@slicedearth/whoisleuth-cli 1.32.0

package/frontend/src/lib/analysis/bulk-mail-exposure.js

@@ -0,0 +1,192 @@
+import { sha256ArtifactDigest } from "./artifact-integrity.js";
+import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
+export const BULK_MAIL_EXPOSURE_SCHEMA = 'whoisleuth.bulk-mail-exposure';
+export const BULK_MAIL_EXPOSURE_VERSION = 1;
+export const MAX_BULK_MAIL_EXPOSURE_ROWS = 2_000;
+const STATE_LABELS = {
+    authenticated_mail: 'Receiving mail with SPF and DMARC',
+    evidence_incomplete: 'Mail evidence incomplete',
+    mail_auth_gap: 'Receiving mail with an authentication gap',
+    mail_auth_incomplete: 'Receiving mail with incomplete authentication evidence',
+    no_explicit_mx: 'No explicit MX observed',
+    null_mx: 'Null MX observed',
+};
+function timestamp(value) {
+    if (typeof value !== 'string' || !Number.isFinite(Date.parse(value)))
+        return null;
+    return new Date(value).toISOString();
+}
+function baselineLabel(profile) {
+    if (profile === 'defensive_no_mail')
+        return 'Configured no-mail baseline';
+    if (profile === 'parked')
+        return 'Configured parked-domain baseline';
+    if (profile === 'standard')
+        return 'Configured standard-mail baseline';
+    return 'No active Brand Profile baseline';
+}
+function dnsCoverage(row) {
+    return row.sourceCoverage.find((source) => source.source === 'dns') ?? null;
+}
+function exposureState(row) {
+    const coverage = dnsCoverage(row);
+    if (row.scanDepth !== 'deep' || !coverage || !['complete', 'partial'].includes(coverage.state)) {
+        return 'evidence_incomplete';
+    }
+    if (row.hasNullMx === true)
+        return 'null_mx';
+    if (row.hasMx === true) {
+        if (row.hasSpf === true && row.hasDmarc === true)
+            return 'authenticated_mail';
+        if (row.hasSpf === false || row.hasDmarc === false)
+            return 'mail_auth_gap';
+        return 'mail_auth_incomplete';
+    }
+    if (row.hasMx === false && row.hasNullMx === false)
+        return 'no_explicit_mx';
+    return 'evidence_incomplete';
+}
+function stateDetail(state) {
+    if (state === 'authenticated_mail') {
+        return 'An explicit receiving MX plus SPF and DMARC publications were observed.';
+    }
+    if (state === 'null_mx') {
+        return 'A null MX explicitly declaring no inbound mail was observed.';
+    }
+    if (state === 'mail_auth_gap') {
+        return 'A receiving MX was observed while SPF or DMARC was observed absent.';
+    }
+    if (state === 'mail_auth_incomplete') {
+        return 'A receiving MX was observed, but SPF or DMARC collection was incomplete.';
+    }
+    if (state === 'no_explicit_mx') {
+        return 'DNS collection completed without an explicit MX. This is not proof that SMTP delivery is impossible.';
+    }
+    return 'The compact scan did not retain enough settled DNS evidence to classify mail exposure.';
+}
+function relation(state, profile) {
+    if (!profile || state === 'evidence_incomplete' || state === 'mail_auth_incomplete') {
+        return {
+            baselineRelation: 'inconclusive',
+            baselineDetail: profile
+                ? 'Incomplete evidence prevents a reliable comparison with the configured baseline.'
+                : 'Set an active Brand Profile to compare this observation with a configured official-domain mail posture.',
+        };
+    }
+    if (profile === 'defensive_no_mail') {
+        return state === 'null_mx'
+            ? {
+                baselineRelation: 'aligned',
+                baselineDetail: 'The observed null MX matches the configured no-mail posture.',
+            }
+            : {
+                baselineRelation: 'review',
+                baselineDetail: 'The observed candidate posture differs from the configured no-mail baseline.',
+            };
+    }
+    if (profile === 'standard') {
+        return ['authenticated_mail', 'mail_auth_gap'].includes(state)
+            ? {
+                baselineRelation: state === 'authenticated_mail' ? 'aligned' : 'review',
+                baselineDetail: state === 'authenticated_mail'
+                    ? 'Receiving mail plus SPF and DMARC matches the configured standard-mail baseline.'
+                    : 'Receiving mail was observed with an authentication gap relative to the configured baseline.',
+            }
+            : {
+                baselineRelation: 'review',
+                baselineDetail: 'The observed candidate posture differs from the configured standard-mail baseline.',
+            };
+    }
+    return {
+        baselineRelation: 'review',
+        baselineDetail: 'The parked-domain profile is context rather than a claim about the expected candidate mail posture.',
+    };
+}
+function rowLimitations(row, state) {
+    const output = [];
+    const coverage = dnsCoverage(row);
+    if (!coverage)
+        output.push('DNS source coverage was not recorded for this compact result.');
+    else if (coverage.state !== 'complete')
+        output.push(`DNS source coverage was ${coverage.state}.`);
+    if (row.scanDepth !== 'deep')
+        output.push('Fast mode does not collect the complete mail evidence used by this review.');
+    if (state === 'no_explicit_mx') {
+        output.push('No explicit MX is not equivalent to a null MX or proof that the domain cannot receive mail.');
+    }
+    output.push('Mail configuration alone does not establish use, intent, control, safety, or maliciousness.');
+    return output.slice(0, 5);
+}
+export function buildBulkMailExposureReport(rowsRaw, options = {}) {
+    const generatedAt = timestamp(options.generatedAt) ?? new Date().toISOString();
+    const officialDomains = [...new Set((options.officialDomains ?? [])
+            .map((domain) => domain.trim().toLowerCase().replace(/\.$/u, ''))
+            .filter(Boolean))].slice(0, 20);
+    const rows = rowsRaw
+        .map(normalizeBulkSessionResult)
+        .filter((row) => Boolean(row))
+        .filter((row) => row.trusted === null)
+        .slice(0, MAX_BULK_MAIL_EXPOSURE_ROWS)
+        .map((item) => {
+        const state = exposureState(item);
+        return {
+            domain: item.domain,
+            state,
+            label: STATE_LABELS[state],
+            detail: stateDetail(state),
+            ...relation(state, options.profile ?? null),
+            mutationTypes: item.mutationTypes.slice(0, 40),
+            registration: item.availability,
+            sourceCoverage: item.sourceCoverage.slice(0, 12),
+            limitations: rowLimitations(item, state),
+        };
+    });
+    const counts = {
+        authenticated_mail: 0,
+        evidence_incomplete: 0,
+        mail_auth_gap: 0,
+        mail_auth_incomplete: 0,
+        no_explicit_mx: 0,
+        null_mx: 0,
+    };
+    for (const item of rows)
+        counts[item.state] += 1;
+    return {
+        version: BULK_MAIL_EXPOSURE_VERSION,
+        generatedAt,
+        observedAt: timestamp(options.observedAt),
+        baseline: {
+            profile: options.profile ?? null,
+            officialDomains,
+            label: baselineLabel(options.profile ?? null),
+            limitations: [
+                'The Brand Profile describes an analyst-configured official-domain posture; it is not a live observation.',
+                'Candidate similarity and mail configuration do not establish use, control, intent, safety, or maliciousness.',
+            ],
+        },
+        rows,
+        counts,
+        limitations: [
+            'This review uses compact Bulk evidence already collected and makes no additional request.',
+            'Null MX, no explicit MX, receiving mail, authentication gaps, and incomplete evidence remain separate states.',
+            'SMTP delivery, mailbox existence, catch-all behavior, and message acceptance were not tested.',
+        ],
+    };
+}
+export async function buildBulkMailExposureExport(report) {
+    const unsigned = {
+        schema: BULK_MAIL_EXPOSURE_SCHEMA,
+        version: BULK_MAIL_EXPOSURE_VERSION,
+        report,
+    };
+    const digestSha256 = await sha256ArtifactDigest(unsigned);
+    const document = {
+        ...unsigned,
+        integrity: { algorithm: 'SHA-256', digestSha256 },
+    };
+    return {
+        document,
+        content: `${JSON.stringify(document, null, 2)}\n`,
+        filename: `whoisleuth-mail-exposure-${report.generatedAt.slice(0, 10)}.json`,
+    };
+}

package/frontend/src/lib/analysis/bulk-retry-plan.js

@@ -0,0 +1,86 @@
+import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
+export const MAX_BULK_RETRY_ROWS = 200;
+export const BULK_REVIEW_STALE_AFTER_DAYS = 7;
+const LIMITED_STATES = new Set([
+    'error',
+    'partial',
+    'skipped',
+    'unavailable',
+    'unsupported',
+]);
+function freshness(value, now = Date.now()) {
+    if (typeof value !== 'string' || !Number.isFinite(Date.parse(value))) {
+        return { observedAt: null, ageDays: null, state: 'unknown' };
+    }
+    const observedAt = new Date(value).toISOString();
+    const ageDays = Math.max(0, Math.floor((now - Date.parse(observedAt)) / 86_400_000));
+    return {
+        observedAt,
+        ageDays,
+        state: ageDays >= BULK_REVIEW_STALE_AFTER_DAYS ? 'stale' : 'current',
+    };
+}
+function retryRow(value, isStale) {
+    const limitedSources = value.sourceCoverage
+        .filter((item) => LIMITED_STATES.has(item.state))
+        .map((item) => item.source)
+        .sort()
+        .slice(0, 12);
+    const reasons = [];
+    if (value.status === 'error')
+        reasons.push('error');
+    if (limitedSources.length)
+        reasons.push('limited_source');
+    if (isStale)
+        reasons.push('stale');
+    return reasons.length ? { domain: value.domain, reasons, limitedSources } : null;
+}
+export function buildBulkRetryPlan(values, mode, observedAtRaw = null, now = Date.now()) {
+    const observationFreshness = freshness(observedAtRaw, now);
+    const candidates = values
+        .map(normalizeBulkSessionResult)
+        .filter((value) => Boolean(value))
+        .map((value) => retryRow(value, observationFreshness.state === 'stale'))
+        .filter((value) => Boolean(value));
+    const rows = candidates.slice(0, MAX_BULK_RETRY_ROWS);
+    return {
+        mode,
+        lookupRequests: rows.length,
+        rows,
+        destinations: mode === 'deep'
+            ? ['registry RDAP', 'registrar RDAP when advertised', 'WHOIS', 'DNS resolvers', 'target HTTP(S)', 'target TLS']
+            : ['registry RDAP', 'authoritative DNS delegation when registration sources are inconclusive'],
+        capped: candidates.length > rows.length,
+        freshness: observationFreshness,
+        limitations: [
+            'This repeats the selected lookup profile; the current API does not request only one upstream source.',
+            `Evidence is marked stale after ${BULK_REVIEW_STALE_AFTER_DAYS} days for review purposes; this is a local observation age, not an upstream record age.`,
+            'Optional third-party intelligence providers are not contacted by Bulk.',
+            'A retry can remain partial or fail and does not convert unavailable evidence into absence.',
+        ],
+    };
+}
+export function preservePriorBulkResult(previousRaw, currentRaw) {
+    const previous = normalizeBulkSessionResult(previousRaw);
+    const current = normalizeBulkSessionResult(currentRaw);
+    if (!previous || !current || previous.domain !== current.domain || previous.status !== 'complete') {
+        return { preserve: false, reason: '' };
+    }
+    if (current.status === 'error') {
+        return { preserve: true, reason: 'The retry failed, so the prior settled result was retained.' };
+    }
+    if (previous.scanDepth === 'deep' && current.scanDepth === 'fast') {
+        return { preserve: true, reason: 'The retry returned only Fast evidence, so the prior Deep result was retained.' };
+    }
+    const currentSources = new Map(current.sourceCoverage.map((item) => [item.source, item.state]));
+    const regressed = previous.sourceCoverage
+        .filter((item) => item.state === 'complete')
+        .map((item) => item.source)
+        .filter((source) => currentSources.get(source) !== 'complete');
+    return regressed.length
+        ? {
+            preserve: true,
+            reason: `The retry reduced complete coverage for ${regressed.slice(0, 6).join(', ')}, so the prior settled result was retained.`,
+        }
+        : { preserve: false, reason: '' };
+}

package/frontend/src/lib/analysis/bulk-review-export.js

@@ -0,0 +1,62 @@
+import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
+import { BULK_REVIEW_STATES, } from "./bulk-review-model.js";
+import { sha256ArtifactDigest } from "./artifact-integrity.js";
+export const BULK_REVIEW_MANIFEST_SCHEMA = 'whoisleuth.bulk-review-manifest';
+export const BULK_REVIEW_MANIFEST_VERSION = 1;
+const MAX_MANIFEST_ROWS = 2_000;
+const REVIEW_STATE_SET = new Set(BULK_REVIEW_STATES);
+function timestamp(value, fallback) {
+    if (typeof value !== 'string' || !Number.isFinite(Date.parse(value)))
+        return fallback;
+    return new Date(value).toISOString();
+}
+function reviewStateMap(values) {
+    return new Map(values.slice(0, MAX_MANIFEST_ROWS * 2).flatMap((item) => (REVIEW_STATE_SET.has(item.state)
+        ? [[item.domain, item.state]]
+        : [])));
+}
+export async function buildBulkReviewManifest(input) {
+    const now = new Date().toISOString();
+    const generatedAt = timestamp(input.generatedAt, now);
+    const observedAt = timestamp(input.observedAt, generatedAt);
+    const states = reviewStateMap(input.reviewStates);
+    const rows = input.rows
+        .map(normalizeBulkSessionResult)
+        .filter((item) => Boolean(item))
+        .slice(0, MAX_MANIFEST_ROWS)
+        .map((item) => ({
+        domain: item.domain,
+        reviewState: states.get(item.domain) || 'unreviewed',
+        resultState: item.status,
+        scanDepth: item.scanDepth,
+        sourceCoverage: item.sourceCoverage,
+    }));
+    const unsigned = {
+        schema: BULK_REVIEW_MANIFEST_SCHEMA,
+        version: BULK_REVIEW_MANIFEST_VERSION,
+        generatedAt,
+        observedAt,
+        lookupProfile: input.lookupProfile,
+        selection: {
+            count: rows.length,
+            domains: rows.map((item) => item.domain),
+        },
+        view: input.view,
+        rows,
+        limitations: [
+            'This manifest records the explicit review selection and view context for a separate CSV export.',
+            'It contains compact source states only and excludes raw payloads, contact records, notes, and transient request state.',
+            'Reproducing the filters does not reproduce upstream responses or imply that evidence remains current.',
+        ],
+    };
+    const digestSha256 = await sha256ArtifactDigest(unsigned);
+    const document = {
+        ...unsigned,
+        integrity: { algorithm: 'SHA-256', digestSha256 },
+    };
+    return {
+        document,
+        content: `${JSON.stringify(document, null, 2)}\n`,
+        filename: `whoisleuth-bulk-review-${generatedAt.slice(0, 10)}.manifest.json`,
+    };
+}

package/frontend/src/lib/analysis/bulk-review-model.js

@@ -0,0 +1,266 @@
+import { normalizeDomain } from "./case-model.js";
+export const BULK_REVIEW_SCHEMA = 'whoisleuth.bulk-review';
+export const BULK_REVIEW_SCHEMA_VERSION = 1;
+export const MAX_BULK_REVIEW_PRESETS = 24;
+export const MAX_BULK_REVIEW_ROWS = 1_900;
+export const MAX_BULK_REVIEW_STORE_BYTES = 512 * 1024;
+export const MAX_BULK_REVIEW_NAME_LENGTH = 80;
+export const BULK_REVIEW_STATES = ['unreviewed', 'reviewing', 'reviewed', 'deferred'];
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
+const PRIMARY_FILTERS = new Set(['all', 'available', 'registered', 'high_risk', 'trusted', 'errors']);
+const SOURCE_FILTERS = new Set(['', 'complete', 'limited', 'failed']);
+const LIFECYCLE_FILTERS = new Set(['', 'new', 'expiring', 'aged', 'unknown']);
+const AGE_FILTERS = new Set(['', '7d', '30d', '90d', '365d', 'older', 'unknown']);
+const MAIL_FILTERS = new Set(['', 'mx', 'no_mx', 'spf_missing', 'dmarc_missing', 'unknown']);
+const GROUPS = new Set(['', 'registrar', 'nameserver', 'source_state', 'lifecycle', 'mail']);
+const SORT_KEYS = new Set(['domain', 'availability', 'risk', 'opportunity', 'activity', 'registrar', 'mutation']);
+const REVIEW_STATES = new Set(BULK_REVIEW_STATES);
+const CASE_DISPOSITIONS = new Set(['', 'untracked', 'unreviewed', 'suspicious', 'confirmed_abuse', 'false_positive', 'expected', 'closed_no_action']);
+const SIGNAL_FILTERS = new Set(['favicon', 'password', 'phishing', 'asset_reuse', 'idn']);
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function text(value, maximum) {
+    if (typeof value !== 'string' || CONTROL_RE.test(value))
+        return '';
+    return value.trim().slice(0, maximum);
+}
+function timestamp(value, fallback) {
+    const normalized = text(value, 64);
+    const parsed = Date.parse(normalized);
+    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : fallback;
+}
+function safeId(value) {
+    return typeof value === 'string' && SAFE_ID_RE.test(value) ? value : '';
+}
+function id(prefix) {
+    if (typeof globalThis.crypto?.randomUUID === 'function')
+        return globalThis.crypto.randomUUID();
+    return `${prefix}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+function setValue(value, values, fallback = '') {
+    return typeof value === 'string' && values.has(value) ? value : fallback;
+}
+function normalizeView(raw) {
+    const value = record(raw);
+    const signalFilters = Array.isArray(value.signalFilters)
+        ? [...new Set(value.signalFilters.filter((item) => typeof item === 'string' && SIGNAL_FILTERS.has(item)))].slice(0, SIGNAL_FILTERS.size)
+        : [];
+    const sortKey = typeof value.sortKey === 'string' && SORT_KEYS.has(value.sortKey)
+        ? value.sortKey
+        : 'risk';
+    return {
+        primaryFilter: setValue(value.primaryFilter, PRIMARY_FILTERS, 'all'),
+        mutationFilter: text(value.mutationFilter, 60),
+        signalFilters,
+        sourceFilter: setValue(value.sourceFilter, SOURCE_FILTERS),
+        lifecycleFilter: setValue(value.lifecycleFilter, LIFECYCLE_FILTERS),
+        ageFilter: setValue(value.ageFilter, AGE_FILTERS),
+        mailFilter: setValue(value.mailFilter, MAIL_FILTERS),
+        registrarFilter: text(value.registrarFilter, 200),
+        caseDispositionFilter: setValue(value.caseDispositionFilter, CASE_DISPOSITIONS),
+        reviewStateFilter: setValue(value.reviewStateFilter, new Set(['', ...BULK_REVIEW_STATES])),
+        groupBy: setValue(value.groupBy, GROUPS),
+        sortKey,
+        sortDirection: value.sortDirection === 1 ? 1 : -1,
+    };
+}
+function normalizePreset(raw, fallback) {
+    const value = record(raw);
+    const name = text(value.name, MAX_BULK_REVIEW_NAME_LENGTH);
+    if (!name)
+        return null;
+    const createdAt = timestamp(value.createdAt, fallback);
+    return {
+        kind: 'preset',
+        id: safeId(value.id) || id('bulk-view'),
+        name,
+        view: normalizeView(value.view),
+        createdAt,
+        updatedAt: timestamp(value.updatedAt, createdAt),
+    };
+}
+function normalizeRow(raw, fallback) {
+    const value = record(raw);
+    const domain = normalizeDomain(value.domain);
+    if (!domain)
+        return null;
+    return {
+        kind: 'row',
+        id: `d-${domain}`,
+        domain,
+        state: setValue(value.state, REVIEW_STATES, 'unreviewed'),
+        updatedAt: timestamp(value.updatedAt, fallback),
+    };
+}
+function sourceLists(raw) {
+    if (Array.isArray(raw)) {
+        return {
+            presets: raw.filter((item) => record(item).kind === 'preset'),
+            rows: raw.filter((item) => record(item).kind === 'row'),
+        };
+    }
+    const value = record(raw);
+    return {
+        presets: Array.isArray(value.presets) ? value.presets : [],
+        rows: Array.isArray(value.rows) ? value.rows : [],
+    };
+}
+export function normalizeBulkReviewStore(raw) {
+    const fallback = new Date(0).toISOString();
+    const source = sourceLists(raw);
+    const presets = new Map();
+    for (const candidate of source.presets.slice(0, MAX_BULK_REVIEW_PRESETS * 4)) {
+        const normalized = normalizePreset(candidate, fallback);
+        if (!normalized)
+            continue;
+        const existing = presets.get(normalized.id);
+        if (!existing || normalized.updatedAt >= existing.updatedAt)
+            presets.set(normalized.id, normalized);
+    }
+    const rows = new Map();
+    for (const candidate of source.rows.slice(0, MAX_BULK_REVIEW_ROWS * 2)) {
+        const normalized = normalizeRow(candidate, fallback);
+        if (!normalized)
+            continue;
+        const existing = rows.get(normalized.domain);
+        if (!existing || normalized.updatedAt >= existing.updatedAt)
+            rows.set(normalized.domain, normalized);
+    }
+    return {
+        schema: BULK_REVIEW_SCHEMA,
+        version: BULK_REVIEW_SCHEMA_VERSION,
+        presets: [...presets.values()]
+            .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt) || left.id.localeCompare(right.id))
+            .slice(0, MAX_BULK_REVIEW_PRESETS),
+        rows: [...rows.values()]
+            .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt) || left.domain.localeCompare(right.domain))
+            .slice(0, MAX_BULK_REVIEW_ROWS),
+    };
+}
+function byteLength(value) {
+    return new TextEncoder().encode(value).byteLength;
+}
+export function enforceBulkReviewBudget(raw) {
+    const store = normalizeBulkReviewStore(raw);
+    while (byteLength(JSON.stringify(store)) > MAX_BULK_REVIEW_STORE_BYTES && store.rows.length)
+        store.rows.pop();
+    while (byteLength(JSON.stringify(store)) > MAX_BULK_REVIEW_STORE_BYTES && store.presets.length > 1)
+        store.presets.pop();
+    if (byteLength(JSON.stringify(store)) > MAX_BULK_REVIEW_STORE_BYTES) {
+        throw new Error('Bulk review preferences exceed the browser-local storage limit.');
+    }
+    return store;
+}
+export function bulkReviewStoreVersion(raw) {
+    const value = record(raw);
+    return typeof value.version === 'number' && Number.isSafeInteger(value.version) && value.version > 0
+        ? value.version
+        : Array.isArray(raw) ? 1 : null;
+}
+export function serializeBulkReviewStore(raw) {
+    return JSON.stringify(enforceBulkReviewBudget(raw));
+}
+export function upsertBulkReviewPreset(raw, input, now = new Date().toISOString()) {
+    const store = normalizeBulkReviewStore(raw);
+    const candidate = normalizePreset({ ...record(input), updatedAt: now }, now);
+    if (!candidate)
+        throw new Error('Enter a name before saving the Bulk review view.');
+    const existing = store.presets.find((item) => item.id === candidate.id);
+    candidate.createdAt = existing?.createdAt ?? candidate.createdAt;
+    return enforceBulkReviewBudget({
+        ...store,
+        presets: [candidate, ...store.presets.filter((item) => item.id !== candidate.id)],
+    });
+}
+export function removeBulkReviewPreset(raw, presetId) {
+    const store = normalizeBulkReviewStore(raw);
+    return { ...store, presets: store.presets.filter((item) => item.id !== presetId) };
+}
+export function setBulkReviewRowState(raw, domain, state, now = new Date().toISOString()) {
+    const store = normalizeBulkReviewStore(raw);
+    const normalizedDomain = normalizeDomain(domain);
+    if (!normalizedDomain || typeof state !== 'string' || !REVIEW_STATES.has(state)) {
+        throw new Error('Choose a valid domain review state.');
+    }
+    const row = normalizeRow({ domain: normalizedDomain, state, updatedAt: now }, now);
+    if (!row)
+        throw new Error('Choose a valid domain review state.');
+    return enforceBulkReviewBudget({
+        ...store,
+        rows: state === 'unreviewed'
+            ? store.rows.filter((item) => item.domain !== normalizedDomain)
+            : [row, ...store.rows.filter((item) => item.domain !== normalizedDomain)],
+    });
+}
+export function bulkReviewRecords(raw) {
+    const store = normalizeBulkReviewStore(raw);
+    return [...store.presets, ...store.rows];
+}
+export function bulkReviewStoreFromRecords(records) {
+    return normalizeBulkReviewStore(records);
+}
+export function buildBulkReviewExport(raw) {
+    return enforceBulkReviewBudget(raw);
+}
+export function mergeBulkReviewStores(localRaw, importedRaw) {
+    const importedRecord = record(importedRaw);
+    if (importedRecord.schema !== BULK_REVIEW_SCHEMA) {
+        throw new Error('This file is not a WHOISleuth Bulk review export.');
+    }
+    if (importedRecord.version !== BULK_REVIEW_SCHEMA_VERSION) {
+        if (typeof importedRecord.version === 'number' && importedRecord.version > BULK_REVIEW_SCHEMA_VERSION) {
+            throw new Error(`This Bulk review export uses newer schema ${importedRecord.version}. Update the app before importing it.`);
+        }
+        throw new Error(`Expected Bulk review schema ${BULK_REVIEW_SCHEMA_VERSION}.`);
+    }
+    const local = normalizeBulkReviewStore(localRaw);
+    const imported = normalizeBulkReviewStore(importedRaw);
+    const presets = new Map(local.presets.map((item) => [item.id, item]));
+    const rows = new Map(local.rows.map((item) => [item.domain, item]));
+    let added = 0;
+    let updated = 0;
+    let skipped = 0;
+    for (const candidate of imported.presets) {
+        const existing = presets.get(candidate.id);
+        if (!existing) {
+            presets.set(candidate.id, candidate);
+            added += 1;
+        }
+        else if (candidate.updatedAt > existing.updatedAt) {
+            presets.set(candidate.id, candidate);
+            updated += 1;
+        }
+        else {
+            skipped += 1;
+        }
+    }
+    for (const candidate of imported.rows) {
+        const existing = rows.get(candidate.domain);
+        if (!existing) {
+            rows.set(candidate.domain, candidate);
+            added += 1;
+        }
+        else if (candidate.updatedAt > existing.updatedAt) {
+            rows.set(candidate.domain, candidate);
+            updated += 1;
+        }
+        else {
+            skipped += 1;
+        }
+    }
+    return {
+        store: enforceBulkReviewBudget({
+            schema: BULK_REVIEW_SCHEMA,
+            version: BULK_REVIEW_SCHEMA_VERSION,
+            presets: [...presets.values()],
+            rows: [...rows.values()],
+        }),
+        added,
+        updated,
+        skipped,
+    };
+}