@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/packages/cases/case-response-actions.mjs

@@ -1,9 +1,78 @@
 // Append-only response actions: transitions, reconciliation and bounded history.
+import { readCaseEvidenceRequest, readCasePacketAmendment, assertEvidenceRequestEvent, assertEvidenceRequestHistory, assertEvidenceRequestTransition, assertPacketAmendment } from "./case-requested-evidence.mjs";
+import { readCaseDeliveryPacketReceipt, readCasePacketCorrection, assertDeliveryPacketReceipt, correctionDelivery } from "./case-packet-correction.mjs";
+import { MAX_INTAKE_LINKS, MAX_MESSAGE_PARTS } from "../contracts/message-intake.mjs";
+import { emailRecipient } from "../evidence/email-recipient.mjs";
+import { responseRouteFreshness } from "./response-route-freshness.mjs";
+import { readCaseResponseObjects, readCaseResponseObjectOutcome, assertCaseObjectOutcome, sameCaseResponseObject } from "./case-response-object.mjs";
 import { CASE_SCHEMA_VERSION, MAX_CASE_ACTIONS, MAX_CASE_ACTION_BYTES, MAX_CASE_ACTION_EVENTS_PER_ACTION, MAX_CASE_ACTION_EVENTS_PER_CASE, MAX_CASE_ACTION_HISTORY_BYTES_PER_CASE, MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_RATIONALE_LENGTH, MAX_RESPONSE_RECIPIENT_LENGTH, MAX_RESPONSE_REFERENCE_LENGTH, } from "../contracts/case-portability.mjs";
 import { normalizeExplicitIsoTimestamp, } from "../evidence/observation.mjs";
 import { CASE_ACTION_EVENT_SOURCE_CLASSES, CASE_ACTION_STATES, CASE_ACTION_TYPES, CASE_PROVIDER_OUTCOMES, } from "./case-response-records.mjs";
 import { SAFE_ID_RE, boundedCounter, compareCodeUnits, deterministicId, freshId, iso, lifecycleLimitations, limitations, optionalIso, record, safeId, text, } from "./case-response-values.mjs";
 const ACTION_TYPES = new Set(CASE_ACTION_TYPES);
+/** Advisory page-memory comparison; neither authenticated identity nor a mutation. */
+export function compareCaseIncomingNotice(action, report, input) {
+    const bounded = (value, maximum) => {
+        if (value === undefined)
+            return '';
+        if (value.length > maximum || /[\u0000-\u001f\u007f]/u.test(value))
+            throw new TypeError('Notice comparison fields must be bounded single-line values.');
+        return value.trim();
+    };
+    const reference = bounded(input.reference, MAX_RESPONSE_REFERENCE_LENGTH);
+    const organisation = bounded(input.claimedOrganisation, MAX_RESPONSE_LABEL_LENGTH);
+    const recipient = emailRecipient(action?.recipient);
+    let recipientHostname = recipient ? recipient.slice(recipient.lastIndexOf('@') + 1).toLowerCase() : null;
+    if (!recipientHostname && action) {
+        try {
+            const url = new URL(action.recipient);
+            if (['https:', 'http:'].includes(url.protocol) && !url.username && !url.password)
+                recipientHostname = url.hostname;
+        }
+        catch { /* A free-text recipient does not establish a route hostname. */ }
+    }
+    const comparisons = [];
+    let senderDomains = 0, omittedSenderDomains = 0;
+    for (const identity of report.identities) {
+        if (identity.role !== 'from' && identity.role !== 'reply_to')
+            continue;
+        if (senderDomains >= MAX_MESSAGE_PARTS * 5) {
+            omittedSenderDomains += 1;
+            continue;
+        }
+        senderDomains += 1;
+        comparisons.push({
+            label: `Part ${identity.part} ${identity.role.replaceAll('_', ' ')} domain: ${identity.domain}`,
+            state: recipientHostname ? identity.domain.toLowerCase() === recipientHostname ? 'match' : 'mismatch' : 'unknown',
+            explanation: 'Compared only with the selected action recipient hostname. Domain agreement does not authenticate the sender; different domains may require independent clarification.',
+        });
+    }
+    if (!senderDomains)
+        comparisons.push({ label: 'Sender domains', state: 'unknown', explanation: 'No From or Reply-To domain was retained. Exact sender addresses are not retained.' });
+    if (omittedSenderDomains)
+        comparisons.push({ label: 'Additional sender context', state: 'unknown', explanation: `${omittedSenderDomains} additional From or Reply-To claims exceed the local comparison cap. No overall sender conclusion is available.` });
+    if (!report.links.length)
+        comparisons.push({ label: 'Supplied destinations', state: 'unknown', explanation: 'No supported destination was retained. Missing or partial extraction is not proof that no destination exists.' });
+    for (const link of report.links.slice(0, MAX_INTAKE_LINKS))
+        comparisons.push({
+            label: `Destination hostname: ${link.hostname}`,
+            state: recipientHostname ? link.hostname.toLowerCase() === recipientHostname ? 'match' : 'mismatch' : 'unknown',
+            explanation: 'Hostname context only, not an exact route match or authority check. Supplied destinations have not been opened.',
+        });
+    const deliveryReferences = action?.history.filter(event => event.applied && event.previousState === 'authorised'
+        && event.nextState === 'submitted' && event.sourceClass === 'analyst' && event.reference).map(event => event.reference) ?? [];
+    comparisons.push({ label: 'Delivery reference', state: !reference || !deliveryReferences.length ? 'unknown'
+            : deliveryReferences.includes(reference) ? 'match' : action.historyOmitted > 0 ? 'unknown' : 'mismatch',
+        explanation: 'Compared with retained, applied submission events only. Acknowledgements and later updates have separate references; missing submission history remains unknown. Matching text does not authenticate a notice.' });
+    comparisons.push({ label: 'Latest action reference', state: reference && action?.reference ? reference === action.reference ? 'match' : 'mismatch' : 'unknown',
+        explanation: 'Compared with the latest retained reference from any applied action event. This may be an acknowledgement or later update, not the delivery reference.' });
+    comparisons.push({ label: 'Claimed organisation', state: 'unknown', explanation: organisation ? 'The entered organisation is an analyst-supplied claim. Retained contact-source text is not a structured authenticated organisation identity.' : 'No organisation claim was supplied; no authenticated organisation identity is inferred.' });
+    return {
+        comparisons,
+        routeFreshness: action ? responseRouteFreshness(action.routeObservedAt, action.routeReviewAfter, input.now) : 'unknown',
+        confirmation: input.confirmedOutOfBand ? 'analyst_reported_out_of_band' : 'not_reported',
+    };
+}
 const ACTION_STATES = new Set(CASE_ACTION_STATES);
 const PROVIDER_OUTCOMES = new Set(CASE_PROVIDER_OUTCOMES);
 const ACTION_EVENT_SOURCE_CLASSES = new Set(CASE_ACTION_EVENT_SOURCE_CLASSES);
@@ -29,6 +98,20 @@ const ACTION_TRANSITIONS = Object.freeze({
     acknowledged: new Set(['acknowledged', 'terminal']),
     terminal: new Set(),
 });
+// Terminal also includes deliberate withdrawal before review. This is stage
+// completion, not proof of authorisation or submission.
+const RESPONSE_DECISION_COMPLETE = Object.freeze({
+    drafting: false,
+    ready_for_review: false,
+    reviewed: true,
+    authorised: true,
+    submitted: true,
+    acknowledged: true,
+    terminal: true,
+});
+export function caseActionCompletesResponseDecision(state) {
+    return RESPONSE_DECISION_COMPLETE[state];
+}
 function bytes(value) {
     try {
         return new TextEncoder().encode(JSON.stringify(value)).byteLength;
@@ -76,6 +159,16 @@ function normalizeActionEvent(raw, actionId, options = {}) {
         && sourceClass !== 'analyst' && !migrationSnapshot)
         return null;
     const provenance = text(item.provenance, MAX_RESPONSE_LABEL_LENGTH) || `${sourceClass}_record`;
+    if (item.evidenceRequest !== undefined && options.sourceVersion != null && options.sourceVersion < 17)
+        throw new Error('Requested evidence requires Case schema 17.');
+    const evidenceRequest = readCaseEvidenceRequest(item.evidenceRequest);
+    if (item.packetReceipt !== undefined && options.sourceVersion != null && options.sourceVersion < 19)
+        throw new TypeError('Delivery receipts require Case schema 19.');
+    const packetReceipt = readCaseDeliveryPacketReceipt(item.packetReceipt);
+    assertDeliveryPacketReceipt(packetReceipt, { previousState, nextState, sourceClass, occurredAt,
+        reference: typeof item.reference === 'string' ? item.reference : null,
+        responseObjects: readCaseResponseObjects(item.responseObjects, options.sourceVersion) }, actionId);
+    assertEvidenceRequestEvent(evidenceRequest, { previousState, nextState, sourceClass, providerOutcome: item.providerOutcome });
     const providerOutcome = typeof item.providerOutcome === 'string' && PROVIDER_OUTCOMES.has(item.providerOutcome)
         ? item.providerOutcome
         : null;
@@ -104,6 +197,10 @@ function normalizeActionEvent(raw, actionId, options = {}) {
         : null;
     const eventMaterial = {
         previousState,
+        ...(item.responseObjects === undefined ? {} : { responseObjects: readCaseResponseObjects(item.responseObjects, options.sourceVersion) }),
+        ...(item.objectOutcome === undefined ? {} : { objectOutcome: readCaseResponseObjectOutcome(item.objectOutcome, options.sourceVersion) }),
+        ...(evidenceRequest ? { evidenceRequest } : {}),
+        ...(packetReceipt ? { packetReceipt } : {}),
         nextState,
         occurredAt,
         sourceClass,
@@ -120,6 +217,16 @@ function normalizeActionEvent(raw, actionId, options = {}) {
             ? item.originActionId
             : null,
     };
+    if (eventMaterial.objectOutcome) {
+        if (!['submitted', 'acknowledged', 'terminal'].includes(nextState) || previousState === 'authorised')
+            throw new TypeError('Object outcomes require a separate attributed event after submission.');
+        if (sourceClass !== 'provider' && sourceClass !== 'analyst')
+            throw new TypeError('Object outcomes require an attributed provider or analyst event.');
+        if (!eventMaterial.responseObjects?.length)
+            throw new TypeError('Select the objects concerned by this provider outcome; no complete-action resolution is inferred.');
+        for (const object of eventMaterial.responseObjects)
+            assertCaseObjectOutcome(eventMaterial.objectOutcome, object);
+    }
     return {
         id: safeId(item.id, 'action-event', { actionId, ...eventMaterial }),
         ...eventMaterial,
@@ -283,6 +390,15 @@ function normalizeAction(raw, fallback, options = {}) {
     const createdAt = iso(item.createdAt, fallback, options);
     const actionId = safeId(item.id, 'action', { recipient, createdAt });
     const history = normalizeActionHistory(item.history, item, actionId, createdAt, fallback, options);
+    assertEvidenceRequestHistory(history.history, history.omitted > 0);
+    if (item.amendment !== undefined && options.sourceVersion != null && options.sourceVersion < 17)
+        throw new Error('Packet amendments require Case schema 17.');
+    const amendment = readCasePacketAmendment(item.amendment);
+    if (item.correction !== undefined && options.sourceVersion != null && options.sourceVersion < 19)
+        throw new TypeError('Packet corrections require Case schema 19.');
+    const correction = readCasePacketCorrection(item.correction);
+    if (correction && amendment)
+        throw new TypeError('Self-initiated correction and provider-request amendment are separate purposes.');
     const applied = history.history.filter((event) => event.applied);
     const latestReference = [...applied].reverse().find((event) => event.reference)?.reference ?? null;
     const latestProviderOutcome = [...applied].reverse().find((event) => event.providerOutcome) ?? null;
@@ -297,6 +413,9 @@ function normalizeAction(raw, fallback, options = {}) {
         : null;
     return {
         id: actionId,
+        ...(item.responseObjects === undefined ? {} : { responseObjects: readCaseResponseObjects(item.responseObjects, options.sourceVersion) }),
+        ...(amendment ? { amendment } : {}),
+        ...(correction ? { correction } : {}),
         type: legacyPlatformReview
             ? 'platform_report'
             : typeof item.type === 'string' && ACTION_TYPES.has(item.type)
@@ -481,9 +600,17 @@ export function appendCaseAction(current, raw, now) {
         : null;
     if (item.originActionId != null && !originActionId)
         throw new Error('A follow-on action requires an existing originating action.');
+    const amendment = readCasePacketAmendment(item.amendment);
+    if (amendment)
+        assertPacketAmendment(current, originActionId, amendment);
+    const correction = readCasePacketCorrection(item.correction);
+    if (correction)
+        correctionDelivery(current, { originActionId, correction,
+            recipient: text(item.recipient, MAX_RESPONSE_RECIPIENT_LENGTH), responseObjects: readCaseResponseObjects(item.responseObjects) });
     const history = [{
             id: freshId('action-event'),
             previousState: null,
+            ...(item.responseObjects === undefined ? {} : { responseObjects: readCaseResponseObjects(item.responseObjects) }),
             nextState: 'drafting',
             occurredAt: now,
             sourceClass: 'analyst',
@@ -508,11 +635,22 @@ export function appendCaseAction(current, raw, now) {
         throw new Error('An action requires a recipient or internal owner.');
     return normalizeCaseActions([...current, created], now, { sourceVersion: CASE_SCHEMA_VERSION });
 }
+export function providerOutcomeRequiresObjectScope(outcome) {
+    return outcome === 'provider_reports_resolved' || outcome === 'partially_remediated';
+}
 export function appendCaseActionTransition(current, actionId, raw, now, validPinIds) {
     const action = current.find((item) => item.id === actionId);
     if (!action)
         throw new Error('That case action no longer exists.');
     const item = record(raw);
+    const selectedObjects = readCaseResponseObjects(item.responseObjects);
+    const outcome = readCaseResponseObjectOutcome(item.objectOutcome);
+    if (selectedObjects?.some(object => !action.responseObjects?.some(bound => sameCaseResponseObject(bound, object))))
+        throw new TypeError('A transition may concern only objects explicitly bound to its action.');
+    if (outcome && !selectedObjects?.length)
+        throw new TypeError('Explicitly select the affected objects for this outcome; it is not applied to every action object.');
+    if (action.responseObjects?.length && providerOutcomeRequiresObjectScope(item.providerOutcome) && !selectedObjects?.length)
+        throw new TypeError('Explicitly select the objects covered by this provider-reported outcome; other action objects remain unchecked.');
     const nextState = typeof item.nextState === 'string' && ACTION_STATES.has(item.nextState)
         ? item.nextState
         : null;
@@ -537,9 +675,24 @@ export function appendCaseActionTransition(current, actionId, raw, now, validPin
         || !SAFE_ID_RE.test(item.evidencePinId) || (validPinIds && !validPinIds.has(item.evidencePinId)))) {
         throw new Error('An action transition evidence pin must reference a retained Case evidence pin.');
     }
+    const evidenceRequest = readCaseEvidenceRequest(item.evidenceRequest);
+    if (evidenceRequest)
+        assertEvidenceRequestTransition(action, evidenceRequest, sourceClass, item.providerOutcome, validPinIds);
+    if (action.amendment && ['ready_for_review', 'reviewed', 'authorised', 'submitted'].includes(nextState)) {
+        assertPacketAmendment(current, action.originActionId, action.amendment);
+    }
+    if (action.correction && ['ready_for_review', 'reviewed', 'authorised', 'submitted'].includes(nextState))
+        correctionDelivery(current, action);
+    const packetReceipt = readCaseDeliveryPacketReceipt(item.packetReceipt);
+    if (packetReceipt && (packetReceipt.recipient !== action.recipient
+        || JSON.stringify(packetReceipt.responseObjects) !== JSON.stringify(action.responseObjects ?? [])))
+        throw new TypeError('The delivered packet receipt no longer matches this action recipient or scope.');
+    if (action.correction && nextState === 'submitted' && !packetReceipt)
+        throw new TypeError('Record the separately prepared correction packet receipt only after actual delivery.');
     const occurredAt = optionalIso(item.occurredAt) ?? now;
     const event = normalizeActionEvent({
         ...item,
+        ...(selectedObjects !== undefined ? { responseObjects: selectedObjects } : action.responseObjects === undefined ? {} : { responseObjects: action.responseObjects }),
         id: freshId('action-event'),
         previousState: action.state,
         nextState,
@@ -558,7 +711,7 @@ export function appendCaseActionTransition(current, actionId, raw, now, validPin
     return normalizeCaseActions(current.map((candidate) => candidate.id === actionId ? updated : candidate), now, currentActionNormalizationOptions(validPinIds));
 }
 const ACTION_REVIEW_MATERIAL_FIELDS = [
-    'type', 'recipient', 'contactSource', 'routeObservedAt', 'routeReviewAfter', 'contactLimitations', 'originActionId',
+    'type', 'recipient', 'contactSource', 'routeObservedAt', 'routeReviewAfter', 'contactLimitations', 'originActionId', 'amendment', 'correction', 'responseObjects',
 ];
 export function updateCaseAction(current, raw, now, validPinIds) {
     const patch = record(raw);
@@ -587,6 +740,10 @@ export function updateCaseAction(current, raw, now, validPinIds) {
         throw new Error('An action requires a recipient or internal owner.');
     const materialChanged = ACTION_REVIEW_MATERIAL_FIELDS
         .some((key) => Object.hasOwn(patch, key) && JSON.stringify(record(existing)[key]) !== JSON.stringify(record(updated)[key]));
+    if (materialChanged && updated.amendment)
+        assertPacketAmendment(current, updated.originActionId, updated.amendment);
+    if (materialChanged && updated.correction)
+        correctionDelivery(current, updated);
     if (materialChanged && ['submitted', 'acknowledged', 'terminal'].includes(existing.state)) {
         throw new Error('Submitted or terminal action identity and recipient metadata cannot be rewritten; create a linked follow-on action instead.');
     }
@@ -600,6 +757,7 @@ export function updateCaseAction(current, raw, now, validPinIds) {
                     occurredAt: now,
                     sourceClass: 'browser_local',
                     provenance: 'material_action_change',
+                    ...(updated.responseObjects === undefined ? {} : { responseObjects: updated.responseObjects }),
                     reference: null,
                     evidencePinId: null,
                     limitations: ['Material action inputs changed after review; prior readiness, review, or authorisation no longer applies.'],

package/packages/cases/case-response-model.mjs

@@ -5,11 +5,14 @@
 import { CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION, MAX_ASSERTION_PROVENANCE_LABELS, MAX_ASSERTION_PROVENANCE_MARKINGS, MAX_CASE_ASSERTIONS, MAX_CASE_CHECKPOINT_FACTS, MAX_CASE_DECISIONS, MAX_CASE_EVIDENCE_PINS, MAX_CASE_MANUAL_TRAIL_EVENTS, MAX_CASE_SIGHTINGS, MAX_DECISION_PIN_REFERENCES, MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_LIMITATION_LENGTH, MAX_RESPONSE_RATIONALE_LENGTH, MAX_RESPONSE_VALUE_LENGTH, MAX_TRAIL_TARGET_LENGTH, } from "../contracts/case-portability.mjs";
 import { CASE_ASSERTION_EXTERNAL_ENTITY_TYPES, CASE_ASSERTION_EXTERNAL_FORMATS, CASE_ASSERTION_KINDS, CASE_ASSERTION_STATES, CASE_DECISION_CONFIDENCE_LEVELS, CASE_EVIDENCE_RELATION_STANCES, CASE_MANUAL_TRAIL_KINDS, CASE_SIGHTING_CATEGORIES, CASE_SIGHTING_STATES, CASE_TRANSITION_EXPECTATIONS, } from "./case-response-records.mjs";
 import { COMPLETENESS, SAFE_ID_RE, compareCodeUnits, freshId, iso, limitations, optionalIso, record, safeId, text, uniqueIds, } from "./case-response-values.mjs";
-import { isValidAsciiHostname } from "../../lib/hostname.mjs";
+import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
 import { readCaseRecheckContext } from "./case-recheck-model.mjs";
+import { readCaseResponseObject } from "./case-response-object.mjs";
+import { normalizeInfrastructureObservation } from "../investigation/infrastructure-observation.mjs";
 export * from "./case-response-records.mjs";
 export * from "./case-response-actions.mjs";
 export * from "./case-response-outcomes.mjs";
+export * from "./case-response-object.mjs";
 export { MAX_ASSERTION_PROVENANCE_LABELS, MAX_ASSERTION_PROVENANCE_MARKINGS, MAX_CASE_ACTION_BYTES, MAX_CASE_ACTION_EVENTS_PER_ACTION, MAX_CASE_ACTION_EVENTS_PER_CASE, MAX_CASE_ACTION_HISTORY_BYTES_PER_CASE, MAX_CASE_ACTIONS, MAX_CASE_ASSERTIONS, MAX_CASE_CHECKPOINT_FACTS, MAX_CASE_CLOSURES, MAX_CASE_DECISIONS, MAX_CASE_EVIDENCE_PINS, MAX_CASE_MANUAL_TRAIL_EVENTS, MAX_CASE_OBSERVED_EFFECT_REVIEWS, MAX_CASE_SIGHTINGS, MAX_DECISION_PIN_REFERENCES, MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_LIMITATION_LENGTH, MAX_RESPONSE_LIMITATIONS, MAX_RESPONSE_RATIONALE_LENGTH, MAX_RESPONSE_RECIPIENT_LENGTH, MAX_RESPONSE_REFERENCE_LENGTH, MAX_RESPONSE_VALUE_LENGTH, MAX_TRAIL_TARGET_LENGTH, } from "../contracts/case-portability.mjs";
 const TRANSITION_EXPECTATIONS = new Set(CASE_TRANSITION_EXPECTATIONS);
 const DECISION_CONFIDENCE_LEVELS = new Set(CASE_DECISION_CONFIDENCE_LEVELS);
@@ -108,6 +111,8 @@ function normalizeEvidenceRelations(value, legacyIds, validIds) {
 }
 function normalizePin(raw, fallback, options = {}) {
     const item = record(raw);
+    if (item.infrastructureObservation !== undefined && options.sourceVersion != null && options.sourceVersion < 18)
+        throw new TypeError('Infrastructure observations require Case schema 18 or later.');
     const label = text(item.label, MAX_RESPONSE_LABEL_LENGTH);
     const value = text(item.value, MAX_RESPONSE_VALUE_LENGTH);
     if (!label || !value)
@@ -141,6 +146,8 @@ function normalizePin(raw, fallback, options = {}) {
             : null,
         limitations: limitations(item.limitations),
         createdAt,
+        ...(item.responseObject === undefined ? {} : { responseObject: readCaseResponseObject(item.responseObject, options.sourceVersion) }),
+        ...(item.infrastructureObservation === undefined ? {} : { infrastructureObservation: normalizeInfrastructureObservation(item.infrastructureObservation) }),
     };
     normalized.certificateObservation = options.allowCertificateObservation === false
         ? null
@@ -195,6 +202,8 @@ export function appendCaseEvidencePin(current, raw, now) {
 export function appendCaseEvidencePins(current, raw, now) {
     if (!Array.isArray(raw) || !raw.length)
         throw new Error('An evidence checkpoint requires at least one selected fact.');
+    if (raw.length > MAX_CASE_CHECKPOINT_FACTS)
+        throw new Error(`A checkpoint can retain at most ${MAX_CASE_CHECKPOINT_FACTS} selected facts. No evidence was saved.`);
     let output = [...current];
     let added = 0;
     for (const item of raw.slice(0, MAX_CASE_CHECKPOINT_FACTS)) {
@@ -240,6 +249,12 @@ export function normalizeCaseDecisions(raw, fallback, validPinIds, options = {})
         .sort((left, right) => Date.parse(left.createdAt) - Date.parse(right.createdAt))
         .slice(-MAX_CASE_DECISIONS);
 }
+/** Counts decisions, not links; references to pins no longer retained do not
+ * support a decision. Inputs have already passed their owning normalisers. */
+export function countEvidenceLinkedCaseDecisions(decisions, pins) {
+    const retainedPinIds = new Set(pins.map(pin => pin.id));
+    return decisions.filter(decision => decision.evidencePinIds.some(id => retainedPinIds.has(id))).length;
+}
 export function appendCaseDecision(current, raw, now, validPinIds) {
     if (current.length >= MAX_CASE_DECISIONS) {
         throw new Error(`A Case can retain at most ${MAX_CASE_DECISIONS} decisions. No existing decision was removed.`);

package/packages/cases/case-response-object.mjs

@@ -0,0 +1,119 @@
+// Explicit object scope, not ownership, collection or proof of remediation.
+import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
+import { OBJECT_RESPONSE_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { array, enumeration, exact, text } from "../evidence/artifact-structure.mjs";
+export const CASE_RESPONSE_OBJECT_KINDS = ['domain', 'hostname', 'page', 'redirect', 'advertisement', 'social_account', 'social_post', 'messaging', 'storefront', 'app', 'other'];
+export const CASE_RESPONSE_OBJECT_OUTCOMES = ['removed', 'restricted', 'suspended', 'delisted', 'warning', 'transferred', 'restored', 'disputed'];
+export const MAX_CASE_RESPONSE_OBJECT_IDENTIFIER = 1_979;
+export const MAX_CASE_RESPONSE_OBJECTS = 20;
+export function readCaseResponseObjects(value, sourceVersion) {
+    if (value === undefined)
+        return undefined;
+    if (sourceVersion != null && sourceVersion < OBJECT_RESPONSE_CASE_SCHEMA_VERSION)
+        throw new TypeError('Object-specific response scope requires Case schema 18 or later.');
+    const objects = array(value, 'Response objects', MAX_CASE_RESPONSE_OBJECTS).map(item => readCaseResponseObject(item, sourceVersion));
+    const keyed = objects.map(object => [JSON.stringify(object), object]);
+    if (new Set(keyed.map(([key]) => key)).size !== keyed.length)
+        throw new TypeError('Response objects must be unique.');
+    return Object.freeze(keyed.sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([, object]) => object));
+}
+/** Historical absence stays absent; a declared historical format cannot carry new fields. */
+export function readCaseResponseObject(value, sourceVersion) {
+    if (value === undefined)
+        return undefined;
+    if (sourceVersion != null && sourceVersion < OBJECT_RESPONSE_CASE_SCHEMA_VERSION)
+        throw new TypeError('Object-specific response scope requires Case schema 18 or later.');
+    const item = exact(value, ['kind', 'identifier', 'incidentTargetId'], 'Response object');
+    const kind = enumeration(item.kind, CASE_RESPONSE_OBJECT_KINDS, 'Response object kind');
+    const identifier = text(item.identifier, 'Response object identifier', MAX_CASE_RESPONSE_OBJECT_IDENTIFIER);
+    if (!identifier || identifier.trim() !== identifier || /[\u0000-\u001f\u007f]/u.test(identifier))
+        throw new TypeError('Response object identifier must be a bounded single-line value.');
+    const incidentTargetId = item.incidentTargetId === null ? null : text(item.incidentTargetId, 'Incident object identity', 64);
+    if (incidentTargetId !== null && !/^[A-Za-z0-9_-]{1,64}$/u.test(incidentTargetId))
+        throw new TypeError('Incident object identity is invalid.');
+    if (kind === 'domain' || kind === 'hostname') {
+        if (identifier !== identifier.toLowerCase() || !isValidAsciiHostname(identifier) || incidentTargetId !== null)
+            throw new TypeError('Domain and hostname scope require a normalised hostname and no incident-link identity.');
+    }
+    else {
+        let url;
+        try {
+            url = new URL(identifier);
+        }
+        catch {
+            throw new TypeError('Select an exact retained HTTP(S) incident link for this object.');
+        }
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.toString() !== identifier || !incidentTargetId)
+            throw new TypeError('Select an exact retained HTTP(S) incident link without credentials for this object.');
+    }
+    return Object.freeze({ kind, identifier, incidentTargetId });
+}
+export function readCaseResponseObjectOutcome(value, sourceVersion) {
+    if (value === undefined)
+        return undefined;
+    if (sourceVersion != null && sourceVersion < OBJECT_RESPONSE_CASE_SCHEMA_VERSION)
+        throw new TypeError('Object-specific outcomes require Case schema 18 or later.');
+    return enumeration(value, CASE_RESPONSE_OBJECT_OUTCOMES, 'Response object outcome');
+}
+export function sameCaseResponseObject(left, right) {
+    return left !== undefined && right !== undefined && left.kind === right.kind && left.identifier === right.identifier && left.incidentTargetId === right.incidentTargetId;
+}
+/** Explicit retained snapshots permit follow-up without retargeting edited links. */
+export function retainedCaseResponseObjects(record) {
+    const objects = [...(record.actions ?? []).flatMap(action => [...action.responseObjects ?? [], ...action.history.flatMap(event => event.responseObjects ?? [])]),
+        ...(record.observedEffects?.reviews ?? []).flatMap(review => review.responseObject ? [review.responseObject] : []),
+        ...(record.evidencePins ?? []).flatMap(pin => pin.responseObject ? [pin.responseObject] : []),
+        ...(record.closures?.records ?? []).flatMap(closure => closure.responseObject ? [closure.responseObject] : []),
+        ...(record.assertions ?? []).flatMap(assertion => assertion.recheck?.responseObject ? [assertion.recheck.responseObject] : [])];
+    return [...new Map(objects.map(object => [JSON.stringify(object), object])).values()];
+}
+/** New identities require current metadata; exact historical identities remain usable. */
+export function assertCaseResponseObject(object, record) {
+    if (!object)
+        return;
+    if (object.kind === 'domain') {
+        if (object.identifier !== record.domain)
+            throw new TypeError('The response domain must match this Case.');
+    }
+    else if (object.kind === 'hostname') {
+        if (object.identifier !== record.domain && !object.identifier.endsWith(`.${record.domain}`))
+            throw new TypeError('The response hostname must belong to this Case domain.');
+    }
+    else if (!record.workflowMetadata?.incidentTargets.some(target => target.id === object.incidentTargetId && target.url === object.identifier)
+        && !retainedCaseResponseObjects(record).some(retained => sameCaseResponseObject(retained, object))) {
+        throw new TypeError('The selected exact incident object changed or is not retained in this Case. Refresh and review it before saving.');
+    }
+}
+export function assertCaseObjectOutcome(outcome, object) {
+    if (!outcome)
+        return;
+    if (!object)
+        throw new TypeError('A typed object outcome requires explicit object scope.');
+    if (outcome === 'suspended' && object.kind !== 'domain')
+        throw new TypeError('Domain suspension requires domain scope.');
+    if (outcome === 'restricted' && object.kind !== 'social_account' && object.kind !== 'app' && object.kind !== 'other')
+        throw new TypeError('Account restriction requires account, app or explicitly other scope.');
+}
+export function caseResponseObjectChoices(record) {
+    const objects = [{ kind: 'domain', identifier: record.domain, incidentTargetId: null }];
+    const hosts = new Set([...(record.evidencePins ?? []).map(pin => pin.observationHostname), ...(record.evidenceHistory ?? []).map(snapshot => snapshot.inputHostname)].filter((value) => Boolean(value)));
+    for (const identifier of hosts)
+        if (identifier === record.domain || identifier.endsWith(`.${record.domain}`))
+            objects.push({ kind: 'hostname', identifier, incidentTargetId: null });
+    for (const target of record.workflowMetadata?.incidentTargets ?? [])
+        for (const kind of CASE_RESPONSE_OBJECT_KINDS.filter(kind => kind !== 'domain' && kind !== 'hostname'))
+            objects.push({ kind, identifier: target.url, incidentTargetId: target.id });
+    objects.push(...retainedCaseResponseObjects(record));
+    return [...new Map(objects.map(object => [JSON.stringify(object), object])).values()].map(object => {
+        const historical = Boolean(object.incidentTargetId && !record.workflowMetadata?.incidentTargets.some(target => target.id === object.incidentTargetId && target.url === object.identifier));
+        return { value: JSON.stringify(object), label: `${object.kind.replaceAll('_', ' ')} · ${object.identifier}${historical ? ' · historical / no current incident link' : ''}`, object };
+    });
+}
+export function selectedCaseResponseObject(record, value) {
+    if (!value)
+        return undefined;
+    const object = caseResponseObjectChoices(record).find(choice => choice.value === value)?.object;
+    if (!object)
+        throw new TypeError('The selected incident object changed. Refresh and review it before saving.');
+    return readCaseResponseObject(object);
+}

package/packages/cases/case-response-outcomes.mjs

@@ -1,7 +1,9 @@
 // Independent observed effects, linked closures and lifecycle summaries.
 import { MAX_CASE_CLOSURES, MAX_CASE_OBSERVED_EFFECT_REVIEWS, MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_RATIONALE_LENGTH, } from "../contracts/case-portability.mjs";
 import { latestObservationCohort, } from "../evidence/latest-observations.mjs";
-import { readCaseRecheckAnswerContext } from "./case-recheck-model.mjs";
+import { readCaseRecheckAnswerContext, assertRecheckNonReproduction, COMPARATIVE_CASE_OBJECT_OUTCOMES } from "./case-recheck-model.mjs";
+import { readCaseResponseObject, readCaseResponseObjectOutcome, assertCaseObjectOutcome, sameCaseResponseObject } from "./case-response-object.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { CASE_CLOSURE_REASONS, CASE_OBSERVED_EFFECT_SOURCE_CLASSES, CASE_OBSERVED_EFFECT_STATES, } from "./case-response-records.mjs";
 import { COMPLETENESS, SAFE_ID_RE, boundedCounter, compareCodeUnits, freshId, iso, lifecycleLimitations, limitations, optionalIso, record, safeId, text, } from "./case-response-values.mjs";
 const OBSERVED_EFFECT_STATES = new Set(CASE_OBSERVED_EFFECT_STATES);
@@ -19,6 +21,16 @@ function normalizeObservedEffectReview(raw, fallback, validPinIds, validSighting
         return null;
     const createdAt = iso(item.createdAt, observedAt || fallback, options);
     const recheck = readCaseRecheckAnswerContext(item.recheck, options.sourceVersion);
+    const responseObject = readCaseResponseObject(item.responseObject, options.sourceVersion);
+    const objectOutcome = readCaseResponseObjectOutcome(item.objectOutcome, options.sourceVersion);
+    assertCaseObjectOutcome(objectOutcome, responseObject);
+    if (objectOutcome && (item.state === 'unavailable' || item.state === 'not_checked'))
+        throw new TypeError('Unavailable or unchecked collection cannot establish an object outcome.');
+    if (objectOutcome && COMPARATIVE_CASE_OBJECT_OUTCOMES.includes(objectOutcome)
+        && (item.completeness !== 'complete' || !recheck?.responseObject || recheck.conditionsMatch !== 'comparable'))
+        throw new TypeError('An independently observed object state change requires complete evidence and comparable exact-object conditions.');
+    if (recheck?.responseObject && !sameCaseResponseObject(recheck.responseObject, responseObject))
+        throw new TypeError('The recheck answer and observation must concern the same exact object.');
     if (recheck && item.state === 'not_reproduced' && (item.completeness !== 'complete' || recheck.conditionsMatch !== 'comparable')) {
         throw new TypeError('A question cannot be marked not reproduced from incomplete evidence or unconfirmed comparison conditions.');
     }
@@ -50,6 +62,8 @@ function normalizeObservedEffectReview(raw, fallback, validPinIds, validSighting
         sightingId,
         followUpAt: optionalIso(item.followUpAt, options),
         ...(recheck ? { recheck } : {}),
+        ...(responseObject ? { responseObject } : {}),
+        ...(objectOutcome ? { objectOutcome } : {}),
         createdAt,
     };
 }
@@ -127,6 +141,7 @@ function normalizeClosure(raw, fallback, validReviewIds, validActionIds, options
     if (!summary)
         return null;
     const createdAt = iso(item.createdAt, fallback, options);
+    const responseObject = readCaseResponseObject(item.responseObject, options.sourceVersion);
     const observedEffectReviewId = typeof item.observedEffectReviewId === 'string'
         && SAFE_ID_RE.test(item.observedEffectReviewId)
         && (!validReviewIds || validReviewIds.has(item.observedEffectReviewId))
@@ -149,7 +164,8 @@ function normalizeClosure(raw, fallback, validReviewIds, validActionIds, options
         return null;
     const linkedProviderEvents = actionId ? linkContext.providerResolutionEvents?.get(actionId) ?? [] : [];
     if (linkContext.providerResolutionEvents && reason === 'provider_reported_resolution_not_independently_checked'
-        && !linkedProviderEvents.some((event) => Date.parse(event.occurredAt) <= Date.parse(createdAt)))
+        && !linkedProviderEvents.some((event) => Date.parse(event.occurredAt) <= Date.parse(createdAt)
+            && (responseObject ? event.responseObjects?.some(object => sameCaseResponseObject(object, responseObject)) : !event.responseObjects?.length)))
         return null;
     const linkLimitations = [
         ...(item.observedEffectReviewId != null && !observedEffectReviewId ? ['A malformed or dangling observed-effect review reference was omitted from this closure.'] : []),
@@ -157,6 +173,7 @@ function normalizeClosure(raw, fallback, validReviewIds, validActionIds, options
     ];
     return {
         id: safeId(item.id, 'case-closure', { reason: item.reason, summary, createdAt }),
+        ...(responseObject === undefined ? {} : { responseObject }),
         reason,
         summary,
         observedEffectReviewId,
@@ -173,8 +190,11 @@ export function buildCaseClosureLinkContext(observedEffects, actions) {
                 createdAt: review.createdAt,
             }])),
         providerResolutionEvents: new Map(actions.map((action) => [action.id, action.history
-                .filter((event) => event.applied && event.providerOutcome === 'provider_reports_resolved')
-                .map((event) => ({ eventId: event.id, occurredAt: event.occurredAt }))])),
+                // Reconciliation can change projection, but not the identity of a retained
+                // typed receipt supporting an already-authored historical decision.
+                .filter((event) => event.providerOutcome === 'provider_reports_resolved')
+                .map((event) => ({ eventId: event.id, occurredAt: event.occurredAt,
+                ...(event.responseObjects === undefined ? {} : { responseObjects: event.responseObjects }) }))])),
     };
 }
 export function normalizeCaseClosureHistory(raw, fallback, validReviewIds, validActionIds, options = {}, linkContext = {}) {
@@ -222,7 +242,82 @@ export function normalizeCaseClosureHistory(raw, fallback, validReviewIds, valid
         ]),
     };
 }
-export function appendCaseClosure(current, raw, now, observedEffects, actions) {
+/** New-write policy only. Historical normalisation must not re-adjudicate a closure. */
+export function caseClosureReviewBlocker(reason, review, now, responseObject, evidencePins = []) {
+    if (review?.responseObject && !sameCaseResponseObject(responseObject, review.responseObject))
+        return 'This independent review concerns one object. Select that object for closure; it cannot close the whole Case.';
+    if (reason !== 'independently_not_reproduced' && reason !== 'infrastructure_changed')
+        return null;
+    const expected = reason === 'independently_not_reproduced' ? 'not_reproduced' : 'changed';
+    const invalidLink = reason === 'independently_not_reproduced'
+        ? 'This closure reason requires a linked independent not-reproduced review.'
+        : 'This closure reason requires a linked independent changed review.';
+    if (!review || review.state !== expected)
+        return invalidLink;
+    if (responseObject) {
+        if (!sameCaseResponseObject(responseObject, review.responseObject))
+            return 'Object-specific technical closure requires a linked independent review explicitly bound to this exact object; historical missing binding remains unknown.';
+        if (!review.recheck || !sameCaseResponseObject(responseObject, review.recheck.responseObject))
+            return 'Object-specific technical closure requires a complete exact-object baseline and current review under comparable conditions.';
+        try {
+            assertRecheckNonReproduction('not_reproduced', review.recheck, review.completeness, evidencePins, evidencePins.find(pin => pin.id === review.evidencePinId), review.observedAt);
+        }
+        catch (cause) {
+            return cause instanceof Error ? cause.message : 'The exact-object review cannot support technical closure.';
+        }
+    }
+    const observedAt = normalizeExplicitIsoTimestamp(review.observedAt);
+    const createdAt = normalizeExplicitIsoTimestamp(review.createdAt);
+    const closedAt = normalizeExplicitIsoTimestamp(now);
+    if (!observedAt || !createdAt || !closedAt
+        || Date.parse(observedAt) > Date.parse(closedAt)
+        || Date.parse(createdAt) > Date.parse(closedAt))
+        return invalidLink;
+    if (reason === 'independently_not_reproduced') {
+        if (review.completeness !== 'complete')
+            return 'Independent non-reproduction closure requires a complete observation. Keep this limited review and collect or record a complete recheck.';
+        if (review.recheck && review.recheck.conditionsMatch !== 'comparable')
+            return 'Independent non-reproduction closure requires comparable recheck conditions.';
+    }
+    return null;
+}
+/** Latest applicable provider cohort, never the action-wide summary or an old receipt. */
+export function caseClosureProviderBlocker(action, responseObject, now) {
+    const blocked = 'This closure reason requires a linked typed provider-reported-resolution outcome for the latest applicable object observation.';
+    const closedAt = normalizeExplicitIsoTimestamp(now);
+    if (!action || !closedAt)
+        return blocked;
+    if (responseObject ? !action.responseObjects?.some(object => sameCaseResponseObject(object, responseObject)) : action.responseObjects?.length)
+        return blocked;
+    // A losing workflow transition is still retained evidence. Select the
+    // exact-object cohort before checking whether its receipts were applied.
+    const events = action.history.filter(event => (event.providerOutcome !== null || event.objectOutcome !== undefined)
+        && Date.parse(event.occurredAt) <= Date.parse(closedAt)
+        && (responseObject ? event.responseObjects?.some(object => sameCaseResponseObject(object, responseObject)) : !event.responseObjects?.length));
+    const cohort = latestObservationCohort(events, event => event.occurredAt);
+    if (!cohort.latest.length || cohort.undated.length || cohort.latest.some(event => !event.applied || event.providerOutcome !== 'provider_reports_resolved'
+        || event.objectOutcome === 'restored' || event.objectOutcome === 'disputed')
+        || new Set(cohort.latest.map(event => event.objectOutcome ?? null)).size !== 1)
+        return blocked;
+    return null;
+}
+export function caseClosureActionBlocker(reason, action, responseObject, now) {
+    if (action?.responseObjects?.length && (!responseObject || !action.responseObjects.some(object => sameCaseResponseObject(object, responseObject))))
+        return 'This action concerns explicitly bound objects. Select one of them for this closure; other objects remain independent.';
+    return reason === 'provider_reported_resolution_not_independently_checked' ? caseClosureProviderBlocker(action, responseObject, now) : null;
+}
+/** Derived presentation only: never rewrite the analyst's summary or limitations. */
+export function caseClosureHistoryQualification(closure, actions) {
+    if (closure.reason !== 'provider_reported_resolution_not_independently_checked')
+        return null;
+    const action = actions.find(candidate => candidate.id === closure.actionId);
+    // Evaluate the retained history, not a wall-clock freshness claim. Future-dated
+    // or conflicting receipts cannot silently make an old decision authoritative.
+    const latestAt = (action?.history ?? []).reduce((latest, event) => Date.parse(event.occurredAt) > Date.parse(latest) ? event.occurredAt : latest, closure.createdAt);
+    return caseClosureProviderBlocker(action, closure.responseObject, latestAt) === null ? null
+        : 'As of the latest retained receipt, provider history does not support a new closure for this scope. This historical analyst decision is preserved; it does not establish current remediation.';
+}
+export function appendCaseClosure(current, raw, now, observedEffects, actions, evidencePins = []) {
     const item = record(raw);
     const reason = typeof item.reason === 'string' && CLOSURE_REASONS.has(item.reason)
         ? item.reason
@@ -233,21 +328,13 @@ export function appendCaseClosure(current, raw, now, observedEffects, actions) {
     const action = typeof item.actionId === 'string'
         ? actions.find((candidate) => candidate.id === item.actionId) ?? null
         : null;
-    if (reason === 'independently_not_reproduced'
-        && (review?.state !== 'not_reproduced' || Date.parse(review.observedAt) > Date.parse(now) || Date.parse(review.createdAt) > Date.parse(now))) {
-        throw new Error('This closure reason requires a linked independent not-reproduced review.');
-    }
-    if (reason === 'infrastructure_changed'
-        && (review?.state !== 'changed' || Date.parse(review.observedAt) > Date.parse(now) || Date.parse(review.createdAt) > Date.parse(now))) {
-        throw new Error('This closure reason requires a linked independent changed review.');
-    }
-    if (reason === 'provider_reported_resolution_not_independently_checked'
-        && (action?.providerOutcome !== 'provider_reports_resolved'
-            || !action.history.some((event) => event.applied
-                && event.providerOutcome === 'provider_reports_resolved'
-                && Date.parse(event.occurredAt) <= Date.parse(now)))) {
-        throw new Error('This closure reason requires a linked typed provider-reported-resolution outcome.');
-    }
+    const responseObject = readCaseResponseObject(item.responseObject);
+    const reviewBlocker = caseClosureReviewBlocker(reason, review, now, responseObject, evidencePins);
+    if (reviewBlocker)
+        throw new Error(reviewBlocker);
+    const actionBlocker = caseClosureActionBlocker(reason, action, responseObject, now);
+    if (actionBlocker)
+        throw new Error(actionBlocker);
     const linkContext = buildCaseClosureLinkContext(observedEffects, actions);
     const created = normalizeClosure({ ...item, id: freshId('case-closure'), createdAt: now }, now, new Set(observedEffects.reviews.map((candidate) => candidate.id)), new Set(actions.map((candidate) => candidate.id)), {}, linkContext);
     if (!created || !reason)
@@ -293,6 +380,7 @@ export function buildCaseResponseLifecycleSummary(input) {
         ? 'missing'
         : latestObservedChangeAt ? 'available' : 'ambiguous';
     const latestClosure = [...(input.closures?.records ?? [])]
+        .filter(closure => closure.responseObject === undefined)
         .sort((left, right) => Date.parse(right.createdAt) - Date.parse(left.createdAt) || compareCodeUnits(right.id, left.id))[0] ?? null;
     return {
         providerOutcomeState,