@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/packages/cases/case-report.mjs

@@ -8,14 +8,18 @@
 // contains raw RDAP/WHOIS material. This module deliberately excludes all raw
 // registry/web responses, contacts, cookies, screenshots, and authentication
 // data. Reports contain only the normalized case record.
-import { caseEvidenceTimeline, compareCaseEvidence, currentCaseEvidence } from "./case-model.mjs";
+import { caseEvidenceTimeline, compareCaseEvidence, currentCaseEvidence, publishedCaseEvidenceTimelineForVerification } from "./case-evidence-model.mjs";
 import { httpSecurityHeaderLabel } from "./http-summary.mjs";
-import { analystInteroperabilityTags } from "../../lib/analyst-taxonomy.mjs";
-import { buildPortableGeneratorMetadata, portableGeneratorAttribution, } from "../../lib/portable-generator.mjs";
+import { webCollectionScoreLimitation } from "../evidence/collection-quality.mjs";
+import { analystInteroperabilityTags } from "../analysis/analyst-taxonomy.mjs";
+import { caseEvidenceLinkIssues } from "./case-evidence-links.mjs";
+import { caseTypeSummary } from "./case-workflow-metadata.mjs";
+import { buildPortableGeneratorMetadata, portableGeneratorAttribution, } from "../analysis/portable-generator.mjs";
 import { buildCaseResponseLifecycleSummary, CASE_EVIDENCE_RELATION_STANCES } from "./case-response-model.mjs";
 import { normalizeCaseBrandProfileIds } from "./case-brand-profile-references.mjs";
 import { CASE_RECHECK_CONDITIONS } from "./case-recheck-model.mjs";
-import { CASE_REPORT_SCHEMA, CASE_REPORT_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_REPORT_SCHEMA_VERSION, } from "../contracts/case-portability.mjs";
+import { escapeCaseMarkdownInline as escapeMarkdownInline } from "./case-markdown.mjs";
+import { CASE_REPORT_SCHEMA, CASE_REPORT_SCHEMA_VERSION, LATEST_PUBLIC_CASE_REPORT_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_REPORT_SCHEMA_VERSION, } from "../contracts/case-portability.mjs";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -35,16 +39,6 @@ const LIMITATIONS_TEXT = [
     'Snapshot hostnames are excluded; supporting DNS, TLS and web observations need not concern the Case registration domain.',
     ...PUBLISHED_V2_3_LIMITATIONS.slice(2),
 ].join(' ');
-function escapeMarkdownInline(text) {
-    return String(text)
-        .replace(/[\r\n\u2028\u2029]+/g, ' ')
-        .replace(/([\\`*_{}\[\]<>()#+!|~])/g, '\\$1')
-        // GFM autolinks bare URLs independently of ordinary link syntax. Break
-        // the scheme or the first `www.` separator without making normal domains,
-        // dates, and prose noisy in the report source.
-        .replace(/\b([a-z][a-z0-9+.-]{1,31}):(?=\/\/)/gi, '$1\\:')
-        .replace(/\bwww\.(?=\S)/gi, 'www\\.');
-}
 /**
  * Escapes a multiline note body for safe inclusion in a Markdown blockquote.
  * Each line is individually escaped and prefixed with `> `.
@@ -90,6 +84,12 @@ function formatReportValue(value, field) {
         return String(value);
     return String(value);
 }
+function readableRiskScore(snapshot) {
+    const value = escapeMarkdownInline(formatReportValue(snapshot.riskScore));
+    const limitation = snapshot.riskScore === null ? null
+        : webCollectionScoreLimitation(snapshot.webCollectionQuality, snapshot.scanDepth);
+    return limitation ? `${value} — ${escapeMarkdownInline(limitation)}` : value;
+}
 /**
  * Returns a shallow clone of a snapshot containing only known schema fields.
  * Unknown/imported keys are never included.
@@ -111,6 +111,7 @@ function pickKnownSnapshotFields(snapshot) {
         capturedAt: snapshot.capturedAt,
         source: snapshot.source,
         scanDepth: snapshot.scanDepth,
+        ...(snapshot.webCollectionQuality ? { webCollectionQuality: { ...snapshot.webCollectionQuality } } : {}),
         availability: snapshot.availability,
         confidence: snapshot.confidence,
         riskModelVersion: snapshot.riskModelVersion,
@@ -173,14 +174,7 @@ export function buildCaseReport(caseRecord, options = {}) {
     const generator = buildPortableGeneratorMetadata(options.applicationVersion);
     // --- Build JSON report ---
     const timeline = caseEvidenceTimeline(caseRecord.evidenceHistory);
-    const timelineEntries = timeline.map((entry) => ({
-        snapshot: pickKnownSnapshotFields(entry.snapshot),
-        isBaseline: entry.isBaseline,
-        hasRepeatedObservation: entry.hasRepeatedObservation,
-        changes: entry.changes?.map(({ field, label, before, after, tone }) => ({ field, label, before, after, tone })) ?? null,
-        hasIncomparableChange: entry.hasIncomparableChange,
-        incomparableReasons: [...entry.incomparableReasons],
-    }));
+    const timelineEntries = projectReportTimeline(timeline);
     const selection = currentCaseEvidence(caseRecord);
     const latest = selection.snapshot;
     const currentAssessment = latest ? pickKnownSnapshotFields(latest) : null;
@@ -221,7 +215,9 @@ export function buildCaseReport(caseRecord, options = {}) {
         currentAssessment,
         evidenceTimeline: timelineEntries,
         analystResponse: {
+            ...(caseRecord.workflowMetadata === undefined ? {} : { workflowMetadata: structuredClone(caseRecord.workflowMetadata) }),
             evidencePins: caseRecord.evidencePins.map((item) => ({ ...item, limitations: [...item.limitations] })),
+            ...(caseRecord.evidenceLinks === undefined ? {} : { evidenceLinks: structuredClone(caseRecord.evidenceLinks) }),
             decisions: caseRecord.decisions.map((item) => ({ ...item, evidencePinIds: [...item.evidencePinIds] })),
             actions: caseRecord.actions.map((item) => ({
                 ...item,
@@ -270,11 +266,25 @@ export function buildCaseReport(caseRecord, options = {}) {
     const md = buildMarkdown(json, options.includeAttribution !== false);
     return { json, markdown: md };
 }
+function projectReportTimeline(timeline) {
+    return timeline.map(entry => ({
+        snapshot: pickKnownSnapshotFields(entry.snapshot), isBaseline: entry.isBaseline,
+        hasRepeatedObservation: entry.hasRepeatedObservation,
+        changes: entry.changes?.map(({ field, label, before, after, tone }) => ({ field, label, before, after, tone })) ?? null,
+        hasIncomparableChange: entry.hasIncomparableChange, incomparableReasons: [...entry.incomparableReasons],
+    }));
+}
 /** Expected strict reader projection; historical disclosure wording is immutable. */
 export function buildCaseReportVerificationProjection(caseRecord, options, schemaVersion) {
-    const current = buildCaseReport(caseRecord, options).json;
+    const generated = buildCaseReport(caseRecord, options).json;
     if (schemaVersion === CASE_REPORT_SCHEMA_VERSION)
-        return current;
+        return generated;
+    if (caseRecord.evidenceHistory.some(snapshot => snapshot.webCollectionQuality !== undefined)) {
+        throw new TypeError('Published report formats cannot declare newer collection-quality fields.');
+    }
+    const current = { ...generated, evidenceTimeline: projectReportTimeline(publishedCaseEvidenceTimelineForVerification(caseRecord.evidenceHistory)) };
+    if (schemaVersion === LATEST_PUBLIC_CASE_REPORT_SCHEMA_VERSION)
+        return { ...current, schemaVersion };
     if (schemaVersion !== PUBLISHED_V2_3_CASE_REPORT_SCHEMA_VERSION) {
         throw new TypeError('No strict Case report projection is defined for this version.');
     }
@@ -325,6 +335,17 @@ function buildMarkdown(report, includeAttribution) {
     if (report.case.tags.length > 0) {
         lines.push(`| Tags | ${escapeMarkdownInline(report.case.tags.join(', '))} |`);
     }
+    const caseTypes = caseTypeSummary(report.analystResponse.workflowMetadata ? { workflowMetadata: report.analystResponse.workflowMetadata } : {});
+    if (caseTypes)
+        lines.push(`| Case types | ${escapeMarkdownInline(caseTypes)} |`);
+    const context = report.analystResponse.workflowMetadata?.investigationContext;
+    if (context) {
+        lines.push(`| Investigation objective | ${escapeMarkdownInline(context.objective)} |`);
+        lines.push(`| Incident URL (${context.urlRetention === 'exact' ? 'exact' : 'origin only'}) | ${escapeMarkdownInline(context.incidentUrl)} |`);
+    }
+    for (const target of report.analystResponse.workflowMetadata?.incidentTargets ?? []) {
+        lines.push(`| Incident link (${target.state}) | ${escapeMarkdownInline(target.url)} |`);
+    }
     lines.push(`| Notes included | ${report.case.notesIncluded ? 'Yes' : 'No'} |`);
     lines.push('');
     // Current assessment
@@ -333,7 +354,7 @@ function buildMarkdown(report, includeAttribution) {
     if (report.currentAssessment) {
         const a = report.currentAssessment;
         lines.push(`- **Availability:** ${escapeMarkdownInline(formatReportValue(a.availability))}`);
-        lines.push(`- **Risk score:** ${escapeMarkdownInline(formatReportValue(a.riskScore))}`);
+        lines.push(`- **Risk score:** ${readableRiskScore(a)}`);
         lines.push(`- **Risk model:** ${a.riskModelVersion === null ? 'Unversioned' : `v${escapeMarkdownInline(formatReportValue(a.riskModelVersion))}`}`);
         lines.push(`- **Brand Profile context:** ${escapeMarkdownInline(formatReportValue(a.profileContextState))}`);
         if (a.profileContextLimitation)
@@ -388,7 +409,7 @@ function buildMarkdown(report, includeAttribution) {
             lines.push('**Key evidence:**');
             lines.push('');
             lines.push(`- Availability: ${escapeMarkdownInline(formatReportValue(snap.availability))}`);
-            lines.push(`- Risk score: ${escapeMarkdownInline(formatReportValue(snap.riskScore))}`);
+            lines.push(`- Risk score: ${readableRiskScore(snap)}`);
             lines.push(`- Risk model: ${snap.riskModelVersion === null ? 'Unversioned' : `v${escapeMarkdownInline(formatReportValue(snap.riskModelVersion))}`}`);
             lines.push(`- Brand Profile context: ${escapeMarkdownInline(formatReportValue(snap.profileContextState))}`);
             if (snap.profileContextLimitation)
@@ -455,6 +476,8 @@ function buildMarkdown(report, includeAttribution) {
                     lines.push('> Opportunity scores and factors use different or unversioned models, so their numeric difference is not treated as a domain change.');
                 if (reasons.includes('scan-depth'))
                     lines.push('> Capture depths differ, so unevaluated deep signals are not treated as additions or removals.');
+                if (reasons.includes('collection-quality'))
+                    lines.push('> Missing or incomplete observations prevent comparison of affected registration, page, favicon or score fields.');
                 if (reasons.length === 0 || reasons.includes('other'))
                     lines.push('> The observations differ materially, but no reliable field-level comparison is available.');
                 lines.push('');
@@ -464,7 +487,7 @@ function buildMarkdown(report, includeAttribution) {
     lines.push('## Analyst Decision Packet');
     lines.push('');
     const response = report.analystResponse;
-    if (!response.evidencePins.length && !response.sightings.length && !response.decisions.length && !response.actions.length && !response.assertions.length && !response.manualTrail.length && !response.observedEffects.reviews.length && !response.closures.records.length && !response.branches.length) {
+    if (!response.evidencePins.length && !response.evidenceLinks?.length && !response.sightings.length && !response.decisions.length && !response.actions.length && !response.assertions.length && !response.manualTrail.length && !response.observedEffects.reviews.length && !response.closures.records.length && !response.branches.length) {
         lines.push('No evidence pins, source-qualified sightings, structured assertions, decision records, response actions, independent effect reviews, closures, or manual investigation steps recorded.');
         lines.push('');
     }
@@ -539,6 +562,12 @@ function buildMarkdown(report, includeAttribution) {
             }
             lines.push('');
         }
+        if (response.evidenceLinks?.length) {
+            lines.push('### Analyst-declared evidence relationships', '');
+            for (const { link, missingPinIds, cyclic } of caseEvidenceLinkIssues(response.evidenceLinks, response.evidencePins))
+                lines.push(`- ${escapeMarkdownInline(link.fromPinId)} ${link.kind === 'derived_from' ? 'derived from' : 'shares a source with'} ${escapeMarkdownInline(link.toPinId)} · recorded ${link.createdAt}`, `  Basis: ${escapeMarkdownInline(link.basis)}`, ...(link.withdrawal ? [`  Withdrawn ${link.withdrawal.at}: ${escapeMarkdownInline(link.withdrawal.reason)}`] : []), ...(missingPinIds.length ? [`  Referenced pins not retained: ${missingPinIds.map(escapeMarkdownInline).join(', ')}`] : []), ...(cyclic ? ['  Conflicting imported derivation cycle; no order is inferred.'] : []));
+            lines.push('These relationships record analyst attribution, not independent corroboration or added confidence.', '');
+        }
         lines.push('### Decisions');
         lines.push('');
         if (!response.decisions.length)
@@ -564,6 +593,13 @@ function buildMarkdown(report, includeAttribution) {
                 lines.push(`  Route review due: ${escapeMarkdownInline(action.routeReviewAfter)}`);
             if (action.originActionId)
                 lines.push(`  Originating action: ${escapeMarkdownInline(action.originActionId)}`);
+            if (action.amendment)
+                lines.push(`  Amendment of submitted packet SHA-256: ${action.amendment.packetDigestSha256}; request events: ${action.amendment.requestEventIds.map(escapeMarkdownInline).join(', ')}`);
+            for (const event of action.history)
+                if (event.evidenceRequest) {
+                    const request = event.evidenceRequest;
+                    lines.push(`  Requested evidence [${request.state}]: ${escapeMarkdownInline(request.summary)}; deadline: ${request.dueAt ?? 'not stated'}; original packet: ${request.packetDigestSha256}${event.applied ? '' : ' (retained conflict)'}`, `  Prepared pins: ${request.evidencePinIds.map(escapeMarkdownInline).join(', ') || 'none'}${request.rationale ? `; ${escapeMarkdownInline(request.rationale)}` : ''}`);
+                }
             if (action.dueAt)
                 lines.push(`  Due: ${escapeMarkdownInline(action.dueAt)}`);
             if (action.followUpAt)

package/packages/cases/case-requested-evidence.mjs

@@ -0,0 +1,146 @@
+import { array, enumeration, exact, HEX_DIGEST_RE, iso, text } from "../evidence/artifact-structure.mjs";
+import { assertWorkspaceInputGraph } from "../workspace/hostile-input.mjs";
+import { MAX_DECISION_PIN_REFERENCES, MAX_RESPONSE_RATIONALE_LENGTH, MAX_RESPONSE_VALUE_LENGTH } from "../contracts/case-portability.mjs";
+import { SAFE_ID_RE } from "./case-response-values.mjs";
+function identifier(value, label) {
+    const result = text(value, label, 64);
+    if (!SAFE_ID_RE.test(result))
+        throw new TypeError(`${label} is invalid.`);
+    return result;
+}
+function identifiers(value, label) {
+    const result = array(value, label, MAX_DECISION_PIN_REFERENCES).map(item => identifier(item, label));
+    if (new Set(result).size !== result.length)
+        throw new TypeError(`${label} contains duplicate identities.`);
+    return result;
+}
+function packetDigest(value) {
+    if (typeof value !== 'string' || !HEX_DIGEST_RE.test(value))
+        throw new TypeError('Select a recorded submitted-packet digest.');
+    return value;
+}
+export function readCaseEvidenceRequest(raw) {
+    if (raw === undefined)
+        return undefined;
+    assertWorkspaceInputGraph(raw, 'Requested evidence');
+    const row = exact(raw, ['id', 'packetDigestSha256', 'summary', 'dueAt', 'state', 'evidencePinIds', 'rationale', 'previousEventIds'], 'Requested evidence');
+    iso(row.dueAt, 'Requested evidence deadline', true);
+    const summary = text(row.summary, 'Requested evidence summary', MAX_RESPONSE_VALUE_LENGTH).trim();
+    const rationale = text(row.rationale, 'Requested evidence rationale', MAX_RESPONSE_RATIONALE_LENGTH, true).trim();
+    const state = enumeration(row.state, ['requested', 'prepared', 'unavailable'], 'Requested evidence state');
+    const evidencePinIds = identifiers(row.evidencePinIds, 'Requested evidence pins');
+    if (!summary || (state === 'prepared' && !evidencePinIds.length) || (state === 'unavailable' && !rationale)) {
+        throw new TypeError('Prepared evidence needs retained pins; unavailable evidence needs an explanation.');
+    }
+    return { id: identifier(row.id, 'Evidence request identity'), packetDigestSha256: packetDigest(row.packetDigestSha256),
+        summary, dueAt: row.dueAt, state, evidencePinIds, rationale,
+        previousEventIds: identifiers(row.previousEventIds, 'Prior evidence request events') };
+}
+export function readCasePacketAmendment(raw) {
+    if (raw === undefined)
+        return undefined;
+    assertWorkspaceInputGraph(raw, 'Packet amendment');
+    const row = exact(raw, ['packetDigestSha256', 'requestEventIds'], 'Packet amendment');
+    const requestEventIds = identifiers(row.requestEventIds, 'Amendment request events');
+    if (!requestEventIds.length)
+        throw new TypeError('Select at least one prepared evidence request.');
+    return { packetDigestSha256: packetDigest(row.packetDigestSha256), requestEventIds };
+}
+export function assertEvidenceRequestEvent(request, event) {
+    if (request && (event.nextState !== 'acknowledged' || !['submitted', 'acknowledged'].includes(String(event.previousState))
+        || (request.state === 'requested'
+            ? event.sourceClass !== 'provider' || event.providerOutcome !== 'more_information_requested' || request.evidencePinIds.length > 0 || Boolean(request.rationale) || request.previousEventIds.length > 0
+            : event.sourceClass !== 'analyst' || request.previousEventIds.length === 0)))
+        throw new TypeError('Requested evidence has incompatible event provenance.');
+}
+/** A digest belongs to the explicit delivery event, never the latest mutable reference. */
+export function submittedPacketReceipts(action) {
+    return action.history.flatMap(event => {
+        const match = /^response-packet-sha256:([a-f0-9]{64})$/u.exec(event.reference ?? '');
+        return event.applied && event.previousState === 'authorised' && event.nextState === 'submitted'
+            && event.sourceClass === 'analyst' && match
+            ? [{ eventId: event.id, digestSha256: match[1], occurredAt: event.occurredAt }] : [];
+    });
+}
+export function latestEvidenceRequests(action) {
+    const events = action.history.filter((event) => event.applied && Boolean(event.evidenceRequest));
+    const replaced = new Set(events.flatMap(event => event.evidenceRequest.previousEventIds
+        .filter(id => events.some(parent => parent.id === id && parent.evidenceRequest.id === event.evidenceRequest.id))));
+    return events.filter(event => !replaced.has(event.id));
+}
+/** Causal links order same-time reviews and retain concurrent branches for explicit reconciliation. */
+export function assertEvidenceRequestHistory(events, missingHistory) {
+    const byId = new Map(events.map(event => [event.id, event]));
+    const complete = new Set(), visiting = new Set();
+    const visit = (id) => {
+        if (complete.has(id))
+            return;
+        if (visiting.has(id))
+            throw new TypeError('Requested evidence history contains a cycle.');
+        visiting.add(id);
+        const request = byId.get(id)?.evidenceRequest;
+        for (const parentId of request?.previousEventIds ?? []) {
+            const parent = byId.get(parentId);
+            if (!parent && missingHistory)
+                continue;
+            if (!parent?.evidenceRequest || parent.evidenceRequest.id !== request.id
+                || parent.evidenceRequest.summary !== request.summary || parent.evidenceRequest.dueAt !== request.dueAt
+                || parent.evidenceRequest.packetDigestSha256 !== request.packetDigestSha256)
+                throw new TypeError('Requested evidence history does not preserve its original request.');
+            visit(parentId);
+        }
+        visiting.delete(id);
+        complete.add(id);
+    };
+    for (const event of events)
+        visit(event.id);
+}
+export function assertEvidenceRequestTransition(action, request, sourceClass, providerOutcome, validPinIds) {
+    if (!['submitted', 'acknowledged'].includes(action.state)
+        || !submittedPacketReceipts(action).some(receipt => receipt.digestSha256 === request.packetDigestSha256)) {
+        throw new Error('Requested evidence must refer to an explicitly recorded packet delivery on an open action.');
+    }
+    const previousEvents = latestEvidenceRequests(action).filter(event => event.evidenceRequest.id === request.id);
+    if (!previousEvents.length) {
+        if (request.state !== 'requested' || sourceClass !== 'provider' || providerOutcome !== 'more_information_requested'
+            || request.evidencePinIds.length || request.rationale || request.previousEventIds.length)
+            throw new Error('A new evidence request must record the provider request before preparation.');
+    }
+    else if (sourceClass !== 'analyst' || request.state === 'requested'
+        || previousEvents.some(({ evidenceRequest: previous }) => request.summary !== previous.summary
+            || request.dueAt !== previous.dueAt || request.packetDigestSha256 !== previous.packetDigestSha256)) {
+        throw new Error('Keep the original provider request unchanged; append a separate request for changed requirements.');
+    }
+    if (JSON.stringify(request.previousEventIds.slice().sort()) !== JSON.stringify(previousEvents.map(event => event.id).sort())) {
+        throw new Error('The evidence preparation changed. Review all current request events before saving.');
+    }
+    if (validPinIds && request.evidencePinIds.some(id => !validPinIds.has(id)))
+        throw new Error('Requested evidence refers to a pin no longer retained in this Case.');
+}
+export function assertPacketAmendment(actions, originActionId, amendment) {
+    const original = actions.find(action => action.id === originActionId);
+    if (!original || !submittedPacketReceipts(original).some(receipt => receipt.digestSha256 === amendment.packetDigestSha256)) {
+        throw new Error('An amendment requires the exact recorded packet delivery from its originating action.');
+    }
+    const latest = latestEvidenceRequests(original);
+    if (amendment.requestEventIds.some(id => !latest.some(event => event.id === id
+        && latest.filter(other => other.evidenceRequest.id === event.evidenceRequest.id).length === 1
+        && event.evidenceRequest.state === 'prepared' && event.evidenceRequest.packetDigestSha256 === amendment.packetDigestSha256))) {
+        throw new Error('Review the current prepared evidence requests before creating or submitting an amendment.');
+    }
+}
+export function assertPacketAmendmentSelection(actions, selectedActionId, selectedPinIds) {
+    const action = actions.find(item => item.id === selectedActionId);
+    if (!action?.amendment)
+        return;
+    assertPacketAmendment(actions, action.originActionId, action.amendment);
+    const original = actions.find(item => item.id === action.originActionId);
+    const required = latestEvidenceRequests(original).filter(event => action.amendment.requestEventIds.includes(event.id))
+        .flatMap(event => event.evidenceRequest.evidencePinIds);
+    if (required.some(id => !selectedPinIds.has(id)))
+        throw new TypeError('Select every prepared request pin for this amendment; the original packet is not regenerated.');
+}
+export function evidenceRequestDelivery(actions, actionId, eventId) {
+    return actions.flatMap(action => action.originActionId === actionId && action.amendment?.requestEventIds.includes(eventId)
+        ? submittedPacketReceipts(action).map(receipt => ({ actionId: action.id, ...receipt })) : []);
+}

package/packages/cases/case-response-actions.mjs

@@ -1,9 +1,76 @@
 // Append-only response actions: transitions, reconciliation and bounded history.
+import { readCaseEvidenceRequest, readCasePacketAmendment, assertEvidenceRequestEvent, assertEvidenceRequestHistory, assertEvidenceRequestTransition, assertPacketAmendment } from "./case-requested-evidence.mjs";
+import { MAX_INTAKE_LINKS, MAX_MESSAGE_PARTS } from "../contracts/message-intake.mjs";
+import { emailRecipient } from "../evidence/email-recipient.mjs";
+import { responseRouteFreshness } from "./response-route-freshness.mjs";
 import { CASE_SCHEMA_VERSION, MAX_CASE_ACTIONS, MAX_CASE_ACTION_BYTES, MAX_CASE_ACTION_EVENTS_PER_ACTION, MAX_CASE_ACTION_EVENTS_PER_CASE, MAX_CASE_ACTION_HISTORY_BYTES_PER_CASE, MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_RATIONALE_LENGTH, MAX_RESPONSE_RECIPIENT_LENGTH, MAX_RESPONSE_REFERENCE_LENGTH, } from "../contracts/case-portability.mjs";
 import { normalizeExplicitIsoTimestamp, } from "../evidence/observation.mjs";
 import { CASE_ACTION_EVENT_SOURCE_CLASSES, CASE_ACTION_STATES, CASE_ACTION_TYPES, CASE_PROVIDER_OUTCOMES, } from "./case-response-records.mjs";
 import { SAFE_ID_RE, boundedCounter, compareCodeUnits, deterministicId, freshId, iso, lifecycleLimitations, limitations, optionalIso, record, safeId, text, } from "./case-response-values.mjs";
 const ACTION_TYPES = new Set(CASE_ACTION_TYPES);
+/** Advisory page-memory comparison; neither authenticated identity nor a mutation. */
+export function compareCaseIncomingNotice(action, report, input) {
+    const bounded = (value, maximum) => {
+        if (value === undefined)
+            return '';
+        if (value.length > maximum || /[\u0000-\u001f\u007f]/u.test(value))
+            throw new TypeError('Notice comparison fields must be bounded single-line values.');
+        return value.trim();
+    };
+    const reference = bounded(input.reference, MAX_RESPONSE_REFERENCE_LENGTH);
+    const organisation = bounded(input.claimedOrganisation, MAX_RESPONSE_LABEL_LENGTH);
+    const recipient = emailRecipient(action?.recipient);
+    let recipientHostname = recipient ? recipient.slice(recipient.lastIndexOf('@') + 1).toLowerCase() : null;
+    if (!recipientHostname && action) {
+        try {
+            const url = new URL(action.recipient);
+            if (['https:', 'http:'].includes(url.protocol) && !url.username && !url.password)
+                recipientHostname = url.hostname;
+        }
+        catch { /* A free-text recipient does not establish a route hostname. */ }
+    }
+    const comparisons = [];
+    let senderDomains = 0, omittedSenderDomains = 0;
+    for (const identity of report.identities) {
+        if (identity.role !== 'from' && identity.role !== 'reply_to')
+            continue;
+        if (senderDomains >= MAX_MESSAGE_PARTS * 5) {
+            omittedSenderDomains += 1;
+            continue;
+        }
+        senderDomains += 1;
+        comparisons.push({
+            label: `Part ${identity.part} ${identity.role.replaceAll('_', ' ')} domain: ${identity.domain}`,
+            state: recipientHostname ? identity.domain.toLowerCase() === recipientHostname ? 'match' : 'mismatch' : 'unknown',
+            explanation: 'Compared only with the selected action recipient hostname. Domain agreement does not authenticate the sender; different domains may require independent clarification.',
+        });
+    }
+    if (!senderDomains)
+        comparisons.push({ label: 'Sender domains', state: 'unknown', explanation: 'No From or Reply-To domain was retained. Exact sender addresses are not retained.' });
+    if (omittedSenderDomains)
+        comparisons.push({ label: 'Additional sender context', state: 'unknown', explanation: `${omittedSenderDomains} additional From or Reply-To claims exceed the local comparison cap. No overall sender conclusion is available.` });
+    if (!report.links.length)
+        comparisons.push({ label: 'Supplied destinations', state: 'unknown', explanation: 'No supported destination was retained. Missing or partial extraction is not proof that no destination exists.' });
+    for (const link of report.links.slice(0, MAX_INTAKE_LINKS))
+        comparisons.push({
+            label: `Destination hostname: ${link.hostname}`,
+            state: recipientHostname ? link.hostname.toLowerCase() === recipientHostname ? 'match' : 'mismatch' : 'unknown',
+            explanation: 'Hostname context only, not an exact route match or authority check. Supplied destinations have not been opened.',
+        });
+    const deliveryReferences = action?.history.filter(event => event.applied && event.previousState === 'authorised'
+        && event.nextState === 'submitted' && event.sourceClass === 'analyst' && event.reference).map(event => event.reference) ?? [];
+    comparisons.push({ label: 'Delivery reference', state: !reference || !deliveryReferences.length ? 'unknown'
+            : deliveryReferences.includes(reference) ? 'match' : action.historyOmitted > 0 ? 'unknown' : 'mismatch',
+        explanation: 'Compared with retained, applied submission events only. Acknowledgements and later updates have separate references; missing submission history remains unknown. Matching text does not authenticate a notice.' });
+    comparisons.push({ label: 'Latest action reference', state: reference && action?.reference ? reference === action.reference ? 'match' : 'mismatch' : 'unknown',
+        explanation: 'Compared with the latest retained reference from any applied action event. This may be an acknowledgement or later update, not the delivery reference.' });
+    comparisons.push({ label: 'Claimed organisation', state: 'unknown', explanation: organisation ? 'The entered organisation is an analyst-supplied claim. Retained contact-source text is not a structured authenticated organisation identity.' : 'No organisation claim was supplied; no authenticated organisation identity is inferred.' });
+    return {
+        comparisons,
+        routeFreshness: action ? responseRouteFreshness(action.routeObservedAt, action.routeReviewAfter, input.now) : 'unknown',
+        confirmation: input.confirmedOutOfBand ? 'analyst_reported_out_of_band' : 'not_reported',
+    };
+}
 const ACTION_STATES = new Set(CASE_ACTION_STATES);
 const PROVIDER_OUTCOMES = new Set(CASE_PROVIDER_OUTCOMES);
 const ACTION_EVENT_SOURCE_CLASSES = new Set(CASE_ACTION_EVENT_SOURCE_CLASSES);
@@ -29,6 +96,20 @@ const ACTION_TRANSITIONS = Object.freeze({
     acknowledged: new Set(['acknowledged', 'terminal']),
     terminal: new Set(),
 });
+// Terminal also includes deliberate withdrawal before review. This is stage
+// completion, not proof of authorisation or submission.
+const RESPONSE_DECISION_COMPLETE = Object.freeze({
+    drafting: false,
+    ready_for_review: false,
+    reviewed: true,
+    authorised: true,
+    submitted: true,
+    acknowledged: true,
+    terminal: true,
+});
+export function caseActionCompletesResponseDecision(state) {
+    return RESPONSE_DECISION_COMPLETE[state];
+}
 function bytes(value) {
     try {
         return new TextEncoder().encode(JSON.stringify(value)).byteLength;
@@ -76,6 +157,10 @@ function normalizeActionEvent(raw, actionId, options = {}) {
         && sourceClass !== 'analyst' && !migrationSnapshot)
         return null;
     const provenance = text(item.provenance, MAX_RESPONSE_LABEL_LENGTH) || `${sourceClass}_record`;
+    if (item.evidenceRequest !== undefined && options.sourceVersion != null && options.sourceVersion < 17)
+        throw new Error('Requested evidence requires Case schema 17.');
+    const evidenceRequest = readCaseEvidenceRequest(item.evidenceRequest);
+    assertEvidenceRequestEvent(evidenceRequest, { previousState, nextState, sourceClass, providerOutcome: item.providerOutcome });
     const providerOutcome = typeof item.providerOutcome === 'string' && PROVIDER_OUTCOMES.has(item.providerOutcome)
         ? item.providerOutcome
         : null;
@@ -104,6 +189,7 @@ function normalizeActionEvent(raw, actionId, options = {}) {
         : null;
     const eventMaterial = {
         previousState,
+        ...(evidenceRequest ? { evidenceRequest } : {}),
         nextState,
         occurredAt,
         sourceClass,
@@ -283,6 +369,10 @@ function normalizeAction(raw, fallback, options = {}) {
     const createdAt = iso(item.createdAt, fallback, options);
     const actionId = safeId(item.id, 'action', { recipient, createdAt });
     const history = normalizeActionHistory(item.history, item, actionId, createdAt, fallback, options);
+    assertEvidenceRequestHistory(history.history, history.omitted > 0);
+    if (item.amendment !== undefined && options.sourceVersion != null && options.sourceVersion < 17)
+        throw new Error('Packet amendments require Case schema 17.');
+    const amendment = readCasePacketAmendment(item.amendment);
     const applied = history.history.filter((event) => event.applied);
     const latestReference = [...applied].reverse().find((event) => event.reference)?.reference ?? null;
     const latestProviderOutcome = [...applied].reverse().find((event) => event.providerOutcome) ?? null;
@@ -297,6 +387,7 @@ function normalizeAction(raw, fallback, options = {}) {
         : null;
     return {
         id: actionId,
+        ...(amendment ? { amendment } : {}),
         type: legacyPlatformReview
             ? 'platform_report'
             : typeof item.type === 'string' && ACTION_TYPES.has(item.type)
@@ -481,6 +572,9 @@ export function appendCaseAction(current, raw, now) {
         : null;
     if (item.originActionId != null && !originActionId)
         throw new Error('A follow-on action requires an existing originating action.');
+    const amendment = readCasePacketAmendment(item.amendment);
+    if (amendment)
+        assertPacketAmendment(current, originActionId, amendment);
     const history = [{
             id: freshId('action-event'),
             previousState: null,
@@ -537,6 +631,12 @@ export function appendCaseActionTransition(current, actionId, raw, now, validPin
         || !SAFE_ID_RE.test(item.evidencePinId) || (validPinIds && !validPinIds.has(item.evidencePinId)))) {
         throw new Error('An action transition evidence pin must reference a retained Case evidence pin.');
     }
+    const evidenceRequest = readCaseEvidenceRequest(item.evidenceRequest);
+    if (evidenceRequest)
+        assertEvidenceRequestTransition(action, evidenceRequest, sourceClass, item.providerOutcome, validPinIds);
+    if (action.amendment && ['ready_for_review', 'reviewed', 'authorised', 'submitted'].includes(nextState)) {
+        assertPacketAmendment(current, action.originActionId, action.amendment);
+    }
     const occurredAt = optionalIso(item.occurredAt) ?? now;
     const event = normalizeActionEvent({
         ...item,
@@ -558,7 +658,7 @@ export function appendCaseActionTransition(current, actionId, raw, now, validPin
     return normalizeCaseActions(current.map((candidate) => candidate.id === actionId ? updated : candidate), now, currentActionNormalizationOptions(validPinIds));
 }
 const ACTION_REVIEW_MATERIAL_FIELDS = [
-    'type', 'recipient', 'contactSource', 'routeObservedAt', 'routeReviewAfter', 'contactLimitations', 'originActionId',
+    'type', 'recipient', 'contactSource', 'routeObservedAt', 'routeReviewAfter', 'contactLimitations', 'originActionId', 'amendment',
 ];
 export function updateCaseAction(current, raw, now, validPinIds) {
     const patch = record(raw);
@@ -587,6 +687,8 @@ export function updateCaseAction(current, raw, now, validPinIds) {
         throw new Error('An action requires a recipient or internal owner.');
     const materialChanged = ACTION_REVIEW_MATERIAL_FIELDS
         .some((key) => Object.hasOwn(patch, key) && JSON.stringify(record(existing)[key]) !== JSON.stringify(record(updated)[key]));
+    if (materialChanged && updated.amendment)
+        assertPacketAmendment(current, updated.originActionId, updated.amendment);
     if (materialChanged && ['submitted', 'acknowledged', 'terminal'].includes(existing.state)) {
         throw new Error('Submitted or terminal action identity and recipient metadata cannot be rewritten; create a linked follow-on action instead.');
     }

package/packages/cases/case-response-model.mjs

@@ -5,7 +5,7 @@
 import { CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION, MAX_ASSERTION_PROVENANCE_LABELS, MAX_ASSERTION_PROVENANCE_MARKINGS, MAX_CASE_ASSERTIONS, MAX_CASE_CHECKPOINT_FACTS, MAX_CASE_DECISIONS, MAX_CASE_EVIDENCE_PINS, MAX_CASE_MANUAL_TRAIL_EVENTS, MAX_CASE_SIGHTINGS, MAX_DECISION_PIN_REFERENCES, MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_LIMITATION_LENGTH, MAX_RESPONSE_RATIONALE_LENGTH, MAX_RESPONSE_VALUE_LENGTH, MAX_TRAIL_TARGET_LENGTH, } from "../contracts/case-portability.mjs";
 import { CASE_ASSERTION_EXTERNAL_ENTITY_TYPES, CASE_ASSERTION_EXTERNAL_FORMATS, CASE_ASSERTION_KINDS, CASE_ASSERTION_STATES, CASE_DECISION_CONFIDENCE_LEVELS, CASE_EVIDENCE_RELATION_STANCES, CASE_MANUAL_TRAIL_KINDS, CASE_SIGHTING_CATEGORIES, CASE_SIGHTING_STATES, CASE_TRANSITION_EXPECTATIONS, } from "./case-response-records.mjs";
 import { COMPLETENESS, SAFE_ID_RE, compareCodeUnits, freshId, iso, limitations, optionalIso, record, safeId, text, uniqueIds, } from "./case-response-values.mjs";
-import { isValidAsciiHostname } from "../../lib/hostname.mjs";
+import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
 import { readCaseRecheckContext } from "./case-recheck-model.mjs";
 export * from "./case-response-records.mjs";
 export * from "./case-response-actions.mjs";
@@ -195,6 +195,8 @@ export function appendCaseEvidencePin(current, raw, now) {
 export function appendCaseEvidencePins(current, raw, now) {
     if (!Array.isArray(raw) || !raw.length)
         throw new Error('An evidence checkpoint requires at least one selected fact.');
+    if (raw.length > MAX_CASE_CHECKPOINT_FACTS)
+        throw new Error(`A checkpoint can retain at most ${MAX_CASE_CHECKPOINT_FACTS} selected facts. No evidence was saved.`);
     let output = [...current];
     let added = 0;
     for (const item of raw.slice(0, MAX_CASE_CHECKPOINT_FACTS)) {
@@ -240,6 +242,12 @@ export function normalizeCaseDecisions(raw, fallback, validPinIds, options = {})
         .sort((left, right) => Date.parse(left.createdAt) - Date.parse(right.createdAt))
         .slice(-MAX_CASE_DECISIONS);
 }
+/** Counts decisions, not links; references to pins no longer retained do not
+ * support a decision. Inputs have already passed their owning normalisers. */
+export function countEvidenceLinkedCaseDecisions(decisions, pins) {
+    const retainedPinIds = new Set(pins.map(pin => pin.id));
+    return decisions.filter(decision => decision.evidencePinIds.some(id => retainedPinIds.has(id))).length;
+}
 export function appendCaseDecision(current, raw, now, validPinIds) {
     if (current.length >= MAX_CASE_DECISIONS) {
         throw new Error(`A Case can retain at most ${MAX_CASE_DECISIONS} decisions. No existing decision was removed.`);

package/packages/cases/case-response-outcomes.mjs

@@ -2,6 +2,7 @@
 import { MAX_CASE_CLOSURES, MAX_CASE_OBSERVED_EFFECT_REVIEWS, MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_RATIONALE_LENGTH, } from "../contracts/case-portability.mjs";
 import { latestObservationCohort, } from "../evidence/latest-observations.mjs";
 import { readCaseRecheckAnswerContext } from "./case-recheck-model.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { CASE_CLOSURE_REASONS, CASE_OBSERVED_EFFECT_SOURCE_CLASSES, CASE_OBSERVED_EFFECT_STATES, } from "./case-response-records.mjs";
 import { COMPLETENESS, SAFE_ID_RE, boundedCounter, compareCodeUnits, freshId, iso, lifecycleLimitations, limitations, optionalIso, record, safeId, text, } from "./case-response-values.mjs";
 const OBSERVED_EFFECT_STATES = new Set(CASE_OBSERVED_EFFECT_STATES);
@@ -222,6 +223,31 @@ export function normalizeCaseClosureHistory(raw, fallback, validReviewIds, valid
         ]),
     };
 }
+/** New-write policy only. Historical normalisation must not re-adjudicate a closure. */
+export function caseClosureReviewBlocker(reason, review, now) {
+    if (reason !== 'independently_not_reproduced' && reason !== 'infrastructure_changed')
+        return null;
+    const expected = reason === 'independently_not_reproduced' ? 'not_reproduced' : 'changed';
+    const invalidLink = reason === 'independently_not_reproduced'
+        ? 'This closure reason requires a linked independent not-reproduced review.'
+        : 'This closure reason requires a linked independent changed review.';
+    if (!review || review.state !== expected)
+        return invalidLink;
+    const observedAt = normalizeExplicitIsoTimestamp(review.observedAt);
+    const createdAt = normalizeExplicitIsoTimestamp(review.createdAt);
+    const closedAt = normalizeExplicitIsoTimestamp(now);
+    if (!observedAt || !createdAt || !closedAt
+        || Date.parse(observedAt) > Date.parse(closedAt)
+        || Date.parse(createdAt) > Date.parse(closedAt))
+        return invalidLink;
+    if (reason === 'independently_not_reproduced') {
+        if (review.completeness !== 'complete')
+            return 'Independent non-reproduction closure requires a complete observation. Keep this limited review and collect or record a complete recheck.';
+        if (review.recheck && review.recheck.conditionsMatch !== 'comparable')
+            return 'Independent non-reproduction closure requires comparable recheck conditions.';
+    }
+    return null;
+}
 export function appendCaseClosure(current, raw, now, observedEffects, actions) {
     const item = record(raw);
     const reason = typeof item.reason === 'string' && CLOSURE_REASONS.has(item.reason)
@@ -233,14 +259,9 @@ export function appendCaseClosure(current, raw, now, observedEffects, actions) {
     const action = typeof item.actionId === 'string'
         ? actions.find((candidate) => candidate.id === item.actionId) ?? null
         : null;
-    if (reason === 'independently_not_reproduced'
-        && (review?.state !== 'not_reproduced' || Date.parse(review.observedAt) > Date.parse(now) || Date.parse(review.createdAt) > Date.parse(now))) {
-        throw new Error('This closure reason requires a linked independent not-reproduced review.');
-    }
-    if (reason === 'infrastructure_changed'
-        && (review?.state !== 'changed' || Date.parse(review.observedAt) > Date.parse(now) || Date.parse(review.createdAt) > Date.parse(now))) {
-        throw new Error('This closure reason requires a linked independent changed review.');
-    }
+    const reviewBlocker = caseClosureReviewBlocker(reason, review, now);
+    if (reviewBlocker)
+        throw new Error(reviewBlocker);
     if (reason === 'provider_reported_resolution_not_independently_checked'
         && (action?.providerOutcome !== 'provider_reports_resolved'
             || !action.history.some((event) => event.applied