@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/lib/browser-library-profile.mjs

@@ -5,13 +5,15 @@
 // are treated as untrusted inputs and are not retained in the result.
 import { createHash } from 'node:crypto';
 import { Worker } from 'node:worker_threads';
+import { createInlineLibraryScanner } from "./browser-library-worker.mjs";
 import { RETIRE_BROWSER_CATALOG } from "./generated/retire-browser-catalog.mjs";
 import { CISA_KEV_CATALOG } from "./generated/cisa-kev-catalog.mjs";
-import { createObservation } from "../packages/evidence/observation.mjs";
+import { createObservation, normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
+import { isCveIdentifier } from "../packages/contracts/vulnerability-identifiers.mjs";
 import { BROWSER_LIBRARY_PROFILE_VERSION, MAX_LIBRARY_FINDINGS, } from "./lookup-child-profile-contract.mjs";
-import { MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_STATIC_HTML_CHARS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
+import { MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_SCRIPT_REFERENCE_LENGTH, MAX_STATIC_HTML_CHARS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 // Catalogue expressions are reviewed third-party inputs. Keep every individual
-// regular-expression evaluation and the aggregate inline-signature work small
+// regular-expression evaluation and aggregate reference/inline-signature work small
 // enough that a target-controlled script cannot monopolise the Node event loop.
 // Full-content hashes still use the complete already-capped script body.
 const MAX_INLINE_LIBRARY_SCAN_CHARS = 1_024;
@@ -21,11 +23,9 @@ const MAX_INLINE_LIBRARY_WORKER_BYTES = 64 * 1024;
 const MAX_LIBRARY_HTML_CHARS = MAX_STATIC_HTML_CHARS;
 const MAX_ADVISORY_IDENTIFIERS = 16;
 const MAX_WEAKNESS_CLASSES = 12;
-const MAX_MATCHES_PER_PATTERN = 4;
 const MAX_VERSION_LENGTH = 64;
 const COMPONENT_RE = /^[a-z0-9._-]{1,80}$/i;
 const VERSION_RE = /^[0-9][0-9.a-z_-]{0,63}$/i;
-const CVE_RE = /^CVE-[0-9X-]+$/;
 const GHSA_RE = /^GHSA-[A-Z0-9-]+$/;
 const CWE_RE = /^CWE-[0-9]+$/;
 const SEVERITY_WEIGHT = Object.freeze({
@@ -37,38 +37,64 @@ const SEVERITY_WEIGHT = Object.freeze({
 });
 const CATALOG_COMPONENTS = RETIRE_BROWSER_CATALOG.components;
 const KNOWN_EXPLOITED_IDENTIFIERS = new Set(CISA_KEV_CATALOG.identifiers);
-const INLINE_EXTRACTOR_CATALOGUE = Object.freeze(Object.entries(CATALOG_COMPONENTS).map(([component, value]) => {
+const KNOWN_EXPLOITED_RELEASED_AT = normalizeExplicitIsoTimestamp(CISA_KEV_CATALOG.releasedAt);
+if (KNOWN_EXPLOITED_RELEASED_AT === null)
+    throw new Error('Pinned known-exploited catalogue has an invalid release timestamp.');
+const PATTERN_EXTRACTOR_CATALOGUE = Object.freeze(Object.entries(CATALOG_COMPONENTS).map(([component, value]) => {
     const extractors = record(record(value).extractors);
+    const patterns = (name) => Object.freeze((Array.isArray(extractors[name]) ? extractors[name] : [])
+        .filter((pattern) => typeof pattern === 'string' && pattern.length > 0 && pattern.length <= 2_048)
+        .slice(0, 64));
     return Object.freeze({
         component,
-        patterns: Object.freeze((Array.isArray(extractors.filecontent) ? extractors.filecontent : [])
-            .filter((pattern) => typeof pattern === 'string' && pattern.length > 0 && pattern.length <= 2_048)
-            .slice(0, 64)),
-        replacements: Object.freeze((Array.isArray(extractors.filecontentreplace) ? extractors.filecontentreplace : [])
-            .filter((pattern) => typeof pattern === 'string' && pattern.length > 0 && pattern.length <= 2_048)
-            .slice(0, 64)),
+        uri: patterns('uri'), filename: patterns('filename'),
+        patterns: patterns('filecontent'), replacements: patterns('filecontentreplace'),
     });
 }));
-const INLINE_REGEX_WORKER_SOURCE = String.raw `
+const LIBRARY_REGEX_WORKER_SOURCE = String.raw `
 const { parentPort, workerData } = require('node:worker_threads');
 const versions = /^[0-9][0-9.a-z_-]{0,63}$/i;
 parentPort.on('message', (job) => {
   const control = new Int32Array(job.control);
   const output = new Uint8Array(job.output);
-  const matches = [];
-  const add = (component, version) => {
+  const matches = new Map();
+  const add = (component, version, method) => {
     const normalized = String(version).replace(/(?:\.|-)?min$/i, '').slice(0, 64);
-    if (versions.test(normalized) && matches.length < 64) matches.push([component, normalized]);
+    const key = component + '\u0000' + normalized;
+    if (!versions.test(normalized)) return;
+    if (!matches.has(key) && matches.size < 64) matches.set(key, [component, normalized, new Set()]);
+    matches.get(key)?.[2].add(method);
   };
   try {
+    const input = JSON.parse(job.value);
+    for (const reference of input.references) {
+      const filename = (reference.replace(/\\/g, '/').split('/').pop() || '').split(/[?#]/, 1)[0];
+      for (const entry of workerData.catalogue) {
+        for (const [patterns, value, method, anchored] of [
+          [entry.uri, reference, 'script URL', false],
+          [entry.filename, filename, 'script filename', true],
+        ]) {
+          if (!value) continue;
+          for (const pattern of patterns) {
+            let expression;
+            try { expression = new RegExp(anchored ? '^(?:' + pattern + ')$' : pattern, 'g'); } catch { continue; }
+            let match, count = 0;
+            while ((match = expression.exec(value)) && count < 4) {
+              if (typeof match[1] === 'string' && versions.test(match[1])) { add(entry.component, match[1], method); count += 1; }
+              if (match[0] === '') expression.lastIndex += 1;
+            }
+          }
+        }
+      }
+    }
     for (const entry of workerData.catalogue) {
       for (const pattern of entry.patterns) {
         let expression;
         try { expression = new RegExp(pattern, 'g'); } catch { continue; }
         let match;
         let count = 0;
-        while ((match = expression.exec(job.value)) && count < 4) {
-          if (typeof match[1] === 'string') add(entry.component, match[1]);
+        while ((match = expression.exec(input.inline)) && count < 4) {
+          if (typeof match[1] === 'string') add(entry.component, match[1], 'inline signature');
           if (match[0] === '') expression.lastIndex += 1;
           count += 1;
         }
@@ -80,25 +106,32 @@ parentPort.on('message', (job) => {
         try { expression = new RegExp(descriptor[1], 'g'); } catch { continue; }
         let match;
         let count = 0;
-        while ((match = expression.exec(job.value)) && count < 4) {
+        while ((match = expression.exec(input.inline)) && count < 4) {
           let replaced = match[0];
           try { replaced = match[0].replace(new RegExp(descriptor[1]), descriptor[2]); } catch { break; }
-          add(entry.component, replaced);
+          add(entry.component, replaced, 'inline signature');
           if (match[0] === '') expression.lastIndex += 1;
           count += 1;
         }
       }
     }
-    const encoded = Buffer.from(JSON.stringify(matches));
+    const encoded = Buffer.from(JSON.stringify([...matches.values()].flatMap(([component, version, methods]) => [...methods].map(method => [component, version, method]))));
     if (encoded.length > output.length) Atomics.store(control, 0, -2);
     else { output.set(encoded); Atomics.store(control, 0, encoded.length); }
   } catch {
     Atomics.store(control, 0, -1);
   }
-  Atomics.notify(control, 0);
+  parentPort.postMessage({ id: job.id });
 });
 `;
-let inlineRegexWorker = null;
+const scanLibraryPatterns = createInlineLibraryScanner(() => new Worker(LIBRARY_REGEX_WORKER_SOURCE, { eval: true, workerData: { catalogue: PATTERN_EXTRACTOR_CATALOGUE } }), {
+    // JSON can escape each admitted character to six characters; include separators and keys.
+    maximumCharacters: 6 * (MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS + MAX_SCRIPT_ELEMENTS * MAX_SCRIPT_REFERENCE_LENGTH) + MAX_SCRIPT_ELEMENTS * 10 + 128,
+    outputBytes: MAX_INLINE_LIBRARY_WORKER_BYTES,
+    deadlineMs: MAX_INLINE_LIBRARY_SCAN_MS,
+    // One worker/output buffer, with at most sixteen bounded pending inputs.
+    pending: 16,
+});
 function record(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -156,26 +189,6 @@ function matchingVulnerabilities(component, version) {
     }
     return matched;
 }
-function matchPattern(pattern, value) {
-    if (typeof pattern !== 'string' || pattern.length === 0 || pattern.length > 2_048)
-        return [];
-    let expression;
-    try {
-        expression = new RegExp(pattern, 'g');
-    }
-    catch {
-        return [];
-    }
-    const matches = [];
-    let match;
-    while ((match = expression.exec(value)) && matches.length < MAX_MATCHES_PER_PATTERN) {
-        if (typeof match[1] === 'string' && VERSION_RE.test(match[1]))
-            matches.push(match[1]);
-        if (match[0] === '')
-            expression.lastIndex += 1;
-    }
-    return matches;
-}
 function addDetected(detected, component, version, method) {
     const normalizedVersion = version.replace(/(?:\.|-)?min$/i, '').slice(0, MAX_VERSION_LENGTH);
     if (!COMPONENT_RE.test(component) || !VERSION_RE.test(normalizedVersion))
@@ -190,84 +203,24 @@ function addDetected(detected, component, version, method) {
         return;
     detected.set(key, { component, version: normalizedVersion, detections: new Set([method]) });
 }
-function scanExtractor(detected, extractorName, value, method) {
-    for (const [componentName, rawComponent] of Object.entries(CATALOG_COMPONENTS)) {
-        const component = record(rawComponent);
-        const extractors = record(component.extractors);
-        const patterns = Array.isArray(extractors[extractorName]) ? extractors[extractorName] : [];
-        for (const pattern of patterns.slice(0, 64)) {
-            for (const version of matchPattern(pattern, value))
-                addDetected(detected, componentName, version, method);
-        }
-    }
-}
-function scanFilename(detected, reference) {
-    const filename = (reference.replace(/\\/g, '/').split('/').pop() || '').split(/[?#]/, 1)[0];
-    if (!filename)
-        return;
-    for (const [componentName, rawComponent] of Object.entries(CATALOG_COMPONENTS)) {
-        const component = record(rawComponent);
-        const extractors = record(component.extractors);
-        const patterns = Array.isArray(extractors.filename) ? extractors.filename : [];
-        for (const pattern of patterns.slice(0, 64)) {
-            if (typeof pattern !== 'string' || pattern.length > 2_048)
-                continue;
-            for (const version of matchPattern(`^(?:${pattern})$`, filename)) {
-                addDetected(detected, componentName, version, 'script filename');
-            }
-        }
-    }
-}
-function scanInlineSignatures(detected, value) {
-    if (!value)
+async function scanSignatures(detected, value, references, signal) {
+    if (!value && !references.length)
         return { timedOut: false, unavailable: false };
-    const controlBuffer = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT);
-    const outputBuffer = new SharedArrayBuffer(MAX_INLINE_LIBRARY_WORKER_BYTES);
-    const control = new Int32Array(controlBuffer);
-    try {
-        if (!inlineRegexWorker) {
-            const createdWorker = new Worker(INLINE_REGEX_WORKER_SOURCE, {
-                eval: true,
-                workerData: { catalogue: INLINE_EXTRACTOR_CATALOGUE },
-            });
-            inlineRegexWorker = createdWorker;
-            createdWorker.unref();
-            createdWorker.once('exit', () => {
-                if (inlineRegexWorker === createdWorker)
-                    inlineRegexWorker = null;
-            });
-            createdWorker.once('error', () => {
-                if (inlineRegexWorker === createdWorker)
-                    inlineRegexWorker = null;
-            });
-        }
-        inlineRegexWorker.postMessage({ value, control: controlBuffer, output: outputBuffer });
-    }
-    catch {
-        void inlineRegexWorker?.terminate().catch(() => { });
-        inlineRegexWorker = null;
-        return { timedOut: false, unavailable: true };
-    }
-    const wait = Atomics.wait(control, 0, 0, MAX_INLINE_LIBRARY_SCAN_MS);
-    const length = Atomics.load(control, 0);
-    if (wait === 'timed-out') {
-        void inlineRegexWorker?.terminate().catch(() => { });
-        inlineRegexWorker = null;
-        return { timedOut: true, unavailable: false };
-    }
-    if (length < 1 || length > MAX_INLINE_LIBRARY_WORKER_BYTES) {
-        return { timedOut: false, unavailable: true };
-    }
+    const result = await scanLibraryPatterns(JSON.stringify({ inline: value, references }), signal);
+    signal?.throwIfAborted();
+    if (result.output === null)
+        return result;
     try {
-        const parsed = JSON.parse(Buffer.from(new Uint8Array(outputBuffer, 0, length)).toString('utf8'));
+        const parsed = JSON.parse(result.output);
         if (!Array.isArray(parsed))
             return { timedOut: false, unavailable: true };
-        for (const item of parsed.slice(0, MAX_LIBRARY_FINDINGS * 4)) {
-            if (!Array.isArray(item) || item.length !== 2)
+        for (const item of parsed.slice(0, MAX_LIBRARY_FINDINGS * 4 * 3)) {
+            if (!Array.isArray(item) || item.length !== 3)
                 continue;
-            const [component, version] = item;
-            if (typeof component === 'string' && typeof version === 'string') {
-                addDetected(detected, component, version, 'inline signature');
+            const [component, version, method] = item;
+            if (typeof component === 'string' && typeof version === 'string'
+                && (method === 'inline signature' || method === 'script URL' || method === 'script filename')) {
+                addDetected(detected, component, version, method);
             }
         }
         return { timedOut: false, unavailable: false };
@@ -311,13 +264,20 @@ function findingFromDetection(detected) {
     let highestSeverity = null;
     const identifiers = new Set();
     const weaknesses = new Set();
+    let omittedCveIdentifiers = 0;
     for (const vulnerability of vulnerabilities) {
         const candidateSeverity = severity(vulnerability.severity);
         if (candidateSeverity
             && (!highestSeverity || SEVERITY_WEIGHT[candidateSeverity] > SEVERITY_WEIGHT[highestSeverity]))
             highestSeverity = candidateSeverity;
         const vulnerabilityIdentifiers = record(vulnerability.identifiers);
-        for (const cve of boundedStringArray(vulnerabilityIdentifiers.CVE, 16, CVE_RE)) {
+        omittedCveIdentifiers += typeof vulnerability.omittedCveIdentifiers === 'number'
+            && Number.isSafeInteger(vulnerability.omittedCveIdentifiers) && vulnerability.omittedCveIdentifiers > 0
+            ? vulnerability.omittedCveIdentifiers : 0;
+        const suppliedCve = Array.isArray(vulnerabilityIdentifiers.CVE) ? vulnerabilityIdentifiers.CVE : [];
+        const validCve = suppliedCve.filter(isCveIdentifier);
+        omittedCveIdentifiers += suppliedCve.length - validCve.length;
+        for (const cve of validCve.slice(0, 16)) {
             if (identifiers.size < MAX_ADVISORY_IDENTIFIERS)
                 identifiers.add(cve);
         }
@@ -332,7 +292,7 @@ function findingFromDetection(detected) {
     }
     const advisoryIdentifiers = [...identifiers].sort();
     const knownExploitedIdentifiers = advisoryIdentifiers.filter((identifier) => KNOWN_EXPLOITED_IDENTIFIERS.has(identifier));
-    return {
+    const finding = {
         id: detected.component,
         name: detected.component,
         apparentVersion: detected.version,
@@ -344,8 +304,10 @@ function findingFromDetection(detected) {
         knownExploitedIdentifiers,
         weaknessClasses: [...weaknesses].sort(),
     };
+    return { finding, omittedCveIdentifiers };
 }
-function analyzeBrowserLibraries(input = {}) {
+async function analyzeBrowserLibraries(input = {}) {
+    input.signal?.throwIfAborted();
     const htmlAnalysis = input.htmlAnalysis ?? analyzeStaticHtml(input.html);
     const detected = new Map();
     let referencesExamined = 0;
@@ -353,11 +315,11 @@ function analyzeBrowserLibraries(input = {}) {
     let inlineSignatureCharactersExamined = 0;
     let inlineSignatureLimitReached = false;
     const inlineSignatureSamples = [];
+    const references = [];
     for (const script of htmlAnalysis.scripts) {
         if (script.reference) {
             referencesExamined += 1;
-            scanExtractor(detected, 'uri', script.reference, 'script URL');
-            scanFilename(detected, script.reference);
+            references.push(script.reference);
         }
         else if (script.inlineContent && script.mediaType !== 'application/ld+json') {
             inlineScriptsExamined += 1;
@@ -369,10 +331,12 @@ function analyzeBrowserLibraries(input = {}) {
                 inlineSignatureSamples.push(signatureScan.signatureContent);
         }
     }
-    const inlineSignatureResult = scanInlineSignatures(detected, inlineSignatureSamples.join('\u0000'));
+    const inlineSignatureResult = await scanSignatures(detected, inlineSignatureSamples.join('\u0000'), references, input.signal);
+    input.signal?.throwIfAborted();
     const inlineSignatureUnavailable = inlineSignatureResult.timedOut || inlineSignatureResult.unavailable;
-    const allFindings = [...detected.values()]
-        .map(findingFromDetection)
+    const projected = [...detected.values()].map(findingFromDetection);
+    const omittedCveIdentifiers = projected.reduce((total, entry) => total + entry.omittedCveIdentifiers, 0);
+    const allFindings = projected.map((entry) => entry.finding)
         .sort((left, right) => ((right.highestSeverity ? SEVERITY_WEIGHT[right.highestSeverity] : -1)
         - (left.highestSeverity ? SEVERITY_WEIGHT[left.highestSeverity] : -1)
         || right.advisoryCount - left.advisoryCount
@@ -386,7 +350,8 @@ function analyzeBrowserLibraries(input = {}) {
         || htmlAnalysis.inlineLimitReached
         || inlineSignatureLimitReached
         || inlineSignatureUnavailable
-        || findingLimitReached;
+        || findingLimitReached
+        || omittedCveIdentifiers > 0;
     const limitations = [
         'Library versions are inferred from passive static signatures and may be absent, transformed, or misleading.',
         'A catalogue advisory match identifies a component version associated with a published advisory; it does not establish reachability or exploitability.',
@@ -406,11 +371,13 @@ function analyzeBrowserLibraries(input = {}) {
     if (inlineSignatureLimitReached)
         limitations.push(`Passive library signature matching evaluated a deterministic ${MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS}-character cumulative sample across inline scripts; full-content hashes still used the complete bounded script content.`);
     if (inlineSignatureResult.timedOut)
-        limitations.push(`Passive library signature matching exceeded its ${MAX_INLINE_LIBRARY_SCAN_MS} ms isolated-worker deadline; hash evidence was still evaluated.`);
+        limitations.push(`Passive library URL, filename and inline signature matching exceeded its ${MAX_INLINE_LIBRARY_SCAN_MS} ms isolated-worker deadline; hash evidence was still evaluated.`);
     if (inlineSignatureResult.unavailable)
-        limitations.push('Passive library signature matching was unavailable in its isolated worker; hash evidence was still evaluated.');
+        limitations.push('Passive library URL, filename and inline signature matching was unavailable in its isolated worker; hash evidence was still evaluated.');
     if (findingLimitReached)
         limitations.push(`Only the first ${MAX_LIBRARY_FINDINGS} library findings were retained.`);
+    if (omittedCveIdentifiers)
+        limitations.push(`${omittedCveIdentifiers} supplied CVE identifier ${omittedCveIdentifiers === 1 ? 'entry was' : 'entries were'} omitted from matching catalogue advisories because of invalid syntax or a source limit. Advisory matches are still counted.`);
     return {
         profileVersion: BROWSER_LIBRARY_PROFILE_VERSION,
         catalog: {
@@ -421,7 +388,7 @@ function analyzeBrowserLibraries(input = {}) {
         knownExploitedCatalog: {
             name: 'CISA KEV',
             version: CISA_KEV_CATALOG.catalogVersion,
-            releasedAt: CISA_KEV_CATALOG.releasedAt,
+            releasedAt: KNOWN_EXPLOITED_RELEASED_AT,
         },
         ...createObservation({
             status: truncated ? 'partial' : 'success',
@@ -437,8 +404,10 @@ function analyzeBrowserLibraries(input = {}) {
                 inlineScriptsExamined,
                 inlineCharactersExamined: htmlAnalysis.inlineCharactersExamined,
                 inlineSignatureCharactersExamined,
-                inlineSignatureTimedOut: inlineSignatureResult.timedOut,
-                inlineSignatureUnavailable: inlineSignatureResult.unavailable,
+                inlineSignatureTimedOut: inlineSignatureSamples.length > 0 && inlineSignatureResult.timedOut,
+                inlineSignatureUnavailable: inlineSignatureSamples.length > 0 && inlineSignatureResult.unavailable,
+                referenceSignatureTimedOut: references.length > 0 && inlineSignatureResult.timedOut,
+                referenceSignatureUnavailable: references.length > 0 && inlineSignatureResult.unavailable,
                 catalogComponents: Object.keys(CATALOG_COMPONENTS).length,
                 findings: allFindings.length,
                 advisoryMatches: allFindings.reduce((sum, finding) => sum + finding.advisoryCount, 0),

package/lib/browser-library-worker.mjs

@@ -0,0 +1,112 @@
+/** One bounded matcher worker. Queue deadlines include waiting; cancellation never stops a different scan. */
+export function createInlineLibraryScanner(createWorker, limits) {
+    let worker = null;
+    let active = null;
+    let closing = false;
+    let nextId = 0;
+    const queue = [];
+    const pending = new Set();
+    function retireWorker() {
+        if (!worker)
+            return;
+        const retired = worker;
+        worker = null;
+        closing = true;
+        void Promise.resolve().then(() => retired.terminate()).catch(() => { }).finally(() => { closing = false; pump(); });
+    }
+    function pump() {
+        if (active || closing)
+            return;
+        const job = queue.shift();
+        if (!job) {
+            worker?.unref();
+            return;
+        }
+        active = job;
+        let current;
+        const control = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+        const output = new Uint8Array(new SharedArrayBuffer(limits.outputBytes));
+        const cleanup = job.cleanup;
+        const failed = () => settle(job, { timedOut: false, unavailable: true, output: null }, true);
+        const message = (value) => {
+            if (!value || typeof value !== 'object' || !('id' in value) || value.id !== job.id)
+                return;
+            const length = Atomics.load(control, 0);
+            if (length < 1 || length > output.byteLength) {
+                failed();
+                return;
+            }
+            settle(job, { timedOut: false, unavailable: false, output: Buffer.from(output.subarray(0, length)).toString('utf8') });
+        };
+        job.cleanup = () => {
+            cleanup();
+            current?.off('message', message);
+            current?.off('error', failed);
+            current?.off('exit', failed);
+        };
+        try {
+            if (!worker) {
+                const created = createWorker();
+                worker = created;
+                const idleStopped = () => { if (!active && worker === created)
+                    worker = null; };
+                created.on('error', idleStopped);
+                created.on('exit', idleStopped);
+            }
+            current = worker;
+            if (active !== job) {
+                retireWorker();
+                return;
+            }
+            current.ref();
+            current.on('message', message);
+            current.on('error', failed);
+            current.on('exit', failed);
+            current.postMessage({ id: job.id, value: job.value, control: control.buffer, output: output.buffer });
+        }
+        catch {
+            failed();
+        }
+    }
+    function settle(job, result, retire = false, aborted = false) {
+        if (!pending.delete(job))
+            return;
+        job.cleanup();
+        if (active === job) {
+            active = null;
+            if (retire)
+                retireWorker();
+        }
+        else {
+            const index = queue.indexOf(job);
+            if (index >= 0)
+                queue.splice(index, 1);
+        }
+        if (aborted)
+            job.reject(job.signal?.reason ?? new DOMException('Aborted', 'AbortError'));
+        else
+            job.resolve(result);
+        queueMicrotask(pump);
+    }
+    return function scan(value, signal) {
+        signal?.throwIfAborted();
+        if (!value)
+            return Promise.resolve({ timedOut: false, unavailable: false, output: '[]' });
+        if (value.length > limits.maximumCharacters || pending.size >= limits.pending) {
+            return Promise.resolve({ timedOut: false, unavailable: true, output: null });
+        }
+        return new Promise((resolve, reject) => {
+            const job = { id: ++nextId, value, ...(signal ? { signal } : {}), resolve, reject, cleanup: () => { } };
+            const timer = setTimeout(() => settle(job, { timedOut: true, unavailable: false, output: null }, true), limits.deadlineMs);
+            const abort = () => settle(job, { timedOut: false, unavailable: true, output: null }, true, true);
+            job.cleanup = () => { clearTimeout(timer); signal?.removeEventListener('abort', abort); };
+            pending.add(job);
+            queue.push(job);
+            signal?.addEventListener('abort', abort, { once: true });
+            if (signal?.aborted)
+                abort();
+            else
+                pump();
+        });
+    };
+}

package/lib/candidate-provenance-bounds.mjs

@@ -0,0 +1,2 @@
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/candidate-provenance-bounds.mjs";

package/lib/classify.mjs

@@ -16,7 +16,7 @@
 import { isIP } from 'node:net';
 import { domainToASCII } from 'node:url';
 import { parse } from 'tldts';
-import { canonicalRegistrableDomain } from "./registrable-domain.mjs";
+import { canonicalRegistrableDomain } from "../packages/analysis/registrable-domain.mjs";
 // A CR/LF here would let one query become multiple lines once it reaches
 // lib/whois.mts's raw `socket.write(query + '\r\n')` - a normal URL-encoded
 // query string (?q=example.com%0D%0AHELP) decodes back into literal control

package/lib/client-behavior-profile.mjs

@@ -1,5 +1,5 @@
 // Static client-side behaviour indicators derived from the existing bounded
-// HTML tokenizer pass. Scripts are never fetched or executed. Only fixed
+// HTML parse. Scripts are never fetched or executed. Only fixed
 // indicator identifiers, descriptions, evidence classes, and bounded counts
 // leave this module; script references and contents are discarded.
 import { createObservation } from "../packages/evidence/observation.mjs";
@@ -20,7 +20,6 @@ function patternCount(value, pattern) {
 }
 function analyzeClientBehavior(input = {}) {
     const htmlAnalysis = input.htmlAnalysis ?? analyzeStaticHtml(input.html);
-    const markup = htmlAnalysis.markup;
     const inlineScripts = htmlAnalysis.scripts
         .filter((script) => script.reference === null)
         .map((script) => script.inlineContent)
@@ -31,7 +30,8 @@ function analyzeClientBehavior(input = {}) {
             return;
         indicators.push({ id, label, evidenceClass, occurrences: boundedOccurrences(occurrences), explanation });
     }
-    add('inline_event_handlers', 'Inline event handlers', 'static_markup', patternCount(markup, /\son[a-z]{2,24}="/gu), 'Inline HTML event-handler attributes were observed.');
+    add('inline_event_handlers', 'Inline event handlers', 'static_markup', htmlAnalysis.elements.reduce((count, element) => count
+        + element.attributes.filter((attribute) => /^on[a-z]{2,24}$/u.test(attribute.name)).length, 0), 'Inline HTML event-handler attributes were observed.');
     add('client_navigation', 'Client-side navigation', 'inline_script', patternCount(inlineScripts, /\b(?:history\.(?:pushState|replaceState)|location\.(?:assign|replace)|window\.location)\b/gu), 'Inline script contains a client-side navigation API.');
     add('form_interception', 'Form interception', 'inline_script', patternCount(inlineScripts, /(?:addEventListener\s*\(\s*['"]submit['"]|\.onsubmit\s*=|preventDefault\s*\()/gu), 'Inline script contains a form-submission or default-action interception marker.');
     add('service_worker', 'Service worker registration', 'inline_script', patternCount(inlineScripts, /\bnavigator\.serviceWorker\.register\s*\(/gu), 'Inline script contains a service-worker registration call.');

package/lib/ct-query.mjs

@@ -1,27 +1,2 @@
-const MAX_CT_QUERY_LENGTH = 200;
-const CT_QUERY_ERROR_CODE = 'INVALID_CT_QUERY';
-const CT_QUERY_ERROR_MESSAGE = `Certificate Transparency query must be at most ${MAX_CT_QUERY_LENGTH} characters and contain no control or invisible formatting characters.`;
-const UNSAFE_QUERY_CHARACTER_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/u;
-class CtQueryError extends Error {
-    code = CT_QUERY_ERROR_CODE;
-    constructor() {
-        super(CT_QUERY_ERROR_MESSAGE);
-        this.name = 'CtQueryError';
-    }
-}
-function normalizeCtQuery(value) {
-    if (value === undefined || value === null)
-        return '';
-    if (typeof value !== 'string'
-        || value.length > MAX_CT_QUERY_LENGTH
-        || UNSAFE_QUERY_CHARACTER_RE.test(value)) {
-        throw new CtQueryError();
-    }
-    return value.trim();
-}
-function isCtQueryError(value) {
-    return value instanceof Error
-        && 'code' in value
-        && value.code === CT_QUERY_ERROR_CODE;
-}
-export { CT_QUERY_ERROR_CODE, CT_QUERY_ERROR_MESSAGE, CtQueryError, isCtQueryError, MAX_CT_QUERY_LENGTH, normalizeCtQuery, };
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/ct-query.mjs";

package/lib/ct-response-bounds.mjs

@@ -1,9 +1,2 @@
-// Shared response-contract bounds for certificate-log search. The collector
-// and browser normalizer import these values so a valid backend response is
-// not accidentally clipped by a stale client-side mirror.
-export const MAX_CT_RESPONSE_RESULTS = 500;
-export const MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH = 50;
-export const MAX_CT_RESPONSE_TIMESTAMP_LENGTH = 64;
-export const MAX_CT_RESPONSE_CERTIFICATE_GROUPS = 100;
-export const MAX_CT_RESPONSE_DOMAINS_PER_GROUP = 20;
-export const MAX_CT_RESPONSE_HOSTNAMES_PER_GROUP = 30;
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/ct-response-bounds.mjs";