@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/packages/workspace/brand-profile-model.mjs

@@ -3,12 +3,17 @@
 // bounds, import merging, and exact serialized-byte accounting.
 import { normalizeDomain } from "../cases/case-model.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { canonicalDomainControlRecords, normalizeDeclaredDomainControlRecordModes, normalizeDomainControlRecordModes } from "../evidence/domain-control-runtime.mjs";
+import { DOMAIN_CONTROL_RECORD_LIST_FIELDS } from "../contracts/domain-control-manifest.mjs";
+import { latestObservationCohort } from "../evidence/latest-observations.mjs";
+import { MAX_IDENTITY_DIGEST_BYTES, sha256IdentityHex } from "../evidence/record-identity.mjs";
+import { DOMAIN_POSTURE_COMPARISON_VERSION, MAX_POSTURE_CHECKS, MAX_POSTURE_CHECK_RECORDS, MAX_POSTURE_RECORD_LENGTH, normalizeDomainPostureSourceContext, normalizeDomainPostureProfileContext } from "../evidence/domain-posture-context.mjs";
 import { normalizeOpaqueReferenceId } from "../cases/opaque-reference-id.mjs";
 import { normalizePageBaseline } from "./page-baseline.mjs";
 import { isInformativePerceptualHash as isInformativeFaviconHash } from "../../lib/perceptual-hash-comparison.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
-import { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
-export { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
+import { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_OFFICIAL_CHANNELS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_URL_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, MAX_RIGHTS_REFERENCES, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
+export { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_OFFICIAL_CHANNELS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_URL_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, MAX_RIGHTS_REFERENCES, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
 const SHA256_RE = /^[a-f0-9]{64}$/i;
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
 const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -42,6 +47,17 @@ export const DESIRED_POSTURE_SUPPRESSION_FIELDS = Object.freeze([
 ]);
 const DESIRED_POSTURE_FIELDS = new Set(DESIRED_POSTURE_SUPPRESSION_FIELDS);
 const POSTURE_CHECK_STATUSES = new Set(['danger', 'info', 'pass', 'warning']);
+export const OFFICIAL_CHANNEL_PLATFORMS = [
+    'facebook',
+    'instagram',
+    'linkedin',
+    'telegram',
+    'tiktok',
+    'x',
+    'youtube',
+    'other',
+];
+export const RIGHTS_REFERENCE_KINDS = ['trademark', 'copyright', 'design', 'other'];
 function record(value) {
     return ordinaryWorkspaceRecord(value, 'Brand Profile input') ?? {};
 }
@@ -107,6 +123,32 @@ export function normalizeProfileDomains(value) {
 export function normalizeProfileTextValues(value) {
     return normalizeList(value, (item) => boundedText(item));
 }
+export const MAX_ALLOWLIST_DRAFT_CHARACTERS = (MAX_PROFILE_DOMAIN_LENGTH + 2) * MAX_PROFILE_VALUE_INPUTS;
+/** Admit the complete submitted list or leave the draft unchanged. */
+export function addBrandAllowlistValues(profile, kind, current, raw) {
+    if (raw.length > MAX_ALLOWLIST_DRAFT_CHARACTERS)
+        throw new RangeError('The submitted allowlist text is too large.');
+    const inputs = raw.split(/[\n,]+/u).map((item) => item.trim()).filter(Boolean);
+    if (inputs.length > MAX_PROFILE_VALUE_INPUTS)
+        throw new RangeError(`Review at most ${MAX_PROFILE_VALUE_INPUTS} entries at a time.`);
+    const next = new Map(current.map((value) => [value.toLowerCase(), value]));
+    const trusted = new Set([...profile.officialDomains, ...profile.approvedPartnerDomains]);
+    for (const [index, input] of inputs.entries()) {
+        const value = kind === 'domains' ? normalizeProfileDomains([input])[0] : normalizeProfileTextValues([input])[0];
+        if (!value || (kind === 'registrars' && input.replace(/\s+/gu, ' ').length > MAX_PROFILE_TEXT_LENGTH)) {
+            throw new TypeError(`Allowlist entry ${index + 1} is invalid or too long. No entries were added.`);
+        }
+        if (kind === 'domains' && trusted.has(value))
+            continue;
+        if (!next.has(value.toLowerCase()))
+            next.set(value.toLowerCase(), value);
+    }
+    if (next.size > MAX_PROFILE_VALUES)
+        throw new RangeError(`This list would contain ${next.size} entries; the current profile supports ${MAX_PROFILE_VALUES}. No entries were added.`);
+    if (next.size === current.length)
+        throw new TypeError('No new entries remain after excluding existing and trusted values.');
+    return [...next.values()];
+}
 export function normalizeProfileTlds(value) {
     return normalizeList(value, normalizeTld);
 }
@@ -148,6 +190,30 @@ export function normalizeProtectionAttestations(value) {
     }
     return output;
 }
+/** Only submitted, validated reviews acquire a new analyst-review clock. */
+export function reviewProtectionAttestations(existing, reviews, nowIso) {
+    const assertedAt = timestamp(nowIso, null);
+    if (!assertedAt)
+        throw new TypeError('The account-control review time is invalid.');
+    if (reviews.length > MAX_PROTECTION_ATTESTATIONS)
+        throw new RangeError('Too many account-control reviews were submitted.');
+    const next = new Map(existing.map((item) => [item.control, { ...item }]));
+    const seen = new Set();
+    for (const review of reviews) {
+        if (!PROTECTION_ATTESTATION_CONTROL_SET.has(review.control) || seen.has(review.control)
+            || !PROTECTION_ATTESTATION_STATES.has(review.state))
+            throw new TypeError('An account-control review is invalid or repeated.');
+        const expiresAt = review.expiresAt === null ? null : timestamp(review.expiresAt, null);
+        if (review.expiresAt !== null && !expiresAt)
+            throw new TypeError('Enter a valid account-control expiry date.');
+        if (typeof review.note !== 'string' || CONTROL_RE.test(review.note)
+            || review.note.replace(/\s+/gu, ' ').trim().length > MAX_PROFILE_TEXT_LENGTH)
+            throw new TypeError(`Account-control notes must contain at most ${MAX_PROFILE_TEXT_LENGTH} characters and no control characters.`);
+        seen.add(review.control);
+        next.set(review.control, { control: review.control, state: review.state, assertedAt, expiresAt, note: boundedText(review.note) });
+    }
+    return [...next.values()];
+}
 function normalizeDesiredPostureRecords(value, normalizer) {
     if (!Array.isArray(value))
         return [];
@@ -165,9 +231,10 @@ function normalizeDesiredPostureRecords(value, normalizer) {
 }
 function normalizeDesiredPostureObservation(value) {
     const candidate = record(value);
-    const observedAt = timestamp(candidate.observedAt, null);
-    if (!observedAt || !Array.isArray(candidate.checks))
+    const observedAt = normalizeExplicitIsoTimestamp(candidate.observedAt) ?? '';
+    if (!Array.isArray(candidate.checks))
         return null;
+    const context = normalizeDomainPostureProfileContext(candidate.context);
     const checks = [];
     const seen = new Set();
     for (const item of candidate.checks.slice(0, 64)) {
@@ -179,28 +246,88 @@ function normalizeDesiredPostureObservation(value) {
             || !POSTURE_CHECK_STATUSES.has(check.status))
             continue;
         seen.add(id);
+        if (check.sourceContext !== undefined && !Array.isArray(check.records))
+            throw new TypeError('Source-qualified posture records must be an array.');
+        const inputRecords = Array.isArray(check.records) ? check.records : [];
+        const records = [];
+        for (const item of inputRecords.slice(0, MAX_POSTURE_CHECK_RECORDS)) {
+            if (typeof item === 'string' && item.length <= MAX_POSTURE_RECORD_LENGTH && !CONTROL_RE.test(item))
+                records.push(item);
+        }
+        const omitted = Math.max(0, inputRecords.length - records.length);
+        const source = normalizeDomainPostureSourceContext(check.sourceContext);
+        const sourceContext = source && omitted ? {
+            ...source,
+            state: source.state === 'unavailable' ? 'unavailable' : 'partial',
+            omittedRecords: source.omittedRecords === null ? null : Math.min(Number.MAX_SAFE_INTEGER, source.omittedRecords + omitted),
+        } : source;
         checks.push({
             id,
             status: check.status,
-            records: normalizeDesiredPostureRecords(check.records),
+            records,
+            ...(sourceContext ? { sourceContext } : {}),
         });
-        if (checks.length >= 32)
+        if (checks.length >= MAX_POSTURE_CHECKS)
             break;
     }
-    return checks.length ? { observedAt, checks } : null;
+    const omittedChecks = Math.max(0, candidate.checks.length - checks.length)
+        + (Number.isSafeInteger(candidate.omittedChecks) && Number(candidate.omittedChecks) > 0 ? Number(candidate.omittedChecks) : 0);
+    return checks.length ? { observedAt, ...(context ? { context } : {}), checks, ...(omittedChecks ? { omittedChecks: Math.min(Number.MAX_SAFE_INTEGER, omittedChecks) } : {}) } : null;
 }
-function normalizeDesiredPostureObservationHistory(value, previous) {
+export function normalizeDesiredPostureObservationHistory(value, previous) {
     const candidates = Array.isArray(value) ? value : previous ? [previous] : [];
     const byTime = new Map();
     for (const item of candidates.slice(0, MAX_DESIRED_POSTURE_OBSERVATIONS * 4)) {
         const normalized = normalizeDesiredPostureObservation(item);
-        if (normalized)
-            byTime.set(normalized.observedAt, normalized);
+        if (!normalized)
+            continue;
+        if (new TextEncoder().encode(JSON.stringify(normalized)).byteLength > MAX_IDENTITY_DIGEST_BYTES) {
+            throw new RangeError('Record identity exceeds its byte limit.');
+        }
+        const cohort = byTime.get(normalized.observedAt) ?? [];
+        cohort.push(normalized);
+        byTime.set(normalized.observedAt, cohort);
     }
-    return [...byTime.values()]
-        .sort((left, right) => Date.parse(left.observedAt) - Date.parse(right.observedAt))
+    return [...byTime.entries()]
+        .sort(([left], [right]) => !left ? 1 : !right ? -1 : Date.parse(left) - Date.parse(right))
+        .flatMap(([, cohort]) => {
+        // Different capture times already distinguish observations. Digest-based
+        // deduplication and ordering remain necessary only within a tied cohort.
+        if (cohort.length === 1)
+            return cohort;
+        const byIdentity = new Map(cohort.map((observation) => [desiredPostureObservationIdentity(observation), observation]));
+        return [...byIdentity.entries()].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
+            .map(([, observation]) => observation);
+    })
         .slice(-MAX_DESIRED_POSTURE_OBSERVATIONS);
 }
+export function desiredPostureObservationIdentity(observation) {
+    return sha256IdentityHex(new TextEncoder().encode(JSON.stringify(observation)));
+}
+export function desiredPostureObservations(baseline) {
+    return baseline.observationHistory?.length ? baseline.observationHistory : baseline.previousObservation ? [baseline.previousObservation] : [];
+}
+export function currentDesiredPostureObservation(baseline) {
+    const history = desiredPostureObservations(baseline);
+    const cohort = latestObservationCohort(history, (item) => item.observedAt);
+    return {
+        observation: !cohort.undated.length && cohort.latest.length === 1 ? cohort.latest[0] : null,
+        candidates: [...cohort.latest, ...cohort.undated],
+        limitation: cohort.undated.length ? 'Retained observations include an unknown capture time; no unique latest review is selected.'
+            : cohort.latest.length > 1 ? 'Distinct observations share the latest capture time; no unique latest review is selected.' : null,
+    };
+}
+export function brandPostureCollectionFingerprint(profile) {
+    return sha256IdentityHex(new TextEncoder().encode(JSON.stringify([
+        profile.id, [...profile.officialDomains].sort(), profile.mailProtectionProfile,
+        [...profile.dkimSelectors].sort(), [...profile.retiredDkimSelectors].sort(),
+    ])));
+}
+export function brandPostureObservationContext(profile, domain) {
+    if (!profile.officialDomains.includes(domain))
+        throw new TypeError('Posture observation target is not an official domain of this profile.');
+    return { version: DOMAIN_POSTURE_COMPARISON_VERSION, domain, profileId: profile.id, profileFingerprint: brandPostureCollectionFingerprint(profile) };
+}
 function deterministicChangeWindowId(seed) {
     const states = [0x811c9dc5, 0x9e3779b9, 0x85ebca6b, 0xc2b2ae35];
     const factors = [0x01000193, 0x85ebca6b, 0xc2b2ae35, 0x27d4eb2f];
@@ -259,6 +386,23 @@ function normalizeTlsSanPatterns(value) {
     }
     return [...output].sort();
 }
+function normalizeBaselineRecords(candidate) {
+    const records = {
+        nameservers: normalizeDesiredPostureRecords(candidate.nameservers, (entry) => normalizeDomain(entry)),
+        ds: normalizeDesiredPostureRecords(candidate.ds),
+        mx: normalizeDesiredPostureRecords(candidate.mx),
+        caa: normalizeDesiredPostureRecords(candidate.caa),
+    };
+    if (!Object.hasOwn(candidate, 'recordModes'))
+        return records;
+    const recordModes = normalizeDeclaredDomainControlRecordModes(candidate.recordModes);
+    for (const field of DOMAIN_CONTROL_RECORD_LIST_FIELDS) {
+        if (Object.hasOwn(recordModes, field))
+            records[field] = canonicalDomainControlRecords(candidate[field], field);
+    }
+    normalizeDomainControlRecordModes(recordModes, records);
+    return { ...records, recordModes };
+}
 export function normalizeDesiredPostureBaselines(value, officialDomains, fallbackNow = new Date().toISOString(), identityScope = '') {
     if (!Array.isArray(value))
         return [];
@@ -295,10 +439,7 @@ export function normalizeDesiredPostureBaselines(value, officialDomains, fallbac
         output.push({
             version: 1,
             domain,
-            nameservers: normalizeDesiredPostureRecords(candidate.nameservers, (entry) => normalizeDomain(entry)),
-            ds: normalizeDesiredPostureRecords(candidate.ds),
-            mx: normalizeDesiredPostureRecords(candidate.mx),
-            caa: normalizeDesiredPostureRecords(candidate.caa),
+            ...normalizeBaselineRecords(candidate),
             tlsIssuer: boundedText(candidate.tlsIssuer, MAX_PROFILE_TEXT_LENGTH),
             tlsSanPatterns: normalizeTlsSanPatterns(candidate.tlsSanPatterns),
             tlsSpkiSha256: typeof candidate.tlsSpkiSha256 === 'string' && SHA256_RE.test(candidate.tlsSpkiSha256)
@@ -318,7 +459,7 @@ export function normalizeDesiredPostureBaselines(value, officialDomains, fallbac
             approvedChangeWindows: normalizeDesiredPostureChangeWindows(candidate.approvedChangeWindows, `${identityScope}\u001f${domain}`),
             suppressions,
             note: boundedText(candidate.note, MAX_PROFILE_TEXT_LENGTH),
-            previousObservation: observationHistory.at(-1) ?? previousObservation,
+            previousObservation: currentDesiredPostureObservation({ observationHistory, previousObservation }).observation,
             observationHistory,
             updatedAt: timestamp(candidate.updatedAt, fallback),
         });
@@ -333,6 +474,82 @@ function normalizeFaviconHash(value) {
 function normalizeFaviconPHash(value) {
     return typeof value === 'string' && isInformativeFaviconHash(value) ? value.toLowerCase() : '';
 }
+function normalizePublicUrl(value) {
+    if (typeof value !== 'string' || CONTROL_RE.test(value) || value.length > MAX_PROFILE_URL_LENGTH * 2)
+        return '';
+    try {
+        const parsed = new URL(value.trim());
+        if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password)
+            return '';
+        const normalized = parsed.toString();
+        return normalized.length <= MAX_PROFILE_URL_LENGTH ? normalized : '';
+    }
+    catch {
+        return '';
+    }
+}
+function normalizeOfficialChannels(value) {
+    if (!Array.isArray(value))
+        return [];
+    const output = new Map();
+    for (const candidate of value.slice(0, MAX_OFFICIAL_CHANNELS * 4)) {
+        const item = record(candidate);
+        const platform = typeof item.platform === 'string'
+            && OFFICIAL_CHANNEL_PLATFORMS.includes(item.platform)
+            ? item.platform
+            : null;
+        const url = normalizePublicUrl(item.url);
+        if (!platform || !url)
+            continue;
+        const key = url.toLowerCase();
+        if (output.has(key))
+            continue;
+        output.set(key, {
+            platform,
+            url,
+            handle: boundedText(item.handle),
+            role: boundedText(item.role),
+            reviewedAt: timestamp(item.reviewedAt, null),
+        });
+        if (output.size >= MAX_OFFICIAL_CHANNELS)
+            break;
+    }
+    return [...output.values()];
+}
+function normalizeRightsReferences(value) {
+    if (!Array.isArray(value))
+        return [];
+    const output = new Map();
+    for (const candidate of value.slice(0, MAX_RIGHTS_REFERENCES * 4)) {
+        const item = record(candidate);
+        const kind = typeof item.kind === 'string' && RIGHTS_REFERENCE_KINDS.includes(item.kind)
+            ? item.kind
+            : null;
+        const owner = boundedText(item.owner);
+        const identifier = boundedText(item.identifier);
+        if (!kind || (!owner && !identifier))
+            continue;
+        const jurisdiction = boundedText(item.jurisdiction);
+        const sourceUrl = item.sourceUrl == null || item.sourceUrl === '' ? '' : normalizePublicUrl(item.sourceUrl);
+        if (item.sourceUrl && !sourceUrl)
+            continue;
+        const key = `${kind}\u0000${owner.toLowerCase()}\u0000${identifier.toLowerCase()}\u0000${jurisdiction.toLowerCase()}`;
+        if (output.has(key))
+            continue;
+        output.set(key, {
+            kind,
+            owner,
+            identifier,
+            jurisdiction,
+            sourceUrl,
+            reviewedAt: timestamp(item.reviewedAt, null),
+            note: boundedText(item.note),
+        });
+        if (output.size >= MAX_RIGHTS_REFERENCES)
+            break;
+    }
+    return [...output.values()];
+}
 /** Normalize one profile while retaining only known, bounded fields. */
 export function normalizeBrandProfile(raw, options = {}) {
     const value = record(raw);
@@ -360,6 +577,7 @@ export function normalizeBrandProfile(raw, options = {}) {
         id: profileId,
         name,
         officialDomains,
+        officialChannels: normalizeOfficialChannels(value.officialChannels),
         productNames: normalizeProfileTextValues(value.productNames),
         tlds: normalizeProfileTlds(value.tlds),
         approvedPartnerDomains: normalizeProfileDomains(value.approvedPartnerDomains),
@@ -373,6 +591,7 @@ export function normalizeBrandProfile(raw, options = {}) {
         desiredPostureBaselines: normalizeDesiredPostureBaselines(value.desiredPostureBaselines, officialDomains, now, profileId),
         trademarkOwner: boundedText(value.trademarkOwner),
         trademarkRegistration: boundedText(value.trademarkRegistration),
+        rightsReferences: normalizeRightsReferences(value.rightsReferences),
         officialFaviconHash: baselineDomainMismatch ? '' : normalizeFaviconHash(value.officialFaviconHash),
         officialFaviconPHash: baselineDomainMismatch ? '' : normalizeFaviconPHash(value.officialFaviconPHash),
         pageBaseline,
@@ -380,6 +599,33 @@ export function normalizeBrandProfile(raw, options = {}) {
         updatedAt: options.touch === true ? now : timestamp(value.updatedAt, createdAt),
     };
 }
+const BRAND_PROFILE_FIELD_PATCH_KEYS = Object.freeze([
+    'allowlistedDomains',
+    'allowlistedRegistrars',
+    'desiredPostureBaselines',
+    'protectionAttestations',
+]);
+/**
+ * Applies one field-owned edit to the transaction-current profile. Identity,
+ * timestamps, and every field outside the explicit patch remain owned by that
+ * current record rather than by the caller's potentially stale snapshot.
+ */
+export function applyBrandProfileFieldPatch(existing, patch, options = {}) {
+    const merged = { ...existing };
+    const supplied = patch;
+    for (const key of BRAND_PROFILE_FIELD_PATCH_KEYS) {
+        if (Object.hasOwn(supplied, key))
+            merged[key] = supplied[key];
+    }
+    const normalized = normalizeBrandProfile(merged, {
+        existing,
+        nowIso: options.nowIso,
+        touch: true,
+    });
+    if (!normalized)
+        throw new Error('The Brand Profile field update is invalid.');
+    return normalized;
+}
 function profileList(raw) {
     if (Array.isArray(raw))
         return raw;
@@ -394,7 +640,7 @@ export function brandProfileStoreVersion(raw) {
 }
 /** Normalize an internal profile collection or current stored envelope. */
 export function normalizeBrandProfileStore(raw) {
-    assertWorkspaceInputGraph(raw, 'Brand Profile store');
+    assertWorkspaceInputGraph(raw, 'Brand Profile store', { maximumBytes: MAX_PROFILE_STORE_BYTES });
     assertWorkspaceDeclaredVersion(raw, 'Brand Profile store');
     const sourceVersion = brandProfileStoreVersion(raw);
     if (!Array.isArray(raw) && sourceVersion !== null
@@ -416,6 +662,10 @@ export function normalizeBrandProfileStore(raw) {
     }
     return { version: BRAND_PROFILE_SCHEMA_VERSION, profiles: [...byId.values()] };
 }
+/** New authored/imported records receive an identity only at the mutation boundary. */
+export function createBrandProfileId() {
+    return crypto.randomUUID ? crypto.randomUUID() : `bp-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
 export function serializeBrandProfileStore(profiles) {
     return JSON.stringify(assertBrandProfileStoreBudget(profiles));
 }
@@ -430,8 +680,8 @@ export function assertBrandProfileStoreBudget(profiles) {
     return store;
 }
 export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
-    assertWorkspaceInputGraph(localRaw, 'Local Brand Profile store');
-    assertWorkspaceInputGraph(importedRaw, 'Imported Brand Profile document');
+    const local = normalizeBrandProfileStore(localRaw).profiles;
+    assertWorkspaceInputGraph(importedRaw, 'Imported Brand Profile document', { maximumBytes: MAX_PROFILE_STORE_BYTES });
     assertWorkspacePortableVersion(importedRaw, BRAND_PROFILE_SCHEMA_VERSION, 'Imported Brand Profile document');
     const imported = record(importedRaw);
     if (imported.schema !== BRAND_PROFILE_SCHEMA) {
@@ -463,7 +713,6 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
         if (id && name)
             retainIdName(id, name);
     }
-    const local = normalizeBrandProfileStore(localRaw).profiles;
     for (const profile of local)
         retainIdName(profile.id, profile.name);
     const byName = new Map(local.map((profile) => [profile.name.toLowerCase(), profile]));
@@ -478,9 +727,14 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
         if (rawId && rawName)
             retainIdName(rawId, rawName);
         const existing = rawName ? byName.get(rawName.toLowerCase()) : null;
+        const incomingUpdatedAt = timestamp(value.updatedAt, null);
+        if (existing && (!incomingUpdatedAt || incomingUpdatedAt <= existing.updatedAt)) {
+            skipped++;
+            continue;
+        }
         const profile = normalizeBrandProfile(item, {
             existing,
-            touch: Boolean(existing),
+            touch: false,
             nowIso: options.nowIso,
             makeId: options.makeId,
         });

package/packages/workspace/bulk-columns.mjs

@@ -0,0 +1,17 @@
+/** Optional result columns. Domain identity and actions are always available. */
+export const BULK_RESULT_COLUMNS = Object.freeze([
+    { id: 'registration', label: 'Registration' },
+    { id: 'risk', label: 'Risk' },
+    { id: 'website', label: 'Website' },
+    { id: 'registrar', label: 'Registrar' },
+    { id: 'mutation', label: 'Mutation' },
+    { id: 'review', label: 'Review' },
+    { id: 'case', label: 'Case' },
+]);
+export const DEFAULT_BULK_RESULT_COLUMNS = Object.freeze(BULK_RESULT_COLUMNS.map((column) => column.id));
+export function normalizeBulkResultColumns(value) {
+    // Missing choices preserve the full presentation used by public version 1.
+    if (!Array.isArray(value))
+        return [...DEFAULT_BULK_RESULT_COLUMNS];
+    return BULK_RESULT_COLUMNS.filter((column) => value.includes(column.id)).map((column) => column.id);
+}

package/packages/workspace/bulk-review-model.mjs

@@ -1,21 +1,28 @@
 import { normalizeDomain } from "../cases/case-model.mjs";
-import { normalizeBulkPresentationSortKey } from "./bulk-sort.mjs";
+import { CASE_DISPOSITIONS as CASE_DISPOSITION_OPTIONS } from "../cases/case-record-contracts.mjs";
+import { BULK_SORT_KEYS, normalizeBulkPresentationSortKey } from "./bulk-sort.mjs";
+import { normalizeBulkResultColumns } from "./bulk-columns.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
-import { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, MAX_BULK_REVIEW_NAME_LENGTH, MAX_BULK_REVIEW_PRESETS, MAX_BULK_REVIEW_ROWS, MAX_BULK_REVIEW_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
+import { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, BULK_REVIEW_EXPORT_SUPPORTED_VERSIONS, MAX_BULK_REVIEW_NAME_LENGTH, MAX_BULK_REVIEW_PRESETS, MAX_BULK_REVIEW_ROWS, MAX_BULK_REVIEW_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
 export { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, MAX_BULK_REVIEW_NAME_LENGTH, MAX_BULK_REVIEW_PRESETS, MAX_BULK_REVIEW_ROWS, MAX_BULK_REVIEW_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
 export const BULK_REVIEW_STATES = ['unreviewed', 'reviewing', 'reviewed', 'deferred'];
+export const BULK_SOURCE_FILTERS = ['', 'complete', 'limited', 'unrecorded'];
+export const BULK_LIFECYCLE_FILTERS = ['', 'registered', 'for_sale', 'expiring', 'available', 'unknown', 'error'];
+export const BULK_AGE_FILTERS = ['', 'new_30', 'new_365', 'older_365', 'unknown'];
+export const BULK_MAIL_FILTERS = ['', 'mail', 'no_mail', 'authenticated', 'auth_gap', 'unknown'];
+export const BULK_GROUP_OPTIONS = ['', 'mutation', 'tld', 'registrar', 'nameserver'];
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
 const PRIMARY_FILTERS = new Set(['all', 'available', 'registered', 'high_risk', 'trusted', 'profile_unevaluated', 'errors']);
-const SOURCE_FILTERS = new Set(['', 'complete', 'limited', 'failed']);
-const LIFECYCLE_FILTERS = new Set(['', 'new', 'expiring', 'aged', 'unknown']);
-const AGE_FILTERS = new Set(['', '7d', '30d', '90d', '365d', 'older', 'unknown']);
-const MAIL_FILTERS = new Set(['', 'mx', 'no_mx', 'spf_missing', 'dmarc_missing', 'unknown']);
-const GROUPS = new Set(['', 'registrar', 'nameserver', 'source_state', 'lifecycle', 'mail']);
-const SORT_KEYS = new Set(['domain', 'availability', 'risk', 'opportunity', 'activity', 'registrar', 'mutation']);
+const SOURCE_FILTERS = new Set(BULK_SOURCE_FILTERS);
+const LIFECYCLE_FILTERS = new Set(BULK_LIFECYCLE_FILTERS);
+const AGE_FILTERS = new Set(BULK_AGE_FILTERS);
+const MAIL_FILTERS = new Set(BULK_MAIL_FILTERS);
+const GROUPS = new Set(BULK_GROUP_OPTIONS);
+const SORT_KEYS = new Set(BULK_SORT_KEYS);
 const REVIEW_STATES = new Set(BULK_REVIEW_STATES);
-const CASE_DISPOSITIONS = new Set(['', 'untracked', 'unreviewed', 'suspicious', 'confirmed_abuse', 'false_positive', 'expected', 'closed_no_action']);
+const CASE_DISPOSITIONS = new Set(['', 'untracked', ...CASE_DISPOSITION_OPTIONS.map((item) => item.value)]);
 const SIGNAL_FILTERS = new Set(['favicon', 'password', 'phishing', 'asset_reuse', 'idn']);
 function record(value) {
     return ordinaryWorkspaceRecord(value, 'Bulk-review input') ?? {};
@@ -61,6 +68,7 @@ function normalizeView(raw) {
         groupBy: setValue(value.groupBy, GROUPS),
         sortKey,
         sortDirection: value.sortDirection === 1 ? 1 : -1,
+        columns: normalizeBulkResultColumns(value.columns),
     };
 }
 function normalizePreset(raw, fallback) {
@@ -107,6 +115,10 @@ function sourceLists(raw) {
 export function normalizeBulkReviewStore(raw) {
     assertWorkspaceInputGraph(raw, 'Bulk-review store');
     assertWorkspaceDeclaredVersion(raw, 'Bulk-review store');
+    const declaredVersion = record(raw).version;
+    if (typeof declaredVersion === 'number' && declaredVersion > BULK_REVIEW_SCHEMA_VERSION) {
+        throw new Error(`This Bulk review store uses newer schema ${declaredVersion}. Update the app before changing it.`);
+    }
     const fallback = new Date(0).toISOString();
     const source = sourceLists(raw);
     const presets = new Map();
@@ -148,7 +160,7 @@ export function enforceBulkReviewBudget(raw) {
     while (byteLength(JSON.stringify(store)) > MAX_BULK_REVIEW_STORE_BYTES && store.presets.length > 1)
         store.presets.pop();
     if (byteLength(JSON.stringify(store)) > MAX_BULK_REVIEW_STORE_BYTES) {
-        throw new Error('Bulk review preferences exceed the browser-local storage limit.');
+        throw new Error('Bulk review preferences exceed the workspace storage limit.');
     }
     return store;
 }
@@ -211,7 +223,7 @@ export function mergeBulkReviewStores(localRaw, importedRaw) {
     if (importedRecord.schema !== BULK_REVIEW_SCHEMA) {
         throw new Error('This file is not a WHOISleuth Bulk review export.');
     }
-    if (importedRecord.version !== BULK_REVIEW_SCHEMA_VERSION) {
+    if (!BULK_REVIEW_EXPORT_SUPPORTED_VERSIONS.some((version) => version === importedRecord.version)) {
         if (typeof importedRecord.version === 'number' && importedRecord.version > BULK_REVIEW_SCHEMA_VERSION) {
             throw new Error(`This Bulk review export uses newer schema ${importedRecord.version}. Update the app before importing it.`);
         }