@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/lib/static-html-analysis.mjs

@@ -1,21 +1,18 @@
-// One bounded tokenization pass over the already-captured homepage body. The
-// parse5 tokenizer applies HTML tokenization rules without constructing a DOM,
-// so deeply nested hostile markup cannot create an unbounded element tree.
-// Only normalized start-tag markup and capped script indicators are retained.
-import { Tokenizer, TokenizerMode } from 'parse5';
+// One bounded native HTML parse over the already-captured homepage body.
+// Consumers share element/attribute evidence instead of reparsing reconstructed
+// markup. Only bounded transient projections leave this module, never a DOM.
+import { htmlTreeEvents, isHtmlElement, parseBoundedHtml, MAX_STATIC_HTML_CHARS, MAX_STATIC_HTML_TAGS, MAX_STATIC_HTML_TREE_EVENTS, } from "./bounded-html-document.mjs";
 import { MAX_CSP_META_POLICIES, MAX_RESPONSE_POLICY_HEADER_BYTES, } from "./response-policy.mjs";
+import { MAX_FAVICON_BYTES, MAX_FAVICON_CANDIDATES } from "./outbound-request-bounds.mjs";
 import { MAX_PAGE_PUBLICATION_DECLARATIONS, MAX_PAGE_PUBLICATION_META_ELEMENTS, MAX_PAGE_PUBLICATION_ROBOTS_DIRECTIVES, } from "./homepage-metadata-contract.mjs";
-const MAX_STATIC_HTML_CHARS = 300_000;
-const MAX_STATIC_HTML_TAGS = 8_192;
-const MAX_STATIC_STRUCTURE_TOKENS = 4_096;
-const MAX_TECHNOLOGY_TAGS = 2_048;
+const MAX_STATIC_STRUCTURE_TOKENS = MAX_STATIC_HTML_TREE_EVENTS;
 const MAX_TAG_LENGTH = 4_096;
 const MAX_ATTRIBUTES_PER_TAG = 128;
 const MAX_SCRIPT_ELEMENTS = 64;
 const MAX_SCRIPT_REFERENCE_LENGTH = 2_048;
 const MAX_SCRIPT_MEDIA_TYPE_LENGTH = 120;
-const MAX_INLINE_SCRIPT_CHARS = 32_768;
 const MAX_INLINE_SCRIPT_TOTAL_CHARS = 65_536;
+const MAX_INLINE_SCRIPT_CHARS = MAX_INLINE_SCRIPT_TOTAL_CHARS;
 const MAX_STATIC_VISIBLE_TEXT_CHARS = MAX_STATIC_HTML_CHARS;
 const MAX_STATIC_FORMS = 50;
 const MAX_STATIC_INPUTS = 500;
@@ -39,29 +36,11 @@ const PAYMENT_AUTOCOMPLETE_TOKENS = new Set([
     'transaction-currency',
     'transaction-amount',
 ]);
-const RAW_TEXT_MODES = Object.freeze({
-    iframe: TokenizerMode.RAWTEXT,
-    noembed: TokenizerMode.RAWTEXT,
-    noframes: TokenizerMode.RAWTEXT,
-    script: TokenizerMode.SCRIPT_DATA,
-    style: TokenizerMode.RAWTEXT,
-    template: TokenizerMode.RAWTEXT,
-    textarea: TokenizerMode.RCDATA,
-    title: TokenizerMode.RCDATA,
-    xmp: TokenizerMode.RAWTEXT,
-});
 const VOID_TAGS = new Set([
     'area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input', 'link', 'meta',
     'param', 'source', 'track', 'wbr',
 ]);
-const NON_VISIBLE_TEXT_TAGS = new Set(['script', 'style', 'template']);
-const HEAD_CONTEXT_TAGS = new Set([
-    'html', 'head', 'base', 'basefont', 'bgsound', 'link', 'meta', 'title',
-    'noscript', 'noframes', 'style', 'template', 'script',
-]);
-const IMPLICIT_HEAD_TEXT_TAGS = new Set([
-    'title', 'noscript', 'noframes', 'style', 'template', 'script',
-]);
+const NON_VISIBLE_TEXT_TAGS = new Set(['head', 'script', 'style', 'template', 'noscript', 'iframe', 'noembed', 'noframes']);
 const ROBOTS_DIRECTIVES = new Set([
     'all', 'follow', 'index', 'max-image-preview', 'max-snippet', 'max-video-preview',
     'noarchive', 'nocache', 'nofollow', 'noimageindex', 'noindex', 'none', 'nositelinkssearchbox',
@@ -218,31 +197,18 @@ function stylesheetCandidate(attributes) {
         truncated: rel.truncated || href.truncated || disabled.truncated || media.truncated,
     };
 }
-function serializedStartTag(tagName, attributes) {
-    let serialized = `<${tagName.toLowerCase()}`;
-    let limitReached = attributes.length > MAX_ATTRIBUTES_PER_TAG;
-    for (const attribute of attributes.slice(0, MAX_ATTRIBUTES_PER_TAG)) {
-        const candidate = ` ${attribute.name.toLowerCase()}="${attribute.value.toLowerCase()}"`;
-        if (serialized.length + candidate.length + 1 > MAX_TAG_LENGTH) {
-            limitReached = true;
-            break;
-        }
-        serialized += candidate;
-    }
-    return {
-        markup: serialized.length + 1 <= MAX_TAG_LENGTH ? `${serialized}>` : null,
-        limitReached,
-    };
-}
 function analyzeStaticHtml(value, options = {}) {
-    const supplied = typeof value === 'string' ? value : '';
-    const inputLimitReached = supplied.length > MAX_STATIC_HTML_CHARS;
-    const html = supplied.slice(0, MAX_STATIC_HTML_CHARS);
+    const parsed = parseBoundedHtml(value);
+    const { inputLimitReached } = parsed;
     const documentUrl = safeBaseUrl(options.baseUrl);
     let effectiveBaseUrl = documentUrl;
     let baseHrefState = 'absent';
     const includeVisibleText = options.includeVisibleText === true;
-    const markup = [];
+    const elements = [];
+    const iconLinks = [];
+    const iconCounts = [0, 0];
+    const tokens = [];
+    const elementStack = [];
     const visibleTextParts = [];
     const structureTokens = [];
     const scripts = [];
@@ -298,11 +264,10 @@ function analyzeStaticHtml(value, options = {}) {
     };
     const robotDirectives = new Set();
     const twitterCardTypes = new Set();
-    let tokenizer;
     let activeInlineScript = null;
     let tagsExamined = 0;
     let inlineCharactersExamined = 0;
-    let tagLimitReached = false;
+    let tagLimitReached = parsed.constructionLimitReached;
     let structureLimitReached = false;
     let scriptLimitReached = false;
     let inlineLimitReached = false;
@@ -310,11 +275,9 @@ function analyzeStaticHtml(value, options = {}) {
     let cspMetaLimitReached = false;
     let publicationMetaElements = 0;
     let robotDirectiveTokens = 0;
-    let publicationTagLimitReached = false;
+    let publicationTagLimitReached = parsed.constructionLimitReached;
     let insideExplicitHead = false;
-    let implicitHeadTextDepth = 0;
-    let headScopeClosed = false;
-    let bodyContentStarted = false;
+    let insideHead = false;
     let scriptElementSeen = false;
     let nonVisibleTextDepth = 0;
     let visibleTextCharacters = 0;
@@ -332,9 +295,8 @@ function analyzeStaticHtml(value, options = {}) {
     function appendInlineScript(chars) {
         if (!activeInlineScript || !chars)
             return;
-        const perScriptRemaining = MAX_INLINE_SCRIPT_CHARS - activeInlineScript.inlineContent.length;
         const totalRemaining = MAX_INLINE_SCRIPT_TOTAL_CHARS - inlineCharactersExamined;
-        const retainedLength = Math.max(0, Math.min(chars.length, perScriptRemaining, totalRemaining));
+        const retainedLength = Math.max(0, Math.min(chars.length, totalRemaining));
         if (retainedLength > 0) {
             activeInlineScript.inlineContent += chars.slice(0, retainedLength);
             inlineCharactersExamined += retainedLength;
@@ -361,33 +323,96 @@ function analyzeStaticHtml(value, options = {}) {
         if (retainedLength < chars.length)
             visibleTextLimitReached = true;
     }
-    const handler = {
-        onStartTag(token) {
-            const tagName = token.tagName.toLowerCase();
-            const rawTextMode = RAW_TEXT_MODES[tagName];
-            if (!token.selfClosing && rawTextMode !== undefined)
-                tokenizer.state = rawTextMode;
-            if (!token.selfClosing && NON_VISIBLE_TEXT_TAGS.has(tagName))
-                nonVisibleTextDepth += 1;
-            if (tagsExamined >= MAX_STATIC_HTML_TAGS) {
-                tagLimitReached = true;
-                publicationTagLimitReached = true;
+    function appendToken(token) {
+        if (tokens.length >= MAX_STATIC_STRUCTURE_TOKENS)
+            structureLimitReached = true;
+        else
+            tokens.push(token);
+    }
+    for (const event of htmlTreeEvents(parsed.document)) {
+        if (event.kind === 'text') {
+            appendInlineScript(event.text);
+            appendTitle(event.text);
+            appendVisibleText(event.text);
+            if (nonVisibleTextDepth === 0)
+                appendToken({ kind: 'text', value: event.text });
+            continue;
+        }
+        const node = event.element;
+        const tagName = node.tagName.toLowerCase();
+        const htmlElement = isHtmlElement(node);
+        if (event.kind === 'end') {
+            elementStack.pop();
+            if (tagName === 'script')
                 activeInlineScript = null;
-                return;
+            if (htmlElement && tagName === 'title')
+                titleDepth = 0;
+            if (htmlElement && tagName === 'head') {
+                insideHead = false;
+                insideExplicitHead = false;
+            }
+            if (!htmlElement || !VOID_TAGS.has(tagName)) {
+                appendStructureToken(`/${tagName}`);
+                appendToken({ kind: 'end', name: tagName });
             }
-            tagsExamined += 1;
-            appendStructureToken(token.selfClosing || VOID_TAGS.has(tagName) ? `${tagName}/` : tagName);
-            if (tagName === 'head')
-                insideExplicitHead = true;
-            if (tagName === 'body' || (!insideExplicitHead && !HEAD_CONTEXT_TAGS.has(tagName))) {
-                bodyContentStarted = true;
-                headScopeClosed = true;
+            if (NON_VISIBLE_TEXT_TAGS.has(tagName))
+                nonVisibleTextDepth -= 1;
+            continue;
+        }
+        {
+            const token = { attrs: node.attrs };
+            if (NON_VISIBLE_TEXT_TAGS.has(tagName))
+                nonVisibleTextDepth += 1;
+            if (node.sourceCodeLocation?.startTag)
+                tagsExamined += 1;
+            appendStructureToken(htmlElement && VOID_TAGS.has(tagName) ? `${tagName}/` : tagName);
+            if (htmlElement && tagName === 'head') {
+                insideHead = true;
+                insideExplicitHead = Boolean(node.sourceCodeLocation?.startTag);
             }
-            if (!insideExplicitHead && !headScopeClosed && !token.selfClosing && IMPLICIT_HEAD_TEXT_TAGS.has(tagName)) {
-                implicitHeadTextDepth += 1;
+            const inPublicationHead = insideHead;
+            const attributes = [];
+            let attributeLength = 0;
+            for (const attribute of node.attrs) {
+                attributeLength += attribute.name.length + attribute.value.length;
+                if (attributes.length >= MAX_ATTRIBUTES_PER_TAG || attributeLength > MAX_TAG_LENGTH)
+                    break;
+                attributes.push({ name: attribute.name, value: attribute.value });
             }
-            const inPublicationHead = insideExplicitHead || (!headScopeClosed && !bodyContentStarted && HEAD_CONTEXT_TAGS.has(tagName));
-            if (tagName === 'base' && inPublicationHead && baseHrefState === 'absent') {
+            const element = {
+                name: tagName, html: htmlElement, attributes,
+                attributesTruncated: attributes.length !== node.attrs.length,
+                parent: elementStack.at(-1) ?? null, inHead: insideHead,
+            };
+            elementStack.push(elements.length);
+            elements.push(element);
+            appendToken({ kind: 'start', element });
+            // Foreign drawing attributes are not HTML technology, form or resource
+            // inputs. Their per-element omission still reaches fingerprinting, but
+            // must not make unrelated HTML evidence incomplete.
+            if (htmlElement && element.attributesTruncated)
+                tagLimitReached = true;
+            if (!htmlElement)
+                continue;
+            if (tagName === 'link') {
+                const rel = node.attrs.find((attribute) => attribute.name === 'rel')?.value;
+                const href = node.attrs.find((attribute) => attribute.name === 'href')?.value.trim();
+                if (rel && rel.length <= 128 && href) {
+                    const relations = rel.toLowerCase().split(/[\t\n\f\r ]+/u);
+                    const priority = relations.includes('icon') ? 0
+                        : relations.some((relation) => ['apple-touch-icon', 'apple-touch-icon-precomposed'].includes(relation)) ? 1 : null;
+                    // Inline image bytes have their own bound; the general 4 KiB
+                    // attribute projection must not silently discard supported icons.
+                    const maxHref = /^data:/iu.test(href) ? MAX_FAVICON_BYTES * 3 + 128 : 2048;
+                    if (priority !== null && iconCounts[priority] < MAX_FAVICON_CANDIDATES && href.length <= maxHref) {
+                        iconLinks.push({ href, priority });
+                        iconCounts[priority] += 1;
+                    }
+                }
+            }
+            // The first document base applies even when it appears in the body;
+            // publication metadata's separate head-only policy does not govern URLs.
+            if (tagName === 'base' && baseHrefState === 'absent') {
                 const href = attributeValue(token.attrs, 'href', MAX_FORM_ATTRIBUTE_LENGTH, false);
                 if (href.truncated && !href.present) {
                     effectiveBaseUrl = documentUrl;
@@ -408,7 +433,7 @@ function analyzeStaticHtml(value, options = {}) {
                     }
                 }
             }
-            if (tagName === 'title' && titleDepth === 0 && titleParts.length === 0)
+            if (tagName === 'title' && titleParts.length === 0)
                 titleDepth = 1;
             if (/^h[1-6]$/u.test(tagName)) {
                 const key = tagName;
@@ -450,10 +475,10 @@ function analyzeStaticHtml(value, options = {}) {
                 if (candidate.candidate)
                     publicationMetadata.renderBlockingCandidates.stylesheet += 1;
             }
-            if (tagName === 'meta' && insideExplicitHead) {
+            if (tagName === 'meta' && insideHead) {
                 const httpEquiv = attributeValue(token.attrs, 'http-equiv', 64);
                 if (httpEquiv.value === 'content-security-policy') {
-                    const content = attributeValue(token.attrs, 'content', MAX_RESPONSE_POLICY_HEADER_BYTES);
+                    const content = attributeValue(token.attrs, 'content', MAX_RESPONSE_POLICY_HEADER_BYTES, false);
                     if (content.value === null || !content.value) {
                         cspMetaLimitReached = cspMetaLimitReached || content.present || content.truncated;
                     }
@@ -584,16 +609,6 @@ function analyzeStaticHtml(value, options = {}) {
                     }
                 }
             }
-            if (markup.length < MAX_TECHNOLOGY_TAGS) {
-                const serialized = serializedStartTag(tagName, token.attrs);
-                if (serialized.limitReached)
-                    tagLimitReached = true;
-                if (serialized.markup)
-                    markup.push(serialized.markup);
-            }
-            else {
-                tagLimitReached = true;
-            }
             if (tagName === 'form') {
                 if (forms.formsObserved >= MAX_STATIC_FORMS) {
                     forms.truncated = true;
@@ -624,13 +639,13 @@ function analyzeStaticHtml(value, options = {}) {
             }
             if (tagName !== 'script') {
                 activeInlineScript = null;
-                return;
+                continue;
             }
             scriptElementSeen = true;
             if (scripts.length >= MAX_SCRIPT_ELEMENTS) {
                 scriptLimitReached = true;
                 activeInlineScript = null;
-                return;
+                continue;
             }
             const reference = scriptReference(token.attrs);
             const script = {
@@ -640,54 +655,8 @@ function analyzeStaticHtml(value, options = {}) {
             };
             scripts.push(script);
             activeInlineScript = reference ? null : script;
-        },
-        onEndTag(token) {
-            const tagName = token.tagName.toLowerCase();
-            if (tagName === 'script')
-                activeInlineScript = null;
-            if (tagName === 'title' && titleDepth > 0)
-                titleDepth = 0;
-            if (tagName === 'head') {
-                insideExplicitHead = false;
-                headScopeClosed = true;
-            }
-            if (!insideExplicitHead && IMPLICIT_HEAD_TEXT_TAGS.has(tagName) && implicitHeadTextDepth > 0) {
-                implicitHeadTextDepth -= 1;
-            }
-            if (!VOID_TAGS.has(tagName))
-                appendStructureToken(`/${tagName}`);
-            if (NON_VISIBLE_TEXT_TAGS.has(tagName) && nonVisibleTextDepth > 0)
-                nonVisibleTextDepth -= 1;
-        },
-        onCharacter(token) {
-            if (!insideExplicitHead && !headScopeClosed && implicitHeadTextDepth === 0 && token.chars.trim()) {
-                bodyContentStarted = true;
-                headScopeClosed = true;
-            }
-            appendInlineScript(token.chars);
-            appendTitle(token.chars);
-            appendVisibleText(token.chars);
-        },
-        onNullCharacter(token) {
-            if (!insideExplicitHead && !headScopeClosed && implicitHeadTextDepth === 0) {
-                bodyContentStarted = true;
-                headScopeClosed = true;
-            }
-            appendInlineScript(token.chars);
-            appendTitle(token.chars);
-            appendVisibleText(token.chars);
-        },
-        onWhitespaceCharacter(token) {
-            appendInlineScript(token.chars);
-            appendTitle(token.chars);
-            appendVisibleText(token.chars);
-        },
-        onComment() { },
-        onDoctype() { },
-        onEof() { },
-    };
-    tokenizer = new Tokenizer({ sourceCodeLocationInfo: false }, handler);
-    tokenizer.write(html, true);
+        }
+    }
     for (const attributes of pendingFormActions) {
         const action = formAction(attributes, effectiveBaseUrl, documentUrl?.origin ?? null);
         forms.actions[action.relationship] += 1;
@@ -723,11 +692,13 @@ function analyzeStaticHtml(value, options = {}) {
             const value = titleParts.join('').replace(CONTROL_CHARACTER_RE_GLOBAL, ' ').replace(/\ufffd/gu, ' ').replace(/\s+/gu, ' ').trim();
             if (!value)
                 return null;
-            return value.length > 200 ? `${value.slice(0, 200)}…` : value;
+            return value.length > 200 ? `${value.slice(0, 199)}…` : value;
         })(),
         effectiveBaseUrl: effectiveBaseUrl?.toString() ?? null,
         baseHrefState,
-        markup: markup.join('\n'),
+        elements,
+        iconLinks: iconLinks.sort((left, right) => left.priority - right.priority).slice(0, MAX_FAVICON_CANDIDATES),
+        tokens,
         visibleText: visibleTextParts.join('').replace(CONTROL_CHARACTER_RE_GLOBAL, ' ').replace(/\s+/gu, ' '),
         structureTokens,
         scripts,
@@ -745,4 +716,4 @@ function analyzeStaticHtml(value, options = {}) {
         inlineCharactersExamined,
     };
 }
-export { MAX_ATTRIBUTES_PER_TAG, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_SCRIPT_MEDIA_TYPE_LENGTH, MAX_STATIC_FORMS, MAX_STATIC_HTML_CHARS, MAX_STATIC_INPUTS, MAX_STATIC_PUBLICATION_META_ELEMENTS, MAX_STATIC_PUBLICATION_DECLARATIONS, MAX_STATIC_ROBOTS_DIRECTIVES, MAX_STATIC_HTML_TAGS, MAX_STATIC_STRUCTURE_TOKENS, MAX_STATIC_VISIBLE_TEXT_CHARS, MAX_TAG_LENGTH, MAX_TECHNOLOGY_TAGS, analyzeStaticHtml, };
+export { MAX_ATTRIBUTES_PER_TAG, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_SCRIPT_REFERENCE_LENGTH, MAX_SCRIPT_MEDIA_TYPE_LENGTH, MAX_STATIC_FORMS, MAX_STATIC_HTML_CHARS, MAX_STATIC_INPUTS, MAX_STATIC_PUBLICATION_META_ELEMENTS, MAX_STATIC_PUBLICATION_DECLARATIONS, MAX_STATIC_ROBOTS_DIRECTIVES, MAX_STATIC_HTML_TAGS, MAX_STATIC_STRUCTURE_TOKENS, MAX_STATIC_VISIBLE_TEXT_CHARS, MAX_TAG_LENGTH, analyzeStaticHtml, };

package/lib/structured-data-identity.mjs

@@ -6,7 +6,7 @@
 import { domainToASCII } from 'node:url';
 import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_STRUCTURED_DATA_ENTITIES, MAX_STRUCTURED_DATA_SAME_AS_HOSTS, STRUCTURED_DATA_IDENTITY_VERSION, } from "./lookup-child-profile-contract.mjs";
-import { isUriShapedLabel } from "./portable-generator.mjs";
+import { isUriShapedLabel } from "../packages/analysis/portable-generator.mjs";
 import { analyzeStaticHtml, } from "./static-html-analysis.mjs";
 const MAX_STRUCTURED_DATA_SCRIPTS = 8;
 const MAX_STRUCTURED_DATA_SCRIPT_CHARS = 16_384;
@@ -290,6 +290,7 @@ function analyzeStructuredDataIdentity(input = {}) {
     }
     const truncated = input.sourceTruncated === true
         || htmlAnalysis.inputLimitReached
+        || htmlAnalysis.tagLimitReached
         || htmlAnalysis.scriptLimitReached
         || htmlAnalysis.inlineLimitReached
         || limitReached;

package/lib/technology-markup.mjs

@@ -0,0 +1,100 @@
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+export function attributeValue(element, name) {
+    return element.attributes.find((attribute) => attribute.name === name)?.value.toLowerCase() ?? '';
+}
+export function hasAttributes(element, ...names) {
+    return element.attributes.some((attribute) => names.includes(attribute.name));
+}
+function httpUrl(value, base) {
+    if (typeof value !== 'string' || value.length > 2048 || CONTROL_RE.test(value) || !value.trim())
+        return null;
+    try {
+        const url = new URL(value, base);
+        return ['http:', 'https:'].includes(url.protocol) && !url.username && !url.password ? url : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function createTechnologyMarkupContext(analysis, effectiveBaseUrl, documentOrigin) {
+    const elements = analysis.elements.filter((element) => element.html && element.name !== 'template');
+    const documentUrl = httpUrl(documentOrigin);
+    const suppliedBase = effectiveBaseUrl ?? analysis.effectiveBaseUrl;
+    const base = httpUrl(suppliedBase) ?? documentUrl;
+    // A reserved base permits legacy minimised relative references without
+    // attributing an absolute external URL to an unknown document origin.
+    const resolutionBase = base ?? new URL('https://document.invalid/');
+    const references = (element, names) => (element.attributes.flatMap((attribute) => {
+        if (!names.includes(attribute.name))
+            return [];
+        if (attribute.value.trim().startsWith('#'))
+            return [];
+        const url = httpUrl(attribute.value, resolutionBase);
+        if (!url)
+            return [];
+        const relative = !/^(?:[a-z][a-z0-9+.-]*:|\/\/)/iu.test(attribute.value.trim());
+        const embedded = documentUrl
+            ? url.origin !== documentUrl.origin
+            : Boolean(base || suppliedBase || documentOrigin) || !relative;
+        return [{ url, embedded }];
+    }));
+    const resources = [];
+    const navigation = [];
+    for (const element of elements) {
+        switch (element.name) {
+            case 'script':
+            case 'img':
+            case 'iframe':
+            case 'frame':
+            case 'source':
+            case 'audio':
+            case 'embed':
+                resources.push(...references(element, ['src']));
+                break;
+            case 'video':
+                resources.push(...references(element, ['src', 'poster']));
+                break;
+            case 'link': {
+                const relations = attributeValue(element, 'rel').trim().split(/\s+/u);
+                // Existing minimised inputs retain a link reference without its rel.
+                // Explicit document metadata or navigation relations are not assets.
+                if (!hasAttributes(element, 'rel') || relations.some((relation) => ['stylesheet', 'preload', 'modulepreload', 'icon'].includes(relation))) {
+                    resources.push(...references(element, ['href']));
+                }
+                break;
+            }
+            case 'object':
+                resources.push(...references(element, ['data']));
+                break;
+            case 'input':
+                if (attributeValue(element, 'type') === 'image')
+                    resources.push(...references(element, ['src']));
+                break;
+            case 'a':
+            case 'area':
+                navigation.push(...references(element, ['href']));
+                break;
+        }
+    }
+    return { elements, resources, navigation };
+}
+export function elementMarker(matches, reviewMarkup) {
+    return { matches: ({ elements }) => elements.some(matches), reviewMarkup };
+}
+export function resourceMarker(matches, reviewPath) {
+    const sharedOrigin = reviewPath.startsWith('https://');
+    return {
+        matches: ({ resources }) => resources.some(({ url }) => matches(url)),
+        embedded: ({ resources }) => sharedOrigin || !resources.some(({ url, embedded }) => !embedded && matches(url)),
+        reviewMarkup: `<link href="${reviewPath}">`,
+        embeddedReviewMarkup: `<link href="${sharedOrigin ? reviewPath : `https://embedded.invalid${reviewPath}`}">`,
+    };
+}
+export function navigationMarker(matches, reviewPath) {
+    return {
+        matches: ({ navigation }) => navigation.some(({ url }) => matches(url)),
+        embedded: ({ navigation }) => !navigation.some(({ url, embedded }) => !embedded && matches(url)),
+        reviewMarkup: `<a href="${reviewPath}"></a>`,
+        embeddedReviewMarkup: `<a href="https://embedded.invalid/${reviewPath}"></a>`,
+    };
+}