@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/packages/workspace/bulk-review-model.mjs

@@ -1,9 +1,10 @@
 import { normalizeDomain } from "../cases/case-model.mjs";
 import { CASE_DISPOSITIONS as CASE_DISPOSITION_OPTIONS } from "../cases/case-record-contracts.mjs";
-import { normalizeBulkPresentationSortKey } from "./bulk-sort.mjs";
+import { BULK_SORT_KEYS, normalizeBulkPresentationSortKey } from "./bulk-sort.mjs";
+import { normalizeBulkResultColumns } from "./bulk-columns.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
-import { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, MAX_BULK_REVIEW_NAME_LENGTH, MAX_BULK_REVIEW_PRESETS, MAX_BULK_REVIEW_ROWS, MAX_BULK_REVIEW_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
+import { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, BULK_REVIEW_EXPORT_SUPPORTED_VERSIONS, MAX_BULK_REVIEW_NAME_LENGTH, MAX_BULK_REVIEW_PRESETS, MAX_BULK_REVIEW_ROWS, MAX_BULK_REVIEW_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
 export { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, MAX_BULK_REVIEW_NAME_LENGTH, MAX_BULK_REVIEW_PRESETS, MAX_BULK_REVIEW_ROWS, MAX_BULK_REVIEW_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
 export const BULK_REVIEW_STATES = ['unreviewed', 'reviewing', 'reviewed', 'deferred'];
 export const BULK_SOURCE_FILTERS = ['', 'complete', 'limited', 'unrecorded'];
@@ -19,7 +20,7 @@ const LIFECYCLE_FILTERS = new Set(BULK_LIFECYCLE_FILTERS);
 const AGE_FILTERS = new Set(BULK_AGE_FILTERS);
 const MAIL_FILTERS = new Set(BULK_MAIL_FILTERS);
 const GROUPS = new Set(BULK_GROUP_OPTIONS);
-const SORT_KEYS = new Set(['domain', 'availability', 'confidence', 'risk', 'opportunity', 'activity', 'registrar', 'mutation']);
+const SORT_KEYS = new Set(BULK_SORT_KEYS);
 const REVIEW_STATES = new Set(BULK_REVIEW_STATES);
 const CASE_DISPOSITIONS = new Set(['', 'untracked', ...CASE_DISPOSITION_OPTIONS.map((item) => item.value)]);
 const SIGNAL_FILTERS = new Set(['favicon', 'password', 'phishing', 'asset_reuse', 'idn']);
@@ -67,6 +68,7 @@ function normalizeView(raw) {
         groupBy: setValue(value.groupBy, GROUPS),
         sortKey,
         sortDirection: value.sortDirection === 1 ? 1 : -1,
+        columns: normalizeBulkResultColumns(value.columns),
     };
 }
 function normalizePreset(raw, fallback) {
@@ -113,6 +115,10 @@ function sourceLists(raw) {
 export function normalizeBulkReviewStore(raw) {
     assertWorkspaceInputGraph(raw, 'Bulk-review store');
     assertWorkspaceDeclaredVersion(raw, 'Bulk-review store');
+    const declaredVersion = record(raw).version;
+    if (typeof declaredVersion === 'number' && declaredVersion > BULK_REVIEW_SCHEMA_VERSION) {
+        throw new Error(`This Bulk review store uses newer schema ${declaredVersion}. Update the app before changing it.`);
+    }
     const fallback = new Date(0).toISOString();
     const source = sourceLists(raw);
     const presets = new Map();
@@ -154,7 +160,7 @@ export function enforceBulkReviewBudget(raw) {
     while (byteLength(JSON.stringify(store)) > MAX_BULK_REVIEW_STORE_BYTES && store.presets.length > 1)
         store.presets.pop();
     if (byteLength(JSON.stringify(store)) > MAX_BULK_REVIEW_STORE_BYTES) {
-        throw new Error('Bulk review preferences exceed the browser-local storage limit.');
+        throw new Error('Bulk review preferences exceed the workspace storage limit.');
     }
     return store;
 }
@@ -217,7 +223,7 @@ export function mergeBulkReviewStores(localRaw, importedRaw) {
     if (importedRecord.schema !== BULK_REVIEW_SCHEMA) {
         throw new Error('This file is not a WHOISleuth Bulk review export.');
     }
-    if (importedRecord.version !== BULK_REVIEW_SCHEMA_VERSION) {
+    if (!BULK_REVIEW_EXPORT_SUPPORTED_VERSIONS.some((version) => version === importedRecord.version)) {
         if (typeof importedRecord.version === 'number' && importedRecord.version > BULK_REVIEW_SCHEMA_VERSION) {
             throw new Error(`This Bulk review export uses newer schema ${importedRecord.version}. Update the app before importing it.`);
         }

package/packages/workspace/bulk-session-model.mjs

@@ -4,6 +4,8 @@
 import { normalizeDomain } from "../cases/case-model.mjs";
 import { normalizeCaaCritical } from "./dns-record-normalization.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { RELATIONSHIP_EVIDENCE_VERSION } from "../contracts/offline-comparison.mjs";
+import { normalizeRelationshipSourceProjection } from "../comparison/relationship-provenance.mjs";
 import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
 import { BULK_SESSION_SCHEMA, BULK_SESSION_SCHEMA_VERSION, MAX_BULK_PROFILE_CONTEXT_LIMITATION_LENGTH, MAX_BULK_SESSIONS, MAX_BULK_SESSION_ARRAY_VALUES, MAX_BULK_SESSION_NAME_LENGTH, MAX_BULK_SESSION_ROWS, MAX_BULK_SESSION_SOURCES, MAX_BULK_SESSION_STORE_BYTES, MAX_BULK_SESSION_TEXT_LENGTH, SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
 export { BULK_SESSION_SCHEMA, BULK_SESSION_SCHEMA_VERSION, MAX_BULK_PROFILE_CONTEXT_LIMITATION_LENGTH, MAX_BULK_SESSIONS, MAX_BULK_SESSION_ARRAY_VALUES, MAX_BULK_SESSION_NAME_LENGTH, MAX_BULK_SESSION_ROWS, MAX_BULK_SESSION_SOURCES, MAX_BULK_SESSION_STORE_BYTES, MAX_BULK_SESSION_TEXT_LENGTH, SUPPORTED_BULK_SESSION_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
@@ -175,7 +177,7 @@ function normalizeSourceCoverage(value) {
         if (!SOURCE_RE.test(source) || !SOURCE_STATES.has(state) || seen.has(source))
             continue;
         seen.add(source);
-        output.push({ source, state: state });
+        output.push({ source, state: state, observedAt: normalizeExplicitIsoTimestamp(item?.observedAt) });
         if (output.length >= MAX_BULK_SESSION_SOURCES)
             break;
     }
@@ -198,8 +200,11 @@ function nullableHash(value, expression) {
 }
 function normalizeRelationship(value) {
     const item = record(value);
+    if (item?.version !== undefined && item.version !== 2 && item.version !== RELATIONSHIP_EVIDENCE_VERSION) {
+        throw new TypeError('This Bulk relationship projection uses an unsupported version. No source evidence was interpreted.');
+    }
     return {
-        version: 2,
+        version: RELATIONSHIP_EVIDENCE_VERSION,
         nameservers: boundedStrings(item?.nameservers, 20),
         ipAddresses: boundedStrings(item?.ipAddresses, 50),
         trackingIdentifiers: boundedTrackingIdentifiers(item?.trackingIdentifiers),
@@ -207,6 +212,7 @@ function normalizeRelationship(value) {
         faviconHash: nullableHash(item?.faviconHash, HASH_64_RE),
         faviconPHash: nullableHash(item?.faviconPHash, PHASH_RE),
         certificateFingerprint: nullableHash(item?.certificateFingerprint, HASH_64_RE),
+        sourceEvidence: item?.version === RELATIONSHIP_EVIDENCE_VERSION ? normalizeRelationshipSourceProjection(item.sourceEvidence) : {},
         truncated: item?.truncated === true,
     };
 }
@@ -270,14 +276,14 @@ export function normalizeBulkComparisonEvidence(value) {
         },
     };
 }
-export function normalizeBulkSessionResult(value) {
+export function normalizeBulkSessionResult(value, inheritedProfileContext) {
     const item = record(value);
     const domain = normalizeDomain(item?.domain);
     const status = boundedText(item?.status, 20);
     const scanDepth = boundedText(item?.scanDepth, 10);
     if (!item || !domain || !RESULT_STATES.has(status) || !MODES.has(scanDepth))
         return null;
-    const rawProfileContext = record(item.profileContext);
+    const rawProfileContext = record(Object.hasOwn(item, 'profileContext') ? item.profileContext : inheritedProfileContext);
     if (!rawProfileContext || !['ready', 'unavailable'].includes(String(rawProfileContext.sourceState)))
         return null;
     const profileContext = normalizeBulkProfileContext(rawProfileContext);
@@ -311,6 +317,7 @@ export function normalizeBulkSessionResult(value) {
         trusted: profileClaimsUsable && !readyWithoutActiveProfile && TRUST_STATES.has(trusted) ? trusted : null,
         error: boundedText(item.error),
         scanDepth: scanDepth,
+        observedAt: normalizeExplicitIsoTimestamp(item.observedAt),
         createdDate: boundedText(item.createdDate, 64) || null,
         expiryDate: boundedText(item.expiryDate, 64) || null,
         privacyProtected: nullableBoolean(item.privacyProtected),
@@ -343,7 +350,7 @@ export function normalizeBulkSessionResult(value) {
         profileContext,
     };
 }
-export function normalizeBulkSession(value) {
+export function normalizeBulkSession(value, sourceStoreVersion) {
     const item = record(value);
     const id = boundedText(item?.id, 128);
     const name = boundedText(item?.name, MAX_BULK_SESSION_NAME_LENGTH);
@@ -367,23 +374,43 @@ export function normalizeBulkSession(value) {
         return null;
     if (!Array.isArray(item.results))
         return null;
+    const rawProfileContext = record(item.profileContext);
+    if (!rawProfileContext)
+        return null;
+    const declaredProfileContext = normalizeBulkProfileContext(rawProfileContext);
+    // Only an explicitly versioned current document may omit identical row
+    // context. Bare runtime rows and public schema 4 must carry their own context;
+    // an explicit invalid/null row value never falls back to the session.
+    const inheritedProfileContext = sourceStoreVersion === 5
+        && declaredProfileContext.sourceState !== 'mixed'
+        && rawProfileContext.sourceState === declaredProfileContext.sourceState
+        ? declaredProfileContext
+        : undefined;
     const allowed = new Set(domains);
     const results = [];
     const seen = new Set();
     for (const candidate of Array.isArray(item.results) ? item.results.slice(0, MAX_BULK_SESSION_ROWS * 2) : []) {
-        const result = normalizeBulkSessionResult(candidate);
+        const publicLegacyRow = sourceStoreVersion === 4;
+        if (publicLegacyRow && record(record(candidate)?.relationship)?.version === RELATIONSHIP_EVIDENCE_VERSION) {
+            throw new TypeError('Bulk schema 4 cannot contain newer relationship source evidence; no evidence was interpreted.');
+        }
+        const result = normalizeBulkSessionResult(candidate, inheritedProfileContext);
         if (!result || !allowed.has(result.domain) || seen.has(result.domain)) {
             return null;
         }
+        // Public schema 4 never recorded a row observation time or qualified
+        // relationship sources. Ignore added fields rather than backdating them.
+        if (publicLegacyRow) {
+            result.observedAt = null;
+            result.relationship.sourceEvidence = {};
+            result.sourceCoverage = result.sourceCoverage.map((source) => ({ ...source, observedAt: null }));
+        }
         seen.add(result.domain);
         results.push(result);
     }
     if ((state === 'complete') !== (results.length === domains.length))
         return null;
     const profileContext = summarizeBulkProfileContexts(results);
-    if (!record(item.profileContext))
-        return null;
-    const declaredProfileContext = normalizeBulkProfileContext(item.profileContext);
     if (!sameProfileContext(declaredProfileContext, profileContext))
         return null;
     return {
@@ -407,7 +434,9 @@ export function bulkSessionStoreVersion(raw) {
         : null;
 }
 export function normalizeBulkSessionStore(raw) {
-    assertWorkspaceInputGraph(raw, 'Bulk-session store');
+    // Preparation may combine an existing store and one incoming store before
+    // whole-session eviction. The persisted document still has its 4 MiB cap.
+    assertWorkspaceInputGraph(raw, 'Bulk-session store', { maximumBytes: MAX_BULK_SESSION_STORE_BYTES * 2 });
     assertWorkspaceDeclaredVersion(raw, 'Bulk-session store');
     const value = record(raw);
     if (value?.schema === BULK_SESSION_SCHEMA
@@ -423,7 +452,7 @@ export function normalizeBulkSessionStore(raw) {
             : [];
     const byId = new Map();
     for (const candidate of candidates.slice(0, MAX_BULK_SESSIONS * 4)) {
-        const session = normalizeBulkSession(candidate);
+        const session = normalizeBulkSession(candidate, bulkSessionStoreVersion(raw) ?? undefined);
         if (!session)
             continue;
         const existing = byId.get(session.id);
@@ -438,8 +467,21 @@ export function normalizeBulkSessionStore(raw) {
             .slice(0, MAX_BULK_SESSIONS),
     };
 }
+/** Current wire representation of an already-normalized session. */
+export function bulkSessionStorageValue(session) {
+    return {
+        ...session,
+        results: session.results.map(({ profileContext, ...row }) => sameProfileContext(profileContext, session.profileContext)
+            ? row
+            : { ...row, profileContext }),
+    };
+}
+/** Current wire bytes for sessions already admitted by the collection owner. */
+export function serializeNormalizedBulkSessions(sessions) {
+    return JSON.stringify({ schema: BULK_SESSION_SCHEMA, version: BULK_SESSION_SCHEMA_VERSION, sessions: sessions.map(bulkSessionStorageValue) });
+}
 export function serializeBulkSessionStore(raw) {
-    return JSON.stringify(normalizeBulkSessionStore(raw));
+    return serializeNormalizedBulkSessions(normalizeBulkSessionStore(raw).sessions);
 }
 function byteLength(value) {
     return new TextEncoder().encode(value).byteLength;
@@ -447,11 +489,16 @@ function byteLength(value) {
 export function enforceBulkSessionStoreBudget(raw) {
     const store = normalizeBulkSessionStore(raw);
     let pruned = 0;
-    while (byteLength(JSON.stringify(store)) > MAX_BULK_SESSION_STORE_BYTES && store.sessions.length > 1) {
+    const sessionBytes = store.sessions.map((session) => byteLength(JSON.stringify(bulkSessionStorageValue(session))));
+    let bytes = byteLength(JSON.stringify({ ...store, sessions: [] }))
+        + sessionBytes.reduce((total, size) => total + size, 0)
+        + Math.max(0, sessionBytes.length - 1);
+    while (bytes > MAX_BULK_SESSION_STORE_BYTES && store.sessions.length > 1) {
+        bytes -= sessionBytes.pop() + 1;
         store.sessions.pop();
         pruned += 1;
     }
-    if (byteLength(JSON.stringify(store)) > MAX_BULK_SESSION_STORE_BYTES) {
+    if (bytes > MAX_BULK_SESSION_STORE_BYTES) {
         throw new Error('This Bulk session exceeds the 4 MiB browser-local session limit.');
     }
     return { store, pruned };
@@ -474,9 +521,29 @@ export function upsertBulkSession(raw, sessionRaw) {
         sessions: bounded.store.sessions,
         session,
         added: index < 0,
-        pruned: bounded.pruned,
+        pruned: Math.max(0, next.length - bounded.store.sessions.length),
     };
 }
+/** Ephemeral retention preview, never part of the stored or exported format. */
+export function prepareBulkSessionSave(raw, sessionRaw) {
+    const current = normalizeBulkSessionStore(raw).sessions;
+    const result = upsertBulkSession(current, sessionRaw);
+    if (!result.sessions.some((session) => session.id === result.session.id)) {
+        throw new Error('This Bulk session cannot fit alongside the saved sessions. Export or remove saved sessions before trying again. Nothing was changed.');
+    }
+    const retained = new Set(result.sessions.map((session) => session.id));
+    const removed = current.filter((session) => !retained.has(session.id));
+    return {
+        ...result,
+        current,
+        removed,
+        removedBytes: removed.reduce((total, session) => total + byteLength(JSON.stringify(bulkSessionStorageValue(session))), 0),
+    };
+}
+/** Confirmation applies to the exact records displayed, not just their IDs. */
+export function bulkSessionSavePreviewIsCurrent(raw, preview) {
+    return serializeBulkSessionStore(raw) === serializeNormalizedBulkSessions(preview.current);
+}
 export function deleteBulkSession(raw, idRaw) {
     const id = boundedText(idRaw, 128);
     return normalizeBulkSessionStore({
@@ -588,7 +655,7 @@ export function buildBulkSessionExport(sessions, generatedAt = new Date().toISOS
         schema: BULK_SESSION_SCHEMA,
         version: BULK_SESSION_SCHEMA_VERSION,
         generatedAt: timestamp(generatedAt, new Date().toISOString()),
-        sessions: store.sessions,
+        sessions: store.sessions.map(bulkSessionStorageValue),
         limitations: [
             'Compact Bulk results and source states only; raw source payloads and contact records are excluded.',
             'Import is non-destructive and does not resume network collection automatically.',
@@ -596,8 +663,8 @@ export function buildBulkSessionExport(sessions, generatedAt = new Date().toISOS
     };
 }
 export function mergeBulkSessions(localRaw, importedRaw) {
-    assertWorkspaceInputGraph(localRaw, 'Local Bulk-session store');
-    assertWorkspaceInputGraph(importedRaw, 'Imported Bulk-session document');
+    assertWorkspaceInputGraph(localRaw, 'Local Bulk-session store', { maximumBytes: MAX_BULK_SESSION_STORE_BYTES * 2 });
+    assertWorkspaceInputGraph(importedRaw, 'Imported Bulk-session document', { maximumBytes: MAX_BULK_SESSION_STORE_BYTES * 2 });
     assertWorkspacePortableVersion(importedRaw, BULK_SESSION_SCHEMA_VERSION, 'Imported Bulk-session document');
     const imported = record(importedRaw);
     if (!imported || imported.schema !== BULK_SESSION_SCHEMA || !Array.isArray(imported.sessions)) {
@@ -614,7 +681,7 @@ export function mergeBulkSessions(localRaw, importedRaw) {
     let updated = 0;
     let skipped = 0;
     for (const candidate of imported.sessions.slice(0, MAX_BULK_SESSIONS * 4)) {
-        const normalized = normalizeBulkSession(candidate);
+        const normalized = normalizeBulkSession(candidate, Number(imported.version));
         if (!normalized) {
             skipped += 1;
             continue;
@@ -649,8 +716,16 @@ export function mergeBulkSessions(localRaw, importedRaw) {
             skipped += 1;
             continue;
         }
+        // An import is additive: count and byte pressure must not silently remove
+        // a local session (or an earlier admitted import). The preview reports
+        // the skipped candidate and the analyst can export/remove data explicitly.
+        const merged = upsertBulkSession(sessions, session);
+        if (merged.pruned > 0 || !merged.sessions.some((item) => item.id === session.id)) {
+            skipped += 1;
+            continue;
+        }
         added += 1;
-        sessions = upsertBulkSession(sessions, session).sessions;
+        sessions = merged.sessions;
     }
     const bounded = enforceBulkSessionStoreBudget({
         schema: BULK_SESSION_SCHEMA,

package/packages/workspace/bulk-sort.mjs

@@ -1,3 +1,4 @@
+export const BULK_SORT_KEYS = ['domain', 'availability', 'confidence', 'risk', 'opportunity', 'activity', 'registrar', 'mutation'];
 /** Opportunity remains a retained data/export field, but is no longer a Bulk presentation sort. */
 export function normalizeBulkPresentationSortKey(key) {
     return key === 'opportunity' ? 'risk' : key;

package/packages/workspace/case-views.mjs

@@ -0,0 +1,102 @@
+import { CASE_VIEWS_SCHEMA, CASE_VIEWS_VERSION, CASE_VIEW_SORTS, MAX_CASE_VIEWS, MAX_CASE_VIEWS_BYTES, MAX_CASE_VIEW_NAME_LENGTH, MAX_CASE_VIEW_SEARCH_LENGTH, } from "../contracts/case-views-contract.mjs";
+import { isValidDisposition, isValidStatus } from "../cases/case-record-decisions.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceInputGraph, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+const encoder = new TextEncoder();
+const control = /[\u0000-\u001f\u007f]/u;
+function object(raw, keys, label) {
+    const value = ordinaryWorkspaceRecord(raw, label);
+    if (!value || Object.keys(value).length !== keys.length || Object.keys(value).some(key => !keys.includes(key)))
+        throw new Error(`${label} has missing or unsupported fields.`);
+    return value;
+}
+function text(raw, maximum, label) {
+    if (typeof raw !== 'string' || raw.length > maximum || control.test(raw))
+        throw new Error(`${label} is invalid or exceeds ${maximum} characters.`);
+    return raw;
+}
+function time(raw) {
+    const value = normalizeExplicitIsoTimestamp(raw);
+    if (!value)
+        throw new Error('A saved Case view has an invalid timestamp.');
+    return value;
+}
+export function normalizeCaseViewFilters(raw) {
+    const value = object(raw, ['status', 'disposition', 'search', 'sort'], 'Case filters');
+    if (value.status !== '' && !isValidStatus(value.status))
+        throw new Error('Unsupported Case status filter.');
+    if (value.disposition !== '' && !isValidDisposition(value.disposition))
+        throw new Error('Unsupported Case disposition filter.');
+    const sort = CASE_VIEW_SORTS.find(option => option.value === value.sort)?.value;
+    if (!sort)
+        throw new Error('Unsupported Case sort order.');
+    return { status: value.status, disposition: value.disposition, search: text(value.search, MAX_CASE_VIEW_SEARCH_LENGTH, 'Case search'), sort };
+}
+export function emptyCaseViewsStore() {
+    return { schema: CASE_VIEWS_SCHEMA, version: CASE_VIEWS_VERSION, views: [] };
+}
+export function caseViewsStoreVersion(raw) {
+    const value = ordinaryWorkspaceRecord(raw, 'Case views');
+    return value?.schema === CASE_VIEWS_SCHEMA && Number.isSafeInteger(value.version) ? value.version : null;
+}
+/** Strict, lossless admission: invalid views and capacity excess never prune saved work. */
+export function normalizeCaseViewsStore(raw) {
+    if (raw === null || raw === undefined)
+        return emptyCaseViewsStore();
+    assertWorkspaceInputGraph(raw, 'Saved Case views', { maximumBytes: MAX_CASE_VIEWS_BYTES });
+    const store = object(raw, ['schema', 'version', 'views'], 'Case views');
+    if (store.schema !== CASE_VIEWS_SCHEMA || store.version !== CASE_VIEWS_VERSION)
+        throw new Error('Unsupported saved Case view format. No views were changed.');
+    if (!Array.isArray(store.views) || store.views.length > MAX_CASE_VIEWS)
+        throw new Error(`Keep at most ${MAX_CASE_VIEWS} saved Case views. Delete unwanted views explicitly before adding more.`);
+    const ids = new Set();
+    const views = [];
+    let bytes = encoder.encode(JSON.stringify(emptyCaseViewsStore())).byteLength;
+    for (const candidate of store.views) {
+        const value = object(candidate, ['id', 'name', 'filters', 'createdAt', 'updatedAt'], 'Saved Case view');
+        if (typeof value.id !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/u.test(value.id) || ids.has(value.id))
+            throw new Error('Invalid or duplicate saved Case view identity.');
+        ids.add(value.id);
+        const name = text(value.name, MAX_CASE_VIEW_NAME_LENGTH, 'Case view name').trim();
+        if (!name)
+            throw new Error('Name this Case view.');
+        const createdAt = time(value.createdAt);
+        const updatedAt = time(value.updatedAt);
+        if (Date.parse(updatedAt) < Date.parse(createdAt))
+            throw new Error('A saved Case view update precedes its creation.');
+        const view = { id: value.id, name, filters: normalizeCaseViewFilters(value.filters), createdAt, updatedAt };
+        bytes += encoder.encode(JSON.stringify(view)).byteLength + (views.length ? 1 : 0);
+        if (bytes > MAX_CASE_VIEWS_BYTES)
+            throw new Error('Saved Case views exceed their storage limit. Existing views were not removed.');
+        views.push(view);
+    }
+    return { ...emptyCaseViewsStore(), views };
+}
+export function serializeCaseViewsStore(raw) {
+    return JSON.stringify(normalizeCaseViewsStore(raw));
+}
+export function serialiseCaseViewsJson(raw) {
+    return `${JSON.stringify(normalizeCaseViewsStore(raw), null, 2)}\n`;
+}
+export function mergeCaseViews(local, incoming) {
+    const current = normalizeCaseViewsStore(local);
+    const imported = normalizeCaseViewsStore(incoming);
+    const views = new Map(current.views.map(view => [view.id, view]));
+    let added = 0, updated = 0, skipped = 0;
+    for (const view of imported.views) {
+        const existing = views.get(view.id);
+        if (!existing) {
+            views.set(view.id, view);
+            added += 1;
+        }
+        else if (JSON.stringify(existing) === JSON.stringify(view))
+            continue;
+        else if (Date.parse(view.updatedAt) > Date.parse(existing.updatedAt) && view.createdAt === existing.createdAt) {
+            views.set(view.id, view);
+            updated += 1;
+        }
+        else
+            skipped += 1;
+    }
+    return { store: normalizeCaseViewsStore({ ...current, views: [...views.values()] }), added, updated, skipped };
+}

package/packages/workspace/hostile-input.mjs

@@ -1,4 +1,5 @@
 import { MAX_WORKSPACE_INPUT_ARRAY_LENGTH, MAX_WORKSPACE_INPUT_GRAPH_DEPTH, MAX_WORKSPACE_INPUT_GRAPH_NODES, MAX_WORKSPACE_INPUT_OBJECT_KEYS, MAX_WORKSPACE_INPUT_STRING_CODE_UNITS, } from "../contracts/workspace-portability.mjs";
+import { boundedJsonLimitsForBytes } from "../../lib/bounded-json.mjs";
 function inputError(label, detail) {
     return new TypeError(`${label} must be bounded ordinary JSON data; ${detail}.`);
 }
@@ -27,9 +28,7 @@ function ownDataDescriptors(value, label) {
         return [key, descriptor];
     });
 }
-export function ordinaryWorkspaceRecord(value, label = 'Workspace input') {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return null;
+function ordinaryRecordDescriptors(value, label) {
     let prototype;
     try {
         prototype = Object.getPrototypeOf(value);
@@ -47,19 +46,33 @@ export function ordinaryWorkspaceRecord(value, label = 'Workspace input') {
     if (descriptors.some(([, descriptor]) => !descriptor.enumerable)) {
         throw inputError(label, 'non-enumerable object fields are not supported');
     }
+    return descriptors;
+}
+export function ordinaryWorkspaceRecord(value, label = 'Workspace input') {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    ordinaryRecordDescriptors(value, label);
     return value;
 }
-export function assertWorkspaceInputGraph(value, label = 'Workspace input') {
+export function assertWorkspaceInputGraph(value, label = 'Workspace input', options = {}) {
+    const limits = options.maximumBytes === undefined ? null : boundedJsonLimitsForBytes(options.maximumBytes);
+    const maximumStringCodeUnits = limits?.maximumStringCodeUnits ?? MAX_WORKSPACE_INPUT_STRING_CODE_UNITS;
     const pending = [{ value, depth: 0, label }];
     const seen = new WeakSet();
     let nodes = 0;
+    let values = 0;
+    let keys = 0;
     let stringCodeUnits = 0;
     while (pending.length) {
         const current = pending.pop();
         const candidate = current.value;
+        values += 1;
+        if (limits && values > limits.maximumValues) {
+            throw inputError(label, 'the graph exceeds the byte-budgeted value ceiling');
+        }
         if (typeof candidate === 'string') {
             stringCodeUnits += candidate.length;
-            if (stringCodeUnits > MAX_WORKSPACE_INPUT_STRING_CODE_UNITS) {
+            if (stringCodeUnits > maximumStringCodeUnits) {
                 throw inputError(label, 'aggregate text exceeds the string ceiling');
             }
             continue;
@@ -76,7 +89,7 @@ export function assertWorkspaceInputGraph(value, label = 'Workspace input') {
             throw inputError(label, 'the nesting depth exceeds the graph ceiling');
         }
         nodes += 1;
-        if (nodes > MAX_WORKSPACE_INPUT_GRAPH_NODES) {
+        if (!limits && nodes > MAX_WORKSPACE_INPUT_GRAPH_NODES) {
             throw inputError(label, 'the graph exceeds the node ceiling');
         }
         if (seen.has(candidate))
@@ -118,8 +131,16 @@ export function assertWorkspaceInputGraph(value, label = 'Workspace input') {
             }
             continue;
         }
-        const record = ordinaryWorkspaceRecord(candidate, current.label);
-        const descriptors = ownDataDescriptors(record, current.label);
+        const descriptors = ordinaryRecordDescriptors(candidate, current.label);
+        if (limits) {
+            keys += descriptors.length;
+            if (keys > limits.maximumKeys)
+                throw inputError(label, 'the graph exceeds the byte-budgeted key ceiling');
+            stringCodeUnits += descriptors.reduce((total, [key]) => total + key.length, 0);
+            if (stringCodeUnits > maximumStringCodeUnits) {
+                throw inputError(label, 'aggregate text exceeds the string ceiling');
+            }
+        }
         for (const [key, descriptor] of descriptors) {
             pending.push({
                 value: descriptor.value,

package/packages/workspace/investigation-template-model.mjs

@@ -85,6 +85,9 @@ export function saveInvestigationTemplate(localRaw, candidateRaw) {
     if (!candidate)
         throw new Error('The investigation template is incomplete or invalid.');
     const local = normalizeInvestigationTemplateStore(localRaw).templates;
+    if (!local.some((item) => item.id === candidate.id) && local.length >= MAX_INVESTIGATION_TEMPLATES) {
+        throw new Error(`Investigation-template storage is full (${MAX_INVESTIGATION_TEMPLATES} templates). Export and remove a template before saving another; no templates were changed.`);
+    }
     return normalizeInvestigationTemplateStore([
         candidate,
         ...local.filter((item) => item.id !== candidate.id),
@@ -126,11 +129,23 @@ export function mergeInvestigationTemplates(localRaw, incomingRaw) {
     const byId = new Map(local.map((item) => [item.id, item]));
     let added = 0;
     let updated = 0;
+    let skipped = 0;
     for (const item of incoming) {
-        if (byId.has(item.id))
+        const existing = byId.get(item.id);
+        if (existing) {
+            if (item.updatedAt <= existing.updatedAt) {
+                skipped += 1;
+                continue;
+            }
             updated += 1;
-        else
+        }
+        else {
+            if (byId.size >= MAX_INVESTIGATION_TEMPLATES) {
+                skipped += 1;
+                continue;
+            }
             added += 1;
+        }
         byId.set(item.id, item);
     }
     const templates = normalizeInvestigationTemplateStore([...byId.values()]).templates;
@@ -138,7 +153,7 @@ export function mergeInvestigationTemplates(localRaw, incomingRaw) {
         templates,
         added,
         updated,
-        skipped: Math.max(0, incoming.length - added - updated),
-        pruned: Math.max(0, byId.size - templates.length),
+        skipped,
+        pruned: 0,
     };
 }

package/packages/workspace/page-baseline.mjs

@@ -5,12 +5,12 @@
 import { normalizeDomain } from "../cases/case-model.mjs";
 import { isInformativePerceptualHash as isInformativeFaviconHash } from "../../lib/perceptual-hash-comparison.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
-import { MAX_BASELINE_IDENTIFIERS, MAX_BASELINE_RESOURCE_HOSTS, MAX_BASELINE_TITLE_LENGTH, PAGE_BASELINE_VERSION, PAGE_FINGERPRINT_VERSION, PAGE_IDENTITY_VERSION, } from "../contracts/workspace-portability.mjs";
-export { MAX_BASELINE_IDENTIFIERS, MAX_BASELINE_RESOURCE_HOSTS, MAX_BASELINE_TITLE_LENGTH, PAGE_BASELINE_VERSION, PAGE_FINGERPRINT_VERSION, PAGE_IDENTITY_VERSION, } from "../contracts/workspace-portability.mjs";
+import { PAGE_FINGERPRINT_TOKEN_LIMITS } from "../contracts/page-fingerprints.mjs";
+import { MAX_BASELINE_IDENTIFIERS, MAX_BASELINE_RESOURCE_HOSTS, MAX_BASELINE_TITLE_LENGTH, PAGE_BASELINE_VERSION, PAGE_FINGERPRINT_PARSERS, PAGE_IDENTITY_VERSION, } from "../contracts/workspace-portability.mjs";
+export { MAX_BASELINE_IDENTIFIERS, MAX_BASELINE_RESOURCE_HOSTS, MAX_BASELINE_TITLE_LENGTH, PAGE_BASELINE_VERSION, PAGE_FINGERPRINT_VERSION, PAGE_FINGERPRINT_PARSERS, PAGE_IDENTITY_VERSION, } from "../contracts/workspace-portability.mjs";
 const SHA256_RE = /^[a-f0-9]{64}$/i;
 const SIMHASH_RE = /^[a-f0-9]{16}$/i;
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
-const MAX_HTML_TOKENS = 4096;
 const MAX_TEXT_TOKENS = 8192;
 const MAX_FORMS = 50;
 const MAX_FORM_CONTROLS = 500;
@@ -50,12 +50,12 @@ function shaComponent(raw, countKey, maximum) {
         truncated: value.truncated === true,
     };
 }
-function visibleTextComponent(raw) {
+function visibleTextComponent(raw, maximum = MAX_TEXT_TOKENS) {
     const value = record(raw);
     if (!value || value.algorithm !== 'simhash64-v1' || typeof value.value !== 'string' || !SIMHASH_RE.test(value.value))
         return null;
-    const tokenCount = count(value.tokenCount, MAX_TEXT_TOKENS);
-    const featureCount = count(value.featureCount, MAX_TEXT_TOKENS);
+    const tokenCount = count(value.tokenCount, maximum);
+    const featureCount = count(value.featureCount, maximum);
     if (tokenCount === null || featureCount === null)
         return null;
     return {
@@ -66,20 +66,21 @@ function visibleTextComponent(raw) {
         truncated: value.truncated === true,
     };
 }
-function domComponent(raw) {
+function domComponent(raw, fingerprintVersion) {
     const value = record(raw);
-    if (!value || value.algorithm !== 'sha256' || value.parser !== 'static-tag-sequence-v1')
+    if (!value || value.algorithm !== 'sha256' || value.parser !== PAGE_FINGERPRINT_PARSERS[fingerprintVersion])
         return null;
     const digest = sha256(value.value);
-    const nodeCount = count(value.nodeCount, MAX_HTML_TOKENS);
+    const maximum = PAGE_FINGERPRINT_TOKEN_LIMITS[fingerprintVersion];
+    const nodeCount = count(value.nodeCount, maximum);
     if (!digest || nodeCount === null)
         return null;
-    const similarity = value.similarity == null ? null : visibleTextComponent(value.similarity);
+    const similarity = value.similarity == null ? null : visibleTextComponent(value.similarity, maximum);
     return {
         algorithm: 'sha256',
         value: digest,
         nodeCount,
-        parser: 'static-tag-sequence-v1',
+        parser: PAGE_FINGERPRINT_PARSERS[fingerprintVersion],
         truncated: value.truncated === true,
         ...(value.similarity == null ? {} : { similarity }),
     };
@@ -175,11 +176,13 @@ export function normalizePageBaseline(raw) {
     const lookupDomain = normalizeDomain(value.lookupDomain);
     const observedAt = timestamp(value.observedAt);
     const pageIdentityVersion = count(value.pageIdentityVersion, PAGE_IDENTITY_VERSION);
-    const fingerprintVersion = count(value.fingerprintVersion, PAGE_FINGERPRINT_VERSION);
-    const normalizedHtml = shaComponent(value.normalizedHtml, 'tokenCount', MAX_HTML_TOKENS);
-    const domStructure = domComponent(value.domStructure);
+    if (typeof value.fingerprintVersion !== 'number' || !Object.hasOwn(PAGE_FINGERPRINT_PARSERS, value.fingerprintVersion))
+        return null;
+    const fingerprintVersion = value.fingerprintVersion;
+    const normalizedHtml = shaComponent(value.normalizedHtml, 'tokenCount', PAGE_FINGERPRINT_TOKEN_LIMITS[fingerprintVersion]);
+    const domStructure = domComponent(value.domStructure, fingerprintVersion);
     if (!domain || !lookupDomain || !observedAt || pageIdentityVersion !== PAGE_IDENTITY_VERSION
-        || fingerprintVersion !== PAGE_FINGERPRINT_VERSION || !normalizedHtml || !domStructure)
+        || !normalizedHtml || !domStructure)
         return null;
     const visibleText = value.visibleText == null ? null : visibleTextComponent(value.visibleText);
     const formStructure = value.formStructure == null ? null : formComponent(value.formStructure);