             })),
         },
         responseLifecycle,
-        limitations: LIMITATIONS_TEXT,
+        limitations: [LIMITATIONS_TEXT, selection.limitation, ...new Set(timeline.map((entry) => entry.orderingLimitation))].filter(Boolean).join(' '),
     };
     // --- Build Markdown ---
     const md = buildMarkdown(json, options.includeAttribution !== false);
     return { json, markdown: md };
 }
+/** Expected strict reader projection; historical disclosure wording is immutable. */
+export function buildCaseReportVerificationProjection(caseRecord, options, schemaVersion) {
+    const current = buildCaseReport(caseRecord, options).json;
+    if (schemaVersion === CASE_REPORT_SCHEMA_VERSION)
+        return current;
+    if (schemaVersion !== PUBLISHED_V2_3_CASE_REPORT_SCHEMA_VERSION) {
+        throw new TypeError('No strict Case report projection is defined for this version.');
+    }
+    const { title: _title, ...publishedCase } = current.case;
+    return {
+        ...current,
+        case: publishedCase,
+        schemaVersion,
+        limitations: PUBLISHED_V2_3_LIMITATIONS.join(' ') + current.limitations.slice(LIMITATIONS_TEXT.length),
+    };
+}
 // ---------------------------------------------------------------------------
 // Markdown generation
 // ---------------------------------------------------------------------------
@@ -310,6 +300,11 @@ function buildMarkdown(report, includeAttribution) {
     const domain = escapeMarkdownInline(report.case.domain || 'unknown');
     lines.push(`# Case Report: ${domain}`);
     lines.push('');
+    if (report.case.title) {
+        lines.push(`**Incident:** ${escapeMarkdownInline(report.case.title)}`);
+        lines.push('');
+    }
+    lines.push(`**Case ID:** ${escapeMarkdownInline(report.case.id)}`);
     // Metadata
     lines.push(`**Generated:** ${escapeMarkdownInline(report.generatedAt)}`);
     lines.push(`**Report schema:** ${escapeMarkdownInline(report.schema)} v${report.schemaVersion}`);
@@ -355,7 +350,9 @@ function buildMarkdown(report, includeAttribution) {
         lines.push(`- **Source:** ${escapeMarkdownInline(formatReportValue(a.source))}`);
     }
     else {
-        lines.push('No evidence captured.');
+        lines.push(report.evidenceTimeline.length
+            ? 'Retained snapshots have no unique latest assessment. Review the timeline and limitations.'
+            : 'No evidence captured.');
     }
     lines.push('');
     // Evidence timeline
@@ -478,7 +475,7 @@ function buildMarkdown(report, includeAttribution) {
             lines.push('No evidence pins recorded.');
         for (const pin of response.evidencePins) {
             lines.push(`- **${escapeMarkdownInline(pin.label)}:** ${escapeMarkdownInline(pin.value)}`);
-            lines.push(`  Source: ${escapeMarkdownInline(pin.source)}; observed ${escapeMarkdownInline(pin.observedAt)}; completeness ${escapeMarkdownInline(pin.completeness)}.`);
+            lines.push(`  Source: ${escapeMarkdownInline(pin.source)}; observed ${escapeMarkdownInline(pin.observedAt ?? 'Time unavailable')}; completeness ${escapeMarkdownInline(pin.completeness)}.`);
             if (pin.limitations.length)
                 lines.push(`  Limitations: ${escapeMarkdownInline(pin.limitations.join('; '))}`);
         }
@@ -488,7 +485,7 @@ function buildMarkdown(report, includeAttribution) {
         if (!response.sightings.length)
             lines.push('No source-qualified sightings recorded.');
         for (const sighting of response.sightings) {
-            lines.push(`- **${escapeMarkdownInline(sighting.state.replaceAll('_', ' '))}:** ${escapeMarkdownInline(sighting.category)} (${escapeMarkdownInline(sighting.observedAt)})`);
+            lines.push(`- **${escapeMarkdownInline(sighting.state.replaceAll('_', ' '))}:** ${escapeMarkdownInline(sighting.category)} (${escapeMarkdownInline(sighting.observedAt ?? 'Observation time unavailable')})`);
             lines.push(`  Source: ${escapeMarkdownInline(sighting.source)}; class ${escapeMarkdownInline(sighting.sourceClass)}; completeness ${escapeMarkdownInline(sighting.completeness)}.`);
             if (sighting.evidencePinId)
                 lines.push(`  Evidence pin: ${escapeMarkdownInline(sighting.evidencePinId)}`);
@@ -512,6 +509,11 @@ function buildMarkdown(report, includeAttribution) {
                 lines.push(`- **${escapeMarkdownInline(assertion.state)}:** ${escapeMarkdownInline(assertion.statement)}`);
                 if (assertion.rationale)
                     lines.push(`  ${escapeMarkdownInline(assertion.rationale)}`);
+                if (assertion.recheck) {
+                    lines.push(`  Recheck target: ${escapeMarkdownInline(assertion.recheck.targetHostname)}; comparison conditions: ${escapeMarkdownInline(assertion.recheck.conditions)}`);
+                    if (assertion.recheck.baselinePinId)
+                        lines.push(`  Baseline evidence pin: ${escapeMarkdownInline(assertion.recheck.baselinePinId)}`);
+                }
                 if (assertion.provenance) {
                     lines.push(`  External provenance: ${escapeMarkdownInline(assertion.provenance.format.toUpperCase())}; source ${escapeMarkdownInline(assertion.provenance.sourceName)}; file SHA-256 ${escapeMarkdownInline(assertion.provenance.sourceDigestSha256)}.`);
                     if (assertion.provenance.publisher)
@@ -623,10 +625,19 @@ function buildMarkdown(report, includeAttribution) {
         : `- Latest independently observed change time: Withheld because the independent change state is ${escapeMarkdownInline(report.responseLifecycle.observedChangeState)}.`);
     if (observedEffect)
         lines.push(`- Latest independent review: ${escapeMarkdownInline(observedEffect.state.replaceAll('_', ' '))} at ${escapeMarkdownInline(observedEffect.observedAt)} from ${escapeMarkdownInline(observedEffect.source)}.`);
+    else if (response.observedEffects.reviews.length)
+        lines.push('- A single latest independent review cannot be selected from the retained observation times. Review the individual records below.');
     if (!response.observedEffects.reviews.length)
         lines.push('- No independent observed-effect review recorded.');
     for (const review of response.observedEffects.reviews) {
         lines.push(`- **${escapeMarkdownInline(review.state.replaceAll('_', ' '))}** (${escapeMarkdownInline(review.observedAt)}): ${escapeMarkdownInline(review.source)}; class ${escapeMarkdownInline(review.sourceClass)}; completeness ${escapeMarkdownInline(review.completeness)}.`);
+        if (review.recheck) {
+            lines.push(`  Question ${escapeMarkdownInline(review.recheck.questionId)}: ${escapeMarkdownInline(review.recheck.question)}`);
+            lines.push(`  Recheck target: ${escapeMarkdownInline(review.recheck.targetHostname)}; retained comparison conditions: ${escapeMarkdownInline(review.recheck.conditions)}`);
+            lines.push(`  Condition comparison: ${escapeMarkdownInline(CASE_RECHECK_CONDITIONS[review.recheck.conditionsMatch])}`);
+            if (review.recheck.baselinePinId)
+                lines.push(`  Baseline evidence pin: ${escapeMarkdownInline(review.recheck.baselinePinId)}`);
+        }
         if (review.evidencePinId)
             lines.push(`  Evidence pin: ${escapeMarkdownInline(review.evidencePinId)}`);
         if (review.sightingId)