@slicedearth/whoisleuth-cli 2.6.0 → 2.8.0

package/lib/whois-authority.mjs

@@ -2,6 +2,7 @@
 // registry response referred by IANA can decide existence; later registrar
 // output is diagnostic and cannot replace an inconclusive registry result.
 import { normalizeWhoisChain } from "./whois-normalization.mjs";
+import { MAX_WHOIS_BYTES } from "./whois-transport.mjs";
 import { domainToASCII } from 'node:url';
 import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { parseIndentedWhoisValue, whoisFieldLimit, } from "./whois-values.mjs";
@@ -133,6 +134,52 @@ function ianaRegistryReferral(hop) {
     }
     return null;
 }
+/** A complete, target-bound delegation record can establish missing service;
+ * merely reaching the end of an unrecognised response cannot. */
+function ianaDiscoveryHasNoWhoisService(chain, hop, requestedDomain) {
+    const expectedRoot = requestedDomain === undefined ? null : canonicalObjectName(requestedDomain)?.split('.').at(-1);
+    if (!expectedRoot || normalizedWhoisServer(hop.server) !== 'whois.iana.org')
+        return false;
+    if (!Array.isArray(chain) || chain.length !== 1)
+        return false;
+    const original = chain[0]?.response;
+    // Normalisation bounds imported text. Do not interpret a clipped prefix as
+    // an entire discovery record with no referral in its omitted remainder.
+    if (typeof original !== 'string' || original.length > MAX_WHOIS_BYTES
+        || Buffer.byteLength(original, 'utf8') > MAX_WHOIS_BYTES)
+        return false;
+    const text = hop.response ?? '';
+    if (/[\u0000-\u0008\u000b-\u001f\u007f]/u.test(text)
+        || classifyHopEvidence(hop, 0) !== 'inconclusive')
+        return false;
+    const fields = new Map();
+    const emptyServiceFields = new Set();
+    let previousServiceField = false;
+    for (const line of text.split('\n')) {
+        if (previousServiceField && /^[ \t]+\S/u.test(line))
+            return false;
+        previousServiceField = false;
+        if (/^[ \t]*(?:refer|ReferralServer|whois)\b/iu.test(line)) {
+            const service = line.match(/^[ \t]*(refer|ReferralServer|whois):[ \t]*$/iu)?.[1]?.toLowerCase();
+            if (!service || emptyServiceFields.has(service))
+                return false;
+            emptyServiceFields.add(service);
+            previousServiceField = true;
+        }
+        const field = line.match(/^[ \t]*(domain|organisation|status|source):[ \t]*(.*)$/iu);
+        if (!field)
+            continue;
+        const key = field[1].toLowerCase();
+        if (fields.has(key))
+            return false;
+        fields.set(key, field[2].trim());
+    }
+    return emptyServiceFields.size > 0
+        && fields.get('domain')?.toLowerCase() === expectedRoot
+        && Boolean(fields.get('organisation'))
+        && fields.get('status')?.toUpperCase() === 'ACTIVE'
+        && fields.get('source')?.toUpperCase() === 'IANA';
+}
 export function analyzeWhoisChainAuthority(chain, requestedDomain) {
     const source = normalizeWhoisChain(chain);
     const evidence = source.map((hop, index) => ({
@@ -177,7 +224,15 @@ export function whoisCollectionStatus(chain, requestedDomain) {
     const source = normalizeWhoisChain(chain);
     if (!source.length || source[0]?.error)
         return 'error';
+    const first = source[0];
+    if (first.server === 'registry capability policy') {
+        if (source.length === 1 && first.queryProfile === 'not-issued' && first.response === undefined
+            && first.address === undefined && first.queriedAt === undefined
+            && (first.status === 'unsupported' || first.status === 'skipped'))
+            return first.status;
+        return 'error';
+    }
     if (source.length === 1)
-        return 'unsupported';
+        return ianaDiscoveryHasNoWhoisService(chain, first, requestedDomain) ? 'unsupported' : 'partial';
     return analyzeWhoisChainAuthority(source, requestedDomain).chainStatus;
 }

package/lib/whois-chain.mjs

@@ -65,7 +65,8 @@ export async function buildWhoisChainUncached(query, options = {}) {
                 server: 'registry capability policy',
                 queryProfile: 'not-issued',
                 responseEncoding: 'utf-8',
-                error: admission.state === 'permission_required'
+                status: admission.state === 'permission_required' ? 'skipped' : 'unsupported',
+                detail: admission.state === 'permission_required'
                     ? 'WHOIS collection requires registry permission or source authorisation; no socket was opened.'
                     : 'IANA publishes no domain WHOIS service for this suffix; no socket was opened.',
             }];

package/lib/whois-contracts.mjs

@@ -2,3 +2,5 @@
 // consumers can depend on the record shape without importing network code.
 export const MAX_WHOIS_STATUSES = 100;
 export const MAX_WHOIS_QUERY_HOPS = 6;
+// A stopped referral remains evidence even when no further request is issued.
+export const MAX_WHOIS_CHAIN_HOPS = MAX_WHOIS_QUERY_HOPS + 1;

package/lib/whois-normalization.mjs

@@ -2,14 +2,12 @@
 // Keeping this separate lets authority analysis and field parsing share the
 // exact same defensive input boundary.
 import { MAX_WHOIS_BYTES } from "./whois-transport.mjs";
-// Collection performs at most six network queries and may retain one seventh,
-// non-issued hop explaining a loop or hop-limit termination.
-const MAX_WHOIS_HOPS = 7;
+import { MAX_WHOIS_CHAIN_HOPS } from "./whois-contracts.mjs";
 export function normalizeWhoisChain(value) {
     if (!Array.isArray(value))
         return [];
     const normalized = [];
-    for (const hopValue of value.slice(0, MAX_WHOIS_HOPS)) {
+    for (const hopValue of value.slice(0, MAX_WHOIS_CHAIN_HOPS)) {
         if (!hopValue || typeof hopValue !== 'object' || Array.isArray(hopValue))
             continue;
         const hop = hopValue;
@@ -25,6 +23,8 @@ export function normalizeWhoisChain(value) {
             // original hop retains its wire text. Lone and embedded controls remain.
             ...(typeof hop.response === 'string' ? { response: hop.response.slice(0, MAX_WHOIS_BYTES).replace(/\r\n/g, '\n') } : {}),
             ...(typeof hop.error === 'string' ? { error: hop.error.slice(0, 1000) } : {}),
+            ...(hop.status === 'unsupported' || hop.status === 'skipped' ? { status: hop.status } : {}),
+            ...(typeof hop.detail === 'string' ? { detail: hop.detail.slice(0, 1000) } : {}),
         });
     }
     return normalized;

package/package.json

@@ -29,24 +29,24 @@
     "type": "git",
     "url": "git+https://github.com/slicedearth/whoisleuth.git"
   },
-  "homepage": "https://www.whoisleuth.com/",
+  "homepage": "https://www.whoisleuth.com",
   "bugs": {
     "url": "https://github.com/slicedearth/whoisleuth/issues"
   },
-  "version": "2.6.0",
+  "version": "2.8.0",
   "dependencies": {
     "@nuintun/qrcode": "5.0.3",
-    "@peculiar/x509": "2.1.0",
+    "@peculiar/x509": "2.2.0",
     "fast-png": "8.0.0",
     "fflate": "0.8.3",
     "maxmind": "5.0.7",
     "parse5": "8.0.1",
     "pdfjs-dist": "6.4.299",
-    "postal-mime": "4.0.4",
+    "postal-mime": "4.0.7",
     "reflect-metadata": "0.2.2",
     "saxes": "6.0.0",
-    "tldts": "7.4.16",
-    "undici": "8.11.2"
+    "tldts": "7.4.18",
+    "undici": "8.12.2"
   },
   "files": [
     "bin/**/*.mjs",

package/packages/analysis/bounded-json.mjs

@@ -127,7 +127,7 @@ export function assertBoundedJsonStructure(value, label = 'JSON value', limits =
     };
     visit(value, 0);
 }
-export function scanBoundedJson(raw, limits = {}, observeString) {
+export function scanBoundedJson(raw, limits = {}, observeString, observeStringLocation) {
     const maximumDepth = limits.maximumDepth ?? MAX_BOUNDED_JSON_DEPTH;
     const maximumKeys = limits.maximumKeys ?? MAX_BOUNDED_JSON_KEYS;
     const maximumValues = limits.maximumValues ?? MAX_BOUNDED_JSON_VALUES;
@@ -136,6 +136,7 @@ export function scanBoundedJson(raw, limits = {}, observeString) {
     let keys = 0;
     let values = 0;
     let stringCodeUnits = 0;
+    const path = [];
     const whitespace = () => {
         while (index < raw.length) {
             const code = raw.charCodeAt(index);
@@ -213,6 +214,7 @@ export function scanBoundedJson(raw, limits = {}, observeString) {
         if (character === '"') {
             const parsedString = stringToken();
             observeString?.({ ...parsedString, kind: 'value', ...(propertyKey === undefined ? {} : { propertyKey }) });
+            observeStringLocation?.({ ...parsedString, end: index, path: [...path] });
             return;
         }
         if (character === '{') {
@@ -245,7 +247,11 @@ export function scanBoundedJson(raw, limits = {}, observeString) {
                 if (raw[index] !== ':')
                     syntaxError();
                 index += 1;
+                if (observeStringLocation)
+                    path.push(key);
                 value(depth + 1, key);
+                if (observeStringLocation)
+                    path.pop();
                 whitespace();
                 if (raw[index] === '}') {
                     index += 1;
@@ -271,7 +277,11 @@ export function scanBoundedJson(raw, limits = {}, observeString) {
                 if (items > maximumContainerItems) {
                     throw new TypeError(`Artefact JSON contains a container with more than ${maximumContainerItems} items.`);
                 }
+                if (observeStringLocation)
+                    path.push(items - 1);
                 value(depth + 1);
+                if (observeStringLocation)
+                    path.pop();
                 whitespace();
                 if (raw[index] === ']') {
                     index += 1;
@@ -312,7 +322,7 @@ export function parseBoundedJson(raw, options) {
     if (bytes < 1 || bytes > options.maximumBytes) {
         throw new TypeError(`${label} must be between 1 byte and ${options.maximumBytes} bytes.`);
     }
-    scanBoundedJson(raw, options.limits);
+    scanBoundedJson(raw, options.limits, undefined, options.observeStringLocation);
     try {
         return JSON.parse(raw);
     }

package/packages/analysis/brand-profile-signals.mjs

@@ -0,0 +1,42 @@
+import { hammingDistanceHex, isInformativePerceptualHash } from "./perceptual-hash-comparison.mjs";
+function normalizedDomain(value) {
+    return value.trim().toLowerCase().replace(/\.$/u, '');
+}
+/** Shared exact comparison and role precedence for browser and CLI consumers. */
+export function profileDomainMatch(domain, profile = null) {
+    if (!profile || !domain)
+        return null;
+    const target = normalizedDomain(domain);
+    const lists = [
+        ['official', profile.officialDomains, 'Exact official-domain declaration'],
+        ['partner', profile.approvedPartnerDomains, 'Exact approved-partner declaration'],
+        ['allowlisted', profile.allowlistedDomains, 'Exact domain allowlist entry'],
+    ];
+    for (const [kind, values, reason] of lists) {
+        const matched = values.find(value => normalizedDomain(value) === target);
+        if (matched !== undefined)
+            return { kind, matchedDomain: normalizedDomain(matched), reason };
+    }
+    return null;
+}
+export function profileDomainKind(domain, profile = null) {
+    return profileDomainMatch(domain, profile)?.kind ?? null;
+}
+export function profileSignals(domain, evidence, profile = null) {
+    const trusted = profileDomainKind(domain, profile);
+    if (!profile || trusted)
+        return { trusted, faviconMatch: false, faviconNearMatch: false, reusesOfficialAssets: false };
+    const exact = Boolean(evidence.faviconHash && profile.officialFaviconHash && evidence.faviconHash === profile.officialFaviconHash);
+    const distance = isInformativePerceptualHash(evidence.faviconPHash) && isInformativePerceptualHash(profile.officialFaviconPHash)
+        ? hammingDistanceHex(evidence.faviconPHash, profile.officialFaviconPHash)
+        : null;
+    const official = new Set(profile.officialDomains.map(normalizedDomain));
+    const reused = Array.isArray(evidence.externalAssetHosts)
+        && evidence.externalAssetHosts.some((host) => typeof host === 'string' && official.has(normalizedDomain(host)));
+    return {
+        trusted: null,
+        faviconMatch: exact,
+        faviconNearMatch: !exact && distance !== null && distance <= 8,
+        reusesOfficialAssets: reused,
+    };
+}

package/packages/cases/case-attachment-model.mjs

@@ -1,7 +1,7 @@
 import { MAX_SELECTED_FILES, SELECTED_FILE_MEDIA_TYPES } from "../contracts/selected-file-limits.mjs";
 import { array, enumeration, exactOptional, iso, text } from "../evidence/artifact-structure.mjs";
 import { readRetainedFileReference } from "../evidence/retained-file.mjs";
-import { readImageDerivation } from "../evidence/image-regions.mjs";
+import { declareImageDerivation, readImageDerivation } from "../evidence/image-regions.mjs";
 /** Case provenance is independent of deduplicated immutable content. */
 export function readCaseAttachment(value) {
     const item = exactOptional(value, ['id', 'fileName', 'mediaType', 'source', 'observedAt', 'retainedAt', 'digestSha256', 'byteLength'], ['derivation'], 'Case attachment');
@@ -50,6 +50,41 @@ export function mergeCaseAttachments(local, incoming) {
 export function caseAttachmentReferences(cases) {
     return cases.flatMap(record => (record.attachments ?? []).map(({ digestSha256, byteLength }) => ({ digestSha256, byteLength })));
 }
+/** Follow declared parents in one admitted Case's metadata; never resolve files or other Cases. */
+export function reviewCaseImageDerivation(attachment, retained) {
+    if (!attachment.derivation)
+        return null;
+    if (!Array.isArray(retained) || retained.length > MAX_SELECTED_FILES)
+        throw new TypeError('Image history exceeds the Case attachment bound.');
+    const references = new Map();
+    for (const item of retained)
+        references.set(item.id, references.has(item.id) ? null : item);
+    const steps = [];
+    const finish = (termination) => Object.freeze({ steps: Object.freeze(steps), termination });
+    const visited = new Set([attachment.id]);
+    let current = attachment;
+    for (let depth = 0; depth < MAX_SELECTED_FILES; depth++) {
+        const derivation = current.derivation;
+        const declaration = declareImageDerivation(derivation);
+        const parent = references.get(derivation.sourceAttachmentId);
+        const matches = parent?.mediaType === 'image/png'
+            && parent.digestSha256 === declaration.source.digestSha256
+            && parent.byteLength === declaration.source.byteLength;
+        const parentReference = parent === undefined ? 'missing' : matches ? 'matching' : 'conflicting';
+        steps.push(Object.freeze({ declaration, parentReference, parentHasDeclaredEdits: matches ? Boolean(parent?.derivation) : null }));
+        if (parentReference === 'missing')
+            return finish('missing_parent');
+        if (!matches || !parent)
+            return finish('conflicting_parent');
+        if (visited.has(parent.id))
+            return finish('cycle');
+        if (!parent.derivation)
+            return finish('no_further_declaration');
+        visited.add(parent.id);
+        current = parent;
+    }
+    return finish('limit');
+}
 export function addCaseAttachments(record, attachments, updatedAt) {
     iso(updatedAt, 'Case update time');
     return { ...record, attachments: mergeCaseAttachments(record.attachments, attachments) ?? [], updatedAt };

package/packages/cases/case-checkpoint-receipts.mjs

@@ -0,0 +1,68 @@
+import { MAX_CASE_EVIDENCE_PINS, COLLECTION_RECEIPT_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { parseLookupCollectionReceipt, lookupCollectionReceiptIdentity } from "../evidence/lookup-collection-receipt.mjs";
+import { canonicalArtifactJsonV2 } from "../evidence/artifact-integrity.mjs";
+/** Removing the last pin in a group also removes its context. No other pin edit
+ * needs bookkeeping, and normalisation never changes a pin or checkpoint ID. */
+export function readCaseCheckpointReceipts(value, pins, sourceVersion) {
+    if (value === undefined)
+        return undefined;
+    if (sourceVersion != null && sourceVersion < COLLECTION_RECEIPT_CASE_SCHEMA_VERSION) {
+        throw new TypeError('Checkpoint collection receipts require Case schema 20.');
+    }
+    if (!Array.isArray(value) || value.length > MAX_CASE_EVIDENCE_PINS) {
+        throw new TypeError('Checkpoint collection receipts must fit the retained evidence-pin limit.');
+    }
+    const groups = new Set(pins.map(pin => pin.checkpointId).filter(Boolean));
+    const entries = new Map();
+    for (const raw of value) {
+        if (!raw || typeof raw !== 'object' || Array.isArray(raw)
+            || Object.keys(raw).length !== 2 || !Object.hasOwn(raw, 'checkpointId') || !Object.hasOwn(raw, 'collectionReceipt')
+            || typeof raw.checkpointId !== 'string' || !/^[A-Za-z0-9_-]{1,64}$/u.test(raw.checkpointId)) {
+            throw new TypeError('A checkpoint collection receipt is malformed.');
+        }
+        const collectionReceipt = parseLookupCollectionReceipt(raw.collectionReceipt);
+        if (!collectionReceipt || collectionReceipt.targetClass !== 'domain')
+            throw new TypeError('A Case checkpoint requires a domain collection receipt.');
+        const previous = entries.get(raw.checkpointId);
+        if (previous && lookupCollectionReceiptIdentity(previous.collectionReceipt) !== lookupCollectionReceiptIdentity(collectionReceipt)) {
+            throw new TypeError('Conflicting collection receipts use the same checkpoint identity. No evidence was changed.');
+        }
+        entries.set(raw.checkpointId, { checkpointId: raw.checkpointId, collectionReceipt });
+    }
+    const retained = [...entries.values()].filter(entry => groups.has(entry.checkpointId))
+        .sort((a, b) => a.checkpointId < b.checkpointId ? -1 : a.checkpointId > b.checkpointId ? 1 : 0);
+    for (const entry of retained) {
+        if (pins.some(pin => pin.checkpointId === entry.checkpointId && pin.collectionDepth !== entry.collectionReceipt.requestedDepth)) {
+            throw new TypeError('The checkpoint collection receipt does not match its retained pins.');
+        }
+    }
+    return retained.length ? retained : undefined;
+}
+export function mergeCaseCheckpointReceipts(left, right, pins) {
+    const before = readCaseCheckpointReceipts(left.checkpointCollectionReceipts, left.evidencePins) ?? [];
+    const incoming = readCaseCheckpointReceipts(right.checkpointCollectionReceipts, right.evidencePins) ?? [];
+    // Each input is bounded independently. Deduplicate before applying the final
+    // group bound so re-importing a full Case remains idempotent.
+    const byId = new Map(before.map(entry => [entry.checkpointId, entry]));
+    for (const entry of incoming) {
+        const previous = byId.get(entry.checkpointId);
+        if (previous && lookupCollectionReceiptIdentity(previous.collectionReceipt) !== lookupCollectionReceiptIdentity(entry.collectionReceipt)) {
+            throw new TypeError('Conflicting collection receipts use the same checkpoint identity. No evidence was changed.');
+        }
+        byId.set(entry.checkpointId, entry);
+    }
+    const groups = new Set(pins.map(pin => pin.checkpointId));
+    const retained = [...byId.values()].filter(entry => groups.has(entry.checkpointId));
+    for (const entry of retained) {
+        // A colliding group ID must not lend its receipt to unrelated retained
+        // pins. Identical imports and partial retention remain valid.
+        const sourcePins = [before.some(item => item.checkpointId === entry.checkpointId) ? left.evidencePins : [],
+            incoming.some(item => item.checkpointId === entry.checkpointId) ? right.evidencePins : []].flat();
+        for (const pin of pins.filter(pin => pin.checkpointId === entry.checkpointId)) {
+            if (!sourcePins.some(source => source.id === pin.id && canonicalArtifactJsonV2(source) === canonicalArtifactJsonV2(pin))) {
+                throw new TypeError('A checkpoint identity belongs to different retained pins. Its collection context cannot be reassigned.');
+            }
+        }
+    }
+    return readCaseCheckpointReceipts(retained, pins);
+}

package/packages/cases/case-evidence-links.mjs

@@ -115,6 +115,34 @@ export function caseEvidenceLinkIssues(links, pins) {
         cyclic: !link.withdrawal && link.kind === 'derived_from' && reaches(graph, link.toPinId, link.fromPinId),
     }));
 }
+/** Follow declared sources, not automatic context matches or withdrawn links. */
+export function traceCaseEvidenceSources(links, rootPinIds) {
+    array(links, 'Retained evidence relationships', MAX_CASE_EVIDENCE_LINKS);
+    const roots = [...new Set(array(rootPinIds, 'Selected evidence pins', MAX_CASE_EVIDENCE_PINS).map(identifier))];
+    const neighbours = new Map();
+    function add(from, to, linkId) {
+        const entries = neighbours.get(from) ?? [];
+        entries.push({ linkId, pinId: to });
+        neighbours.set(from, entries);
+    }
+    for (const link of links)
+        if (!link.withdrawal) {
+            add(link.fromPinId, link.toPinId, link.id);
+            if (link.kind === 'shared_source')
+                add(link.toPinId, link.fromPinId, link.id);
+        }
+    const pinIds = new Set(roots), linkIds = new Set();
+    // Set iteration visits newly reached pins once, including unresolved references.
+    for (const pinId of pinIds)
+        for (const edge of neighbours.get(pinId) ?? []) {
+            linkIds.add(edge.linkId);
+            pinIds.add(edge.pinId);
+        }
+    return {
+        rootPinIds: roots, pinIds: [...pinIds], linkIds: [...linkIds],
+        withdrawnLinkIds: links.filter(link => link.withdrawal && (pinIds.has(link.fromPinId) || pinIds.has(link.toPinId))).map(link => link.id),
+    };
+}
 /** Matching context is disclosed, never counted as independent corroboration. */
 export function caseEvidenceSharedContext(pins) {
     const groups = new Map();

package/packages/cases/case-evidence-model.mjs

@@ -5,7 +5,8 @@ import { normalizeOpportunityModelVersion } from "../analysis/opportunity-scorin
 import { normalizeRiskModelVersion } from "../analysis/risk-scoring.mjs";
 import { latestObservationCohort } from "../evidence/latest-observations.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
-import { EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION, OBJECT_RESPONSE_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { COLLECTION_RECEIPT_CASE_SCHEMA_VERSION, EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION, OBJECT_RESPONSE_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { parseLookupCollectionReceipt, lookupCollectionReceiptIdentity } from "../evidence/lookup-collection-receipt.mjs";
 import { validWebObservationMode } from "../evidence/lookup-target.mjs";
 import { normalizeWebCollectionQuality, webCollectionAllowsComparison } from "../evidence/collection-quality.mjs";
 import { MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, } from "./case-record-contracts.mjs";
@@ -125,6 +126,7 @@ const MATERIAL_FIELD_ORDER = [
     'webObservationMode',
     'scanDepth',
     'webCollectionQuality',
+    'collectionReceipt',
     'availability', 'confidence', 'riskModelVersion', 'riskScore', 'opportunityModelVersion', 'opportunityScore',
     'riskFactors', 'opportunityFactors',
     'registrar', 'createdDate', 'expiryDate', 'nameservers',
@@ -178,7 +180,7 @@ function isEmptyMaterial(value) {
 }
 // Fields that describe the capture rather than assert evidence, so they never
 // on their own keep an otherwise-empty snapshot alive.
-const NON_EVIDENCE_MATERIAL = new Set(['inputHostname', 'observationHostname', 'webObservationMode', 'scanDepth', 'webCollectionQuality', 'confidence']);
+const NON_EVIDENCE_MATERIAL = new Set(['inputHostname', 'observationHostname', 'webObservationMode', 'scanDepth', 'webCollectionQuality', 'collectionReceipt', 'confidence']);
 // A snapshot with no material evidence (only timestamps/source/depth, or only a
 // bare confidence/unknown-availability) is dropped rather than added to a
 // timeline.
@@ -198,7 +200,7 @@ function canonicalMaterialString(snapshot, legacyOrder = false) {
         const value = materialValue(field, snapshot, legacyOrder);
         // Optional collection context does not alter historical fingerprints when
         // absent; recorded context separates otherwise-identical captures.
-        if ((field === 'inputHostname' || field === 'observationHostname' || field === 'webObservationMode' || field === 'webCollectionQuality' || field === 'hasExternalPasswordForm') && value === null)
+        if ((field === 'inputHostname' || field === 'observationHostname' || field === 'webObservationMode' || field === 'webCollectionQuality' || field === 'collectionReceipt' || field === 'hasExternalPasswordForm') && value === null)
             continue;
         canonical[field] = value;
     }
@@ -220,6 +222,23 @@ export function normalizeSnapshot(raw, options = {}) {
     const built = buildSnapshot(raw, options);
     return built ? built.snapshot : null;
 }
+/** Shared artefacts use receipt-free identities, not hashes of private choices.
+ * Unchanged historical histories keep their exact identifiers. */
+export function caseEvidenceWithoutCollectionReceipts(record) {
+    if (!Array.isArray(record.evidenceHistory))
+        return [];
+    if (!record.evidenceHistory.some(snapshot => snapshot?.collectionReceipt !== undefined)) {
+        return structuredClone(record.evidenceHistory);
+    }
+    return normalizeEvidenceHistory(record.evidenceHistory.map(snapshot => {
+        if (!snapshot || typeof snapshot !== 'object')
+            return snapshot;
+        const { collectionReceipt: _receipt, ...evidence } = snapshot;
+        return evidence;
+    }), {
+        fallback: null, caseDomain: record.domain,
+    });
+}
 /** @returns {{ snapshot: CaseEvidenceSnapshot, material: string } | null} */
 function buildSnapshot(raw, options) {
     if (!raw || typeof raw !== 'object')
@@ -236,6 +255,13 @@ function buildSnapshot(raw, options) {
     // captures declare code-unit ordering; the declaration survives every save.
     const legacyOrder = historicalSchema || (record.factorOrder === undefined && typeof record.fingerprint === 'string');
     const scanDepth = normalizeScanDepth(record.scanDepth);
+    const collectionReceipt = parseLookupCollectionReceipt(record.collectionReceipt);
+    if (collectionReceipt && options.sourceVersion != null && options.sourceVersion < COLLECTION_RECEIPT_CASE_SCHEMA_VERSION) {
+        throw new TypeError('Collection receipts require Case schema 20 or later; historical evidence was not reinterpreted.');
+    }
+    if (collectionReceipt && (collectionReceipt.targetClass !== 'domain' || collectionReceipt.requestedDepth !== scanDepth)) {
+        throw new TypeError('Collection receipt does not match the Case assessment.');
+    }
     const httpSummary = normalizeHttpSummary(record);
     const webCollectionQuality = normalizeWebCollectionQuality(record.webCollectionQuality, scanDepth);
     if (webCollectionQuality && options.sourceVersion != null && options.sourceVersion < EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION) {
@@ -259,6 +285,7 @@ function buildSnapshot(raw, options) {
         ...(acceptsObservationHostname && scanDepth !== 'fast' && record.webObservationMode === 'selected_url' ? { webObservationMode: record.webObservationMode } : {}),
         scanDepth,
         ...(webCollectionQuality ? { webCollectionQuality } : {}),
+        ...(collectionReceipt ? { collectionReceipt } : {}),
         availability: evidenceString(record.availability),
         confidence: evidenceString(record.confidence),
         riskModelVersion: normalizeRiskModelVersion(record.riskModelVersion),
@@ -525,9 +552,14 @@ function buildEvidenceTimeline(history, enforceCollectionQuality) {
         const incomparableReasons = orderingLimitation
             ? ['other']
             : comparable ? incomparableReasonsForEvidence(previous.snapshot, snapshot, enforceCollectionQuality) : [];
-        if (comparable && !changes.length && !incomparableReasons.length
-            && canonicalMaterialString(previous.snapshot) !== canonicalMaterialString(snapshot))
-            incomparableReasons.push('other');
+        const collectionContextChanged = Boolean(comparable
+            && lookupCollectionReceiptIdentity(previous.snapshot.collectionReceipt) !== lookupCollectionReceiptIdentity(snapshot.collectionReceipt));
+        if (comparable && !changes.length && !incomparableReasons.length) {
+            const { collectionReceipt: _beforeReceipt, ...before } = previous.snapshot;
+            const { collectionReceipt: _afterReceipt, ...after } = snapshot;
+            if (canonicalMaterialString(before) !== canonicalMaterialString(after))
+                incomparableReasons.push('other');
+        }
         return {
             snapshot,
             isBaseline,
@@ -536,6 +568,7 @@ function buildEvidenceTimeline(history, enforceCollectionQuality) {
             hasIncomparableChange: incomparableReasons.length > 0,
             incomparableReasons,
             orderingLimitation,
+            collectionContextChanged,
         };
     });
 }

package/packages/cases/case-migration-model.mjs

@@ -6,6 +6,8 @@ import { normalizeCase } from "./case-record-operations.mjs";
 import { normalizeCaseObjective } from "./case-incident-context.mjs";
 import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { mergeImportedEvidenceHistory, normalizeEvidenceHistory } from "./case-evidence-model.mjs";
+import { assertCaseCollectionReceiptAudience } from "./case-record-projection.mjs";
+import { readCaseCheckpointReceipts, mergeCaseCheckpointReceipts } from "./case-checkpoint-receipts.mjs";
 import { CASE_REPORT_SCHEMA, PUBLIC_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, caseReportVersionMatchesCase, CLI_CASE_PACK_CURRENT_REDACTION_KEYS, CLI_CASE_PACK_INTEGRITY_KEYS, CLI_CASE_PACK_LIMITATIONS, CLI_CASE_PACK_PACKET_KEYS, CLI_CASE_PACK_PUBLIC_REPORT_KEYS, CLI_CASE_PACK_REPORT_KEYS, CLI_CASE_PACK_ROOT_KEYS, CLI_CASE_PACK_SCHEMA, CLI_CASE_PACK_VERSION, } from "../contracts/case-portability.mjs";
 import { canonicalArtifactJsonV2 } from "../evidence/artifact-integrity.mjs";
 import { readCaseAttachments, mergeCaseAttachments } from "./case-attachment-model.mjs";
@@ -242,6 +244,7 @@ function extractImportPatch(raw, importedVersion) {
             caseDomain: domain,
         }),
         evidencePins,
+        checkpointCollectionReceipts: readCaseCheckpointReceipts(record.checkpointCollectionReceipts, evidencePins, importedVersion),
         decisions,
         actions,
         assertions,
@@ -297,6 +300,7 @@ function caseFromPatch(patch, now) {
         source: patch.source ?? DEFAULT_SOURCE,
         evidenceHistory: patch.evidenceHistory,
         evidencePins: patch.evidencePins,
+        ...(patch.checkpointCollectionReceipts === undefined ? {} : { checkpointCollectionReceipts: patch.checkpointCollectionReceipts }),
         decisions: patch.decisions,
         actions: patch.actions,
         assertions: patch.assertions,
@@ -327,6 +331,7 @@ function applyImportPatch(local, patch) {
     const historySelection = mergeImportedEvidenceHistory(local.evidenceHistory, patch.evidenceHistory, local.domain);
     const pinSelection = retainLocalAuthoredRecords(local.evidencePins, patch.evidencePins, MAX_CASE_EVIDENCE_PINS);
     const evidencePins = normalizeCaseEvidencePins(pinSelection.records, fallback);
+    const checkpointCollectionReceipts = mergeCaseCheckpointReceipts(local, patch, evidencePins);
     const pinIds = new Set(evidencePins.map((item) => item.id));
     const actions = mergeCaseActions(local.actions, patch.actions, fallback, pinIds);
     const assertionSelection = retainLocalAuthoredRecords(local.assertions, patch.assertions, MAX_CASE_ASSERTIONS);
@@ -351,8 +356,9 @@ function applyImportPatch(local, patch) {
         + assertionSelection.omitted
         + trailSelection.omitted
         + sightingSelection.omitted;
+    const { checkpointCollectionReceipts: _previousReceipts, ...localFields } = local;
     return { record: {
-            ...local,
+            ...localFields,
             title: patch.title !== undefined && importNewer ? patch.title : local.title ?? '',
             status: patch.status !== undefined && importNewer ? patch.status : local.status,
             disposition: patch.disposition !== undefined && importNewer ? patch.disposition : local.disposition,
@@ -361,6 +367,7 @@ function applyImportPatch(local, patch) {
             source: patch.source !== undefined && importNewer ? patch.source : local.source,
             evidenceHistory: historySelection.records,
             evidencePins,
+            ...(checkpointCollectionReceipts === undefined ? {} : { checkpointCollectionReceipts }),
             decisions,
             actions,
             assertions,
@@ -465,6 +472,7 @@ function caseCollectionImportEnvelope(importedRaw) {
         || caseTimestampOrNull(root.exportedAt) !== root.exportedAt) {
         throw new Error('The WHOISleuth CLI Case-pack envelope is invalid.');
     }
+    assertCaseCollectionReceiptAudience(root, audience);
     for (const reportValue of reports) {
         const report = objectRecord(reportValue);
         assertOnlyEnvelopeKeys(report, rootVersion === PUBLIC_CASE_SCHEMA_VERSION ? CLI_CASE_PACK_PUBLIC_REPORT_KEYS : CLI_CASE_PACK_REPORT_KEYS, 'CLI Case-pack report');