@slicedearth/whoisleuth-cli 1.32.0

package/lib/idn-confusables.mjs

@@ -0,0 +1,465 @@
+// Shared internationalized-domain analysis. This module performs no
+// network requests and deliberately produces explainable similarity evidence,
+// not a malicious/benign verdict. The small generated mapping is a versioned,
+// bounded projection of Unicode Technical Standard #39 data plus the existing
+// reviewed compatibility set. It focuses on characters that visually collapse
+// to common ASCII domain-label characters.
+import { GENERATED_CONFUSABLE_GROUPS, GENERATED_CONFUSABLE_MAPPING_VERSION, GENERATED_GENERATION_CONFUSABLE_GROUPS, } from "./generated/unicode-confusables-17.mjs";
+import { MAX_GENERATION_CONFUSABLES_PER_ASCII, REVIEWED_GENERATION_CONFUSABLES, } from "./idn-confusable-policy.mjs";
+export const IDN_ANALYSIS_VERSION = 1;
+export const CONFUSABLE_MAPPING_VERSION = GENERATED_CONFUSABLE_MAPPING_VERSION;
+const MAX_DOMAIN_LENGTH = 253;
+const MAX_LABELS = 20;
+const MAX_UNICODE_LABEL_CODEPOINTS = 128;
+const MAX_REFERENCE_DOMAINS = 50;
+const MAX_REFERENCE_MATCHES = 20;
+const MAX_FINDINGS = 20;
+const CONFUSABLE_TO_ASCII = new Map();
+for (const [ascii, values] of Object.entries(GENERATED_CONFUSABLE_GROUPS)) {
+    for (const value of values)
+        CONFUSABLE_TO_ASCII.set(value, ascii);
+}
+const SCRIPT_TESTS = Object.freeze([
+    ['Latin', /\p{Script=Latin}/u],
+    ['Cyrillic', /\p{Script=Cyrillic}/u],
+    ['Greek', /\p{Script=Greek}/u],
+    ['Armenian', /\p{Script=Armenian}/u],
+    ['Coptic', /\p{Script=Coptic}/u],
+    ['Deseret', /\p{Script=Deseret}/u],
+    ['Lisu', /\p{Script=Lisu}/u],
+    ['Hebrew', /\p{Script=Hebrew}/u],
+    ['Arabic', /\p{Script=Arabic}/u],
+    ['Devanagari', /\p{Script=Devanagari}/u],
+    ['Bengali', /\p{Script=Bengali}/u],
+    ['Gurmukhi', /\p{Script=Gurmukhi}/u],
+    ['Gujarati', /\p{Script=Gujarati}/u],
+    ['Tamil', /\p{Script=Tamil}/u],
+    ['Telugu', /\p{Script=Telugu}/u],
+    ['Kannada', /\p{Script=Kannada}/u],
+    ['Malayalam', /\p{Script=Malayalam}/u],
+    ['Thai', /\p{Script=Thai}/u],
+    ['Georgian', /\p{Script=Georgian}/u],
+    ['Han', /\p{Script=Han}/u],
+    ['Hiragana', /\p{Script=Hiragana}/u],
+    ['Katakana', /\p{Script=Katakana}/u],
+    ['Hangul', /\p{Script=Hangul}/u],
+]);
+const MARK_RE = /\p{Mark}/u;
+const LETTER_RE = /\p{Letter}/u;
+const JAPANESE_SCRIPTS = new Set(['Han', 'Hiragana', 'Katakana']);
+const WHOLE_LABEL_TARGET_SCRIPTS = Object.freeze([
+    'Cyrillic',
+    'Greek',
+    'Armenian',
+    'Coptic',
+    'Deseret',
+    'Lisu',
+]);
+const MAX_WHOLE_LABEL_VARIANTS = WHOLE_LABEL_TARGET_SCRIPTS.length;
+const ASCII_GENERATION_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
+export const MAX_ADVANCED_CONFUSABLE_VARIANTS = 256;
+const ADVANCED_CONFUSABLE_SCRIPT_ORDER = Object.freeze([
+    'Cyrillic',
+    'Greek',
+    'Latin',
+    'Armenian',
+    'Coptic',
+    'Lisu',
+    'Deseret',
+]);
+function decodeDigit(codePoint) {
+    if (codePoint >= 0x61 && codePoint <= 0x7a)
+        return codePoint - 0x61;
+    if (codePoint >= 0x41 && codePoint <= 0x5a)
+        return codePoint - 0x41;
+    if (codePoint >= 0x30 && codePoint <= 0x39)
+        return codePoint - 0x30 + 26;
+    return -1;
+}
+function adaptBias(delta, pointCount, firstTime) {
+    let value = firstTime ? Math.floor(delta / 700) : delta >> 1;
+    value += Math.floor(value / pointCount);
+    let k = 0;
+    while (value > 455) {
+        value = Math.floor(value / 35);
+        k += 36;
+    }
+    return k + Math.floor((36 * value) / (value + 38));
+}
+// RFC 3492 decoder kept local so the browser build does not acquire a runtime
+// dependency merely to present the Unicode form of an already-normalized ACE
+// label. Every arithmetic step is checked and decoded output is capped.
+export function decodePunycodeLabel(input) {
+    if (typeof input !== 'string' || input.length === 0 || input.length > 59 || !/^[a-z0-9-]+$/i.test(input))
+        return null;
+    const output = [];
+    const delimiter = input.lastIndexOf('-');
+    let cursor = 0;
+    if (delimiter >= 0) {
+        for (const char of input.slice(0, delimiter)) {
+            const point = char.codePointAt(0);
+            if (point === undefined || point >= 0x80)
+                return null;
+            output.push(point);
+        }
+        cursor = delimiter + 1;
+    }
+    let n = 128;
+    let index = 0;
+    let bias = 72;
+    while (cursor < input.length) {
+        const oldIndex = index;
+        let weight = 1;
+        for (let k = 36;; k += 36) {
+            if (cursor >= input.length)
+                return null;
+            const encodedPoint = input.codePointAt(cursor++);
+            if (encodedPoint === undefined)
+                return null;
+            const digit = decodeDigit(encodedPoint);
+            if (digit < 0 || digit > Math.floor((Number.MAX_SAFE_INTEGER - index) / weight))
+                return null;
+            index += digit * weight;
+            const threshold = k <= bias + 1 ? 1 : k >= bias + 26 ? 26 : k - bias;
+            if (digit < threshold)
+                break;
+            const baseMinusThreshold = 36 - threshold;
+            if (weight > Math.floor(Number.MAX_SAFE_INTEGER / baseMinusThreshold))
+                return null;
+            weight *= baseMinusThreshold;
+        }
+        const pointCount = output.length + 1;
+        bias = adaptBias(index - oldIndex, pointCount, oldIndex === 0);
+        const increment = Math.floor(index / pointCount);
+        if (increment > 0x10ffff - n)
+            return null;
+        n += increment;
+        index %= pointCount;
+        if (n >= 0xd800 && n <= 0xdfff)
+            return null;
+        output.splice(index, 0, n);
+        index += 1;
+        if (output.length > MAX_UNICODE_LABEL_CODEPOINTS)
+            return null;
+    }
+    try {
+        return String.fromCodePoint(...output).normalize('NFC');
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeAsciiDomain(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    const trimmed = raw.trim().replace(/\.+$/, '');
+    if (!trimmed || trimmed.length > MAX_DOMAIN_LENGTH || /[\u0000-\u0020\u007f]/.test(trimmed))
+        return null;
+    let hostname;
+    try {
+        hostname = new URL(`https://${trimmed}`).hostname.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+    const labels = hostname.split('.');
+    if (labels.length < 2 || labels.length > MAX_LABELS)
+        return null;
+    if (!labels.every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(label)))
+        return null;
+    return hostname;
+}
+export function unicodeDomainFromAscii(raw) {
+    const asciiDomain = normalizeAsciiDomain(raw);
+    if (!asciiDomain)
+        return null;
+    const labels = [];
+    for (const label of asciiDomain.split('.')) {
+        if (!label.startsWith('xn--')) {
+            labels.push(label);
+            continue;
+        }
+        const decoded = decodePunycodeLabel(label.slice(4));
+        if (!decoded)
+            return null;
+        labels.push(decoded);
+    }
+    return labels.join('.');
+}
+function scriptForCharacter(character) {
+    if (!LETTER_RE.test(character))
+        return null;
+    for (const [name, expression] of SCRIPT_TESTS) {
+        if (expression.test(character))
+            return name;
+    }
+    return 'Other';
+}
+function isCompatibleScriptSet(scripts) {
+    return scripts.length <= 1 || scripts.every((script) => JAPANESE_SCRIPTS.has(script));
+}
+export function unicodeSkeleton(raw) {
+    if (typeof raw !== 'string' || raw.length > MAX_DOMAIN_LENGTH * 4)
+        return null;
+    let output = '';
+    for (const character of raw.normalize('NFKD').toLowerCase()) {
+        if (MARK_RE.test(character))
+            continue;
+        const mapped = CONFUSABLE_TO_ASCII.get(character);
+        if (mapped) {
+            output += mapped;
+        }
+        else if (character === '0') {
+            output += 'o';
+        }
+        else if (character === '1' || character === '|') {
+            output += 'l';
+        }
+        else {
+            output += character;
+        }
+        if (output.length > MAX_DOMAIN_LENGTH * 2)
+            return null;
+    }
+    return output;
+}
+export function confusableCharactersForAscii(character) {
+    const source = String(character || '').toLowerCase();
+    return [...(GENERATED_GENERATION_CONFUSABLE_GROUPS[source] || '')]
+        .slice(0, MAX_GENERATION_CONFUSABLES_PER_ASCII);
+}
+function advancedConfusablePlan(raw) {
+    if (typeof raw !== 'string') {
+        return Object.freeze({ label: '', pairs: Object.freeze([]), eligibleVariantCount: 0, omittedByPolicy: 0 });
+    }
+    const label = raw.trim().toLowerCase();
+    if (!ASCII_GENERATION_LABEL_RE.test(label)) {
+        return Object.freeze({ label: '', pairs: Object.freeze([]), eligibleVariantCount: 0, omittedByPolicy: 0 });
+    }
+    const positions = [];
+    for (const [index, character] of [...label].entries()) {
+        if (!/^[a-z]$/u.test(character))
+            continue;
+        const reviewedCharacters = REVIEWED_GENERATION_CONFUSABLES[character] || '';
+        const grouped = new Map();
+        for (const replacement of confusableCharactersForAscii(character)) {
+            const script = scriptForCharacter(replacement);
+            if (!script || !ADVANCED_CONFUSABLE_SCRIPT_ORDER.includes(script))
+                continue;
+            const values = grouped.get(script) || [];
+            values.push(Object.freeze({
+                character: replacement,
+                reviewed: reviewedCharacters.includes(replacement),
+            }));
+            grouped.set(script, values);
+        }
+        const byScript = new Map();
+        for (const [script, values] of grouped)
+            byScript.set(script, Object.freeze(values));
+        const total = [...byScript.values()].reduce((sum, values) => sum + values.length, 0);
+        if (total > 0)
+            positions.push(Object.freeze({ index, byScript, total }));
+    }
+    const pairs = [];
+    let eligibleVariantCount = 0;
+    let omittedByPolicy = 0;
+    for (let leftIndex = 0; leftIndex < positions.length; leftIndex += 1) {
+        for (let rightIndex = leftIndex + 1; rightIndex < positions.length; rightIndex += 1) {
+            const left = positions[leftIndex];
+            const right = positions[rightIndex];
+            if (!left || !right)
+                continue;
+            let eligibleForPair = 0;
+            for (const script of ADVANCED_CONFUSABLE_SCRIPT_ORDER) {
+                eligibleForPair += (left.byScript.get(script)?.length || 0)
+                    * (right.byScript.get(script)?.length || 0);
+            }
+            eligibleVariantCount += eligibleForPair;
+            omittedByPolicy += (left.total * right.total) - eligibleForPair;
+            if (eligibleForPair > 0) {
+                pairs.push(Object.freeze({ left, right, span: right.index - left.index }));
+            }
+        }
+    }
+    pairs.sort((left, right) => left.span - right.span
+        || left.left.index - right.left.index
+        || left.right.index - right.right.index);
+    return Object.freeze({
+        label,
+        pairs: Object.freeze(pairs),
+        eligibleVariantCount,
+        omittedByPolicy,
+    });
+}
+export function estimateAdvancedConfusableVariants(raw) {
+    const plan = advancedConfusablePlan(raw);
+    return Object.freeze({
+        eligibleVariantCount: plan.eligibleVariantCount,
+        omittedByPolicy: plan.omittedByPolicy,
+        omittedByBudget: Math.max(0, plan.eligibleVariantCount - MAX_ADVANCED_CONFUSABLE_VARIANTS),
+    });
+}
+// Produces an explicit advanced candidate family. Exactly two ASCII-letter
+// positions are replaced, both with characters from the same reviewed script.
+// Curated compatibility mappings rank before later projected additions, then
+// stable script and position order applies before the independent output cap.
+export function advancedConfusableVariantsForAscii(raw) {
+    const plan = advancedConfusablePlan(raw);
+    const variants = [];
+    const seen = new Set();
+    candidateLoop: for (const visualClass of ['reviewed', 'projected']) {
+        for (const script of ADVANCED_CONFUSABLE_SCRIPT_ORDER) {
+            for (const pair of plan.pairs) {
+                const leftValues = pair.left.byScript.get(script) || [];
+                const rightValues = pair.right.byScript.get(script) || [];
+                for (const left of leftValues) {
+                    for (const right of rightValues) {
+                        const candidateClass = left.reviewed && right.reviewed ? 'reviewed' : 'projected';
+                        if (candidateClass !== visualClass)
+                            continue;
+                        const characters = [...plan.label];
+                        characters[pair.left.index] = left.character;
+                        characters[pair.right.index] = right.character;
+                        const unicodeLabel = characters.join('');
+                        if (seen.has(unicodeLabel))
+                            continue;
+                        seen.add(unicodeLabel);
+                        variants.push(Object.freeze({ unicodeLabel, script, visualClass }));
+                        if (variants.length >= MAX_ADVANCED_CONFUSABLE_VARIANTS)
+                            break candidateLoop;
+                    }
+                }
+            }
+        }
+    }
+    return Object.freeze({
+        variants: Object.freeze(variants),
+        eligibleVariantCount: plan.eligibleVariantCount,
+        omittedByPolicy: plan.omittedByPolicy,
+        omittedByBudget: Math.max(0, plan.eligibleVariantCount - variants.length),
+    });
+}
+// Builds at most one deterministic candidate per reviewed non-Latin script.
+// This is a deliberately narrower generation aid than the formal UTS #39
+// whole-script algorithm: it uses JavaScript Script properties rather than
+// resolved Script_Extensions and therefore does not expose a standards verdict.
+export function wholeLabelConfusableVariantsForAscii(raw) {
+    if (typeof raw !== 'string')
+        return [];
+    const label = raw.trim().toLowerCase();
+    const letters = [...label].filter((character) => /^[a-z]$/u.test(character));
+    if (label.length === 0
+        || label.length > 63
+        || !ASCII_GENERATION_LABEL_RE.test(label)
+        || letters.length < 2)
+        return [];
+    const variants = [];
+    for (const targetScript of WHOLE_LABEL_TARGET_SCRIPTS) {
+        let unicodeLabel = '';
+        let complete = true;
+        for (const character of label) {
+            if (!/^[a-z]$/u.test(character)) {
+                unicodeLabel += character;
+                continue;
+            }
+            const replacement = confusableCharactersForAscii(character)
+                .find((candidate) => scriptForCharacter(candidate) === targetScript);
+            if (!replacement) {
+                complete = false;
+                break;
+            }
+            unicodeLabel += replacement;
+        }
+        if (complete && unicodeLabel !== label) {
+            variants.push(Object.freeze({ unicodeLabel, script: targetScript }));
+            if (variants.length >= MAX_WHOLE_LABEL_VARIANTS)
+                break;
+        }
+    }
+    return variants;
+}
+function analyzeLabels(unicodeDomain) {
+    const labels = [];
+    const allScripts = new Set();
+    for (const label of unicodeDomain.split('.').slice(0, MAX_LABELS)) {
+        const scripts = [...new Set([...label].map(scriptForCharacter).filter((script) => Boolean(script)))].sort();
+        for (const script of scripts)
+            allScripts.add(script);
+        labels.push({ label, scripts, mixed: !isCompatibleScriptSet(scripts) });
+    }
+    return { labels, scripts: [...allScripts].sort() };
+}
+export function analyzeDomainIdn(rawDomain, referenceDomains = []) {
+    const asciiDomain = normalizeAsciiDomain(rawDomain);
+    if (!asciiDomain)
+        return null;
+    const unicodeDomain = unicodeDomainFromAscii(asciiDomain);
+    if (!unicodeDomain)
+        return null;
+    const hasIdn = asciiDomain.split('.').some((label) => label.startsWith('xn--'));
+    const analyzed = analyzeLabels(unicodeDomain);
+    const mixedScriptLabels = analyzed.labels.filter((label) => label.mixed);
+    const skeleton = unicodeSkeleton(unicodeDomain);
+    const referenceMatches = [];
+    const seenReferences = new Set();
+    for (const rawReference of (Array.isArray(referenceDomains) ? referenceDomains : []).slice(0, MAX_REFERENCE_DOMAINS)) {
+        const referenceAscii = normalizeAsciiDomain(rawReference);
+        if (!referenceAscii || referenceAscii === asciiDomain || seenReferences.has(referenceAscii))
+            continue;
+        seenReferences.add(referenceAscii);
+        const referenceUnicode = unicodeDomainFromAscii(referenceAscii);
+        const referenceSkeleton = referenceUnicode ? unicodeSkeleton(referenceUnicode) : null;
+        if (!skeleton || !referenceUnicode || !referenceSkeleton || skeleton !== referenceSkeleton)
+            continue;
+        referenceMatches.push({
+            asciiDomain: referenceAscii,
+            unicodeDomain: referenceUnicode,
+            skeleton: referenceSkeleton,
+        });
+        if (referenceMatches.length >= MAX_REFERENCE_MATCHES)
+            break;
+    }
+    const findings = [];
+    if (hasIdn)
+        findings.push({
+            id: 'internationalized_domain',
+            tone: 'info',
+            label: 'Internationalised domain',
+            detail: 'The DNS-safe ASCII form contains an xn-- label. Review the Unicode and ASCII forms together.',
+        });
+    for (const label of mixedScriptLabels) {
+        findings.push({
+            id: 'mixed_script_label',
+            tone: 'warning',
+            label: 'Mixed writing scripts',
+            detail: `“${label.label}” combines ${label.scripts.join(' and ')} characters. Mixed scripts can be legitimate but deserve visual review.`,
+        });
+        if (findings.length >= MAX_FINDINGS)
+            break;
+    }
+    if (referenceMatches.length && findings.length < MAX_FINDINGS)
+        findings.push({
+            id: 'official_skeleton_match',
+            tone: 'warning',
+            label: 'Confusable with an official domain',
+            detail: `The normalized visual skeleton matches ${referenceMatches.map((item) => item.asciiDomain).join(', ')}. This is similarity evidence, not proof of impersonation.`,
+        });
+    return {
+        version: IDN_ANALYSIS_VERSION,
+        mappingVersion: CONFUSABLE_MAPPING_VERSION,
+        asciiDomain,
+        unicodeDomain,
+        hasIdn,
+        scripts: analyzed.scripts,
+        labels: analyzed.labels,
+        mixedScript: mixedScriptLabels.length > 0,
+        skeleton,
+        referenceMatches,
+        findings,
+        truncated: Array.isArray(referenceDomains) && referenceDomains.length > MAX_REFERENCE_DOMAINS,
+        limitations: [
+            'Confusable analysis uses a bounded generated mapping and cannot identify every visual similarity.',
+            'Script mixing and skeleton matches are contextual indicators, not maliciousness verdicts.',
+        ],
+    };
+}

package/lib/lookup-cache.mjs

@@ -0,0 +1,130 @@
+// Short-TTL in-memory cache for repeated RDAP/WHOIS lookups - the same
+// domain looked up again shortly after (reviewing typosquat candidates,
+// re-running a scan, a deep-check following a fast scan on the same
+// domain) doesn't need a fresh registry round-trip every time. Same
+// "public data, safe to share across all requests" reasoning as the IANA
+// bootstrap cache in lib/rdap.mts - RDAP/WHOIS results are public registry
+// data, not anything specific to who's asking, so caching them briefly
+// isn't a privacy concern the way per-user state would be.
+//
+// In-memory, so (like the bootstrap cache and the rate limiter) this
+// applies globally on server.mts's one long-lived process, but only within
+// a single warm container on Netlify Functions.
+const TTL_MS = 3 * 60 * 1000; // 3 minutes
+const SWEEP_INTERVAL_MS = 5 * 60 * 1000;
+// Bounds worst-case memory regardless of the TTL/sweep - without this, a
+// single large fast scan (up to MAX_FAST_BULK_DOMAINS domains) landing
+// within one TTL window adds that many entries, each holding a full raw
+// RDAP/WHOIS response, before the next sweep has a chance to run; repeated
+// or concurrent large scans compound that. `Map` preserves insertion
+// order, so the oldest entry is always `store.keys().next().value` -
+// simple FIFO eviction, not a full LRU (re-caching an existing key doesn't
+// move it), which is a fine fit for a cache whose primary job is
+// deduplicating near-simultaneous repeat lookups within a few minutes, not
+// long-term hit-rate optimization.
+const MAX_ENTRIES = 3000;
+// MAX_ENTRIES alone bounds count, not size - it doesn't stop a hostile or
+// compromised registry from serving a near-maximum-size response (RDAP:
+// 2MB, lib/rdap.mts; WHOIS: 200KB/hop, lib/whois.mts) for many distinct
+// domains. A full-size fast bulk scan (up to MAX_FAST_BULK_DOMAINS) hitting
+// such a registry could otherwise retain gigabytes before entry count ever
+// reaches MAX_ENTRIES. 100MB is generous for a normal Node process while
+// still being a real ceiling.
+const MAX_TOTAL_BYTES = 100 * 1024 * 1024;
+const store = new Map();
+let totalBytes = 0;
+let nextSweepAt = 0;
+// Approximate, not exact (doesn't account for JS object/string overhead) -
+// good enough for a soft memory ceiling, and cheap since it only runs once
+// per cache write, not per read.
+function approxByteSize(value) {
+    try {
+        return Buffer.byteLength(JSON.stringify(value));
+    }
+    catch {
+        return 0;
+    }
+}
+function deleteEntry(key) {
+    const entry = store.get(key);
+    if (!entry)
+        return;
+    store.delete(key);
+    totalBytes -= entry.size;
+}
+function sweepExpiredEntries(now) {
+    if (now < nextSweepAt)
+        return;
+    nextSweepAt = now + SWEEP_INTERVAL_MS;
+    for (const [key, entry] of store) {
+        if (now > entry.expiresAt)
+            deleteEntry(key);
+    }
+}
+function getCached(key) {
+    sweepExpiredEntries(Date.now());
+    const entry = store.get(key);
+    if (!entry)
+        return undefined;
+    if (Date.now() > entry.expiresAt) {
+        deleteEntry(key);
+        return undefined;
+    }
+    return entry.value;
+}
+function setCached(key, value) {
+    sweepExpiredEntries(Date.now());
+    deleteEntry(key); // avoid double-counting bytes if this key is already cached
+    const size = approxByteSize(value);
+    store.set(key, { value, expiresAt: Date.now() + TTL_MS, size });
+    totalBytes += size;
+    while (store.size > 0 && (store.size > MAX_ENTRIES || totalBytes > MAX_TOTAL_BYTES)) {
+        const oldestKey = store.keys().next().value;
+        if (oldestKey === undefined)
+            break;
+        deleteEntry(oldestKey);
+    }
+}
+// Concurrent callers for the same key (e.g. a bulk scan's concurrent
+// workers, or a fast scan immediately followed by a deep-check, hitting the
+// same domain before the first lookup has even finished) share one
+// in-flight request instead of each starting their own.
+const inFlight = new Map();
+// `factory` may legitimately resolve to `null` (e.g. "no RDAP registry for
+// this TLD") - that's cached as a real result, distinct from `undefined`
+// meaning "not cached yet", so a `null` answer doesn't get re-fetched every
+// time either.
+// The cache intentionally holds heterogeneous public lookup results. Callers
+// supply distinct result contracts, so this internal compatibility boundary
+// stays dynamically typed rather than asserting one shared payload shape.
+async function cached(key, factory) {
+    const hit = getCached(key);
+    if (hit !== undefined)
+        return hit;
+    const pending = inFlight.get(key);
+    if (pending)
+        return pending;
+    const promise = (async () => {
+        try {
+            const value = await factory();
+            setCached(key, value);
+            return value;
+        }
+        finally {
+            inFlight.delete(key);
+        }
+    })();
+    inFlight.set(key, promise);
+    return promise;
+}
+// Expired entries are swept lazily during cache activity. This preserves the
+// long-running Express cleanup behavior without creating an import-time timer,
+// which some request-scoped runtimes prohibit. Entry count and byte ceilings
+// remain the hard memory bounds between sweeps.
+function storeSize() {
+    return store.size;
+}
+function storeBytes() {
+    return totalBytes;
+}
+export { cached, MAX_ENTRIES, MAX_TOTAL_BYTES, storeSize as _storeSize, storeBytes as _storeBytes, };