@slicedearth/whoisleuth-cli 2.6.0 → 2.7.0

package/packages/cases/case-object-coverage.mjs

@@ -1,33 +1,119 @@
-import { retainedCaseResponseObjects, sameCaseResponseObject } from "./case-response-object.mjs";
-export function buildCaseIncidentCoverage(record) {
+import { retainedCaseResponseObjects, sameCaseResponseObject, } from "./case-response-object.mjs";
+import { correctionDelivery } from "./case-packet-correction.mjs";
+export function caseIncidentObjects(record) {
     const objects = new Map();
     const explicit = retainedCaseResponseObjects(record);
     for (const target of record.workflowMetadata?.incidentTargets ?? []) {
-        const matching = explicit.filter(object => object.incidentTargetId === target.id && object.identifier === target.url);
-        for (const object of matching.length ? matching : [{ kind: 'other', identifier: target.url, incidentTargetId: target.id }])
+        const matching = explicit.filter((object) => object.incidentTargetId === target.id && object.identifier === target.url);
+        for (const object of matching.length
+            ? matching
+            : [{ kind: 'other', identifier: target.url, incidentTargetId: target.id }])
             objects.set(JSON.stringify(object), { target, object, targetRetained: true });
     }
     for (const object of explicit)
         if (!objects.has(JSON.stringify(object)))
             objects.set(JSON.stringify(object), {
-                object, targetRetained: false,
-                target: { id: object.incidentTargetId ?? `${object.kind}-${object.identifier}`, url: object.identifier, state: 'open', createdAt: record.createdAt ?? '', updatedAt: record.updatedAt ?? '' },
+                object,
+                targetRetained: false,
+                target: {
+                    id: object.incidentTargetId ?? `${object.kind}-${object.identifier}`,
+                    url: object.identifier,
+                    state: 'open',
+                    createdAt: record.createdAt ?? '',
+                    updatedAt: record.updatedAt ?? '',
+                },
             });
-    return [...objects.values()].map(({ target, object, targetRetained }) => {
-        const actions = (record.actions ?? []).filter(action => action.responseObjects?.some(bound => sameCaseResponseObject(bound, object)));
-        const reviews = (record.observedEffects?.reviews ?? []).filter(review => sameCaseResponseObject(review.responseObject, object));
-        const latestAt = Math.max(...reviews.map(review => Date.parse(review.observedAt)));
-        const latest = reviews.filter(review => Date.parse(review.observedAt) === latestAt);
-        return { target, targetRetained, responseObject: object,
-            hostname: object.kind === 'domain' || object.kind === 'hostname' ? object.identifier : new URL(object.identifier).hostname,
+    return [...objects.values()];
+}
+export function buildCaseIncidentCoverage(record) {
+    return caseIncidentObjects(record).map(({ target, object, targetRetained }) => {
+        const contexts = (record.actions ?? [])
+            .map((action) => ({
+            action,
+            currentlyBound: Boolean(action.responseObjects?.some((bound) => sameCaseResponseObject(bound, object))),
+            events: action.history.filter((event) => event.responseObjects?.some((bound) => sameCaseResponseObject(bound, object))),
+        }))
+            .filter((context) => context.currentlyBound || context.events.length);
+        const actions = contexts
+            .filter((context) => context.currentlyBound)
+            .map((context) => context.action);
+        const responseContexts = contexts.map(({ action, currentlyBound, events }) => {
+            let correction = null;
+            if (currentlyBound && action.correction) {
+                let linkAvailable = false;
+                try {
+                    linkAvailable = Boolean(correctionDelivery(record.actions ?? [], action));
+                }
+                catch {
+                    /* Historical linkage can be unavailable; the draft is not re-authorised here. */
+                }
+                correction = {
+                    purpose: action.correction.purpose,
+                    originActionId: action.originActionId,
+                    deliveryEventId: action.correction.deliveryEventId,
+                    packetDigestSha256: action.correction.packetDigestSha256,
+                    packetVersion: action.correction.packetVersion,
+                    linkAvailable,
+                };
+            }
+            return {
+                actionId: action.id,
+                type: action.type,
+                recipient: action.recipient,
+                contactSource: action.contactSource,
+                routeObservedAt: action.routeObservedAt,
+                routeReviewAfter: action.routeReviewAfter,
+                contactLimitations: action.contactLimitations,
+                metadataUpdatedAt: action.metadataUpdatedAt,
+                currentState: action.state,
+                currentlyBound,
+                historyOmitted: action.historyOmitted,
+                historyLimitations: action.historyLimitations,
+                reviewEvents: events.filter((event) => event.sourceClass === 'analyst' &&
+                    (event.nextState === 'reviewed' || event.nextState === 'authorised')),
+                // A repeated submitted-state update alone does not establish another delivery.
+                deliveryEvents: events.filter((event) => event.sourceClass === 'analyst' &&
+                    event.nextState === 'submitted' &&
+                    (event.previousState === 'authorised' || Boolean(event.packetReceipt))),
+                correction,
+            };
+        });
+        const responseEvents = contexts.flatMap(({ action, events }) => events
+            .filter((event) => event.providerOutcome || event.objectOutcome || event.nextState === 'acknowledged')
+            .map((event) => ({
+            actionId: action.id,
+            eventId: event.id,
+            state: event.nextState,
+            outcome: event.objectOutcome ?? event.providerOutcome,
+            occurredAt: event.occurredAt,
+            sourceClass: event.sourceClass,
+            applied: event.applied,
+            provenance: event.provenance,
+            reference: event.reference,
+        })));
+        const reviews = (record.observedEffects?.reviews ?? []).filter((review) => sameCaseResponseObject(review.responseObject, object));
+        const latestAt = Math.max(...reviews.map((review) => Date.parse(review.observedAt)));
+        const latest = reviews.filter((review) => Date.parse(review.observedAt) === latestAt);
+        return {
+            target,
+            targetRetained,
+            responseObject: object,
+            hostname: object.kind === 'domain' || object.kind === 'hostname'
+                ? object.identifier
+                : new URL(object.identifier).hostname,
             actionCoverage: actions.length ? 'bound' : 'unknown',
-            actionIds: actions.map(action => action.id),
-            providerEvents: (record.actions ?? []).flatMap(action => action.history.filter(event => event.applied
-                && event.responseObjects?.some(bound => sameCaseResponseObject(bound, object))
-                && (event.providerOutcome || event.objectOutcome || event.nextState === 'acknowledged'))
-                .map(event => ({ actionId: action.id, eventId: event.id, state: event.nextState, outcome: event.objectOutcome ?? event.providerOutcome, occurredAt: event.occurredAt, sourceClass: event.sourceClass }))),
-            observationCoverage: !reviews.length ? 'unknown' : new Set(latest.map(review => `${review.state}\u0000${review.objectOutcome ?? ''}`)).size > 1 ? 'ambiguous' : 'available',
+            actionIds: actions.map((action) => action.id),
+            responseContexts,
+            providerEvents: responseEvents.filter((event) => event.applied),
+            unappliedProviderEvents: responseEvents.filter((event) => !event.applied),
+            observationCoverage: !reviews.length
+                ? 'unknown'
+                : new Set(latest.map((review) => `${review.state}\u0000${review.objectOutcome ?? ''}`))
+                    .size > 1
+                    ? 'ambiguous'
+                    : 'available',
             reviews,
-            closures: (record.closures?.records ?? []).filter(closure => sameCaseResponseObject(closure.responseObject, object)), };
+            closures: (record.closures?.records ?? []).filter((closure) => sameCaseResponseObject(closure.responseObject, object)),
+        };
     });
 }

package/packages/cases/case-record-operations.mjs

@@ -10,6 +10,7 @@ import { appendCaseAction, appendCaseAssertion, appendCaseClosure, appendCaseDec
 import { MAX_CASES, MAX_NOTES_PER_CASE, } from "./case-record-contracts.mjs";
 import { MAX_CASE_OBJECTIVE_LENGTH, MAX_RESPONSE_VALUE_LENGTH } from "../contracts/case-portability.mjs";
 import { caseRecordVersionInput } from "./case-record-version-input.mjs";
+import { readCaseCheckpointReceipts, mergeCaseCheckpointReceipts } from "./case-checkpoint-receipts.mjs";
 import { readCaseAttachments } from "./case-attachment-model.mjs";
 import { readCaseEvidenceLinks, appendCaseEvidenceLink, withdrawCaseEvidenceLink } from "./case-evidence-links.mjs";
 import { assertCurrentRecheckQuestion, assertRecheckNonReproduction, assertCaseObjectObservationOutcome, readCaseRecheckAnswerContext } from "./case-recheck-model.mjs";
@@ -66,6 +67,7 @@ export function normalizeCase(raw, existing, nowIso, sourceVersion) {
     const createdAt = existing ? existing.createdAt : caseTimestampOrNull(record.createdAt, sourceVersion) || now;
     const updatedAt = caseTimestampOrNull(record.updatedAt, sourceVersion) || createdAt;
     const evidencePins = normalizeCaseEvidencePins(record.evidencePins, updatedAt, timestampOptions);
+    const checkpointCollectionReceipts = readCaseCheckpointReceipts(record.checkpointCollectionReceipts, evidencePins, sourceVersion);
     const pinIds = new Set(evidencePins.map((item) => item.id));
     const actions = normalizeCaseActions(record.actions, updatedAt, { ...timestampOptions, validEvidencePinIds: pinIds });
     for (const action of actions)
@@ -98,6 +100,7 @@ export function normalizeCase(raw, existing, nowIso, sourceVersion) {
         source: normalizeSource(record.source),
         evidenceHistory: normalizeCaseEvidence(record, domain, createdAt, updatedAt, now, sourceVersion),
         evidencePins,
+        ...(checkpointCollectionReceipts === undefined ? {} : { checkpointCollectionReceipts }),
         decisions: normalizeCaseDecisions(record.decisions, updatedAt, pinIds, timestampOptions),
         actions,
         assertions,
@@ -140,6 +143,7 @@ export function createCase(input, nowIso) {
     const actions = input.action !== undefined
         ? appendCaseAction([], input.action, now)
         : [];
+    const checkpointCollectionReceipts = readCaseCheckpointReceipts(input.checkpointCollectionReceipts, evidencePins);
     const assertions = input.assertion !== undefined
         ? appendCaseAssertion([], input.assertion, now)
         : [];
@@ -186,6 +190,7 @@ export function createCase(input, nowIso) {
             caseDomain: domain,
         }),
         evidencePins,
+        ...(checkpointCollectionReceipts === undefined ? {} : { checkpointCollectionReceipts }),
         decisions: input.decision !== undefined
             ? appendCaseDecision([], input.decision, now)
             : [],
@@ -318,6 +323,11 @@ export function updateCase(cases, id, patch, nowIso) {
     if (patch.evidencePin !== undefined) {
         evidencePins = appendCaseEvidencePin(evidencePins, patch.evidencePin, now);
     }
+    const previousPinIds = new Set(current.evidencePins.map(pin => pin.id));
+    const checkpointCollectionReceipts = mergeCaseCheckpointReceipts(current, {
+        evidencePins: evidencePins.filter(pin => !previousPinIds.has(pin.id)),
+        checkpointCollectionReceipts: patch.checkpointCollectionReceipts,
+    }, evidencePins);
     const pinIds = new Set(evidencePins.map((item) => item.id));
     const correctionInput = patch.action !== undefined ? objectRecord(patch.action) : patch.actionUpdate !== undefined
         ? { ...current.actions.find(action => action.id === objectRecord(patch.actionUpdate).id), ...objectRecord(patch.actionUpdate) } : null;
@@ -416,6 +426,7 @@ export function updateCase(cases, id, patch, nowIso) {
         source,
         evidenceHistory,
         evidencePins,
+        ...(checkpointCollectionReceipts === undefined ? {} : { checkpointCollectionReceipts }),
         ...((patch.evidenceLink !== undefined || patch.evidenceLinkWithdrawal !== undefined) ? {
             evidenceLinks: patch.evidenceLink !== undefined
                 ? appendCaseEvidenceLink(current.evidenceLinks ?? [], patch.evidenceLink, evidencePins, now)
@@ -433,6 +444,8 @@ export function updateCase(cases, id, patch, nowIso) {
         updatedAt: now,
     };
     const next = [...cases];
+    if (checkpointCollectionReceipts === undefined)
+        delete record.checkpointCollectionReceipts;
     next[index] = record;
     return { cases: next, record };
 }

package/packages/cases/case-record-projection.mjs

@@ -1,5 +1,20 @@
-import { PUBLIC_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { COLLECTION_RECEIPT_CASE_SCHEMA_VERSION, PUBLIC_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION, MAX_CASE_IMPORT_BYTES } from "../contracts/case-portability.mjs";
 import { caseStatusIsClosed } from "./case-record-decisions.mjs";
+import { caseEvidenceWithoutCollectionReceipts } from "./case-evidence-model.mjs";
+import { assertBoundedJsonStructure, boundedJsonLimitsForBytes, scanBoundedJson } from "../analysis/bounded-json.mjs";
+/** Check the whole shared envelope, including otherwise unrecognised nesting.
+ * Writer projection alone cannot enforce the audience of an imported pack. */
+export function assertCaseCollectionReceiptAudience(root, audience) {
+    if (audience === 'internal')
+        return;
+    const limits = boundedJsonLimitsForBytes(MAX_CASE_IMPORT_BYTES);
+    assertBoundedJsonStructure(root, 'Shared Case pack', limits);
+    scanBoundedJson(JSON.stringify(root), limits, entry => {
+        if (entry.kind === 'key' && (entry.value === 'collectionReceipt' || entry.value === 'checkpointCollectionReceipts')) {
+            throw new TypeError('Shared Case packs cannot contain private collection receipts.');
+        }
+    });
+}
 const PRESERVE = Object.freeze({
     durable: 'preserve', internal: 'preserve', trusted: 'preserve', public: 'preserve',
 });
@@ -101,13 +116,24 @@ const CASE_FIELD_RULES = Object.freeze({
         },
     }),
     source: preservedField('source'),
-    evidenceHistory: fieldRule('evidenceHistory', PRESERVE, (record) => structuredClone(record.evidenceHistory)),
+    evidenceHistory: fieldRule('evidenceHistory', SHARED_REDACT, (record, profile) => (profile === 'trusted' || profile === 'public'
+        ? caseEvidenceWithoutCollectionReceipts(record) : structuredClone(record.evidenceHistory)), {
+        nestedSensitiveFields: ['collectionReceipt'],
+        audienceExclusions: {
+            trusted: { label: 'Private collection receipts', order: 4, sinceVersion: COLLECTION_RECEIPT_CASE_SCHEMA_VERSION },
+            public: { label: 'Private collection receipts', order: 4, sinceVersion: COLLECTION_RECEIPT_CASE_SCHEMA_VERSION },
+        },
+    }),
     evidencePins: fieldRule('evidencePins', PUBLIC_REDACT, (record, profile) => structuredClone(record.evidencePins).map(pin => {
         if (profile !== 'public')
             return pin;
         const { responseObject: _scope, infrastructureObservation: _infrastructure, ...publicPin } = pin;
         return publicPin;
     }), { nestedSensitiveFields: ['responseObject', 'infrastructureObservation'], audienceExclusions: { public: { label: 'Exact-object evidence scope and infrastructure observations', order: 4, sinceVersion: 18 } } }),
+    checkpointCollectionReceipts: fieldRule('checkpointCollectionReceipts', SHARED_EXCLUDE, (record, profile) => (profile === 'trusted' || profile === 'public' ? undefined : structuredClone(record.checkpointCollectionReceipts)), { audienceExclusions: {
+            trusted: { label: 'Private collection receipts', order: 4, sinceVersion: COLLECTION_RECEIPT_CASE_SCHEMA_VERSION },
+            public: { label: 'Private collection receipts', order: 4, sinceVersion: COLLECTION_RECEIPT_CASE_SCHEMA_VERSION },
+        } }),
     evidenceLinks: fieldRule('evidenceLinks', PUBLIC_EXCLUDE, (record, profile) => (profile === 'public' ? undefined : structuredClone(record.evidenceLinks)), { audienceExclusions: { public: { label: 'Analyst evidence relationships', order: 4, sinceVersion: EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION } } }),
     decisions: fieldRule('decisions', PRESERVE, (record) => structuredClone(record.decisions)),
     actions: fieldRule('actions', TRUSTED_REDACT_PUBLIC_EXCLUDE, (record, profile) => (profile === 'public'

package/packages/cases/case-report.mjs

@@ -8,12 +8,12 @@
 // contains raw RDAP/WHOIS material. This module deliberately excludes all raw
 // registry/web responses, contacts, cookies, screenshots, and authentication
 // data. Reports contain only the normalized case record.
-import { caseEvidenceTimeline, compareCaseEvidence, currentCaseEvidence, publishedCaseEvidenceTimelineForVerification } from "./case-evidence-model.mjs";
+import { caseEvidenceTimeline, caseEvidenceWithoutCollectionReceipts, compareCaseEvidence, currentCaseEvidence, publishedCaseEvidenceTimelineForVerification } from "./case-evidence-model.mjs";
 import { httpSecurityHeaderLabel } from "./http-summary.mjs";
 import { webCollectionScoreLimitation } from "../evidence/collection-quality.mjs";
 import { analystInteroperabilityTags } from "../analysis/analyst-taxonomy.mjs";
 import { caseEvidenceLinkIssues } from "./case-evidence-links.mjs";
-import { caseTypeSummary } from "./case-workflow-metadata.mjs";
+import { caseTypeSummary } from "./case-type-presentation.mjs";
 import { caseClosureHistoryQualification } from "./case-response-outcomes.mjs";
 import { buildPortableGeneratorMetadata, portableGeneratorAttribution, } from "../analysis/portable-generator.mjs";
 import { buildCaseResponseLifecycleSummary, CASE_EVIDENCE_RELATION_STANCES } from "./case-response-model.mjs";
@@ -178,9 +178,10 @@ export function buildCaseReport(caseRecord, options = {}) {
     const now = generatedAt || new Date().toISOString();
     const generator = buildPortableGeneratorMetadata(options.applicationVersion);
     // --- Build JSON report ---
-    const timeline = caseEvidenceTimeline(caseRecord.evidenceHistory);
+    const sharedEvidence = { ...caseRecord, evidenceHistory: caseEvidenceWithoutCollectionReceipts(caseRecord) };
+    const timeline = caseEvidenceTimeline(sharedEvidence.evidenceHistory);
     const timelineEntries = projectReportTimeline(timeline);
-    const selection = currentCaseEvidence(caseRecord);
+    const selection = currentCaseEvidence(sharedEvidence);
     const latest = selection.snapshot;
     const currentAssessment = latest ? pickKnownSnapshotFields(latest) : null;
     const responseLifecycle = buildCaseResponseLifecycleSummary(caseRecord);