@slicedearth/whoisleuth-cli 1.32.0

package/lib/sslbl-intelligence.mjs

@@ -0,0 +1,241 @@
+// Exact local matching against the generated SSLBL certificate snapshot.
+// Lookup never contacts SSLBL. A stale snapshot can preserve a historical
+// positive match, but a stale miss remains inconclusive.
+import { SSLBL_CERTIFICATE_SNAPSHOT } from "./sslbl-certificates.generated.mjs";
+import { createHash } from 'node:crypto';
+export const SSLBL_INTELLIGENCE_VERSION = 1;
+export const SSLBL_SNAPSHOT_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1000;
+export const SSLBL_SNAPSHOT_EXPIRED_AGE_MS = 45 * 24 * 60 * 60 * 1000;
+export const MAX_SSLBL_SNAPSHOT_ENTRIES = 50_000;
+export const MAX_SSLBL_FINGERPRINT_CHUNKS = 1_000;
+export const SSLBL_SOURCE_PAGE = 'https://sslbl.abuse.ch/blacklist/';
+const SHA1_RE = /^[a-f0-9]{40}$/u;
+const SHA256_RE = /^[a-f0-9]{64}$/u;
+const SNAPSHOT_SCHEMA = 'whoisleuth.sslbl-certificate-snapshot';
+const SNAPSHOT_SOURCE = 'https://sslbl.abuse.ch/blacklist/sslblacklist.csv';
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function timestamp(value) {
+    if (typeof value !== 'string' || value.length > 64)
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+function normalizedFingerprint(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.replaceAll(':', '').trim().toLowerCase();
+    return SHA1_RE.test(normalized) ? normalized : null;
+}
+function fingerprintDigest(fingerprints) {
+    return createHash('sha256')
+        .update([...fingerprints].sort().join('\n'), 'utf8')
+        .digest('hex');
+}
+function validateSnapshot(value) {
+    const candidate = record(value);
+    const sourceUpdatedAt = timestamp(candidate.sourceUpdatedAt);
+    const generatedAt = timestamp(candidate.generatedAt);
+    if (candidate.schema !== SNAPSHOT_SCHEMA
+        || candidate.version !== 1
+        || candidate.source !== SNAPSHOT_SOURCE
+        || !sourceUpdatedAt
+        || !generatedAt
+        || Date.parse(sourceUpdatedAt) > Date.parse(generatedAt)
+        || typeof candidate.sourceDigestSha256 !== 'string'
+        || !SHA256_RE.test(candidate.sourceDigestSha256)
+        || typeof candidate.entriesDigestSha256 !== 'string'
+        || !SHA256_RE.test(candidate.entriesDigestSha256)
+        || !Number.isSafeInteger(candidate.entryCount)
+        || Number(candidate.entryCount) < 1
+        || Number(candidate.entryCount) > MAX_SSLBL_SNAPSHOT_ENTRIES
+        || !Array.isArray(candidate.fingerprintChunks)
+        || candidate.fingerprintChunks.length < 1
+        || candidate.fingerprintChunks.length > MAX_SSLBL_FINGERPRINT_CHUNKS) {
+        return null;
+    }
+    const fingerprints = new Set();
+    for (const chunk of candidate.fingerprintChunks) {
+        if (typeof chunk !== 'string' || chunk.length > 4_000 || !chunk.endsWith('\n'))
+            return null;
+        for (const line of chunk.split('\n')) {
+            if (!line)
+                continue;
+            if (!SHA1_RE.test(line) || fingerprints.has(line))
+                return null;
+            fingerprints.add(line);
+            if (fingerprints.size > MAX_SSLBL_SNAPSHOT_ENTRIES)
+                return null;
+        }
+    }
+    if (fingerprints.size !== candidate.entryCount
+        || fingerprintDigest(fingerprints) !== candidate.entriesDigestSha256) {
+        return null;
+    }
+    return {
+        snapshot: candidate,
+        fingerprints,
+    };
+}
+let builtInSnapshotValidation;
+function validatedSnapshot(value) {
+    if (value !== undefined)
+        return validateSnapshot(value);
+    if (builtInSnapshotValidation === undefined) {
+        builtInSnapshotValidation = validateSnapshot(SSLBL_CERTIFICATE_SNAPSHOT);
+    }
+    return builtInSnapshotValidation;
+}
+function effectiveNow(value) {
+    const candidate = value instanceof Date
+        ? value.getTime()
+        : typeof value === 'number'
+            ? value
+            : typeof value === 'string'
+                ? Date.parse(value)
+                : Date.now();
+    return Number.isFinite(candidate) ? candidate : Date.now();
+}
+export function sslblSnapshotHealth(options = {}) {
+    const validated = validatedSnapshot(options.snapshot);
+    if (!validated) {
+        return Object.freeze({
+            state: 'invalid',
+            sourceUpdatedAt: null,
+            generatedAt: null,
+            ageSeconds: null,
+            entryCount: null,
+            digestSha256: null,
+            detail: 'The local SSLBL certificate snapshot is missing or failed validation.',
+        });
+    }
+    const now = effectiveNow(options.now);
+    const sourceUpdatedAt = timestamp(validated.snapshot.sourceUpdatedAt);
+    const generatedAt = timestamp(validated.snapshot.generatedAt);
+    if (!sourceUpdatedAt || !generatedAt || Date.parse(sourceUpdatedAt) > now) {
+        return Object.freeze({
+            state: 'invalid',
+            sourceUpdatedAt,
+            generatedAt,
+            ageSeconds: null,
+            entryCount: validated.snapshot.entryCount,
+            digestSha256: validated.snapshot.entriesDigestSha256,
+            detail: 'The local SSLBL certificate snapshot has invalid or future-dated timestamps.',
+        });
+    }
+    const ageMs = now - Date.parse(sourceUpdatedAt);
+    const state = ageMs > SSLBL_SNAPSHOT_EXPIRED_AGE_MS
+        ? 'expired'
+        : ageMs > SSLBL_SNAPSHOT_MAX_AGE_MS
+            ? 'stale'
+            : 'current';
+    return Object.freeze({
+        state,
+        sourceUpdatedAt,
+        generatedAt,
+        ageSeconds: Math.floor(ageMs / 1000),
+        entryCount: validated.snapshot.entryCount,
+        digestSha256: validated.snapshot.entriesDigestSha256,
+        detail: state === 'current'
+            ? 'The local SSLBL certificate snapshot is current.'
+            : state === 'stale'
+                ? 'The local SSLBL certificate snapshot is stale; positive matches remain review leads and misses are inconclusive.'
+                : 'The local SSLBL certificate snapshot is too old to support a current comparison.',
+    });
+}
+function tlsFingerprint(value) {
+    const tls = record(value);
+    const certificate = record(tls.certificate);
+    return normalizedFingerprint(certificate.fingerprintSha1);
+}
+function unavailable(observedAt, fingerprintSha1, detail) {
+    return Object.freeze({
+        sslblVersion: SSLBL_INTELLIGENCE_VERSION,
+        source: 'sslbl',
+        status: 'unavailable',
+        verdict: 'inconclusive',
+        complete: false,
+        observedAt,
+        fingerprintSha1,
+        referenceUrl: null,
+        snapshot: Object.freeze({
+            sourceUpdatedAt: null,
+            generatedAt: null,
+            ageSeconds: null,
+            entryCount: null,
+            digestSha256: null,
+        }),
+        detail,
+        limitations: Object.freeze([
+            'Unavailable certificate warning data is not evidence that the observed certificate is absent from SSLBL or safe.',
+            'SSLBL associates listed certificate fingerprints with observed botnet command-and-control activity; a match does not establish current domain ownership, intent, or activity.',
+        ]),
+    });
+}
+export function inspectSslblCertificate(tls, options = {}) {
+    const nowValue = effectiveNow(options.now);
+    const observedAt = new Date(nowValue).toISOString();
+    const fingerprintSha1 = tlsFingerprint(tls);
+    if (!fingerprintSha1) {
+        return unavailable(observedAt, null, 'The deep TLS observation did not retain a usable leaf-certificate SHA-1 fingerprint.');
+    }
+    const validated = validatedSnapshot(options.snapshot);
+    if (!validated) {
+        return unavailable(observedAt, fingerprintSha1, 'The local SSLBL certificate snapshot is missing or failed validation.');
+    }
+    const sourceUpdatedAt = timestamp(validated.snapshot.sourceUpdatedAt);
+    const generatedAt = timestamp(validated.snapshot.generatedAt);
+    if (!sourceUpdatedAt || !generatedAt) {
+        return unavailable(observedAt, fingerprintSha1, 'The local SSLBL certificate snapshot has invalid timestamps.');
+    }
+    if (Date.parse(sourceUpdatedAt) > nowValue) {
+        return unavailable(observedAt, fingerprintSha1, 'The local SSLBL certificate snapshot is future-dated and cannot support a current comparison.');
+    }
+    const ageMs = nowValue - Date.parse(sourceUpdatedAt);
+    if (ageMs > SSLBL_SNAPSHOT_EXPIRED_AGE_MS) {
+        return unavailable(observedAt, fingerprintSha1, 'The local SSLBL certificate snapshot is too old to support a current comparison.');
+    }
+    const listed = validated.fingerprints.has(fingerprintSha1);
+    const stale = ageMs > SSLBL_SNAPSHOT_MAX_AGE_MS;
+    const verdict = listed
+        ? 'listed'
+        : stale
+            ? 'inconclusive'
+            : 'not_listed';
+    const referenceUrl = listed
+        ? `https://sslbl.abuse.ch/ssl-certificates/sha1/${fingerprintSha1}/`
+        : null;
+    return Object.freeze({
+        sslblVersion: SSLBL_INTELLIGENCE_VERSION,
+        source: 'sslbl',
+        status: stale ? 'stale' : 'success',
+        verdict,
+        complete: !stale,
+        observedAt,
+        fingerprintSha1,
+        referenceUrl,
+        snapshot: Object.freeze({
+            sourceUpdatedAt,
+            generatedAt,
+            ageSeconds: Math.floor(ageMs / 1000),
+            entryCount: validated.snapshot.entryCount,
+            digestSha256: validated.snapshot.entriesDigestSha256,
+        }),
+        detail: listed
+            ? stale
+                ? 'The observed leaf certificate appears in the stale local SSLBL snapshot. Verify the current provider record before acting.'
+                : 'The observed leaf certificate appears in the local SSLBL certificate snapshot.'
+            : stale
+                ? 'The stale local snapshot contains no exact match, so the result is inconclusive.'
+                : 'No exact fingerprint match was found in the current local SSLBL certificate snapshot.',
+        limitations: Object.freeze([
+            'SSLBL matching uses the exact observed leaf-certificate SHA-1 fingerprint and makes no network request.',
+            'No match is not evidence that the domain, certificate, or service is safe.',
+            'Certificates can be reused across unrelated domains or infrastructure; a match does not prove ownership, intent, or current activity.',
+            ...(stale ? ['The snapshot is older than the current-evidence threshold and should be refreshed.'] : []),
+        ]),
+    });
+}

package/lib/static-html-analysis.mjs

@@ -0,0 +1,340 @@
+// One bounded tokenization pass over the already-captured homepage body. The
+// parse5 tokenizer applies HTML tokenization rules without constructing a DOM,
+// so deeply nested hostile markup cannot create an unbounded element tree.
+// Only normalized start-tag markup and capped script indicators are retained.
+import { Tokenizer, TokenizerMode } from 'parse5';
+const MAX_STATIC_HTML_CHARS = 300_000;
+const MAX_STATIC_HTML_TAGS = 8_192;
+const MAX_STATIC_STRUCTURE_TOKENS = 4_096;
+const MAX_TECHNOLOGY_TAGS = 2_048;
+const MAX_TAG_LENGTH = 4_096;
+const MAX_ATTRIBUTES_PER_TAG = 128;
+const MAX_SCRIPT_ELEMENTS = 64;
+const MAX_SCRIPT_REFERENCE_LENGTH = 2_048;
+const MAX_SCRIPT_MEDIA_TYPE_LENGTH = 120;
+const MAX_INLINE_SCRIPT_CHARS = 32_768;
+const MAX_INLINE_SCRIPT_TOTAL_CHARS = 65_536;
+const MAX_STATIC_FORMS = 50;
+const MAX_STATIC_INPUTS = 500;
+const MAX_FORM_ATTRIBUTE_LENGTH = 2_048;
+const CONTROL_CHARACTER_RE = /[\u0000-\u001f\u007f]/;
+const PAYMENT_AUTOCOMPLETE_TOKENS = new Set([
+    'cc-name',
+    'cc-given-name',
+    'cc-additional-name',
+    'cc-family-name',
+    'cc-number',
+    'cc-exp',
+    'cc-exp-month',
+    'cc-exp-year',
+    'cc-csc',
+    'cc-type',
+    'transaction-currency',
+    'transaction-amount',
+]);
+const RAW_TEXT_MODES = Object.freeze({
+    iframe: TokenizerMode.RAWTEXT,
+    noembed: TokenizerMode.RAWTEXT,
+    noframes: TokenizerMode.RAWTEXT,
+    script: TokenizerMode.SCRIPT_DATA,
+    style: TokenizerMode.RAWTEXT,
+    template: TokenizerMode.RAWTEXT,
+    textarea: TokenizerMode.RCDATA,
+    title: TokenizerMode.RCDATA,
+    xmp: TokenizerMode.RAWTEXT,
+});
+const VOID_TAGS = new Set([
+    'area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input', 'link', 'meta',
+    'param', 'source', 'track', 'wbr',
+]);
+function attributeValue(attributes, name, maximumLength = MAX_FORM_ATTRIBUTE_LENGTH) {
+    const attribute = attributes
+        .slice(0, MAX_ATTRIBUTES_PER_TAG)
+        .find((candidate) => candidate.name.toLowerCase() === name);
+    if (!attribute)
+        return { present: false, value: null, truncated: attributes.length > MAX_ATTRIBUTES_PER_TAG };
+    if (attribute.value.length > maximumLength || CONTROL_CHARACTER_RE.test(attribute.value)) {
+        return { present: true, value: null, truncated: true };
+    }
+    return {
+        present: true,
+        value: attribute.value.trim().toLowerCase(),
+        truncated: attributes.length > MAX_ATTRIBUTES_PER_TAG,
+    };
+}
+function safeBaseUrl(value) {
+    if (typeof value !== 'string' || value.length > MAX_FORM_ATTRIBUTE_LENGTH || CONTROL_CHARACTER_RE.test(value))
+        return null;
+    try {
+        const parsed = new URL(value);
+        return ['http:', 'https:'].includes(parsed.protocol) && !parsed.username && !parsed.password && parsed.hostname
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function formMethod(attributes) {
+    const method = attributeValue(attributes, 'method', 24);
+    if (!method.present && method.truncated)
+        return { value: 'other', truncated: true };
+    if (!method.present || method.value === '')
+        return { value: 'missing', truncated: method.truncated };
+    if (method.value === null)
+        return { value: 'other', truncated: true };
+    return {
+        value: ['get', 'post', 'dialog'].includes(method.value)
+            ? method.value
+            : 'other',
+        truncated: method.truncated,
+    };
+}
+function formAction(attributes, baseUrl) {
+    const action = attributeValue(attributes, 'action');
+    if (!action.present && action.truncated) {
+        return { relationship: 'unclassified', cleartext: false, truncated: true };
+    }
+    if (!action.present || action.value === '') {
+        return { relationship: 'missing', cleartext: false, truncated: action.truncated };
+    }
+    if (action.value === null) {
+        return { relationship: 'unclassified', cleartext: false, truncated: true };
+    }
+    if (!baseUrl) {
+        return { relationship: 'unclassified', cleartext: false, truncated: action.truncated };
+    }
+    try {
+        const parsed = new URL(action.value, baseUrl);
+        if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password || !parsed.hostname) {
+            return { relationship: 'unclassified', cleartext: false, truncated: action.truncated };
+        }
+        return {
+            relationship: parsed.origin === baseUrl.origin ? 'sameOrigin' : 'external',
+            cleartext: parsed.protocol === 'http:',
+            truncated: action.truncated,
+        };
+    }
+    catch {
+        return { relationship: 'unclassified', cleartext: false, truncated: action.truncated };
+    }
+}
+function inputCategories(attributes) {
+    if (attributes.length > MAX_ATTRIBUTES_PER_TAG)
+        return { values: [], truncated: true };
+    const type = attributeValue(attributes, 'type', 40);
+    const autocomplete = attributeValue(attributes, 'autocomplete', 160);
+    const disabled = attributeValue(attributes, 'disabled', 10).present;
+    const truncated = type.truncated || autocomplete.truncated;
+    if (disabled || type.value === 'hidden')
+        return { values: [], truncated };
+    const normalizedType = type.value || 'text';
+    const autocompleteTokens = (autocomplete.value || '').split(/\s+/u).filter(Boolean).slice(0, 16);
+    const categories = new Set();
+    if (normalizedType === 'password' || autocompleteTokens.some((token) => ['current-password', 'new-password'].includes(token))) {
+        categories.add('password');
+    }
+    if (normalizedType === 'email' || autocompleteTokens.includes('email'))
+        categories.add('email');
+    if (autocompleteTokens.includes('username'))
+        categories.add('username');
+    if (autocompleteTokens.includes('one-time-code'))
+        categories.add('one_time_code');
+    if (autocompleteTokens.some((token) => PAYMENT_AUTOCOMPLETE_TOKENS.has(token)))
+        categories.add('payment');
+    return { values: [...categories], truncated };
+}
+function scriptReference(attributes) {
+    for (const attribute of attributes.slice(0, MAX_ATTRIBUTES_PER_TAG)) {
+        if (attribute.name.toLowerCase() !== 'src')
+            continue;
+        if (attribute.value.length === 0
+            || attribute.value.length > MAX_SCRIPT_REFERENCE_LENGTH
+            || CONTROL_CHARACTER_RE.test(attribute.value))
+            return null;
+        return attribute.value;
+    }
+    return null;
+}
+function scriptMediaType(attributes) {
+    for (const attribute of attributes.slice(0, MAX_ATTRIBUTES_PER_TAG)) {
+        if (attribute.name.toLowerCase() !== 'type')
+            continue;
+        if (attribute.value.length === 0
+            || attribute.value.length > MAX_SCRIPT_MEDIA_TYPE_LENGTH
+            || CONTROL_CHARACTER_RE.test(attribute.value))
+            return null;
+        return attribute.value.trim().toLowerCase().split(';', 1)[0] || null;
+    }
+    return null;
+}
+function serializedStartTag(tagName, attributes) {
+    let serialized = `<${tagName.toLowerCase()}`;
+    let limitReached = attributes.length > MAX_ATTRIBUTES_PER_TAG;
+    for (const attribute of attributes.slice(0, MAX_ATTRIBUTES_PER_TAG)) {
+        const candidate = ` ${attribute.name.toLowerCase()}="${attribute.value.toLowerCase()}"`;
+        if (serialized.length + candidate.length + 1 > MAX_TAG_LENGTH) {
+            limitReached = true;
+            break;
+        }
+        serialized += candidate;
+    }
+    return {
+        markup: serialized.length + 1 <= MAX_TAG_LENGTH ? `${serialized}>` : null,
+        limitReached,
+    };
+}
+function analyzeStaticHtml(value, options = {}) {
+    const supplied = typeof value === 'string' ? value : '';
+    const inputLimitReached = supplied.length > MAX_STATIC_HTML_CHARS;
+    const html = supplied.slice(0, MAX_STATIC_HTML_CHARS);
+    const baseUrl = safeBaseUrl(options.baseUrl);
+    const markup = [];
+    const structureTokens = [];
+    const scripts = [];
+    const forms = {
+        formsObserved: 0,
+        inputsObserved: 0,
+        classifiedInputs: 0,
+        categories: { password: 0, email: 0, username: 0, one_time_code: 0, payment: 0 },
+        methods: { missing: 0, get: 0, post: 0, dialog: 0, other: 0 },
+        actions: { sameOrigin: 0, external: 0, missing: 0, cleartext: 0, unclassified: 0 },
+        truncated: false,
+    };
+    let tokenizer;
+    let activeInlineScript = null;
+    let tagsExamined = 0;
+    let inlineCharactersExamined = 0;
+    let tagLimitReached = false;
+    let structureLimitReached = false;
+    let scriptLimitReached = false;
+    let inlineLimitReached = false;
+    function appendInlineScript(chars) {
+        if (!activeInlineScript || !chars)
+            return;
+        const perScriptRemaining = MAX_INLINE_SCRIPT_CHARS - activeInlineScript.inlineContent.length;
+        const totalRemaining = MAX_INLINE_SCRIPT_TOTAL_CHARS - inlineCharactersExamined;
+        const retainedLength = Math.max(0, Math.min(chars.length, perScriptRemaining, totalRemaining));
+        if (retainedLength > 0) {
+            activeInlineScript.inlineContent += chars.slice(0, retainedLength);
+            inlineCharactersExamined += retainedLength;
+        }
+        if (retainedLength < chars.length)
+            inlineLimitReached = true;
+    }
+    function appendStructureToken(value) {
+        if (structureTokens.length >= MAX_STATIC_STRUCTURE_TOKENS) {
+            structureLimitReached = true;
+            return;
+        }
+        structureTokens.push(value);
+    }
+    const handler = {
+        onStartTag(token) {
+            const tagName = token.tagName.toLowerCase();
+            const rawTextMode = RAW_TEXT_MODES[tagName];
+            if (!token.selfClosing && rawTextMode !== undefined)
+                tokenizer.state = rawTextMode;
+            if (tagsExamined >= MAX_STATIC_HTML_TAGS) {
+                tagLimitReached = true;
+                activeInlineScript = null;
+                return;
+            }
+            tagsExamined += 1;
+            appendStructureToken(token.selfClosing || VOID_TAGS.has(tagName) ? `${tagName}/` : tagName);
+            if (markup.length < MAX_TECHNOLOGY_TAGS) {
+                const serialized = serializedStartTag(tagName, token.attrs);
+                if (serialized.limitReached)
+                    tagLimitReached = true;
+                if (serialized.markup)
+                    markup.push(serialized.markup);
+            }
+            else {
+                tagLimitReached = true;
+            }
+            if (tagName === 'form') {
+                if (forms.formsObserved >= MAX_STATIC_FORMS) {
+                    forms.truncated = true;
+                }
+                else {
+                    forms.formsObserved += 1;
+                    const method = formMethod(token.attrs);
+                    forms.methods[method.value] += 1;
+                    const action = formAction(token.attrs, baseUrl);
+                    forms.actions[action.relationship] += 1;
+                    if (action.cleartext)
+                        forms.actions.cleartext += 1;
+                    if (method.truncated || action.truncated)
+                        forms.truncated = true;
+                }
+            }
+            else if (tagName === 'input') {
+                if (forms.inputsObserved >= MAX_STATIC_INPUTS) {
+                    forms.truncated = true;
+                }
+                else {
+                    forms.inputsObserved += 1;
+                    const categories = inputCategories(token.attrs);
+                    if (categories.truncated)
+                        forms.truncated = true;
+                    if (categories.values.length)
+                        forms.classifiedInputs += 1;
+                    for (const category of categories.values)
+                        forms.categories[category] += 1;
+                }
+            }
+            if (tagName !== 'script') {
+                activeInlineScript = null;
+                return;
+            }
+            if (scripts.length >= MAX_SCRIPT_ELEMENTS) {
+                scriptLimitReached = true;
+                activeInlineScript = null;
+                return;
+            }
+            const reference = scriptReference(token.attrs);
+            const script = {
+                reference,
+                inlineContent: '',
+                mediaType: scriptMediaType(token.attrs),
+            };
+            scripts.push(script);
+            activeInlineScript = reference ? null : script;
+        },
+        onEndTag(token) {
+            const tagName = token.tagName.toLowerCase();
+            if (tagName === 'script')
+                activeInlineScript = null;
+            if (!VOID_TAGS.has(tagName))
+                appendStructureToken(`/${tagName}`);
+        },
+        onCharacter(token) {
+            appendInlineScript(token.chars);
+        },
+        onNullCharacter(token) {
+            appendInlineScript(token.chars);
+        },
+        onWhitespaceCharacter(token) {
+            appendInlineScript(token.chars);
+        },
+        onComment() { },
+        onDoctype() { },
+        onEof() { },
+    };
+    tokenizer = new Tokenizer({ sourceCodeLocationInfo: false }, handler);
+    tokenizer.write(html, true);
+    return {
+        markup: markup.join('\n'),
+        structureTokens,
+        scripts,
+        forms,
+        inputLimitReached,
+        tagLimitReached,
+        structureLimitReached,
+        scriptLimitReached,
+        inlineLimitReached,
+        tagsExamined,
+        inlineCharactersExamined,
+    };
+}
+export { MAX_ATTRIBUTES_PER_TAG, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_SCRIPT_MEDIA_TYPE_LENGTH, MAX_STATIC_FORMS, MAX_STATIC_HTML_CHARS, MAX_STATIC_INPUTS, MAX_STATIC_HTML_TAGS, MAX_STATIC_STRUCTURE_TOKENS, MAX_TAG_LENGTH, MAX_TECHNOLOGY_TAGS, analyzeStaticHtml, };