@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/lib/website-technology.mjs

@@ -6,11 +6,28 @@
 // retained.
 import { analyzeBrowserLibraries } from "./browser-library-profile.mjs";
 import { createObservation } from "../packages/evidence/observation.mjs";
-import { MAX_STATIC_HTML_CHARS, MAX_TAG_LENGTH, MAX_TECHNOLOGY_TAGS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
+import { attributeValue, createTechnologyMarkupContext, elementMarker, hasAttributes, navigationMarker, resourceMarker, } from "./technology-markup.mjs";
+import { MAX_STATIC_HTML_CHARS, MAX_STATIC_HTML_TAGS as MAX_TECHNOLOGY_TAGS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 import { TECHNOLOGY_EVIDENCE_ROLE_ORDER, } from "./technology-evidence-role.mjs";
 import { MAX_EVIDENCE_PER_TECHNOLOGY, MAX_TECHNOLOGY_EVIDENCE_DESCRIPTION_LENGTH, MAX_TECHNOLOGY_FINDINGS, TECHNOLOGY_PROFILE_VERSION, } from "./lookup-child-profile-contract.mjs";
+const TECHNOLOGY_CATEGORIES = Object.freeze([
+    'application runtime',
+    'content management',
+    'commerce',
+    'site builder',
+    'web framework',
+    'static site generator',
+    'web server',
+    'delivery platform',
+]);
+const TECHNOLOGY_EVIDENCE_SOURCES = Object.freeze([
+    'generator metadata',
+    'static HTML',
+    'resource origin',
+    'HTTP server header',
+    'passive response header',
+]);
 const MAX_TECHNOLOGY_HTML_CHARS = MAX_STATIC_HTML_CHARS;
-const MAX_TECHNOLOGY_TAG_LENGTH = MAX_TAG_LENGTH;
 const MAX_RESOURCE_ORIGINS = 30;
 const MAX_GENERATOR_INPUT = 160;
 const MAX_SERVER_INPUT = 240;
@@ -98,12 +115,16 @@ function generatorEvidence(pattern, description) {
         matches: ({ generator }) => pattern.test(generator),
     };
 }
-function htmlEvidence(markers, description, confidence = 'high') {
+function htmlEvidence(markupRules, description, confidence = 'high') {
     return {
         source: 'static HTML',
         description,
         confidence,
-        matches: ({ html }) => markers.some((marker) => html.includes(marker)),
+        markupRules,
+        matches: (context) => markupRules.some((rule) => rule.matches(context)),
+        roleFor: (context) => markupRules.some((rule) => rule.matches(context) && !rule.embedded?.(context))
+            ? undefined
+            : 'embedded_dependency',
     };
 }
 function resourceEvidence(hosts, description) {
@@ -133,7 +154,7 @@ function serverEvidence(pattern, description, confidence = 'high') {
 function responseHeaderEvidence(name, pattern, description, confidence = 'high') {
     return {
         source: 'passive response header',
-        description,
+        description: `${name}: ${description}`,
         confidence,
         matches: ({ responseHeaders }) => {
             if (!responseHeaders.has(name))
@@ -142,7 +163,10 @@ function responseHeaderEvidence(name, pattern, description, confidence = 'high')
         },
     };
 }
-function evidenceRole(signature, evidence) {
+function evidenceRole(signature, evidence, context) {
+    const contextualRole = context ? evidence.roleFor?.(context) : undefined;
+    if (contextualRole)
+        return contextualRole;
     if (evidence.role)
         return evidence.role;
     if (evidence.source === 'resource origin')
@@ -159,14 +183,20 @@ const TECHNOLOGY_SIGNATURES = [
         id: 'wordpress', name: 'WordPress', category: 'content management',
         evidence: [
             generatorEvidence(/^wordpress(?:\s|$)/i, 'Generator metadata identifies WordPress.'),
-            htmlEvidence(['/wp-content/', '/wp-includes/'], 'Static resource paths use WordPress conventions.', 'medium'),
+            htmlEvidence([
+                resourceMarker((url) => /\/wp-content\//iu.test(url.pathname), '/wp-content/fixture.css'),
+                resourceMarker((url) => /\/wp-includes\//iu.test(url.pathname), '/wp-includes/fixture.js'),
+            ], 'Static resource paths use WordPress conventions.', 'medium'),
         ],
     },
     {
         id: 'drupal', name: 'Drupal', category: 'content management',
         evidence: [
             generatorEvidence(/^drupal(?:\s|$)/i, 'Generator metadata identifies Drupal.'),
-            htmlEvidence(['data-drupal-selector=', 'data-drupal-link-system-path=', 'drupal-settings-json'], 'Static markup contains Drupal-specific attributes.'),
+            htmlEvidence([
+                elementMarker((element) => hasAttributes(element, 'data-drupal-selector'), '<main data-drupal-selector="fixture"></main>'),
+                elementMarker((element) => hasAttributes(element, 'data-drupal-link-system-path'), '<main data-drupal-link-system-path="fixture"></main>'),
+            ], 'Static markup contains Drupal-specific attributes.'),
             responseHeaderEvidence('x-drupal-cache', null, 'A Drupal-specific cache response header was observed.', 'medium'),
         ],
     },
@@ -178,7 +208,10 @@ const TECHNOLOGY_SIGNATURES = [
         id: 'ghost', name: 'Ghost', category: 'content management',
         evidence: [
             generatorEvidence(/^ghost(?:\s|$)/i, 'Generator metadata identifies Ghost.'),
-            htmlEvidence(['ghost/api/content/', 'data-ghost-search'], 'Static markup contains Ghost-specific integration markers.'),
+            htmlEvidence([
+                elementMarker((element) => hasAttributes(element, 'data-ghost-search'), '<main data-ghost-search></main>'),
+                resourceMarker((url) => /\/ghost\/api\/content\//iu.test(url.pathname), '/ghost/api/content/'),
+            ], 'Static markup contains Ghost-specific integration markers.'),
         ],
     },
     {
@@ -195,7 +228,10 @@ const TECHNOLOGY_SIGNATURES = [
         id: 'shopify', name: 'Shopify', category: 'commerce',
         requiresNonResourceEvidence: true,
         evidence: [
-            htmlEvidence(['shopify-section', 'shopify.theme'], 'Static markup contains Shopify-specific storefront markers.'),
+            htmlEvidence([
+                elementMarker((element) => attributeValue(element, 'class').split(/\s/u).includes('shopify-section')
+                    || /^shopify-section(?:-|$)/u.test(attributeValue(element, 'id')), '<section class="shopify-section"></section>'),
+            ], 'Static markup contains Shopify-specific storefront markers.'),
             resourceEvidence(['cdn.shopify.com'], 'A retained resource origin uses the Shopify content network.'),
             responseHeaderEvidence('x-shopify-stage', null, 'A Shopify-specific platform response header was observed.', 'medium'),
             responseHeaderEvidence('x-sorting-hat-podid', null, 'A Shopify-specific routing response header was observed.', 'medium'),
@@ -216,33 +252,43 @@ const TECHNOLOGY_SIGNATURES = [
     {
         id: 'adobe-commerce-magento', name: 'Adobe Commerce / Magento Open Source', category: 'commerce',
         evidence: [
-            htmlEvidence(['data-mage-init=', 'type="text/x-magento-init"', "type='text/x-magento-init'"], 'Static markup contains Commerce frontend initialisation markers.'),
+            htmlEvidence([
+                elementMarker((element) => hasAttributes(element, 'data-mage-init'), '<main data-mage-init="{}"></main>'),
+                elementMarker((element) => element.name === 'script' && attributeValue(element, 'type') === 'text/x-magento-init', '<script type="text/x-magento-init">{}</script>'),
+            ], 'Static markup contains Commerce frontend initialisation markers.'),
         ],
     },
     {
         id: 'bigcommerce', name: 'BigCommerce', category: 'commerce',
         minimumEvidenceMatches: 2,
+        allowEmbeddedOnly: true,
         evidence: [
-            htmlEvidence(['cdn11.bigcommerce.com/s-', 'stencil-utils'], 'Static markup contains BigCommerce storefront asset markers.', 'medium'),
+            htmlEvidence([
+                resourceMarker((url) => /(?:^|\/)stencil-utils(?:[./-]|$)/iu.test(url.pathname), '/assets/stencil-utils.js'),
+                resourceMarker((url) => /^cdn\d+\.bigcommerce\.com$/iu.test(url.hostname) && /^\/s-[^/]+\//iu.test(url.pathname), 'https://cdn11.bigcommerce.com/s-fixture/theme.css'),
+            ], 'Static markup contains BigCommerce storefront asset markers.', 'medium'),
             resourcePatternEvidence(/^cdn\d+\.bigcommerce\.com$/i, 'A retained resource origin uses BigCommerce storefront delivery infrastructure.'),
         ],
     },
     {
         id: 'woocommerce', name: 'WooCommerce', category: 'commerce',
         evidence: [
-            htmlEvidence(['/wp-content/plugins/woocommerce/'], 'Static resource paths identify the WooCommerce plugin.'),
+            htmlEvidence([resourceMarker((url) => /\/wp-content\/plugins\/woocommerce\//iu.test(url.pathname), '/wp-content/plugins/woocommerce/fixture.css')], 'Static resource paths identify the WooCommerce plugin.'),
         ],
     },
     {
         id: 'opencart', name: 'OpenCart', category: 'commerce',
         evidence: [
-            htmlEvidence(['index.php?route=common/home', 'image/catalog/opencart-logo.png'], 'Static markup contains OpenCart routing or default asset conventions.'),
+            htmlEvidence([
+                navigationMarker((url) => /\/index\.php$/iu.test(url.pathname) && url.searchParams.getAll('route').length === 1 && url.searchParams.get('route')?.toLowerCase() === 'common/home', 'index.php?route=common/home'),
+                resourceMarker((url) => /\/image\/catalog\/opencart-logo\.png$/iu.test(url.pathname), '/image/catalog/opencart-logo.png'),
+            ], 'Static markup contains OpenCart routing or default asset conventions.'),
         ],
     },
     {
         id: 'prestashop', name: 'PrestaShop', category: 'commerce',
         evidence: [
-            htmlEvidence(['/modules/ps_'], 'Static resource paths use PrestaShop module conventions.'),
+            htmlEvidence([resourceMarker((url) => /\/modules\/ps_[^/]+\//iu.test(url.pathname), '/modules/ps_fixture/fixture.css')], 'Static resource paths use PrestaShop module conventions.'),
         ],
     },
     {
@@ -250,24 +296,29 @@ const TECHNOLOGY_SIGNATURES = [
         requiresNonResourceEvidence: true,
         evidence: [
             generatorEvidence(/^wix(?:\.com)?(?:\s|$)/i, 'Generator metadata identifies Wix.'),
-            htmlEvidence(['data-mesh-id='], 'Static markup contains a Wix-specific document attribute.', 'medium'),
+            htmlEvidence([elementMarker((element) => hasAttributes(element, 'data-mesh-id'), '<main data-mesh-id="fixture"></main>')], 'Static markup contains a Wix-specific document attribute.', 'medium'),
             resourceEvidence(['static.parastorage.com', 'wixstatic.com'], 'A retained resource origin uses Wix delivery infrastructure.'),
         ],
     },
     {
         id: 'squarespace', name: 'Squarespace', category: 'site builder',
         requiresNonResourceEvidence: true,
+        allowEmbeddedOnly: true,
         evidence: [
             generatorEvidence(/^squarespace(?:\s|$)/i, 'Generator metadata identifies Squarespace.'),
-            htmlEvidence(['squarespace-context'], 'Static markup contains a Squarespace-specific document marker.', 'medium'),
-            resourceEvidence(['static.squarespace.com', 'static1.squarespace.com'], 'A retained resource origin uses Squarespace delivery infrastructure.'),
+            htmlEvidence([
+                resourceMarker((url) => url.hostname === 'assets.squarespace.com' && /^\/universal\/scripts-compressed\/[a-z0-9][a-z0-9.-]*\.js$/iu.test(url.pathname), 'https://assets.squarespace.com/universal/scripts-compressed/fixture.js'),
+            ], 'Static resource paths use Squarespace platform bundle conventions.', 'medium'),
         ],
     },
     {
         id: 'webflow', name: 'Webflow', category: 'site builder',
         evidence: [
             generatorEvidence(/^webflow(?:\s|$)/i, 'Generator metadata identifies Webflow.'),
-            htmlEvidence(['data-wf-page=', 'data-wf-site='], 'Static markup contains Webflow-specific document attributes.'),
+            htmlEvidence([
+                elementMarker((element) => hasAttributes(element, 'data-wf-page'), '<main data-wf-page="fixture"></main>'),
+                elementMarker((element) => hasAttributes(element, 'data-wf-site'), '<main data-wf-site="fixture"></main>'),
+            ], 'Static markup contains Webflow-specific document attributes.'),
         ],
     },
     {
@@ -275,7 +326,7 @@ const TECHNOLOGY_SIGNATURES = [
         requiresNonResourceEvidence: true,
         evidence: [
             generatorEvidence(/^framer(?:\s|$)/i, 'Generator metadata identifies Framer.'),
-            htmlEvidence(['data-framer-name='], 'Static markup contains Framer-specific component attributes.'),
+            htmlEvidence([elementMarker((element) => hasAttributes(element, 'data-framer-name'), '<main data-framer-name="fixture"></main>')], 'Static markup contains Framer-specific component attributes.'),
             resourceEvidence(['framerusercontent.com'], 'A retained resource origin uses Framer delivery infrastructure.'),
         ],
     },
@@ -283,42 +334,57 @@ const TECHNOLOGY_SIGNATURES = [
         id: 'weebly', name: 'Weebly', category: 'site builder',
         requiresNonResourceEvidence: true,
         evidence: [
-            htmlEvidence(['id="wsite-base-style"', "id='wsite-base-style'", 'title="wsite-theme-css"', "title='wsite-theme-css'"], 'Static markup contains Weebly-specific theme attributes.'),
+            htmlEvidence([elementMarker((element) => element.name === 'link' && (attributeValue(element, 'id') === 'wsite-base-style' || attributeValue(element, 'title') === 'wsite-theme-css'), '<link id="wsite-base-style" href="/fixture.css">')], 'Static markup contains Weebly-specific theme attributes.'),
             resourceEvidence(['editmysite.com'], 'A retained resource origin uses Weebly delivery infrastructure.'),
         ],
     },
     {
         id: 'angular', name: 'Angular', category: 'web framework',
-        evidence: [htmlEvidence([' ng-version='], 'Static markup contains Angular version metadata.')],
+        evidence: [htmlEvidence([elementMarker((element) => hasAttributes(element, 'ng-version'), '<main ng-version="fixture"></main>')], 'Static markup contains Angular version metadata.')],
     },
     {
         id: 'aspnet-web-forms', name: 'ASP.NET Web Forms', category: 'web framework',
-        evidence: [htmlEvidence([' name="__viewstate"', ' id="__viewstate"'], 'Static form markup contains the ASP.NET Web Forms view-state field.')],
+        evidence: [htmlEvidence([elementMarker((element) => element.name === 'input' && (attributeValue(element, 'name') === '__viewstate' || attributeValue(element, 'id') === '__viewstate'), '<input name="__VIEWSTATE">')], 'Static form markup contains the ASP.NET Web Forms view-state field.')],
     },
     {
         id: 'nextjs', name: 'Next.js', category: 'web framework',
-        evidence: [htmlEvidence(['id="__next_data__"', "id='__next_data__'", '/_next/static/'], 'Static markup contains Next.js bootstrap or asset markers.')],
+        evidence: [htmlEvidence([
+                elementMarker((element) => element.name === 'script' && attributeValue(element, 'id') === '__next_data__', '<script id="__NEXT_DATA__"></script>'),
+                resourceMarker((url) => /\/_next\/static\//iu.test(url.pathname), '/_next/static/fixture.js'),
+            ], 'Static markup contains Next.js bootstrap or asset markers.')],
     },
     {
         id: 'nuxt', name: 'Nuxt', category: 'web framework',
-        evidence: [htmlEvidence(['id="__nuxt"', "id='__nuxt'", '/_nuxt/'], 'Static markup contains Nuxt bootstrap or asset markers.')],
+        evidence: [htmlEvidence([
+                elementMarker((element) => attributeValue(element, 'id') === '__nuxt', '<main id="__nuxt"></main>'),
+                resourceMarker((url) => /\/_nuxt\//iu.test(url.pathname), '/_nuxt/fixture.js'),
+            ], 'Static markup contains Nuxt bootstrap or asset markers.')],
     },
     {
         id: 'gatsby', name: 'Gatsby', category: 'web framework',
-        evidence: [htmlEvidence(['id="___gatsby"', "id='___gatsby'", '/page-data/app-data.json'], 'Static markup contains Gatsby bootstrap or page-data markers.')],
+        evidence: [htmlEvidence([
+                elementMarker((element) => attributeValue(element, 'id') === '___gatsby', '<main id="___gatsby"></main>'),
+                resourceMarker((url) => /\/page-data\/app-data\.json$/iu.test(url.pathname), '/page-data/app-data.json'),
+            ], 'Static markup contains Gatsby bootstrap or page-data markers.')],
     },
     {
         id: 'sveltekit', name: 'SvelteKit', category: 'web framework',
         evidence: [
-            htmlEvidence(['data-sveltekit-preload-data=', 'data-sveltekit-reload='], 'Static markup contains SvelteKit-specific navigation attributes.'),
-            htmlEvidence(['href="/_app/immutable/', 'src="/_app/immutable/'], 'Static asset paths use SvelteKit build conventions.', 'medium'),
+            htmlEvidence([
+                elementMarker((element) => hasAttributes(element, 'data-sveltekit-preload-data'), '<a data-sveltekit-preload-data="hover"></a>'),
+                elementMarker((element) => hasAttributes(element, 'data-sveltekit-reload'), '<a data-sveltekit-reload></a>'),
+            ], 'Static markup contains SvelteKit-specific navigation attributes.'),
+            htmlEvidence([resourceMarker((url) => /\/_app\/immutable\//iu.test(url.pathname), '/_app/immutable/fixture.css')], 'Static asset paths use SvelteKit build conventions.', 'medium'),
         ],
     },
     {
         id: 'astro', name: 'Astro', category: 'web framework',
         evidence: [
-            htmlEvidence(['<astro-island', '<astro-slot'], 'Static markup contains Astro component-island elements.'),
-            htmlEvidence(['href="/_astro/', 'src="/_astro/'], 'Static asset paths use Astro build conventions.', 'medium'),
+            htmlEvidence([
+                elementMarker((element) => element.name === 'astro-island', '<astro-island></astro-island>'),
+                elementMarker((element) => element.name === 'astro-slot', '<astro-slot></astro-slot>'),
+            ], 'Static markup contains Astro component-island elements.'),
+            htmlEvidence([resourceMarker((url) => /\/_astro\//iu.test(url.pathname), '/_astro/fixture.css')], 'Static asset paths use Astro build conventions.', 'medium'),
         ],
     },
     {
@@ -406,43 +472,85 @@ const TECHNOLOGY_SIGNATURE_CATALOGUE = Object.freeze(TECHNOLOGY_SIGNATURES.map((
         confidence: evidence.confidence,
     }))),
 })));
-function analyzeWebsiteTechnology(input = {}) {
+function technologyHtmlAnalysis(input) {
+    return input.htmlAnalysis ?? analyzeStaticHtml(input.html, {
+        ...(typeof input.documentOrigin === 'string' ? { baseUrl: input.documentOrigin } : {}),
+    });
+}
+// These are fixed semantic reconstructions, not copies of observed markup.
+// Keeping them beside the predicates removes a second keyword catalogue from
+// the contribution tools. Independent structural fixtures test the predicates.
+function minimiseTechnologyMarkup(input) {
+    const analysis = technologyHtmlAnalysis(input);
+    if (analysis.inputLimitReached || analysis.tagLimitReached) {
+        throw new TypeError('Technology review markup exceeded the complete structural-analysis boundary.');
+    }
+    const context = createTechnologyMarkupContext(analysis, input.effectiveBaseUrl, input.documentOrigin);
+    const fragments = TECHNOLOGY_SIGNATURES.flatMap((signature) => signature.evidence.flatMap((evidence) => ((evidence.markupRules ?? []).flatMap((rule) => rule.matches(context)
+        ? [rule.embedded?.(context) ? rule.embeddedReviewMarkup : rule.reviewMarkup]
+        : []))));
+    return [...new Set(fragments)].join('');
+}
+function reconstructTechnologyHtmlEvidence(id, description, role) {
+    const rules = TECHNOLOGY_SIGNATURES.find((signature) => signature.id === id)?.evidence
+        .find((evidence) => evidence.source === 'static HTML' && evidence.description === description)?.markupRules;
+    const markup = role === 'embedded_dependency'
+        ? rules?.find((rule) => rule.embeddedReviewMarkup)?.embeddedReviewMarkup
+        : rules?.[0]?.reviewMarkup;
+    if (!markup)
+        throw new TypeError('The retained static clue has no current structural reconstruction.');
+    return markup;
+}
+async function analyzeWebsiteTechnology(input = {}) {
+    input.signal?.throwIfAborted();
     // Existing direct callers pass minimised, already-derived page evidence rather
     // than the page body. The real collector declares false for header-only
     // responses, while an explicit malformed declaration also fails closed.
     const htmlAvailable = input.htmlAvailable === undefined
         ? true
         : input.htmlAvailable === true;
-    const htmlAnalysis = input.htmlAnalysis ?? analyzeStaticHtml(input.html);
-    const browserLibraryProfile = htmlAvailable ? analyzeBrowserLibraries({
+    const htmlAnalysis = htmlAvailable ? technologyHtmlAnalysis(input) : analyzeStaticHtml('');
+    const browserLibraryProfile = htmlAvailable ? await analyzeBrowserLibraries({
         htmlAnalysis,
         observedAt: input.observedAt,
         sourceTruncated: input.sourceTruncated,
+        ...(input.signal ? { signal: input.signal } : {}),
     }) : null;
     const context = {
-        html: htmlAnalysis.markup,
-        generator: boundedLowercase(input.generator, MAX_GENERATOR_INPUT),
+        ...createTechnologyMarkupContext(htmlAnalysis, input.effectiveBaseUrl, input.documentOrigin),
+        generator: htmlAvailable ? boundedLowercase(input.generator, MAX_GENERATOR_INPUT) : '',
         httpServer: boundedLowercase(input.httpServer, MAX_SERVER_INPUT),
-        resourceHosts: normalizedResourceHosts(input.resourceOrigins),
+        resourceHosts: htmlAvailable ? normalizedResourceHosts(input.resourceOrigins) : new Set(),
         responseHeaders: normalizedResponseHeaders(input.responseHeaders),
     };
     const findings = [];
     for (const signature of TECHNOLOGY_SIGNATURES) {
-        const matched = signature.evidence.filter((evidence) => evidence.matches(context));
-        if (matched.length < (signature.minimumEvidenceMatches || 1))
-            continue;
-        if (signature.requiresNonResourceEvidence && matched.every((evidence) => evidence.source === 'resource origin'))
+        const matched = signature.evidence
+            .filter((evidence) => evidence.matches(context))
+            .map((evidence) => ({ evidence, role: evidenceRole(signature, evidence, context) }));
+        const nonEmbeddedMatches = matched.filter((entry) => entry.role !== 'embedded_dependency');
+        const minimumEvidenceMatches = signature.minimumEvidenceMatches || 1;
+        const qualifiesForPlatform = matched.length >= minimumEvidenceMatches
+            && (minimumEvidenceMatches === 1 || nonEmbeddedMatches.length > 0)
+            && (!signature.requiresNonResourceEvidence || nonEmbeddedMatches.length > 0);
+        const contextualEmbeddedEvidence = matched.filter((entry) => (entry.role === 'embedded_dependency' && entry.evidence.roleFor !== undefined));
+        const selected = qualifiesForPlatform
+            ? matched
+            : signature.allowEmbeddedOnly
+                ? contextualEmbeddedEvidence.slice(0, 1)
+                : [];
+        if (selected.length === 0)
             continue;
-        const matchedEvidence = matched.slice(0, MAX_EVIDENCE_PER_TECHNOLOGY).map((evidence) => ({
+        const matchedEvidence = selected.slice(0, MAX_EVIDENCE_PER_TECHNOLOGY).map(({ evidence, role }) => ({
             source: evidence.source,
-            role: evidenceRole(signature, evidence),
+            role,
             description: evidence.description,
         }));
         findings.push({
             id: signature.id,
             name: signature.name,
             category: signature.category,
-            confidence: matched.some((evidence) => evidence.confidence === 'high') ? 'high' : 'medium',
+            confidence: selected.some(({ evidence }) => evidence.confidence === 'high') ? 'high' : 'medium',
             roles: TECHNOLOGY_EVIDENCE_ROLE_ORDER.filter((role) => matchedEvidence.some((evidence) => evidence.role === role)),
             evidence: matchedEvidence,
         });
@@ -466,7 +574,7 @@ function analyzeWebsiteTechnology(input = {}) {
     if (htmlAnalysis.inputLimitReached)
         limitations.push(`Only the first ${MAX_TECHNOLOGY_HTML_CHARS} HTML characters were evaluated.`);
     if (htmlAnalysis.tagLimitReached)
-        limitations.push(`Technology matching reached the ${MAX_TECHNOLOGY_TAGS}-tag or ${MAX_TECHNOLOGY_TAG_LENGTH}-character tag boundary.`);
+        limitations.push('Static HTML construction or attribute projection reached a bound; later technology indicators may be missing.');
     if (findingLimitReached)
         limitations.push(`Only the first ${MAX_TECHNOLOGY_FINDINGS} technology findings were retained.`);
     return {
@@ -493,4 +601,4 @@ function analyzeWebsiteTechnology(input = {}) {
         browserLibraryProfile,
     };
 }
-export { MAX_EVIDENCE_PER_TECHNOLOGY, MAX_TECHNOLOGY_EVIDENCE_DESCRIPTION_LENGTH, MAX_TECHNOLOGY_FINDINGS, MAX_TECHNOLOGY_HTML_CHARS, MAX_TECHNOLOGY_TAGS, PASSIVE_TECHNOLOGY_HEADER_NAMES, TECHNOLOGY_PROFILE_VERSION, TECHNOLOGY_SIGNATURE_CATALOGUE, analyzeWebsiteTechnology, captureTechnologyResponseHeaders, };
+export { MAX_EVIDENCE_PER_TECHNOLOGY, MAX_TECHNOLOGY_EVIDENCE_DESCRIPTION_LENGTH, MAX_TECHNOLOGY_FINDINGS, MAX_TECHNOLOGY_HTML_CHARS, MAX_TECHNOLOGY_TAGS, PASSIVE_TECHNOLOGY_HEADER_NAMES, TECHNOLOGY_CATEGORIES, TECHNOLOGY_EVIDENCE_SOURCES, TECHNOLOGY_PROFILE_VERSION, TECHNOLOGY_SIGNATURE_CATALOGUE, analyzeWebsiteTechnology, captureTechnologyResponseHeaders, minimiseTechnologyMarkup, reconstructTechnologyHtmlEvidence, };

package/lib/whois-authority.mjs

@@ -29,7 +29,10 @@ const LINE_NOT_FOUND_PATTERNS = Object.freeze([
 const NZ_NOT_FOUND_RE = /^[ \t]*query_status[ \t]*:[ \t]*220(?:\s|$)/im;
 const NZ_POSITIVE_RE = /^[ \t]*query_status[ \t]*:[ \t]*(?:200|210)(?:\s|$)/im;
 const NZ_TEMPORARY_FAILURE_RE = /^[ \t]*query_status[ \t]*:[ \t]*4\d{2}(?:\s|$)/im;
-const RATE_LIMIT_LINE_RE = /^[ \t]*(?:[%#*;>-]+[ \t]*)?(?:(?:error|status)[ \t:.-]+)?(?:whois[ \t]+limit[ \t]+exceeded|query[ \t]+(?:rate[ \t-]*)?limit[ \t]+exceeded|(?:request|query)[ \t]+limit[ \t]+(?:exceeded|reached)|rate[ \t-]*limit(?:[ \t]+exceeded)?|too[ \t]+many[ \t]+(?:requests|queries)|quota[ \t]+exceeded|number[ \t]+of[^\r\n]{0,120}[ \t]+exceeded|(?:requests?|queries?)[ \t]+(?:are[ \t]+)?throttled|throttled|(?:service[ \t]+)?temporarily[ \t]+unavailable|(?:please[ \t]+)?try[ \t]+again[ \t]+later|please[ \t]+wait)\b[^\r\n]{0,240}$/im;
+// A refusal describes this response; a footer describing permitted query
+// frequency does not. Keep explicit refusals ahead of echoed domain fields.
+const RATE_LIMIT_LINE_RE = /^[ \t]*(?:[%#*;>-]+[ \t]*)?(?:(?:error|status)[ \t:.-]+)?(?:whois[ \t]+limit[ \t]+exceeded|query[ \t]+(?:rate[ \t-]*)?limit[ \t]+exceeded|(?:request|query)[ \t]+limit[ \t]+(?:exceeded|reached)|rate[ \t-]*limit(?:ed|[ \t]+(?:exceeded|reached))|too[ \t]+many[ \t]+(?:requests|queries)|quota[ \t]+exceeded|number[ \t]+of[^\r\n]{0,120}[ \t]+exceeded|(?:requests?|queries?)[ \t]+(?:are[ \t]+)?throttled|throttled|(?:service[ \t]+)?temporarily[ \t]+unavailable)\b[^\r\n]{0,240}$/im;
+const RETRY_LINE_RE = /^[ \t]*(?:[%#*;>-]+[ \t]*)?(?:(?:error|status)[ \t:.-]+)?(?:rate[ \t-]*limit|(?:please[ \t]+)?try[ \t]+again[ \t]+later|please[ \t]+wait(?:[ \t]+\d{1,6}[ \t]+(?:seconds?|minutes?|hours?))?(?:[ \t]+(?:and[ \t]+)?(?:retry|try[ \t]+again)(?:[ \t]+later)?)?)[.!]?[ \t]*$/im;
 const POSITIVE_REGISTRATION_RE = /^[ \t*]*(?:Domain(?:[ \t]+Name)?|domainname|Registrar|Registrar WHOIS Server|Creation Date|Created(?: On)?|Registry Expiry Date|Registered(?: On)?|Name Server|nserver|Sponsoring Registrar)[ \t.]*:[ \t]*\S/im;
 const POSITIVE_BRACKET_RE = /\[(?:Domain Name|Registrant|Name Server)\][ \t]*\S/i;
 function hasSectionedRegistrationEvidence(text) {
@@ -53,7 +56,7 @@ function classifyHopEvidence(hop, index) {
     const text = hop.response || '';
     if (!text.trim())
         return 'inconclusive';
-    if (RATE_LIMIT_LINE_RE.test(text))
+    if (RATE_LIMIT_LINE_RE.test(text) || RETRY_LINE_RE.test(text))
         return 'rate_limited';
     if (NZ_TEMPORARY_FAILURE_RE.test(text))
         return 'rate_limited';
@@ -131,3 +134,12 @@ export function analyzeWhoisChainAuthority(chain) {
             : 'partial',
     };
 }
+/** Collection status shared by final and incremental Lookup presentation. */
+export function whoisCollectionStatus(chain) {
+    const source = normalizeWhoisChain(chain);
+    if (!source.length || source[0]?.error)
+        return 'error';
+    if (source.length === 1)
+        return 'unsupported';
+    return analyzeWhoisChainAuthority(source).chainStatus;
+}

package/lib/whois-chain.mjs

@@ -3,12 +3,12 @@
 // bounded referrals.
 import { domainToUnicode } from 'node:url';
 import { cached } from "./lookup-cache.mjs";
+import { MAX_WHOIS_QUERY_HOPS } from "./whois-contracts.mjs";
 import { registryCapabilityFor, registryServiceAdmissionFor, } from "./registry-capabilities.mjs";
 import { whoisQuery } from "./whois-transport.mjs";
 const IANA_WHOIS = 'whois.iana.org';
 const WHOIS_HOP_DEADLINE_MS = 12_000;
 const WHOIS_CHAIN_DEADLINE_MS = 25_000;
-const MAX_WHOIS_QUERY_HOPS = 6;
 function incompleteReferralHop(server, reason) {
     return {
         server,
@@ -58,6 +58,7 @@ function extractReferral(whoisText) {
     return null;
 }
 export async function buildWhoisChainUncached(query, options = {}) {
+    options.signal?.throwIfAborted();
     const admission = registryServiceAdmissionFor(query, 'whois');
     if (admission && !admission.allowed) {
         return [{
@@ -77,6 +78,7 @@ export async function buildWhoisChainUncached(query, options = {}) {
     let currentServer = IANA_WHOIS;
     const startedAt = now();
     for (let hop = 0; hop < MAX_WHOIS_QUERY_HOPS; hop += 1) {
+        options.signal?.throwIfAborted();
         if (visited.has(currentServer.toLowerCase())) {
             chain.push(incompleteReferralHop(currentServer, 'referral_loop'));
             break;
@@ -101,12 +103,15 @@ export async function buildWhoisChainUncached(query, options = {}) {
             responseText = await queryWhois(currentServer, transport.query, {
                 timeoutMs: Math.min(10_000, remainingMs),
                 totalDeadlineMs: Math.min(WHOIS_HOP_DEADLINE_MS, remainingMs),
+                ...(options.signal ? { signal: options.signal } : {}),
                 onAddressSelected: (selected) => {
                     address = selected;
                 },
             });
+            options.signal?.throwIfAborted();
         }
         catch (cause) {
+            options.signal?.throwIfAborted();
             chain.push({
                 server: currentServer,
                 queriedAt,
@@ -140,6 +145,8 @@ export async function buildWhoisChainUncached(query, options = {}) {
     }
     return chain;
 }
-export async function buildWhoisChain(query) {
+export async function buildWhoisChain(query, options = {}) {
+    if (options.signal)
+        return buildWhoisChainUncached(query, options);
     return cached(`whois:${query.toLowerCase()}`, () => buildWhoisChainUncached(query));
 }

package/lib/whois-common-formats.mjs

@@ -176,7 +176,7 @@ function applyWhoisCommonFormats(text, isRootHop, dialects, context) {
         }) === 'capped')
             break;
     }
-    for (const m of text.matchAll(/\[Name Server\][ \t]*([a-zA-Z0-9.\-]+)/gi)) {
+    for (const m of text.matchAll(/\[Name Server\][ \t]*([^\s]+)/gi)) {
         if (addBoundedWhoisSetValue(nameservers, m[1], {
             maxEntries: MAX_WHOIS_NAMESERVERS, maxLength: 253,
             field: 'nameservers', truncatedFields,
@@ -188,16 +188,16 @@ function applyWhoisCommonFormats(text, isRootHop, dialects, context) {
     // on every hop; "nserver:"/"Host Name:"/"DNS:" are real per-domain
     // labels on some registries (e.g. .ru, .kr, .mx) but only once we're
     // past the root hop, for the same reason as the field patterns above.
-    const nsLinePatterns = [/^[ \t*]*Name Server[ \t.]*:[ \t]*([a-zA-Z0-9.\-]+)/gim];
+    const nsLinePatterns = [/^[ \t*]*Name Server[ \t.]*:[ \t]*([^\s]+)/gim];
     if (!isRootHop) {
-        nsLinePatterns.push(/^[ \t*]*nserver[ \t.]*:[ \t]*([a-zA-Z0-9.\-]+)/gim, /^[ \t*]*Nameserver[ \t.]*:[ \t]*([a-zA-Z0-9.\-]+)/gim, /^[ \t*]*Host Name[ \t.]*:[ \t]*([a-zA-Z0-9.\-]+)/gim, /^[ \t]*ns_name_\d{2}[ \t]*:[ \t]*([a-zA-Z0-9.\-]+)/gim);
+        nsLinePatterns.push(/^[ \t*]*nserver[ \t.]*:[ \t]*([^\s]+)/gim, /^[ \t*]*Nameserver[ \t.]*:[ \t]*([^\s]+)/gim, /^[ \t*]*Host Name[ \t.]*:[ \t]*([^\s]+)/gim, /^[ \t]*ns_name_\d{2}[ \t]*:[ \t]*([^\s]+)/gim);
         // Punktum dk uses `DNS: example.dk` for the queried domain, then
         // `Hostname:` inside its nameserver section. Other supported
         // registries use `DNS:` for an actual nameserver, so switch aliases
         // only when the full .dk marker set is present.
         nsLinePatterns.push(isPunktum
-            ? /^[ \t*]*Hostname[ \t.]*:[ \t]*([a-zA-Z0-9.\-]+)/gim
-            : /^[ \t*]*DNS[ \t.]*:[ \t]*([a-zA-Z0-9.\-]+)/gim);
+            ? /^[ \t*]*Hostname[ \t.]*:[ \t]*([^\s]+)/gim
+            : /^[ \t*]*DNS[ \t.]*:[ \t]*([^\s]+)/gim);
     }
     for (const re of nsLinePatterns) {
         for (const m of text.matchAll(re)) {

package/lib/whois-contracts.mjs

@@ -1,3 +1,4 @@
 // Stable normalized WHOIS contracts. Parsing and transport remain separate so
 // consumers can depend on the record shape without importing network code.
-export {};
+export const MAX_WHOIS_STATUSES = 100;
+export const MAX_WHOIS_QUERY_HOPS = 6;

package/lib/whois-dialects.mjs

@@ -263,8 +263,8 @@ function applyWhoisDialects(text, isRootHop, context) {
             assignBoundedWhoisMatch(text, fields, 'updatedDate', /^[ \t]*Last modified[ \t.]*:[ \t]*(.+)$/im, truncatedFields);
             assignBoundedWhoisMatch(text, fields, 'registrar', /^[ \t]*Current Registar[ \t]*:[ \t]*(.+)$/im, truncatedFields);
             for (const pattern of [
-                /^[ \t]*Primary server[ \t.]*:[ \t]*([a-zA-Z0-9.-]+)/gim,
-                /^[ \t]*Secondary server[ \t.]*:[ \t]*([a-zA-Z0-9.-]+)/gim,
+                /^[ \t]*Primary server[ \t.]*:[ \t]*([^\s]+)/gim,
+                /^[ \t]*Secondary server[ \t.]*:[ \t]*([^\s]+)/gim,
             ]) {
                 for (const match of text.matchAll(pattern)) {
                     const result = addBoundedWhoisSetValue(nameservers, match[1], {

package/lib/whois-parser-support.mjs

@@ -1,7 +1,7 @@
 // Bounded primitives and generic field patterns shared by the WHOIS parser.
 import { boundedWhoisValue, whoisFieldLimit, } from "./whois-values.mjs";
+import { MAX_WHOIS_STATUSES } from "./whois-contracts.mjs";
 const MAX_WHOIS_NAMESERVERS = 200;
-const MAX_WHOIS_STATUSES = 100;
 const WHOIS_DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
 // ---------------------------------------------------------------------------
 // WHOIS response parsing (merges the referral chain into readable fields)
@@ -21,6 +21,13 @@ function assignBoundedWhoisMatch(text, fields, key, pattern, truncatedFields) {
 }
 function addBoundedWhoisSetValue(set, rawValue, { maxEntries, maxLength, field, truncatedFields, }) {
     const bounded = boundedWhoisValue(rawValue, maxLength);
+    if (bounded.truncated)
+        truncatedFields.add(field);
+    if (field === 'nameservers' && (bounded.truncated || !bounded.value
+        || !WHOIS_DOMAIN_RE.test(bounded.value.replace(/\.$/u, '')))) {
+        truncatedFields.add(field);
+        return 'ignored';
+    }
     if (!bounded.value || set.has(bounded.value))
         return 'ignored';
     if (set.size >= maxEntries) {