drop additional domains a broader tracked domain already covers

[jamiusaliu]

Fixes #571.

Matching is suffix-based (categorizeDomain, apps/web/src/lib/domain-categories.server.ts), so blog.acme.io is already counted as the brand's whenever acme.io is tracked. As the issue says, this is not serious, the entry just sits in the settings list doing nothing.

What changed

normalizeBrandUpdate now filters out an additional domain when something broader already covers it:

• another entry in the same list, in either order, and through a chain (eu.blog.acme.io, blog.acme.io, acme.io collapses to acme.io)
• the website, when the website is part of the same update

Dropping silently rather than erroring, to match how the function already treats exact duplicates. Redundant seemed closer to duplicate than to invalid.

Two things worth a second opinion

The label boundary. isCoveredBy anchors on ., so notacme.io and fake-acme.io survive next to acme.io. A bare endsWith would silently delete a genuinely different domain, which would be a worse bug than the one being fixed. There is a test for it.

The website is only consulted when it is in the same update. A partial edit that sends additionalDomains alone has no website to compare against, and this function deliberately never touches the database. The settings form always submits both, so the real path is covered. Happy to move the check into updateBrandFn where the stored brand is available if you would rather it hold for API callers too.

One thing I did not assume: an additional domain exactly equal to the website domain is also dropped, since categorizeDomain treats === and the suffix case identically. Say the word if you would rather only strict subdomains were removed.

Testing

Six tests added to apps/web/src/lib/__tests__/brand-settings.test.ts, written before the change. Four failed against main, the two boundary guards passed from the start. apps/web is at 353 passing, up from 347, with biome check and tsc --noEmit clean.

CLA signed in the first commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KxTY4DGQWJn6My6bRCoPeM

---

Open workspace in Conductor

[vercel]

@jamiusaliu is attempting to deploy a commit to the Blue Whale Labs Team on Vercel.

A member of the Team first needs to authorize it.

[jamiusaliu]

Rebased on main and updated for #690.

That PR replaced the endsWith check this was written against with inDomainSet, so the private helper here was a second copy of something you had just consolidated. It now calls inDomainSet instead, which means the "equals, or is a subdomain of" question is answered the same way as in categorizeDomain and the citation snapshot route, and the label-boundary walk that keeps notacme.io out of acme.io comes from your helper rather than from mine.

No change to behaviour or to the tests. apps/web is at 516 passing, tsc --noEmit and biome check clean, including the new complexity ceiling.

[jamiusaliu]

Thanks for taking this the rest of the way. Rejecting the domain at the input is a better read of #571 than what I sent: the issue says these "shouldn't allow" subdomains, and a silent drop at save time answered a different question. Naming the covering domain in the message is the part I would not have thought to add.

One thing you may not have from your side: #724 landed on domain-categories.ts after you branched, so I ran ad6beff both on its own and merged with current main. It merges cleanly and is green either way. apps/web 516 on the branch and 528 merged, packages/lib 532, tsc --noEmit clean in apps/web, biome check clean repo-wide.

I did not run E2E, the build, or the new stories. I have also left the branch alone rather than rebase it, since you are working in there. Say the word if a rebase or anything else would help.