@slicedearth/whoisleuth-cli 2.3.0 → 2.4.0

package/lib/website-technology.mjs

@@ -6,7 +6,8 @@
 // retained.
 import { analyzeBrowserLibraries } from "./browser-library-profile.mjs";
 import { createObservation } from "../packages/evidence/observation.mjs";
-import { MAX_STATIC_HTML_CHARS, MAX_TAG_LENGTH, MAX_TECHNOLOGY_TAGS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
+import { attributeValue, createTechnologyMarkupContext, elementMarker, hasAttributes, navigationMarker, resourceMarker, } from "./technology-markup.mjs";
+import { MAX_STATIC_HTML_CHARS, MAX_STATIC_HTML_TAGS as MAX_TECHNOLOGY_TAGS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 import { TECHNOLOGY_EVIDENCE_ROLE_ORDER, } from "./technology-evidence-role.mjs";
 import { MAX_EVIDENCE_PER_TECHNOLOGY, MAX_TECHNOLOGY_EVIDENCE_DESCRIPTION_LENGTH, MAX_TECHNOLOGY_FINDINGS, TECHNOLOGY_PROFILE_VERSION, } from "./lookup-child-profile-contract.mjs";
 const TECHNOLOGY_CATEGORIES = Object.freeze([
@@ -27,7 +28,6 @@ const TECHNOLOGY_EVIDENCE_SOURCES = Object.freeze([
     'passive response header',
 ]);
 const MAX_TECHNOLOGY_HTML_CHARS = MAX_STATIC_HTML_CHARS;
-const MAX_TECHNOLOGY_TAG_LENGTH = MAX_TAG_LENGTH;
 const MAX_RESOURCE_ORIGINS = 30;
 const MAX_GENERATOR_INPUT = 160;
 const MAX_SERVER_INPUT = 240;
@@ -55,29 +55,6 @@ function normalizedResourceHosts(value) {
     }
     return hosts;
 }
-function applicationMarkup(markup, resourceHosts, effectiveBaseUrl, documentOrigin) {
-    let resolutionBase;
-    try {
-        resolutionBase = new URL(typeof effectiveBaseUrl === 'string' ? effectiveBaseUrl : 'https://document.invalid/');
-    }
-    catch {
-        resolutionBase = new URL('https://document.invalid/');
-    }
-    const comparedOrigin = typeof documentOrigin === 'string' && /^https?:\/\//iu.test(documentOrigin)
-        ? documentOrigin
-        : null;
-    return markup.replace(/\s(src|href|poster|data)="([^"]*)"/giu, (attribute, name, value) => {
-        try {
-            const parsed = new URL(value, resolutionBase);
-            const knownExternalHost = resourceHosts.has(parsed.hostname.toLowerCase());
-            const offOrigin = comparedOrigin ? parsed.origin !== comparedOrigin : knownExternalHost;
-            return knownExternalHost && offOrigin ? ` ${name.toLowerCase()}=""` : attribute;
-        }
-        catch {
-            return attribute;
-        }
-    });
-}
 const PASSIVE_TECHNOLOGY_HEADER_NAMES = Object.freeze([
     'cf-ray',
     'x-drupal-cache',
@@ -138,21 +115,14 @@ function generatorEvidence(pattern, description) {
         matches: ({ generator }) => pattern.test(generator),
     };
 }
-function htmlEvidence(markers, description, confidence = 'high') {
-    return {
-        source: 'static HTML',
-        description,
-        confidence,
-        matches: ({ html }) => markers.some((marker) => html.includes(marker)),
-    };
-}
-function resourcePathEvidence(markers, description, confidence = 'high') {
+function htmlEvidence(markupRules, description, confidence = 'high') {
     return {
         source: 'static HTML',
         description,
         confidence,
-        matches: ({ html }) => markers.some((marker) => html.includes(marker)),
-        roleFor: ({ applicationHtml }) => markers.some((marker) => applicationHtml.includes(marker))
+        markupRules,
+        matches: (context) => markupRules.some((rule) => rule.matches(context)),
+        roleFor: (context) => markupRules.some((rule) => rule.matches(context) && !rule.embedded?.(context))
             ? undefined
             : 'embedded_dependency',
     };
@@ -184,7 +154,7 @@ function serverEvidence(pattern, description, confidence = 'high') {
 function responseHeaderEvidence(name, pattern, description, confidence = 'high') {
     return {
         source: 'passive response header',
-        description,
+        description: `${name}: ${description}`,
         confidence,
         matches: ({ responseHeaders }) => {
             if (!responseHeaders.has(name))
@@ -213,14 +183,20 @@ const TECHNOLOGY_SIGNATURES = [
         id: 'wordpress', name: 'WordPress', category: 'content management',
         evidence: [
             generatorEvidence(/^wordpress(?:\s|$)/i, 'Generator metadata identifies WordPress.'),
-            resourcePathEvidence(['/wp-content/', '/wp-includes/'], 'Static resource paths use WordPress conventions.', 'medium'),
+            htmlEvidence([
+                resourceMarker((url) => /\/wp-content\//iu.test(url.pathname), '/wp-content/fixture.css'),
+                resourceMarker((url) => /\/wp-includes\//iu.test(url.pathname), '/wp-includes/fixture.js'),
+            ], 'Static resource paths use WordPress conventions.', 'medium'),
         ],
     },
     {
         id: 'drupal', name: 'Drupal', category: 'content management',
         evidence: [
             generatorEvidence(/^drupal(?:\s|$)/i, 'Generator metadata identifies Drupal.'),
-            htmlEvidence(['data-drupal-selector=', 'data-drupal-link-system-path=', 'drupal-settings-json'], 'Static markup contains Drupal-specific attributes.'),
+            htmlEvidence([
+                elementMarker((element) => hasAttributes(element, 'data-drupal-selector'), '<main data-drupal-selector="fixture"></main>'),
+                elementMarker((element) => hasAttributes(element, 'data-drupal-link-system-path'), '<main data-drupal-link-system-path="fixture"></main>'),
+            ], 'Static markup contains Drupal-specific attributes.'),
             responseHeaderEvidence('x-drupal-cache', null, 'A Drupal-specific cache response header was observed.', 'medium'),
         ],
     },
@@ -232,7 +208,10 @@ const TECHNOLOGY_SIGNATURES = [
         id: 'ghost', name: 'Ghost', category: 'content management',
         evidence: [
             generatorEvidence(/^ghost(?:\s|$)/i, 'Generator metadata identifies Ghost.'),
-            htmlEvidence(['ghost/api/content/', 'data-ghost-search'], 'Static markup contains Ghost-specific integration markers.'),
+            htmlEvidence([
+                elementMarker((element) => hasAttributes(element, 'data-ghost-search'), '<main data-ghost-search></main>'),
+                resourceMarker((url) => /\/ghost\/api\/content\//iu.test(url.pathname), '/ghost/api/content/'),
+            ], 'Static markup contains Ghost-specific integration markers.'),
         ],
     },
     {
@@ -249,7 +228,10 @@ const TECHNOLOGY_SIGNATURES = [
         id: 'shopify', name: 'Shopify', category: 'commerce',
         requiresNonResourceEvidence: true,
         evidence: [
-            htmlEvidence(['shopify-section', 'shopify.theme'], 'Static markup contains Shopify-specific storefront markers.'),
+            htmlEvidence([
+                elementMarker((element) => attributeValue(element, 'class').split(/\s/u).includes('shopify-section')
+                    || /^shopify-section(?:-|$)/u.test(attributeValue(element, 'id')), '<section class="shopify-section"></section>'),
+            ], 'Static markup contains Shopify-specific storefront markers.'),
             resourceEvidence(['cdn.shopify.com'], 'A retained resource origin uses the Shopify content network.'),
             responseHeaderEvidence('x-shopify-stage', null, 'A Shopify-specific platform response header was observed.', 'medium'),
             responseHeaderEvidence('x-sorting-hat-podid', null, 'A Shopify-specific routing response header was observed.', 'medium'),
@@ -270,7 +252,10 @@ const TECHNOLOGY_SIGNATURES = [
     {
         id: 'adobe-commerce-magento', name: 'Adobe Commerce / Magento Open Source', category: 'commerce',
         evidence: [
-            htmlEvidence(['data-mage-init=', 'type="text/x-magento-init"', "type='text/x-magento-init'"], 'Static markup contains Commerce frontend initialisation markers.'),
+            htmlEvidence([
+                elementMarker((element) => hasAttributes(element, 'data-mage-init'), '<main data-mage-init="{}"></main>'),
+                elementMarker((element) => element.name === 'script' && attributeValue(element, 'type') === 'text/x-magento-init', '<script type="text/x-magento-init">{}</script>'),
+            ], 'Static markup contains Commerce frontend initialisation markers.'),
         ],
     },
     {
@@ -278,26 +263,32 @@ const TECHNOLOGY_SIGNATURES = [
         minimumEvidenceMatches: 2,
         allowEmbeddedOnly: true,
         evidence: [
-            resourcePathEvidence(['cdn11.bigcommerce.com/s-', 'stencil-utils'], 'Static markup contains BigCommerce storefront asset markers.', 'medium'),
+            htmlEvidence([
+                resourceMarker((url) => /(?:^|\/)stencil-utils(?:[./-]|$)/iu.test(url.pathname), '/assets/stencil-utils.js'),
+                resourceMarker((url) => /^cdn\d+\.bigcommerce\.com$/iu.test(url.hostname) && /^\/s-[^/]+\//iu.test(url.pathname), 'https://cdn11.bigcommerce.com/s-fixture/theme.css'),
+            ], 'Static markup contains BigCommerce storefront asset markers.', 'medium'),
             resourcePatternEvidence(/^cdn\d+\.bigcommerce\.com$/i, 'A retained resource origin uses BigCommerce storefront delivery infrastructure.'),
         ],
     },
     {
         id: 'woocommerce', name: 'WooCommerce', category: 'commerce',
         evidence: [
-            htmlEvidence(['/wp-content/plugins/woocommerce/'], 'Static resource paths identify the WooCommerce plugin.'),
+            htmlEvidence([resourceMarker((url) => /\/wp-content\/plugins\/woocommerce\//iu.test(url.pathname), '/wp-content/plugins/woocommerce/fixture.css')], 'Static resource paths identify the WooCommerce plugin.'),
         ],
     },
     {
         id: 'opencart', name: 'OpenCart', category: 'commerce',
         evidence: [
-            htmlEvidence(['index.php?route=common/home', 'image/catalog/opencart-logo.png'], 'Static markup contains OpenCart routing or default asset conventions.'),
+            htmlEvidence([
+                navigationMarker((url) => /\/index\.php$/iu.test(url.pathname) && url.searchParams.getAll('route').length === 1 && url.searchParams.get('route')?.toLowerCase() === 'common/home', 'index.php?route=common/home'),
+                resourceMarker((url) => /\/image\/catalog\/opencart-logo\.png$/iu.test(url.pathname), '/image/catalog/opencart-logo.png'),
+            ], 'Static markup contains OpenCart routing or default asset conventions.'),
         ],
     },
     {
         id: 'prestashop', name: 'PrestaShop', category: 'commerce',
         evidence: [
-            htmlEvidence(['/modules/ps_'], 'Static resource paths use PrestaShop module conventions.'),
+            htmlEvidence([resourceMarker((url) => /\/modules\/ps_[^/]+\//iu.test(url.pathname), '/modules/ps_fixture/fixture.css')], 'Static resource paths use PrestaShop module conventions.'),
         ],
     },
     {
@@ -305,24 +296,29 @@ const TECHNOLOGY_SIGNATURES = [
         requiresNonResourceEvidence: true,
         evidence: [
             generatorEvidence(/^wix(?:\.com)?(?:\s|$)/i, 'Generator metadata identifies Wix.'),
-            htmlEvidence(['data-mesh-id='], 'Static markup contains a Wix-specific document attribute.', 'medium'),
+            htmlEvidence([elementMarker((element) => hasAttributes(element, 'data-mesh-id'), '<main data-mesh-id="fixture"></main>')], 'Static markup contains a Wix-specific document attribute.', 'medium'),
             resourceEvidence(['static.parastorage.com', 'wixstatic.com'], 'A retained resource origin uses Wix delivery infrastructure.'),
         ],
     },
     {
         id: 'squarespace', name: 'Squarespace', category: 'site builder',
         requiresNonResourceEvidence: true,
+        allowEmbeddedOnly: true,
         evidence: [
             generatorEvidence(/^squarespace(?:\s|$)/i, 'Generator metadata identifies Squarespace.'),
-            htmlEvidence(['squarespace-context'], 'Static markup contains a Squarespace-specific document marker.', 'medium'),
-            resourceEvidence(['static.squarespace.com', 'static1.squarespace.com'], 'A retained resource origin uses Squarespace delivery infrastructure.'),
+            htmlEvidence([
+                resourceMarker((url) => url.hostname === 'assets.squarespace.com' && /^\/universal\/scripts-compressed\/[a-z0-9][a-z0-9.-]*\.js$/iu.test(url.pathname), 'https://assets.squarespace.com/universal/scripts-compressed/fixture.js'),
+            ], 'Static resource paths use Squarespace platform bundle conventions.', 'medium'),
         ],
     },
     {
         id: 'webflow', name: 'Webflow', category: 'site builder',
         evidence: [
             generatorEvidence(/^webflow(?:\s|$)/i, 'Generator metadata identifies Webflow.'),
-            htmlEvidence(['data-wf-page=', 'data-wf-site='], 'Static markup contains Webflow-specific document attributes.'),
+            htmlEvidence([
+                elementMarker((element) => hasAttributes(element, 'data-wf-page'), '<main data-wf-page="fixture"></main>'),
+                elementMarker((element) => hasAttributes(element, 'data-wf-site'), '<main data-wf-site="fixture"></main>'),
+            ], 'Static markup contains Webflow-specific document attributes.'),
         ],
     },
     {
@@ -330,7 +326,7 @@ const TECHNOLOGY_SIGNATURES = [
         requiresNonResourceEvidence: true,
         evidence: [
             generatorEvidence(/^framer(?:\s|$)/i, 'Generator metadata identifies Framer.'),
-            htmlEvidence(['data-framer-name='], 'Static markup contains Framer-specific component attributes.'),
+            htmlEvidence([elementMarker((element) => hasAttributes(element, 'data-framer-name'), '<main data-framer-name="fixture"></main>')], 'Static markup contains Framer-specific component attributes.'),
             resourceEvidence(['framerusercontent.com'], 'A retained resource origin uses Framer delivery infrastructure.'),
         ],
     },
@@ -338,42 +334,57 @@ const TECHNOLOGY_SIGNATURES = [
         id: 'weebly', name: 'Weebly', category: 'site builder',
         requiresNonResourceEvidence: true,
         evidence: [
-            htmlEvidence(['id="wsite-base-style"', "id='wsite-base-style'", 'title="wsite-theme-css"', "title='wsite-theme-css'"], 'Static markup contains Weebly-specific theme attributes.'),
+            htmlEvidence([elementMarker((element) => element.name === 'link' && (attributeValue(element, 'id') === 'wsite-base-style' || attributeValue(element, 'title') === 'wsite-theme-css'), '<link id="wsite-base-style" href="/fixture.css">')], 'Static markup contains Weebly-specific theme attributes.'),
             resourceEvidence(['editmysite.com'], 'A retained resource origin uses Weebly delivery infrastructure.'),
         ],
     },
     {
         id: 'angular', name: 'Angular', category: 'web framework',
-        evidence: [htmlEvidence([' ng-version='], 'Static markup contains Angular version metadata.')],
+        evidence: [htmlEvidence([elementMarker((element) => hasAttributes(element, 'ng-version'), '<main ng-version="fixture"></main>')], 'Static markup contains Angular version metadata.')],
     },
     {
         id: 'aspnet-web-forms', name: 'ASP.NET Web Forms', category: 'web framework',
-        evidence: [htmlEvidence([' name="__viewstate"', ' id="__viewstate"'], 'Static form markup contains the ASP.NET Web Forms view-state field.')],
+        evidence: [htmlEvidence([elementMarker((element) => element.name === 'input' && (attributeValue(element, 'name') === '__viewstate' || attributeValue(element, 'id') === '__viewstate'), '<input name="__VIEWSTATE">')], 'Static form markup contains the ASP.NET Web Forms view-state field.')],
     },
     {
         id: 'nextjs', name: 'Next.js', category: 'web framework',
-        evidence: [htmlEvidence(['id="__next_data__"', "id='__next_data__'", '/_next/static/'], 'Static markup contains Next.js bootstrap or asset markers.')],
+        evidence: [htmlEvidence([
+                elementMarker((element) => element.name === 'script' && attributeValue(element, 'id') === '__next_data__', '<script id="__NEXT_DATA__"></script>'),
+                resourceMarker((url) => /\/_next\/static\//iu.test(url.pathname), '/_next/static/fixture.js'),
+            ], 'Static markup contains Next.js bootstrap or asset markers.')],
     },
     {
         id: 'nuxt', name: 'Nuxt', category: 'web framework',
-        evidence: [htmlEvidence(['id="__nuxt"', "id='__nuxt'", '/_nuxt/'], 'Static markup contains Nuxt bootstrap or asset markers.')],
+        evidence: [htmlEvidence([
+                elementMarker((element) => attributeValue(element, 'id') === '__nuxt', '<main id="__nuxt"></main>'),
+                resourceMarker((url) => /\/_nuxt\//iu.test(url.pathname), '/_nuxt/fixture.js'),
+            ], 'Static markup contains Nuxt bootstrap or asset markers.')],
     },
     {
         id: 'gatsby', name: 'Gatsby', category: 'web framework',
-        evidence: [htmlEvidence(['id="___gatsby"', "id='___gatsby'", '/page-data/app-data.json'], 'Static markup contains Gatsby bootstrap or page-data markers.')],
+        evidence: [htmlEvidence([
+                elementMarker((element) => attributeValue(element, 'id') === '___gatsby', '<main id="___gatsby"></main>'),
+                resourceMarker((url) => /\/page-data\/app-data\.json$/iu.test(url.pathname), '/page-data/app-data.json'),
+            ], 'Static markup contains Gatsby bootstrap or page-data markers.')],
     },
     {
         id: 'sveltekit', name: 'SvelteKit', category: 'web framework',
         evidence: [
-            htmlEvidence(['data-sveltekit-preload-data=', 'data-sveltekit-reload='], 'Static markup contains SvelteKit-specific navigation attributes.'),
-            htmlEvidence(['href="/_app/immutable/', 'src="/_app/immutable/'], 'Static asset paths use SvelteKit build conventions.', 'medium'),
+            htmlEvidence([
+                elementMarker((element) => hasAttributes(element, 'data-sveltekit-preload-data'), '<a data-sveltekit-preload-data="hover"></a>'),
+                elementMarker((element) => hasAttributes(element, 'data-sveltekit-reload'), '<a data-sveltekit-reload></a>'),
+            ], 'Static markup contains SvelteKit-specific navigation attributes.'),
+            htmlEvidence([resourceMarker((url) => /\/_app\/immutable\//iu.test(url.pathname), '/_app/immutable/fixture.css')], 'Static asset paths use SvelteKit build conventions.', 'medium'),
         ],
     },
     {
         id: 'astro', name: 'Astro', category: 'web framework',
         evidence: [
-            htmlEvidence(['<astro-island', '<astro-slot'], 'Static markup contains Astro component-island elements.'),
-            htmlEvidence(['href="/_astro/', 'src="/_astro/'], 'Static asset paths use Astro build conventions.', 'medium'),
+            htmlEvidence([
+                elementMarker((element) => element.name === 'astro-island', '<astro-island></astro-island>'),
+                elementMarker((element) => element.name === 'astro-slot', '<astro-slot></astro-slot>'),
+            ], 'Static markup contains Astro component-island elements.'),
+            htmlEvidence([resourceMarker((url) => /\/_astro\//iu.test(url.pathname), '/_astro/fixture.css')], 'Static asset paths use Astro build conventions.', 'medium'),
         ],
     },
     {
@@ -461,28 +472,57 @@ const TECHNOLOGY_SIGNATURE_CATALOGUE = Object.freeze(TECHNOLOGY_SIGNATURES.map((
         confidence: evidence.confidence,
     }))),
 })));
-function analyzeWebsiteTechnology(input = {}) {
+function technologyHtmlAnalysis(input) {
+    return input.htmlAnalysis ?? analyzeStaticHtml(input.html, {
+        ...(typeof input.documentOrigin === 'string' ? { baseUrl: input.documentOrigin } : {}),
+    });
+}
+// These are fixed semantic reconstructions, not copies of observed markup.
+// Keeping them beside the predicates removes a second keyword catalogue from
+// the contribution tools. Independent structural fixtures test the predicates.
+function minimiseTechnologyMarkup(input) {
+    const analysis = technologyHtmlAnalysis(input);
+    if (analysis.inputLimitReached || analysis.tagLimitReached) {
+        throw new TypeError('Technology review markup exceeded the complete structural-analysis boundary.');
+    }
+    const context = createTechnologyMarkupContext(analysis, input.effectiveBaseUrl, input.documentOrigin);
+    const fragments = TECHNOLOGY_SIGNATURES.flatMap((signature) => signature.evidence.flatMap((evidence) => ((evidence.markupRules ?? []).flatMap((rule) => rule.matches(context)
+        ? [rule.embedded?.(context) ? rule.embeddedReviewMarkup : rule.reviewMarkup]
+        : []))));
+    return [...new Set(fragments)].join('');
+}
+function reconstructTechnologyHtmlEvidence(id, description, role) {
+    const rules = TECHNOLOGY_SIGNATURES.find((signature) => signature.id === id)?.evidence
+        .find((evidence) => evidence.source === 'static HTML' && evidence.description === description)?.markupRules;
+    const markup = role === 'embedded_dependency'
+        ? rules?.find((rule) => rule.embeddedReviewMarkup)?.embeddedReviewMarkup
+        : rules?.[0]?.reviewMarkup;
+    if (!markup)
+        throw new TypeError('The retained static clue has no current structural reconstruction.');
+    return markup;
+}
+async function analyzeWebsiteTechnology(input = {}) {
+    input.signal?.throwIfAborted();
     // Existing direct callers pass minimised, already-derived page evidence rather
     // than the page body. The real collector declares false for header-only
     // responses, while an explicit malformed declaration also fails closed.
     const htmlAvailable = input.htmlAvailable === undefined
         ? true
         : input.htmlAvailable === true;
-    const htmlAnalysis = input.htmlAnalysis ?? analyzeStaticHtml(input.html);
-    const browserLibraryProfile = htmlAvailable ? analyzeBrowserLibraries({
+    const htmlAnalysis = htmlAvailable ? technologyHtmlAnalysis(input) : analyzeStaticHtml('');
+    const browserLibraryProfile = htmlAvailable ? await analyzeBrowserLibraries({
         htmlAnalysis,
         observedAt: input.observedAt,
         sourceTruncated: input.sourceTruncated,
+        ...(input.signal ? { signal: input.signal } : {}),
     }) : null;
     const context = {
-        html: htmlAnalysis.markup,
-        applicationHtml: '',
-        generator: boundedLowercase(input.generator, MAX_GENERATOR_INPUT),
+        ...createTechnologyMarkupContext(htmlAnalysis, input.effectiveBaseUrl, input.documentOrigin),
+        generator: htmlAvailable ? boundedLowercase(input.generator, MAX_GENERATOR_INPUT) : '',
         httpServer: boundedLowercase(input.httpServer, MAX_SERVER_INPUT),
-        resourceHosts: normalizedResourceHosts(input.resourceOrigins),
+        resourceHosts: htmlAvailable ? normalizedResourceHosts(input.resourceOrigins) : new Set(),
         responseHeaders: normalizedResponseHeaders(input.responseHeaders),
     };
-    context.applicationHtml = applicationMarkup(context.html, context.resourceHosts, input.effectiveBaseUrl, input.documentOrigin);
     const findings = [];
     for (const signature of TECHNOLOGY_SIGNATURES) {
         const matched = signature.evidence
@@ -534,7 +574,7 @@ function analyzeWebsiteTechnology(input = {}) {
     if (htmlAnalysis.inputLimitReached)
         limitations.push(`Only the first ${MAX_TECHNOLOGY_HTML_CHARS} HTML characters were evaluated.`);
     if (htmlAnalysis.tagLimitReached)
-        limitations.push(`Technology matching reached the ${MAX_TECHNOLOGY_TAGS}-tag or ${MAX_TECHNOLOGY_TAG_LENGTH}-character tag boundary.`);
+        limitations.push('Static HTML construction or attribute projection reached a bound; later technology indicators may be missing.');
     if (findingLimitReached)
         limitations.push(`Only the first ${MAX_TECHNOLOGY_FINDINGS} technology findings were retained.`);
     return {
@@ -561,4 +601,4 @@ function analyzeWebsiteTechnology(input = {}) {
         browserLibraryProfile,
     };
 }
-export { MAX_EVIDENCE_PER_TECHNOLOGY, MAX_TECHNOLOGY_EVIDENCE_DESCRIPTION_LENGTH, MAX_TECHNOLOGY_FINDINGS, MAX_TECHNOLOGY_HTML_CHARS, MAX_TECHNOLOGY_TAGS, PASSIVE_TECHNOLOGY_HEADER_NAMES, TECHNOLOGY_CATEGORIES, TECHNOLOGY_EVIDENCE_SOURCES, TECHNOLOGY_PROFILE_VERSION, TECHNOLOGY_SIGNATURE_CATALOGUE, analyzeWebsiteTechnology, captureTechnologyResponseHeaders, };
+export { MAX_EVIDENCE_PER_TECHNOLOGY, MAX_TECHNOLOGY_EVIDENCE_DESCRIPTION_LENGTH, MAX_TECHNOLOGY_FINDINGS, MAX_TECHNOLOGY_HTML_CHARS, MAX_TECHNOLOGY_TAGS, PASSIVE_TECHNOLOGY_HEADER_NAMES, TECHNOLOGY_CATEGORIES, TECHNOLOGY_EVIDENCE_SOURCES, TECHNOLOGY_PROFILE_VERSION, TECHNOLOGY_SIGNATURE_CATALOGUE, analyzeWebsiteTechnology, captureTechnologyResponseHeaders, minimiseTechnologyMarkup, reconstructTechnologyHtmlEvidence, };

package/lib/whois-authority.mjs

@@ -29,7 +29,10 @@ const LINE_NOT_FOUND_PATTERNS = Object.freeze([
 const NZ_NOT_FOUND_RE = /^[ \t]*query_status[ \t]*:[ \t]*220(?:\s|$)/im;
 const NZ_POSITIVE_RE = /^[ \t]*query_status[ \t]*:[ \t]*(?:200|210)(?:\s|$)/im;
 const NZ_TEMPORARY_FAILURE_RE = /^[ \t]*query_status[ \t]*:[ \t]*4\d{2}(?:\s|$)/im;
-const RATE_LIMIT_LINE_RE = /^[ \t]*(?:[%#*;>-]+[ \t]*)?(?:(?:error|status)[ \t:.-]+)?(?:whois[ \t]+limit[ \t]+exceeded|query[ \t]+(?:rate[ \t-]*)?limit[ \t]+exceeded|(?:request|query)[ \t]+limit[ \t]+(?:exceeded|reached)|rate[ \t-]*limit(?:[ \t]+exceeded)?|too[ \t]+many[ \t]+(?:requests|queries)|quota[ \t]+exceeded|number[ \t]+of[^\r\n]{0,120}[ \t]+exceeded|(?:requests?|queries?)[ \t]+(?:are[ \t]+)?throttled|throttled|(?:service[ \t]+)?temporarily[ \t]+unavailable|(?:please[ \t]+)?try[ \t]+again[ \t]+later|please[ \t]+wait)\b[^\r\n]{0,240}$/im;
+// A refusal describes this response; a footer describing permitted query
+// frequency does not. Keep explicit refusals ahead of echoed domain fields.
+const RATE_LIMIT_LINE_RE = /^[ \t]*(?:[%#*;>-]+[ \t]*)?(?:(?:error|status)[ \t:.-]+)?(?:whois[ \t]+limit[ \t]+exceeded|query[ \t]+(?:rate[ \t-]*)?limit[ \t]+exceeded|(?:request|query)[ \t]+limit[ \t]+(?:exceeded|reached)|rate[ \t-]*limit(?:ed|[ \t]+(?:exceeded|reached))|too[ \t]+many[ \t]+(?:requests|queries)|quota[ \t]+exceeded|number[ \t]+of[^\r\n]{0,120}[ \t]+exceeded|(?:requests?|queries?)[ \t]+(?:are[ \t]+)?throttled|throttled|(?:service[ \t]+)?temporarily[ \t]+unavailable)\b[^\r\n]{0,240}$/im;
+const RETRY_LINE_RE = /^[ \t]*(?:[%#*;>-]+[ \t]*)?(?:(?:error|status)[ \t:.-]+)?(?:rate[ \t-]*limit|(?:please[ \t]+)?try[ \t]+again[ \t]+later|please[ \t]+wait(?:[ \t]+\d{1,6}[ \t]+(?:seconds?|minutes?|hours?))?(?:[ \t]+(?:and[ \t]+)?(?:retry|try[ \t]+again)(?:[ \t]+later)?)?)[.!]?[ \t]*$/im;
 const POSITIVE_REGISTRATION_RE = /^[ \t*]*(?:Domain(?:[ \t]+Name)?|domainname|Registrar|Registrar WHOIS Server|Creation Date|Created(?: On)?|Registry Expiry Date|Registered(?: On)?|Name Server|nserver|Sponsoring Registrar)[ \t.]*:[ \t]*\S/im;
 const POSITIVE_BRACKET_RE = /\[(?:Domain Name|Registrant|Name Server)\][ \t]*\S/i;
 function hasSectionedRegistrationEvidence(text) {
@@ -53,7 +56,7 @@ function classifyHopEvidence(hop, index) {
     const text = hop.response || '';
     if (!text.trim())
         return 'inconclusive';
-    if (RATE_LIMIT_LINE_RE.test(text))
+    if (RATE_LIMIT_LINE_RE.test(text) || RETRY_LINE_RE.test(text))
         return 'rate_limited';
     if (NZ_TEMPORARY_FAILURE_RE.test(text))
         return 'rate_limited';
@@ -131,3 +134,12 @@ export function analyzeWhoisChainAuthority(chain) {
             : 'partial',
     };
 }
+/** Collection status shared by final and incremental Lookup presentation. */
+export function whoisCollectionStatus(chain) {
+    const source = normalizeWhoisChain(chain);
+    if (!source.length || source[0]?.error)
+        return 'error';
+    if (source.length === 1)
+        return 'unsupported';
+    return analyzeWhoisChainAuthority(source).chainStatus;
+}

package/lib/whois-chain.mjs

@@ -3,12 +3,12 @@
 // bounded referrals.
 import { domainToUnicode } from 'node:url';
 import { cached } from "./lookup-cache.mjs";
+import { MAX_WHOIS_QUERY_HOPS } from "./whois-contracts.mjs";
 import { registryCapabilityFor, registryServiceAdmissionFor, } from "./registry-capabilities.mjs";
 import { whoisQuery } from "./whois-transport.mjs";
 const IANA_WHOIS = 'whois.iana.org';
 const WHOIS_HOP_DEADLINE_MS = 12_000;
 const WHOIS_CHAIN_DEADLINE_MS = 25_000;
-const MAX_WHOIS_QUERY_HOPS = 6;
 function incompleteReferralHop(server, reason) {
     return {
         server,
@@ -58,6 +58,7 @@ function extractReferral(whoisText) {
     return null;
 }
 export async function buildWhoisChainUncached(query, options = {}) {
+    options.signal?.throwIfAborted();
     const admission = registryServiceAdmissionFor(query, 'whois');
     if (admission && !admission.allowed) {
         return [{
@@ -77,6 +78,7 @@ export async function buildWhoisChainUncached(query, options = {}) {
     let currentServer = IANA_WHOIS;
     const startedAt = now();
     for (let hop = 0; hop < MAX_WHOIS_QUERY_HOPS; hop += 1) {
+        options.signal?.throwIfAborted();
         if (visited.has(currentServer.toLowerCase())) {
             chain.push(incompleteReferralHop(currentServer, 'referral_loop'));
             break;
@@ -101,12 +103,15 @@ export async function buildWhoisChainUncached(query, options = {}) {
             responseText = await queryWhois(currentServer, transport.query, {
                 timeoutMs: Math.min(10_000, remainingMs),
                 totalDeadlineMs: Math.min(WHOIS_HOP_DEADLINE_MS, remainingMs),
+                ...(options.signal ? { signal: options.signal } : {}),
                 onAddressSelected: (selected) => {
                     address = selected;
                 },
             });
+            options.signal?.throwIfAborted();
         }
         catch (cause) {
+            options.signal?.throwIfAborted();
             chain.push({
                 server: currentServer,
                 queriedAt,
@@ -140,6 +145,8 @@ export async function buildWhoisChainUncached(query, options = {}) {
     }
     return chain;
 }
-export async function buildWhoisChain(query) {
+export async function buildWhoisChain(query, options = {}) {
+    if (options.signal)
+        return buildWhoisChainUncached(query, options);
     return cached(`whois:${query.toLowerCase()}`, () => buildWhoisChainUncached(query));
 }

package/lib/whois-common-formats.mjs

@@ -176,7 +176,7 @@ function applyWhoisCommonFormats(text, isRootHop, dialects, context) {
         }) === 'capped')
             break;
     }
-    for (const m of text.matchAll(/\[Name Server\][ \t]*([a-zA-Z0-9.\-]+)/gi)) {
+    for (const m of text.matchAll(/\[Name Server\][ \t]*([^\s]+)/gi)) {
         if (addBoundedWhoisSetValue(nameservers, m[1], {
             maxEntries: MAX_WHOIS_NAMESERVERS, maxLength: 253,
             field: 'nameservers', truncatedFields,
@@ -188,16 +188,16 @@ function applyWhoisCommonFormats(text, isRootHop, dialects, context) {
     // on every hop; "nserver:"/"Host Name:"/"DNS:" are real per-domain
     // labels on some registries (e.g. .ru, .kr, .mx) but only once we're
     // past the root hop, for the same reason as the field patterns above.
-    const nsLinePatterns = [/^[ \t*]*Name Server[ \t.]*:[ \t]*([a-zA-Z0-9.\-]+)/gim];
+    const nsLinePatterns = [/^[ \t*]*Name Server[ \t.]*:[ \t]*([^\s]+)/gim];
     if (!isRootHop) {
-        nsLinePatterns.push(/^[ \t*]*nserver[ \t.]*:[ \t]*([a-zA-Z0-9.\-]+)/gim, /^[ \t*]*Nameserver[ \t.]*:[ \t]*([a-zA-Z0-9.\-]+)/gim, /^[ \t*]*Host Name[ \t.]*:[ \t]*([a-zA-Z0-9.\-]+)/gim, /^[ \t]*ns_name_\d{2}[ \t]*:[ \t]*([a-zA-Z0-9.\-]+)/gim);
+        nsLinePatterns.push(/^[ \t*]*nserver[ \t.]*:[ \t]*([^\s]+)/gim, /^[ \t*]*Nameserver[ \t.]*:[ \t]*([^\s]+)/gim, /^[ \t*]*Host Name[ \t.]*:[ \t]*([^\s]+)/gim, /^[ \t]*ns_name_\d{2}[ \t]*:[ \t]*([^\s]+)/gim);
         // Punktum dk uses `DNS: example.dk` for the queried domain, then
         // `Hostname:` inside its nameserver section. Other supported
         // registries use `DNS:` for an actual nameserver, so switch aliases
         // only when the full .dk marker set is present.
         nsLinePatterns.push(isPunktum
-            ? /^[ \t*]*Hostname[ \t.]*:[ \t]*([a-zA-Z0-9.\-]+)/gim
-            : /^[ \t*]*DNS[ \t.]*:[ \t]*([a-zA-Z0-9.\-]+)/gim);
+            ? /^[ \t*]*Hostname[ \t.]*:[ \t]*([^\s]+)/gim
+            : /^[ \t*]*DNS[ \t.]*:[ \t]*([^\s]+)/gim);
     }
     for (const re of nsLinePatterns) {
         for (const m of text.matchAll(re)) {

package/lib/whois-contracts.mjs

@@ -1,3 +1,4 @@
 // Stable normalized WHOIS contracts. Parsing and transport remain separate so
 // consumers can depend on the record shape without importing network code.
-export {};
+export const MAX_WHOIS_STATUSES = 100;
+export const MAX_WHOIS_QUERY_HOPS = 6;

package/lib/whois-dialects.mjs

@@ -263,8 +263,8 @@ function applyWhoisDialects(text, isRootHop, context) {
             assignBoundedWhoisMatch(text, fields, 'updatedDate', /^[ \t]*Last modified[ \t.]*:[ \t]*(.+)$/im, truncatedFields);
             assignBoundedWhoisMatch(text, fields, 'registrar', /^[ \t]*Current Registar[ \t]*:[ \t]*(.+)$/im, truncatedFields);
             for (const pattern of [
-                /^[ \t]*Primary server[ \t.]*:[ \t]*([a-zA-Z0-9.-]+)/gim,
-                /^[ \t]*Secondary server[ \t.]*:[ \t]*([a-zA-Z0-9.-]+)/gim,
+                /^[ \t]*Primary server[ \t.]*:[ \t]*([^\s]+)/gim,
+                /^[ \t]*Secondary server[ \t.]*:[ \t]*([^\s]+)/gim,
             ]) {
                 for (const match of text.matchAll(pattern)) {
                     const result = addBoundedWhoisSetValue(nameservers, match[1], {

package/lib/whois-parser-support.mjs

@@ -1,7 +1,7 @@
 // Bounded primitives and generic field patterns shared by the WHOIS parser.
 import { boundedWhoisValue, whoisFieldLimit, } from "./whois-values.mjs";
+import { MAX_WHOIS_STATUSES } from "./whois-contracts.mjs";
 const MAX_WHOIS_NAMESERVERS = 200;
-const MAX_WHOIS_STATUSES = 100;
 const WHOIS_DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
 // ---------------------------------------------------------------------------
 // WHOIS response parsing (merges the referral chain into readable fields)
@@ -21,6 +21,13 @@ function assignBoundedWhoisMatch(text, fields, key, pattern, truncatedFields) {
 }
 function addBoundedWhoisSetValue(set, rawValue, { maxEntries, maxLength, field, truncatedFields, }) {
     const bounded = boundedWhoisValue(rawValue, maxLength);
+    if (bounded.truncated)
+        truncatedFields.add(field);
+    if (field === 'nameservers' && (bounded.truncated || !bounded.value
+        || !WHOIS_DOMAIN_RE.test(bounded.value.replace(/\.$/u, '')))) {
+        truncatedFields.add(field);
+        return 'ignored';
+    }
     if (!bounded.value || set.has(bounded.value))
         return 'ignored';
     if (set.size >= maxEntries) {

package/lib/whois-transport.mjs

@@ -16,38 +16,45 @@ function errorMessage(value, fallback) {
 // A referral hostname is upstream-controlled, so resolve and validate its
 // addresses before connecting. Connect to the selected address directly to
 // prevent a second DNS lookup from bypassing the public-address decision.
-function queryWhoisAddress(address, server, query, { port = 43, timeoutMs = 10000, totalDeadlineMs = WHOIS_HOP_DEADLINE_MS, createConnection = net.createConnection, } = {}) {
+function queryWhoisAddress(address, server, query, { port = 43, timeoutMs = 10000, totalDeadlineMs = WHOIS_HOP_DEADLINE_MS, createConnection = net.createConnection, signal, } = {}) {
     return new Promise((resolve, reject) => {
+        signal?.throwIfAborted();
         const socket = createConnection({ host: address, port }, () => {
-            socket.write(query + '\r\n');
+            if (!signal?.aborted)
+                socket.write(query + '\r\n');
         });
         const chunks = [];
         let totalBytes = 0;
         let settled = false;
         const deadline = setTimeout(() => {
-            settled = true;
+            settle(reject, new Error(`WHOIS request to ${server} exceeded the total time limit`));
             socket.destroy();
-            reject(new Error(`WHOIS request to ${server} exceeded the total time limit`));
         }, totalDeadlineMs);
         function settle(fn, value) {
             if (settled)
                 return;
             settled = true;
             clearTimeout(deadline);
+            signal?.removeEventListener('abort', abort);
             fn(value);
         }
+        const abort = () => { settle(reject, signal.reason); socket.destroy(); };
         socket.setTimeout(Math.min(timeoutMs, totalDeadlineMs));
         socket.on('data', (chunk) => {
+            if (settled)
+                return;
             const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
             totalBytes += buffer.length;
             if (totalBytes > MAX_WHOIS_BYTES) {
-                socket.destroy();
                 settle(reject, new Error(`WHOIS response from ${server} exceeded ${MAX_WHOIS_BYTES} bytes`));
+                socket.destroy();
                 return;
             }
             chunks.push(buffer);
         });
         const settleResponse = () => {
+            if (settled)
+                return;
             try {
                 const responseText = new TextDecoder('utf-8', { fatal: true })
                     .decode(Buffer.concat(chunks, totalBytes));
@@ -60,13 +67,17 @@ function queryWhoisAddress(address, server, query, { port = 43, timeoutMs = 1000
         socket.on('end', settleResponse);
         socket.on('close', settleResponse);
         socket.on('timeout', () => {
-            socket.destroy();
             settle(reject, new Error(`WHOIS request to ${server} timed out`));
+            socket.destroy();
         });
         socket.on('error', (error) => settle(reject, error));
+        signal?.addEventListener('abort', abort, { once: true });
+        if (signal?.aborted)
+            abort();
     });
 }
-async function whoisQuery(server, query, { port = 43, timeoutMs = 10000, totalDeadlineMs = WHOIS_HOP_DEADLINE_MS, resolveAddresses = resolvePublicAddresses, queryAddress = queryWhoisAddress, now = Date.now, onAddressSelected = (_address) => { }, } = {}) {
+async function whoisQuery(server, query, { port = 43, timeoutMs = 10000, totalDeadlineMs = WHOIS_HOP_DEADLINE_MS, resolveAddresses = resolvePublicAddresses, queryAddress = queryWhoisAddress, now = Date.now, onAddressSelected = (_address) => { }, signal, } = {}) {
+    signal?.throwIfAborted();
     const startedAt = now();
     let resolutionTimer;
     const records = await Promise.race([
@@ -75,10 +86,12 @@ async function whoisQuery(server, query, { port = 43, timeoutMs = 10000, totalDe
             resolutionTimer = setTimeout(() => reject(new Error(`WHOIS request to ${server} timed out during DNS resolution`)), totalDeadlineMs);
         }),
     ]).finally(() => clearTimeout(resolutionTimer));
+    signal?.throwIfAborted();
     const candidates = records.slice(0, MAX_WHOIS_ADDRESSES);
     const failures = [];
     let attempts = 0;
     for (const { address } of candidates) {
+        signal?.throwIfAborted();
         const remainingMs = totalDeadlineMs - (now() - startedAt);
         if (remainingMs <= 0)
             break;
@@ -88,7 +101,9 @@ async function whoisQuery(server, query, { port = 43, timeoutMs = 10000, totalDe
                 port,
                 timeoutMs: Math.min(timeoutMs, remainingMs),
                 totalDeadlineMs: remainingMs,
+                ...(signal ? { signal } : {}),
             });
+            signal?.throwIfAborted();
             try {
                 onAddressSelected(address);
             }
@@ -98,6 +113,7 @@ async function whoisQuery(server, query, { port = 43, timeoutMs = 10000, totalDe
             return response;
         }
         catch (error) {
+            signal?.throwIfAborted();
             failures.push(errorMessage(error, 'connection failed').slice(0, 200));
         }
     }