@slicedearth/whoisleuth-cli 1.43.0 → 1.45.0

package/lib/browser-library-profile.mjs

@@ -4,10 +4,19 @@
 // scripts. Upstream URLs, filenames, inline bodies, and catalogue expressions
 // are treated as untrusted inputs and are not retained in the result.
 import { createHash } from 'node:crypto';
+import { Worker } from 'node:worker_threads';
 import { RETIRE_BROWSER_CATALOG } from "./generated/retire-browser-catalog.mjs";
 import { CISA_KEV_CATALOG } from "./generated/cisa-kev-catalog.mjs";
 import { createObservation } from "./observation.mjs";
 import { MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_STATIC_HTML_CHARS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
+// Catalogue expressions are reviewed third-party inputs. Keep every individual
+// regular-expression evaluation and the aggregate inline-signature work small
+// enough that a target-controlled script cannot monopolise the Node event loop.
+// Full-content hashes still use the complete already-capped script body.
+const MAX_INLINE_LIBRARY_SCAN_CHARS = 1_024;
+const MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS = 4_096;
+const MAX_INLINE_LIBRARY_SCAN_MS = 750;
+const MAX_INLINE_LIBRARY_WORKER_BYTES = 64 * 1024;
 const BROWSER_LIBRARY_PROFILE_VERSION = 2;
 const MAX_LIBRARY_HTML_CHARS = MAX_STATIC_HTML_CHARS;
 const MAX_LIBRARY_FINDINGS = 16;
@@ -29,6 +38,68 @@ const SEVERITY_WEIGHT = Object.freeze({
 });
 const CATALOG_COMPONENTS = RETIRE_BROWSER_CATALOG.components;
 const KNOWN_EXPLOITED_IDENTIFIERS = new Set(CISA_KEV_CATALOG.identifiers);
+const INLINE_EXTRACTOR_CATALOGUE = Object.freeze(Object.entries(CATALOG_COMPONENTS).map(([component, value]) => {
+    const extractors = record(record(value).extractors);
+    return Object.freeze({
+        component,
+        patterns: Object.freeze((Array.isArray(extractors.filecontent) ? extractors.filecontent : [])
+            .filter((pattern) => typeof pattern === 'string' && pattern.length > 0 && pattern.length <= 2_048)
+            .slice(0, 64)),
+        replacements: Object.freeze((Array.isArray(extractors.filecontentreplace) ? extractors.filecontentreplace : [])
+            .filter((pattern) => typeof pattern === 'string' && pattern.length > 0 && pattern.length <= 2_048)
+            .slice(0, 64)),
+    });
+}));
+const INLINE_REGEX_WORKER_SOURCE = String.raw `
+const { parentPort, workerData } = require('node:worker_threads');
+const versions = /^[0-9][0-9.a-z_-]{0,63}$/i;
+parentPort.on('message', (job) => {
+  const control = new Int32Array(job.control);
+  const output = new Uint8Array(job.output);
+  const matches = [];
+  const add = (component, version) => {
+    const normalized = String(version).replace(/(?:\.|-)?min$/i, '').slice(0, 64);
+    if (versions.test(normalized) && matches.length < 64) matches.push([component, normalized]);
+  };
+  try {
+    for (const entry of workerData.catalogue) {
+      for (const pattern of entry.patterns) {
+        let expression;
+        try { expression = new RegExp(pattern, 'g'); } catch { continue; }
+        let match;
+        let count = 0;
+        while ((match = expression.exec(job.value)) && count < 4) {
+          if (typeof match[1] === 'string') add(entry.component, match[1]);
+          if (match[0] === '') expression.lastIndex += 1;
+          count += 1;
+        }
+      }
+      for (const descriptorValue of entry.replacements) {
+        const descriptor = /^\/(.*[^\\])\/([^/]+)\/$/.exec(descriptorValue);
+        if (!descriptor || !descriptor[1]) continue;
+        let expression;
+        try { expression = new RegExp(descriptor[1], 'g'); } catch { continue; }
+        let match;
+        let count = 0;
+        while ((match = expression.exec(job.value)) && count < 4) {
+          let replaced = match[0];
+          try { replaced = match[0].replace(new RegExp(descriptor[1]), descriptor[2]); } catch { break; }
+          add(entry.component, replaced);
+          if (match[0] === '') expression.lastIndex += 1;
+          count += 1;
+        }
+      }
+    }
+    const encoded = Buffer.from(JSON.stringify(matches));
+    if (encoded.length > output.length) Atomics.store(control, 0, -2);
+    else { output.set(encoded); Atomics.store(control, 0, encoded.length); }
+  } catch {
+    Atomics.store(control, 0, -1);
+  }
+  Atomics.notify(control, 0);
+});
+`;
+let inlineRegexWorker = null;
 function record(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -106,32 +177,6 @@ function matchPattern(pattern, value) {
     }
     return matches;
 }
-function matchReplacementPattern(pattern, value) {
-    if (typeof pattern !== 'string' || pattern.length === 0 || pattern.length > 2_048)
-        return [];
-    const descriptor = /^\/(.*[^\\])\/([^/]+)\/$/.exec(pattern);
-    const expressionSource = descriptor?.[1];
-    const replacement = descriptor?.[2];
-    if (!expressionSource || replacement === undefined)
-        return [];
-    let expression;
-    try {
-        expression = new RegExp(expressionSource, 'g');
-    }
-    catch {
-        return [];
-    }
-    const matches = [];
-    let match;
-    while ((match = expression.exec(value)) && matches.length < MAX_MATCHES_PER_PATTERN) {
-        const replaced = match[0].replace(new RegExp(expressionSource), replacement).replace(/(?:\.|-)?min$/i, '');
-        if (VERSION_RE.test(replaced))
-            matches.push(replaced);
-        if (match[0] === '')
-            expression.lastIndex += 1;
-    }
-    return matches;
-}
 function addDetected(detected, component, version, method) {
     const normalizedVersion = version.replace(/(?:\.|-)?min$/i, '').slice(0, MAX_VERSION_LENGTH);
     if (!COMPONENT_RE.test(component) || !VERSION_RE.test(normalizedVersion))
@@ -174,24 +219,87 @@ function scanFilename(detected, reference) {
         }
     }
 }
-function scanInlineContent(detected, content) {
+function scanInlineSignatures(detected, value) {
+    if (!value)
+        return { timedOut: false, unavailable: false };
+    const controlBuffer = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT);
+    const outputBuffer = new SharedArrayBuffer(MAX_INLINE_LIBRARY_WORKER_BYTES);
+    const control = new Int32Array(controlBuffer);
+    try {
+        if (!inlineRegexWorker) {
+            const createdWorker = new Worker(INLINE_REGEX_WORKER_SOURCE, {
+                eval: true,
+                workerData: { catalogue: INLINE_EXTRACTOR_CATALOGUE },
+            });
+            inlineRegexWorker = createdWorker;
+            createdWorker.unref();
+            createdWorker.once('exit', () => {
+                if (inlineRegexWorker === createdWorker)
+                    inlineRegexWorker = null;
+            });
+            createdWorker.once('error', () => {
+                if (inlineRegexWorker === createdWorker)
+                    inlineRegexWorker = null;
+            });
+        }
+        inlineRegexWorker.postMessage({ value, control: controlBuffer, output: outputBuffer });
+    }
+    catch {
+        void inlineRegexWorker?.terminate().catch(() => { });
+        inlineRegexWorker = null;
+        return { timedOut: false, unavailable: true };
+    }
+    const wait = Atomics.wait(control, 0, 0, MAX_INLINE_LIBRARY_SCAN_MS);
+    const length = Atomics.load(control, 0);
+    if (wait === 'timed-out') {
+        void inlineRegexWorker?.terminate().catch(() => { });
+        inlineRegexWorker = null;
+        return { timedOut: true, unavailable: false };
+    }
+    if (length < 1 || length > MAX_INLINE_LIBRARY_WORKER_BYTES) {
+        return { timedOut: false, unavailable: true };
+    }
+    try {
+        const parsed = JSON.parse(Buffer.from(new Uint8Array(outputBuffer, 0, length)).toString('utf8'));
+        if (!Array.isArray(parsed))
+            return { timedOut: false, unavailable: true };
+        for (const item of parsed.slice(0, MAX_LIBRARY_FINDINGS * 4)) {
+            if (!Array.isArray(item) || item.length !== 2)
+                continue;
+            const [component, version] = item;
+            if (typeof component === 'string' && typeof version === 'string') {
+                addDetected(detected, component, version, 'inline signature');
+            }
+        }
+        return { timedOut: false, unavailable: false };
+    }
+    catch {
+        return { timedOut: false, unavailable: true };
+    }
+}
+function scanInlineContent(detected, content, maximumSignatureCharacters) {
     const normalized = content.replace(/\r\n?|\n/g, '\n');
     const digest = createHash('sha1').update(normalized).digest('hex');
-    scanExtractor(detected, 'filecontent', normalized, 'inline signature');
+    const retainedCharacters = Math.max(0, Math.min(MAX_INLINE_LIBRARY_SCAN_CHARS, maximumSignatureCharacters, normalized.length));
+    const headCharacters = Math.ceil(retainedCharacters / 2);
+    const tailCharacters = retainedCharacters - headCharacters;
+    const signatureContent = retainedCharacters === 0
+        ? ''
+        : normalized.length <= retainedCharacters
+            ? normalized
+            : `${normalized.slice(0, headCharacters)}${tailCharacters ? normalized.slice(-tailCharacters) : ''}`;
     for (const [componentName, rawComponent] of Object.entries(CATALOG_COMPONENTS)) {
-        const component = record(rawComponent);
-        const extractors = record(component.extractors);
-        const replacementPatterns = Array.isArray(extractors.filecontentreplace) ? extractors.filecontentreplace : [];
-        for (const pattern of replacementPatterns.slice(0, 64)) {
-            for (const version of matchReplacementPattern(pattern, normalized)) {
-                addDetected(detected, componentName, version, 'inline signature');
-            }
-        }
+        const extractors = record(record(rawComponent).extractors);
         const hashes = record(extractors.hashes);
         const version = hashes[digest];
         if (typeof version === 'string')
             addDetected(detected, componentName, version, 'inline hash');
     }
+    return {
+        charactersExamined: retainedCharacters,
+        truncated: retainedCharacters < normalized.length,
+        signatureContent,
+    };
 }
 function severity(value) {
     return typeof value === 'string' && Object.hasOwn(SEVERITY_WEIGHT, value)
@@ -243,6 +351,9 @@ function analyzeBrowserLibraries(input = {}) {
     const detected = new Map();
     let referencesExamined = 0;
     let inlineScriptsExamined = 0;
+    let inlineSignatureCharactersExamined = 0;
+    let inlineSignatureLimitReached = false;
+    const inlineSignatureSamples = [];
     for (const script of htmlAnalysis.scripts) {
         if (script.reference) {
             referencesExamined += 1;
@@ -251,9 +362,16 @@ function analyzeBrowserLibraries(input = {}) {
         }
         else if (script.inlineContent && script.mediaType !== 'application/ld+json') {
             inlineScriptsExamined += 1;
-            scanInlineContent(detected, script.inlineContent);
+            const remaining = Math.max(0, MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS - inlineSignatureCharactersExamined);
+            const signatureScan = scanInlineContent(detected, script.inlineContent, remaining);
+            inlineSignatureCharactersExamined += signatureScan.charactersExamined;
+            inlineSignatureLimitReached ||= signatureScan.truncated;
+            if (signatureScan.signatureContent)
+                inlineSignatureSamples.push(signatureScan.signatureContent);
         }
     }
+    const inlineSignatureResult = scanInlineSignatures(detected, inlineSignatureSamples.join('\u0000'));
+    const inlineSignatureUnavailable = inlineSignatureResult.timedOut || inlineSignatureResult.unavailable;
     const allFindings = [...detected.values()]
         .map(findingFromDetection)
         .sort((left, right) => ((right.highestSeverity ? SEVERITY_WEIGHT[right.highestSeverity] : -1)
@@ -267,6 +385,8 @@ function analyzeBrowserLibraries(input = {}) {
         || htmlAnalysis.tagLimitReached
         || htmlAnalysis.scriptLimitReached
         || htmlAnalysis.inlineLimitReached
+        || inlineSignatureLimitReached
+        || inlineSignatureUnavailable
         || findingLimitReached;
     const limitations = [
         'Library versions are inferred from passive static signatures and may be absent, transformed, or misleading.',
@@ -284,6 +404,12 @@ function analyzeBrowserLibraries(input = {}) {
         limitations.push(`Only the first ${MAX_SCRIPT_ELEMENTS} script elements were evaluated.`);
     if (htmlAnalysis.inlineLimitReached)
         limitations.push(`Inline script evaluation reached its ${MAX_INLINE_SCRIPT_TOTAL_CHARS}-character cumulative boundary.`);
+    if (inlineSignatureLimitReached)
+        limitations.push(`Passive library signature matching evaluated a deterministic ${MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS}-character cumulative sample across inline scripts; full-content hashes still used the complete bounded script content.`);
+    if (inlineSignatureResult.timedOut)
+        limitations.push(`Passive library signature matching exceeded its ${MAX_INLINE_LIBRARY_SCAN_MS} ms isolated-worker deadline; hash evidence was still evaluated.`);
+    if (inlineSignatureResult.unavailable)
+        limitations.push('Passive library signature matching was unavailable in its isolated worker; hash evidence was still evaluated.');
     if (findingLimitReached)
         limitations.push(`Only the first ${MAX_LIBRARY_FINDINGS} library findings were retained.`);
     return {
@@ -311,6 +437,9 @@ function analyzeBrowserLibraries(input = {}) {
                 referencesExamined,
                 inlineScriptsExamined,
                 inlineCharactersExamined: htmlAnalysis.inlineCharactersExamined,
+                inlineSignatureCharactersExamined,
+                inlineSignatureTimedOut: inlineSignatureResult.timedOut,
+                inlineSignatureUnavailable: inlineSignatureResult.unavailable,
                 catalogComponents: Object.keys(CATALOG_COMPONENTS).length,
                 findings: allFindings.length,
                 advisoryMatches: allFindings.reduce((sum, finding) => sum + finding.advisoryCount, 0),
@@ -320,4 +449,4 @@ function analyzeBrowserLibraries(input = {}) {
         findings: allFindings.slice(0, MAX_LIBRARY_FINDINGS),
     };
 }
-export { BROWSER_LIBRARY_PROFILE_VERSION, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_LIBRARY_FINDINGS, MAX_LIBRARY_HTML_CHARS, MAX_SCRIPT_ELEMENTS, analyzeBrowserLibraries, };
+export { BROWSER_LIBRARY_PROFILE_VERSION, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_INLINE_LIBRARY_SCAN_CHARS, MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS, MAX_LIBRARY_FINDINGS, MAX_LIBRARY_HTML_CHARS, MAX_SCRIPT_ELEMENTS, analyzeBrowserLibraries, };

package/lib/lookup-cache.mjs

@@ -42,7 +42,7 @@ function approxByteSize(value) {
         return Buffer.byteLength(JSON.stringify(value));
     }
     catch {
-        return 0;
+        return null;
     }
 }
 function deleteEntry(key) {
@@ -76,6 +76,10 @@ function setCached(key, value) {
     sweepExpiredEntries(Date.now());
     deleteEntry(key); // avoid double-counting bytes if this key is already cached
     const size = approxByteSize(value);
+    // A value whose serialized size cannot be measured cannot participate in a
+    // byte-bounded cache. Return it to the current caller without retaining it.
+    if (size === null)
+        return;
     store.set(key, { value, expiresAt: Date.now() + TTL_MS, size });
     totalBytes += size;
     while (store.size > 0 && (store.size > MAX_ENTRIES || totalBytes > MAX_TOTAL_BYTES)) {

package/lib/rdap-transport.mjs

@@ -3,12 +3,12 @@
 // lib/rdap.mts.
 import { readTextCapped, safeFetch, safeFetchDetailed } from "./safe-fetch.mjs";
 const MAX_RDAP_BYTES = 2000000;
-async function fetchRdapWithTimeout(url, options, timeoutMs) {
+async function fetchRdapWithTimeout(url, options, timeoutMs, dependencies = {}) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const response = await safeFetch(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await readTextCapped(response, MAX_RDAP_BYTES);
+        const response = await (dependencies.fetch ?? safeFetch)(url, { ...options, signal: controller.signal });
+        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(response, MAX_RDAP_BYTES);
         if (truncated)
             throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
         return { status: response.status, ok: response.ok, text };
@@ -17,12 +17,12 @@ async function fetchRdapWithTimeout(url, options, timeoutMs) {
         clearTimeout(timeout);
     }
 }
-async function fetchRdapDetailedWithTimeout(url, options, timeoutMs) {
+async function fetchRdapDetailedWithTimeout(url, options, timeoutMs, dependencies = {}) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const result = await safeFetchDetailed(url, { ...options, signal: controller.signal });
-        const { text, truncated } = await readTextCapped(result.response, MAX_RDAP_BYTES);
+        const result = await (dependencies.fetchDetailed ?? safeFetchDetailed)(url, { ...options, signal: controller.signal });
+        const { text, truncated } = await (dependencies.readText ?? readTextCapped)(result.response, MAX_RDAP_BYTES);
         if (truncated)
             throw new Error(`Response from ${url} exceeded ${MAX_RDAP_BYTES} bytes`);
         return {

package/lib/safe-fetch.mjs

@@ -128,21 +128,26 @@ function isPrivateIpv6(ip) {
         return true; // ::1 (loopback)
     if (g0.startsWith('ff'))
         return true; // multicast ff00::/8
-    // IPv4-mapped (::ffff:0:0/96) and the deprecated IPv4-compatible
-    // (::0:0/96) forms both put the embedded address in the last two groups -
-    // checked on the canonical expanded form above, so it doesn't matter
-    // whether the address was originally written in dotted-decimal or hex.
-    if ([g0, g1, g2, g3, g4].every((g) => g === '0000') && (g5 === 'ffff' || g5 === '0000')) {
+    // IPv4-mapped addresses put the embedded address in the last two groups.
+    // Accept only a mapped public IPv4 target. The deprecated IPv4-compatible
+    // form is rejected below rather than treated as a routable IPv6 address.
+    if ([g0, g1, g2, g3, g4].every((g) => g === '0000') && g5 === 'ffff') {
         const embedded = groupsToIpv4(g6, g7);
         if (embedded && isPrivateIpv4(embedded))
             return true;
+        if (embedded)
+            return false;
     }
+    if ([g0, g1, g2, g3, g4, g5].every((g) => g === '0000'))
+        return true;
     // NAT64 well-known prefix (64:ff9b::/96) - same tail embedding, different
     // prefix; some IPv6-only networks synthesize these to reach IPv4 hosts.
     if (g0 === '0064' && g1 === 'ff9b' && [g2, g3, g4, g5].every((g) => g === '0000')) {
         const embedded = groupsToIpv4(g6, g7);
         if (embedded && isPrivateIpv4(embedded))
             return true;
+        if (embedded)
+            return false;
     }
     // RFC 8215 local-use NAT64 prefix (64:ff9b:1::/48). Unlike the well-known
     // /96 above, operators may choose how IPv4 bits are embedded within this
@@ -150,21 +155,13 @@ function isPrivateIpv6(ip) {
     // rather than attempting to decode one layout and leaving others open.
     if (g0 === '0064' && g1 === 'ff9b' && g2 === '0001')
         return true;
-    // 6to4 (2002::/16) - the embedded IPv4 lives in groups 1-2, not the tail.
-    if (g0 === '2002') {
-        const embedded = groupsToIpv4(g1, g2);
-        if (embedded && isPrivateIpv4(embedded))
-            return true;
-    }
-    // Teredo (2001:0000::/32) carries both a server IPv4 address and an
-    // obfuscated client IPv4 address. Decode both so a transition address
-    // cannot smuggle a private/loopback target past the IPv4 guard.
-    if (g0 === '2001' && g1 === '0000') {
-        const server = groupsToIpv4(g2, g3);
-        const client = groupsToIpv4(((~parseInt(g6, 16)) & 0xffff).toString(16), ((~parseInt(g7, 16)) & 0xffff).toString(16));
-        if ((server && isPrivateIpv4(server)) || (client && isPrivateIpv4(client)))
-            return true;
-    }
+    // Deprecated transition mechanisms are not direct global-unicast targets.
+    // Reject their entire ranges instead of attempting to classify embedded
+    // addresses whose relays and routing behaviour are outside this boundary.
+    if (g0 === '2002')
+        return true; // 6to4 2002::/16
+    if (g0 === '2001' && g1 === '0000')
+        return true; // Teredo 2001::/32
     if (/^fe[89ab][0-9a-f]$/.test(g0))
         return true; // link-local fe80::/10
     if (/^fe[cdef][0-9a-f]$/.test(g0))
@@ -175,11 +172,20 @@ function isPrivateIpv6(ip) {
         return true; // discard-only 100::/64
     if (g0 === '2001' && g1 === '0db8')
         return true; // documentation 2001:db8::/32
+    if (g0 === '3fff' && parseInt(g1, 16) <= 0x0fff)
+        return true; // documentation 3fff::/20
     if (g0 === '2001' && g1 === '0002' && g2 === '0000')
         return true; // benchmarking 2001:2::/48
     if (g0 === '2001' && /^00[1-2][0-9a-f]$/.test(g1))
         return true; // ORCHID/ORCHIDv2
-    return false;
+    // Ordinary publicly routed IPv6 unicast addresses are allocated from
+    // 2000::/3. Treat everything outside that allocation as reserved unless it
+    // matched one of the explicitly supported public transition forms above.
+    // An allow-list boundary is intentional here: newly written or unassigned
+    // address space must not silently become an outbound SSRF target merely
+    // because it was absent from this file's special-purpose exclusions.
+    const firstGroup = parseInt(g0, 16);
+    return !Number.isInteger(firstGroup) || firstGroup < 0x2000 || firstGroup > 0x3fff;
 }
 function isPrivateAddress(ip) {
     const version = net.isIP(ip);
@@ -373,13 +379,12 @@ async function readTextCapped(res, maxBytes, options = {}) {
         bytesRead,
         ...(hasher ? { sha256: hasher.digest('hex') } : {}),
     });
-    const reader = res.body && res.body.getReader ? res.body.getReader() : null;
-    if (!reader) {
-        const full = Buffer.from(await res.arrayBuffer());
-        const captured = full.subarray(0, maxBytes);
-        hasher?.update(captured);
-        return result(new TextDecoder().decode(captured), full.length > maxBytes, captured.length);
+    if (res.body === null)
+        return result('', false, 0);
+    if (typeof res.body?.getReader !== 'function') {
+        throw new Error('Response body does not expose a bounded readable stream');
     }
+    const reader = res.body.getReader();
     const decoder = new TextDecoder();
     let text = '';
     let received = 0;
@@ -413,12 +418,12 @@ async function readTextCapped(res, maxBytes, options = {}) {
 // text (a favicon image) - collects raw bytes into a Buffer instead of
 // decoding as UTF-8, which would corrupt non-text bytes.
 async function readBytesCapped(res, maxBytes) {
-    const reader = res.body && res.body.getReader ? res.body.getReader() : null;
-    if (!reader) {
-        const buf = Buffer.from(await res.arrayBuffer());
-        const bytes = buf.subarray(0, maxBytes);
-        return { bytes, truncated: buf.length > maxBytes, bytesRead: bytes.length };
+    if (res.body === null)
+        return { bytes: Buffer.alloc(0), truncated: false, bytesRead: 0 };
+    if (typeof res.body?.getReader !== 'function') {
+        throw new Error('Response body does not expose a bounded readable stream');
     }
+    const reader = res.body.getReader();
     const chunks = [];
     let received = 0;
     let truncated = false;

package/lib/threat-intelligence-runtime.mjs

@@ -5,7 +5,7 @@
 // output budgets before producing separately attributed normalized evidence.
 import { createObservation } from "./observation.mjs";
 import { assertCuratedConnectorDefinition, assertThreatIntelligenceProvider, } from "./threat-intelligence-definition-registry.mjs";
-import { boundedHttpsUrl, boundedInteger, boundedString, isRecord, isoTimestamp, strictBoundedString, } from "./bounded-contract-normalizers.mjs";
+import { boundedHttpsUrl, boundedString, isRecord, isoTimestamp, strictBoundedString, } from "./bounded-contract-normalizers.mjs";
 import { CURATED_CONNECTOR_ENTITY_TYPES, MAX_THREAT_INTELLIGENCE_URL_LENGTH, normalizeCuratedConnectorTarget, normalizeThreatIntelligenceTarget, } from "./threat-intelligence-targets.mjs";
 const THREAT_INTELLIGENCE_CONTRACT_VERSION = 1;
 const THREAT_INTELLIGENCE_SCHEMA = 'whoisleuth.threat-intelligence-result';
@@ -78,7 +78,6 @@ const CONNECTOR_RELATIONSHIP_ENDPOINTS = Object.freeze({
 });
 // createObservation() retains at most 40 source characters, so provider IDs use
 // the same ceiling and can never be truncated at the provenance boundary.
-const MAX_PROVIDER_ID_LENGTH = 40;
 const MAX_PROVIDER_LABEL_LENGTH = 100;
 const MAX_DETAIL_LENGTH = 500;
 const MAX_FINDING_ID_LENGTH = 160;

package/lib/website-technology.mjs

@@ -7,7 +7,7 @@
 import { analyzeBrowserLibraries } from "./browser-library-profile.mjs";
 import { createObservation } from "./observation.mjs";
 import { MAX_STATIC_HTML_CHARS, MAX_TAG_LENGTH, MAX_TECHNOLOGY_TAGS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
-const TECHNOLOGY_PROFILE_VERSION = 8;
+const TECHNOLOGY_PROFILE_VERSION = 10;
 const MAX_TECHNOLOGY_HTML_CHARS = MAX_STATIC_HTML_CHARS;
 const MAX_TECHNOLOGY_TAG_LENGTH = MAX_TAG_LENGTH;
 const MAX_TECHNOLOGY_FINDINGS = 24;
@@ -151,7 +151,6 @@ const TECHNOLOGY_SIGNATURES = [
     {
         id: 'craft-cms', name: 'Craft CMS', category: 'content management',
         evidence: [
-            generatorEvidence(/^craft cms(?:\s|$)/i, 'Generator metadata identifies Craft CMS.'),
             responseHeaderEvidence('x-powered-by', /(?:^|,\s*)craft cms(?:\s|$|\/)/i, 'The passive X-Powered-By response header identifies Craft CMS.'),
         ],
     },
@@ -204,14 +203,12 @@ const TECHNOLOGY_SIGNATURES = [
     {
         id: 'opencart', name: 'OpenCart', category: 'commerce',
         evidence: [
-            generatorEvidence(/^opencart(?:\s|$)/i, 'Generator metadata identifies OpenCart.'),
             htmlEvidence(['index.php?route=common/home', 'image/catalog/opencart-logo.png'], 'Static markup contains OpenCart routing or default asset conventions.'),
         ],
     },
     {
         id: 'prestashop', name: 'PrestaShop', category: 'commerce',
         evidence: [
-            generatorEvidence(/^prestashop(?:\s|$)/i, 'Generator metadata identifies PrestaShop.'),
             htmlEvidence(['/modules/ps_'], 'Static resource paths use PrestaShop module conventions.'),
         ],
     },
@@ -253,7 +250,7 @@ const TECHNOLOGY_SIGNATURES = [
         id: 'weebly', name: 'Weebly', category: 'site builder',
         requiresNonResourceEvidence: true,
         evidence: [
-            generatorEvidence(/^weebly(?:\s|$)/i, 'Generator metadata identifies Weebly.'),
+            htmlEvidence(['id="wsite-base-style"', "id='wsite-base-style'", 'title="wsite-theme-css"', "title='wsite-theme-css'"], 'Static markup contains Weebly-specific theme attributes.'),
             resourceEvidence(['editmysite.com'], 'A retained resource origin uses Weebly delivery infrastructure.'),
         ],
     },
@@ -321,7 +318,6 @@ const TECHNOLOGY_SIGNATURES = [
     {
         id: 'cloudfront', name: 'Amazon CloudFront', category: 'delivery platform',
         evidence: [
-            serverEvidence(/^cloudfront(?:\s|$|\/)/i, 'The selected response server header identifies Amazon CloudFront.'),
             resourceEvidence(['cloudfront.net'], 'A retained resource origin uses Amazon CloudFront delivery infrastructure.'),
         ],
     },

package/package.json

@@ -33,7 +33,7 @@
   "bugs": {
     "url": "https://github.com/slicedearth/whoisleuth/issues"
   },
-  "version": "1.43.0",
+  "version": "1.45.0",
   "dependencies": {
     "@peculiar/x509": "2.0.0",
     "maxmind": "5.0.7",