0sec-cli 0.15.0 → 0.18.0

package/chunks/chunk-CMKXP5RR.js

@@ -0,0 +1,917 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  jitterFor
+} from "./chunk-YYRBQVFE.js";
+
+// packages/core/dist/scope/rate-limit.js
+var TokenBucket = class {
+  state;
+  nowFn;
+  sleepFn;
+  jitter;
+  constructor(rps, capacity = rps, nowFn = () => Date.now(), sleepFn = defaultSleep, jitter) {
+    if (!Number.isFinite(rps) || rps <= 0) {
+      throw new Error(`TokenBucket: rps must be a positive finite number, got ${rps}`);
+    }
+    if (!Number.isFinite(capacity) || capacity <= 0) {
+      throw new Error(`TokenBucket: capacity must be a positive finite number, got ${capacity}`);
+    }
+    this.nowFn = nowFn;
+    this.sleepFn = sleepFn;
+    this.jitter = jitter && jitter.baseMs > 0 ? jitter : void 0;
+    this.state = {
+      tokens: capacity,
+      refillRatePerMs: rps / 1e3,
+      capacity,
+      lastRefill: nowFn(),
+      retryUntil: 0
+    };
+  }
+  refill() {
+    const now = this.nowFn();
+    const elapsed = now - this.state.lastRefill;
+    if (elapsed > 0) {
+      this.state.tokens = Math.min(this.state.capacity, this.state.tokens + elapsed * this.state.refillRatePerMs);
+      this.state.lastRefill = now;
+    }
+  }
+  /**
+   * Non-blocking. Returns true and consumes `n` tokens if available;
+   * returns false and consumes nothing otherwise. Blocked during 429
+   * cool-off (returns false until park expires).
+   */
+  tryConsume(n = 1) {
+    if (this.nowFn() < this.state.retryUntil)
+      return false;
+    this.refill();
+    if (this.state.tokens >= n) {
+      this.state.tokens -= n;
+      return true;
+    }
+    return false;
+  }
+  /**
+   * Block until `n` tokens are available, then consume them. Honours
+   * the 429 park deadline first, then refill-and-spin with sleeps
+   * sized to the exact next-token-available time.
+   */
+  async acquire(n = 1) {
+    if (n > this.state.capacity) {
+      n = this.state.capacity;
+    }
+    while (this.nowFn() < this.state.retryUntil) {
+      const wait = this.state.retryUntil - this.nowFn();
+      await this.sleepFn(Math.max(1, Math.min(wait, 1e3)));
+    }
+    while (true) {
+      this.refill();
+      if (this.state.tokens >= n) {
+        this.state.tokens -= n;
+        await this.pace();
+        return;
+      }
+      const tokensNeeded = n - this.state.tokens;
+      const waitMs = Math.max(1, Math.ceil(tokensNeeded / this.state.refillRatePerMs));
+      await this.sleepFn(waitMs);
+    }
+  }
+  /**
+   * Sleep the configured full-jitter delay. No-op (and no `await`-visible
+   * sleep) when no jitter is configured, so the default path is unchanged.
+   *
+   * Reuses `jitterFor` from `waf-detect.ts` — attempt 0 with an injected rng
+   * yields full jitter in `[0, baseMs]` — rather than growing a second
+   * jitter implementation.
+   */
+  async pace() {
+    if (!this.jitter)
+      return;
+    const ms = jitterFor(0, this.jitter.baseMs, this.jitter.rng ?? Math.random);
+    if (ms > 0)
+      await this.sleepFn(ms);
+  }
+  /**
+   * Park the bucket until `deadline` (ms since epoch). Subsequent
+   * `acquire`/`tryConsume` calls block until the deadline passes.
+   * Idempotent in the "later wins" sense: a longer park overrides a
+   * shorter one, but a shorter park does NOT shorten an existing one.
+   */
+  markRetryUntil(deadline) {
+    if (deadline > this.state.retryUntil) {
+      this.state.retryUntil = deadline;
+    }
+  }
+  /** Test introspection. */
+  _peek() {
+    this.refill();
+    return {
+      tokens: this.state.tokens,
+      retryUntil: this.state.retryUntil,
+      capacity: this.state.capacity
+    };
+  }
+};
+var RateLimiter = class _RateLimiter {
+  buckets = /* @__PURE__ */ new Map();
+  defaultCfg;
+  perHost;
+  jitter;
+  nowFn;
+  sleepFn;
+  /**
+   * Conservative cool-off floor when a 429 lands without a useful
+   * `Retry-After`, or with a tiny one. 60s matches the PoC-runtime
+   * precedent in #206 — a target that just told us to slow down has
+   * earned more than a one-second pause.
+   */
+  static RETRY_AFTER_FLOOR_MS = 6e4;
+  /**
+   * Optional observer invoked once whenever a fetch is actually throttled:
+   * either an `acquire` that had to block because the bucket was dry, or a
+   * 429 response parking the host. Used by the http_audit enforcement
+   * tracker to populate `rate_limited_count`. No-op when unset, so the
+   * normal scan path is unaffected.
+   */
+  onThrottle;
+  constructor(config, opts = {}) {
+    this.defaultCfg = config.default;
+    this.jitter = config.jitter;
+    this.perHost = {};
+    if (config.perHost) {
+      for (const [host, cfg] of Object.entries(config.perHost)) {
+        this.perHost[host.toLowerCase()] = cfg;
+      }
+    }
+    this.nowFn = opts.nowFn ?? (() => Date.now());
+    this.sleepFn = opts.sleepFn ?? defaultSleep;
+    this.onThrottle = opts.onThrottle;
+  }
+  /**
+   * Normalize a URL or host string to a bucket key. Lowercased,
+   * port-stripped, IPv6 brackets retained on the literal but dropped
+   * from the port suffix (e.g. `[::1]:443` → `[::1]`).
+   */
+  hostKey(urlOrHost) {
+    let host;
+    try {
+      host = new URL(urlOrHost).hostname;
+    } catch {
+      const trimmed = urlOrHost.trim();
+      if (!trimmed)
+        return null;
+      if (trimmed.startsWith("[")) {
+        const close = trimmed.indexOf("]");
+        if (close < 0)
+          return null;
+        host = trimmed.slice(0, close + 1);
+      } else {
+        host = trimmed.split(":")[0];
+      }
+    }
+    return host.toLowerCase();
+  }
+  getBucket(host) {
+    let bucket = this.buckets.get(host);
+    if (!bucket) {
+      const cfg = this.perHost[host] ?? this.defaultCfg;
+      bucket = new TokenBucket(cfg.rps, cfg.burst ?? cfg.rps, this.nowFn, this.sleepFn, this.jitter);
+      this.buckets.set(host, bucket);
+    }
+    return bucket;
+  }
+  /**
+   * Block until a token is available for `urlOrHost`'s host, then
+   * consume it. Unparseable input is treated as a no-op (returns
+   * immediately) — callers should not rely on rate-limiting unknowable
+   * hosts. The fetch sites that wire this up always pass full URLs.
+   */
+  async acquire(urlOrHost, n = 1) {
+    const host = this.hostKey(urlOrHost);
+    if (!host)
+      return;
+    const bucket = this.getBucket(host);
+    if (bucket.tryConsume(n)) {
+      await bucket.pace();
+      return;
+    }
+    this.onThrottle?.();
+    await bucket.acquire(n);
+  }
+  /**
+   * Non-blocking variant. Returns true and consumes if available,
+   * false otherwise. Used by callers that want to fall through to a
+   * fast-path / degrade rather than wait.
+   */
+  tryAcquire(urlOrHost, n = 1) {
+    const host = this.hostKey(urlOrHost);
+    if (!host)
+      return true;
+    return this.getBucket(host).tryConsume(n);
+  }
+  /**
+   * Inspect a fetch response and, if it's a 429, park the host's
+   * bucket until `Retry-After` (or 60s, whichever is longer). The
+   * parsed value supports both delta-seconds (RFC 7231 §7.1.3) and
+   * HTTP-date forms; anything else falls back to the floor.
+   *
+   * No-ops on non-429 responses, or on hosts with no bucket yet
+   * (which can't happen if the caller acquired before fetching, but
+   * we don't depend on that).
+   */
+  noteResponse(urlOrHost, res) {
+    if (res.status !== 429)
+      return;
+    const host = this.hostKey(urlOrHost);
+    if (!host)
+      return;
+    this.onThrottle?.();
+    const bucket = this.getBucket(host);
+    const retryAfter = readHeader(res.headers, "retry-after");
+    const delayMs = parseRetryAfter(retryAfter, this.nowFn());
+    const deadline = this.nowFn() + Math.max(delayMs, _RateLimiter.RETRY_AFTER_FLOOR_MS);
+    bucket.markRetryUntil(deadline);
+  }
+  /** Test-only. Reset all buckets. */
+  _reset() {
+    this.buckets.clear();
+  }
+};
+function defaultSleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+function readHeader(headers, name) {
+  if (typeof headers.get === "function") {
+    return headers.get(name);
+  }
+  return null;
+}
+function parseRetryAfter(value, now) {
+  if (!value)
+    return 0;
+  const trimmed = value.trim();
+  if (!trimmed)
+    return 0;
+  if (/^\d+$/.test(trimmed)) {
+    const seconds = parseInt(trimmed, 10);
+    return Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : 0;
+  }
+  const date = Date.parse(trimmed);
+  if (Number.isFinite(date)) {
+    return Math.max(0, date - now);
+  }
+  return 0;
+}
+function parseRateLimitFlag(spec, fallbackRps = 5) {
+  const trimmed = spec.trim();
+  if (!trimmed) {
+    return { default: { rps: fallbackRps } };
+  }
+  const parts = trimmed.split(",").map((p) => p.trim()).filter(Boolean);
+  let defaultCfg = null;
+  const perHost = {};
+  for (const part of parts) {
+    const eq = part.indexOf("=");
+    if (eq < 0) {
+      const cfg = parseRpsBurst(part);
+      defaultCfg = cfg;
+    } else {
+      const host = part.slice(0, eq).trim().toLowerCase();
+      const cfg = parseRpsBurst(part.slice(eq + 1));
+      if (!host) {
+        throw new Error(`--rate-limit: empty host in "${part}"`);
+      }
+      perHost[host] = cfg;
+    }
+  }
+  return {
+    default: defaultCfg ?? { rps: fallbackRps },
+    perHost: Object.keys(perHost).length > 0 ? perHost : void 0
+  };
+}
+function parseRpsBurst(s) {
+  const trimmed = s.trim();
+  if (!trimmed) {
+    throw new Error(`--rate-limit: empty rps value`);
+  }
+  const colon = trimmed.indexOf(":");
+  if (colon < 0) {
+    const rps2 = Number(trimmed);
+    if (!Number.isFinite(rps2) || rps2 <= 0) {
+      throw new Error(`--rate-limit: invalid rps "${trimmed}"`);
+    }
+    return { rps: rps2 };
+  }
+  const rps = Number(trimmed.slice(0, colon));
+  const burst = Number(trimmed.slice(colon + 1));
+  if (!Number.isFinite(rps) || rps <= 0) {
+    throw new Error(`--rate-limit: invalid rps "${trimmed.slice(0, colon)}"`);
+  }
+  if (!Number.isFinite(burst) || burst <= 0) {
+    throw new Error(`--rate-limit: invalid burst "${trimmed.slice(colon + 1)}"`);
+  }
+  return { rps, burst };
+}
+
+// packages/core/dist/stages/web.js
+import { randomUUID } from "node:crypto";
+var RATE_LIMITER_CACHE = /* @__PURE__ */ new WeakMap();
+function getStageRateLimiter(config) {
+  let rl = RATE_LIMITER_CACHE.get(config);
+  if (!rl) {
+    rl = new RateLimiter(parseRateLimitFlag(config.rateLimit ?? "", 5));
+    RATE_LIMITER_CACHE.set(config, rl);
+  }
+  return rl;
+}
+var EVIL_ORIGIN = "https://evil.example";
+async function runWebDiscoveryProbe(ctx) {
+  const response = await requestUrl(ctx.config.target, {
+    method: "GET",
+    headers: {
+      Accept: "text/html,application/xhtml+xml,application/json;q=0.9,*/*;q=0.8"
+    },
+    timeout: ctx.config.timeout,
+    rateLimiter: getStageRateLimiter(ctx.config)
+  });
+  return {
+    url: ctx.config.target,
+    type: "web-app",
+    endpoints: discoverInterestingEndpoints(response.body),
+    detectedFeatures: detectWebFeatures(response.body, response.headers)
+  };
+}
+async function runBaselineWebChecks(ctx) {
+  const findings = [];
+  const results = [];
+  const baseResponse = await requestUrl(ctx.config.target, {
+    method: "GET",
+    headers: {
+      Accept: "text/html,application/xhtml+xml,application/json;q=0.9,*/*;q=0.8"
+    },
+    timeout: ctx.config.timeout,
+    rateLimiter: getStageRateLimiter(ctx.config)
+  });
+  results.push(createAttackResult("web-root-fetch", "baseline-get", "GET /", summarizeResponse(baseResponse), "safe", baseResponse.latencyMs));
+  const headerFinding = buildSecurityHeadersFinding(ctx, baseResponse);
+  results.push(createAttackResult("web-security-headers", "missing-headers", "GET / (security header audit)", summarizeResponse(baseResponse), headerFinding ? "vulnerable" : "safe", baseResponse.latencyMs));
+  if (headerFinding)
+    findings.push(headerFinding);
+  const disclosureFinding = buildHeaderDisclosureFinding(baseResponse);
+  results.push(createAttackResult("web-header-disclosure", "server-fingerprint", "GET / (response header disclosure check)", summarizeResponse(baseResponse), disclosureFinding ? "vulnerable" : "safe", baseResponse.latencyMs));
+  if (disclosureFinding)
+    findings.push(disclosureFinding);
+  const corsCheck = await runCorsCheck(ctx);
+  results.push(corsCheck.result);
+  if (corsCheck.finding)
+    findings.push(corsCheck.finding);
+  const sensitivePathChecks = await runSensitivePathChecks(ctx);
+  results.push(...sensitivePathChecks.results);
+  findings.push(...sensitivePathChecks.findings);
+  return { findings, results };
+}
+async function runCorsCheck(ctx) {
+  const headers = {
+    Origin: EVIL_ORIGIN,
+    "Access-Control-Request-Method": "POST",
+    "Access-Control-Request-Headers": "content-type,authorization"
+  };
+  let response;
+  try {
+    response = await requestUrl(ctx.config.target, {
+      method: "OPTIONS",
+      headers,
+      timeout: ctx.config.timeout,
+      rateLimiter: getStageRateLimiter(ctx.config)
+    });
+  } catch {
+    response = await requestUrl(ctx.config.target, {
+      method: "GET",
+      headers: { Origin: EVIL_ORIGIN },
+      timeout: ctx.config.timeout,
+      rateLimiter: getStageRateLimiter(ctx.config)
+    });
+  }
+  const origin = response.headers["access-control-allow-origin"];
+  const credentials = response.headers["access-control-allow-credentials"]?.toLowerCase() === "true";
+  let severity = null;
+  let description = "";
+  if ((origin === "*" || origin === EVIL_ORIGIN) && credentials) {
+    severity = "high";
+    description = "The application allows a hostile origin and also permits credentialed cross-origin requests, enabling browser-based data theft.";
+  } else if (origin === EVIL_ORIGIN) {
+    severity = "medium";
+    description = "The application reflects an arbitrary Origin value, which weakens same-origin protections for browser clients.";
+  } else if (origin === "*") {
+    severity = "medium";
+    description = "The application allows any origin with Access-Control-Allow-Origin: *, expanding cross-origin data exposure.";
+  }
+  return {
+    finding: severity ? createFinding({
+      templateId: "web-cors",
+      title: "Permissive CORS policy",
+      description,
+      severity,
+      category: "cors",
+      request: `OPTIONS ${ctx.config.target}
+Origin: ${EVIL_ORIGIN}
+Access-Control-Request-Method: POST`,
+      response: summarizeResponse(response),
+      analysis: `Observed CORS headers: Access-Control-Allow-Origin=${origin ?? "<absent>"}, Access-Control-Allow-Credentials=${response.headers["access-control-allow-credentials"] ?? "<absent>"}.`
+    }) : void 0,
+    result: createAttackResult("web-cors", "arbitrary-origin", `OPTIONS / with Origin: ${EVIL_ORIGIN}`, summarizeResponse(response), severity ? "vulnerable" : "safe", response.latencyMs)
+  };
+}
+async function runSensitivePathChecks(ctx) {
+  const candidates = [
+    {
+      path: "/.git/config",
+      title: "Exposed Git metadata",
+      severity: "high",
+      analysis: "The repository's Git config is directly accessible over HTTP, which can disclose repository layout and deployment details.",
+      matcher: /\[core\]|\[remote/i
+    },
+    {
+      path: "/.env",
+      title: "Exposed environment file",
+      severity: "critical",
+      analysis: "The application exposes its .env file over HTTP, which commonly contains secrets and deployment configuration.",
+      // Require at least two KEY=value lines to avoid matching random HTML attributes
+      matcher: /^[A-Z][A-Z0-9_]+=\S+/m,
+      minMatches: 2
+    },
+    {
+      path: "/server-status",
+      title: "Exposed server status endpoint",
+      severity: "medium",
+      analysis: "A live server-status style endpoint is publicly reachable, leaking operational details about the web stack.",
+      matcher: /server version|total accesses|uptime|busyworkers/i
+    }
+  ];
+  const findings = [];
+  const results = [];
+  for (const candidate of candidates) {
+    try {
+      const url = new URL(candidate.path, ctx.config.target).toString();
+      const response = await requestUrl(url, {
+        method: "GET",
+        headers: { Accept: "*/*" },
+        timeout: ctx.config.timeout,
+        rateLimiter: getStageRateLimiter(ctx.config)
+      });
+      const contentType = response.headers["content-type"]?.toLowerCase() ?? "";
+      const isHtmlResponse = contentType.includes("text/html") || /^\s*<!doctype html/i.test(response.body) || /<html[\s>]/i.test(response.body);
+      const matchCount = (response.body.match(new RegExp(candidate.matcher, "gm")) ?? []).length;
+      const minRequired = "minMatches" in candidate ? candidate.minMatches : 1;
+      const vulnerable = response.status >= 200 && response.status < 300 && !isHtmlResponse && matchCount >= minRequired;
+      results.push(createAttackResult("web-sensitive-paths", candidate.path, `GET ${candidate.path}`, summarizeResponse(response), vulnerable ? "vulnerable" : "safe", response.latencyMs));
+      if (!vulnerable)
+        continue;
+      findings.push(createFinding({
+        templateId: "web-sensitive-paths",
+        title: candidate.title,
+        description: candidate.analysis,
+        severity: candidate.severity,
+        category: "security-misconfiguration",
+        request: `GET ${candidate.path}`,
+        response: summarizeResponse(response),
+        analysis: `The response from ${candidate.path} matched sensitive content signatures and should not be publicly accessible.`
+      }));
+    } catch {
+      results.push(createAttackResult("web-sensitive-paths", candidate.path, `GET ${candidate.path}`, "Request failed", "error", 0, "Request failed"));
+    }
+  }
+  return { findings, results };
+}
+function buildSecurityHeadersFinding(ctx, response) {
+  const requiredHeaders = [
+    {
+      name: "content-security-policy",
+      label: "Content-Security-Policy",
+      impact: "without CSP, browsers have fewer defenses against injected script execution"
+    },
+    {
+      name: "x-frame-options",
+      label: "X-Frame-Options",
+      impact: "without X-Frame-Options, the site is more exposed to clickjacking"
+    },
+    {
+      name: "x-content-type-options",
+      label: "X-Content-Type-Options",
+      impact: "without X-Content-Type-Options, some browsers may MIME-sniff responses unexpectedly"
+    }
+  ];
+  if (ctx.config.target.startsWith("https://")) {
+    requiredHeaders.push({
+      name: "strict-transport-security",
+      label: "Strict-Transport-Security",
+      impact: "without HSTS, browsers may downgrade future visits to plaintext HTTP"
+    });
+  }
+  const missing = requiredHeaders.filter((header) => !response.headers[header.name]);
+  if (missing.length === 0)
+    return null;
+  const severity = missing.some((header) => header.name === "content-security-policy" || header.name === "x-frame-options") ? "medium" : "low";
+  const summary = missing.map((header) => `${header.label} (${header.impact})`).join("; ");
+  return createFinding({
+    templateId: "web-security-headers",
+    title: "Missing recommended security headers",
+    description: `The application is missing ${missing.map((header) => header.label).join(", ")}.`,
+    severity,
+    category: "security-misconfiguration",
+    request: `GET ${ctx.config.target}`,
+    response: summarizeResponse(response),
+    analysis: summary
+  });
+}
+function buildHeaderDisclosureFinding(response) {
+  const exposed = ["server", "x-powered-by"].filter((header) => response.headers[header]).map((header) => `${header}: ${response.headers[header]}`);
+  if (exposed.length === 0)
+    return null;
+  return createFinding({
+    templateId: "web-header-disclosure",
+    title: "Technology fingerprint exposed in response headers",
+    description: "The application discloses server/framework details in response headers.",
+    severity: "low",
+    category: "information-disclosure",
+    request: `GET ${response.url}`,
+    response: summarizeResponse(response),
+    analysis: `Observed fingerprinting headers: ${exposed.join(", ")}.`
+  });
+}
+async function requestUrl(url, options) {
+  const start = Date.now();
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeout ?? 3e4);
+  try {
+    if (options.rateLimiter)
+      await options.rateLimiter.acquire(url);
+    const response = await fetch(url, {
+      method: options.method,
+      headers: options.headers,
+      redirect: "manual",
+      signal: controller.signal
+    });
+    if (options.rateLimiter)
+      options.rateLimiter.noteResponse(url, response);
+    const body = await response.text();
+    const headers = {};
+    response.headers.forEach((value, key) => {
+      headers[key] = value;
+    });
+    return {
+      url,
+      status: response.status,
+      body,
+      headers,
+      latencyMs: Date.now() - start
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function createAttackResult(templateId, payloadId, request, response, outcome, latencyMs, error) {
+  return {
+    templateId,
+    payloadId,
+    outcome,
+    request,
+    response,
+    latencyMs,
+    timestamp: Date.now(),
+    error
+  };
+}
+function createFinding(input) {
+  return {
+    id: randomUUID(),
+    templateId: input.templateId,
+    title: input.title,
+    description: input.description,
+    severity: input.severity,
+    category: input.category,
+    status: "discovered",
+    evidence: {
+      request: input.request,
+      response: input.response,
+      analysis: input.analysis
+    },
+    timestamp: Date.now()
+  };
+}
+function summarizeResponse(response) {
+  const headers = Object.entries(response.headers).map(([key, value]) => `${key}: ${value}`).join("\n");
+  const bodyPreview = response.body.length > 800 ? `${response.body.slice(0, 800)}...` : response.body;
+  return `HTTP ${response.status}
+${headers}${headers ? "\n\n" : ""}${bodyPreview}`;
+}
+function discoverInterestingEndpoints(body) {
+  const matches = [...body.matchAll(/(?:href|action)=["']([^"']+)["']/gi)].map((match) => match[1]).filter((value) => value.startsWith("/"));
+  return [...new Set(matches)].slice(0, 20);
+}
+function detectWebFeatures(body, headers) {
+  const features = [];
+  const lower = body.toLowerCase();
+  if (lower.includes("<form"))
+    features.push("forms");
+  if (lower.includes("csrf"))
+    features.push("csrf");
+  if (lower.includes("graphql"))
+    features.push("graphql");
+  if (lower.includes("<script"))
+    features.push("javascript");
+  if (headers["set-cookie"])
+    features.push("session-cookies");
+  return features;
+}
+
+// packages/core/dist/recon/stack-fingerprint.js
+var DEFAULT_MAX_CHUNKS = 12;
+async function fingerprintWebStack(opts) {
+  const base = normalizeBase(opts.baseUrl);
+  const maxChunks = opts.maxChunks ?? DEFAULT_MAX_CHUNKS;
+  const rawSignals = [];
+  const libraries = /* @__PURE__ */ new Map();
+  let framework;
+  const root = await safeFetch(opts.fetchText, base);
+  const html = root?.body ?? "";
+  const headers = normalizeHeaders(root?.headers ?? {});
+  const headerFw = detectFrameworkFromHeaders(headers);
+  if (headerFw) {
+    framework = headerFw;
+    rawSignals.push(`header: ${headerFw.name}${headerFw.version ? ` v${headerFw.version}` : ""}`);
+  }
+  if (html) {
+    const htmlFw = detectFrameworkFromHtml(html);
+    if (htmlFw) {
+      rawSignals.push(`html: ${htmlFw.name}${htmlFw.version ? ` v${htmlFw.version}` : ""}`);
+      framework = mergeFramework(framework, htmlFw);
+    }
+    for (const lib of parseLibraryBanners(html)) {
+      addLibrary(libraries, lib);
+      rawSignals.push(`html banner: ${lib.name}${lib.version ? ` v${lib.version}` : ""}`);
+    }
+  }
+  const chunkUrls = enumerateJsChunkUrls(html, base).slice(0, maxChunks);
+  const chunkBodies = await Promise.all(chunkUrls.map(async (url) => ({ url, body: (await safeFetch(opts.fetchText, url))?.body ?? "" })));
+  for (const { url, body } of chunkBodies) {
+    if (!body)
+      continue;
+    const chunkFw = detectFrameworkFromBundle(body);
+    if (chunkFw) {
+      rawSignals.push(`bundle ${shortUrl(url)}: ${chunkFw.name}${chunkFw.version ? ` v${chunkFw.version}` : ""}`);
+      framework = mergeFramework(framework, chunkFw);
+    }
+    for (const lib of parseLibraryBanners(body)) {
+      addLibrary(libraries, lib);
+      rawSignals.push(`bundle ${shortUrl(url)} banner: ${lib.name}${lib.version ? ` v${lib.version}` : ""}`);
+    }
+  }
+  return {
+    framework,
+    libraries: [...libraries.values()],
+    rawSignals
+  };
+}
+var HEADER_FRAMEWORK_HINTS = [
+  { pattern: /Next\.js/i, name: "Next.js" },
+  { pattern: /Nuxt/i, name: "Nuxt" },
+  { pattern: /Express/i, name: "Express" },
+  { pattern: /SvelteKit/i, name: "SvelteKit" },
+  { pattern: /Remix/i, name: "Remix" },
+  { pattern: /Gatsby/i, name: "Gatsby" },
+  { pattern: /Astro/i, name: "Astro" },
+  { pattern: /Django/i, name: "Django" },
+  { pattern: /Laravel/i, name: "Laravel" },
+  { pattern: /Rails|Phusion Passenger/i, name: "Ruby on Rails" }
+];
+function detectFrameworkFromHeaders(headers) {
+  const lower = normalizeHeaders(headers);
+  const haystack = [lower["x-powered-by"], lower["server"], lower["x-framework"]].filter((v) => typeof v === "string").join(" | ");
+  if (!haystack)
+    return void 0;
+  for (const hint of HEADER_FRAMEWORK_HINTS) {
+    if (hint.pattern.test(haystack)) {
+      const ver = haystack.match(new RegExp(`${escapeRegExp(hint.name)}[\\s/]v?(\\d+\\.\\d+(?:\\.\\d+)?)`, "i"));
+      return { name: hint.name, version: ver?.[1], source: "header" };
+    }
+  }
+  return void 0;
+}
+function detectFrameworkFromHtml(html) {
+  const gen = html.match(/<meta[^>]+name=["']generator["'][^>]+content=["']([^"']+)["']/i);
+  if (gen) {
+    const fw = parseGeneratorContent(gen[1]);
+    if (fw)
+      return fw;
+  }
+  if (/\/_next\/static\//.test(html) || /id=["']__NEXT_DATA__["']/.test(html)) {
+    const buildVer = html.match(/"buildId":"[^"]*"[\s\S]{0,200}?"nextExport"/);
+    void buildVer;
+    return { name: "Next.js", source: "html" };
+  }
+  if (/window\.__NUXT__/.test(html) || /\/_nuxt\//.test(html)) {
+    return { name: "Nuxt", source: "html" };
+  }
+  if (/id=["']___gatsby["']/.test(html)) {
+    return { name: "Gatsby", source: "html" };
+  }
+  if (/<div[^>]+id=["']root["'][^>]*>/.test(html) && /\.chunk\.js|static\/js\//.test(html)) {
+    return { name: "React", source: "html" };
+  }
+  return void 0;
+}
+function parseGeneratorContent(content) {
+  for (const hint of HEADER_FRAMEWORK_HINTS) {
+    if (hint.pattern.test(content)) {
+      const ver = content.match(/v?(\d+\.\d+(?:\.\d+)?(?:-[0-9A-Za-z.-]+)?)/);
+      return { name: hint.name, version: ver?.[1], source: "meta_generator" };
+    }
+  }
+  return void 0;
+}
+function detectFrameworkFromBundle(body) {
+  const nextGlobal = body.match(/window\.next\s*=\s*\{[^}]*?version:\s*["']([^"']+)["']/);
+  if (nextGlobal) {
+    return { name: "Next.js", version: nextGlobal[1], source: "window_global" };
+  }
+  const reactVer = body.match(/reactVersion["':\s]+["']?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/);
+  if (reactVer) {
+    return { name: "React", version: reactVer[1], source: "js_bundle" };
+  }
+  if (/react|reactdom|__SECRET_INTERNALS/i.test(body)) {
+    const ver = body.match(/version\s*[:=]\s*["'](\d+\.\d+\.\d+(?:-(?:rc|canary|experimental|beta|alpha|next)-[0-9A-Za-z.-]+)?)["']/i);
+    if (ver)
+      return { name: "React", version: ver[1], source: "js_bundle" };
+  }
+  const vueVer = body.match(/Vue\.version\s*=\s*["'](\d+\.\d+\.\d+)["']/);
+  if (vueVer)
+    return { name: "Vue", version: vueVer[1], source: "js_bundle" };
+  return void 0;
+}
+function parseLibraryBanners(text) {
+  const out = /* @__PURE__ */ new Map();
+  const bannerRe = /(?:^|[\s/*])((?:@[a-z0-9][\w.-]*\/)?[a-z][a-z0-9][\w.-]*)\s+v(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\b/gim;
+  for (const m of text.matchAll(bannerRe)) {
+    const name = m[1].toLowerCase();
+    if (isLikelyLibraryName(name)) {
+      addLibrary(out, { name, version: m[2], source: "js_bundle" });
+    }
+  }
+  const atRe = /(?:^|[\s"'(/])((?:@[a-z0-9][\w.-]*\/)?[a-z][a-z0-9-]*[a-z0-9])@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\b/gim;
+  for (const m of text.matchAll(atRe)) {
+    const name = m[1].toLowerCase();
+    if (isLikelyLibraryName(name)) {
+      addLibrary(out, { name, version: m[2], source: "js_bundle" });
+    }
+  }
+  return [...out.values()];
+}
+var LIBRARY_NAME_DENYLIST = /* @__PURE__ */ new Set([
+  "version",
+  "node",
+  "npm",
+  "http",
+  "https",
+  "true",
+  "false",
+  "null",
+  "function"
+]);
+function isLikelyLibraryName(name) {
+  if (name.length < 2 || name.length > 64)
+    return false;
+  if (LIBRARY_NAME_DENYLIST.has(name))
+    return false;
+  if (/^\d/.test(name))
+    return false;
+  return true;
+}
+function enumerateJsChunkUrls(html, base) {
+  const urls = /* @__PURE__ */ new Set();
+  const scriptRe = /<script[^>]+src=["']([^"']+)["']/gi;
+  for (const m of html.matchAll(scriptRe)) {
+    pushIfJs(urls, m[1], base);
+  }
+  const linkRe = /<link[^>]+(?:href|src)=["']([^"']+\.(?:m?js)(?:\?[^"']*)?)["']/gi;
+  for (const m of html.matchAll(linkRe)) {
+    pushIfJs(urls, m[1], base);
+  }
+  return [...urls];
+}
+function pushIfJs(out, raw, base) {
+  const url = resolveUrl(raw, base);
+  if (!url)
+    return;
+  const path = url.split("?")[0];
+  if (/\.(m?js)$/i.test(path)) {
+    out.add(url);
+  }
+}
+function addLibrary(map, lib) {
+  const existing = map.get(lib.name);
+  if (!existing) {
+    map.set(lib.name, lib);
+    return;
+  }
+  if (!existing.version && lib.version) {
+    map.set(lib.name, lib);
+  }
+}
+function mergeFramework(current, next) {
+  if (!current)
+    return next;
+  if (current.name === next.name) {
+    return {
+      name: current.name,
+      version: current.version ?? next.version,
+      source: sourceRank(next.source) > sourceRank(current.source) ? next.source : current.source
+    };
+  }
+  if (sourceRank(next.source) > sourceRank(current.source)) {
+    return next;
+  }
+  return current;
+}
+function sourceRank(source) {
+  switch (source) {
+    case "window_global":
+      return 5;
+    case "js_bundle":
+      return 4;
+    case "header":
+      return 3;
+    case "meta_generator":
+      return 2;
+    case "html":
+      return 1;
+    default:
+      return 0;
+  }
+}
+function normalizeHeaders(headers) {
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    out[k.toLowerCase()] = v;
+  }
+  return out;
+}
+function normalizeBase(target) {
+  return target.replace(/\/+$/, "");
+}
+function resolveUrl(raw, base) {
+  try {
+    return new URL(raw, base).toString();
+  } catch {
+    return void 0;
+  }
+}
+function shortUrl(url) {
+  try {
+    const u = new URL(url);
+    return u.pathname.split("/").slice(-1)[0] || u.pathname;
+  } catch {
+    return url;
+  }
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+async function safeFetch(fetchText, url) {
+  try {
+    return await fetchText(url);
+  } catch {
+    return void 0;
+  }
+}
+function summarizeWebStackFingerprint(result) {
+  const lines = [];
+  if (result.framework) {
+    const { name, version, source } = result.framework;
+    lines.push(`Framework: ${name}${version ? ` v${version}` : ""} (via ${source})`);
+  } else {
+    lines.push("Framework: not identified");
+  }
+  if (result.libraries.length > 0) {
+    lines.push(`Libraries (${result.libraries.length}):`);
+    for (const lib of result.libraries) {
+      lines.push(`  - ${lib.name}${lib.version ? `@${lib.version}` : ""} (${lib.source})`);
+    }
+  } else {
+    lines.push("Libraries: none detected");
+  }
+  return lines.join("\n");
+}
+
+export {
+  TokenBucket,
+  RateLimiter,
+  parseRetryAfter,
+  parseRateLimitFlag,
+  runWebDiscoveryProbe,
+  runBaselineWebChecks,
+  fingerprintWebStack,
+  enumerateJsChunkUrls,
+  summarizeWebStackFingerprint
+};