@slicedearth/whoisleuth-cli 1.32.0

package/lib/website-technology.mjs

@@ -0,0 +1,437 @@
+// Versioned, bounded technology indicators derived from the HTTP and static
+// HTML evidence already collected by a deep lookup. A standards-compliant
+// parser identifies live elements and attributes without executing scripts.
+// Signatures emit only curated labels and fixed evidence descriptions; matched
+// markup, header values, URL paths, and arbitrary upstream strings are never
+// retained.
+import { analyzeBrowserLibraries } from "./browser-library-profile.mjs";
+import { createObservation } from "./observation.mjs";
+import { MAX_STATIC_HTML_CHARS, MAX_TAG_LENGTH, MAX_TECHNOLOGY_TAGS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
+const TECHNOLOGY_PROFILE_VERSION = 6;
+const MAX_TECHNOLOGY_HTML_CHARS = MAX_STATIC_HTML_CHARS;
+const MAX_TECHNOLOGY_TAG_LENGTH = MAX_TAG_LENGTH;
+const MAX_TECHNOLOGY_FINDINGS = 24;
+const MAX_EVIDENCE_PER_TECHNOLOGY = 4;
+const MAX_RESOURCE_ORIGINS = 30;
+const MAX_GENERATOR_INPUT = 160;
+const MAX_SERVER_INPUT = 240;
+const MAX_PASSIVE_RESPONSE_HEADERS = 8;
+const MAX_TECHNOLOGY_EVIDENCE_DESCRIPTION_LENGTH = 180;
+const CONTROL_CHARACTER_RE = /[\u0000-\u001f\u007f]/;
+function boundedLowercase(value, maxLength) {
+    if (typeof value !== 'string' || value.length > maxLength || CONTROL_CHARACTER_RE.test(value))
+        return '';
+    return value.trim().toLowerCase();
+}
+function normalizedResourceHosts(value) {
+    const hosts = new Set();
+    for (const item of (Array.isArray(value) ? value : []).slice(0, MAX_RESOURCE_ORIGINS)) {
+        if (typeof item !== 'string' || item.length > 2048 || CONTROL_CHARACTER_RE.test(item))
+            continue;
+        try {
+            const parsed = new URL(item);
+            if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password || !parsed.hostname)
+                continue;
+            hosts.add(parsed.hostname.toLowerCase());
+        }
+        catch {
+            // An invalid retained origin cannot contribute to a technology finding.
+        }
+    }
+    return hosts;
+}
+const PASSIVE_HEADER_NAMES = new Set([
+    'cf-ray',
+    'x-drupal-cache',
+    'x-fastly-request-id',
+    'x-powered-by',
+    'x-shopify-stage',
+    'x-sorting-hat-podid',
+    'x-vercel-id',
+]);
+function normalizedResponseHeaders(value) {
+    const input = value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+    const output = new Map();
+    for (const [rawName, rawValue] of Object.entries(input).slice(0, MAX_PASSIVE_RESPONSE_HEADERS * 4)) {
+        const name = rawName.trim().toLowerCase();
+        if (!PASSIVE_HEADER_NAMES.has(name) || typeof rawValue !== 'string')
+            continue;
+        const normalized = boundedLowercase(rawValue, 240);
+        if (!normalized)
+            continue;
+        output.set(name, normalized);
+        if (output.size >= MAX_PASSIVE_RESPONSE_HEADERS)
+            break;
+    }
+    return output;
+}
+function generatorEvidence(pattern, description) {
+    return {
+        source: 'generator metadata',
+        description,
+        confidence: 'high',
+        matches: ({ generator }) => pattern.test(generator),
+    };
+}
+function htmlEvidence(markers, description, confidence = 'high') {
+    return {
+        source: 'static HTML',
+        description,
+        confidence,
+        matches: ({ html }) => markers.some((marker) => html.includes(marker)),
+    };
+}
+function resourceEvidence(hosts, description) {
+    return {
+        source: 'resource origin',
+        description,
+        confidence: 'medium',
+        matches: ({ resourceHosts }) => hosts.some((host) => resourceHosts.has(host) || [...resourceHosts].some((value) => value.endsWith(`.${host}`))),
+    };
+}
+function resourcePatternEvidence(pattern, description) {
+    return {
+        source: 'resource origin',
+        description,
+        confidence: 'medium',
+        matches: ({ resourceHosts }) => [...resourceHosts].some((host) => pattern.test(host)),
+    };
+}
+function serverEvidence(pattern, description, confidence = 'high') {
+    return {
+        source: 'HTTP server header',
+        description,
+        confidence,
+        matches: ({ httpServer }) => pattern.test(httpServer),
+    };
+}
+function responseHeaderEvidence(name, pattern, description, confidence = 'high') {
+    return {
+        source: 'passive response header',
+        description,
+        confidence,
+        matches: ({ responseHeaders }) => {
+            if (!responseHeaders.has(name))
+                return false;
+            return pattern ? pattern.test(responseHeaders.get(name) ?? '') : true;
+        },
+    };
+}
+const TECHNOLOGY_SIGNATURES = [
+    {
+        id: 'wordpress', name: 'WordPress', category: 'content management',
+        evidence: [
+            generatorEvidence(/^wordpress(?:\s|$)/i, 'Generator metadata identifies WordPress.'),
+            htmlEvidence(['/wp-content/', '/wp-includes/'], 'Static resource paths use WordPress conventions.', 'medium'),
+        ],
+    },
+    {
+        id: 'drupal', name: 'Drupal', category: 'content management',
+        evidence: [
+            generatorEvidence(/^drupal(?:\s|$)/i, 'Generator metadata identifies Drupal.'),
+            htmlEvidence(['data-drupal-selector=', 'data-drupal-link-system-path=', 'drupal-settings-json'], 'Static markup contains Drupal-specific attributes.'),
+            responseHeaderEvidence('x-drupal-cache', null, 'A Drupal-specific cache response header was observed.', 'medium'),
+        ],
+    },
+    {
+        id: 'joomla', name: 'Joomla', category: 'content management',
+        evidence: [generatorEvidence(/^joomla!?\b/i, 'Generator metadata identifies Joomla.')],
+    },
+    {
+        id: 'ghost', name: 'Ghost', category: 'content management',
+        evidence: [
+            generatorEvidence(/^ghost(?:\s|$)/i, 'Generator metadata identifies Ghost.'),
+            htmlEvidence(['ghost/api/content/', 'data-ghost-search'], 'Static markup contains Ghost-specific integration markers.'),
+        ],
+    },
+    {
+        id: 'craft-cms', name: 'Craft CMS', category: 'content management',
+        evidence: [generatorEvidence(/^craft cms(?:\s|$)/i, 'Generator metadata identifies Craft CMS.')],
+    },
+    {
+        id: 'typo3', name: 'TYPO3 CMS', category: 'content management',
+        evidence: [generatorEvidence(/^typo3(?:\s+cms)?(?:\s|$)/i, 'Generator metadata identifies TYPO3 CMS.')],
+    },
+    {
+        id: 'shopify', name: 'Shopify', category: 'commerce',
+        requiresNonResourceEvidence: true,
+        evidence: [
+            htmlEvidence(['shopify-section', 'shopify.theme'], 'Static markup contains Shopify-specific storefront markers.'),
+            resourceEvidence(['cdn.shopify.com'], 'A retained resource origin uses the Shopify content network.'),
+            responseHeaderEvidence('x-shopify-stage', null, 'A Shopify-specific platform response header was observed.', 'medium'),
+            responseHeaderEvidence('x-sorting-hat-podid', null, 'A Shopify-specific routing response header was observed.', 'medium'),
+        ],
+    },
+    {
+        id: 'php', name: 'PHP', category: 'application runtime',
+        evidence: [responseHeaderEvidence('x-powered-by', /^php(?:\s|$|\/)/i, 'The passive X-Powered-By response header identifies PHP.')],
+    },
+    {
+        id: 'aspnet', name: 'ASP.NET', category: 'web framework',
+        evidence: [responseHeaderEvidence('x-powered-by', /^asp\.net(?:\s|$|\/)/i, 'The passive X-Powered-By response header identifies ASP.NET.')],
+    },
+    {
+        id: 'express', name: 'Express', category: 'web framework',
+        evidence: [responseHeaderEvidence('x-powered-by', /^express(?:\s|$|\/)/i, 'The passive X-Powered-By response header identifies Express.')],
+    },
+    {
+        id: 'adobe-commerce-magento', name: 'Adobe Commerce / Magento Open Source', category: 'commerce',
+        evidence: [
+            htmlEvidence(['data-mage-init=', 'type="text/x-magento-init"', "type='text/x-magento-init'"], 'Static markup contains Commerce frontend initialization markers.'),
+        ],
+    },
+    {
+        id: 'bigcommerce', name: 'BigCommerce', category: 'commerce',
+        minimumEvidenceMatches: 2,
+        evidence: [
+            htmlEvidence(['cdn11.bigcommerce.com/s-', 'stencil-utils'], 'Static markup contains BigCommerce storefront asset markers.', 'medium'),
+            resourcePatternEvidence(/^cdn\d+\.bigcommerce\.com$/i, 'A retained resource origin uses BigCommerce storefront delivery infrastructure.'),
+        ],
+    },
+    {
+        id: 'woocommerce', name: 'WooCommerce', category: 'commerce',
+        evidence: [
+            htmlEvidence(['/wp-content/plugins/woocommerce/'], 'Static resource paths identify the WooCommerce plugin.'),
+        ],
+    },
+    {
+        id: 'opencart', name: 'OpenCart', category: 'commerce',
+        evidence: [generatorEvidence(/^opencart(?:\s|$)/i, 'Generator metadata identifies OpenCart.')],
+    },
+    {
+        id: 'prestashop', name: 'PrestaShop', category: 'commerce',
+        evidence: [generatorEvidence(/^prestashop(?:\s|$)/i, 'Generator metadata identifies PrestaShop.')],
+    },
+    {
+        id: 'wix', name: 'Wix', category: 'site builder',
+        requiresNonResourceEvidence: true,
+        evidence: [
+            generatorEvidence(/^wix(?:\s|$)/i, 'Generator metadata identifies Wix.'),
+            htmlEvidence(['data-mesh-id='], 'Static markup contains a Wix-specific document attribute.', 'medium'),
+            resourceEvidence(['static.parastorage.com', 'wixstatic.com'], 'A retained resource origin uses Wix delivery infrastructure.'),
+        ],
+    },
+    {
+        id: 'squarespace', name: 'Squarespace', category: 'site builder',
+        requiresNonResourceEvidence: true,
+        evidence: [
+            generatorEvidence(/^squarespace(?:\s|$)/i, 'Generator metadata identifies Squarespace.'),
+            htmlEvidence(['squarespace-context'], 'Static markup contains a Squarespace-specific document marker.', 'medium'),
+            resourceEvidence(['static.squarespace.com', 'static1.squarespace.com'], 'A retained resource origin uses Squarespace delivery infrastructure.'),
+        ],
+    },
+    {
+        id: 'webflow', name: 'Webflow', category: 'site builder',
+        evidence: [
+            generatorEvidence(/^webflow(?:\s|$)/i, 'Generator metadata identifies Webflow.'),
+            htmlEvidence(['data-wf-page=', 'data-wf-site='], 'Static markup contains Webflow-specific document attributes.'),
+        ],
+    },
+    {
+        id: 'framer', name: 'Framer', category: 'site builder',
+        requiresNonResourceEvidence: true,
+        evidence: [
+            generatorEvidence(/^framer(?:\s|$)/i, 'Generator metadata identifies Framer.'),
+            htmlEvidence(['data-framer-name='], 'Static markup contains Framer-specific component attributes.'),
+            resourceEvidence(['framerusercontent.com'], 'A retained resource origin uses Framer delivery infrastructure.'),
+        ],
+    },
+    {
+        id: 'weebly', name: 'Weebly', category: 'site builder',
+        requiresNonResourceEvidence: true,
+        evidence: [
+            generatorEvidence(/^weebly(?:\s|$)/i, 'Generator metadata identifies Weebly.'),
+            resourceEvidence(['editmysite.com'], 'A retained resource origin uses Weebly delivery infrastructure.'),
+        ],
+    },
+    {
+        id: 'angular', name: 'Angular', category: 'web framework',
+        evidence: [htmlEvidence([' ng-version='], 'Static markup contains Angular version metadata.')],
+    },
+    {
+        id: 'aspnet-web-forms', name: 'ASP.NET Web Forms', category: 'web framework',
+        evidence: [htmlEvidence([' name="__viewstate"', ' id="__viewstate"'], 'Static form markup contains the ASP.NET Web Forms view-state field.')],
+    },
+    {
+        id: 'nextjs', name: 'Next.js', category: 'web framework',
+        evidence: [htmlEvidence(['id="__next_data__"', "id='__next_data__'", '/_next/static/'], 'Static markup contains Next.js bootstrap or asset markers.')],
+    },
+    {
+        id: 'nuxt', name: 'Nuxt', category: 'web framework',
+        evidence: [htmlEvidence(['id="__nuxt"', "id='__nuxt'", '/_nuxt/'], 'Static markup contains Nuxt bootstrap or asset markers.')],
+    },
+    {
+        id: 'gatsby', name: 'Gatsby', category: 'web framework',
+        evidence: [htmlEvidence(['id="___gatsby"', "id='___gatsby'", '/page-data/app-data.json'], 'Static markup contains Gatsby bootstrap or page-data markers.')],
+    },
+    {
+        id: 'sveltekit', name: 'SvelteKit', category: 'web framework',
+        evidence: [
+            htmlEvidence(['data-sveltekit-preload-data=', 'data-sveltekit-reload='], 'Static markup contains SvelteKit-specific navigation attributes.'),
+            htmlEvidence(['href="/_app/immutable/', 'src="/_app/immutable/'], 'Static asset paths use SvelteKit build conventions.', 'medium'),
+        ],
+    },
+    {
+        id: 'astro', name: 'Astro', category: 'web framework',
+        evidence: [
+            htmlEvidence(['<astro-island', '<astro-slot'], 'Static markup contains Astro component-island elements.'),
+            htmlEvidence(['href="/_astro/', 'src="/_astro/'], 'Static asset paths use Astro build conventions.', 'medium'),
+        ],
+    },
+    {
+        id: 'hugo', name: 'Hugo', category: 'static site generator',
+        evidence: [generatorEvidence(/^hugo(?:\s|$)/i, 'Generator metadata identifies Hugo.')],
+    },
+    {
+        id: 'jekyll', name: 'Jekyll', category: 'static site generator',
+        evidence: [generatorEvidence(/^jekyll(?:\s|$)/i, 'Generator metadata identifies Jekyll.')],
+    },
+    {
+        id: 'docusaurus', name: 'Docusaurus', category: 'static site generator',
+        evidence: [generatorEvidence(/^docusaurus(?:\s|$)/i, 'Generator metadata identifies Docusaurus.')],
+    },
+    {
+        id: 'eleventy', name: 'Eleventy', category: 'static site generator',
+        evidence: [generatorEvidence(/^(?:eleventy|11ty)(?:\s|$)/i, 'Generator metadata identifies Eleventy.')],
+    },
+    {
+        id: 'hexo', name: 'Hexo', category: 'static site generator',
+        evidence: [generatorEvidence(/^hexo(?:\s|$)/i, 'Generator metadata identifies Hexo.')],
+    },
+    {
+        id: 'cloudflare', name: 'Cloudflare', category: 'delivery platform',
+        evidence: [
+            serverEvidence(/^cloudflare(?:\s|$|\/)/i, 'The selected response server header identifies Cloudflare.'),
+            responseHeaderEvidence('cf-ray', null, 'A Cloudflare request-trace response header was observed.', 'medium'),
+        ],
+    },
+    {
+        id: 'cloudfront', name: 'Amazon CloudFront', category: 'delivery platform',
+        evidence: [
+            serverEvidence(/^cloudfront(?:\s|$|\/)/i, 'The selected response server header identifies Amazon CloudFront.'),
+            resourceEvidence(['cloudfront.net'], 'A retained resource origin uses Amazon CloudFront delivery infrastructure.'),
+        ],
+    },
+    {
+        id: 'netlify', name: 'Netlify', category: 'delivery platform',
+        evidence: [serverEvidence(/^netlify(?:\s|$|\/)/i, 'The selected response server header identifies Netlify.')],
+    },
+    {
+        id: 'vercel', name: 'Vercel', category: 'delivery platform',
+        evidence: [
+            serverEvidence(/^vercel(?:\s|$|\/)/i, 'The selected response server header identifies Vercel.'),
+            responseHeaderEvidence('x-vercel-id', null, 'A Vercel request-trace response header was observed.', 'medium'),
+        ],
+    },
+    {
+        id: 'fastly', name: 'Fastly', category: 'delivery platform',
+        evidence: [responseHeaderEvidence('x-fastly-request-id', null, 'A Fastly request identifier response header was observed.', 'medium')],
+    },
+    {
+        id: 'nginx', name: 'nginx', category: 'web server',
+        evidence: [serverEvidence(/^nginx(?:\s|$|\/)/i, 'The selected response server header identifies nginx.')],
+    },
+    {
+        id: 'apache-http-server', name: 'Apache HTTP Server', category: 'web server',
+        evidence: [serverEvidence(/^apache(?:\s|$|\/)/i, 'The selected response server header identifies Apache HTTP Server.')],
+    },
+    {
+        id: 'microsoft-iis', name: 'Microsoft IIS', category: 'web server',
+        evidence: [serverEvidence(/^microsoft-iis(?:\s|$|\/)/i, 'The selected response server header identifies Microsoft IIS.')],
+    },
+    {
+        id: 'litespeed', name: 'LiteSpeed', category: 'web server',
+        evidence: [serverEvidence(/^(?:open)?litespeed(?:\s|$|\/)/i, 'The selected response server header identifies LiteSpeed.')],
+    },
+    {
+        id: 'caddy', name: 'Caddy', category: 'web server',
+        evidence: [serverEvidence(/^caddy(?:\s|$|\/)/i, 'The selected response server header identifies Caddy.')],
+    },
+];
+const TECHNOLOGY_SIGNATURE_CATALOGUE = Object.freeze(TECHNOLOGY_SIGNATURES.map((signature) => Object.freeze({
+    id: signature.id,
+    name: signature.name,
+    category: signature.category,
+    minimumEvidenceMatches: signature.minimumEvidenceMatches || 1,
+    requiresNonResourceEvidence: signature.requiresNonResourceEvidence === true,
+    evidence: Object.freeze(signature.evidence.map(({ source, description, confidence }) => Object.freeze({
+        source,
+        description,
+        confidence,
+    }))),
+})));
+function analyzeWebsiteTechnology(input = {}) {
+    const htmlAnalysis = input.htmlAnalysis ?? analyzeStaticHtml(input.html);
+    const browserLibraryProfile = analyzeBrowserLibraries({
+        htmlAnalysis,
+        observedAt: input.observedAt,
+        sourceTruncated: input.sourceTruncated,
+    });
+    const context = {
+        html: htmlAnalysis.markup,
+        generator: boundedLowercase(input.generator, MAX_GENERATOR_INPUT),
+        httpServer: boundedLowercase(input.httpServer, MAX_SERVER_INPUT),
+        resourceHosts: normalizedResourceHosts(input.resourceOrigins),
+        responseHeaders: normalizedResponseHeaders(input.responseHeaders),
+    };
+    const findings = [];
+    for (const signature of TECHNOLOGY_SIGNATURES) {
+        const matched = signature.evidence.filter((evidence) => evidence.matches(context));
+        if (matched.length < (signature.minimumEvidenceMatches || 1))
+            continue;
+        if (signature.requiresNonResourceEvidence && matched.every((evidence) => evidence.source === 'resource origin'))
+            continue;
+        findings.push({
+            id: signature.id,
+            name: signature.name,
+            category: signature.category,
+            confidence: matched.some((evidence) => evidence.confidence === 'high') ? 'high' : 'medium',
+            evidence: matched.slice(0, MAX_EVIDENCE_PER_TECHNOLOGY).map(({ source, description }) => ({ source, description })),
+        });
+    }
+    findings.sort((left, right) => left.category.localeCompare(right.category) || left.name.localeCompare(right.name));
+    const findingLimitReached = findings.length > MAX_TECHNOLOGY_FINDINGS;
+    const truncated = input.sourceTruncated === true
+        || htmlAnalysis.inputLimitReached
+        || htmlAnalysis.tagLimitReached
+        || findingLimitReached;
+    const limitations = [
+        'Curated signature matching is selective; an unmatched technology may still be present.',
+        'Static response evidence cannot identify JavaScript-rendered or deliberately concealed technologies.',
+        'Technology indicators describe observed implementation clues, not ownership, safety, or maliciousness.',
+    ];
+    if (input.sourceTruncated === true)
+        limitations.push('The captured homepage body was truncated, so technology indicators may be incomplete.');
+    if (htmlAnalysis.inputLimitReached)
+        limitations.push(`Only the first ${MAX_TECHNOLOGY_HTML_CHARS} HTML characters were evaluated.`);
+    if (htmlAnalysis.tagLimitReached)
+        limitations.push(`Technology matching reached the ${MAX_TECHNOLOGY_TAGS}-tag or ${MAX_TECHNOLOGY_TAG_LENGTH}-character tag boundary.`);
+    if (findingLimitReached)
+        limitations.push(`Only the first ${MAX_TECHNOLOGY_FINDINGS} technology findings were retained.`);
+    return {
+        profileVersion: TECHNOLOGY_PROFILE_VERSION,
+        ...createObservation({
+            status: truncated ? 'partial' : 'success',
+            observedAt: input.observedAt,
+            scanMode: 'deep',
+            source: 'derived',
+            complete: !truncated,
+            truncated,
+            limitations,
+            diagnostics: {
+                findings: findings.length,
+                htmlEvaluated: Boolean(context.html),
+                generatorEvaluated: Boolean(context.generator),
+                serverEvaluated: Boolean(context.httpServer),
+                resourceOriginsEvaluated: context.resourceHosts.size,
+                passiveHeadersEvaluated: context.responseHeaders.size,
+                tagLimitReached: htmlAnalysis.tagLimitReached,
+            },
+        }),
+        findings: findings.slice(0, MAX_TECHNOLOGY_FINDINGS),
+        browserLibraryProfile,
+    };
+}
+export { MAX_EVIDENCE_PER_TECHNOLOGY, MAX_TECHNOLOGY_EVIDENCE_DESCRIPTION_LENGTH, MAX_TECHNOLOGY_FINDINGS, MAX_TECHNOLOGY_HTML_CHARS, MAX_TECHNOLOGY_TAGS, TECHNOLOGY_PROFILE_VERSION, TECHNOLOGY_SIGNATURE_CATALOGUE, analyzeWebsiteTechnology, };

package/lib/whois-authority.mjs

@@ -0,0 +1,98 @@
+// Authority-aware interpretation of WHOIS referral chains. The first
+// definitive non-root response decides existence; later registrar output is
+// diagnostic and cannot override the registry.
+import { normalizeWhoisChain } from "./whois-normalization.mjs";
+import { parseIndentedWhoisValue, whoisFieldLimit, } from "./whois-values.mjs";
+const NOT_FOUND_RE = /no match for|no match\b|not found|no entries found|domain not found|no object found|not registered|status\s*:\s*(?:available|free)\b|registered\s*:\s*(?:no|false)\b|is available for registration/i;
+const LINE_NOT_FOUND_PATTERNS = Object.freeze([
+    /^[ \t]*%[ \t]*nothing found[ \t]*$/im,
+    /^[ \t]*[a-z0-9](?:[a-z0-9.-]{0,252})[ \t]+is free[ \t]*$/im,
+    /^[ \t]*el dominio no se encuentra registrado en nic argentina[ \t]*$/im,
+    /^[ \t]*the domain has not been registered\.?[ \t]*$/im,
+    /^[ \t]*the queried object does not exist:[ \t]*no matching objects found[ \t]*$/im,
+    /^[ \t]*no record found for[ \t]+'[a-z0-9.-]{1,253}'\.?[ \t]*$/im,
+    /^[ \t]*no data found[ \t]*$/im,
+    /^[ \t]*>>[ \t]*no data found for domain[ \t]*:[ \t]*[a-z0-9.-]{1,253}[ \t]*$/im,
+    /^[ \t]*domain[ \t]+[a-z0-9.-]{1,253}[ \t]+is available for purchase[ \t]*$/im,
+]);
+const NZ_NOT_FOUND_RE = /^[ \t]*query_status[ \t]*:[ \t]*220(?:\s|$)/im;
+const NZ_POSITIVE_RE = /^[ \t]*query_status[ \t]*:[ \t]*(?:200|210)(?:\s|$)/im;
+const NZ_TEMPORARY_FAILURE_RE = /^[ \t]*query_status[ \t]*:[ \t]*4\d{2}(?:\s|$)/im;
+const RATE_LIMIT_LINE_RE = /^[ \t]*(?:[%#*;>-]+[ \t]*)?(?:(?:error|status)[ \t:.-]+)?(?:whois[ \t]+limit[ \t]+exceeded|query[ \t]+(?:rate[ \t-]*)?limit[ \t]+exceeded|(?:request|query)[ \t]+limit[ \t]+(?:exceeded|reached)|rate[ \t-]*limit(?:[ \t]+exceeded)?|too[ \t]+many[ \t]+(?:requests|queries)|quota[ \t]+exceeded|number[ \t]+of[^\r\n]{0,120}[ \t]+exceeded|(?:requests?|queries?)[ \t]+(?:are[ \t]+)?throttled|throttled|(?:service[ \t]+)?temporarily[ \t]+unavailable|(?:please[ \t]+)?try[ \t]+again[ \t]+later|please[ \t]+wait)\b[^\r\n]{0,240}$/im;
+const POSITIVE_REGISTRATION_RE = /^[ \t*]*(?:Domain(?:[ \t]+Name)?|domainname|Registrar|Registrar WHOIS Server|Creation Date|Created(?: On)?|Registry Expiry Date|Registered(?: On)?|Name Server|nserver|Sponsoring Registrar)[ \t.]*:[ \t]*\S/im;
+const POSITIVE_BRACKET_RE = /\[(?:Domain Name|Registrant|Name Server)\][ \t]*\S/i;
+function hasSectionedRegistrationEvidence(text) {
+    if (!/^[ \t]*Relevant dates[ \t]*:[ \t]*$/im.test(text)
+        || !/^[ \t]*Registration status[ \t]*:[ \t]*$/im.test(text)) {
+        return false;
+    }
+    const domain = parseIndentedWhoisValue(text, /^[ \t]*Domain(?: name)?[ \t]*:[ \t]*$/im, whoisFieldLimit('domainName'));
+    const status = parseIndentedWhoisValue(text, /^[ \t]*Registration status[ \t]*:[ \t]*$/im, 160);
+    return Boolean(domain?.value && status?.value);
+}
+export function hasNicKgRegistrationEvidence(text) {
+    return /^% This is the \.kg ccTLD Whois server[ \t]*$/im.test(text)
+        && /^[ \t]*Domain[ \t]+[a-z0-9.-]+[ \t]+\([A-Z][A-Z0-9_-]*\)[ \t]*$/im.test(text)
+        && /^[ \t]*Record created[ \t]*:[ \t]*\S/im.test(text)
+        && /^[ \t]*Name servers in the listed order[ \t]*:[ \t]*$/im.test(text);
+}
+function classifyHopEvidence(hop, index) {
+    if (hop.error)
+        return 'error';
+    const text = hop.response || '';
+    if (!text.trim())
+        return 'inconclusive';
+    if (RATE_LIMIT_LINE_RE.test(text))
+        return 'rate_limited';
+    if (NZ_TEMPORARY_FAILURE_RE.test(text))
+        return 'rate_limited';
+    if (NZ_NOT_FOUND_RE.test(text))
+        return 'negative';
+    if (NOT_FOUND_RE.test(text)
+        || LINE_NOT_FOUND_PATTERNS.some((pattern) => pattern.test(text))) {
+        return 'negative';
+    }
+    if (index > 0
+        && (POSITIVE_REGISTRATION_RE.test(text)
+            || POSITIVE_BRACKET_RE.test(text)
+            || NZ_POSITIVE_RE.test(text)
+            || hasSectionedRegistrationEvidence(text)
+            || hasNicKgRegistrationEvidence(text))) {
+        return 'positive';
+    }
+    return 'inconclusive';
+}
+export function analyzeWhoisChainAuthority(chain) {
+    const source = normalizeWhoisChain(chain);
+    const evidence = source.map((hop, index) => ({
+        server: hop.server,
+        index,
+        kind: classifyHopEvidence(hop, index),
+    }));
+    const failed = evidence.filter((item) => item.kind === 'error' || item.kind === 'rate_limited');
+    const authoritative = evidence.find((item) => item.index > 0
+        && (item.kind === 'positive' || item.kind === 'negative'));
+    const conflict = authoritative
+        ? evidence.find((item) => item.index > authoritative.index
+            && (item.kind === 'positive' || item.kind === 'negative')
+            && item.kind !== authoritative.kind)
+        : null;
+    const registrationStatus = !authoritative
+        ? 'inconclusive'
+        : authoritative.kind === 'positive'
+            ? 'registered'
+            : 'not_found';
+    return {
+        registrationStatus,
+        notFound: registrationStatus === 'not_found',
+        notFoundSource: registrationStatus === 'not_found' && authoritative
+            ? authoritative.server
+            : null,
+        authoritativeHop: authoritative?.server ?? null,
+        failedHop: failed[0]?.server ?? null,
+        conflictingHop: conflict?.server ?? null,
+        chainStatus: authoritative && failed.length === 0 && !conflict
+            ? 'complete'
+            : 'partial',
+    };
+}