@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/packages/cases/case-export-input.mjs

@@ -0,0 +1,55 @@
+import { boundedJsonLimitsForBytes, parseBoundedJsonObject } from "../analysis/bounded-json.mjs";
+import { canonicalArtifactJsonV2 } from "../evidence/artifact-integrity.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { CASE_SCHEMA_VERSION, CLI_CASE_PACK_INPUT_CASE_VERSIONS, MAX_CASE_STORE_BYTES, MAX_EDITABLE_CASE_INPUT_BYTES, PUBLISHED_V2_3_CASE_SCHEMA_VERSION, EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { normalizeCaseStore } from "./case-migration-model.mjs";
+import { serializeCaseStore } from "./case-storage-model.mjs";
+/** Historical wire shape remains independent of current in-memory defaults. */
+export function canonicalCaseExportProjection(cases, caseVersion) {
+    return cases.map((record) => {
+        const { workflowMetadata: _workflow, ...historical } = record;
+        const value = caseVersion < EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION ? historical : record;
+        if (caseVersion !== PUBLISHED_V2_3_CASE_SCHEMA_VERSION)
+            return value;
+        if ([...value.evidencePins, ...value.sightings].some((item) => item.observedAt === null)) {
+            throw new TypeError('The published Case 15 format requires a known observation time on each retained pin and sighting.');
+        }
+        const { title: _title, ...published } = value;
+        return {
+            ...published,
+            sightings: [...value.sightings].sort((left, right) => Date.parse(left.observedAt) - Date.parse(right.observedAt)
+                || (left.id < right.id ? -1 : left.id > right.id ? 1 : 0)),
+        };
+    });
+}
+/** Editing never silently repairs, drops or truncates an imported record. */
+export function readEditableCaseExport(input) {
+    const root = parseBoundedJsonObject(input, {
+        label: 'Case file', maximumBytes: MAX_EDITABLE_CASE_INPUT_BYTES,
+        limits: boundedJsonLimitsForBytes(MAX_CASE_STORE_BYTES),
+    });
+    if (Object.keys(root).some(key => !['version', 'exportedAt', 'cases'].includes(key))) {
+        throw new TypeError('Case editing requires an ordinary Case export, not a response packet or an envelope with additional fields.');
+    }
+    if (!CLI_CASE_PACK_INPUT_CASE_VERSIONS.some(version => version === root.version) || !Array.isArray(root.cases)) {
+        throw new TypeError(`Case editing reads exact schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(', ')} and writes schema ${CASE_SCHEMA_VERSION}. Re-export other supported historical formats through the ordinary import workflow first.`);
+    }
+    if (Object.hasOwn(root, 'exportedAt') && !normalizeExplicitIsoTimestamp(root.exportedAt)) {
+        throw new TypeError('The Case export time is invalid.');
+    }
+    const cases = normalizeCaseStore(root).cases;
+    const projected = canonicalCaseExportProjection(cases, root.version);
+    const byId = new Map(projected.map(record => [record.id, record]));
+    const seen = new Set();
+    if (cases.length !== root.cases.length || root.cases.some(value => {
+        if (!value || typeof value !== 'object' || typeof value.id !== 'string' || seen.has(value.id))
+            return true;
+        seen.add(value.id);
+        return canonicalArtifactJsonV2(value) !== canonicalArtifactJsonV2(byId.get(value.id));
+    }))
+        throw new TypeError('The Case file would lose, repair or truncate retained data during normalisation. Nothing was changed.');
+    if (new TextEncoder().encode(serializeCaseStore(cases)).byteLength > MAX_CASE_STORE_BYTES) {
+        throw new TypeError('The Case file exceeds the canonical store byte budget. Select fewer Cases; no retained evidence was pruned.');
+    }
+    return cases;
+}

package/packages/cases/case-incident-context.mjs

@@ -0,0 +1,52 @@
+// Pure incident context parsing and retention projection; no storage or Case mutation.
+import { canonicalRegistrableDomain } from "../analysis/registrable-domain.mjs";
+import { MAX_CASE_OBJECTIVE_LENGTH } from "../contracts/case-portability.mjs";
+import { parseCredentialFreeHttpUrl } from "../evidence/lookup-target.mjs";
+export const MAX_CASE_INCIDENT_URL_LENGTH = 1_850;
+function boundedContextText(value, maximum) {
+    return typeof value === 'string'
+        ? value.replace(/[\u0000-\u001f\u007f]/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum)
+        : '';
+}
+export function normalizeCaseObjective(value) {
+    return boundedContextText(value, MAX_CASE_OBJECTIVE_LENGTH);
+}
+export function parseIncidentUrlContext(value) {
+    const parsed = parseCredentialFreeHttpUrl(value, MAX_CASE_INCIDENT_URL_LENGTH);
+    if (!parsed)
+        return null;
+    const hostname = parsed.hostname.toLowerCase().replace(/\.$/u, '');
+    const registrableDomain = canonicalRegistrableDomain(hostname);
+    if (!registrableDomain)
+        return null;
+    const exactUrl = parsed.toString();
+    if (exactUrl.length > MAX_CASE_INCIDENT_URL_LENGTH)
+        return null;
+    return Object.freeze({
+        exactUrl,
+        hostname,
+        registrableDomain,
+        originUrl: parsed.origin,
+        hasPath: parsed.pathname !== '/',
+        hasQuery: Boolean(parsed.search),
+        hasFragment: Boolean(parsed.hash),
+    });
+}
+export function caseInvestigationContext(record) {
+    return record?.workflowMetadata?.investigationContext ?? null;
+}
+export function prepareCaseInvestigationContext(input) {
+    const objective = normalizeCaseObjective(input.objective);
+    if (!objective)
+        throw new Error('Enter the investigation objective before retaining Incident context.');
+    const parsed = parseIncidentUrlContext(input.incidentUrl);
+    if (!parsed)
+        throw new Error(`Enter one absolute HTTP(S) Incident URL of at most ${MAX_CASE_INCIDENT_URL_LENGTH} characters without credentials.`);
+    const retention = input.retainExactUrl ? 'exact' : 'origin_only';
+    const retainedUrl = input.retainExactUrl ? parsed.exactUrl : parsed.originUrl;
+    return Object.freeze({
+        objective,
+        incidentUrl: retainedUrl,
+        urlRetention: retention,
+    });
+}

package/packages/cases/case-markdown.mjs

@@ -0,0 +1,11 @@
+/** Keep untrusted Case prose literal, including block syntax and GFM autolinks. */
+export function escapeCaseMarkdownInline(text) {
+    return String(text)
+        .replace(/[\r\n\u2028\u2029]+/g, ' ')
+        .replace(/([\\`*_{}\[\]<>()#+!|~])/g, '\\$1')
+        .replace(/^(\s*)([-=]+)(?=\s|$)/u, '$1\\$2')
+        .replace(/^(\s*\d+)\.(?=\s)/u, '$1\\.')
+        // Break automatic links without altering the underlying evidence value.
+        .replace(/\b([a-z][a-z0-9+.-]{1,31}):(?=\/\/)/gi, '$1\\:')
+        .replace(/\bwww\.(?=\S)/gi, 'www\\.');
+}

package/packages/cases/case-migration-model.mjs

@@ -1,10 +1,22 @@
-import { CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, MAX_CASES, MAX_NOTES_PER_CASE, deterministicId, caseTimestampOrNull, normalizeCase, normalizeDomain, normalizeEvidenceHistory, normalizeNotes, normalizeReviewReasonCode, normalizeTags, objectRecord, safeId, isValidDisposition, isValidSource, isValidStatus, } from "./case-record-model.mjs";
-import { CASE_REPORT_SCHEMA, PUBLIC_CASE_SCHEMA_VERSION, caseReportVersionMatchesCase, CLI_CASE_PACK_CURRENT_REDACTION_KEYS, CLI_CASE_PACK_INTEGRITY_KEYS, CLI_CASE_PACK_LIMITATIONS, CLI_CASE_PACK_PACKET_KEYS, CLI_CASE_PACK_PUBLIC_REPORT_KEYS, CLI_CASE_PACK_REPORT_KEYS, CLI_CASE_PACK_ROOT_KEYS, CLI_CASE_PACK_SCHEMA, CLI_CASE_PACK_VERSION, } from "../contracts/case-portability.mjs";
+import { CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, MAX_CASES, MAX_NOTES_PER_CASE, } from "../contracts/case-portability.mjs";
+import { DEFAULT_DISPOSITION, DEFAULT_STATUS, isValidDisposition, isValidStatus } from "./case-record-decisions.mjs";
+import { DEFAULT_SOURCE } from "./case-record-contracts.mjs";
+import { deterministicId, caseTimestampOrNull, normalizeNotes, normalizeReviewReasonCode, normalizeTags, objectRecord, safeId, isValidSource, } from "./case-record-core.mjs";
+import { normalizeCase } from "./case-record-operations.mjs";
+import { normalizeCaseObjective } from "./case-incident-context.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { mergeImportedEvidenceHistory, normalizeEvidenceHistory } from "./case-evidence-model.mjs";
+import { CASE_REPORT_SCHEMA, PUBLIC_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, caseReportVersionMatchesCase, CLI_CASE_PACK_CURRENT_REDACTION_KEYS, CLI_CASE_PACK_INTEGRITY_KEYS, CLI_CASE_PACK_LIMITATIONS, CLI_CASE_PACK_PACKET_KEYS, CLI_CASE_PACK_PUBLIC_REPORT_KEYS, CLI_CASE_PACK_REPORT_KEYS, CLI_CASE_PACK_ROOT_KEYS, CLI_CASE_PACK_SCHEMA, CLI_CASE_PACK_VERSION, } from "../contracts/case-portability.mjs";
 import { canonicalArtifactJsonV2 } from "../evidence/artifact-integrity.mjs";
-import { assertBoundedJsonStructure } from "../../lib/bounded-json.mjs";
+import { readCaseAttachments, mergeCaseAttachments } from "./case-attachment-model.mjs";
+import { readCaseEvidenceLinks, mergeCaseEvidenceLinks } from "./case-evidence-links.mjs";
+import { EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { assertBoundedJsonStructure } from "../analysis/bounded-json.mjs";
 import { inspectCaseBrandProfileIds, unionCaseBrandProfileIds, } from "./case-brand-profile-references.mjs";
 import { caseInvestigationBranchReferences, mergeCaseInvestigationBranches, normalizeCaseInvestigationBranches, } from "./case-investigation-branch-model.mjs";
 import { buildCaseClosureLinkContext, mergeCaseActions, mergeCaseClosureHistories, mergeCaseObservedEffectHistories, MAX_CASE_ASSERTIONS, MAX_CASE_DECISIONS, MAX_CASE_EVIDENCE_PINS, MAX_CASE_MANUAL_TRAIL_EVENTS, MAX_CASE_SIGHTINGS, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseClosureHistory, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseObservedEffectHistory, normalizeCaseSightings, } from "./case-response-model.mjs";
+import { readCaseWorkflowFields } from "./case-workflow-migration.mjs";
+import { emptyCaseWorkflowMetadata, mergeCaseWorkflowMetadata } from "./case-workflow-metadata.mjs";
 export const MAX_CASE_INPUT_RECORDS = 2_000;
 function compareCodeUnits(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
@@ -32,8 +44,8 @@ function assignUniqueIds(cases) {
 }
 /**
  * Recovers a clean, bounded store from the current versioned envelope or an
- * internal bare array, drops malformed records, keeps a single
- * case per domain (most recently updated wins), caps to MAX_CASES by recency,
+ * internal bare array, drops malformed records, preserves distinct current
+ * Case identities, caps to MAX_CASES by recency,
  * and guarantees globally unique safe ids. Retired, future, accessor-bearing,
  * sparse, or otherwise non-JSON envelopes fail before normalisation.
  * @param {unknown} raw
@@ -53,44 +65,53 @@ export function normalizeCaseStore(raw) {
         if (sourceVersion > CASE_SCHEMA_VERSION) {
             throw new TypeError(`Case schema ${sourceVersion} is newer than the supported schema ${CASE_SCHEMA_VERSION}; no data was changed.`);
         }
-        if (sourceVersion === CASE_SCHEMA_VERSION) {
-            assertCurrentCaseShape(raw);
+        if (sourceVersion >= PUBLISHED_V2_3_CASE_SCHEMA_VERSION) {
+            assertModernCaseShape(raw, sourceVersion);
         }
     }
-    const byDomain = new Map();
+    const byIdentity = new Map();
     for (const item of boundedCaseList(raw).items) {
         const normalized = normalizeCase(item, undefined, fallback, sourceVersion ?? CASE_SCHEMA_VERSION);
         if (!normalized)
             continue;
-        const existing = byDomain.get(normalized.domain);
+        // Published domain-centred stores retain their original recovery rule.
+        // Current incidents share a domain without sharing analyst decisions.
+        const key = sourceVersion !== null && sourceVersion < INCIDENT_CASE_SCHEMA_VERSION
+            ? normalized.domain : `${normalized.domain}\u0000${normalized.id}`;
+        const existing = byIdentity.get(key);
         if (!existing || Date.parse(normalized.updatedAt) >= Date.parse(existing.updatedAt)) {
-            byDomain.set(normalized.domain, normalized);
+            byIdentity.set(key, normalized);
         }
     }
-    const cases = [...byDomain.values()]
+    const cases = [...byIdentity.values()]
         .sort((a, b) => Date.parse(b.updatedAt) - Date.parse(a.updatedAt))
         .slice(0, MAX_CASES);
     assignUniqueIds(cases);
     return { version: CASE_SCHEMA_VERSION, cases };
 }
-function assertCurrentCaseShape(raw) {
+function assertModernCaseShape(raw, sourceVersion) {
     for (const item of boundedCaseList(raw).items) {
         const itemRecord = objectRecord(item);
+        if (sourceVersion < EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION && Object.hasOwn(itemRecord, 'evidenceLinks'))
+            throw new TypeError('Evidence relationships require the current Case schema.');
+        if (sourceVersion < INCIDENT_CASE_SCHEMA_VERSION && Object.hasOwn(itemRecord, 'attachments')) {
+            throw new TypeError('Retained file references require the current Case schema; no data was changed.');
+        }
         const evidenceHistory = itemRecord.evidenceHistory;
         for (const snapshot of Array.isArray(evidenceHistory) ? evidenceHistory : []) {
             const record = objectRecord(snapshot);
             if (Object.keys(record).length > 0 && !Object.hasOwn(record, 'inputHostname')) {
-                throw new TypeError(`Case schema ${CASE_SCHEMA_VERSION} evidence snapshots must declare their exact submitted hostname, including null; unreleased local Case checkpoints are not interpreted as the v2 format and no data was changed.`);
+                throw new TypeError(`Case schema ${sourceVersion} evidence snapshots must declare their exact submitted hostname, including null; no data was changed.`);
             }
         }
         const actions = itemRecord.actions;
         for (const action of Array.isArray(actions) ? actions : []) {
             const record = objectRecord(action);
             if (Object.keys(record).length > 0 && !Object.hasOwn(record, 'routeObservedAt')) {
-                throw new TypeError(`Case schema ${CASE_SCHEMA_VERSION} response actions must declare their route observation time, including null; unreleased local Case checkpoints are not interpreted as the current format and no data was changed.`);
+                throw new TypeError(`Case schema ${sourceVersion} response actions must declare their route observation time, including null; no data was changed.`);
             }
             if (Object.keys(record).length > 0 && !Object.hasOwn(record, 'routeReviewAfter')) {
-                throw new TypeError(`Case schema ${CASE_SCHEMA_VERSION} response actions must declare their route review deadline, including null; unreleased local Case checkpoints are not interpreted as the current format and no data was changed.`);
+                throw new TypeError(`Case schema ${sourceVersion} response actions must declare their route review deadline, including null; no data was changed.`);
             }
         }
         const decisions = itemRecord.decisions;
@@ -98,7 +119,7 @@ function assertCurrentCaseShape(raw) {
             const record = objectRecord(decision);
             if (Object.keys(record).length > 0
                 && (!Object.hasOwn(record, 'confidence') || !Object.hasOwn(record, 'confidenceBasis'))) {
-                throw new TypeError(`Case schema ${CASE_SCHEMA_VERSION} analyst decisions must declare confidence and its basis; unreleased local Case checkpoints are not interpreted as the current format and no data was changed.`);
+                throw new TypeError(`Case schema ${sourceVersion} analyst decisions must declare confidence and its basis; no data was changed.`);
             }
         }
     }
@@ -160,6 +181,8 @@ function boundedCaseList(raw) {
  */
 function extractImportPatch(raw, importedVersion) {
     const record = objectRecord(raw);
+    if (record.evidenceLinks !== undefined && importedVersion < EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION)
+        throw new TypeError('Evidence relationships require the current Case schema.');
     const domain = normalizeDomain(record.domain);
     if (!domain)
         return null;
@@ -168,7 +191,7 @@ function extractImportPatch(raw, importedVersion) {
         || null;
     const normalizedFallback = importFallback || '1970-01-01T00:00:00.000Z';
     const timestampOptions = {
-        legacyTimestamps: importedVersion < CASE_SCHEMA_VERSION,
+        legacyTimestamps: importedVersion < PUBLISHED_V2_3_CASE_SCHEMA_VERSION,
         sourceVersion: importedVersion,
     };
     const rawEvidence = Array.isArray(record.evidenceHistory) ? record.evidenceHistory : [];
@@ -196,9 +219,13 @@ function extractImportPatch(raw, importedVersion) {
         [record.sightings, sightings],
     ].reduce((total, [candidates, retained]) => total
         + Math.max(0, (Array.isArray(candidates) ? candidates.length : 0) - retained.length), 0);
+    const workflow = readCaseWorkflowFields(record, domain, assertions, importedVersion);
+    const hasWorkflow = record.workflowMetadata !== undefined || workflow.workflowMetadata.types.length > 0
+        || workflow.workflowMetadata.incidentTargets.length > 0 || workflow.workflowMetadata.investigationContext !== null;
     return {
         domain,
         rawId: typeof record.id === 'string' ? record.id : null,
+        title: typeof record.title === 'string' && importedVersion >= INCIDENT_CASE_SCHEMA_VERSION ? normalizeCaseObjective(record.title) : undefined,
         status: isValidStatus(record.status) ? record.status : undefined,
         disposition: isValidDisposition(record.disposition) ? record.disposition : undefined,
         reviewReasonCode: Object.hasOwn(record, 'reviewReasonCode')
@@ -225,7 +252,10 @@ function extractImportPatch(raw, importedVersion) {
         branches: importedVersion >= 11
             ? normalizeCaseInvestigationBranches(record.branches, normalizedFallback, branchReferences, timestampOptions)
             : [],
-        tags: normalizeTags(record.tags),
+        attachments: importedVersion >= INCIDENT_CASE_SCHEMA_VERSION ? readCaseAttachments(record.attachments) : undefined,
+        evidenceLinks: readCaseEvidenceLinks(record.evidenceLinks),
+        tags: workflow.tags,
+        workflowMetadata: hasWorkflow ? workflow.workflowMetadata : undefined,
         // Imported notes fall back only to the imported record's own timestamps
         // (never "now"), so a timestamp-less note gets a stable, deterministic time
         // and id, and re-importing the same file cannot manufacture a duplicate or a
@@ -235,16 +265,6 @@ function extractImportPatch(raw, importedVersion) {
         updatedAt: caseTimestampOrNull(record.updatedAt, importedVersion),
     };
 }
-/** @param {CaseNote[]} a @param {CaseNote[]} b @returns {CaseNote[]} */
-function unionNotes(a, b) {
-    const byId = new Map();
-    for (const note of [...a, ...b]) {
-        if (!byId.has(note.id))
-            byId.set(note.id, note);
-    }
-    const notes = [...byId.values()].sort((left, right) => Date.parse(left.createdAt) - Date.parse(right.createdAt));
-    return notes.slice(Math.max(0, notes.length - MAX_NOTES_PER_CASE));
-}
 function retainLocalAuthoredRecords(local, imported, maximum) {
     const records = [...local];
     const retainedIds = new Set(records.map((item) => item.id));
@@ -261,23 +281,18 @@ function retainLocalAuthoredRecords(local, imported, maximum) {
     }
     return { records, omitted };
 }
-// Additive, deduplicated union of two evidence histories. Identical material
-// collapses (earliest firstCapturedAt, latest capturedAt), distinct snapshots
-// are retained subject to the per-case bound, and an older import can never
-// move an existing observation backwards.
-function mergeEvidenceHistories(local, imported, caseDomain) {
-    return normalizeEvidenceHistory([...local, ...imported], { source: 'import', fallback: null, caseDomain });
-}
 /** @param {ImportPatch} patch @param {string} now @returns {CaseRecord} */
 function caseFromPatch(patch, now) {
     return {
         id: '', // assigned by mergeCases so it can guarantee uniqueness against locals
         domain: patch.domain,
+        title: patch.title ?? '',
         status: patch.status ?? DEFAULT_STATUS,
         disposition: patch.disposition ?? DEFAULT_DISPOSITION,
         reviewReasonCode: patch.reviewReasonCode ?? null,
         brandProfileIds: patch.brandProfileIds,
         tags: patch.tags,
+        workflowMetadata: patch.workflowMetadata ?? emptyCaseWorkflowMetadata(),
         notes: patch.notes,
         source: patch.source ?? DEFAULT_SOURCE,
         evidenceHistory: patch.evidenceHistory,
@@ -290,6 +305,8 @@ function caseFromPatch(patch, now) {
         observedEffects: patch.observedEffects,
         closures: patch.closures,
         branches: patch.branches,
+        ...(patch.attachments === undefined ? {} : { attachments: patch.attachments }),
+        ...(patch.evidenceLinks === undefined ? {} : { evidenceLinks: patch.evidenceLinks }),
         createdAt: patch.createdAt || patch.updatedAt || now,
         updatedAt: patch.updatedAt || patch.createdAt || now,
     };
@@ -306,6 +323,8 @@ function caseFromPatch(patch, now) {
 function applyImportPatch(local, patch) {
     const importNewer = patch.updatedAt !== null && Date.parse(patch.updatedAt) > Date.parse(local.updatedAt);
     const fallback = patch.updatedAt || local.updatedAt;
+    const noteSelection = retainLocalAuthoredRecords(local.notes, patch.notes, MAX_NOTES_PER_CASE);
+    const historySelection = mergeImportedEvidenceHistory(local.evidenceHistory, patch.evidenceHistory, local.domain);
     const pinSelection = retainLocalAuthoredRecords(local.evidencePins, patch.evidencePins, MAX_CASE_EVIDENCE_PINS);
     const evidencePins = normalizeCaseEvidencePins(pinSelection.records, fallback);
     const pinIds = new Set(evidencePins.map((item) => item.id));
@@ -323,7 +342,10 @@ function applyImportPatch(local, patch) {
     const decisions = normalizeCaseDecisions(decisionSelection.records, fallback, pinIds);
     const trailSelection = retainLocalAuthoredRecords(local.manualTrail, patch.manualTrail, MAX_CASE_MANUAL_TRAIL_EVENTS);
     const manualTrail = normalizeCaseManualTrail(trailSelection.records, fallback);
+    const attachments = mergeCaseAttachments(local.attachments, patch.attachments);
+    const evidenceLinks = mergeCaseEvidenceLinks(local.evidenceLinks, patch.evidenceLinks);
     const authoredHistoryOmitted = patch.authoredHistoryOmitted
+        + noteSelection.omitted
         + pinSelection.omitted
         + decisionSelection.omitted
         + assertionSelection.omitted
@@ -331,12 +353,13 @@ function applyImportPatch(local, patch) {
         + sightingSelection.omitted;
     return { record: {
             ...local,
+            title: patch.title !== undefined && importNewer ? patch.title : local.title ?? '',
             status: patch.status !== undefined && importNewer ? patch.status : local.status,
             disposition: patch.disposition !== undefined && importNewer ? patch.disposition : local.disposition,
             reviewReasonCode: patch.reviewReasonCode !== undefined && importNewer ? patch.reviewReasonCode : local.reviewReasonCode ?? null,
             brandProfileIds: brandProfileReferences.ids,
             source: patch.source !== undefined && importNewer ? patch.source : local.source,
-            evidenceHistory: mergeEvidenceHistories(local.evidenceHistory, patch.evidenceHistory, local.domain),
+            evidenceHistory: historySelection.records,
             evidencePins,
             decisions,
             actions,
@@ -346,11 +369,16 @@ function applyImportPatch(local, patch) {
             observedEffects,
             closures,
             branches: mergeCaseInvestigationBranches(local.branches ?? [], patch.branches, fallback, branchReferences),
+            ...(attachments === undefined ? {} : { attachments }),
+            ...(evidenceLinks === undefined ? {} : { evidenceLinks }),
             tags: normalizeTags([...local.tags, ...patch.tags]),
-            notes: unionNotes(local.notes, patch.notes),
+            workflowMetadata: patch.workflowMetadata === undefined
+                ? local.workflowMetadata ?? emptyCaseWorkflowMetadata()
+                : mergeCaseWorkflowMetadata(local.workflowMetadata ?? emptyCaseWorkflowMetadata(), patch.workflowMetadata, importNewer, local.domain),
+            notes: normalizeNotes(noteSelection.records, fallback),
             createdAt: patch.createdAt && Date.parse(patch.createdAt) < Date.parse(local.createdAt) ? patch.createdAt : local.createdAt,
             updatedAt: importNewer ? (patch.updatedAt ?? local.updatedAt) : local.updatedAt,
-        }, brandProfileReferencesOmitted: brandProfileReferences.omitted, authoredHistoryOmitted };
+        }, brandProfileReferencesOmitted: brandProfileReferences.omitted, authoredHistoryOmitted, evidenceHistoryOmitted: historySelection.omitted };
 }
 function pickFreeId(preferred, domain, used) {
     const wanted = safeId(preferred);
@@ -456,14 +484,14 @@ function caseCollectionImportEnvelope(importedRaw) {
 }
 /**
  * Merges an imported (already parsed) value into the local cases. Predictable
- * and idempotent: unknown records are skipped, existing domains merge without
+ * and idempotent: unknown records are skipped, matching Case identities merge without
  * losing newer local decisions, and new ones are added until the store bound is
  * reached. An imported envelope that declares a schema version newer than we
  * support is rejected up front (before any local data is touched) rather than
  * reinterpreted.
  * @param {CaseRecord[]} localCases
  * @param {unknown} importedRaw
- * @returns {{ cases: CaseRecord[], added: number, updated: number, skipped: number, brandProfileReferencesOmitted: number, authoredHistoryOmitted: number }}
+ * @returns {{ cases: CaseRecord[], added: number, updated: number, skipped: number, brandProfileReferencesOmitted: number, authoredHistoryOmitted: number, evidenceHistoryOmitted: number }}
  */
 export function mergeCases(localCases, importedRaw) {
     assertBoundedJsonStructure(importedRaw, 'Case import', CASE_INPUT_JSON_LIMITS);
@@ -480,11 +508,11 @@ export function mergeCases(localCases, importedRaw) {
         || !Array.isArray(importedEnvelope.cases)) {
         throw new Error(`Expected a well-formed WHOISleuth Case export using schema ${CASE_SCHEMA_VERSION}; no data was changed.`);
     }
-    if (importedVersion === CASE_SCHEMA_VERSION)
-        assertCurrentCaseShape(importedEnvelope);
+    if (importedVersion !== null && importedVersion >= PUBLISHED_V2_3_CASE_SCHEMA_VERSION)
+        assertModernCaseShape(importedEnvelope, importedVersion);
     const local = normalizeCaseStore(localCases).cases;
     const supportedImportedVersion = importedVersion ?? 0;
-    const byDomain = new Map(local.map((item) => [item.domain, item]));
+    const byId = new Map(local.map((item) => [item.id, item]));
     const usedIds = new Set(local.map((item) => item.id));
     let added = 0;
     let updated = 0;
@@ -492,26 +520,47 @@ export function mergeCases(localCases, importedRaw) {
     let skipped = imported.omitted;
     let brandProfileReferencesOmitted = 0;
     let authoredHistoryOmitted = 0;
+    let evidenceHistoryOmitted = 0;
     const fallback = new Date(0).toISOString();
+    const importedIds = new Set();
     for (const item of imported.items) {
         const patch = extractImportPatch(item, supportedImportedVersion);
         if (!patch) {
             skipped += 1;
             continue;
         }
-        const existing = byDomain.get(patch.domain);
+        const importedId = safeId(patch.rawId);
+        if (supportedImportedVersion >= INCIDENT_CASE_SCHEMA_VERSION && importedId) {
+            if (importedIds.has(importedId))
+                throw new Error('Incident Case imports cannot repeat a declared Case ID. No data was changed.');
+            importedIds.add(importedId);
+        }
+        let existing = importedId ? byId.get(importedId) : undefined;
+        if (existing && existing.domain !== patch.domain) {
+            if (supportedImportedVersion >= INCIDENT_CASE_SCHEMA_VERSION)
+                throw new Error('An imported Case ID belongs to a different domain in this workspace. No data was changed.');
+            existing = undefined;
+        }
+        if (!existing && (supportedImportedVersion < INCIDENT_CASE_SCHEMA_VERSION || !importedId)) {
+            const matchingDomain = [...byId.values()].filter(record => record.domain === patch.domain);
+            if (matchingDomain.length > 1) {
+                throw new Error(`The imported record for ${patch.domain} has no matching Case identity and several incidents exist. Import it into a separate workspace to review it without merging incidents; no data was changed.`);
+            }
+            existing = matchingDomain[0];
+        }
         if (existing) {
             const merged = applyImportPatch(existing, patch);
-            byDomain.set(patch.domain, merged.record);
+            byId.set(existing.id, merged.record);
             brandProfileReferencesOmitted += patch.brandProfileReferencesOmitted + merged.brandProfileReferencesOmitted;
             authoredHistoryOmitted += merged.authoredHistoryOmitted;
+            evidenceHistoryOmitted += merged.evidenceHistoryOmitted;
             updated += 1;
         }
-        else if (byDomain.size < MAX_CASES) {
+        else if (byId.size < MAX_CASES) {
             const record = caseFromPatch(patch, fallback);
             record.id = pickFreeId(patch.rawId, patch.domain, usedIds);
             usedIds.add(record.id);
-            byDomain.set(patch.domain, record);
+            byId.set(record.id, record);
             brandProfileReferencesOmitted += patch.brandProfileReferencesOmitted;
             authoredHistoryOmitted += patch.authoredHistoryOmitted;
             added += 1;
@@ -521,11 +570,12 @@ export function mergeCases(localCases, importedRaw) {
         }
     }
     return {
-        cases: normalizeCaseStore([...byDomain.values()]).cases,
+        cases: normalizeCaseStore([...byId.values()]).cases,
         added,
         updated,
         skipped,
         brandProfileReferencesOmitted,
         authoredHistoryOmitted,
+        evidenceHistoryOmitted,
     };
 }

package/packages/cases/case-model.mjs

@@ -3,3 +3,4 @@
 export * from "./case-record-model.mjs";
 export * from "./case-migration-model.mjs";
 export * from "./case-storage-model.mjs";
+export * from "./case-selection.mjs";

package/packages/cases/case-recheck-model.mjs

@@ -0,0 +1,149 @@
+import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
+import { INCIDENT_CASE_SCHEMA_VERSION, MAX_RESPONSE_RATIONALE_LENGTH, } from "../contracts/case-portability.mjs";
+import { enumeration, exact, text } from "../evidence/artifact-structure.mjs";
+import { casePinHasCompleteObservation } from "./case-evidence-quality.mjs";
+export const CASE_RECHECK_CONDITIONS = Object.freeze({
+    unknown: 'Not established',
+    comparable: 'Comparable for this question',
+    different: 'Different conditions',
+});
+function reference(value, label) {
+    const id = text(value, label, 64);
+    if (!/^[A-Za-z0-9_-]+$/u.test(id))
+        throw new TypeError(`${label} is invalid.`);
+    return id;
+}
+function contextFields(item) {
+    const targetHostname = text(item.targetHostname, 'Recheck target hostname', 253);
+    if (targetHostname !== targetHostname.toLowerCase() || !isValidAsciiHostname(targetHostname)) {
+        throw new TypeError('Use one normalised hostname for the recheck target, without a path or query.');
+    }
+    const conditions = text(item.conditions, 'Recheck comparison conditions', MAX_RESPONSE_RATIONALE_LENGTH);
+    if (!conditions.trim())
+        throw new TypeError('Describe the conditions needed to compare the observations.');
+    return Object.freeze({
+        targetHostname,
+        conditions,
+        baselinePinId: item.baselinePinId === null ? null : reference(item.baselinePinId, 'Recheck baseline pin'),
+    });
+}
+/** Optional current-format context; historical records have no invented question. */
+export function readCaseRecheckContext(value, sourceVersion) {
+    if (value === undefined)
+        return undefined;
+    if (sourceVersion != null && sourceVersion < INCIDENT_CASE_SCHEMA_VERSION)
+        throw new TypeError('This Case format cannot contain structured recheck questions.');
+    return contextFields(exact(value, ['targetHostname', 'baselinePinId', 'conditions'], 'Recheck question context'));
+}
+export function readCaseRecheckAnswerContext(value, sourceVersion) {
+    if (value === undefined)
+        return undefined;
+    if (sourceVersion != null && sourceVersion < INCIDENT_CASE_SCHEMA_VERSION)
+        throw new TypeError('This Case format cannot contain structured recheck answers.');
+    const item = exact(value, ['targetHostname', 'baselinePinId', 'conditions', 'questionId', 'question', 'conditionsMatch'], 'Recheck answer context');
+    const question = text(item.question, 'Recheck question', MAX_RESPONSE_RATIONALE_LENGTH);
+    if (!question.trim())
+        throw new TypeError('A recheck answer requires its original question.');
+    return Object.freeze({
+        ...contextFields(item),
+        questionId: reference(item.questionId, 'Recheck question ID'),
+        question,
+        conditionsMatch: enumeration(item.conditionsMatch, Object.keys(CASE_RECHECK_CONDITIONS), 'Recheck condition comparison'),
+    });
+}
+export function caseRecheckQuestions(assertions) {
+    return assertions.filter((item) => item.kind === 'next_step' && item.recheck && item.state === 'open');
+}
+export function caseRecheckAnswerContext(question, conditionsMatch) {
+    if (question.kind !== 'next_step' || !question.recheck)
+        throw new TypeError('Select a saved recheck question.');
+    return readCaseRecheckAnswerContext({
+        ...question.recheck,
+        questionId: question.id,
+        question: question.statement,
+        conditionsMatch,
+    });
+}
+/** Shared read projection; each form retains its draft and existing save coordinator. */
+export function selectCaseRecheckQuestion(assertions, selection) {
+    const questions = caseRecheckQuestions(assertions);
+    const question = questions.find((item) => item.id === selection.questionId);
+    return {
+        questions,
+        context: question ? caseRecheckAnswerContext(question, selection.conditionsMatch) : undefined,
+        stale: Boolean(selection.questionId) && (!question || question.updatedAt !== selection.questionUpdatedAt),
+    };
+}
+/** A saved answer is a snapshot, not a live reference to an editable plan. */
+export function assertCurrentRecheckQuestion(answer, assertions) {
+    const question = caseRecheckQuestions(assertions).find((item) => item.id === answer.questionId);
+    if (!question ||
+        JSON.stringify(caseRecheckAnswerContext(question, answer.conditionsMatch)) !==
+            JSON.stringify(answer)) {
+        throw new Error('The recheck question changed or was resolved. Refresh and review its current conditions before saving this answer.');
+    }
+}
+const RECHECK_COMPARISON_MESSAGES = {
+    different_conditions: 'The comparison conditions differ.',
+    unconfirmed_conditions: 'Comparable conditions have not been confirmed.',
+    missing_baseline: 'The baseline evidence is no longer available.',
+    current_target_mismatch: 'The current evidence concerns a different or unknown hostname.',
+    incomplete_current: 'The current source does not establish a complete observation.',
+    later_observation_needed: 'A later source observation is needed; reviewing the baseline again is not a recheck.',
+    baseline_target_mismatch: 'The baseline concerns a different hostname.',
+    different_field_or_source: 'The observations use different fields or sources.',
+};
+/** Admissibility depends on these reasons, not on presentation warnings. */
+export function caseRecheckComparisonBlockers(context, pins, current) {
+    const blockers = [];
+    if (context.conditionsMatch !== 'comparable') {
+        blockers.push(context.conditionsMatch === 'different'
+            ? 'different_conditions'
+            : 'unconfirmed_conditions');
+    }
+    const baseline = pins.find((pin) => pin.id === context.baselinePinId);
+    if (context.baselinePinId && !baseline)
+        blockers.push('missing_baseline');
+    if (current) {
+        if (current.observationHostname !== context.targetHostname)
+            blockers.push('current_target_mismatch');
+        if (!casePinHasCompleteObservation(current))
+            blockers.push('incomplete_current');
+        if (baseline) {
+            const sameObservation = baseline.id === current.id;
+            const unknownObservationTime = !baseline.observedAt || !current.observedAt;
+            const nonLaterObservation = !unknownObservationTime &&
+                Date.parse(current.observedAt) <= Date.parse(baseline.observedAt);
+            if (sameObservation || unknownObservationTime || nonLaterObservation) {
+                blockers.push('later_observation_needed');
+            }
+            if (baseline.observationHostname && baseline.observationHostname !== context.targetHostname)
+                blockers.push('baseline_target_mismatch');
+            const differentField = Boolean(baseline.field) && current.field !== baseline.field;
+            const differentSource = baseline.source !== current.source;
+            if (differentField || differentSource)
+                blockers.push('different_field_or_source');
+        }
+    }
+    return blockers;
+}
+export function caseRecheckComparisonWarnings(context, pins, current) {
+    return caseRecheckComparisonBlockers(context, pins, current)
+        .map((reason) => RECHECK_COMPARISON_MESSAGES[reason]);
+}
+export function assertRecheckNonReproduction(state, context, completeness, pins, current, observedAt) {
+    if (state !== 'not_reproduced')
+        return;
+    const blockers = caseRecheckComparisonBlockers(context, pins, current);
+    const baseline = pins.find((pin) => pin.id === context.baselinePinId);
+    let laterIndependentObservationNeeded = false;
+    if (!current && baseline) {
+        const missingObservationTime = !baseline.observedAt || !observedAt;
+        const invalidObservationTime = observedAt ? !Number.isFinite(Date.parse(observedAt)) : false;
+        const nonLaterObservation = !missingObservationTime && Date.parse(observedAt) <= Date.parse(baseline.observedAt);
+        laterIndependentObservationNeeded = missingObservationTime || invalidObservationTime || nonLaterObservation;
+    }
+    if (completeness !== 'complete' || blockers.length || laterIndependentObservationNeeded) {
+        throw new Error('Not reproduced requires a complete observation under comparable conditions. Record unavailable or describe the limited observation instead.');
+    }
+}

package/packages/cases/case-record-contracts.mjs

@@ -1,4 +1,4 @@
-import { ANALYST_REVIEW_REASONS } from "../../lib/analyst-taxonomy.mjs";
+import { ANALYST_REVIEW_REASONS } from "../analysis/analyst-taxonomy.mjs";
 import { CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, PUBLIC_CASE_SCHEMA_VERSION, MAX_CASE_BRAND_PROFILE_ID_CANDIDATES, MAX_CASE_BRAND_PROFILE_IDS, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_CASES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTE_LENGTH, MAX_NOTES_PER_CASE, MAX_TAG_LENGTH, MAX_TAGS_PER_CASE, } from "../contracts/case-portability.mjs";
 import { CASE_DISPOSITIONS, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_STATUS, } from "./case-record-decisions.mjs";
 export { CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, PUBLIC_CASE_SCHEMA_VERSION, MAX_CASE_BRAND_PROFILE_ID_CANDIDATES, MAX_CASE_BRAND_PROFILE_IDS, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_CASES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTE_LENGTH, MAX_NOTES_PER_CASE, MAX_TAG_LENGTH, MAX_TAGS_PER_CASE, };