@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/lib/bounded-html-document.mjs

@@ -0,0 +1,125 @@
+// Native HTML tree construction over an already-captured body. Resource limits
+// are enforced while nodes are created, including implied/reconstructed nodes;
+// a post-parse traversal limit alone would not bound hostile parser work.
+import { parse, defaultTreeAdapter as adapter } from 'parse5';
+import { MAX_HOMEPAGE_BYTES } from "./outbound-request-bounds.mjs";
+import { MAX_STATIC_HTML_TAGS, MAX_STATIC_HTML_NODES, MAX_STATIC_HTML_DEPTH, } from "../packages/contracts/page-fingerprints.mjs";
+export { MAX_STATIC_HTML_TAGS, MAX_STATIC_HTML_NODES, MAX_STATIC_HTML_DEPTH, MAX_STATIC_HTML_TREE_EVENTS, } from "../packages/contracts/page-fingerprints.mjs";
+// UTF-8 decoding cannot produce more UTF-16 code units than captured bytes.
+// Direct string callers share this ceiling; tree construction remains bounded
+// independently of the source size.
+export const MAX_STATIC_HTML_CHARS = MAX_HOMEPAGE_BYTES;
+const MAX_CONSTRUCTED_ATTRIBUTE_CHARS = MAX_STATIC_HTML_CHARS * 4;
+const HTML_NAMESPACE = 'http://www.w3.org/1999/xhtml';
+export function parseBoundedHtml(value) {
+    const supplied = typeof value === 'string' ? value : '';
+    const stop = new Error('Static HTML construction limit reached.');
+    let document;
+    let nodes = 0;
+    let elements = 0;
+    let depth = 0;
+    let attributeCharacters = 0;
+    let constructionLimitReached = false;
+    function reserveNode() {
+        if (nodes >= MAX_STATIC_HTML_NODES)
+            throw stop;
+        nodes += 1;
+    }
+    function reserveAttributes(attributes) {
+        for (const attribute of attributes) {
+            attributeCharacters += attribute.name.length + attribute.value.length;
+            if (attributeCharacters > MAX_CONSTRUCTED_ATTRIBUTE_CHARS)
+                throw stop;
+        }
+    }
+    const boundedAdapter = {
+        ...adapter,
+        createDocument() {
+            reserveNode();
+            document = adapter.createDocument();
+            return document;
+        },
+        createDocumentFragment() { reserveNode(); return adapter.createDocumentFragment(); },
+        createElement(name, namespace, attributes) {
+            // Allow the three mandatory document elements in addition to source tags.
+            // Reconstructed formatting elements also consume this finite allowance.
+            if (elements >= MAX_STATIC_HTML_TAGS + 3)
+                throw stop;
+            elements += 1;
+            reserveAttributes(attributes);
+            reserveNode();
+            return adapter.createElement(name, namespace, attributes);
+        },
+        createCommentNode(text) { reserveNode(); return adapter.createCommentNode(text); },
+        insertText(parent, text) {
+            const previous = parent.childNodes.at(-1);
+            if (!previous || !adapter.isTextNode(previous))
+                reserveNode();
+            adapter.insertText(parent, text);
+        },
+        insertTextBefore(parent, text, reference) {
+            const previous = parent.childNodes[parent.childNodes.indexOf(reference) - 1];
+            if (!previous || !adapter.isTextNode(previous))
+                reserveNode();
+            adapter.insertTextBefore(parent, text, reference);
+        },
+        setDocumentType(parent, name, publicId, systemId) {
+            if (!parent.childNodes.some((node) => node.nodeName === '#documentType'))
+                reserveNode();
+            adapter.setDocumentType(parent, name, publicId, systemId);
+        },
+        adoptAttributes(element, attributes) {
+            reserveAttributes(attributes);
+            adapter.adoptAttributes(element, attributes);
+        },
+        onItemPush() {
+            depth += 1;
+            if (depth > MAX_STATIC_HTML_DEPTH)
+                throw stop;
+        },
+        onItemPop() { depth -= 1; },
+    };
+    try {
+        parse(supplied.slice(0, MAX_STATIC_HTML_CHARS), {
+            treeAdapter: boundedAdapter,
+            sourceCodeLocationInfo: true,
+            scriptingEnabled: true,
+        });
+    }
+    catch (error) {
+        if (error !== stop)
+            throw error;
+        constructionLimitReached = true;
+    }
+    // Parser or adapter failures are not silently re-labelled as empty evidence.
+    if (!document)
+        throw new Error('Static HTML document was not initialised.');
+    return { document, inputLimitReached: supplied.length > MAX_STATIC_HTML_CHARS, constructionLimitReached };
+}
+export function isHtmlElement(node) {
+    return adapter.isElementNode(node) && node.namespaceURI === HTML_NAMESPACE;
+}
+// Iterative native-tree order, without entering inert template fragments.
+// Foreign elements are retained for structure, not interpreted as HTML forms.
+export function* htmlTreeEvents(document) {
+    const pending = [{ node: document, exit: false }];
+    while (pending.length) {
+        const { node, exit } = pending.pop();
+        if (adapter.isElementNode(node)) {
+            yield { kind: exit ? 'end' : 'start', element: node };
+            if (exit)
+                continue;
+            pending.push({ node, exit: true });
+            if (isHtmlElement(node) && node.tagName === 'template')
+                continue;
+        }
+        else if (adapter.isTextNode(node)) {
+            yield { kind: 'text', text: node.value };
+        }
+        if ('childNodes' in node) {
+            for (let index = node.childNodes.length - 1; index >= 0; index -= 1) {
+                pending.push({ node: node.childNodes[index], exit: false });
+            }
+        }
+    }
+}

package/lib/bounded-json.mjs

@@ -3,6 +3,23 @@ export const MAX_BOUNDED_JSON_KEYS = 50_000;
 export const MAX_BOUNDED_JSON_VALUES = 100_000;
 export const MAX_BOUNDED_JSON_CONTAINER_ITEMS = 10_000;
 export const UNSAFE_JSON_OBJECT_KEYS = Object.freeze(['__proto__']);
+/** Aggregate work allowed by a separately enforced UTF-8 byte budget. */
+export function boundedJsonLimitsForBytes(maximumBytes) {
+    if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1) {
+        throw new TypeError('The JSON byte budget must be a positive safe integer.');
+    }
+    // A member needs at least five bytes (comma, two quotes, colon, value).
+    // Values need at least two bytes each, apart from a scalar root or the last
+    // array item. These upper bounds do not depend on a model's current fields.
+    // Nesting and individual-container limits remain independently bounded.
+    return {
+        maximumKeys: Math.floor(maximumBytes / 5),
+        maximumValues: Math.ceil(maximumBytes / 2),
+        // Decoded text is a lower bound on its UTF-8 JSON representation. Checking
+        // it before stringify also prevents an oversized string allocation.
+        maximumStringCodeUnits: maximumBytes,
+    };
+}
 function syntaxError() {
     throw new TypeError('Artefact input is not valid JSON.');
 }
@@ -16,7 +33,14 @@ export function assertBoundedJsonStructure(value, label = 'JSON value', limits =
     const maximumContainerItems = limits.maximumContainerItems ?? MAX_BOUNDED_JSON_CONTAINER_ITEMS;
     let keys = 0;
     let values = 0;
+    let stringCodeUnits = 0;
     const ancestors = new Set();
+    const text = (value) => {
+        stringCodeUnits += value.length;
+        if (limits.maximumStringCodeUnits !== undefined && stringCodeUnits > limits.maximumStringCodeUnits) {
+            throw new TypeError(`${label} exceeds the aggregate text limit.`);
+        }
+    };
     const visit = (current, depth) => {
         values += 1;
         if (values > maximumValues) {
@@ -25,7 +49,11 @@ export function assertBoundedJsonStructure(value, label = 'JSON value', limits =
         if (depth > maximumDepth) {
             throw new TypeError(`${label} exceeds the ${maximumDepth}-level nesting limit.`);
         }
-        if (current === null || typeof current === 'string' || typeof current === 'boolean')
+        if (typeof current === 'string') {
+            text(current);
+            return;
+        }
+        if (current === null || typeof current === 'boolean')
             return;
         if (typeof current === 'number') {
             if (!Number.isFinite(current))
@@ -91,6 +119,7 @@ export function assertBoundedJsonStructure(value, label = 'JSON value', limits =
             for (const key of objectKeys) {
                 if (!isSafeJsonObjectKey(key))
                     throw new TypeError(`${label} contains an unsafe object key.`);
+                text(key);
                 visit(descriptors[key].value, depth + 1);
             }
         }
@@ -106,9 +135,14 @@ export function scanBoundedJson(raw, limits = {}, observeString) {
     let index = 0;
     let keys = 0;
     let values = 0;
+    let stringCodeUnits = 0;
     const whitespace = () => {
-        while (index < raw.length && /[\t\n\r ]/u.test(raw[index]))
+        while (index < raw.length) {
+            const code = raw.charCodeAt(index);
+            if (code !== 0x20 && code !== 0x09 && code !== 0x0a && code !== 0x0d)
+                break;
             index += 1;
+        }
     };
     const stringToken = () => {
         const start = index;
@@ -117,12 +151,18 @@ export function scanBoundedJson(raw, limits = {}, observeString) {
             const character = raw[index];
             if (character === '"') {
                 index += 1;
+                let value;
                 try {
-                    return { value: JSON.parse(raw.slice(start, index)), offset: start };
+                    value = JSON.parse(raw.slice(start, index));
                 }
                 catch {
                     syntaxError();
                 }
+                stringCodeUnits += value.length;
+                if (limits.maximumStringCodeUnits !== undefined && stringCodeUnits > limits.maximumStringCodeUnits) {
+                    throw new TypeError('Artefact JSON exceeds the aggregate text limit.');
+                }
+                return { value, offset: start };
             }
             if (character === '\\') {
                 index += 1;

package/lib/browser-library-profile.mjs

@@ -5,9 +5,11 @@
 // are treated as untrusted inputs and are not retained in the result.
 import { createHash } from 'node:crypto';
 import { Worker } from 'node:worker_threads';
+import { createInlineLibraryScanner } from "./browser-library-worker.mjs";
 import { RETIRE_BROWSER_CATALOG } from "./generated/retire-browser-catalog.mjs";
 import { CISA_KEV_CATALOG } from "./generated/cisa-kev-catalog.mjs";
-import { createObservation } from "../packages/evidence/observation.mjs";
+import { createObservation, normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
+import { isCveIdentifier } from "../packages/contracts/vulnerability-identifiers.mjs";
 import { BROWSER_LIBRARY_PROFILE_VERSION, MAX_LIBRARY_FINDINGS, } from "./lookup-child-profile-contract.mjs";
 import { MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_STATIC_HTML_CHARS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 // Catalogue expressions are reviewed third-party inputs. Keep every individual
@@ -25,7 +27,6 @@ const MAX_MATCHES_PER_PATTERN = 4;
 const MAX_VERSION_LENGTH = 64;
 const COMPONENT_RE = /^[a-z0-9._-]{1,80}$/i;
 const VERSION_RE = /^[0-9][0-9.a-z_-]{0,63}$/i;
-const CVE_RE = /^CVE-[0-9X-]+$/;
 const GHSA_RE = /^GHSA-[A-Z0-9-]+$/;
 const CWE_RE = /^CWE-[0-9]+$/;
 const SEVERITY_WEIGHT = Object.freeze({
@@ -37,6 +38,9 @@ const SEVERITY_WEIGHT = Object.freeze({
 });
 const CATALOG_COMPONENTS = RETIRE_BROWSER_CATALOG.components;
 const KNOWN_EXPLOITED_IDENTIFIERS = new Set(CISA_KEV_CATALOG.identifiers);
+const KNOWN_EXPLOITED_RELEASED_AT = normalizeExplicitIsoTimestamp(CISA_KEV_CATALOG.releasedAt);
+if (KNOWN_EXPLOITED_RELEASED_AT === null)
+    throw new Error('Pinned known-exploited catalogue has an invalid release timestamp.');
 const INLINE_EXTRACTOR_CATALOGUE = Object.freeze(Object.entries(CATALOG_COMPONENTS).map(([component, value]) => {
     const extractors = record(record(value).extractors);
     return Object.freeze({
@@ -95,10 +99,16 @@ parentPort.on('message', (job) => {
   } catch {
     Atomics.store(control, 0, -1);
   }
-  Atomics.notify(control, 0);
+  parentPort.postMessage({ id: job.id });
 });
 `;
-let inlineRegexWorker = null;
+const scanInlineLibrary = createInlineLibraryScanner(() => new Worker(INLINE_REGEX_WORKER_SOURCE, { eval: true, workerData: { catalogue: INLINE_EXTRACTOR_CATALOGUE } }), {
+    maximumCharacters: MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS + MAX_SCRIPT_ELEMENTS,
+    outputBytes: MAX_INLINE_LIBRARY_WORKER_BYTES,
+    deadlineMs: MAX_INLINE_LIBRARY_SCAN_MS,
+    // One worker/output buffer, with at most sixteen bounded pending inputs.
+    pending: 16,
+});
 function record(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -218,48 +228,15 @@ function scanFilename(detected, reference) {
         }
     }
 }
-function scanInlineSignatures(detected, value) {
+async function scanInlineSignatures(detected, value, signal) {
     if (!value)
         return { timedOut: false, unavailable: false };
-    const controlBuffer = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT);
-    const outputBuffer = new SharedArrayBuffer(MAX_INLINE_LIBRARY_WORKER_BYTES);
-    const control = new Int32Array(controlBuffer);
+    const result = await scanInlineLibrary(value, signal);
+    signal?.throwIfAborted();
+    if (result.output === null)
+        return result;
     try {
-        if (!inlineRegexWorker) {
-            const createdWorker = new Worker(INLINE_REGEX_WORKER_SOURCE, {
-                eval: true,
-                workerData: { catalogue: INLINE_EXTRACTOR_CATALOGUE },
-            });
-            inlineRegexWorker = createdWorker;
-            createdWorker.unref();
-            createdWorker.once('exit', () => {
-                if (inlineRegexWorker === createdWorker)
-                    inlineRegexWorker = null;
-            });
-            createdWorker.once('error', () => {
-                if (inlineRegexWorker === createdWorker)
-                    inlineRegexWorker = null;
-            });
-        }
-        inlineRegexWorker.postMessage({ value, control: controlBuffer, output: outputBuffer });
-    }
-    catch {
-        void inlineRegexWorker?.terminate().catch(() => { });
-        inlineRegexWorker = null;
-        return { timedOut: false, unavailable: true };
-    }
-    const wait = Atomics.wait(control, 0, 0, MAX_INLINE_LIBRARY_SCAN_MS);
-    const length = Atomics.load(control, 0);
-    if (wait === 'timed-out') {
-        void inlineRegexWorker?.terminate().catch(() => { });
-        inlineRegexWorker = null;
-        return { timedOut: true, unavailable: false };
-    }
-    if (length < 1 || length > MAX_INLINE_LIBRARY_WORKER_BYTES) {
-        return { timedOut: false, unavailable: true };
-    }
-    try {
-        const parsed = JSON.parse(Buffer.from(new Uint8Array(outputBuffer, 0, length)).toString('utf8'));
+        const parsed = JSON.parse(result.output);
         if (!Array.isArray(parsed))
             return { timedOut: false, unavailable: true };
         for (const item of parsed.slice(0, MAX_LIBRARY_FINDINGS * 4)) {
@@ -311,13 +288,20 @@ function findingFromDetection(detected) {
     let highestSeverity = null;
     const identifiers = new Set();
     const weaknesses = new Set();
+    let omittedCveIdentifiers = 0;
     for (const vulnerability of vulnerabilities) {
         const candidateSeverity = severity(vulnerability.severity);
         if (candidateSeverity
             && (!highestSeverity || SEVERITY_WEIGHT[candidateSeverity] > SEVERITY_WEIGHT[highestSeverity]))
             highestSeverity = candidateSeverity;
         const vulnerabilityIdentifiers = record(vulnerability.identifiers);
-        for (const cve of boundedStringArray(vulnerabilityIdentifiers.CVE, 16, CVE_RE)) {
+        omittedCveIdentifiers += typeof vulnerability.omittedCveIdentifiers === 'number'
+            && Number.isSafeInteger(vulnerability.omittedCveIdentifiers) && vulnerability.omittedCveIdentifiers > 0
+            ? vulnerability.omittedCveIdentifiers : 0;
+        const suppliedCve = Array.isArray(vulnerabilityIdentifiers.CVE) ? vulnerabilityIdentifiers.CVE : [];
+        const validCve = suppliedCve.filter(isCveIdentifier);
+        omittedCveIdentifiers += suppliedCve.length - validCve.length;
+        for (const cve of validCve.slice(0, 16)) {
             if (identifiers.size < MAX_ADVISORY_IDENTIFIERS)
                 identifiers.add(cve);
         }
@@ -332,7 +316,7 @@ function findingFromDetection(detected) {
     }
     const advisoryIdentifiers = [...identifiers].sort();
     const knownExploitedIdentifiers = advisoryIdentifiers.filter((identifier) => KNOWN_EXPLOITED_IDENTIFIERS.has(identifier));
-    return {
+    const finding = {
         id: detected.component,
         name: detected.component,
         apparentVersion: detected.version,
@@ -344,8 +328,10 @@ function findingFromDetection(detected) {
         knownExploitedIdentifiers,
         weaknessClasses: [...weaknesses].sort(),
     };
+    return { finding, omittedCveIdentifiers };
 }
-function analyzeBrowserLibraries(input = {}) {
+async function analyzeBrowserLibraries(input = {}) {
+    input.signal?.throwIfAborted();
     const htmlAnalysis = input.htmlAnalysis ?? analyzeStaticHtml(input.html);
     const detected = new Map();
     let referencesExamined = 0;
@@ -369,10 +355,12 @@ function analyzeBrowserLibraries(input = {}) {
                 inlineSignatureSamples.push(signatureScan.signatureContent);
         }
     }
-    const inlineSignatureResult = scanInlineSignatures(detected, inlineSignatureSamples.join('\u0000'));
+    const inlineSignatureResult = await scanInlineSignatures(detected, inlineSignatureSamples.join('\u0000'), input.signal);
+    input.signal?.throwIfAborted();
     const inlineSignatureUnavailable = inlineSignatureResult.timedOut || inlineSignatureResult.unavailable;
-    const allFindings = [...detected.values()]
-        .map(findingFromDetection)
+    const projected = [...detected.values()].map(findingFromDetection);
+    const omittedCveIdentifiers = projected.reduce((total, entry) => total + entry.omittedCveIdentifiers, 0);
+    const allFindings = projected.map((entry) => entry.finding)
         .sort((left, right) => ((right.highestSeverity ? SEVERITY_WEIGHT[right.highestSeverity] : -1)
         - (left.highestSeverity ? SEVERITY_WEIGHT[left.highestSeverity] : -1)
         || right.advisoryCount - left.advisoryCount
@@ -386,7 +374,8 @@ function analyzeBrowserLibraries(input = {}) {
         || htmlAnalysis.inlineLimitReached
         || inlineSignatureLimitReached
         || inlineSignatureUnavailable
-        || findingLimitReached;
+        || findingLimitReached
+        || omittedCveIdentifiers > 0;
     const limitations = [
         'Library versions are inferred from passive static signatures and may be absent, transformed, or misleading.',
         'A catalogue advisory match identifies a component version associated with a published advisory; it does not establish reachability or exploitability.',
@@ -411,6 +400,8 @@ function analyzeBrowserLibraries(input = {}) {
         limitations.push('Passive library signature matching was unavailable in its isolated worker; hash evidence was still evaluated.');
     if (findingLimitReached)
         limitations.push(`Only the first ${MAX_LIBRARY_FINDINGS} library findings were retained.`);
+    if (omittedCveIdentifiers)
+        limitations.push(`${omittedCveIdentifiers} supplied CVE identifier ${omittedCveIdentifiers === 1 ? 'entry was' : 'entries were'} omitted from matching catalogue advisories because of invalid syntax or a source limit. Advisory matches are still counted.`);
     return {
         profileVersion: BROWSER_LIBRARY_PROFILE_VERSION,
         catalog: {
@@ -421,7 +412,7 @@ function analyzeBrowserLibraries(input = {}) {
         knownExploitedCatalog: {
             name: 'CISA KEV',
             version: CISA_KEV_CATALOG.catalogVersion,
-            releasedAt: CISA_KEV_CATALOG.releasedAt,
+            releasedAt: KNOWN_EXPLOITED_RELEASED_AT,
         },
         ...createObservation({
             status: truncated ? 'partial' : 'success',

package/lib/browser-library-worker.mjs

@@ -0,0 +1,112 @@
+/** One bounded matcher worker. Queue deadlines include waiting; cancellation never stops a different scan. */
+export function createInlineLibraryScanner(createWorker, limits) {
+    let worker = null;
+    let active = null;
+    let closing = false;
+    let nextId = 0;
+    const queue = [];
+    const pending = new Set();
+    function retireWorker() {
+        if (!worker)
+            return;
+        const retired = worker;
+        worker = null;
+        closing = true;
+        void Promise.resolve().then(() => retired.terminate()).catch(() => { }).finally(() => { closing = false; pump(); });
+    }
+    function pump() {
+        if (active || closing)
+            return;
+        const job = queue.shift();
+        if (!job) {
+            worker?.unref();
+            return;
+        }
+        active = job;
+        let current;
+        const control = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+        const output = new Uint8Array(new SharedArrayBuffer(limits.outputBytes));
+        const cleanup = job.cleanup;
+        const failed = () => settle(job, { timedOut: false, unavailable: true, output: null }, true);
+        const message = (value) => {
+            if (!value || typeof value !== 'object' || !('id' in value) || value.id !== job.id)
+                return;
+            const length = Atomics.load(control, 0);
+            if (length < 1 || length > output.byteLength) {
+                failed();
+                return;
+            }
+            settle(job, { timedOut: false, unavailable: false, output: Buffer.from(output.subarray(0, length)).toString('utf8') });
+        };
+        job.cleanup = () => {
+            cleanup();
+            current?.off('message', message);
+            current?.off('error', failed);
+            current?.off('exit', failed);
+        };
+        try {
+            if (!worker) {
+                const created = createWorker();
+                worker = created;
+                const idleStopped = () => { if (!active && worker === created)
+                    worker = null; };
+                created.on('error', idleStopped);
+                created.on('exit', idleStopped);
+            }
+            current = worker;
+            if (active !== job) {
+                retireWorker();
+                return;
+            }
+            current.ref();
+            current.on('message', message);
+            current.on('error', failed);
+            current.on('exit', failed);
+            current.postMessage({ id: job.id, value: job.value, control: control.buffer, output: output.buffer });
+        }
+        catch {
+            failed();
+        }
+    }
+    function settle(job, result, retire = false, aborted = false) {
+        if (!pending.delete(job))
+            return;
+        job.cleanup();
+        if (active === job) {
+            active = null;
+            if (retire)
+                retireWorker();
+        }
+        else {
+            const index = queue.indexOf(job);
+            if (index >= 0)
+                queue.splice(index, 1);
+        }
+        if (aborted)
+            job.reject(job.signal?.reason ?? new DOMException('Aborted', 'AbortError'));
+        else
+            job.resolve(result);
+        queueMicrotask(pump);
+    }
+    return function scan(value, signal) {
+        signal?.throwIfAborted();
+        if (!value)
+            return Promise.resolve({ timedOut: false, unavailable: false, output: '[]' });
+        if (value.length > limits.maximumCharacters || pending.size >= limits.pending) {
+            return Promise.resolve({ timedOut: false, unavailable: true, output: null });
+        }
+        return new Promise((resolve, reject) => {
+            const job = { id: ++nextId, value, ...(signal ? { signal } : {}), resolve, reject, cleanup: () => { } };
+            const timer = setTimeout(() => settle(job, { timedOut: true, unavailable: false, output: null }, true), limits.deadlineMs);
+            const abort = () => settle(job, { timedOut: false, unavailable: true, output: null }, true, true);
+            job.cleanup = () => { clearTimeout(timer); signal?.removeEventListener('abort', abort); };
+            pending.add(job);
+            queue.push(job);
+            signal?.addEventListener('abort', abort, { once: true });
+            if (signal?.aborted)
+                abort();
+            else
+                pump();
+        });
+    };
+}

package/lib/client-behavior-profile.mjs

@@ -1,5 +1,5 @@
 // Static client-side behaviour indicators derived from the existing bounded
-// HTML tokenizer pass. Scripts are never fetched or executed. Only fixed
+// HTML parse. Scripts are never fetched or executed. Only fixed
 // indicator identifiers, descriptions, evidence classes, and bounded counts
 // leave this module; script references and contents are discarded.
 import { createObservation } from "../packages/evidence/observation.mjs";
@@ -20,7 +20,6 @@ function patternCount(value, pattern) {
 }
 function analyzeClientBehavior(input = {}) {
     const htmlAnalysis = input.htmlAnalysis ?? analyzeStaticHtml(input.html);
-    const markup = htmlAnalysis.markup;
     const inlineScripts = htmlAnalysis.scripts
         .filter((script) => script.reference === null)
         .map((script) => script.inlineContent)
@@ -31,7 +30,8 @@ function analyzeClientBehavior(input = {}) {
             return;
         indicators.push({ id, label, evidenceClass, occurrences: boundedOccurrences(occurrences), explanation });
     }
-    add('inline_event_handlers', 'Inline event handlers', 'static_markup', patternCount(markup, /\son[a-z]{2,24}="/gu), 'Inline HTML event-handler attributes were observed.');
+    add('inline_event_handlers', 'Inline event handlers', 'static_markup', htmlAnalysis.elements.reduce((count, element) => count
+        + element.attributes.filter((attribute) => /^on[a-z]{2,24}$/u.test(attribute.name)).length, 0), 'Inline HTML event-handler attributes were observed.');
     add('client_navigation', 'Client-side navigation', 'inline_script', patternCount(inlineScripts, /\b(?:history\.(?:pushState|replaceState)|location\.(?:assign|replace)|window\.location)\b/gu), 'Inline script contains a client-side navigation API.');
     add('form_interception', 'Form interception', 'inline_script', patternCount(inlineScripts, /(?:addEventListener\s*\(\s*['"]submit['"]|\.onsubmit\s*=|preventDefault\s*\()/gu), 'Inline script contains a form-submission or default-action interception marker.');
     add('service_worker', 'Service worker registration', 'inline_script', patternCount(inlineScripts, /\bnavigator\.serviceWorker\.register\s*\(/gu), 'Inline script contains a service-worker registration call.');

package/lib/ct-search.mjs

@@ -7,6 +7,7 @@
 // earliest public signal a new lookalike exists at all. Shared by the
 // Express server and the Netlify Functions.
 import { parse } from 'tldts';
+import { setTimeout as sleep } from 'node:timers/promises';
 import { normalizeCtQuery } from "./ct-query.mjs";
 import { safeFetch, readTextCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
@@ -71,23 +72,26 @@ function normalizeHostname(raw) {
         h = h.slice(2);
     return HOSTNAME_RE.test(h) && isValidAsciiHostname(h, { requireLowercase: true }) ? h : null;
 }
-function delay(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+function delay(ms, signal) {
+    return sleep(ms, undefined, signal ? { signal } : {});
 }
 async function fetchCrtSh(keyword, attempt = 0, dependencies = {}) {
+    dependencies.signal?.throwIfAborted();
     const fetcher = dependencies.fetcher || safeFetch;
     const wait = dependencies.delay || delay;
     const controller = new AbortController();
+    const signal = dependencies.signal ? AbortSignal.any([dependencies.signal, controller.signal]) : controller.signal;
     const timeout = setTimeout(() => controller.abort(), CRT_SH_TIMEOUT_MS);
     try {
         let res;
         try {
             res = await fetcher(`https://crt.sh/?q=${encodeURIComponent(keyword)}&output=json`, {
                 headers: whoisleuthRequestHeaders({ Accept: 'application/json' }),
-                signal: controller.signal,
+                signal,
             }, 0);
         }
         catch (err) {
+            dependencies.signal?.throwIfAborted();
             if (!(err instanceof Error) || err.name !== 'AbortError')
                 throw err;
             if (attempt < MAX_TIMEOUT_RETRIES)
@@ -101,7 +105,8 @@ async function fetchCrtSh(keyword, attempt = 0, dependencies = {}) {
             // undici's own idle-timeout eventually notices.
             await res.body?.cancel().catch(() => { });
             if (RETRYABLE_STATUSES.has(res.status) && attempt < MAX_RETRIES) {
-                await wait(RETRY_DELAY_MS * (attempt + 1));
+                await wait(RETRY_DELAY_MS * (attempt + 1), dependencies.signal);
+                dependencies.signal?.throwIfAborted();
                 return fetchCrtSh(keyword, attempt + 1, dependencies);
             }
             throw new Error(RETRYABLE_STATUSES.has(res.status)
@@ -109,6 +114,7 @@ async function fetchCrtSh(keyword, attempt = 0, dependencies = {}) {
                 : `crt.sh returned ${res.status}`);
         }
         const { text, truncated } = await readTextCapped(res, CRT_SH_MAX_BYTES, { fatalUtf8: true });
+        signal.throwIfAborted();
         if (truncated) {
             throw new Error(`crt.sh returned more than ${CRT_SH_MAX_BYTES / (1024 * 1024)}MB of results for "${keyword}" - try a narrower/more specific keyword.`);
         }
@@ -464,6 +470,7 @@ function summarizeCtResults(rows) {
 // Production search
 // ---------------------------------------------------------------------------
 async function searchCertificateTransparency(keyword, dependencies = {}) {
+    dependencies.signal?.throwIfAborted();
     const startedAt = Date.now();
     const trimmed = normalizeCtQuery(keyword);
     if (!trimmed) {