@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/packages/cases/case-recheck-model.mjs

@@ -1,7 +1,12 @@
-import { isValidAsciiHostname } from "../../lib/hostname.mjs";
-import { INCIDENT_CASE_SCHEMA_VERSION, MAX_RESPONSE_RATIONALE_LENGTH } from "../contracts/case-portability.mjs";
+import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
+import { INCIDENT_CASE_SCHEMA_VERSION, MAX_RESPONSE_RATIONALE_LENGTH, } from "../contracts/case-portability.mjs";
 import { enumeration, exact, text } from "../evidence/artifact-structure.mjs";
-export const CASE_RECHECK_CONDITIONS = Object.freeze({ unknown: 'Not established', comparable: 'Comparable for this question', different: 'Different conditions' });
+import { casePinHasCompleteObservation } from "./case-evidence-quality.mjs";
+export const CASE_RECHECK_CONDITIONS = Object.freeze({
+    unknown: 'Not established',
+    comparable: 'Comparable for this question',
+    different: 'Different conditions',
+});
 function reference(value, label) {
     const id = text(value, label, 64);
     if (!/^[A-Za-z0-9_-]+$/u.test(id))
@@ -16,8 +21,11 @@ function contextFields(item) {
     const conditions = text(item.conditions, 'Recheck comparison conditions', MAX_RESPONSE_RATIONALE_LENGTH);
     if (!conditions.trim())
         throw new TypeError('Describe the conditions needed to compare the observations.');
-    return Object.freeze({ targetHostname, conditions,
-        baselinePinId: item.baselinePinId === null ? null : reference(item.baselinePinId, 'Recheck baseline pin') });
+    return Object.freeze({
+        targetHostname,
+        conditions,
+        baselinePinId: item.baselinePinId === null ? null : reference(item.baselinePinId, 'Recheck baseline pin'),
+    });
 }
 /** Optional current-format context; historical records have no invented question. */
 export function readCaseRecheckContext(value, sourceVersion) {
@@ -36,56 +44,106 @@ export function readCaseRecheckAnswerContext(value, sourceVersion) {
     const question = text(item.question, 'Recheck question', MAX_RESPONSE_RATIONALE_LENGTH);
     if (!question.trim())
         throw new TypeError('A recheck answer requires its original question.');
-    return Object.freeze({ ...contextFields(item), questionId: reference(item.questionId, 'Recheck question ID'),
+    return Object.freeze({
+        ...contextFields(item),
+        questionId: reference(item.questionId, 'Recheck question ID'),
         question,
-        conditionsMatch: enumeration(item.conditionsMatch, Object.keys(CASE_RECHECK_CONDITIONS), 'Recheck condition comparison') });
+        conditionsMatch: enumeration(item.conditionsMatch, Object.keys(CASE_RECHECK_CONDITIONS), 'Recheck condition comparison'),
+    });
 }
 export function caseRecheckQuestions(assertions) {
-    return assertions.filter(item => item.kind === 'next_step' && item.recheck && item.state === 'open');
+    return assertions.filter((item) => item.kind === 'next_step' && item.recheck && item.state === 'open');
 }
 export function caseRecheckAnswerContext(question, conditionsMatch) {
     if (question.kind !== 'next_step' || !question.recheck)
         throw new TypeError('Select a saved recheck question.');
-    return readCaseRecheckAnswerContext({ ...question.recheck, questionId: question.id, question: question.statement, conditionsMatch });
+    return readCaseRecheckAnswerContext({
+        ...question.recheck,
+        questionId: question.id,
+        question: question.statement,
+        conditionsMatch,
+    });
+}
+/** Shared read projection; each form retains its draft and existing save coordinator. */
+export function selectCaseRecheckQuestion(assertions, selection) {
+    const questions = caseRecheckQuestions(assertions);
+    const question = questions.find((item) => item.id === selection.questionId);
+    return {
+        questions,
+        context: question ? caseRecheckAnswerContext(question, selection.conditionsMatch) : undefined,
+        stale: Boolean(selection.questionId) && (!question || question.updatedAt !== selection.questionUpdatedAt),
+    };
 }
 /** A saved answer is a snapshot, not a live reference to an editable plan. */
 export function assertCurrentRecheckQuestion(answer, assertions) {
-    const question = caseRecheckQuestions(assertions).find(item => item.id === answer.questionId);
-    if (!question || JSON.stringify(caseRecheckAnswerContext(question, answer.conditionsMatch)) !== JSON.stringify(answer)) {
+    const question = caseRecheckQuestions(assertions).find((item) => item.id === answer.questionId);
+    if (!question ||
+        JSON.stringify(caseRecheckAnswerContext(question, answer.conditionsMatch)) !==
+            JSON.stringify(answer)) {
         throw new Error('The recheck question changed or was resolved. Refresh and review its current conditions before saving this answer.');
     }
 }
-export function caseRecheckComparisonWarnings(context, pins, current) {
-    const warnings = [];
-    if (context.conditionsMatch !== 'comparable')
-        warnings.push(context.conditionsMatch === 'different'
-            ? 'The comparison conditions differ.' : 'Comparable conditions have not been confirmed.');
-    const baseline = pins.find(pin => pin.id === context.baselinePinId);
+const RECHECK_COMPARISON_MESSAGES = {
+    different_conditions: 'The comparison conditions differ.',
+    unconfirmed_conditions: 'Comparable conditions have not been confirmed.',
+    missing_baseline: 'The baseline evidence is no longer available.',
+    current_target_mismatch: 'The current evidence concerns a different or unknown hostname.',
+    incomplete_current: 'The current source does not establish a complete observation.',
+    later_observation_needed: 'A later source observation is needed; reviewing the baseline again is not a recheck.',
+    baseline_target_mismatch: 'The baseline concerns a different hostname.',
+    different_field_or_source: 'The observations use different fields or sources.',
+};
+/** Admissibility depends on these reasons, not on presentation warnings. */
+export function caseRecheckComparisonBlockers(context, pins, current) {
+    const blockers = [];
+    if (context.conditionsMatch !== 'comparable') {
+        blockers.push(context.conditionsMatch === 'different'
+            ? 'different_conditions'
+            : 'unconfirmed_conditions');
+    }
+    const baseline = pins.find((pin) => pin.id === context.baselinePinId);
     if (context.baselinePinId && !baseline)
-        warnings.push('The baseline evidence is no longer available.');
+        blockers.push('missing_baseline');
     if (current) {
         if (current.observationHostname !== context.targetHostname)
-            warnings.push('The current evidence concerns a different or unknown hostname.');
-        if (current.completeness !== 'complete' || current.truncated || current.sourceState !== 'complete' && current.sourceState !== 'success' && current.sourceState !== 'reviewed' && current.sourceState !== 'not_found')
-            warnings.push('The current source does not establish a complete observation.');
+            blockers.push('current_target_mismatch');
+        if (!casePinHasCompleteObservation(current))
+            blockers.push('incomplete_current');
         if (baseline) {
-            if (baseline.id === current.id || !baseline.observedAt || !current.observedAt || Date.parse(current.observedAt) <= Date.parse(baseline.observedAt))
-                warnings.push('A later source observation is needed; reviewing the baseline again is not a recheck.');
+            const sameObservation = baseline.id === current.id;
+            const unknownObservationTime = !baseline.observedAt || !current.observedAt;
+            const nonLaterObservation = !unknownObservationTime &&
+                Date.parse(current.observedAt) <= Date.parse(baseline.observedAt);
+            if (sameObservation || unknownObservationTime || nonLaterObservation) {
+                blockers.push('later_observation_needed');
+            }
             if (baseline.observationHostname && baseline.observationHostname !== context.targetHostname)
-                warnings.push('The baseline concerns a different hostname.');
-            if (baseline.field && current.field !== baseline.field || baseline.source !== current.source)
-                warnings.push('The observations use different fields or sources.');
+                blockers.push('baseline_target_mismatch');
+            const differentField = Boolean(baseline.field) && current.field !== baseline.field;
+            const differentSource = baseline.source !== current.source;
+            if (differentField || differentSource)
+                blockers.push('different_field_or_source');
         }
     }
-    return warnings;
+    return blockers;
+}
+export function caseRecheckComparisonWarnings(context, pins, current) {
+    return caseRecheckComparisonBlockers(context, pins, current)
+        .map((reason) => RECHECK_COMPARISON_MESSAGES[reason]);
 }
 export function assertRecheckNonReproduction(state, context, completeness, pins, current, observedAt) {
     if (state !== 'not_reproduced')
         return;
-    const warnings = caseRecheckComparisonWarnings(context, pins, current);
-    const baseline = pins.find(pin => pin.id === context.baselinePinId);
-    if (!current && baseline && (!baseline.observedAt || !observedAt || !Number.isFinite(Date.parse(observedAt)) || Date.parse(observedAt) <= Date.parse(baseline.observedAt)))
-        warnings.push('A later independent observation is needed.');
-    if (completeness !== 'complete' || warnings.length)
+    const blockers = caseRecheckComparisonBlockers(context, pins, current);
+    const baseline = pins.find((pin) => pin.id === context.baselinePinId);
+    let laterIndependentObservationNeeded = false;
+    if (!current && baseline) {
+        const missingObservationTime = !baseline.observedAt || !observedAt;
+        const invalidObservationTime = observedAt ? !Number.isFinite(Date.parse(observedAt)) : false;
+        const nonLaterObservation = !missingObservationTime && Date.parse(observedAt) <= Date.parse(baseline.observedAt);
+        laterIndependentObservationNeeded = missingObservationTime || invalidObservationTime || nonLaterObservation;
+    }
+    if (completeness !== 'complete' || blockers.length || laterIndependentObservationNeeded) {
         throw new Error('Not reproduced requires a complete observation under comparable conditions. Record unavailable or describe the limited observation instead.');
+    }
 }

package/packages/cases/case-record-contracts.mjs

@@ -1,4 +1,4 @@
-import { ANALYST_REVIEW_REASONS } from "../../lib/analyst-taxonomy.mjs";
+import { ANALYST_REVIEW_REASONS } from "../analysis/analyst-taxonomy.mjs";
 import { CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, PUBLIC_CASE_SCHEMA_VERSION, MAX_CASE_BRAND_PROFILE_ID_CANDIDATES, MAX_CASE_BRAND_PROFILE_IDS, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_CASES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTE_LENGTH, MAX_NOTES_PER_CASE, MAX_TAG_LENGTH, MAX_TAGS_PER_CASE, } from "../contracts/case-portability.mjs";
 import { CASE_DISPOSITIONS, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_STATUS, } from "./case-record-decisions.mjs";
 export { CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, PUBLIC_CASE_SCHEMA_VERSION, MAX_CASE_BRAND_PROFILE_ID_CANDIDATES, MAX_CASE_BRAND_PROFILE_IDS, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_CASES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTE_LENGTH, MAX_NOTES_PER_CASE, MAX_TAG_LENGTH, MAX_TAGS_PER_CASE, };

package/packages/cases/case-record-core.mjs

@@ -4,7 +4,7 @@ import { CASE_REVIEW_REASONS, CASE_SOURCES, DEFAULT_DISPOSITION, DEFAULT_SOURCE,
 import { dispositionLabel, isValidDisposition, isValidStatus, statusLabel, } from "./case-record-decisions.mjs";
 import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "../evidence/observation.mjs";
 import { PUBLISHED_V2_3_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
-import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
+import { canonicalRegistrableDomain } from "../analysis/registrable-domain.mjs";
 // Forward-version policy (two distinct guarantees):
 //   - A locally-stored envelope that declares a version greater than this is
 //     still read best-effort on load (known fields kept, unknown dropped), but

package/packages/cases/case-record-operations.mjs

@@ -1,12 +1,15 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
-import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
-import { parseCredentialFreeHttpUrl } from "../evidence/lookup-target.mjs";
+import { normalizeCaseObjective, parseIncidentUrlContext, } from "./case-incident-context.mjs";
 import { selectExistingCase } from "./case-selection.mjs";
+import { emptyCaseWorkflowMetadata, updateCaseWorkflowMetadata } from "./case-workflow-metadata.mjs";
+import { readCaseWorkflowFields } from "./case-workflow-migration.mjs";
 import { appendCaseAction, appendCaseAssertion, appendCaseClosure, appendCaseDecision, appendCaseEvidencePin, appendCaseEvidencePins, appendCaseManualTrailEvent, appendCaseObservedEffectReview, appendCaseSighting, buildCaseClosureLinkContext, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseClosureHistory, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseObservedEffectHistory, normalizeCaseSightings, updateCaseAction, updateCaseAssertion, } from "./case-response-model.mjs";
 import { MAX_CASES, MAX_NOTES_PER_CASE, } from "./case-record-contracts.mjs";
-import { PUBLISHED_V2_3_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, MAX_CASE_OBJECTIVE_LENGTH } from "../contracts/case-portability.mjs";
+import { MAX_CASE_OBJECTIVE_LENGTH, MAX_RESPONSE_VALUE_LENGTH } from "../contracts/case-portability.mjs";
+import { caseRecordVersionInput } from "./case-record-version-input.mjs";
 import { readCaseAttachments } from "./case-attachment-model.mjs";
+import { readCaseEvidenceLinks, appendCaseEvidenceLink, withdrawCaseEvidenceLink } from "./case-evidence-links.mjs";
 import { assertCurrentRecheckQuestion, assertRecheckNonReproduction, readCaseRecheckAnswerContext } from "./case-recheck-model.mjs";
 import { caseDispositionSupportsDefensiveResponse, caseStatusIsClosed, caseStatusOptionsForDirectEdit, caseStatusRequiresClosure, isReviewedCaseDisposition, } from "./case-record-decisions.mjs";
 import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, caseTimestampOrNull, deterministicId, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeReviewReasonCode, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.mjs";
@@ -15,84 +18,7 @@ import { normalizeEvidenceHistory, } from "./case-evidence-model.mjs";
 import { appendCaseInvestigationBranch, caseInvestigationBranchReferences, normalizeCaseInvestigationBranches, updateCaseInvestigationBranch, } from "./case-investigation-branch-model.mjs";
 export { caseDispositionSupportsDefensiveResponse, caseStatusIsClosed, caseStatusOptionsForDirectEdit, caseStatusRequiresClosure, isReviewedCaseDisposition, };
 export { MAX_CASE_OBJECTIVE_LENGTH };
-export const MAX_CASE_INCIDENT_URL_LENGTH = 1_850;
-export const INCIDENT_CONTEXT_STATEMENT_PREFIX = 'Investigate incident URL: ';
-const OBJECTIVE_PREFIX = 'Objective: ';
-const RETENTION_SEPARATOR = ' | URL retained: ';
-function boundedContextText(value, maximum) {
-    return typeof value === 'string'
-        ? value.replace(/[\u0000-\u001f\u007f]/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum)
-        : '';
-}
-export function normalizeCaseObjective(value) {
-    return boundedContextText(value, MAX_CASE_OBJECTIVE_LENGTH);
-}
-export function parseIncidentUrlContext(value) {
-    const parsed = parseCredentialFreeHttpUrl(value, MAX_CASE_INCIDENT_URL_LENGTH);
-    if (!parsed)
-        return null;
-    const hostname = parsed.hostname.toLowerCase().replace(/\.$/u, '');
-    const registrableDomain = canonicalRegistrableDomain(hostname);
-    if (!registrableDomain)
-        return null;
-    const exactUrl = parsed.toString();
-    if (exactUrl.length > MAX_CASE_INCIDENT_URL_LENGTH)
-        return null;
-    return Object.freeze({
-        exactUrl,
-        hostname,
-        registrableDomain,
-        originUrl: parsed.origin,
-        hasPath: parsed.pathname !== '/',
-        hasQuery: Boolean(parsed.search),
-        hasFragment: Boolean(parsed.hash),
-    });
-}
-export function caseInvestigationContext(record) {
-    if (!record)
-        return null;
-    for (const assertion of [...record.assertions].reverse()) {
-        if (assertion.kind !== 'next_step' || assertion.state !== 'open'
-            || !assertion.statement.startsWith(INCIDENT_CONTEXT_STATEMENT_PREFIX))
-            continue;
-        const incidentUrl = assertion.statement.slice(INCIDENT_CONTEXT_STATEMENT_PREFIX.length);
-        const parsed = parseIncidentUrlContext(incidentUrl);
-        if (!parsed || parsed.registrableDomain !== record.domain)
-            continue;
-        const rationale = assertion.rationale ?? '';
-        const separatorIndex = rationale.lastIndexOf(RETENTION_SEPARATOR);
-        const objective = separatorIndex > OBJECTIVE_PREFIX.length && rationale.startsWith(OBJECTIVE_PREFIX)
-            ? normalizeCaseObjective(rationale.slice(OBJECTIVE_PREFIX.length, separatorIndex))
-            : '';
-        const retention = separatorIndex >= 0 ? rationale.slice(separatorIndex + RETENTION_SEPARATOR.length) : '';
-        if (!objective || (retention !== 'exact' && retention !== 'origin_only'))
-            continue;
-        return Object.freeze({
-            objective,
-            incidentUrl: parsed.exactUrl,
-            urlRetention: retention,
-            assertionId: assertion.id,
-            updatedAt: assertion.updatedAt,
-        });
-    }
-    return null;
-}
-export function caseInvestigationContextAssertion(input) {
-    const objective = normalizeCaseObjective(input.objective);
-    if (!objective)
-        throw new Error('Enter the investigation objective before retaining Incident context.');
-    const parsed = parseIncidentUrlContext(input.incidentUrl);
-    if (!parsed)
-        throw new Error(`Enter one absolute HTTP(S) Incident URL of at most ${MAX_CASE_INCIDENT_URL_LENGTH} characters without credentials.`);
-    const retention = input.retainExactUrl ? 'exact' : 'origin_only';
-    const retainedUrl = input.retainExactUrl ? parsed.exactUrl : parsed.originUrl;
-    return Object.freeze({
-        statement: `${INCIDENT_CONTEXT_STATEMENT_PREFIX}${retainedUrl}`,
-        rationale: `${OBJECTIVE_PREFIX}${objective}${RETENTION_SEPARATOR}${retention}`,
-        retainedUrl,
-        retention,
-    });
-}
+export * from "./case-incident-context.mjs";
 // ---------------------------------------------------------------------------
 // Case normalization
 // ---------------------------------------------------------------------------
@@ -130,31 +56,29 @@ function normalizeCaseEvidence(record, domain, createdAt, updatedAt, now, source
  */
 export function normalizeCase(raw, existing, nowIso, sourceVersion) {
     const now = caseTimestampOrNull(nowIso) || new Date().toISOString();
-    const record = objectRecord(raw);
-    const domain = normalizeDomain(existing ? existing.domain : record.domain);
+    const input = objectRecord(raw);
+    const domain = normalizeDomain(existing ? existing.domain : input.domain);
     if (!domain)
         return null;
+    const { record, timestampOptions } = caseRecordVersionInput(input, sourceVersion);
     const createdAt = existing ? existing.createdAt : caseTimestampOrNull(record.createdAt, sourceVersion) || now;
     const updatedAt = caseTimestampOrNull(record.updatedAt, sourceVersion) || createdAt;
-    const timestampOptions = {
-        legacyTimestamps: sourceVersion != null && sourceVersion < PUBLISHED_V2_3_CASE_SCHEMA_VERSION,
-        ...(sourceVersion === undefined ? {} : { sourceVersion }),
-    };
     const evidencePins = normalizeCaseEvidencePins(record.evidencePins, updatedAt, timestampOptions);
     const pinIds = new Set(evidencePins.map((item) => item.id));
     const actions = normalizeCaseActions(record.actions, updatedAt, { ...timestampOptions, validEvidencePinIds: pinIds });
     const assertions = normalizeCaseAssertions(record.assertions, updatedAt, pinIds, timestampOptions);
     const sightings = normalizeCaseSightings(record.sightings, updatedAt, pinIds, timestampOptions);
     const sightingIds = new Set(sightings.map((item) => item.id));
-    const observedEffects = normalizeCaseObservedEffectHistory(sourceVersion != null && sourceVersion < 13 ? undefined : record.observedEffects, updatedAt, pinIds, sightingIds, timestampOptions);
-    const closures = normalizeCaseClosureHistory(sourceVersion != null && sourceVersion < 13 ? undefined : record.closures, updatedAt, new Set(observedEffects.reviews.map((item) => item.id)), new Set(actions.map((item) => item.id)), timestampOptions, buildCaseClosureLinkContext(observedEffects, actions));
+    const observedEffects = normalizeCaseObservedEffectHistory(record.observedEffects, updatedAt, pinIds, sightingIds, timestampOptions);
+    const closures = normalizeCaseClosureHistory(record.closures, updatedAt, new Set(observedEffects.reviews.map((item) => item.id)), new Set(actions.map((item) => item.id)), timestampOptions, buildCaseClosureLinkContext(observedEffects, actions));
     const normalizedStatus = normalizeStatus(record.status);
     const branchReferences = caseInvestigationBranchReferences({ evidencePins, actions, assertions });
     const attachments = readCaseAttachments(record.attachments);
+    const evidenceLinks = readCaseEvidenceLinks(record.evidenceLinks);
     return {
         id: existing ? existing.id : safeId(record.id) || deterministicId(domain),
         domain,
-        title: sourceVersion != null && sourceVersion < INCIDENT_CASE_SCHEMA_VERSION ? '' : normalizeCaseObjective(record.title),
+        title: normalizeCaseObjective(record.title),
         status: caseStatusRequiresClosure(normalizedStatus)
             && closures.records.length === 0 && !closures.preV13HistoryUnavailable
             ? 'reviewing'
@@ -162,7 +86,7 @@ export function normalizeCase(raw, existing, nowIso, sourceVersion) {
         disposition: normalizeDisposition(record.disposition),
         reviewReasonCode: normalizeReviewReasonCode(record.reviewReasonCode),
         brandProfileIds: normalizeCaseBrandProfileIds(record.brandProfileIds),
-        tags: normalizeTags(record.tags),
+        ...readCaseWorkflowFields(record, domain, assertions, sourceVersion),
         notes: normalizeNotes(record.notes, now, sourceVersion),
         source: normalizeSource(record.source),
         evidenceHistory: normalizeCaseEvidence(record, domain, createdAt, updatedAt, now, sourceVersion),
@@ -176,6 +100,7 @@ export function normalizeCase(raw, existing, nowIso, sourceVersion) {
         closures,
         branches: normalizeCaseInvestigationBranches(record.branches, updatedAt, branchReferences, timestampOptions),
         ...(attachments === undefined ? {} : { attachments }),
+        ...(evidenceLinks === undefined ? {} : { evidenceLinks }),
         createdAt,
         updatedAt,
     };
@@ -232,6 +157,7 @@ export function createCase(input, nowIso) {
         reviewReasonCode: normalizeReviewReasonCode(input.reviewReasonCode),
         brandProfileIds: input.brandProfileIds === undefined ? [] : assertCaseBrandProfileIds(input.brandProfileIds),
         tags: normalizeTags(input.tags),
+        workflowMetadata: updateCaseWorkflowMetadata(emptyCaseWorkflowMetadata(), input, domain, now),
         notes: noteBody ? [{ id: makeId(), body: noteBody, createdAt: now }] : [],
         source,
         evidenceHistory: normalizeEvidenceHistory(input.evidence ? [input.evidence] : [], {
@@ -243,6 +169,7 @@ export function createCase(input, nowIso) {
         decisions: input.decision !== undefined
             ? appendCaseDecision([], input.decision, now)
             : [],
+        ...(input.evidenceLink === undefined ? {} : { evidenceLinks: appendCaseEvidenceLink([], input.evidenceLink, evidencePins, now) }),
         actions,
         assertions,
         manualTrail: input.trailEvent !== undefined
@@ -319,9 +246,21 @@ export function updateCase(cases, id, patch, nowIso) {
     const current = cases[index];
     if (!current)
         throw new Error('That case no longer exists.');
+    if (patch.evidenceLink !== undefined && patch.evidenceLinkWithdrawal !== undefined)
+        throw new TypeError('Record or withdraw one evidence relationship at a time.');
     if (patch.title !== undefined && patch.expectedTitle !== undefined && patch.expectedTitle !== (current.title ?? '')) {
         throw new Error('The incident title changed after this draft was started. Reload and review the current title before saving; your draft has not been applied.');
     }
+    for (const [value, expected, actual, label] of [
+        [patch.status, patch.expectedStatus, current.status, 'status'],
+        [patch.disposition, patch.expectedDisposition, current.disposition, 'disposition'],
+        [patch.reviewReasonCode, patch.expectedReviewReasonCode, current.reviewReasonCode ?? null, 'review reason'],
+        [patch.tags, patch.expectedTags, current.tags, 'tags'],
+    ]) {
+        if (value !== undefined && expected !== undefined && JSON.stringify(expected) !== JSON.stringify(actual)) {
+            throw new Error(`The Case ${label} changed after this edit was started. Reopen the Case to review the current value; your edit has not been applied.`);
+        }
+    }
     let notes = current.notes;
     if (patch.note !== undefined) {
         const body = normalizeNoteBody(patch.note);
@@ -398,6 +337,8 @@ export function updateCase(cases, id, patch, nowIso) {
     }
     const record = {
         ...current,
+        workflowMetadata: updateCaseWorkflowMetadata(current.workflowMetadata
+            ?? readCaseWorkflowFields(current, current.domain, current.assertions).workflowMetadata, patch, current.domain, now),
         title: patch.title === undefined ? current.title ?? '' : normalizeCaseObjective(patch.title),
         status: patch.closure !== undefined
             ? 'resolved'
@@ -413,6 +354,11 @@ export function updateCase(cases, id, patch, nowIso) {
         source,
         evidenceHistory,
         evidencePins,
+        ...((patch.evidenceLink !== undefined || patch.evidenceLinkWithdrawal !== undefined) ? {
+            evidenceLinks: patch.evidenceLink !== undefined
+                ? appendCaseEvidenceLink(current.evidenceLinks ?? [], patch.evidenceLink, evidencePins, now)
+                : withdrawCaseEvidenceLink(current.evidenceLinks ?? [], patch.evidenceLinkWithdrawal, now),
+        } : {}),
         decisions,
         actions,
         assertions,
@@ -537,26 +483,7 @@ export function recordCaseInvestigationContext(cases, id, input, nowIso) {
     if (!parsed || parsed.registrableDomain !== current.domain) {
         throw new Error(`The Incident URL must belong to the Case domain ${current.domain}.`);
     }
-    const context = caseInvestigationContextAssertion(input);
-    const existing = caseInvestigationContext(current);
-    return updateCase(cases, id, existing
-        ? {
-            assertionUpdate: {
-                id: existing.assertionId,
-                statement: context.statement,
-                rationale: context.rationale,
-                state: 'open',
-            },
-        }
-        : {
-            assertion: {
-                kind: 'next_step',
-                statement: context.statement,
-                rationale: context.rationale,
-                evidenceRelations: [],
-                state: 'open',
-            },
-        }, nowIso);
+    return updateCase(cases, id, { investigationContext: input }, nowIso);
 }
 export function recordCaseRecheckOutcome(cases, id, input, nowIso) {
     const now = caseTimestampOrNull(nowIso) || new Date().toISOString();
@@ -578,7 +505,8 @@ export function recordCaseRecheckOutcome(cases, id, input, nowIso) {
             collectionDepth: input.collectionDepth,
             observationHostname: input.observationHostname,
             completeness: input.completeness,
-            truncated: false,
+            truncated: input.comparisonTruncated === true
+                || (typeof input.comparisonSummary === 'string' && input.comparisonSummary.length > MAX_RESPONSE_VALUE_LENGTH),
             limitations: input.limitations,
         },
     }, now);

package/packages/cases/case-record-projection.mjs

@@ -1,4 +1,4 @@
-import { PUBLIC_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { PUBLIC_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
 import { caseStatusIsClosed } from "./case-record-decisions.mjs";
 const PRESERVE = Object.freeze({
     durable: 'preserve', internal: 'preserve', trusted: 'preserve', public: 'preserve',
@@ -86,6 +86,12 @@ const CASE_FIELD_RULES = Object.freeze({
         audienceExclusions: { public: { label: 'Brand Profile references', order: 2 } },
     }),
     tags: fieldRule('tags', PRESERVE, (record) => [...record.tags]),
+    workflowMetadata: fieldRule('workflowMetadata', PUBLIC_REDACT, (record, profile) => (record.workflowMetadata === undefined ? undefined : profile === 'public'
+        ? { types: [...record.workflowMetadata.types], incidentTargets: [], investigationContext: null }
+        : structuredClone(record.workflowMetadata)), {
+        nestedSensitiveFields: ['incidentTargets', 'investigationContext'],
+        audienceExclusions: { public: { label: 'Private incident links and investigation context', order: 4, sinceVersion: EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION } },
+    }),
     notes: fieldRule('notes', SHARED_EXCLUDE, (record, profile) => (profile === 'trusted' || profile === 'public'
         ? []
         : record.notes.map((item) => ({ ...item }))), {
@@ -97,6 +103,7 @@ const CASE_FIELD_RULES = Object.freeze({
     source: preservedField('source'),
     evidenceHistory: fieldRule('evidenceHistory', PRESERVE, (record) => structuredClone(record.evidenceHistory)),
     evidencePins: fieldRule('evidencePins', PRESERVE, (record) => structuredClone(record.evidencePins)),
+    evidenceLinks: fieldRule('evidenceLinks', PUBLIC_EXCLUDE, (record, profile) => (profile === 'public' ? undefined : structuredClone(record.evidenceLinks)), { audienceExclusions: { public: { label: 'Analyst evidence relationships', order: 4, sinceVersion: EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION } } }),
     decisions: fieldRule('decisions', PRESERVE, (record) => structuredClone(record.decisions)),
     actions: fieldRule('actions', TRUSTED_REDACT_PUBLIC_EXCLUDE, (record, profile) => (profile === 'public'
         ? []

package/packages/cases/case-record-version-input.mjs

@@ -0,0 +1,19 @@
+import { EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, PUBLISHED_V2_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION, } from "../contracts/case-portability.mjs";
+/** Adapt declared historical fields before ordinary current-record recovery. */
+export function caseRecordVersionInput(record, sourceVersion) {
+    const declared = sourceVersion != null;
+    if (record.evidenceLinks !== undefined && declared && sourceVersion < EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION) {
+        throw new TypeError('Evidence relationships require the current Case schema.');
+    }
+    return {
+        record: declared && sourceVersion < INCIDENT_CASE_SCHEMA_VERSION ? {
+            ...record,
+            ...(sourceVersion < PUBLISHED_V2_CASE_SCHEMA_VERSION ? { observedEffects: undefined, closures: undefined } : {}),
+            title: '',
+        } : record,
+        timestampOptions: {
+            legacyTimestamps: declared && sourceVersion < PUBLISHED_V2_3_CASE_SCHEMA_VERSION,
+            ...(sourceVersion === undefined ? {} : { sourceVersion }),
+        },
+    };
+}