@slicedearth/whoisleuth-cli 2.5.1 → 2.7.0

package/packages/cases/case-record-projection.mjs

@@ -1,5 +1,20 @@
-import { PUBLIC_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { COLLECTION_RECEIPT_CASE_SCHEMA_VERSION, PUBLIC_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION, MAX_CASE_IMPORT_BYTES } from "../contracts/case-portability.mjs";
 import { caseStatusIsClosed } from "./case-record-decisions.mjs";
+import { caseEvidenceWithoutCollectionReceipts } from "./case-evidence-model.mjs";
+import { assertBoundedJsonStructure, boundedJsonLimitsForBytes, scanBoundedJson } from "../analysis/bounded-json.mjs";
+/** Check the whole shared envelope, including otherwise unrecognised nesting.
+ * Writer projection alone cannot enforce the audience of an imported pack. */
+export function assertCaseCollectionReceiptAudience(root, audience) {
+    if (audience === 'internal')
+        return;
+    const limits = boundedJsonLimitsForBytes(MAX_CASE_IMPORT_BYTES);
+    assertBoundedJsonStructure(root, 'Shared Case pack', limits);
+    scanBoundedJson(JSON.stringify(root), limits, entry => {
+        if (entry.kind === 'key' && (entry.value === 'collectionReceipt' || entry.value === 'checkpointCollectionReceipts')) {
+            throw new TypeError('Shared Case packs cannot contain private collection receipts.');
+        }
+    });
+}
 const PRESERVE = Object.freeze({
     durable: 'preserve', internal: 'preserve', trusted: 'preserve', public: 'preserve',
 });
@@ -101,16 +116,38 @@ const CASE_FIELD_RULES = Object.freeze({
         },
     }),
     source: preservedField('source'),
-    evidenceHistory: fieldRule('evidenceHistory', PRESERVE, (record) => structuredClone(record.evidenceHistory)),
-    evidencePins: fieldRule('evidencePins', PRESERVE, (record) => structuredClone(record.evidencePins)),
+    evidenceHistory: fieldRule('evidenceHistory', SHARED_REDACT, (record, profile) => (profile === 'trusted' || profile === 'public'
+        ? caseEvidenceWithoutCollectionReceipts(record) : structuredClone(record.evidenceHistory)), {
+        nestedSensitiveFields: ['collectionReceipt'],
+        audienceExclusions: {
+            trusted: { label: 'Private collection receipts', order: 4, sinceVersion: COLLECTION_RECEIPT_CASE_SCHEMA_VERSION },
+            public: { label: 'Private collection receipts', order: 4, sinceVersion: COLLECTION_RECEIPT_CASE_SCHEMA_VERSION },
+        },
+    }),
+    evidencePins: fieldRule('evidencePins', PUBLIC_REDACT, (record, profile) => structuredClone(record.evidencePins).map(pin => {
+        if (profile !== 'public')
+            return pin;
+        const { responseObject: _scope, infrastructureObservation: _infrastructure, ...publicPin } = pin;
+        return publicPin;
+    }), { nestedSensitiveFields: ['responseObject', 'infrastructureObservation'], audienceExclusions: { public: { label: 'Exact-object evidence scope and infrastructure observations', order: 4, sinceVersion: 18 } } }),
+    checkpointCollectionReceipts: fieldRule('checkpointCollectionReceipts', SHARED_EXCLUDE, (record, profile) => (profile === 'trusted' || profile === 'public' ? undefined : structuredClone(record.checkpointCollectionReceipts)), { audienceExclusions: {
+            trusted: { label: 'Private collection receipts', order: 4, sinceVersion: COLLECTION_RECEIPT_CASE_SCHEMA_VERSION },
+            public: { label: 'Private collection receipts', order: 4, sinceVersion: COLLECTION_RECEIPT_CASE_SCHEMA_VERSION },
+        } }),
     evidenceLinks: fieldRule('evidenceLinks', PUBLIC_EXCLUDE, (record, profile) => (profile === 'public' ? undefined : structuredClone(record.evidenceLinks)), { audienceExclusions: { public: { label: 'Analyst evidence relationships', order: 4, sinceVersion: EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION } } }),
     decisions: fieldRule('decisions', PRESERVE, (record) => structuredClone(record.decisions)),
     actions: fieldRule('actions', TRUSTED_REDACT_PUBLIC_EXCLUDE, (record, profile) => (profile === 'public'
         ? []
         : profile === 'trusted'
-            ? structuredClone(record.actions).map((item) => ({ ...item, recipient: '[redacted]' }))
+            ? structuredClone(record.actions).map((item) => {
+                const { correction: _privateCorrection, ...shared } = item;
+                return { ...shared, recipient: '[redacted]', history: shared.history.map(event => {
+                        const { packetReceipt: _privateReceipt, ...sharedEvent } = event;
+                        return sharedEvent;
+                    }) };
+            })
             : structuredClone(record.actions)), {
-        nestedSensitiveFields: ['recipient'],
+        nestedSensitiveFields: ['recipient', 'responseObjects', 'correction', 'packetReceipt'],
         audienceExclusions: {
             trusted: { label: 'Recipient values', order: 2 },
             public: { label: 'Actions and recipient values', order: 3 },
@@ -191,6 +228,7 @@ const OUTSIDE_SCHEMA_EXCLUSIONS = Object.freeze({
 });
 function currentAudienceExclusions(audience, caseVersion) {
     const entries = [
+        ...(audience === 'trusted' && caseVersion >= 19 ? [{ label: 'Private correction content and exact delivery receipts', order: 2 }] : []),
         ...Object.values(CASE_FIELD_RULES).flatMap((rule) => (rule.audienceExclusions[audience] ? [rule.audienceExclusions[audience]] : [])),
         OUTSIDE_SCHEMA_EXCLUSIONS[audience],
     ];

package/packages/cases/case-record-version-input.mjs

@@ -1,7 +1,29 @@
-import { EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, PUBLISHED_V2_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION, } from "../contracts/case-portability.mjs";
+import { EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, PUBLISHED_V2_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION, OBJECT_RESPONSE_CASE_SCHEMA_VERSION, DELIVERY_CORRECTION_CASE_SCHEMA_VERSION, } from "../contracts/case-portability.mjs";
 /** Adapt declared historical fields before ordinary current-record recovery. */
 export function caseRecordVersionInput(record, sourceVersion) {
     const declared = sourceVersion != null;
+    if (declared && sourceVersion < DELIVERY_CORRECTION_CASE_SCHEMA_VERSION && Array.isArray(record.actions)
+        && record.actions.some(action => action && typeof action === 'object' && (action.correction !== undefined
+            || Array.isArray(action.history) && action.history.some((event) => event?.packetReceipt !== undefined)))) {
+        throw new TypeError('Delivery receipts and corrections require Case schema 19; historical deliveries were not reinterpreted.');
+    }
+    if (declared && sourceVersion < OBJECT_RESPONSE_CASE_SCHEMA_VERSION) {
+        const items = (value) => Array.isArray(value) ? value.filter((item) => !!item && typeof item === 'object' && !Array.isArray(item)) : [];
+        const object = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+        const pins = items(record.evidencePins);
+        const actions = items(record.actions);
+        const reviews = items(object(record.observedEffects).reviews);
+        const closures = items(object(record.closures).records);
+        const questions = [...items(record.assertions), ...reviews].map(item => object(item.recheck));
+        const events = actions.flatMap(action => items(action.history));
+        if (pins.some(pin => pin.responseObject !== undefined || pin.infrastructureObservation !== undefined)
+            || actions.some(action => action.responseObjects !== undefined)
+            || events.some(event => event.responseObjects !== undefined || event.objectOutcome !== undefined)
+            || [...reviews, ...closures, ...questions].some(item => item.responseObject !== undefined || item.objectOutcome !== undefined)
+            || [...items(record.evidenceHistory), object(record.evidence)].some(snapshot => snapshot.hasExternalPasswordForm !== undefined)) {
+            throw new TypeError('Object response and password-form attribution fields require Case schema 18; historical evidence was not reinterpreted.');
+        }
+    }
     if (record.evidenceLinks !== undefined && declared && sourceVersion < EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION) {
         throw new TypeError('Evidence relationships require the current Case schema.');
     }

package/packages/cases/case-report.mjs

@@ -8,15 +8,19 @@
 // contains raw RDAP/WHOIS material. This module deliberately excludes all raw
 // registry/web responses, contacts, cookies, screenshots, and authentication
 // data. Reports contain only the normalized case record.
-import { caseEvidenceTimeline, compareCaseEvidence, currentCaseEvidence, publishedCaseEvidenceTimelineForVerification } from "./case-evidence-model.mjs";
+import { caseEvidenceTimeline, caseEvidenceWithoutCollectionReceipts, compareCaseEvidence, currentCaseEvidence, publishedCaseEvidenceTimelineForVerification } from "./case-evidence-model.mjs";
 import { httpSecurityHeaderLabel } from "./http-summary.mjs";
 import { webCollectionScoreLimitation } from "../evidence/collection-quality.mjs";
 import { analystInteroperabilityTags } from "../analysis/analyst-taxonomy.mjs";
 import { caseEvidenceLinkIssues } from "./case-evidence-links.mjs";
-import { caseTypeSummary } from "./case-workflow-metadata.mjs";
+import { caseTypeSummary } from "./case-type-presentation.mjs";
+import { caseClosureHistoryQualification } from "./case-response-outcomes.mjs";
 import { buildPortableGeneratorMetadata, portableGeneratorAttribution, } from "../analysis/portable-generator.mjs";
 import { buildCaseResponseLifecycleSummary, CASE_EVIDENCE_RELATION_STANCES } from "./case-response-model.mjs";
 import { normalizeCaseBrandProfileIds } from "./case-brand-profile-references.mjs";
+import { EVIDENCE_FOLLOW_UP_CASE_REPORT_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { OBJECT_RESPONSE_CASE_REPORT_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { CASE_DELIVERY_RECEIPT_LIMITATION } from "./case-packet-correction.mjs";
 import { CASE_RECHECK_CONDITIONS } from "./case-recheck-model.mjs";
 import { escapeCaseMarkdownInline as escapeMarkdownInline } from "./case-markdown.mjs";
 import { CASE_REPORT_SCHEMA, CASE_REPORT_SCHEMA_VERSION, LATEST_PUBLIC_CASE_REPORT_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_REPORT_SCHEMA_VERSION, } from "../contracts/case-portability.mjs";
@@ -145,6 +149,7 @@ function pickKnownSnapshotFields(snapshot) {
         reusesOfficialAssets: snapshot.reusesOfficialAssets,
         hasPasswordField: snapshot.hasPasswordField,
         hasExternalFormAction: snapshot.hasExternalFormAction,
+        ...(snapshot.hasExternalPasswordForm === undefined ? {} : { hasExternalPasswordForm: snapshot.hasExternalPasswordForm }),
         phishingLanguageMatch: snapshot.phishingLanguageMatch,
         privacyProtected: snapshot.privacyProtected ?? null,
         idnReferenceMatch: snapshot.idnReferenceMatch ?? null,
@@ -173,9 +178,10 @@ export function buildCaseReport(caseRecord, options = {}) {
     const now = generatedAt || new Date().toISOString();
     const generator = buildPortableGeneratorMetadata(options.applicationVersion);
     // --- Build JSON report ---
-    const timeline = caseEvidenceTimeline(caseRecord.evidenceHistory);
+    const sharedEvidence = { ...caseRecord, evidenceHistory: caseEvidenceWithoutCollectionReceipts(caseRecord) };
+    const timeline = caseEvidenceTimeline(sharedEvidence.evidenceHistory);
     const timelineEntries = projectReportTimeline(timeline);
-    const selection = currentCaseEvidence(caseRecord);
+    const selection = currentCaseEvidence(sharedEvidence);
     const latest = selection.snapshot;
     const currentAssessment = latest ? pickKnownSnapshotFields(latest) : null;
     const responseLifecycle = buildCaseResponseLifecycleSummary(caseRecord);
@@ -279,6 +285,10 @@ export function buildCaseReportVerificationProjection(caseRecord, options, schem
     const generated = buildCaseReport(caseRecord, options).json;
     if (schemaVersion === CASE_REPORT_SCHEMA_VERSION)
         return generated;
+    if (schemaVersion === OBJECT_RESPONSE_CASE_REPORT_SCHEMA_VERSION)
+        return { ...generated, schemaVersion };
+    if (schemaVersion === EVIDENCE_FOLLOW_UP_CASE_REPORT_SCHEMA_VERSION)
+        return { ...generated, schemaVersion };
     if (caseRecord.evidenceHistory.some(snapshot => snapshot.webCollectionQuality !== undefined)) {
         throw new TypeError('Published report formats cannot declare newer collection-quality fields.');
     }
@@ -499,6 +509,8 @@ function buildMarkdown(report, includeAttribution) {
         for (const pin of response.evidencePins) {
             lines.push(`- **${escapeMarkdownInline(pin.label)}:** ${escapeMarkdownInline(pin.value)}`);
             lines.push(`  Source: ${escapeMarkdownInline(pin.source)}; observed ${escapeMarkdownInline(pin.observedAt ?? 'Time unavailable')}; completeness ${escapeMarkdownInline(pin.completeness)}.`);
+            if (pin.responseObject)
+                lines.push(`  Exact object: ${escapeMarkdownInline(pin.responseObject.kind)} · ${escapeMarkdownInline(pin.responseObject.identifier)}`);
             if (pin.limitations.length)
                 lines.push(`  Limitations: ${escapeMarkdownInline(pin.limitations.join('; '))}`);
         }
@@ -587,6 +599,7 @@ function buildMarkdown(report, includeAttribution) {
         for (const action of response.actions) {
             lines.push(`- **${escapeMarkdownInline(action.type.replaceAll('_', ' '))}:** ${escapeMarkdownInline(action.recipient)} (${escapeMarkdownInline(action.state)})`);
             lines.push(`  Contact source: ${escapeMarkdownInline(action.contactSource)}; updated ${escapeMarkdownInline(action.updatedAt)}.`);
+            lines.push(`  Object binding: ${action.responseObjects?.length ? action.responseObjects.map(object => `${escapeMarkdownInline(object.kind)} · ${escapeMarkdownInline(object.identifier)}`).join('; ') : 'Unknown; historical or unbound actions do not establish exact-object coverage.'}`);
             if (action.routeObservedAt)
                 lines.push(`  Route reviewed: ${escapeMarkdownInline(action.routeObservedAt)}`);
             if (action.routeReviewAfter)
@@ -595,6 +608,8 @@ function buildMarkdown(report, includeAttribution) {
                 lines.push(`  Originating action: ${escapeMarkdownInline(action.originActionId)}`);
             if (action.amendment)
                 lines.push(`  Amendment of submitted packet SHA-256: ${action.amendment.packetDigestSha256}; request events: ${action.amendment.requestEventIds.map(escapeMarkdownInline).join(', ')}`);
+            if (action.correction)
+                lines.push(`  ${action.correction.purpose === 'correction' ? 'Correction request' : 'Retraction request'} for delivery event ${escapeMarkdownInline(action.correction.deliveryEventId)}; packet v${action.correction.packetVersion} SHA-256: ${action.correction.packetDigestSha256}`, `  Reason: ${escapeMarkdownInline(action.correction.reason)}`, `  Previous statement: ${escapeMarkdownInline(action.correction.previousStatement)}`, `  Corrected statement: ${escapeMarkdownInline(action.correction.correctedStatement || 'Request to retract the previous statement')}`, `  Corrected evidence pins: ${action.correction.evidencePinIds.map(escapeMarkdownInline).join(', ')}`, '  Preparation is not delivery, recipient acceptance, restoration or independent recheck.');
             for (const event of action.history)
                 if (event.evidenceRequest) {
                     const request = event.evidenceRequest;
@@ -616,8 +631,14 @@ function buildMarkdown(report, includeAttribution) {
                 lines.push(`  - ${escapeMarkdownInline(event.occurredAt)} · ${escapeMarkdownInline(event.previousState ?? 'none')} → ${escapeMarkdownInline(event.nextState)} · ${escapeMarkdownInline(event.sourceClass)} · ${event.applied ? 'applied' : 'retained conflict'}`);
                 if (event.providerOutcome)
                     lines.push(`    Provider outcome at this time: ${escapeMarkdownInline(event.providerOutcome.replaceAll('_', ' '))}`);
+                if (event.responseObjects?.length)
+                    lines.push(`    Objects at this event: ${event.responseObjects.map(object => `${escapeMarkdownInline(object.kind)} · ${escapeMarkdownInline(object.identifier)}`).join('; ')}`);
+                if (event.objectOutcome)
+                    lines.push(`    Source-reported object outcome: ${escapeMarkdownInline(event.objectOutcome)}; not independent verification or causation.`);
                 if (event.reference)
                     lines.push(`    Event reference: ${escapeMarkdownInline(event.reference)}`);
+                if (event.packetReceipt)
+                    lines.push(`    Retained packet v${event.packetReceipt.packetVersion}: ${event.packetReceipt.packetDigestSha256}; recipient ${escapeMarkdownInline(event.packetReceipt.recipient)}; audience ${escapeMarkdownInline(event.packetReceipt.profile)}; generated ${event.packetReceipt.packetGeneratedAt}`, `    ${CASE_DELIVERY_RECEIPT_LIMITATION}`);
                 if (event.evidencePinId)
                     lines.push(`    Evidence pin: ${escapeMarkdownInline(event.evidencePinId)}`);
                 if (event.limitations.length)
@@ -667,6 +688,10 @@ function buildMarkdown(report, includeAttribution) {
         lines.push('- No independent observed-effect review recorded.');
     for (const review of response.observedEffects.reviews) {
         lines.push(`- **${escapeMarkdownInline(review.state.replaceAll('_', ' '))}** (${escapeMarkdownInline(review.observedAt)}): ${escapeMarkdownInline(review.source)}; class ${escapeMarkdownInline(review.sourceClass)}; completeness ${escapeMarkdownInline(review.completeness)}.`);
+        if (review.responseObject)
+            lines.push(`  Exact object: ${escapeMarkdownInline(review.responseObject.kind)} · ${escapeMarkdownInline(review.responseObject.identifier)}`);
+        if (review.objectOutcome)
+            lines.push(`  Independently recorded object outcome: ${escapeMarkdownInline(review.objectOutcome)}; point-in-time observation, not report causation or recurrence.`);
         if (review.recheck) {
             lines.push(`  Question ${escapeMarkdownInline(review.recheck.questionId)}: ${escapeMarkdownInline(review.recheck.question)}`);
             lines.push(`  Recheck target: ${escapeMarkdownInline(review.recheck.targetHostname)}; retained comparison conditions: ${escapeMarkdownInline(review.recheck.conditions)}`);
@@ -689,13 +714,19 @@ function buildMarkdown(report, includeAttribution) {
         lines.push('- No deliberate analyst closure recorded.');
     for (const closure of response.closures.records) {
         lines.push(`- **Closure · ${escapeMarkdownInline(closure.reason.replaceAll('_', ' '))}** (${escapeMarkdownInline(closure.createdAt)}): ${escapeMarkdownInline(closure.summary)}`);
+        lines.push(`  Scope: ${closure.responseObject ? `${escapeMarkdownInline(closure.responseObject.kind)} · ${escapeMarkdownInline(closure.responseObject.identifier)}; other objects and the Case remain independent.` : 'Whole Case analyst decision.'}`);
         if (closure.observedEffectReviewId)
             lines.push(`  Independent review: ${escapeMarkdownInline(closure.observedEffectReviewId)}`);
         if (closure.actionId)
             lines.push(`  Provider action: ${escapeMarkdownInline(closure.actionId)}`);
+        const qualification = caseClosureHistoryQualification(closure, response.actions);
+        if (qualification)
+            lines.push(`  History qualification: ${escapeMarkdownInline(qualification)}`);
         if (closure.limitations.length)
             lines.push(`  Limitations: ${escapeMarkdownInline(closure.limitations.join('; '))}`);
     }
+    if (response.closures.omitted)
+        lines.push(`- Closure records not retained: ${response.closures.omitted}. ${escapeMarkdownInline(response.closures.limitations.join('; '))}`);
     lines.push('');
     // Analyst notes (only when included)
     if (report.case.notesIncluded && Array.isArray(report.case.notes) && report.case.notes.length > 0) {

package/packages/cases/case-requested-evidence.mjs

@@ -57,7 +57,7 @@ export function assertEvidenceRequestEvent(request, event) {
 export function submittedPacketReceipts(action) {
     return action.history.flatMap(event => {
         const match = /^response-packet-sha256:([a-f0-9]{64})$/u.exec(event.reference ?? '');
-        return event.applied && event.previousState === 'authorised' && event.nextState === 'submitted'
+        return event.applied && ['authorised', 'submitted'].includes(event.previousState ?? '') && event.nextState === 'submitted'
             && event.sourceClass === 'analyst' && match
             ? [{ eventId: event.id, digestSha256: match[1], occurredAt: event.occurredAt }] : [];
     });

package/packages/cases/case-response-actions.mjs

@@ -1,8 +1,10 @@
 // Append-only response actions: transitions, reconciliation and bounded history.
 import { readCaseEvidenceRequest, readCasePacketAmendment, assertEvidenceRequestEvent, assertEvidenceRequestHistory, assertEvidenceRequestTransition, assertPacketAmendment } from "./case-requested-evidence.mjs";
+import { readCaseDeliveryPacketReceipt, readCasePacketCorrection, assertDeliveryPacketReceipt, correctionDelivery } from "./case-packet-correction.mjs";
 import { MAX_INTAKE_LINKS, MAX_MESSAGE_PARTS } from "../contracts/message-intake.mjs";
 import { emailRecipient } from "../evidence/email-recipient.mjs";
 import { responseRouteFreshness } from "./response-route-freshness.mjs";
+import { readCaseResponseObjects, readCaseResponseObjectOutcome, assertCaseObjectOutcome, sameCaseResponseObject } from "./case-response-object.mjs";
 import { CASE_SCHEMA_VERSION, MAX_CASE_ACTIONS, MAX_CASE_ACTION_BYTES, MAX_CASE_ACTION_EVENTS_PER_ACTION, MAX_CASE_ACTION_EVENTS_PER_CASE, MAX_CASE_ACTION_HISTORY_BYTES_PER_CASE, MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_RATIONALE_LENGTH, MAX_RESPONSE_RECIPIENT_LENGTH, MAX_RESPONSE_REFERENCE_LENGTH, } from "../contracts/case-portability.mjs";
 import { normalizeExplicitIsoTimestamp, } from "../evidence/observation.mjs";
 import { CASE_ACTION_EVENT_SOURCE_CLASSES, CASE_ACTION_STATES, CASE_ACTION_TYPES, CASE_PROVIDER_OUTCOMES, } from "./case-response-records.mjs";
@@ -160,6 +162,12 @@ function normalizeActionEvent(raw, actionId, options = {}) {
     if (item.evidenceRequest !== undefined && options.sourceVersion != null && options.sourceVersion < 17)
         throw new Error('Requested evidence requires Case schema 17.');
     const evidenceRequest = readCaseEvidenceRequest(item.evidenceRequest);
+    if (item.packetReceipt !== undefined && options.sourceVersion != null && options.sourceVersion < 19)
+        throw new TypeError('Delivery receipts require Case schema 19.');
+    const packetReceipt = readCaseDeliveryPacketReceipt(item.packetReceipt);
+    assertDeliveryPacketReceipt(packetReceipt, { previousState, nextState, sourceClass, occurredAt,
+        reference: typeof item.reference === 'string' ? item.reference : null,
+        responseObjects: readCaseResponseObjects(item.responseObjects, options.sourceVersion) }, actionId);
     assertEvidenceRequestEvent(evidenceRequest, { previousState, nextState, sourceClass, providerOutcome: item.providerOutcome });
     const providerOutcome = typeof item.providerOutcome === 'string' && PROVIDER_OUTCOMES.has(item.providerOutcome)
         ? item.providerOutcome
@@ -189,7 +197,10 @@ function normalizeActionEvent(raw, actionId, options = {}) {
         : null;
     const eventMaterial = {
         previousState,
+        ...(item.responseObjects === undefined ? {} : { responseObjects: readCaseResponseObjects(item.responseObjects, options.sourceVersion) }),
+        ...(item.objectOutcome === undefined ? {} : { objectOutcome: readCaseResponseObjectOutcome(item.objectOutcome, options.sourceVersion) }),
         ...(evidenceRequest ? { evidenceRequest } : {}),
+        ...(packetReceipt ? { packetReceipt } : {}),
         nextState,
         occurredAt,
         sourceClass,
@@ -206,6 +217,16 @@ function normalizeActionEvent(raw, actionId, options = {}) {
             ? item.originActionId
             : null,
     };
+    if (eventMaterial.objectOutcome) {
+        if (!['submitted', 'acknowledged', 'terminal'].includes(nextState) || previousState === 'authorised')
+            throw new TypeError('Object outcomes require a separate attributed event after submission.');
+        if (sourceClass !== 'provider' && sourceClass !== 'analyst')
+            throw new TypeError('Object outcomes require an attributed provider or analyst event.');
+        if (!eventMaterial.responseObjects?.length)
+            throw new TypeError('Select the objects concerned by this provider outcome; no complete-action resolution is inferred.');
+        for (const object of eventMaterial.responseObjects)
+            assertCaseObjectOutcome(eventMaterial.objectOutcome, object);
+    }
     return {
         id: safeId(item.id, 'action-event', { actionId, ...eventMaterial }),
         ...eventMaterial,
@@ -373,6 +394,11 @@ function normalizeAction(raw, fallback, options = {}) {
     if (item.amendment !== undefined && options.sourceVersion != null && options.sourceVersion < 17)
         throw new Error('Packet amendments require Case schema 17.');
     const amendment = readCasePacketAmendment(item.amendment);
+    if (item.correction !== undefined && options.sourceVersion != null && options.sourceVersion < 19)
+        throw new TypeError('Packet corrections require Case schema 19.');
+    const correction = readCasePacketCorrection(item.correction);
+    if (correction && amendment)
+        throw new TypeError('Self-initiated correction and provider-request amendment are separate purposes.');
     const applied = history.history.filter((event) => event.applied);
     const latestReference = [...applied].reverse().find((event) => event.reference)?.reference ?? null;
     const latestProviderOutcome = [...applied].reverse().find((event) => event.providerOutcome) ?? null;
@@ -387,7 +413,9 @@ function normalizeAction(raw, fallback, options = {}) {
         : null;
     return {
         id: actionId,
+        ...(item.responseObjects === undefined ? {} : { responseObjects: readCaseResponseObjects(item.responseObjects, options.sourceVersion) }),
         ...(amendment ? { amendment } : {}),
+        ...(correction ? { correction } : {}),
         type: legacyPlatformReview
             ? 'platform_report'
             : typeof item.type === 'string' && ACTION_TYPES.has(item.type)
@@ -575,9 +603,14 @@ export function appendCaseAction(current, raw, now) {
     const amendment = readCasePacketAmendment(item.amendment);
     if (amendment)
         assertPacketAmendment(current, originActionId, amendment);
+    const correction = readCasePacketCorrection(item.correction);
+    if (correction)
+        correctionDelivery(current, { originActionId, correction,
+            recipient: text(item.recipient, MAX_RESPONSE_RECIPIENT_LENGTH), responseObjects: readCaseResponseObjects(item.responseObjects) });
     const history = [{
             id: freshId('action-event'),
             previousState: null,
+            ...(item.responseObjects === undefined ? {} : { responseObjects: readCaseResponseObjects(item.responseObjects) }),
             nextState: 'drafting',
             occurredAt: now,
             sourceClass: 'analyst',
@@ -602,11 +635,22 @@ export function appendCaseAction(current, raw, now) {
         throw new Error('An action requires a recipient or internal owner.');
     return normalizeCaseActions([...current, created], now, { sourceVersion: CASE_SCHEMA_VERSION });
 }
+export function providerOutcomeRequiresObjectScope(outcome) {
+    return outcome === 'provider_reports_resolved' || outcome === 'partially_remediated';
+}
 export function appendCaseActionTransition(current, actionId, raw, now, validPinIds) {
     const action = current.find((item) => item.id === actionId);
     if (!action)
         throw new Error('That case action no longer exists.');
     const item = record(raw);
+    const selectedObjects = readCaseResponseObjects(item.responseObjects);
+    const outcome = readCaseResponseObjectOutcome(item.objectOutcome);
+    if (selectedObjects?.some(object => !action.responseObjects?.some(bound => sameCaseResponseObject(bound, object))))
+        throw new TypeError('A transition may concern only objects explicitly bound to its action.');
+    if (outcome && !selectedObjects?.length)
+        throw new TypeError('Explicitly select the affected objects for this outcome; it is not applied to every action object.');
+    if (action.responseObjects?.length && providerOutcomeRequiresObjectScope(item.providerOutcome) && !selectedObjects?.length)
+        throw new TypeError('Explicitly select the objects covered by this provider-reported outcome; other action objects remain unchecked.');
     const nextState = typeof item.nextState === 'string' && ACTION_STATES.has(item.nextState)
         ? item.nextState
         : null;
@@ -637,9 +681,18 @@ export function appendCaseActionTransition(current, actionId, raw, now, validPin
     if (action.amendment && ['ready_for_review', 'reviewed', 'authorised', 'submitted'].includes(nextState)) {
         assertPacketAmendment(current, action.originActionId, action.amendment);
     }
+    if (action.correction && ['ready_for_review', 'reviewed', 'authorised', 'submitted'].includes(nextState))
+        correctionDelivery(current, action);
+    const packetReceipt = readCaseDeliveryPacketReceipt(item.packetReceipt);
+    if (packetReceipt && (packetReceipt.recipient !== action.recipient
+        || JSON.stringify(packetReceipt.responseObjects) !== JSON.stringify(action.responseObjects ?? [])))
+        throw new TypeError('The delivered packet receipt no longer matches this action recipient or scope.');
+    if (action.correction && nextState === 'submitted' && !packetReceipt)
+        throw new TypeError('Record the separately prepared correction packet receipt only after actual delivery.');
     const occurredAt = optionalIso(item.occurredAt) ?? now;
     const event = normalizeActionEvent({
         ...item,
+        ...(selectedObjects !== undefined ? { responseObjects: selectedObjects } : action.responseObjects === undefined ? {} : { responseObjects: action.responseObjects }),
         id: freshId('action-event'),
         previousState: action.state,
         nextState,
@@ -658,7 +711,7 @@ export function appendCaseActionTransition(current, actionId, raw, now, validPin
     return normalizeCaseActions(current.map((candidate) => candidate.id === actionId ? updated : candidate), now, currentActionNormalizationOptions(validPinIds));
 }
 const ACTION_REVIEW_MATERIAL_FIELDS = [
-    'type', 'recipient', 'contactSource', 'routeObservedAt', 'routeReviewAfter', 'contactLimitations', 'originActionId', 'amendment',
+    'type', 'recipient', 'contactSource', 'routeObservedAt', 'routeReviewAfter', 'contactLimitations', 'originActionId', 'amendment', 'correction', 'responseObjects',
 ];
 export function updateCaseAction(current, raw, now, validPinIds) {
     const patch = record(raw);
@@ -689,6 +742,8 @@ export function updateCaseAction(current, raw, now, validPinIds) {
         .some((key) => Object.hasOwn(patch, key) && JSON.stringify(record(existing)[key]) !== JSON.stringify(record(updated)[key]));
     if (materialChanged && updated.amendment)
         assertPacketAmendment(current, updated.originActionId, updated.amendment);
+    if (materialChanged && updated.correction)
+        correctionDelivery(current, updated);
     if (materialChanged && ['submitted', 'acknowledged', 'terminal'].includes(existing.state)) {
         throw new Error('Submitted or terminal action identity and recipient metadata cannot be rewritten; create a linked follow-on action instead.');
     }
@@ -702,6 +757,7 @@ export function updateCaseAction(current, raw, now, validPinIds) {
                     occurredAt: now,
                     sourceClass: 'browser_local',
                     provenance: 'material_action_change',
+                    ...(updated.responseObjects === undefined ? {} : { responseObjects: updated.responseObjects }),
                     reference: null,
                     evidencePinId: null,
                     limitations: ['Material action inputs changed after review; prior readiness, review, or authorisation no longer applies.'],

package/packages/cases/case-response-model.mjs

@@ -7,9 +7,12 @@ import { CASE_ASSERTION_EXTERNAL_ENTITY_TYPES, CASE_ASSERTION_EXTERNAL_FORMATS,
 import { COMPLETENESS, SAFE_ID_RE, compareCodeUnits, freshId, iso, limitations, optionalIso, record, safeId, text, uniqueIds, } from "./case-response-values.mjs";
 import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
 import { readCaseRecheckContext } from "./case-recheck-model.mjs";
+import { readCaseResponseObject } from "./case-response-object.mjs";
+import { normalizeInfrastructureObservation } from "../investigation/infrastructure-observation.mjs";
 export * from "./case-response-records.mjs";
 export * from "./case-response-actions.mjs";
 export * from "./case-response-outcomes.mjs";
+export * from "./case-response-object.mjs";
 export { MAX_ASSERTION_PROVENANCE_LABELS, MAX_ASSERTION_PROVENANCE_MARKINGS, MAX_CASE_ACTION_BYTES, MAX_CASE_ACTION_EVENTS_PER_ACTION, MAX_CASE_ACTION_EVENTS_PER_CASE, MAX_CASE_ACTION_HISTORY_BYTES_PER_CASE, MAX_CASE_ACTIONS, MAX_CASE_ASSERTIONS, MAX_CASE_CHECKPOINT_FACTS, MAX_CASE_CLOSURES, MAX_CASE_DECISIONS, MAX_CASE_EVIDENCE_PINS, MAX_CASE_MANUAL_TRAIL_EVENTS, MAX_CASE_OBSERVED_EFFECT_REVIEWS, MAX_CASE_SIGHTINGS, MAX_DECISION_PIN_REFERENCES, MAX_RESPONSE_LABEL_LENGTH, MAX_RESPONSE_LIMITATION_LENGTH, MAX_RESPONSE_LIMITATIONS, MAX_RESPONSE_RATIONALE_LENGTH, MAX_RESPONSE_RECIPIENT_LENGTH, MAX_RESPONSE_REFERENCE_LENGTH, MAX_RESPONSE_VALUE_LENGTH, MAX_TRAIL_TARGET_LENGTH, } from "../contracts/case-portability.mjs";
 const TRANSITION_EXPECTATIONS = new Set(CASE_TRANSITION_EXPECTATIONS);
 const DECISION_CONFIDENCE_LEVELS = new Set(CASE_DECISION_CONFIDENCE_LEVELS);
@@ -108,6 +111,8 @@ function normalizeEvidenceRelations(value, legacyIds, validIds) {
 }
 function normalizePin(raw, fallback, options = {}) {
     const item = record(raw);
+    if (item.infrastructureObservation !== undefined && options.sourceVersion != null && options.sourceVersion < 18)
+        throw new TypeError('Infrastructure observations require Case schema 18 or later.');
     const label = text(item.label, MAX_RESPONSE_LABEL_LENGTH);
     const value = text(item.value, MAX_RESPONSE_VALUE_LENGTH);
     if (!label || !value)
@@ -141,6 +146,8 @@ function normalizePin(raw, fallback, options = {}) {
             : null,
         limitations: limitations(item.limitations),
         createdAt,
+        ...(item.responseObject === undefined ? {} : { responseObject: readCaseResponseObject(item.responseObject, options.sourceVersion) }),
+        ...(item.infrastructureObservation === undefined ? {} : { infrastructureObservation: normalizeInfrastructureObservation(item.infrastructureObservation) }),
     };
     normalized.certificateObservation = options.allowCertificateObservation === false
         ? null

package/packages/cases/case-response-object.mjs

@@ -0,0 +1,119 @@
+// Explicit object scope, not ownership, collection or proof of remediation.
+import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
+import { OBJECT_RESPONSE_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { array, enumeration, exact, text } from "../evidence/artifact-structure.mjs";
+export const CASE_RESPONSE_OBJECT_KINDS = ['domain', 'hostname', 'page', 'redirect', 'advertisement', 'social_account', 'social_post', 'messaging', 'storefront', 'app', 'other'];
+export const CASE_RESPONSE_OBJECT_OUTCOMES = ['removed', 'restricted', 'suspended', 'delisted', 'warning', 'transferred', 'restored', 'disputed'];
+export const MAX_CASE_RESPONSE_OBJECT_IDENTIFIER = 1_979;
+export const MAX_CASE_RESPONSE_OBJECTS = 20;
+export function readCaseResponseObjects(value, sourceVersion) {
+    if (value === undefined)
+        return undefined;
+    if (sourceVersion != null && sourceVersion < OBJECT_RESPONSE_CASE_SCHEMA_VERSION)
+        throw new TypeError('Object-specific response scope requires Case schema 18 or later.');
+    const objects = array(value, 'Response objects', MAX_CASE_RESPONSE_OBJECTS).map(item => readCaseResponseObject(item, sourceVersion));
+    const keyed = objects.map(object => [JSON.stringify(object), object]);
+    if (new Set(keyed.map(([key]) => key)).size !== keyed.length)
+        throw new TypeError('Response objects must be unique.');
+    return Object.freeze(keyed.sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([, object]) => object));
+}
+/** Historical absence stays absent; a declared historical format cannot carry new fields. */
+export function readCaseResponseObject(value, sourceVersion) {
+    if (value === undefined)
+        return undefined;
+    if (sourceVersion != null && sourceVersion < OBJECT_RESPONSE_CASE_SCHEMA_VERSION)
+        throw new TypeError('Object-specific response scope requires Case schema 18 or later.');
+    const item = exact(value, ['kind', 'identifier', 'incidentTargetId'], 'Response object');
+    const kind = enumeration(item.kind, CASE_RESPONSE_OBJECT_KINDS, 'Response object kind');
+    const identifier = text(item.identifier, 'Response object identifier', MAX_CASE_RESPONSE_OBJECT_IDENTIFIER);
+    if (!identifier || identifier.trim() !== identifier || /[\u0000-\u001f\u007f]/u.test(identifier))
+        throw new TypeError('Response object identifier must be a bounded single-line value.');
+    const incidentTargetId = item.incidentTargetId === null ? null : text(item.incidentTargetId, 'Incident object identity', 64);
+    if (incidentTargetId !== null && !/^[A-Za-z0-9_-]{1,64}$/u.test(incidentTargetId))
+        throw new TypeError('Incident object identity is invalid.');
+    if (kind === 'domain' || kind === 'hostname') {
+        if (identifier !== identifier.toLowerCase() || !isValidAsciiHostname(identifier) || incidentTargetId !== null)
+            throw new TypeError('Domain and hostname scope require a normalised hostname and no incident-link identity.');
+    }
+    else {
+        let url;
+        try {
+            url = new URL(identifier);
+        }
+        catch {
+            throw new TypeError('Select an exact retained HTTP(S) incident link for this object.');
+        }
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.toString() !== identifier || !incidentTargetId)
+            throw new TypeError('Select an exact retained HTTP(S) incident link without credentials for this object.');
+    }
+    return Object.freeze({ kind, identifier, incidentTargetId });
+}
+export function readCaseResponseObjectOutcome(value, sourceVersion) {
+    if (value === undefined)
+        return undefined;
+    if (sourceVersion != null && sourceVersion < OBJECT_RESPONSE_CASE_SCHEMA_VERSION)
+        throw new TypeError('Object-specific outcomes require Case schema 18 or later.');
+    return enumeration(value, CASE_RESPONSE_OBJECT_OUTCOMES, 'Response object outcome');
+}
+export function sameCaseResponseObject(left, right) {
+    return left !== undefined && right !== undefined && left.kind === right.kind && left.identifier === right.identifier && left.incidentTargetId === right.incidentTargetId;
+}
+/** Explicit retained snapshots permit follow-up without retargeting edited links. */
+export function retainedCaseResponseObjects(record) {
+    const objects = [...(record.actions ?? []).flatMap(action => [...action.responseObjects ?? [], ...action.history.flatMap(event => event.responseObjects ?? [])]),
+        ...(record.observedEffects?.reviews ?? []).flatMap(review => review.responseObject ? [review.responseObject] : []),
+        ...(record.evidencePins ?? []).flatMap(pin => pin.responseObject ? [pin.responseObject] : []),
+        ...(record.closures?.records ?? []).flatMap(closure => closure.responseObject ? [closure.responseObject] : []),
+        ...(record.assertions ?? []).flatMap(assertion => assertion.recheck?.responseObject ? [assertion.recheck.responseObject] : [])];
+    return [...new Map(objects.map(object => [JSON.stringify(object), object])).values()];
+}
+/** New identities require current metadata; exact historical identities remain usable. */
+export function assertCaseResponseObject(object, record) {
+    if (!object)
+        return;
+    if (object.kind === 'domain') {
+        if (object.identifier !== record.domain)
+            throw new TypeError('The response domain must match this Case.');
+    }
+    else if (object.kind === 'hostname') {
+        if (object.identifier !== record.domain && !object.identifier.endsWith(`.${record.domain}`))
+            throw new TypeError('The response hostname must belong to this Case domain.');
+    }
+    else if (!record.workflowMetadata?.incidentTargets.some(target => target.id === object.incidentTargetId && target.url === object.identifier)
+        && !retainedCaseResponseObjects(record).some(retained => sameCaseResponseObject(retained, object))) {
+        throw new TypeError('The selected exact incident object changed or is not retained in this Case. Refresh and review it before saving.');
+    }
+}
+export function assertCaseObjectOutcome(outcome, object) {
+    if (!outcome)
+        return;
+    if (!object)
+        throw new TypeError('A typed object outcome requires explicit object scope.');
+    if (outcome === 'suspended' && object.kind !== 'domain')
+        throw new TypeError('Domain suspension requires domain scope.');
+    if (outcome === 'restricted' && object.kind !== 'social_account' && object.kind !== 'app' && object.kind !== 'other')
+        throw new TypeError('Account restriction requires account, app or explicitly other scope.');
+}
+export function caseResponseObjectChoices(record) {
+    const objects = [{ kind: 'domain', identifier: record.domain, incidentTargetId: null }];
+    const hosts = new Set([...(record.evidencePins ?? []).map(pin => pin.observationHostname), ...(record.evidenceHistory ?? []).map(snapshot => snapshot.inputHostname)].filter((value) => Boolean(value)));
+    for (const identifier of hosts)
+        if (identifier === record.domain || identifier.endsWith(`.${record.domain}`))
+            objects.push({ kind: 'hostname', identifier, incidentTargetId: null });
+    for (const target of record.workflowMetadata?.incidentTargets ?? [])
+        for (const kind of CASE_RESPONSE_OBJECT_KINDS.filter(kind => kind !== 'domain' && kind !== 'hostname'))
+            objects.push({ kind, identifier: target.url, incidentTargetId: target.id });
+    objects.push(...retainedCaseResponseObjects(record));
+    return [...new Map(objects.map(object => [JSON.stringify(object), object])).values()].map(object => {
+        const historical = Boolean(object.incidentTargetId && !record.workflowMetadata?.incidentTargets.some(target => target.id === object.incidentTargetId && target.url === object.identifier));
+        return { value: JSON.stringify(object), label: `${object.kind.replaceAll('_', ' ')} · ${object.identifier}${historical ? ' · historical / no current incident link' : ''}`, object };
+    });
+}
+export function selectedCaseResponseObject(record, value) {
+    if (!value)
+        return undefined;
+    const object = caseResponseObjectChoices(record).find(choice => choice.value === value)?.object;
+    if (!object)
+        throw new TypeError('The selected incident object changed. Refresh and review it before saving.');
+    return readCaseResponseObject(object);
+}