@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/packages/cases/case-incident-context.mjs

@@ -0,0 +1,52 @@
+// Pure incident context parsing and retention projection; no storage or Case mutation.
+import { canonicalRegistrableDomain } from "../analysis/registrable-domain.mjs";
+import { MAX_CASE_OBJECTIVE_LENGTH } from "../contracts/case-portability.mjs";
+import { parseCredentialFreeHttpUrl } from "../evidence/lookup-target.mjs";
+export const MAX_CASE_INCIDENT_URL_LENGTH = 1_850;
+function boundedContextText(value, maximum) {
+    return typeof value === 'string'
+        ? value.replace(/[\u0000-\u001f\u007f]/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum)
+        : '';
+}
+export function normalizeCaseObjective(value) {
+    return boundedContextText(value, MAX_CASE_OBJECTIVE_LENGTH);
+}
+export function parseIncidentUrlContext(value) {
+    const parsed = parseCredentialFreeHttpUrl(value, MAX_CASE_INCIDENT_URL_LENGTH);
+    if (!parsed)
+        return null;
+    const hostname = parsed.hostname.toLowerCase().replace(/\.$/u, '');
+    const registrableDomain = canonicalRegistrableDomain(hostname);
+    if (!registrableDomain)
+        return null;
+    const exactUrl = parsed.toString();
+    if (exactUrl.length > MAX_CASE_INCIDENT_URL_LENGTH)
+        return null;
+    return Object.freeze({
+        exactUrl,
+        hostname,
+        registrableDomain,
+        originUrl: parsed.origin,
+        hasPath: parsed.pathname !== '/',
+        hasQuery: Boolean(parsed.search),
+        hasFragment: Boolean(parsed.hash),
+    });
+}
+export function caseInvestigationContext(record) {
+    return record?.workflowMetadata?.investigationContext ?? null;
+}
+export function prepareCaseInvestigationContext(input) {
+    const objective = normalizeCaseObjective(input.objective);
+    if (!objective)
+        throw new Error('Enter the investigation objective before retaining Incident context.');
+    const parsed = parseIncidentUrlContext(input.incidentUrl);
+    if (!parsed)
+        throw new Error(`Enter one absolute HTTP(S) Incident URL of at most ${MAX_CASE_INCIDENT_URL_LENGTH} characters without credentials.`);
+    const retention = input.retainExactUrl ? 'exact' : 'origin_only';
+    const retainedUrl = input.retainExactUrl ? parsed.exactUrl : parsed.originUrl;
+    return Object.freeze({
+        objective,
+        incidentUrl: retainedUrl,
+        urlRetention: retention,
+    });
+}

package/packages/cases/case-markdown.mjs

@@ -0,0 +1,11 @@
+/** Keep untrusted Case prose literal, including block syntax and GFM autolinks. */
+export function escapeCaseMarkdownInline(text) {
+    return String(text)
+        .replace(/[\r\n\u2028\u2029]+/g, ' ')
+        .replace(/([\\`*_{}\[\]<>()#+!|~])/g, '\\$1')
+        .replace(/^(\s*)([-=]+)(?=\s|$)/u, '$1\\$2')
+        .replace(/^(\s*\d+)\.(?=\s)/u, '$1\\.')
+        // Break automatic links without altering the underlying evidence value.
+        .replace(/\b([a-z][a-z0-9+.-]{1,31}):(?=\/\/)/gi, '$1\\:')
+        .replace(/\bwww\.(?=\S)/gi, 'www\\.');
+}

package/packages/cases/case-migration-model.mjs

@@ -1,11 +1,22 @@
-import { CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, DEFAULT_DISPOSITION, DEFAULT_SOURCE, DEFAULT_STATUS, MAX_CASES, MAX_NOTES_PER_CASE, deterministicId, caseTimestampOrNull, normalizeCase, normalizeDomain, normalizeCaseObjective, normalizeEvidenceHistory, normalizeNotes, normalizeReviewReasonCode, normalizeTags, objectRecord, safeId, isValidDisposition, isValidSource, isValidStatus, } from "./case-record-model.mjs";
+import { CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, MAX_CASES, MAX_NOTES_PER_CASE, } from "../contracts/case-portability.mjs";
+import { DEFAULT_DISPOSITION, DEFAULT_STATUS, isValidDisposition, isValidStatus } from "./case-record-decisions.mjs";
+import { DEFAULT_SOURCE } from "./case-record-contracts.mjs";
+import { deterministicId, caseTimestampOrNull, normalizeNotes, normalizeReviewReasonCode, normalizeTags, objectRecord, safeId, isValidSource, } from "./case-record-core.mjs";
+import { normalizeCase } from "./case-record-operations.mjs";
+import { normalizeCaseObjective } from "./case-incident-context.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { mergeImportedEvidenceHistory, normalizeEvidenceHistory } from "./case-evidence-model.mjs";
 import { CASE_REPORT_SCHEMA, PUBLIC_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, caseReportVersionMatchesCase, CLI_CASE_PACK_CURRENT_REDACTION_KEYS, CLI_CASE_PACK_INTEGRITY_KEYS, CLI_CASE_PACK_LIMITATIONS, CLI_CASE_PACK_PACKET_KEYS, CLI_CASE_PACK_PUBLIC_REPORT_KEYS, CLI_CASE_PACK_REPORT_KEYS, CLI_CASE_PACK_ROOT_KEYS, CLI_CASE_PACK_SCHEMA, CLI_CASE_PACK_VERSION, } from "../contracts/case-portability.mjs";
 import { canonicalArtifactJsonV2 } from "../evidence/artifact-integrity.mjs";
 import { readCaseAttachments, mergeCaseAttachments } from "./case-attachment-model.mjs";
-import { assertBoundedJsonStructure } from "../../lib/bounded-json.mjs";
+import { readCaseEvidenceLinks, mergeCaseEvidenceLinks } from "./case-evidence-links.mjs";
+import { EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { assertBoundedJsonStructure } from "../analysis/bounded-json.mjs";
 import { inspectCaseBrandProfileIds, unionCaseBrandProfileIds, } from "./case-brand-profile-references.mjs";
 import { caseInvestigationBranchReferences, mergeCaseInvestigationBranches, normalizeCaseInvestigationBranches, } from "./case-investigation-branch-model.mjs";
 import { buildCaseClosureLinkContext, mergeCaseActions, mergeCaseClosureHistories, mergeCaseObservedEffectHistories, MAX_CASE_ASSERTIONS, MAX_CASE_DECISIONS, MAX_CASE_EVIDENCE_PINS, MAX_CASE_MANUAL_TRAIL_EVENTS, MAX_CASE_SIGHTINGS, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseClosureHistory, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseObservedEffectHistory, normalizeCaseSightings, } from "./case-response-model.mjs";
+import { readCaseWorkflowFields } from "./case-workflow-migration.mjs";
+import { emptyCaseWorkflowMetadata, mergeCaseWorkflowMetadata } from "./case-workflow-metadata.mjs";
 export const MAX_CASE_INPUT_RECORDS = 2_000;
 function compareCodeUnits(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
@@ -81,6 +92,8 @@ export function normalizeCaseStore(raw) {
 function assertModernCaseShape(raw, sourceVersion) {
     for (const item of boundedCaseList(raw).items) {
         const itemRecord = objectRecord(item);
+        if (sourceVersion < EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION && Object.hasOwn(itemRecord, 'evidenceLinks'))
+            throw new TypeError('Evidence relationships require the current Case schema.');
         if (sourceVersion < INCIDENT_CASE_SCHEMA_VERSION && Object.hasOwn(itemRecord, 'attachments')) {
             throw new TypeError('Retained file references require the current Case schema; no data was changed.');
         }
@@ -168,6 +181,8 @@ function boundedCaseList(raw) {
  */
 function extractImportPatch(raw, importedVersion) {
     const record = objectRecord(raw);
+    if (record.evidenceLinks !== undefined && importedVersion < EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION)
+        throw new TypeError('Evidence relationships require the current Case schema.');
     const domain = normalizeDomain(record.domain);
     if (!domain)
         return null;
@@ -204,6 +219,9 @@ function extractImportPatch(raw, importedVersion) {
         [record.sightings, sightings],
     ].reduce((total, [candidates, retained]) => total
         + Math.max(0, (Array.isArray(candidates) ? candidates.length : 0) - retained.length), 0);
+    const workflow = readCaseWorkflowFields(record, domain, assertions, importedVersion);
+    const hasWorkflow = record.workflowMetadata !== undefined || workflow.workflowMetadata.types.length > 0
+        || workflow.workflowMetadata.incidentTargets.length > 0 || workflow.workflowMetadata.investigationContext !== null;
     return {
         domain,
         rawId: typeof record.id === 'string' ? record.id : null,
@@ -235,7 +253,9 @@ function extractImportPatch(raw, importedVersion) {
             ? normalizeCaseInvestigationBranches(record.branches, normalizedFallback, branchReferences, timestampOptions)
             : [],
         attachments: importedVersion >= INCIDENT_CASE_SCHEMA_VERSION ? readCaseAttachments(record.attachments) : undefined,
-        tags: normalizeTags(record.tags),
+        evidenceLinks: readCaseEvidenceLinks(record.evidenceLinks),
+        tags: workflow.tags,
+        workflowMetadata: hasWorkflow ? workflow.workflowMetadata : undefined,
         // Imported notes fall back only to the imported record's own timestamps
         // (never "now"), so a timestamp-less note gets a stable, deterministic time
         // and id, and re-importing the same file cannot manufacture a duplicate or a
@@ -245,16 +265,6 @@ function extractImportPatch(raw, importedVersion) {
         updatedAt: caseTimestampOrNull(record.updatedAt, importedVersion),
     };
 }
-/** @param {CaseNote[]} a @param {CaseNote[]} b @returns {CaseNote[]} */
-function unionNotes(a, b) {
-    const byId = new Map();
-    for (const note of [...a, ...b]) {
-        if (!byId.has(note.id))
-            byId.set(note.id, note);
-    }
-    const notes = [...byId.values()].sort((left, right) => Date.parse(left.createdAt) - Date.parse(right.createdAt));
-    return notes.slice(Math.max(0, notes.length - MAX_NOTES_PER_CASE));
-}
 function retainLocalAuthoredRecords(local, imported, maximum) {
     const records = [...local];
     const retainedIds = new Set(records.map((item) => item.id));
@@ -271,13 +281,6 @@ function retainLocalAuthoredRecords(local, imported, maximum) {
     }
     return { records, omitted };
 }
-// Additive, deduplicated union of two evidence histories. Identical material
-// collapses (earliest firstCapturedAt, latest capturedAt), distinct snapshots
-// are retained subject to the per-case bound, and an older import can never
-// move an existing observation backwards.
-function mergeEvidenceHistories(local, imported, caseDomain) {
-    return normalizeEvidenceHistory([...local, ...imported], { source: 'import', fallback: null, caseDomain });
-}
 /** @param {ImportPatch} patch @param {string} now @returns {CaseRecord} */
 function caseFromPatch(patch, now) {
     return {
@@ -289,6 +292,7 @@ function caseFromPatch(patch, now) {
         reviewReasonCode: patch.reviewReasonCode ?? null,
         brandProfileIds: patch.brandProfileIds,
         tags: patch.tags,
+        workflowMetadata: patch.workflowMetadata ?? emptyCaseWorkflowMetadata(),
         notes: patch.notes,
         source: patch.source ?? DEFAULT_SOURCE,
         evidenceHistory: patch.evidenceHistory,
@@ -302,6 +306,7 @@ function caseFromPatch(patch, now) {
         closures: patch.closures,
         branches: patch.branches,
         ...(patch.attachments === undefined ? {} : { attachments: patch.attachments }),
+        ...(patch.evidenceLinks === undefined ? {} : { evidenceLinks: patch.evidenceLinks }),
         createdAt: patch.createdAt || patch.updatedAt || now,
         updatedAt: patch.updatedAt || patch.createdAt || now,
     };
@@ -318,6 +323,8 @@ function caseFromPatch(patch, now) {
 function applyImportPatch(local, patch) {
     const importNewer = patch.updatedAt !== null && Date.parse(patch.updatedAt) > Date.parse(local.updatedAt);
     const fallback = patch.updatedAt || local.updatedAt;
+    const noteSelection = retainLocalAuthoredRecords(local.notes, patch.notes, MAX_NOTES_PER_CASE);
+    const historySelection = mergeImportedEvidenceHistory(local.evidenceHistory, patch.evidenceHistory, local.domain);
     const pinSelection = retainLocalAuthoredRecords(local.evidencePins, patch.evidencePins, MAX_CASE_EVIDENCE_PINS);
     const evidencePins = normalizeCaseEvidencePins(pinSelection.records, fallback);
     const pinIds = new Set(evidencePins.map((item) => item.id));
@@ -336,7 +343,9 @@ function applyImportPatch(local, patch) {
     const trailSelection = retainLocalAuthoredRecords(local.manualTrail, patch.manualTrail, MAX_CASE_MANUAL_TRAIL_EVENTS);
     const manualTrail = normalizeCaseManualTrail(trailSelection.records, fallback);
     const attachments = mergeCaseAttachments(local.attachments, patch.attachments);
+    const evidenceLinks = mergeCaseEvidenceLinks(local.evidenceLinks, patch.evidenceLinks);
     const authoredHistoryOmitted = patch.authoredHistoryOmitted
+        + noteSelection.omitted
         + pinSelection.omitted
         + decisionSelection.omitted
         + assertionSelection.omitted
@@ -350,7 +359,7 @@ function applyImportPatch(local, patch) {
             reviewReasonCode: patch.reviewReasonCode !== undefined && importNewer ? patch.reviewReasonCode : local.reviewReasonCode ?? null,
             brandProfileIds: brandProfileReferences.ids,
             source: patch.source !== undefined && importNewer ? patch.source : local.source,
-            evidenceHistory: mergeEvidenceHistories(local.evidenceHistory, patch.evidenceHistory, local.domain),
+            evidenceHistory: historySelection.records,
             evidencePins,
             decisions,
             actions,
@@ -361,11 +370,15 @@ function applyImportPatch(local, patch) {
             closures,
             branches: mergeCaseInvestigationBranches(local.branches ?? [], patch.branches, fallback, branchReferences),
             ...(attachments === undefined ? {} : { attachments }),
+            ...(evidenceLinks === undefined ? {} : { evidenceLinks }),
             tags: normalizeTags([...local.tags, ...patch.tags]),
-            notes: unionNotes(local.notes, patch.notes),
+            workflowMetadata: patch.workflowMetadata === undefined
+                ? local.workflowMetadata ?? emptyCaseWorkflowMetadata()
+                : mergeCaseWorkflowMetadata(local.workflowMetadata ?? emptyCaseWorkflowMetadata(), patch.workflowMetadata, importNewer, local.domain),
+            notes: normalizeNotes(noteSelection.records, fallback),
             createdAt: patch.createdAt && Date.parse(patch.createdAt) < Date.parse(local.createdAt) ? patch.createdAt : local.createdAt,
             updatedAt: importNewer ? (patch.updatedAt ?? local.updatedAt) : local.updatedAt,
-        }, brandProfileReferencesOmitted: brandProfileReferences.omitted, authoredHistoryOmitted };
+        }, brandProfileReferencesOmitted: brandProfileReferences.omitted, authoredHistoryOmitted, evidenceHistoryOmitted: historySelection.omitted };
 }
 function pickFreeId(preferred, domain, used) {
     const wanted = safeId(preferred);
@@ -478,7 +491,7 @@ function caseCollectionImportEnvelope(importedRaw) {
  * reinterpreted.
  * @param {CaseRecord[]} localCases
  * @param {unknown} importedRaw
- * @returns {{ cases: CaseRecord[], added: number, updated: number, skipped: number, brandProfileReferencesOmitted: number, authoredHistoryOmitted: number }}
+ * @returns {{ cases: CaseRecord[], added: number, updated: number, skipped: number, brandProfileReferencesOmitted: number, authoredHistoryOmitted: number, evidenceHistoryOmitted: number }}
  */
 export function mergeCases(localCases, importedRaw) {
     assertBoundedJsonStructure(importedRaw, 'Case import', CASE_INPUT_JSON_LIMITS);
@@ -507,6 +520,7 @@ export function mergeCases(localCases, importedRaw) {
     let skipped = imported.omitted;
     let brandProfileReferencesOmitted = 0;
     let authoredHistoryOmitted = 0;
+    let evidenceHistoryOmitted = 0;
     const fallback = new Date(0).toISOString();
     const importedIds = new Set();
     for (const item of imported.items) {
@@ -539,6 +553,7 @@ export function mergeCases(localCases, importedRaw) {
             byId.set(existing.id, merged.record);
             brandProfileReferencesOmitted += patch.brandProfileReferencesOmitted + merged.brandProfileReferencesOmitted;
             authoredHistoryOmitted += merged.authoredHistoryOmitted;
+            evidenceHistoryOmitted += merged.evidenceHistoryOmitted;
             updated += 1;
         }
         else if (byId.size < MAX_CASES) {
@@ -561,5 +576,6 @@ export function mergeCases(localCases, importedRaw) {
         skipped,
         brandProfileReferencesOmitted,
         authoredHistoryOmitted,
+        evidenceHistoryOmitted,
     };
 }

package/packages/cases/case-object-coverage.mjs

@@ -0,0 +1,33 @@
+import { retainedCaseResponseObjects, sameCaseResponseObject } from "./case-response-object.mjs";
+export function buildCaseIncidentCoverage(record) {
+    const objects = new Map();
+    const explicit = retainedCaseResponseObjects(record);
+    for (const target of record.workflowMetadata?.incidentTargets ?? []) {
+        const matching = explicit.filter(object => object.incidentTargetId === target.id && object.identifier === target.url);
+        for (const object of matching.length ? matching : [{ kind: 'other', identifier: target.url, incidentTargetId: target.id }])
+            objects.set(JSON.stringify(object), { target, object, targetRetained: true });
+    }
+    for (const object of explicit)
+        if (!objects.has(JSON.stringify(object)))
+            objects.set(JSON.stringify(object), {
+                object, targetRetained: false,
+                target: { id: object.incidentTargetId ?? `${object.kind}-${object.identifier}`, url: object.identifier, state: 'open', createdAt: record.createdAt ?? '', updatedAt: record.updatedAt ?? '' },
+            });
+    return [...objects.values()].map(({ target, object, targetRetained }) => {
+        const actions = (record.actions ?? []).filter(action => action.responseObjects?.some(bound => sameCaseResponseObject(bound, object)));
+        const reviews = (record.observedEffects?.reviews ?? []).filter(review => sameCaseResponseObject(review.responseObject, object));
+        const latestAt = Math.max(...reviews.map(review => Date.parse(review.observedAt)));
+        const latest = reviews.filter(review => Date.parse(review.observedAt) === latestAt);
+        return { target, targetRetained, responseObject: object,
+            hostname: object.kind === 'domain' || object.kind === 'hostname' ? object.identifier : new URL(object.identifier).hostname,
+            actionCoverage: actions.length ? 'bound' : 'unknown',
+            actionIds: actions.map(action => action.id),
+            providerEvents: (record.actions ?? []).flatMap(action => action.history.filter(event => event.applied
+                && event.responseObjects?.some(bound => sameCaseResponseObject(bound, object))
+                && (event.providerOutcome || event.objectOutcome || event.nextState === 'acknowledged'))
+                .map(event => ({ actionId: action.id, eventId: event.id, state: event.nextState, outcome: event.objectOutcome ?? event.providerOutcome, occurredAt: event.occurredAt, sourceClass: event.sourceClass }))),
+            observationCoverage: !reviews.length ? 'unknown' : new Set(latest.map(review => `${review.state}\u0000${review.objectOutcome ?? ''}`)).size > 1 ? 'ambiguous' : 'available',
+            reviews,
+            closures: (record.closures?.records ?? []).filter(closure => sameCaseResponseObject(closure.responseObject, object)), };
+    });
+}

package/packages/cases/case-packet-correction.mjs

@@ -0,0 +1,106 @@
+// Local delivery linkage, not authentication, external acceptance or nonrepudiation.
+import { array, enumeration, exact, HEX_DIGEST_RE, iso, text } from "../evidence/artifact-structure.mjs";
+import { assertWorkspaceInputGraph } from "../workspace/hostile-input.mjs";
+import { MAX_DECISION_PIN_REFERENCES, MAX_RESPONSE_RATIONALE_LENGTH, MAX_RESPONSE_RECIPIENT_LENGTH, SUPPORTED_CASE_RESPONSE_PACKET_VERSIONS } from "../contracts/case-portability.mjs";
+import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
+import { readCaseResponseObjects, sameCaseResponseObject } from "./case-response-object.mjs";
+import { RESPONSE_PACKET_PROFILE_IDS } from "./case-response-packet-vocabulary.mjs";
+export const CASE_DELIVERY_RECEIPT_LIMITATION = 'This retained local receipt identifies canonical packet JSON and analyst-recorded delivery, not delivered message or PDF bytes, external receipt, factual truth, authorship authentication or provider acceptance.';
+const id = (value, label) => {
+    const result = text(value, label, 64);
+    if (!/^[A-Za-z0-9_-]{1,64}$/u.test(result))
+        throw new TypeError(`${label} is invalid.`);
+    return result;
+};
+const digest = (value) => {
+    if (typeof value !== 'string' || !HEX_DIGEST_RE.test(value))
+        throw new TypeError('Select an exact recorded packet digest.');
+    return value;
+};
+const packetVersion = (value) => {
+    if (!SUPPORTED_CASE_RESPONSE_PACKET_VERSIONS.some(version => version === value))
+        throw new TypeError('The recorded packet version is unsupported.');
+    return value;
+};
+const statement = (value, label, required = true) => {
+    const result = text(value, label, MAX_RESPONSE_RATIONALE_LENGTH, !required).trim();
+    if (required && !result)
+        throw new TypeError(`${label} is required.`);
+    return result;
+};
+export function readCaseDeliveryPacketReceipt(value) {
+    if (value === undefined)
+        return undefined;
+    assertWorkspaceInputGraph(value, 'Delivery packet receipt');
+    const row = exact(value, ['version', 'caseId', 'actionId', 'target', 'packetDigestSha256', 'packetVersion', 'packetGeneratedAt', 'recipient', 'profile', 'responseObjects'], 'Delivery packet receipt');
+    if (row.version !== 1)
+        throw new TypeError('The delivery receipt version is unsupported.');
+    const target = text(row.target, 'Receipt target', 253);
+    if (!isValidAsciiHostname(target) || target !== target.toLowerCase())
+        throw new TypeError('The delivery receipt target is invalid.');
+    iso(row.packetGeneratedAt, 'Packet generation time');
+    const recipient = text(row.recipient, 'Receipt recipient', MAX_RESPONSE_RECIPIENT_LENGTH).trim();
+    if (!recipient)
+        throw new TypeError('The receipt recipient is required.');
+    const responseObjects = readCaseResponseObjects(row.responseObjects);
+    if (!responseObjects?.length)
+        throw new TypeError('The receipt requires an explicit nonempty delivered object scope.');
+    return Object.freeze({ version: 1, caseId: id(row.caseId, 'Receipt Case'), actionId: id(row.actionId, 'Receipt action'), target,
+        packetDigestSha256: digest(row.packetDigestSha256), packetVersion: packetVersion(row.packetVersion), packetGeneratedAt: row.packetGeneratedAt,
+        recipient, profile: enumeration(row.profile, RESPONSE_PACKET_PROFILE_IDS, 'Receipt audience'), responseObjects });
+}
+export function readCasePacketCorrection(value) {
+    if (value === undefined)
+        return undefined;
+    assertWorkspaceInputGraph(value, 'Packet correction');
+    const row = exact(value, ['version', 'purpose', 'deliveryEventId', 'packetDigestSha256', 'packetVersion', 'reason', 'previousStatement', 'correctedStatement', 'evidencePinIds', 'profile'], 'Packet correction');
+    if (row.version !== 1)
+        throw new TypeError('The correction version is unsupported.');
+    const purpose = enumeration(row.purpose, ['correction', 'retraction_request'], 'Correction purpose');
+    const pins = array(row.evidencePinIds, 'Correction evidence', MAX_DECISION_PIN_REFERENCES).map(value => id(value, 'Correction pin'));
+    if (!pins.length || new Set(pins).size !== pins.length)
+        throw new TypeError('Select distinct retained correction evidence pins.');
+    return Object.freeze({ version: 1, purpose, deliveryEventId: id(row.deliveryEventId, 'Original delivery event'),
+        packetDigestSha256: digest(row.packetDigestSha256), packetVersion: packetVersion(row.packetVersion),
+        reason: statement(row.reason, 'Correction reason'), previousStatement: statement(row.previousStatement, 'Previous statement'),
+        correctedStatement: statement(row.correctedStatement, 'Corrected statement', purpose === 'correction'),
+        evidencePinIds: Object.freeze(pins), profile: enumeration(row.profile, RESPONSE_PACKET_PROFILE_IDS, 'Correction audience') });
+}
+export function assertDeliveryPacketReceipt(receipt, event, actionId) {
+    if (!receipt)
+        return;
+    if (receipt.actionId !== actionId || !['authorised', 'submitted'].includes(event.previousState ?? '') || event.nextState !== 'submitted' || event.sourceClass !== 'analyst'
+        || event.reference !== `response-packet-sha256:${receipt.packetDigestSha256}`
+        || JSON.stringify(event.responseObjects ?? []) !== JSON.stringify(receipt.responseObjects)
+        || (event.occurredAt && Date.parse(event.occurredAt) < Date.parse(receipt.packetGeneratedAt)))
+        throw new TypeError('The packet receipt must match its exact analyst-recorded delivery and object scope.');
+}
+export function correctionDelivery(actions, action, context) {
+    const correction = action.correction;
+    if (!correction)
+        return null;
+    const original = actions.find(item => item.id === action.originActionId);
+    const event = original?.history.find(item => item.id === correction.deliveryEventId);
+    const receipt = event?.packetReceipt;
+    if (!original || !event?.applied || !receipt)
+        throw new TypeError('An exact-linked correction requires the retained receipt of the explicitly selected delivery. Legacy digest-only or omitted receipts cannot authorise it.');
+    assertDeliveryPacketReceipt(receipt, event, original.id);
+    if (receipt.recipient === '[redacted]' || action.recipient === '[redacted]' || receipt.recipient !== action.recipient
+        || original.recipient !== receipt.recipient || correction.profile !== receipt.profile
+        || correction.packetDigestSha256 !== receipt.packetDigestSha256 || correction.packetVersion !== receipt.packetVersion
+        || !action.responseObjects?.length || action.responseObjects.some(object => !receipt.responseObjects.some(previous => sameCaseResponseObject(previous, object))))
+        throw new TypeError('Correction recipient, version, digest, audience and object subset must match the selected delivered packet.');
+    if (context && (receipt.caseId !== context.caseId || receipt.target !== context.target || (context.profile && context.profile !== correction.profile)
+        || (context.selectedPinIds && correction.evidencePinIds.some(pin => !context.selectedPinIds.has(pin)))))
+        throw new TypeError('Review the current Case target, audience and every retained correction pin before preparation.');
+    return { original, event, receipt };
+}
+/** Called only with the exact completed packet; never uses a later editable draft. */
+export function deliveryReceiptForPacket(packet) {
+    const action = packet.escalationHistory.find(action => action.actionId === packet.actionBinding.selectedActionId);
+    if (!action || !packet.recipientRoute || packet.authorisation.status !== 'authorised' || !action.responseObjects?.length)
+        throw new TypeError('A retained exact receipt requires an authorised action-bound packet with explicit object scope.');
+    return readCaseDeliveryPacketReceipt({ version: 1, caseId: packet.case.id, actionId: action.actionId, target: packet.case.domain,
+        packetDigestSha256: packet.integrity.digestSha256, packetVersion: packet.schemaVersion, packetGeneratedAt: packet.generatedAt,
+        recipient: packet.recipientRoute.contact, profile: packet.profile.id, responseObjects: action.responseObjects });
+}

package/packages/cases/case-recheck-model.mjs

@@ -1,14 +1,20 @@
-import { isValidAsciiHostname } from "../../lib/hostname.mjs";
-import { INCIDENT_CASE_SCHEMA_VERSION, MAX_RESPONSE_RATIONALE_LENGTH } from "../contracts/case-portability.mjs";
-import { enumeration, exact, text } from "../evidence/artifact-structure.mjs";
-export const CASE_RECHECK_CONDITIONS = Object.freeze({ unknown: 'Not established', comparable: 'Comparable for this question', different: 'Different conditions' });
+import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
+import { INCIDENT_CASE_SCHEMA_VERSION, MAX_RESPONSE_RATIONALE_LENGTH, } from "../contracts/case-portability.mjs";
+import { enumeration, exactOptional, text } from "../evidence/artifact-structure.mjs";
+import { readCaseResponseObject, sameCaseResponseObject } from "./case-response-object.mjs";
+import { casePinHasCompleteObservation } from "./case-evidence-quality.mjs";
+export const CASE_RECHECK_CONDITIONS = Object.freeze({
+    unknown: 'Not established',
+    comparable: 'Comparable for this question',
+    different: 'Different conditions',
+});
 function reference(value, label) {
     const id = text(value, label, 64);
     if (!/^[A-Za-z0-9_-]+$/u.test(id))
         throw new TypeError(`${label} is invalid.`);
     return id;
 }
-function contextFields(item) {
+function contextFields(item, sourceVersion) {
     const targetHostname = text(item.targetHostname, 'Recheck target hostname', 253);
     if (targetHostname !== targetHostname.toLowerCase() || !isValidAsciiHostname(targetHostname)) {
         throw new TypeError('Use one normalised hostname for the recheck target, without a path or query.');
@@ -16,8 +22,17 @@ function contextFields(item) {
     const conditions = text(item.conditions, 'Recheck comparison conditions', MAX_RESPONSE_RATIONALE_LENGTH);
     if (!conditions.trim())
         throw new TypeError('Describe the conditions needed to compare the observations.');
-    return Object.freeze({ targetHostname, conditions,
-        baselinePinId: item.baselinePinId === null ? null : reference(item.baselinePinId, 'Recheck baseline pin') });
+    const responseObject = readCaseResponseObject(item.responseObject, sourceVersion);
+    if (responseObject && (responseObject.kind === 'domain' || responseObject.kind === 'hostname'
+        ? responseObject.identifier : new URL(responseObject.identifier).hostname) !== targetHostname) {
+        throw new TypeError('The recheck target hostname must match the exact object snapshot.');
+    }
+    return Object.freeze({
+        targetHostname,
+        conditions,
+        baselinePinId: item.baselinePinId === null ? null : reference(item.baselinePinId, 'Recheck baseline pin'),
+        ...(responseObject ? { responseObject } : {}),
+    });
 }
 /** Optional current-format context; historical records have no invented question. */
 export function readCaseRecheckContext(value, sourceVersion) {
@@ -25,67 +40,140 @@ export function readCaseRecheckContext(value, sourceVersion) {
         return undefined;
     if (sourceVersion != null && sourceVersion < INCIDENT_CASE_SCHEMA_VERSION)
         throw new TypeError('This Case format cannot contain structured recheck questions.');
-    return contextFields(exact(value, ['targetHostname', 'baselinePinId', 'conditions'], 'Recheck question context'));
+    return contextFields(exactOptional(value, ['targetHostname', 'baselinePinId', 'conditions'], ['responseObject'], 'Recheck question context'), sourceVersion);
 }
 export function readCaseRecheckAnswerContext(value, sourceVersion) {
     if (value === undefined)
         return undefined;
     if (sourceVersion != null && sourceVersion < INCIDENT_CASE_SCHEMA_VERSION)
         throw new TypeError('This Case format cannot contain structured recheck answers.');
-    const item = exact(value, ['targetHostname', 'baselinePinId', 'conditions', 'questionId', 'question', 'conditionsMatch'], 'Recheck answer context');
+    const item = exactOptional(value, ['targetHostname', 'baselinePinId', 'conditions', 'questionId', 'question', 'conditionsMatch'], ['responseObject'], 'Recheck answer context');
     const question = text(item.question, 'Recheck question', MAX_RESPONSE_RATIONALE_LENGTH);
     if (!question.trim())
         throw new TypeError('A recheck answer requires its original question.');
-    return Object.freeze({ ...contextFields(item), questionId: reference(item.questionId, 'Recheck question ID'),
+    return Object.freeze({
+        ...contextFields(item, sourceVersion),
+        questionId: reference(item.questionId, 'Recheck question ID'),
         question,
-        conditionsMatch: enumeration(item.conditionsMatch, Object.keys(CASE_RECHECK_CONDITIONS), 'Recheck condition comparison') });
+        conditionsMatch: enumeration(item.conditionsMatch, Object.keys(CASE_RECHECK_CONDITIONS), 'Recheck condition comparison'),
+    });
 }
 export function caseRecheckQuestions(assertions) {
-    return assertions.filter(item => item.kind === 'next_step' && item.recheck && item.state === 'open');
+    return assertions.filter((item) => item.kind === 'next_step' && item.recheck && item.state === 'open');
 }
 export function caseRecheckAnswerContext(question, conditionsMatch) {
     if (question.kind !== 'next_step' || !question.recheck)
         throw new TypeError('Select a saved recheck question.');
-    return readCaseRecheckAnswerContext({ ...question.recheck, questionId: question.id, question: question.statement, conditionsMatch });
+    return readCaseRecheckAnswerContext({
+        ...question.recheck,
+        questionId: question.id,
+        question: question.statement,
+        conditionsMatch,
+    });
+}
+/** Shared read projection; each form retains its draft and existing save coordinator. */
+export function selectCaseRecheckQuestion(assertions, selection) {
+    const questions = caseRecheckQuestions(assertions);
+    const question = questions.find((item) => item.id === selection.questionId);
+    return {
+        questions,
+        context: question ? caseRecheckAnswerContext(question, selection.conditionsMatch) : undefined,
+        stale: Boolean(selection.questionId) && (!question || question.updatedAt !== selection.questionUpdatedAt),
+    };
 }
 /** A saved answer is a snapshot, not a live reference to an editable plan. */
 export function assertCurrentRecheckQuestion(answer, assertions) {
-    const question = caseRecheckQuestions(assertions).find(item => item.id === answer.questionId);
-    if (!question || JSON.stringify(caseRecheckAnswerContext(question, answer.conditionsMatch)) !== JSON.stringify(answer)) {
+    const question = caseRecheckQuestions(assertions).find((item) => item.id === answer.questionId);
+    if (!question ||
+        JSON.stringify(caseRecheckAnswerContext(question, answer.conditionsMatch)) !==
+            JSON.stringify(answer)) {
         throw new Error('The recheck question changed or was resolved. Refresh and review its current conditions before saving this answer.');
     }
 }
-export function caseRecheckComparisonWarnings(context, pins, current) {
-    const warnings = [];
-    if (context.conditionsMatch !== 'comparable')
-        warnings.push(context.conditionsMatch === 'different'
-            ? 'The comparison conditions differ.' : 'Comparable conditions have not been confirmed.');
-    const baseline = pins.find(pin => pin.id === context.baselinePinId);
+const RECHECK_COMPARISON_MESSAGES = {
+    different_conditions: 'The comparison conditions differ.',
+    unconfirmed_conditions: 'Comparable conditions have not been confirmed.',
+    missing_baseline: 'The baseline evidence is no longer available.',
+    current_target_mismatch: 'The current evidence concerns a different or unknown hostname.',
+    incomplete_current: 'The current source does not establish a complete observation.',
+    later_observation_needed: 'A later source observation is needed; reviewing the baseline again is not a recheck.',
+    baseline_target_mismatch: 'The baseline concerns a different hostname.',
+    different_field_or_source: 'The observations use different fields or sources.',
+    missing_object_baseline: 'An object-specific baseline is required for this exact-object comparison.',
+    baseline_object_mismatch: 'The baseline does not explicitly concern this same object.',
+    current_object_mismatch: 'The current observation does not explicitly concern this same object.',
+    incomplete_object_baseline: 'The exact-object baseline must be a complete source observation.',
+};
+/** Admissibility depends on these reasons, not on presentation warnings. */
+export function caseRecheckComparisonBlockers(context, pins, current) {
+    const blockers = [];
+    if (context.conditionsMatch !== 'comparable') {
+        blockers.push(context.conditionsMatch === 'different'
+            ? 'different_conditions'
+            : 'unconfirmed_conditions');
+    }
+    const baseline = pins.find((pin) => pin.id === context.baselinePinId);
+    if (context.responseObject) {
+        if (!baseline)
+            blockers.push('missing_object_baseline');
+        else if (!sameCaseResponseObject(baseline.responseObject, context.responseObject))
+            blockers.push('baseline_object_mismatch');
+        if (baseline && !casePinHasCompleteObservation(baseline))
+            blockers.push('incomplete_object_baseline');
+        if (!current || !sameCaseResponseObject(current.responseObject, context.responseObject))
+            blockers.push('current_object_mismatch');
+    }
     if (context.baselinePinId && !baseline)
-        warnings.push('The baseline evidence is no longer available.');
+        blockers.push('missing_baseline');
     if (current) {
         if (current.observationHostname !== context.targetHostname)
-            warnings.push('The current evidence concerns a different or unknown hostname.');
-        if (current.completeness !== 'complete' || current.truncated || current.sourceState !== 'complete' && current.sourceState !== 'success' && current.sourceState !== 'reviewed' && current.sourceState !== 'not_found')
-            warnings.push('The current source does not establish a complete observation.');
+            blockers.push('current_target_mismatch');
+        if (!casePinHasCompleteObservation(current))
+            blockers.push('incomplete_current');
         if (baseline) {
-            if (baseline.id === current.id || !baseline.observedAt || !current.observedAt || Date.parse(current.observedAt) <= Date.parse(baseline.observedAt))
-                warnings.push('A later source observation is needed; reviewing the baseline again is not a recheck.');
+            const sameObservation = baseline.id === current.id;
+            const unknownObservationTime = !baseline.observedAt || !current.observedAt;
+            const nonLaterObservation = !unknownObservationTime &&
+                Date.parse(current.observedAt) <= Date.parse(baseline.observedAt);
+            if (sameObservation || unknownObservationTime || nonLaterObservation) {
+                blockers.push('later_observation_needed');
+            }
             if (baseline.observationHostname && baseline.observationHostname !== context.targetHostname)
-                warnings.push('The baseline concerns a different hostname.');
-            if (baseline.field && current.field !== baseline.field || baseline.source !== current.source)
-                warnings.push('The observations use different fields or sources.');
+                blockers.push('baseline_target_mismatch');
+            const differentField = Boolean(baseline.field) && current.field !== baseline.field;
+            const differentSource = baseline.source !== current.source;
+            if (differentField || differentSource)
+                blockers.push('different_field_or_source');
         }
     }
-    return warnings;
+    return blockers;
+}
+export function caseRecheckComparisonWarnings(context, pins, current) {
+    return caseRecheckComparisonBlockers(context, pins, current)
+        .map((reason) => RECHECK_COMPARISON_MESSAGES[reason]);
 }
 export function assertRecheckNonReproduction(state, context, completeness, pins, current, observedAt) {
     if (state !== 'not_reproduced')
         return;
-    const warnings = caseRecheckComparisonWarnings(context, pins, current);
-    const baseline = pins.find(pin => pin.id === context.baselinePinId);
-    if (!current && baseline && (!baseline.observedAt || !observedAt || !Number.isFinite(Date.parse(observedAt)) || Date.parse(observedAt) <= Date.parse(baseline.observedAt)))
-        warnings.push('A later independent observation is needed.');
-    if (completeness !== 'complete' || warnings.length)
+    const blockers = caseRecheckComparisonBlockers(context, pins, current);
+    const baseline = pins.find((pin) => pin.id === context.baselinePinId);
+    let laterIndependentObservationNeeded = false;
+    if (!current && baseline) {
+        const missingObservationTime = !baseline.observedAt || !observedAt;
+        const invalidObservationTime = observedAt ? !Number.isFinite(Date.parse(observedAt)) : false;
+        const nonLaterObservation = !missingObservationTime && Date.parse(observedAt) <= Date.parse(baseline.observedAt);
+        laterIndependentObservationNeeded = missingObservationTime || invalidObservationTime || nonLaterObservation;
+    }
+    if (completeness !== 'complete' || blockers.length || laterIndependentObservationNeeded) {
         throw new Error('Not reproduced requires a complete observation under comparable conditions. Record unavailable or describe the limited observation instead.');
+    }
+}
+export const COMPARATIVE_CASE_OBJECT_OUTCOMES = Object.freeze(['removed', 'restricted', 'suspended', 'delisted', 'transferred', 'restored']);
+/** Technical state changes need an exact-object baseline; procedural dispute is distinct. */
+export function assertCaseObjectObservationOutcome(outcome, context, completeness, pins, current, observedAt) {
+    if (!outcome || !COMPARATIVE_CASE_OBJECT_OUTCOMES.includes(outcome))
+        return;
+    if (!context?.responseObject)
+        throw new TypeError('An independent object state change requires a saved exact-object baseline question and comparable evidence.');
+    assertRecheckNonReproduction('not_reproduced', context, completeness, pins, current, observedAt);
 }

package/packages/cases/case-record-contracts.mjs

@@ -1,4 +1,4 @@
-import { ANALYST_REVIEW_REASONS } from "../../lib/analyst-taxonomy.mjs";
+import { ANALYST_REVIEW_REASONS } from "../analysis/analyst-taxonomy.mjs";
 import { CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, PUBLIC_CASE_SCHEMA_VERSION, MAX_CASE_BRAND_PROFILE_ID_CANDIDATES, MAX_CASE_BRAND_PROFILE_IDS, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_CASES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTE_LENGTH, MAX_NOTES_PER_CASE, MAX_TAG_LENGTH, MAX_TAGS_PER_CASE, } from "../contracts/case-portability.mjs";
 import { CASE_DISPOSITIONS, CASE_STATUSES, DEFAULT_DISPOSITION, DEFAULT_STATUS, } from "./case-record-decisions.mjs";
 export { CASE_IMPORT_VERSIONS, CASE_SCHEMA_VERSION, PUBLIC_CASE_SCHEMA_VERSION, MAX_CASE_BRAND_PROFILE_ID_CANDIDATES, MAX_CASE_BRAND_PROFILE_IDS, MAX_CASE_IMPORT_BYTES, MAX_CASE_STORE_BYTES, MAX_CASES, MAX_DOMAIN_LENGTH, MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, MAX_NOTE_LENGTH, MAX_NOTES_PER_CASE, MAX_TAG_LENGTH, MAX_TAGS_PER_CASE, };

package/packages/cases/case-record-core.mjs

@@ -4,7 +4,7 @@ import { CASE_REVIEW_REASONS, CASE_SOURCES, DEFAULT_DISPOSITION, DEFAULT_SOURCE,
 import { dispositionLabel, isValidDisposition, isValidStatus, statusLabel, } from "./case-record-decisions.mjs";
 import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "../evidence/observation.mjs";
 import { PUBLISHED_V2_3_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
-import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
+import { canonicalRegistrableDomain } from "../analysis/registrable-domain.mjs";
 // Forward-version policy (two distinct guarantees):
 //   - A locally-stored envelope that declares a version greater than this is
 //     still read best-effort on load (known fields kept, unknown dropped), but