@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/lib/bounded-contract-normalizers.mjs

@@ -62,6 +62,10 @@ export function requireRecord(value, label) {
         throw new TypeError(`${label} must be an object.`);
     return value;
 }
+/** Stable ordering for bounded record selection, independent of host collation. */
+export function compareCodeUnits(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
 export function requireBoundedString(value, label, maxLength) {
     const normalised = strictBoundedString(value, maxLength);
     if (!normalised) {

package/lib/bounded-json.mjs

@@ -1,330 +1,2 @@
-export const MAX_BOUNDED_JSON_DEPTH = 48;
-export const MAX_BOUNDED_JSON_KEYS = 50_000;
-export const MAX_BOUNDED_JSON_VALUES = 100_000;
-export const MAX_BOUNDED_JSON_CONTAINER_ITEMS = 10_000;
-export const UNSAFE_JSON_OBJECT_KEYS = Object.freeze(['__proto__']);
-/** Aggregate work allowed by a separately enforced UTF-8 byte budget. */
-export function boundedJsonLimitsForBytes(maximumBytes) {
-    if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1) {
-        throw new TypeError('The JSON byte budget must be a positive safe integer.');
-    }
-    // A member needs at least five bytes (comma, two quotes, colon, value).
-    // Values need at least two bytes each, apart from a scalar root or the last
-    // array item. These upper bounds do not depend on a model's current fields.
-    // Nesting and individual-container limits remain independently bounded.
-    return {
-        maximumKeys: Math.floor(maximumBytes / 5),
-        maximumValues: Math.ceil(maximumBytes / 2),
-        // Decoded text is a lower bound on its UTF-8 JSON representation. Checking
-        // it before stringify also prevents an oversized string allocation.
-        maximumStringCodeUnits: maximumBytes,
-    };
-}
-function syntaxError() {
-    throw new TypeError('Artefact input is not valid JSON.');
-}
-export function isSafeJsonObjectKey(value) {
-    return !UNSAFE_JSON_OBJECT_KEYS.includes(value);
-}
-export function assertBoundedJsonStructure(value, label = 'JSON value', limits = {}) {
-    const maximumDepth = limits.maximumDepth ?? MAX_BOUNDED_JSON_DEPTH;
-    const maximumKeys = limits.maximumKeys ?? MAX_BOUNDED_JSON_KEYS;
-    const maximumValues = limits.maximumValues ?? MAX_BOUNDED_JSON_VALUES;
-    const maximumContainerItems = limits.maximumContainerItems ?? MAX_BOUNDED_JSON_CONTAINER_ITEMS;
-    let keys = 0;
-    let values = 0;
-    let stringCodeUnits = 0;
-    const ancestors = new Set();
-    const text = (value) => {
-        stringCodeUnits += value.length;
-        if (limits.maximumStringCodeUnits !== undefined && stringCodeUnits > limits.maximumStringCodeUnits) {
-            throw new TypeError(`${label} exceeds the aggregate text limit.`);
-        }
-    };
-    const visit = (current, depth) => {
-        values += 1;
-        if (values > maximumValues) {
-            throw new TypeError(`${label} exceeds the ${maximumValues}-value limit.`);
-        }
-        if (depth > maximumDepth) {
-            throw new TypeError(`${label} exceeds the ${maximumDepth}-level nesting limit.`);
-        }
-        if (typeof current === 'string') {
-            text(current);
-            return;
-        }
-        if (current === null || typeof current === 'boolean')
-            return;
-        if (typeof current === 'number') {
-            if (!Number.isFinite(current))
-                throw new TypeError(`${label} contains a non-JSON number.`);
-            return;
-        }
-        if (typeof current !== 'object')
-            throw new TypeError(`${label} contains a non-JSON value.`);
-        if (ancestors.has(current))
-            throw new TypeError(`${label} contains a cyclic object reference.`);
-        let prototype;
-        let ownKeys;
-        let descriptors;
-        try {
-            prototype = Object.getPrototypeOf(current);
-            ownKeys = Reflect.ownKeys(current);
-            descriptors = Object.getOwnPropertyDescriptors(current);
-        }
-        catch {
-            throw new TypeError(`${label} could not be inspected safely.`);
-        }
-        if (ownKeys.some((key) => typeof key !== 'string')) {
-            throw new TypeError(`${label} contains a symbol key.`);
-        }
-        if (ownKeys.some((key) => {
-            const descriptor = descriptors[String(key)];
-            return !descriptor || !Object.hasOwn(descriptor, 'value');
-        })) {
-            throw new TypeError(`${label} contains an accessor property.`);
-        }
-        ancestors.add(current);
-        if (Array.isArray(current)) {
-            if (prototype !== Array.prototype) {
-                throw new TypeError(`${label} contains an array with a custom prototype.`);
-            }
-            const length = descriptors.length?.value;
-            if (!Number.isSafeInteger(length) || length < 0 || length > maximumContainerItems) {
-                throw new TypeError(`${label} contains a container with more than ${maximumContainerItems} items.`);
-            }
-            const indexes = ownKeys.filter((key) => key !== 'length');
-            if (indexes.length !== length
-                || indexes.some((key, index) => key !== String(index) || descriptors[key]?.enumerable !== true)) {
-                throw new TypeError(`${label} contains a sparse, extended, or non-enumerable array.`);
-            }
-            for (const key of indexes)
-                visit(descriptors[key].value, depth + 1);
-        }
-        else {
-            if (prototype !== Object.prototype && prototype !== null) {
-                throw new TypeError(`${label} contains an object with a custom prototype.`);
-            }
-            const objectKeys = ownKeys;
-            if (objectKeys.length > maximumContainerItems) {
-                throw new TypeError(`${label} contains a container with more than ${maximumContainerItems} items.`);
-            }
-            if (objectKeys.some((key) => descriptors[key]?.enumerable !== true)) {
-                throw new TypeError(`${label} contains a non-enumerable object property.`);
-            }
-            keys += objectKeys.length;
-            if (keys > maximumKeys) {
-                throw new TypeError(`${label} exceeds the ${maximumKeys}-key limit.`);
-            }
-            for (const key of objectKeys) {
-                if (!isSafeJsonObjectKey(key))
-                    throw new TypeError(`${label} contains an unsafe object key.`);
-                text(key);
-                visit(descriptors[key].value, depth + 1);
-            }
-        }
-        ancestors.delete(current);
-    };
-    visit(value, 0);
-}
-export function scanBoundedJson(raw, limits = {}, observeString) {
-    const maximumDepth = limits.maximumDepth ?? MAX_BOUNDED_JSON_DEPTH;
-    const maximumKeys = limits.maximumKeys ?? MAX_BOUNDED_JSON_KEYS;
-    const maximumValues = limits.maximumValues ?? MAX_BOUNDED_JSON_VALUES;
-    const maximumContainerItems = limits.maximumContainerItems ?? MAX_BOUNDED_JSON_CONTAINER_ITEMS;
-    let index = 0;
-    let keys = 0;
-    let values = 0;
-    let stringCodeUnits = 0;
-    const whitespace = () => {
-        while (index < raw.length) {
-            const code = raw.charCodeAt(index);
-            if (code !== 0x20 && code !== 0x09 && code !== 0x0a && code !== 0x0d)
-                break;
-            index += 1;
-        }
-    };
-    const stringToken = () => {
-        const start = index;
-        index += 1;
-        while (index < raw.length) {
-            const character = raw[index];
-            if (character === '"') {
-                index += 1;
-                let value;
-                try {
-                    value = JSON.parse(raw.slice(start, index));
-                }
-                catch {
-                    syntaxError();
-                }
-                stringCodeUnits += value.length;
-                if (limits.maximumStringCodeUnits !== undefined && stringCodeUnits > limits.maximumStringCodeUnits) {
-                    throw new TypeError('Artefact JSON exceeds the aggregate text limit.');
-                }
-                return { value, offset: start };
-            }
-            if (character === '\\') {
-                index += 1;
-                if (index >= raw.length)
-                    syntaxError();
-                if (raw[index] === 'u') {
-                    if (!/^[a-fA-F0-9]{4}$/u.test(raw.slice(index + 1, index + 5)))
-                        syntaxError();
-                    index += 5;
-                }
-                else {
-                    if (!/["\\/bfnrt]/u.test(raw[index]))
-                        syntaxError();
-                    index += 1;
-                }
-                continue;
-            }
-            if (character.charCodeAt(0) <= 0x1f)
-                syntaxError();
-            index += 1;
-        }
-        return syntaxError();
-    };
-    const literal = (token) => {
-        if (raw.slice(index, index + token.length) !== token)
-            syntaxError();
-        index += token.length;
-    };
-    const number = () => {
-        const match = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/u.exec(raw.slice(index));
-        if (!match)
-            syntaxError();
-        if (!Number.isFinite(Number(match[0]))) {
-            throw new TypeError('Artefact JSON contains a non-finite number.');
-        }
-        index += match[0].length;
-    };
-    const value = (depth, propertyKey) => {
-        values += 1;
-        if (values > maximumValues) {
-            throw new TypeError(`Artefact JSON exceeds the ${maximumValues}-value limit.`);
-        }
-        if (depth > maximumDepth) {
-            throw new TypeError(`Artefact JSON exceeds the ${maximumDepth}-level nesting limit.`);
-        }
-        whitespace();
-        const character = raw[index];
-        if (character === '"') {
-            const parsedString = stringToken();
-            observeString?.({ ...parsedString, kind: 'value', ...(propertyKey === undefined ? {} : { propertyKey }) });
-            return;
-        }
-        if (character === '{') {
-            index += 1;
-            whitespace();
-            const seen = new Set();
-            if (raw[index] === '}') {
-                index += 1;
-                return;
-            }
-            while (index < raw.length) {
-                if (raw[index] !== '"')
-                    syntaxError();
-                const parsedKey = stringToken();
-                const key = parsedKey.value;
-                if (seen.size >= maximumContainerItems) {
-                    throw new TypeError(`Artefact JSON contains a container with more than ${maximumContainerItems} items.`);
-                }
-                keys += 1;
-                if (keys > maximumKeys) {
-                    throw new TypeError(`Artefact JSON exceeds the ${maximumKeys}-key limit.`);
-                }
-                if (seen.has(key))
-                    throw new TypeError('Artefact JSON contains a duplicate object key.');
-                if (!isSafeJsonObjectKey(key))
-                    throw new TypeError('Artefact JSON contains an unsafe object key.');
-                seen.add(key);
-                observeString?.({ ...parsedKey, kind: 'key' });
-                whitespace();
-                if (raw[index] !== ':')
-                    syntaxError();
-                index += 1;
-                value(depth + 1, key);
-                whitespace();
-                if (raw[index] === '}') {
-                    index += 1;
-                    return;
-                }
-                if (raw[index] !== ',')
-                    syntaxError();
-                index += 1;
-                whitespace();
-            }
-            syntaxError();
-        }
-        if (character === '[') {
-            index += 1;
-            whitespace();
-            if (raw[index] === ']') {
-                index += 1;
-                return;
-            }
-            let items = 0;
-            while (index < raw.length) {
-                items += 1;
-                if (items > maximumContainerItems) {
-                    throw new TypeError(`Artefact JSON contains a container with more than ${maximumContainerItems} items.`);
-                }
-                value(depth + 1);
-                whitespace();
-                if (raw[index] === ']') {
-                    index += 1;
-                    return;
-                }
-                if (raw[index] !== ',')
-                    syntaxError();
-                index += 1;
-                whitespace();
-            }
-            syntaxError();
-        }
-        if (character === 't') {
-            literal('true');
-            return;
-        }
-        if (character === 'f') {
-            literal('false');
-            return;
-        }
-        if (character === 'n') {
-            literal('null');
-            return;
-        }
-        number();
-    };
-    whitespace();
-    value(0);
-    whitespace();
-    if (index !== raw.length)
-        syntaxError();
-}
-export function parseBoundedJson(raw, options) {
-    const label = options.label ?? 'Artefact input';
-    if (typeof raw !== 'string')
-        throw new TypeError(`${label} must be UTF-8 JSON text.`);
-    const bytes = new TextEncoder().encode(raw).byteLength;
-    if (bytes < 1 || bytes > options.maximumBytes) {
-        throw new TypeError(`${label} must be between 1 byte and ${options.maximumBytes} bytes.`);
-    }
-    scanBoundedJson(raw, options.limits);
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        return syntaxError();
-    }
-}
-export function parseBoundedJsonObject(raw, options) {
-    const label = options.label ?? 'Artefact input';
-    const parsed = parseBoundedJson(raw, options);
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        throw new TypeError(`${label} must contain one JSON object.`);
-    }
-    return parsed;
-}
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/bounded-json.mjs";

package/lib/browser-library-profile.mjs

@@ -11,9 +11,9 @@ import { CISA_KEV_CATALOG } from "./generated/cisa-kev-catalog.mjs";
 import { createObservation, normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { isCveIdentifier } from "../packages/contracts/vulnerability-identifiers.mjs";
 import { BROWSER_LIBRARY_PROFILE_VERSION, MAX_LIBRARY_FINDINGS, } from "./lookup-child-profile-contract.mjs";
-import { MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_STATIC_HTML_CHARS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
+import { MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_SCRIPT_REFERENCE_LENGTH, MAX_STATIC_HTML_CHARS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
 // Catalogue expressions are reviewed third-party inputs. Keep every individual
-// regular-expression evaluation and the aggregate inline-signature work small
+// regular-expression evaluation and aggregate reference/inline-signature work small
 // enough that a target-controlled script cannot monopolise the Node event loop.
 // Full-content hashes still use the complete already-capped script body.
 const MAX_INLINE_LIBRARY_SCAN_CHARS = 1_024;
@@ -23,7 +23,6 @@ const MAX_INLINE_LIBRARY_WORKER_BYTES = 64 * 1024;
 const MAX_LIBRARY_HTML_CHARS = MAX_STATIC_HTML_CHARS;
 const MAX_ADVISORY_IDENTIFIERS = 16;
 const MAX_WEAKNESS_CLASSES = 12;
-const MAX_MATCHES_PER_PATTERN = 4;
 const MAX_VERSION_LENGTH = 64;
 const COMPONENT_RE = /^[a-z0-9._-]{1,80}$/i;
 const VERSION_RE = /^[0-9][0-9.a-z_-]{0,63}$/i;
@@ -41,38 +40,61 @@ const KNOWN_EXPLOITED_IDENTIFIERS = new Set(CISA_KEV_CATALOG.identifiers);
 const KNOWN_EXPLOITED_RELEASED_AT = normalizeExplicitIsoTimestamp(CISA_KEV_CATALOG.releasedAt);
 if (KNOWN_EXPLOITED_RELEASED_AT === null)
     throw new Error('Pinned known-exploited catalogue has an invalid release timestamp.');
-const INLINE_EXTRACTOR_CATALOGUE = Object.freeze(Object.entries(CATALOG_COMPONENTS).map(([component, value]) => {
+const PATTERN_EXTRACTOR_CATALOGUE = Object.freeze(Object.entries(CATALOG_COMPONENTS).map(([component, value]) => {
     const extractors = record(record(value).extractors);
+    const patterns = (name) => Object.freeze((Array.isArray(extractors[name]) ? extractors[name] : [])
+        .filter((pattern) => typeof pattern === 'string' && pattern.length > 0 && pattern.length <= 2_048)
+        .slice(0, 64));
     return Object.freeze({
         component,
-        patterns: Object.freeze((Array.isArray(extractors.filecontent) ? extractors.filecontent : [])
-            .filter((pattern) => typeof pattern === 'string' && pattern.length > 0 && pattern.length <= 2_048)
-            .slice(0, 64)),
-        replacements: Object.freeze((Array.isArray(extractors.filecontentreplace) ? extractors.filecontentreplace : [])
-            .filter((pattern) => typeof pattern === 'string' && pattern.length > 0 && pattern.length <= 2_048)
-            .slice(0, 64)),
+        uri: patterns('uri'), filename: patterns('filename'),
+        patterns: patterns('filecontent'), replacements: patterns('filecontentreplace'),
     });
 }));
-const INLINE_REGEX_WORKER_SOURCE = String.raw `
+const LIBRARY_REGEX_WORKER_SOURCE = String.raw `
 const { parentPort, workerData } = require('node:worker_threads');
 const versions = /^[0-9][0-9.a-z_-]{0,63}$/i;
 parentPort.on('message', (job) => {
   const control = new Int32Array(job.control);
   const output = new Uint8Array(job.output);
-  const matches = [];
-  const add = (component, version) => {
+  const matches = new Map();
+  const add = (component, version, method) => {
     const normalized = String(version).replace(/(?:\.|-)?min$/i, '').slice(0, 64);
-    if (versions.test(normalized) && matches.length < 64) matches.push([component, normalized]);
+    const key = component + '\u0000' + normalized;
+    if (!versions.test(normalized)) return;
+    if (!matches.has(key) && matches.size < 64) matches.set(key, [component, normalized, new Set()]);
+    matches.get(key)?.[2].add(method);
   };
   try {
+    const input = JSON.parse(job.value);
+    for (const reference of input.references) {
+      const filename = (reference.replace(/\\/g, '/').split('/').pop() || '').split(/[?#]/, 1)[0];
+      for (const entry of workerData.catalogue) {
+        for (const [patterns, value, method, anchored] of [
+          [entry.uri, reference, 'script URL', false],
+          [entry.filename, filename, 'script filename', true],
+        ]) {
+          if (!value) continue;
+          for (const pattern of patterns) {
+            let expression;
+            try { expression = new RegExp(anchored ? '^(?:' + pattern + ')$' : pattern, 'g'); } catch { continue; }
+            let match, count = 0;
+            while ((match = expression.exec(value)) && count < 4) {
+              if (typeof match[1] === 'string' && versions.test(match[1])) { add(entry.component, match[1], method); count += 1; }
+              if (match[0] === '') expression.lastIndex += 1;
+            }
+          }
+        }
+      }
+    }
     for (const entry of workerData.catalogue) {
       for (const pattern of entry.patterns) {
         let expression;
         try { expression = new RegExp(pattern, 'g'); } catch { continue; }
         let match;
         let count = 0;
-        while ((match = expression.exec(job.value)) && count < 4) {
-          if (typeof match[1] === 'string') add(entry.component, match[1]);
+        while ((match = expression.exec(input.inline)) && count < 4) {
+          if (typeof match[1] === 'string') add(entry.component, match[1], 'inline signature');
           if (match[0] === '') expression.lastIndex += 1;
           count += 1;
         }
@@ -84,16 +106,16 @@ parentPort.on('message', (job) => {
         try { expression = new RegExp(descriptor[1], 'g'); } catch { continue; }
         let match;
         let count = 0;
-        while ((match = expression.exec(job.value)) && count < 4) {
+        while ((match = expression.exec(input.inline)) && count < 4) {
           let replaced = match[0];
           try { replaced = match[0].replace(new RegExp(descriptor[1]), descriptor[2]); } catch { break; }
-          add(entry.component, replaced);
+          add(entry.component, replaced, 'inline signature');
           if (match[0] === '') expression.lastIndex += 1;
           count += 1;
         }
       }
     }
-    const encoded = Buffer.from(JSON.stringify(matches));
+    const encoded = Buffer.from(JSON.stringify([...matches.values()].flatMap(([component, version, methods]) => [...methods].map(method => [component, version, method]))));
     if (encoded.length > output.length) Atomics.store(control, 0, -2);
     else { output.set(encoded); Atomics.store(control, 0, encoded.length); }
   } catch {
@@ -102,8 +124,9 @@ parentPort.on('message', (job) => {
   parentPort.postMessage({ id: job.id });
 });
 `;
-const scanInlineLibrary = createInlineLibraryScanner(() => new Worker(INLINE_REGEX_WORKER_SOURCE, { eval: true, workerData: { catalogue: INLINE_EXTRACTOR_CATALOGUE } }), {
-    maximumCharacters: MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS + MAX_SCRIPT_ELEMENTS,
+const scanLibraryPatterns = createInlineLibraryScanner(() => new Worker(LIBRARY_REGEX_WORKER_SOURCE, { eval: true, workerData: { catalogue: PATTERN_EXTRACTOR_CATALOGUE } }), {
+    // JSON can escape each admitted character to six characters; include separators and keys.
+    maximumCharacters: 6 * (MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS + MAX_SCRIPT_ELEMENTS * MAX_SCRIPT_REFERENCE_LENGTH) + MAX_SCRIPT_ELEMENTS * 10 + 128,
     outputBytes: MAX_INLINE_LIBRARY_WORKER_BYTES,
     deadlineMs: MAX_INLINE_LIBRARY_SCAN_MS,
     // One worker/output buffer, with at most sixteen bounded pending inputs.
@@ -166,26 +189,6 @@ function matchingVulnerabilities(component, version) {
     }
     return matched;
 }
-function matchPattern(pattern, value) {
-    if (typeof pattern !== 'string' || pattern.length === 0 || pattern.length > 2_048)
-        return [];
-    let expression;
-    try {
-        expression = new RegExp(pattern, 'g');
-    }
-    catch {
-        return [];
-    }
-    const matches = [];
-    let match;
-    while ((match = expression.exec(value)) && matches.length < MAX_MATCHES_PER_PATTERN) {
-        if (typeof match[1] === 'string' && VERSION_RE.test(match[1]))
-            matches.push(match[1]);
-        if (match[0] === '')
-            expression.lastIndex += 1;
-    }
-    return matches;
-}
 function addDetected(detected, component, version, method) {
     const normalizedVersion = version.replace(/(?:\.|-)?min$/i, '').slice(0, MAX_VERSION_LENGTH);
     if (!COMPONENT_RE.test(component) || !VERSION_RE.test(normalizedVersion))
@@ -200,38 +203,10 @@ function addDetected(detected, component, version, method) {
         return;
     detected.set(key, { component, version: normalizedVersion, detections: new Set([method]) });
 }
-function scanExtractor(detected, extractorName, value, method) {
-    for (const [componentName, rawComponent] of Object.entries(CATALOG_COMPONENTS)) {
-        const component = record(rawComponent);
-        const extractors = record(component.extractors);
-        const patterns = Array.isArray(extractors[extractorName]) ? extractors[extractorName] : [];
-        for (const pattern of patterns.slice(0, 64)) {
-            for (const version of matchPattern(pattern, value))
-                addDetected(detected, componentName, version, method);
-        }
-    }
-}
-function scanFilename(detected, reference) {
-    const filename = (reference.replace(/\\/g, '/').split('/').pop() || '').split(/[?#]/, 1)[0];
-    if (!filename)
-        return;
-    for (const [componentName, rawComponent] of Object.entries(CATALOG_COMPONENTS)) {
-        const component = record(rawComponent);
-        const extractors = record(component.extractors);
-        const patterns = Array.isArray(extractors.filename) ? extractors.filename : [];
-        for (const pattern of patterns.slice(0, 64)) {
-            if (typeof pattern !== 'string' || pattern.length > 2_048)
-                continue;
-            for (const version of matchPattern(`^(?:${pattern})$`, filename)) {
-                addDetected(detected, componentName, version, 'script filename');
-            }
-        }
-    }
-}
-async function scanInlineSignatures(detected, value, signal) {
-    if (!value)
+async function scanSignatures(detected, value, references, signal) {
+    if (!value && !references.length)
         return { timedOut: false, unavailable: false };
-    const result = await scanInlineLibrary(value, signal);
+    const result = await scanLibraryPatterns(JSON.stringify({ inline: value, references }), signal);
     signal?.throwIfAborted();
     if (result.output === null)
         return result;
@@ -239,12 +214,13 @@ async function scanInlineSignatures(detected, value, signal) {
         const parsed = JSON.parse(result.output);
         if (!Array.isArray(parsed))
             return { timedOut: false, unavailable: true };
-        for (const item of parsed.slice(0, MAX_LIBRARY_FINDINGS * 4)) {
-            if (!Array.isArray(item) || item.length !== 2)
+        for (const item of parsed.slice(0, MAX_LIBRARY_FINDINGS * 4 * 3)) {
+            if (!Array.isArray(item) || item.length !== 3)
                 continue;
-            const [component, version] = item;
-            if (typeof component === 'string' && typeof version === 'string') {
-                addDetected(detected, component, version, 'inline signature');
+            const [component, version, method] = item;
+            if (typeof component === 'string' && typeof version === 'string'
+                && (method === 'inline signature' || method === 'script URL' || method === 'script filename')) {
+                addDetected(detected, component, version, method);
             }
         }
         return { timedOut: false, unavailable: false };
@@ -339,11 +315,11 @@ async function analyzeBrowserLibraries(input = {}) {
     let inlineSignatureCharactersExamined = 0;
     let inlineSignatureLimitReached = false;
     const inlineSignatureSamples = [];
+    const references = [];
     for (const script of htmlAnalysis.scripts) {
         if (script.reference) {
             referencesExamined += 1;
-            scanExtractor(detected, 'uri', script.reference, 'script URL');
-            scanFilename(detected, script.reference);
+            references.push(script.reference);
         }
         else if (script.inlineContent && script.mediaType !== 'application/ld+json') {
             inlineScriptsExamined += 1;
@@ -355,7 +331,7 @@ async function analyzeBrowserLibraries(input = {}) {
                 inlineSignatureSamples.push(signatureScan.signatureContent);
         }
     }
-    const inlineSignatureResult = await scanInlineSignatures(detected, inlineSignatureSamples.join('\u0000'), input.signal);
+    const inlineSignatureResult = await scanSignatures(detected, inlineSignatureSamples.join('\u0000'), references, input.signal);
     input.signal?.throwIfAborted();
     const inlineSignatureUnavailable = inlineSignatureResult.timedOut || inlineSignatureResult.unavailable;
     const projected = [...detected.values()].map(findingFromDetection);
@@ -395,9 +371,9 @@ async function analyzeBrowserLibraries(input = {}) {
     if (inlineSignatureLimitReached)
         limitations.push(`Passive library signature matching evaluated a deterministic ${MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS}-character cumulative sample across inline scripts; full-content hashes still used the complete bounded script content.`);
     if (inlineSignatureResult.timedOut)
-        limitations.push(`Passive library signature matching exceeded its ${MAX_INLINE_LIBRARY_SCAN_MS} ms isolated-worker deadline; hash evidence was still evaluated.`);
+        limitations.push(`Passive library URL, filename and inline signature matching exceeded its ${MAX_INLINE_LIBRARY_SCAN_MS} ms isolated-worker deadline; hash evidence was still evaluated.`);
     if (inlineSignatureResult.unavailable)
-        limitations.push('Passive library signature matching was unavailable in its isolated worker; hash evidence was still evaluated.');
+        limitations.push('Passive library URL, filename and inline signature matching was unavailable in its isolated worker; hash evidence was still evaluated.');
     if (findingLimitReached)
         limitations.push(`Only the first ${MAX_LIBRARY_FINDINGS} library findings were retained.`);
     if (omittedCveIdentifiers)
@@ -428,8 +404,10 @@ async function analyzeBrowserLibraries(input = {}) {
                 inlineScriptsExamined,
                 inlineCharactersExamined: htmlAnalysis.inlineCharactersExamined,
                 inlineSignatureCharactersExamined,
-                inlineSignatureTimedOut: inlineSignatureResult.timedOut,
-                inlineSignatureUnavailable: inlineSignatureResult.unavailable,
+                inlineSignatureTimedOut: inlineSignatureSamples.length > 0 && inlineSignatureResult.timedOut,
+                inlineSignatureUnavailable: inlineSignatureSamples.length > 0 && inlineSignatureResult.unavailable,
+                referenceSignatureTimedOut: references.length > 0 && inlineSignatureResult.timedOut,
+                referenceSignatureUnavailable: references.length > 0 && inlineSignatureResult.unavailable,
                 catalogComponents: Object.keys(CATALOG_COMPONENTS).length,
                 findings: allFindings.length,
                 advisoryMatches: allFindings.reduce((sum, finding) => sum + finding.advisoryCount, 0),

package/lib/candidate-provenance-bounds.mjs

@@ -0,0 +1,2 @@
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/candidate-provenance-bounds.mjs";

package/lib/classify.mjs

@@ -16,7 +16,7 @@
 import { isIP } from 'node:net';
 import { domainToASCII } from 'node:url';
 import { parse } from 'tldts';
-import { canonicalRegistrableDomain } from "./registrable-domain.mjs";
+import { canonicalRegistrableDomain } from "../packages/analysis/registrable-domain.mjs";
 // A CR/LF here would let one query become multiple lines once it reaches
 // lib/whois.mts's raw `socket.write(query + '\r\n')` - a normal URL-encoded
 // query string (?q=example.com%0D%0AHELP) decodes back into literal control

package/lib/ct-query.mjs

@@ -1,27 +1,2 @@
-const MAX_CT_QUERY_LENGTH = 200;
-const CT_QUERY_ERROR_CODE = 'INVALID_CT_QUERY';
-const CT_QUERY_ERROR_MESSAGE = `Certificate Transparency query must be at most ${MAX_CT_QUERY_LENGTH} characters and contain no control or invisible formatting characters.`;
-const UNSAFE_QUERY_CHARACTER_RE = /[\u0000-\u001f\u007f-\u009f]|\p{Default_Ignorable_Code_Point}/u;
-class CtQueryError extends Error {
-    code = CT_QUERY_ERROR_CODE;
-    constructor() {
-        super(CT_QUERY_ERROR_MESSAGE);
-        this.name = 'CtQueryError';
-    }
-}
-function normalizeCtQuery(value) {
-    if (value === undefined || value === null)
-        return '';
-    if (typeof value !== 'string'
-        || value.length > MAX_CT_QUERY_LENGTH
-        || UNSAFE_QUERY_CHARACTER_RE.test(value)) {
-        throw new CtQueryError();
-    }
-    return value.trim();
-}
-function isCtQueryError(value) {
-    return value instanceof Error
-        && 'code' in value
-        && value.code === CT_QUERY_ERROR_CODE;
-}
-export { CT_QUERY_ERROR_CODE, CT_QUERY_ERROR_MESSAGE, CtQueryError, isCtQueryError, MAX_CT_QUERY_LENGTH, normalizeCtQuery, };
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/ct-query.mjs";

package/lib/ct-response-bounds.mjs

@@ -1,9 +1,2 @@
-// Shared response-contract bounds for certificate-log search. The collector
-// and browser normalizer import these values so a valid backend response is
-// not accidentally clipped by a stale client-side mirror.
-export const MAX_CT_RESPONSE_RESULTS = 500;
-export const MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH = 50;
-export const MAX_CT_RESPONSE_TIMESTAMP_LENGTH = 64;
-export const MAX_CT_RESPONSE_CERTIFICATE_GROUPS = 100;
-export const MAX_CT_RESPONSE_DOMAINS_PER_GROUP = 20;
-export const MAX_CT_RESPONSE_HOSTNAMES_PER_GROUP = 30;
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/ct-response-bounds.mjs";