@slicedearth/whoisleuth-cli 1.47.4 → 2.0.1

package/{frontend/src/lib/analysis/brand-profile-model.js → packages/workspace/brand-profile-model.mjs}

@@ -1,31 +1,14 @@
 // Pure Brand Profile normalization and storage model. The browser wrapper owns
 // persistence and downloads; this module owns schema migration, semantic field
 // bounds, import merging, and exact serialized-byte accounting.
-import { normalizeDomain } from "./case-model.js";
-import { normalizeOpaqueReferenceId } from "./opaque-reference-id.js";
-import { normalizePageBaseline } from "./page-baseline.js";
-import { isInformativeFaviconHash } from "./utils.js";
-export const BRAND_PROFILE_SCHEMA = 'whoisleuth.brand-profiles';
-export const BRAND_PROFILE_SCHEMA_VERSION = 6;
-export const SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS = Object.freeze([2, 3, 4, 5, BRAND_PROFILE_SCHEMA_VERSION]);
-export const MAX_PROFILES = 100;
-export const MAX_PROFILE_VALUES = 200;
-export const MAX_PROFILE_VALUE_INPUTS = MAX_PROFILE_VALUES * 4;
-// Profiles share the origin's browser-storage quota with cases, campaigns,
-// watchlists, and CT history. Fail at a predictable one-megabyte boundary.
-export const MAX_PROFILE_STORE_BYTES = 1024 * 1024;
-export const MAX_PROFILE_NAME_LENGTH = 100;
-export const MAX_PROFILE_TEXT_LENGTH = 200;
-export const MAX_PROFILE_DOMAIN_LENGTH = 253;
-export const MAX_PROFILE_TLD_LENGTH = 63;
-export const MAX_DKIM_SELECTOR_LENGTH = 253;
-export const MAX_DKIM_SELECTORS = 10;
-export const MAX_PROTECTION_ATTESTATIONS = 6;
-export const MAX_DESIRED_POSTURE_BASELINES = 20;
-export const MAX_DESIRED_POSTURE_RECORDS = 32;
-export const MAX_DESIRED_POSTURE_SUPPRESSIONS = 12;
-export const MAX_DESIRED_POSTURE_OBSERVATIONS = 12;
-export const MAX_DESIRED_POSTURE_CHANGE_WINDOWS = 8;
+import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { normalizeOpaqueReferenceId } from "../cases/opaque-reference-id.mjs";
+import { normalizePageBaseline } from "./page-baseline.mjs";
+import { isInformativePerceptualHash as isInformativeFaviconHash } from "../../lib/perceptual-hash-comparison.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
+export { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
 const SHA256_RE = /^[a-f0-9]{64}$/i;
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
 const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -46,7 +29,7 @@ const PROTECTION_ATTESTATION_STATES = new Set([
     'unavailable',
     'not_applicable',
 ]);
-const DESIRED_POSTURE_FIELDS = new Set([
+export const DESIRED_POSTURE_SUPPRESSION_FIELDS = Object.freeze([
     'nameservers',
     'ds',
     'mx',
@@ -57,11 +40,10 @@ const DESIRED_POSTURE_FIELDS = new Set([
     'registrar_lock',
     'renewal_review',
 ]);
+const DESIRED_POSTURE_FIELDS = new Set(DESIRED_POSTURE_SUPPRESSION_FIELDS);
 const POSTURE_CHECK_STATUSES = new Set(['danger', 'info', 'pass', 'warning']);
 function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : {};
+    return ordinaryWorkspaceRecord(value, 'Brand Profile input') ?? {};
 }
 function boundedText(value, maximum = MAX_PROFILE_TEXT_LENGTH) {
     if (typeof value !== 'string' || CONTROL_RE.test(value))
@@ -72,12 +54,13 @@ export function normalizeBrandProfileId(value) {
     return normalizeOpaqueReferenceId(value);
 }
 function timestamp(value, fallback) {
-    if (typeof value === 'string' && value.length <= 64 && !CONTROL_RE.test(value)) {
-        const parsed = Date.parse(value);
-        if (Number.isFinite(parsed))
-            return new Date(parsed).toISOString();
+    return normalizeExplicitIsoTimestamp(value) ?? fallback;
+}
+function calendarTimestamp(value, fallback) {
+    if (typeof value === 'string' && /^\d{4}-\d{2}-\d{2}$/u.test(value)) {
+        return normalizeExplicitIsoTimestamp(`${value}T00:00:00Z`) ?? fallback;
     }
-    return fallback;
+    return timestamp(value, fallback);
 }
 function normalizeTld(value) {
     if (typeof value !== 'string' || CONTROL_RE.test(value))
@@ -157,7 +140,7 @@ export function normalizeProtectionAttestations(value) {
             control: candidate.control,
             state: candidate.state,
             assertedAt,
-            expiresAt: timestamp(candidate.expiresAt, null),
+            expiresAt: calendarTimestamp(candidate.expiresAt, null),
             note: boundedText(candidate.note),
         });
         if (output.length >= MAX_PROTECTION_ATTESTATIONS)
@@ -218,10 +201,25 @@ function normalizeDesiredPostureObservationHistory(value, previous) {
         .sort((left, right) => Date.parse(left.observedAt) - Date.parse(right.observedAt))
         .slice(-MAX_DESIRED_POSTURE_OBSERVATIONS);
 }
-function normalizeDesiredPostureChangeWindows(value) {
+function deterministicChangeWindowId(seed) {
+    const states = [0x811c9dc5, 0x9e3779b9, 0x85ebca6b, 0xc2b2ae35];
+    const factors = [0x01000193, 0x85ebca6b, 0xc2b2ae35, 0x27d4eb2f];
+    for (let index = 0; index < seed.length; index += 1) {
+        const code = seed.charCodeAt(index);
+        for (let stateIndex = 0; stateIndex < states.length; stateIndex += 1) {
+            const state = states[stateIndex] ?? 0;
+            const mixed = state ^ (code + Math.imul(index + 1, stateIndex + 17));
+            states[stateIndex] = Math.imul(mixed, factors[stateIndex] ?? 0x01000193);
+        }
+    }
+    return `cw-${states.map((state) => (state >>> 0).toString(16).padStart(8, '0')).join('')}`;
+}
+function normalizeDesiredPostureChangeWindows(value, identityScope = '') {
     if (!Array.isArray(value))
         return [];
     const output = [];
+    const seenIds = new Set();
+    const duplicateMaterial = new Map();
     for (const item of value.slice(0, MAX_DESIRED_POSTURE_CHANGE_WINDOWS * 4)) {
         const candidate = record(item);
         const startsAt = timestamp(candidate.startsAt, null);
@@ -229,7 +227,17 @@ function normalizeDesiredPostureChangeWindows(value) {
         const summary = boundedText(candidate.summary, 300);
         if (!startsAt || !endsAt || Date.parse(endsAt) <= Date.parse(startsAt) || !summary)
             continue;
-        output.push({ startsAt, endsAt, summary });
+        const material = `${startsAt}\u001f${endsAt}\u001f${summary}`;
+        const occurrence = duplicateMaterial.get(material) ?? 0;
+        duplicateMaterial.set(material, occurrence + 1);
+        let id = normalizeOpaqueReferenceId(candidate.id);
+        let salt = 0;
+        while (!id || seenIds.has(id)) {
+            id = deterministicChangeWindowId(`${identityScope}\u001f${material}\u001f${occurrence}\u001f${salt}`);
+            salt += 1;
+        }
+        seenIds.add(id);
+        output.push({ id, startsAt, endsAt, summary });
         if (output.length >= MAX_DESIRED_POSTURE_CHANGE_WINDOWS)
             break;
     }
@@ -251,7 +259,7 @@ function normalizeTlsSanPatterns(value) {
     }
     return [...output].sort();
 }
-export function normalizeDesiredPostureBaselines(value, officialDomains, fallbackNow = new Date().toISOString()) {
+export function normalizeDesiredPostureBaselines(value, officialDomains, fallbackNow = new Date().toISOString(), identityScope = '') {
     if (!Array.isArray(value))
         return [];
     const allowedDomains = new Set(officialDomains);
@@ -276,7 +284,7 @@ export function normalizeDesiredPostureBaselines(value, officialDomains, fallbac
             suppressions.push({
                 field,
                 reason,
-                expiresAt: timestamp(suppression.expiresAt, null),
+                expiresAt: calendarTimestamp(suppression.expiresAt, null),
             });
             if (suppressions.length >= MAX_DESIRED_POSTURE_SUPPRESSIONS)
                 break;
@@ -299,7 +307,7 @@ export function normalizeDesiredPostureBaselines(value, officialDomains, fallbac
             registrarLock: ['required', 'not_required'].includes(String(candidate.registrarLock))
                 ? candidate.registrarLock
                 : 'unconfigured',
-            renewalReviewAt: timestamp(candidate.renewalReviewAt, null),
+            renewalReviewAt: calendarTimestamp(candidate.renewalReviewAt, null),
             zoneIntent: ['active_service', 'defensive_registration', 'no_service', 'parked', 'redirect_only'].includes(String(candidate.zoneIntent))
                 ? candidate.zoneIntent
                 : 'unconfigured',
@@ -307,7 +315,7 @@ export function normalizeDesiredPostureBaselines(value, officialDomains, fallbac
                 ? candidate.lifecycle
                 : 'active',
             recoveryDependency: boundedText(candidate.recoveryDependency, 200),
-            approvedChangeWindows: normalizeDesiredPostureChangeWindows(candidate.approvedChangeWindows),
+            approvedChangeWindows: normalizeDesiredPostureChangeWindows(candidate.approvedChangeWindows, `${identityScope}\u001f${domain}`),
             suppressions,
             note: boundedText(candidate.note, MAX_PROFILE_TEXT_LENGTH),
             previousObservation: observationHistory.at(-1) ?? previousObservation,
@@ -332,9 +340,12 @@ export function normalizeBrandProfile(raw, options = {}) {
     const now = timestamp(options.nowIso, new Date().toISOString());
     const officialDomains = normalizeProfileDomains(value.officialDomains);
     const dkimSelectors = normalizeDkimSelectors(value.dkimSelectors);
-    const candidateBaseline = Object.prototype.hasOwnProperty.call(value, 'pageBaseline')
+    const suppliedBaseline = Object.prototype.hasOwnProperty.call(value, 'pageBaseline');
+    const candidateBaseline = suppliedBaseline
         ? normalizePageBaseline(value.pageBaseline)
         : normalizePageBaseline(existing?.pageBaseline);
+    const baselineDomainMismatch = suppliedBaseline && candidateBaseline !== null
+        && !officialDomains.includes(candidateBaseline.domain);
     const pageBaseline = candidateBaseline && officialDomains.includes(candidateBaseline.domain)
         ? candidateBaseline
         : null;
@@ -359,11 +370,11 @@ export function normalizeBrandProfile(raw, options = {}) {
             .filter((selector) => !dkimSelectors.includes(selector)),
         mailProtectionProfile: normalizeMailProtectionProfile(value.mailProtectionProfile),
         protectionAttestations: normalizeProtectionAttestations(value.protectionAttestations),
-        desiredPostureBaselines: normalizeDesiredPostureBaselines(value.desiredPostureBaselines, officialDomains, now),
+        desiredPostureBaselines: normalizeDesiredPostureBaselines(value.desiredPostureBaselines, officialDomains, now, profileId),
         trademarkOwner: boundedText(value.trademarkOwner),
         trademarkRegistration: boundedText(value.trademarkRegistration),
-        officialFaviconHash: normalizeFaviconHash(value.officialFaviconHash),
-        officialFaviconPHash: normalizeFaviconPHash(value.officialFaviconPHash),
+        officialFaviconHash: baselineDomainMismatch ? '' : normalizeFaviconHash(value.officialFaviconHash),
+        officialFaviconPHash: baselineDomainMismatch ? '' : normalizeFaviconPHash(value.officialFaviconPHash),
         pageBaseline,
         createdAt,
         updatedAt: options.touch === true ? now : timestamp(value.updatedAt, createdAt),
@@ -377,15 +388,24 @@ function profileList(raw) {
 }
 export function brandProfileStoreVersion(raw) {
     if (Array.isArray(raw))
-        return 1;
+        return BRAND_PROFILE_SCHEMA_VERSION;
     const value = record(raw);
     return typeof value.version === 'number' && Number.isFinite(value.version) && value.version > 0 ? value.version : null;
 }
 /** Normalize an internal profile collection or current stored envelope. */
 export function normalizeBrandProfileStore(raw) {
+    assertWorkspaceInputGraph(raw, 'Brand Profile store');
+    assertWorkspaceDeclaredVersion(raw, 'Brand Profile store');
+    const sourceVersion = brandProfileStoreVersion(raw);
+    if (!Array.isArray(raw) && sourceVersion !== null
+        && !SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS.includes(sourceVersion)) {
+        throw new Error(`Brand Profile schema ${sourceVersion} is unsupported; no data was changed.`);
+    }
     const byId = new Map();
     for (const item of profileList(raw).slice(0, MAX_PROFILES * 4)) {
-        const profile = normalizeBrandProfile(item);
+        const profile = normalizeBrandProfile(item, {
+            nowIso: new Date(0).toISOString(),
+        });
         if (!profile)
             continue;
         const previous = byId.get(profile.id);
@@ -410,6 +430,9 @@ export function assertBrandProfileStoreBudget(profiles) {
     return store;
 }
 export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
+    assertWorkspaceInputGraph(localRaw, 'Local Brand Profile store');
+    assertWorkspaceInputGraph(importedRaw, 'Imported Brand Profile document');
+    assertWorkspacePortableVersion(importedRaw, BRAND_PROFILE_SCHEMA_VERSION, 'Imported Brand Profile document');
     const imported = record(importedRaw);
     if (imported.schema !== BRAND_PROFILE_SCHEMA) {
         throw new Error('This JSON file is not a WHOISleuth Brand Profile export.');
@@ -457,7 +480,7 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
         const existing = rawName ? byName.get(rawName.toLowerCase()) : null;
         const profile = normalizeBrandProfile(item, {
             existing,
-            touch: true,
+            touch: Boolean(existing),
             nowIso: options.nowIso,
             makeId: options.makeId,
         });

package/{frontend/src/lib/analysis/bulk-review-model.js → packages/workspace/bulk-review-model.mjs}

@@ -1,11 +1,9 @@
-import { normalizeDomain } from "./case-model.js";
-import { normalizeBulkPresentationSortKey } from "./bulk-sort.js";
-export const BULK_REVIEW_SCHEMA = 'whoisleuth.bulk-review';
-export const BULK_REVIEW_SCHEMA_VERSION = 1;
-export const MAX_BULK_REVIEW_PRESETS = 24;
-export const MAX_BULK_REVIEW_ROWS = 1_900;
-export const MAX_BULK_REVIEW_STORE_BYTES = 512 * 1024;
-export const MAX_BULK_REVIEW_NAME_LENGTH = 80;
+import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeBulkPresentationSortKey } from "./bulk-sort.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, MAX_BULK_REVIEW_NAME_LENGTH, MAX_BULK_REVIEW_PRESETS, MAX_BULK_REVIEW_ROWS, MAX_BULK_REVIEW_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
+export { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, MAX_BULK_REVIEW_NAME_LENGTH, MAX_BULK_REVIEW_PRESETS, MAX_BULK_REVIEW_ROWS, MAX_BULK_REVIEW_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
 export const BULK_REVIEW_STATES = ['unreviewed', 'reviewing', 'reviewed', 'deferred'];
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
@@ -20,9 +18,7 @@ const REVIEW_STATES = new Set(BULK_REVIEW_STATES);
 const CASE_DISPOSITIONS = new Set(['', 'untracked', 'unreviewed', 'suspicious', 'confirmed_abuse', 'false_positive', 'expected', 'closed_no_action']);
 const SIGNAL_FILTERS = new Set(['favicon', 'password', 'phishing', 'asset_reuse', 'idn']);
 function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : {};
+    return ordinaryWorkspaceRecord(value, 'Bulk-review input') ?? {};
 }
 function text(value, maximum) {
     if (typeof value !== 'string' || CONTROL_RE.test(value))
@@ -30,9 +26,7 @@ function text(value, maximum) {
     return value.trim().slice(0, maximum);
 }
 function timestamp(value, fallback) {
-    const normalized = text(value, 64);
-    const parsed = Date.parse(normalized);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : fallback;
+    return normalizeExplicitIsoTimestamp(value) ?? fallback;
 }
 function safeId(value) {
     return typeof value === 'string' && SAFE_ID_RE.test(value) ? value : '';
@@ -111,6 +105,8 @@ function sourceLists(raw) {
     };
 }
 export function normalizeBulkReviewStore(raw) {
+    assertWorkspaceInputGraph(raw, 'Bulk-review store');
+    assertWorkspaceDeclaredVersion(raw, 'Bulk-review store');
     const fallback = new Date(0).toISOString();
     const source = sourceLists(raw);
     const presets = new Map();
@@ -208,6 +204,9 @@ export function buildBulkReviewExport(raw) {
     return enforceBulkReviewBudget(raw);
 }
 export function mergeBulkReviewStores(localRaw, importedRaw) {
+    assertWorkspaceInputGraph(localRaw, 'Local Bulk-review store');
+    assertWorkspaceInputGraph(importedRaw, 'Imported Bulk-review document');
+    assertWorkspacePortableVersion(importedRaw, BULK_REVIEW_SCHEMA_VERSION, 'Imported Bulk-review document');
     const importedRecord = record(importedRaw);
     if (importedRecord.schema !== BULK_REVIEW_SCHEMA) {
         throw new Error('This file is not a WHOISleuth Bulk review export.');

package/{frontend/src/lib/analysis/bulk-session-model.js → packages/workspace/bulk-session-model.mjs}

@@ -1,21 +1,13 @@
 // Pure, bounded persistence model for analyst-saved Bulk investigations.
 // Sessions retain compact derived rows and source states, never raw registry,
 // WHOIS, HTTP, TLS, page, or provider payloads.
-import { normalizeDomain } from "./case-model.js";
-import { normalizeCaaCritical } from "./dns-record-normalization.js";
-export const BULK_SESSION_SCHEMA = 'whoisleuth.bulk-sessions';
-export const BULK_SESSION_SCHEMA_VERSION = 4;
-export const SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS = Object.freeze([1, 2, 3, BULK_SESSION_SCHEMA_VERSION]);
-export const MAX_BULK_SESSIONS = 10;
-export const MAX_BULK_SESSION_ROWS = 2_000;
-export const MAX_BULK_SESSION_STORE_BYTES = 4 * 1024 * 1024;
-export const MAX_BULK_SESSION_NAME_LENGTH = 100;
-export const MAX_BULK_SESSION_TEXT_LENGTH = 500;
-export const MAX_BULK_SESSION_ARRAY_VALUES = 100;
-export const MAX_BULK_SESSION_SOURCES = 12;
-export const MAX_BULK_PROFILE_CONTEXT_LIMITATION_LENGTH = 300;
+import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeCaaCritical } from "./dns-record-normalization.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { BULK_SESSION_SCHEMA, BULK_SESSION_SCHEMA_VERSION, MAX_BULK_PROFILE_CONTEXT_LIMITATION_LENGTH, MAX_BULK_SESSIONS, MAX_BULK_SESSION_ARRAY_VALUES, MAX_BULK_SESSION_NAME_LENGTH, MAX_BULK_SESSION_ROWS, MAX_BULK_SESSION_SOURCES, MAX_BULK_SESSION_STORE_BYTES, MAX_BULK_SESSION_TEXT_LENGTH, SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
+export { BULK_SESSION_SCHEMA, BULK_SESSION_SCHEMA_VERSION, MAX_BULK_PROFILE_CONTEXT_LIMITATION_LENGTH, MAX_BULK_SESSIONS, MAX_BULK_SESSION_ARRAY_VALUES, MAX_BULK_SESSION_NAME_LENGTH, MAX_BULK_SESSION_ROWS, MAX_BULK_SESSION_SOURCES, MAX_BULK_SESSION_STORE_BYTES, MAX_BULK_SESSION_TEXT_LENGTH, SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
 export const BULK_PROFILE_CONTEXT_UNAVAILABLE_LIMITATION = 'Brand Profile context was unavailable when this row was evaluated. Trust, profile matches, and the profile-dependent Risk assessment remain inconclusive.';
-export const BULK_PROFILE_CONTEXT_LEGACY_LIMITATION = 'This legacy Bulk row did not retain profile-context provenance. Trust, profile matches, and the potentially profile-influenced Risk assessment are withheld until the domain is rescanned.';
 export const BULK_PROFILE_CONTEXT_MISMATCH_LIMITATION = 'This saved Bulk row was evaluated with a different or unreadable Brand Profile context. Profile-derived conclusions and the Risk assessment are withheld until the domain is rescanned.';
 export const BULK_PROFILE_CONTEXT_IMPORTED_LIMITATION = 'This row came from a portable import whose claimed Brand Profile identity and revision cannot authenticate profile-derived conclusions. Trust, profile matches, and the potentially profile-influenced Risk assessment are withheld until the domain is rescanned locally.';
 const CONTROL_RE = /[\x00-\x1f\x7f]/u;
@@ -41,9 +33,7 @@ const SOURCE_STATES = new Set([
 const TRUST_STATES = new Set(['official', 'partner', 'allowlisted']);
 const COMPARISON_STATES = new Set(['error', 'not_found', 'partial', 'success', 'unavailable']);
 function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : null;
+    return ordinaryWorkspaceRecord(value, 'Bulk-session input');
 }
 function boundedText(value, maximum = MAX_BULK_SESSION_TEXT_LENGTH) {
     return typeof value === 'string' && value.length <= maximum && !CONTROL_RE.test(value)
@@ -51,8 +41,7 @@ function boundedText(value, maximum = MAX_BULK_SESSION_TEXT_LENGTH) {
         : '';
 }
 function timestamp(value, fallback = null) {
-    const text = boundedText(value, 64);
-    return text && Number.isFinite(Date.parse(text)) ? new Date(text).toISOString() : fallback;
+    return normalizeExplicitIsoTimestamp(value) ?? fallback;
 }
 function profileContextLimitation(value, fallback) {
     return boundedText(value, MAX_BULK_PROFILE_CONTEXT_LIMITATION_LENGTH) || fallback;
@@ -281,7 +270,7 @@ export function normalizeBulkComparisonEvidence(value) {
         },
     };
 }
-export function normalizeBulkSessionResult(value, sourceVersion = BULK_SESSION_SCHEMA_VERSION) {
+export function normalizeBulkSessionResult(value) {
     const item = record(value);
     const domain = normalizeDomain(item?.domain);
     const status = boundedText(item?.status, 20);
@@ -289,13 +278,10 @@ export function normalizeBulkSessionResult(value, sourceVersion = BULK_SESSION_S
     if (!item || !domain || !RESULT_STATES.has(status) || !MODES.has(scanDepth))
         return null;
     const rawProfileContext = record(item.profileContext);
-    if (sourceVersion >= 4
-        && (!rawProfileContext || !['ready', 'unavailable'].includes(String(rawProfileContext.sourceState))))
+    if (!rawProfileContext || !['ready', 'unavailable'].includes(String(rawProfileContext.sourceState)))
         return null;
-    const profileContext = sourceVersion >= 4
-        ? normalizeBulkProfileContext(rawProfileContext)
-        : unavailableBulkProfileContext(BULK_PROFILE_CONTEXT_LEGACY_LIMITATION);
-    if (sourceVersion >= 4 && rawProfileContext?.sourceState === 'ready' && profileContext.sourceState !== 'ready')
+    const profileContext = normalizeBulkProfileContext(rawProfileContext);
+    if (rawProfileContext.sourceState === 'ready' && profileContext.sourceState !== 'ready')
         return null;
     const profileContextReady = profileContext.sourceState === 'ready';
     const trusted = boundedText(item.trusted, 20);
@@ -357,7 +343,7 @@ export function normalizeBulkSessionResult(value, sourceVersion = BULK_SESSION_S
         profileContext,
     };
 }
-export function normalizeBulkSession(value, sourceVersion = BULK_SESSION_SCHEMA_VERSION) {
+export function normalizeBulkSession(value) {
     const item = record(value);
     const id = boundedText(item?.id, 128);
     const name = boundedText(item?.name, MAX_BULK_SESSION_NAME_LENGTH);
@@ -379,33 +365,27 @@ export function normalizeBulkSession(value, sourceVersion = BULK_SESSION_SCHEMA_
     const domains = domainList(item.domains);
     if (!domains.length)
         return null;
-    if (sourceVersion >= 4 && !Array.isArray(item.results))
+    if (!Array.isArray(item.results))
         return null;
     const allowed = new Set(domains);
     const results = [];
     const seen = new Set();
     for (const candidate of Array.isArray(item.results) ? item.results.slice(0, MAX_BULK_SESSION_ROWS * 2) : []) {
-        const result = normalizeBulkSessionResult(candidate, sourceVersion);
+        const result = normalizeBulkSessionResult(candidate);
         if (!result || !allowed.has(result.domain) || seen.has(result.domain)) {
-            if (sourceVersion >= 4)
-                return null;
-            continue;
+            return null;
         }
         seen.add(result.domain);
         results.push(result);
-        if (sourceVersion < 4 && results.length >= MAX_BULK_SESSION_ROWS)
-            break;
     }
-    if (sourceVersion >= 4 && ((state === 'complete') !== (results.length === domains.length)))
+    if ((state === 'complete') !== (results.length === domains.length))
         return null;
     const profileContext = summarizeBulkProfileContexts(results);
-    if (sourceVersion >= 4) {
-        if (!record(item.profileContext))
-            return null;
-        const declaredProfileContext = normalizeBulkProfileContext(item.profileContext);
-        if (!sameProfileContext(declaredProfileContext, profileContext))
-            return null;
-    }
+    if (!record(item.profileContext))
+        return null;
+    const declaredProfileContext = normalizeBulkProfileContext(item.profileContext);
+    if (!sameProfileContext(declaredProfileContext, profileContext))
+        return null;
     return {
         id,
         name,
@@ -427,11 +407,13 @@ export function bulkSessionStoreVersion(raw) {
         : null;
 }
 export function normalizeBulkSessionStore(raw) {
+    assertWorkspaceInputGraph(raw, 'Bulk-session store');
+    assertWorkspaceDeclaredVersion(raw, 'Bulk-session store');
     const value = record(raw);
-    const sourceVersion = value?.schema === BULK_SESSION_SCHEMA
-        && SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS.includes(Number(value.version))
-        ? Number(value.version)
-        : null;
+    if (value?.schema === BULK_SESSION_SCHEMA
+        && !SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS.includes(Number(value.version))) {
+        throw new Error(`Bulk-session store schema ${String(value.version)} is unsupported; no data was changed.`);
+    }
     const candidates = Array.isArray(raw)
         ? raw
         : value?.schema === BULK_SESSION_SCHEMA
@@ -441,17 +423,7 @@ export function normalizeBulkSessionStore(raw) {
             : [];
     const byId = new Map();
     for (const candidate of candidates.slice(0, MAX_BULK_SESSIONS * 4)) {
-        const candidateRecord = record(candidate);
-        const resultRecords = Array.isArray(candidateRecord?.results)
-            ? candidateRecord.results.map(record).filter((item) => Boolean(item))
-            : [];
-        const whollyUnversionedLegacy = Array.isArray(raw)
-            && !Object.hasOwn(candidateRecord ?? {}, 'profileContext')
-            && resultRecords.every((item) => !Object.hasOwn(item, 'profileContext'));
-        const candidateVersion = Array.isArray(raw)
-            ? whollyUnversionedLegacy ? 3 : BULK_SESSION_SCHEMA_VERSION
-            : sourceVersion ?? BULK_SESSION_SCHEMA_VERSION;
-        const session = normalizeBulkSession(candidate, candidateVersion);
+        const session = normalizeBulkSession(candidate);
         if (!session)
             continue;
         const existing = byId.get(session.id);
@@ -623,6 +595,9 @@ export function buildBulkSessionExport(sessions, generatedAt = new Date().toISOS
     };
 }
 export function mergeBulkSessions(localRaw, importedRaw) {
+    assertWorkspaceInputGraph(localRaw, 'Local Bulk-session store');
+    assertWorkspaceInputGraph(importedRaw, 'Imported Bulk-session document');
+    assertWorkspacePortableVersion(importedRaw, BULK_SESSION_SCHEMA_VERSION, 'Imported Bulk-session document');
     const imported = record(importedRaw);
     if (!imported || imported.schema !== BULK_SESSION_SCHEMA || !Array.isArray(imported.sessions)) {
         throw new Error('This file is not a WHOISleuth Bulk session export.');
@@ -637,9 +612,8 @@ export function mergeBulkSessions(localRaw, importedRaw) {
     let added = 0;
     let updated = 0;
     let skipped = 0;
-    const importedVersion = Number(imported.version);
     for (const candidate of imported.sessions.slice(0, MAX_BULK_SESSIONS * 4)) {
-        const normalized = normalizeBulkSession(candidate, importedVersion);
+        const normalized = normalizeBulkSession(candidate);
         if (!normalized) {
             skipped += 1;
             continue;

package/{frontend/src/lib/analysis/bulk-sort.js → packages/workspace/bulk-sort.mjs}

@@ -19,8 +19,11 @@ function compareText(left, right) {
     const rightText = boundedText(right);
     return leftText.localeCompare(rightText, 'en', { numeric: true, sensitivity: 'base' });
 }
-function sortValue(row, key) {
-    if (key === 'risk' || key === 'opportunity') {
+function sortValue(row, key, comparableRisk) {
+    if (key === 'risk') {
+        return { missing: !Number.isFinite(comparableRisk), value: Number(comparableRisk ?? 0) };
+    }
+    if (key === 'opportunity') {
         return { missing: !Number.isFinite(row[key]), value: Number(row[key] ?? 0) };
     }
     if (key === 'confidence') {
@@ -35,10 +38,10 @@ function sortValue(row, key) {
 export function defaultBulkSortDirection(key) {
     return key === 'risk' || key === 'opportunity' || key === 'confidence' ? -1 : 1;
 }
-export function sortBulkResults(rows, key, direction) {
+export function sortBulkResults(rows, key, direction, riskValue = null) {
     return [...rows].sort((left, right) => {
-        const leftValue = sortValue(left, key);
-        const rightValue = sortValue(right, key);
+        const leftValue = sortValue(left, key, key === 'risk' && riskValue ? riskValue(left) : left.risk);
+        const rightValue = sortValue(right, key, key === 'risk' && riskValue ? riskValue(right) : right.risk);
         // Missing values always remain last instead of jumping to the top when
         // the requested direction changes.
         if (leftValue.missing !== rightValue.missing)

package/{frontend/src/lib/analysis/campaign-model.js → packages/workspace/campaign-model.mjs}

@@ -1,23 +1,14 @@
 // Pure, framework-neutral browser-local campaign model. Campaigns deliberately
 // reference normalized case domains rather than copying case evidence, notes,
 // or mutable case ids. The browser wrapper owns persistence and downloads.
-import { normalizeDomain } from "./case-model.js";
-export const CAMPAIGN_SCHEMA = 'whoisleuth.campaigns';
-export const CAMPAIGN_SCHEMA_VERSION = 1;
-export const MAX_CAMPAIGNS = 50;
-export const MAX_CAMPAIGN_DOMAINS = 50;
-export const MAX_CAMPAIGN_NAME_LENGTH = 100;
-export const MAX_CAMPAIGN_DESCRIPTION_LENGTH = 1000;
-export const MAX_CAMPAIGN_IMPORT_BYTES = 2 * 1024 * 1024;
-export const MAX_CAMPAIGN_INPUT_RECORDS = 500;
-// Cases and watchlists share the same per-origin browser quota. Keep this
-// collection smaller than the case store and fail before a browser quota error.
-export const MAX_CAMPAIGN_STORE_BYTES = 512 * 1024;
+import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { CAMPAIGN_SCHEMA, CAMPAIGN_SCHEMA_VERSION, MAX_CAMPAIGNS, MAX_CAMPAIGN_DESCRIPTION_LENGTH, MAX_CAMPAIGN_DOMAINS, MAX_CAMPAIGN_INPUT_RECORDS, MAX_CAMPAIGN_NAME_LENGTH, MAX_CAMPAIGN_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
+export { CAMPAIGN_SCHEMA, CAMPAIGN_SCHEMA_VERSION, MAX_CAMPAIGNS, MAX_CAMPAIGN_DESCRIPTION_LENGTH, MAX_CAMPAIGN_DOMAINS, MAX_CAMPAIGN_IMPORT_BYTES, MAX_CAMPAIGN_INPUT_RECORDS, MAX_CAMPAIGN_NAME_LENGTH, MAX_CAMPAIGN_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
 const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
 function plainRecord(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : null;
+    return ordinaryWorkspaceRecord(value, 'Campaign input');
 }
 function hashString(value) {
     let hash = 2166136261 >>> 0;
@@ -36,10 +27,7 @@ function makeId() {
     return `campaign-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
 }
 function isoOrNull(value) {
-    if (typeof value !== 'string' || value.length > 64 || /[\x00-\x1f\x7f]/.test(value))
-        return null;
-    const parsed = Date.parse(value);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+    return normalizeExplicitIsoTimestamp(value);
 }
 function normalizeName(value) {
     return String(value == null ? '' : value).replace(/\s+/g, ' ').trim().slice(0, MAX_CAMPAIGN_NAME_LENGTH).trim();
@@ -97,10 +85,12 @@ export function campaignStoreVersion(raw) {
 }
 /** Recover a deterministic, bounded store from parsed browser data. */
 export function normalizeCampaignStore(raw) {
-    const now = new Date().toISOString();
+    assertWorkspaceInputGraph(raw, 'Campaign store');
+    assertWorkspaceDeclaredVersion(raw, 'Campaign store');
+    const fallback = new Date(0).toISOString();
     const byId = new Map();
     for (const item of asCampaignList(raw).slice(0, MAX_CAMPAIGN_INPUT_RECORDS)) {
-        const campaign = normalizeCampaign(item, now);
+        const campaign = normalizeCampaign(item, fallback);
         if (!campaign)
             continue;
         const existing = byId.get(campaign.id);
@@ -207,14 +197,22 @@ function mergeCampaign(local, imported) {
 }
 /** Non-destructively merge a portable export into local campaigns by id. */
 export function mergeCampaigns(localRaw, importedRaw) {
+    assertWorkspaceInputGraph(localRaw, 'Local campaign store');
+    assertWorkspaceInputGraph(importedRaw, 'Imported campaign document');
+    assertWorkspacePortableVersion(importedRaw, CAMPAIGN_SCHEMA_VERSION, 'Imported campaign document');
     const importedEnvelope = plainRecord(importedRaw);
-    if (importedEnvelope && typeof importedEnvelope.schema === 'string' && importedEnvelope.schema !== CAMPAIGN_SCHEMA) {
+    if (!importedEnvelope
+        || importedEnvelope.schema !== CAMPAIGN_SCHEMA
+        || !Array.isArray(importedEnvelope.campaigns)) {
         throw new Error('This JSON file is not a WHOISleuth campaign export.');
     }
     const version = campaignStoreVersion(importedRaw);
     if (version !== null && version > CAMPAIGN_SCHEMA_VERSION) {
         throw new Error(`This campaign file uses newer schema ${version}. Update the app before importing it.`);
     }
+    if (version !== CAMPAIGN_SCHEMA_VERSION) {
+        throw new Error(`Expected campaign schema ${CAMPAIGN_SCHEMA_VERSION}.`);
+    }
     const local = normalizeCampaignStore(localRaw).campaigns;
     const byId = new Map(local.map((campaign) => [campaign.id, campaign]));
     let added = 0;