v0.0.168

Technology detection reads real loaders again where #1550 had hidden them: scripts held back by a delay or consent plugin (WP Rocket, Perfmatters, NitroPack, SiteGround, Rocket Loader and others), and a preconnect to a Supabase project origin.

Fixed

• Technology detection reads a loader a delay or consent plugin parks in a wrapper script type again (#1550). v0.0.165 treated every script type that is not JavaScript as data, so a Clarity, Tag Manager, Facebook Pixel or Google Analytics loader that WP Rocket (rocketlazyloadscript), Perfmatters (pmdelayedscript), NitroPack (nitropack/inlinescript), SiteGround Optimizer (text/sg-delayed-inline), a cookie-consent blocker (javascript/blocked) or Cloudflare Rocket Loader (<hash>-module) swaps to JavaScript later was no longer detected (about 100 pairs on 76 of 37,248 corpus sites, Clarity the hardest hit). text/babel is read too, and a bundler's __bundler/ext_resources list is read like an import map: only the uri and url fields of its entries count as script URLs (bounded like an import map), and every other text in the list, a description with a vendor URL for example, stays inert. The rule stays narrow and explicit: a type reads as code only when it is one of the known wrapper names, matched whole (23 exact names, WP Rocket rocketlazyloadscript and text/rocketlazyloadscript, Perfmatters pmdelayedscript, NitroPack nitropack/inlinescript and nitropack/javascript, SiteGround text/sg-delayed-inline, LiteSpeed litespeed/javascript, bv_inline_delayed_js, pslazyscript, airfleetlazyloadscript, lazyjs, text/prosyo-later, o/js-lzl, the consent blockers' javascript/blocked, text/javascript-blocked, text/javascript_blocked, application/ecmascript-blocked and text/blocked, easyoptscript, application/x-imovisor-consent, text/plain, text/partytown, text/babel, and Rocket Loader's hex-hash <hash>-text/javascript, <hash>-application/javascript and <hash>-module). No word in a type counts, so JSON, JSON-LD, import maps, templates, comments and every other type, a custom one that says lazy or javascript included (text/x-lazy-cache, application/javascript-example), are still cut, as is one with a MIME parameter; an unknown wrapper type is cut until corpus evidence adds it. A script type of more than 2,048 spaces followed by application/json was read as an empty (running) type: it is trimmed before it is bounded now. A framework's scriptLoader JSON that names gtag/js is still data.
• Technology detection reads a Supabase project origin in a preconnect or dns-prefetch link again (#1539). Counting only loading <link> rels stopped a <link rel="alternate"> with a /functions/v1/ path from detecting Supabase, but it also left a site whose only signal was <link rel="preconnect" href="https://<ref>.supabase.co/"> and a dns-prefetch to the same origin with no detection, because the detector asked for a /rest/v1-style path. A bare project origin (20 lowercase letters or digits, optional trailing slash, no path, not a your... placeholder or one repeated character) that is the whole href of a link that loads or connects now detects it (a comma or space separated list that merely contains it does not); the same origin in an alternate or canonical link, or in an <a href>, still does not.