agent-sanitizer 2.63.1 → 2.64.1

package/LICENSE-THIRD-PARTY

@@ -26,3 +26,30 @@ IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+src/css-syntax-data.mjs
+  CSS value grammars extracted by scripts/gen-css-syntax.mjs from
+  css-tree@3.2.1's definition-syntax-data (mdn-data@2.27.1, CC0 1.0, plus
+  css-tree's own patch). css-tree's licence follows.
+
+(The MIT License)
+
+Copyright (C) 2016-2026 by Roman Dvornov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/THREAT-MODEL.md

@@ -142,9 +142,13 @@ exfil-shaped URLs.
 
 ## Layer 3—exfil URLs (detection only)
 
-Report—never rewrite—URLs in markdown links/images/definitions and HTML
-attributes (`src`/`href`/`background`/`srcset`/`ping`, form `action`/`formaction`,
-`meta refresh`) that are shaped to carry data off-origin:
+Report—never rewrite—URLs in markdown links/images/definitions, every HTML/SVG
+URL attribute in `src/url-attributes.mjs` (`src`, `href`, `xlink:href`,
+`srcset`/`imagesrcset`, `ping`, `poster`, `object data`, form
+`action`/`formaction`, `meta refresh`, …), CSS `url()` in `style` attributes and
+`<style>` elements, and the same again inside HTML comments, that are shaped to
+carry data off-origin. A URL's scheme is read by the WHATWG URL parser, and
+`srcset` and `meta refresh` by ports of the HTML Standard's own parsing steps:
 
 - suspicious query/fragment parameters (long base64/hex blobs, credential-shaped
   tokens), tuned to skip request-signing / pagination / analytics parameters

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.63.1",
+  "version": "2.64.1",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/src/cf-charset.mjs

@@ -1,13 +1,14 @@
 /**
- * GENERATED by scripts/gen-invisible-charset.mjs from the pinned UCD
- * (General_Category=Cf, Unicode 17.0.0) — DO NOT EDIT.
+ * GENERATED by scripts/gen-cf-charset.mjs from the pinned UCD
+ * (General_Category=Cf, Unicode 17.0.0) at install, pack and build
+ * time; git-ignored, never committed — DO NOT EDIT.
  *
  * The general-category Cf code points, PINNED at generation time. invisible.mjs
  * strips exactly this set instead of asking the runtime for Cf, and the Python port
  * reads the SAME set from data/invisible-charset.json's `cf_codepoints`, so both
  * layers strip an identical Cf set regardless of each runtime's own Unicode
- * version. Regenerate with `node scripts/gen-invisible-charset.mjs`;
- * test/invisible-charset.test.mjs fails if this drifts from the pinned UCD.
+ * version. Regenerate with `node scripts/gen-cf-charset.mjs` (`pnpm install`
+ * does).
  */
 
 export const UNICODE_VERSION = "17.0.0";

package/src/css-syntax-data.mjs

@@ -0,0 +1,274 @@
+/** GENERATED by scripts/gen-css-syntax.mjs — DO NOT EDIT (mdn-data, CC0). */
+// Stryker disable all — generated; its correctness is the round-trip test.
+/** @type {{ types: Record<string, string>, properties: Record<string, string> }} */
+export const CSS_SYNTAX = {
+  types: {
+    "-legacy-gradient": "<-webkit-gradient()> | <-legacy-linear-gradient> | <-legacy-repeating-linear-gradient> | <-legacy-radial-gradient> | <-legacy-repeating-radial-gradient>",
+    "-legacy-linear-gradient": "-moz-linear-gradient( <-legacy-linear-gradient-arguments> ) | -webkit-linear-gradient( <-legacy-linear-gradient-arguments> ) | -o-linear-gradient( <-legacy-linear-gradient-arguments> )",
+    "-legacy-linear-gradient-arguments": "[ <angle> | <side-or-corner> ]? , <color-stop-list>",
+    "-legacy-radial-gradient": "-moz-radial-gradient( <-legacy-radial-gradient-arguments> ) | -webkit-radial-gradient( <-legacy-radial-gradient-arguments> ) | -o-radial-gradient( <-legacy-radial-gradient-arguments> )",
+    "-legacy-radial-gradient-arguments": "[ <position> , ]? [ [ [ <-legacy-radial-gradient-shape> || <-legacy-radial-gradient-size> ] | [ <length> | <percentage> ]{2} ] , ]? <color-stop-list>",
+    "-legacy-radial-gradient-shape": "circle | ellipse",
+    "-legacy-radial-gradient-size": "closest-side | closest-corner | farthest-side | farthest-corner | contain | cover",
+    "-legacy-repeating-linear-gradient": "-moz-repeating-linear-gradient( <-legacy-linear-gradient-arguments> ) | -webkit-repeating-linear-gradient( <-legacy-linear-gradient-arguments> ) | -o-repeating-linear-gradient( <-legacy-linear-gradient-arguments> )",
+    "-legacy-repeating-radial-gradient": "-moz-repeating-radial-gradient( <-legacy-radial-gradient-arguments> ) | -webkit-repeating-radial-gradient( <-legacy-radial-gradient-arguments> ) | -o-repeating-radial-gradient( <-legacy-radial-gradient-arguments> )",
+    "-ms-filter-function": "<-ms-filter-function-progid> | <-ms-filter-function-legacy>",
+    "-ms-filter-function-legacy": "<ident-token> | <function-token> <any-value>? )",
+    "-ms-filter-function-list": "<-ms-filter-function>+",
+    "-ms-filter-function-progid": "'progid:' [ <ident-token> '.' ]* [ <ident-token> | <function-token> <any-value>? ) ]",
+    "-non-standard-color": "-moz-ButtonDefault | -moz-ButtonHoverFace | -moz-ButtonHoverText | -moz-CellHighlight | -moz-CellHighlightText | -moz-Combobox | -moz-ComboboxText | -moz-Dialog | -moz-DialogText | -moz-dragtargetzone | -moz-EvenTreeRow | -moz-Field | -moz-FieldText | -moz-html-CellHighlight | -moz-html-CellHighlightText | -moz-mac-accentdarkestshadow | -moz-mac-accentdarkshadow | -moz-mac-accentface | -moz-mac-accentlightesthighlight | -moz-mac-accentlightshadow | -moz-mac-accentregularhighlight | -moz-mac-accentregularshadow | -moz-mac-chrome-active | -moz-mac-chrome-inactive | -moz-mac-focusring | -moz-mac-menuselect | -moz-mac-menushadow | -moz-mac-menutextselect | -moz-MenuHover | -moz-MenuHoverText | -moz-MenuBarText | -moz-MenuBarHoverText | -moz-nativehyperlinktext | -moz-OddTreeRow | -moz-win-communicationstext | -moz-win-mediatext | -moz-activehyperlinktext | -moz-default-background-color | -moz-default-color | -moz-hyperlinktext | -moz-visitedhyperlinktext | -webkit-activelink | -webkit-focus-ring-color | -webkit-link | -webkit-text",
+    "-non-standard-display": "-ms-inline-flexbox | -ms-grid | -ms-inline-grid | -webkit-flex | -webkit-inline-flex | -webkit-box | -webkit-inline-box | -moz-inline-stack | -moz-box | -moz-inline-box",
+    "-non-standard-font": "-apple-system-body | -apple-system-headline | -apple-system-subheadline | -apple-system-caption1 | -apple-system-caption2 | -apple-system-footnote | -apple-system-short-body | -apple-system-short-headline | -apple-system-short-subheadline | -apple-system-short-caption1 | -apple-system-short-footnote | -apple-system-tall-body",
+    "-non-standard-generic-family": "-apple-system | BlinkMacSystemFont",
+    "-non-standard-overflow": "overlay | -moz-scrollbars-none | -moz-scrollbars-horizontal | -moz-scrollbars-vertical | -moz-hidden-unscrollable",
+    "-non-standard-size": "intrinsic | min-intrinsic | -webkit-fill-available | -webkit-fit-content | -webkit-min-content | -webkit-max-content  | -moz-available | -moz-fit-content | -moz-min-content | -moz-max-content",
+    "-webkit-gradient()": "-webkit-gradient( <-webkit-gradient-type>, <-webkit-gradient-point> [, <-webkit-gradient-point> | , <-webkit-gradient-radius>, <-webkit-gradient-point> ] [, <-webkit-gradient-radius>]? [, <-webkit-gradient-color-stop>]* )",
+    "-webkit-gradient-color-stop": "from( <color> ) | color-stop( [ <number-zero-one> | <percentage> ] , <color> ) | to( <color> )",
+    "-webkit-gradient-point": "[ left | center | right | <length-percentage> ] [ top | center | bottom | <length-percentage> ]",
+    "-webkit-gradient-radius": "<length> | <percentage>",
+    "-webkit-gradient-type": "linear | radial",
+    "absolute-size": "xx-small | x-small | small | medium | large | x-large | xx-large | xxx-large",
+    "alpha-value": "<number> | <percentage>",
+    "anchor()": "anchor( <anchor-name>? && <anchor-side>, <length-percentage>? )",
+    "anchor-name": "<dashed-ident>",
+    "anchor-side": "inside | outside | top | left | right | bottom | start | end | self-start | self-end | <percentage> | center",
+    "anchor-size()": "anchor-size( [ <anchor-name> || <anchor-size> ]? , <length-percentage>? )",
+    "anchor-size": "width | height | block | inline | self-block | self-inline",
+    "angle-percentage": "<angle> | <percentage>",
+    "angular-color-hint": "<angle-percentage> | <zero>",
+    "angular-color-stop": "<color> <color-stop-angle>?",
+    "angular-color-stop-list": "<angular-color-stop> , [ <angular-color-hint>? , <angular-color-stop> ]#?",
+    "attachment": "scroll | fixed | local",
+    "basic-shape": "<inset()> | <xywh()> | <rect()> | <circle()> | <ellipse()> | <polygon()> | <path()>",
+    "bg-clip": "<visual-box> | border-area | text",
+    "bg-image": "<image> | none",
+    "bg-layer": "<bg-image> || <bg-position> [ / <bg-size> ]? || <repeat-style> || <attachment> || <visual-box> || <visual-box>",
+    "bg-position": "[ [ left | center | right | top | bottom | <length-percentage> ] | [ left | center | right | <length-percentage> ] [ top | center | bottom | <length-percentage> ] | [ center | [ left | right ] <length-percentage>? ] && [ center | [ top | bottom ] <length-percentage>? ] ]",
+    "bg-size": "[ <length-percentage [0,∞]> | auto ]{1,2} | cover | contain",
+    "blur()": "blur( <length>? )",
+    "bottom": "<length> | auto",
+    "brightness()": "brightness( [ <number> | <percentage> ]? )",
+    "calc-constant": "e | pi | infinity | -infinity | NaN",
+    "calc-product": "<calc-value> [ '*' <calc-value> | '/' <number> ]*",
+    "calc-size()": "calc-size( <calc-size-basis>, <calc-sum> )",
+    "calc-size-basis": "<intrinsic-size-keyword> | <calc-size()> | any | <calc-sum>",
+    "calc-sum": "<calc-product> [ [ '+' | '-' ] <calc-product> ]*",
+    "calc-value": "<number> | <dimension> | <percentage> | <calc-constant> | ( <calc-sum> )",
+    "cf-final-image": "<image> | <color>",
+    "cf-mixing-image": "<percentage>? && <image>",
+    "circle()": "circle( <radial-size>? [ at <position> ]? )",
+    "clip-source": "<url>",
+    "cmyk-component": "<number> | <percentage> | none",
+    "color()": "color( <colorspace-params> [ / [ <alpha-value> | none ] ]? )",
+    "color": "<color-base> | currentColor | <system-color> | <device-cmyk()>  | <light-dark()> | <-non-standard-color>",
+    "color-base": "<hex-color> | <color-function> | <named-color> | <color-mix()> | transparent",
+    "color-function": "<rgb()> | <rgba()> | <hsl()> | <hsla()> | <hwb()> | <lab()> | <lch()> | <oklab()> | <oklch()> | <color()>",
+    "color-interpolation-method": "in [ <rectangular-color-space> | <polar-color-space> <hue-interpolation-method>? | <custom-color-space> ]",
+    "color-mix()": "color-mix( <color-interpolation-method> , [ <color> && <percentage [0,100]>? ]#{2} )",
+    "color-stop-angle": "[ <angle-percentage> | <zero> ]{1,2}",
+    "color-stop-length": "<length-percentage>{1,2}",
+    "color-stop-list": "<linear-color-stop> , [ <linear-color-hint>? , <linear-color-stop> ]#?",
+    "colorspace-params": "[ <predefined-rgb-params> | <xyz-params>]",
+    "conic-gradient()": "conic-gradient( [ <conic-gradient-syntax> ] )",
+    "conic-gradient-syntax": "[ [ [ from [ <angle> | <zero> ] ]? [ at <position> ]? ] || <color-interpolation-method> ]? , <angular-color-stop-list>",
+    "contrast()": "contrast( [ <number> | <percentage> ]? )",
+    "cross-fade()": "cross-fade( <cf-mixing-image> , <cf-final-image>? )",
+    "custom-color-space": "<dashed-ident>",
+    "device-cmyk()": "<legacy-device-cmyk-syntax> | <modern-device-cmyk-syntax>",
+    "display-box": "contents | none",
+    "display-inside": "flow | flow-root | table | flex | grid | ruby",
+    "display-internal": "table-row-group | table-header-group | table-footer-group | table-row | table-cell | table-column-group | table-column | table-caption | ruby-base | ruby-text | ruby-base-container | ruby-text-container",
+    "display-legacy": "inline-block | inline-list-item | inline-table | inline-flex | inline-grid",
+    "display-listitem": "<display-outside>? && [ flow | flow-root ]? && list-item",
+    "display-outside": "block | inline | run-in",
+    "drop-shadow()": "drop-shadow( [ <color>? && <length>{2,3} ] )",
+    "element()": "element( <custom-ident> , [ first | start | last | first-except ]? ) | element( <id-selector> )",
+    "ellipse()": "ellipse( <radial-size>? [ at <position> ]? )",
+    "family-name": "<string> | <custom-ident>+",
+    "filter-function": "<blur()> | <brightness()> | <contrast()> | <drop-shadow()> | <grayscale()> | <hue-rotate()> | <invert()> | <opacity()> | <saturate()> | <sepia()>",
+    "filter-value-list": "[ <filter-function> | <url> ]+",
+    "final-bg-layer": "<bg-image> || <bg-position> [ / <bg-size> ]? || <repeat-style> || <attachment> || <visual-box> || <visual-box> || <'background-color'>",
+    "font-variant-css2": "normal | small-caps",
+    "font-weight-absolute": "normal | bold | <number [1,1000]>",
+    "font-width-css3": "normal | ultra-condensed | extra-condensed | condensed | semi-condensed | semi-expanded | expanded | extra-expanded | ultra-expanded",
+    "generic-complete": "serif | sans-serif | system-ui | cursive | fantasy | math | monospace",
+    "generic-family": "<generic-script-specific>| <generic-complete> | <generic-incomplete> | <-non-standard-generic-family>",
+    "generic-incomplete": "ui-serif | ui-sans-serif | ui-monospace | ui-rounded",
+    "generic-script-specific": "generic(kai) | generic(fangsong) | generic(nastaliq)",
+    "geometry-box": "<shape-box> | fill-box | stroke-box | view-box",
+    "gradient": "<linear-gradient()> | <repeating-linear-gradient()> | <radial-gradient()> | <repeating-radial-gradient()> | <conic-gradient()> | <repeating-conic-gradient()> | <-legacy-gradient>",
+    "grayscale()": "grayscale( [ <number> | <percentage> ]? )",
+    "hsl()": "hsl( <hue>, <percentage>, <percentage>, <alpha-value>? ) | hsl( [ <hue> | none ] [ <percentage> | <number> | none ] [ <percentage> | <number> | none ] [ / [ <alpha-value> | none ] ]? )",
+    "hsla()": "hsla( <hue>, <percentage>, <percentage>, <alpha-value>? ) | hsla( [ <hue> | none ] [ <percentage> | <number> | none ] [ <percentage> | <number> | none ] [ / [ <alpha-value> | none ] ]? )",
+    "hue": "<number> | <angle>",
+    "hue-interpolation-method": "[ shorter | longer | increasing | decreasing ] hue",
+    "hue-rotate()": "hue-rotate( [ <angle> | <zero> ]? )",
+    "hwb()": "hwb( [ <hue> | none ] [ <percentage> | <number> | none ] [ <percentage> | <number> | none ] [ / [ <alpha-value> | none ] ]? )",
+    "id-selector": "<hash-token>",
+    "image()": "image( <image-tags>? [ <image-src>? , <color>? ]! )",
+    "image": "<url> | <image()> | <image-set()> | <element()> | <paint()> | <cross-fade()> | <gradient>",
+    "image-set()": "image-set( <image-set-option># )",
+    "image-set-option": "[ <image> | <string> ] [ <resolution> || type(<string>) ]",
+    "image-src": "<url> | <string>",
+    "image-tags": "ltr | rtl",
+    "inset()": "inset( <length-percentage>{1,4} [ round <'border-radius'> ]? )",
+    "intrinsic-size-keyword": "min-content | max-content | fit-content",
+    "invert()": "invert( [ <number> | <percentage> ]? )",
+    "lab()": "lab( [<percentage> | <number> | none] [ <percentage> | <number> | none] [ <percentage> | <number> | none] [ / [<alpha-value> | none] ]? )",
+    "lch()": "lch( [<percentage> | <number> | none] [ <percentage> | <number> | none] [ <hue> | none] [ / [<alpha-value> | none] ]? )",
+    "left": "<length> | auto",
+    "legacy-device-cmyk-syntax": "device-cmyk( <number>#{4} )",
+    "length-percentage": "<length> | <percentage>",
+    "light-dark()": "light-dark( <color>, <color> )",
+    "line-style": "none | hidden | dotted | dashed | solid | double | groove | ridge | inset | outset",
+    "line-width": "<length> | thin | medium | thick",
+    "linear-color-hint": "<length-percentage>",
+    "linear-color-stop": "<color> <color-stop-length>?",
+    "linear-gradient()": "linear-gradient( [ <linear-gradient-syntax> ] )",
+    "linear-gradient-syntax": "[ [ <angle> | <zero> | to <side-or-corner> ] || <color-interpolation-method> ]? , <color-stop-list>",
+    "matrix()": "matrix( <number>#{6} )",
+    "matrix3d()": "matrix3d( <number>#{16} )",
+    "modern-device-cmyk-syntax": "device-cmyk( <cmyk-component>{4} [ / [ <alpha-value> | none ] ]? )",
+    "named-color": "aliceblue | antiquewhite | aqua | aquamarine | azure | beige | bisque | black | blanchedalmond | blue | blueviolet | brown | burlywood | cadetblue | chartreuse | chocolate | coral | cornflowerblue | cornsilk | crimson | cyan | darkblue | darkcyan | darkgoldenrod | darkgray | darkgreen | darkgrey | darkkhaki | darkmagenta | darkolivegreen | darkorange | darkorchid | darkred | darksalmon | darkseagreen | darkslateblue | darkslategray | darkslategrey | darkturquoise | darkviolet | deeppink | deepskyblue | dimgray | dimgrey | dodgerblue | firebrick | floralwhite | forestgreen | fuchsia | gainsboro | ghostwhite | gold | goldenrod | gray | green | greenyellow | grey | honeydew | hotpink | indianred | indigo | ivory | khaki | lavender | lavenderblush | lawngreen | lemonchiffon | lightblue | lightcoral | lightcyan | lightgoldenrodyellow | lightgray | lightgreen | lightgrey | lightpink | lightsalmon | lightseagreen | lightskyblue | lightslategray | lightslategrey | lightsteelblue | lightyellow | lime | limegreen | linen | magenta | maroon | mediumaquamarine | mediumblue | mediumorchid | mediumpurple | mediumseagreen | mediumslateblue | mediumspringgreen | mediumturquoise | mediumvioletred | midnightblue | mintcream | mistyrose | moccasin | navajowhite | navy | oldlace | olive | olivedrab | orange | orangered | orchid | palegoldenrod | palegreen | paleturquoise | palevioletred | papayawhip | peachpuff | peru | pink | plum | powderblue | purple | rebeccapurple | red | rosybrown | royalblue | saddlebrown | salmon | sandybrown | seagreen | seashell | sienna | silver | skyblue | slateblue | slategray | slategrey | snow | springgreen | steelblue | tan | teal | thistle | tomato | turquoise | violet | wheat | white | whitesmoke | yellow | yellowgreen",
+    "number-zero-one": "<number [0,1]>",
+    "oklab()": "oklab( [ <percentage> | <number> | none] [ <percentage> | <number> | none] [ <percentage> | <number> | none] [ / [<alpha-value> | none] ]? )",
+    "oklch()": "oklch( [ <percentage> | <number> | none] [ <percentage> | <number> | none] [ <hue> | none] [ / [<alpha-value> | none] ]? )",
+    "opacity()": "opacity( [ <number> | <percentage> ]? )",
+    "opacity-value": "<number> | <percentage>",
+    "paint()": "paint( <ident>, <declaration-value>? )",
+    "path()": "path( <'fill-rule'>? , <string> )",
+    "perspective()": "perspective( [ <length [0,∞]> | none ] )",
+    "polar-color-space": "hsl | hwb | lch | oklch",
+    "polygon()": "polygon( <'fill-rule'>? , [ <length-percentage> <length-percentage> ]# )",
+    "position": "[ [ left | center | right ] || [ top | center | bottom ] | [ left | center | right | <length-percentage> ] [ top | center | bottom | <length-percentage> ]? | [ [ left | right ] <length-percentage> ] && [ [ top | bottom ] <length-percentage> ] ]",
+    "predefined-rgb": "srgb | srgb-linear | display-p3 | display-p3-linear | a98-rgb | prophoto-rgb | rec2020",
+    "predefined-rgb-params": "<predefined-rgb> [ <number> | <percentage> | none ]{3}",
+    "radial-extent": "closest-corner | closest-side | farthest-corner | farthest-side",
+    "radial-gradient()": "radial-gradient( [ <radial-gradient-syntax> ] )",
+    "radial-gradient-syntax": "[ [ [ <radial-shape> || <radial-size> ]? [ at <position> ]? ] || <color-interpolation-method> ]? , <color-stop-list>",
+    "radial-shape": "circle | ellipse",
+    "radial-size": "<radial-extent> | <length [0,∞]> | <length-percentage [0,∞]>{2}",
+    "rect()": "rect( [ <length-percentage> | auto ]{4} [ round <'border-radius'> ]? )",
+    "rectangular-color-space": "srgb | srgb-linear | display-p3 | display-p3-linear | a98-rgb | prophoto-rgb | rec2020 | lab | oklab | xyz | xyz-d50 | xyz-d65",
+    "relative-size": "larger | smaller",
+    "repeat-style": "repeat-x | repeat-y | [ repeat | space | round | no-repeat ]{1,2}",
+    "repeating-conic-gradient()": "repeating-conic-gradient( [ <conic-gradient-syntax> ] )",
+    "repeating-linear-gradient()": "repeating-linear-gradient( [ <linear-gradient-syntax> ] )",
+    "repeating-radial-gradient()": "repeating-radial-gradient( [ <radial-gradient-syntax> ] )",
+    "rgb()": "rgb( <percentage>#{3} , <alpha-value>? ) | rgb( <number>#{3} , <alpha-value>? ) | rgb( [ <number> | <percentage> | none ]{3} [ / [ <alpha-value> | none ] ]? )",
+    "rgba()": "rgba( <percentage>#{3} , <alpha-value>? ) | rgba( <number>#{3} , <alpha-value>? ) | rgba( [ <number> | <percentage> | none ]{3} [ / [ <alpha-value> | none ] ]? )",
+    "right": "<length> | auto",
+    "rotate()": "rotate( [ <angle> | <zero> ] )",
+    "rotate3d()": "rotate3d( <number> , <number> , <number> , [ <angle> | <zero> ] )",
+    "rotateX()": "rotateX( [ <angle> | <zero> ] )",
+    "rotateY()": "rotateY( [ <angle> | <zero> ] )",
+    "rotateZ()": "rotateZ( [ <angle> | <zero> ] )",
+    "saturate()": "saturate( [ <number> | <percentage> ]? )",
+    "scale()": "scale( [ <number> | <percentage> ]#{1,2} )",
+    "scale3d()": "scale3d( [ <number> | <percentage> ]#{3} )",
+    "scaleX()": "scaleX( [ <number> | <percentage> ] )",
+    "scaleY()": "scaleY( [ <number> | <percentage> ] )",
+    "scaleZ()": "scaleZ( [ <number> | <percentage> ] )",
+    "sepia()": "sepia( [ <number> | <percentage> ]? )",
+    "shape": "rect( <top>, <right>, <bottom>, <left> ) | rect( <top> <right> <bottom> <left> )",
+    "shape-box": "<visual-box> | margin-box",
+    "side-or-corner": "[ left | right ] || [ top | bottom ]",
+    "skew()": "skew( [ <angle> | <zero> ] , [ <angle> | <zero> ]? )",
+    "skewX()": "skewX( [ <angle> | <zero> ] )",
+    "skewY()": "skewY( [ <angle> | <zero> ] )",
+    "system-color": "AccentColor | AccentColorText | ActiveText | ButtonBorder | ButtonFace | ButtonText | Canvas | CanvasText | Field | FieldText | GrayText | Highlight | HighlightText | LinkText | Mark | MarkText | SelectedItem | SelectedItemText | VisitedText",
+    "system-family-name": "caption | icon | menu | message-box | small-caption | status-bar",
+    "top": "<length> | auto",
+    "transform-function": "<matrix()> | <translate()> | <translateX()> | <translateY()> | <scale()> | <scaleX()> | <scaleY()> | <rotate()> | <skew()> | <skewX()> | <skewY()> | <matrix3d()> | <translate3d()> | <translateZ()> | <scale3d()> | <scaleZ()> | <rotate3d()> | <rotateX()> | <rotateY()> | <rotateZ()> | <perspective()>",
+    "transform-list": "<transform-function>+",
+    "translate()": "translate( <length-percentage> , <length-percentage>? )",
+    "translate3d()": "translate3d( <length-percentage> , <length-percentage> , <length> )",
+    "translateX()": "translateX( <length-percentage> )",
+    "translateY()": "translateY( <length-percentage> )",
+    "translateZ()": "translateZ( <length> )",
+    "url": "url( <string> <url-modifier>* ) | <url-token>",
+    "url-modifier": "<ident> | <function-token> <any-value> )",
+    "visual-box": "content-box | padding-box | border-box",
+    "xywh()": "xywh( <length-percentage>{2} <length-percentage [0,∞]>{2} [ round <'border-radius'> ]? )",
+    "xyz-params": "<xyz-space> [ <number> | <percentage> | none ]{3}",
+    "xyz-space": "xyz | xyz-d50 | xyz-d65",
+  },
+  properties: {
+    "-webkit-background-clip": "[ <visual-box> | border | padding | content | text ]#",
+    "-webkit-text-fill-color": "<color>",
+    "-webkit-text-stroke": "<length> || <color>",
+    "-webkit-text-stroke-color": "<color>",
+    "all": "initial | inherit | unset | revert | revert-layer",
+    "background": "<bg-layer>#? , <final-bg-layer>",
+    "background-clip": "<bg-clip>#",
+    "background-color": "<color>",
+    "background-image": "<bg-image>#",
+    "border": "<line-width> || <line-style> || <color>",
+    "border-block": "<'border-block-start'>",
+    "border-block-end": "<'border-top-width'> || <'border-top-style'> || <color>",
+    "border-block-end-width": "<'border-top-width'>",
+    "border-block-start": "<'border-top-width'> || <'border-top-style'> || <color>",
+    "border-block-start-width": "<'border-top-width'>",
+    "border-block-width": "<'border-top-width'>{1,2}",
+    "border-bottom": "<line-width> || <line-style> || <color>",
+    "border-bottom-width": "<line-width>",
+    "border-inline": "<'border-block-start'>",
+    "border-inline-end": "<'border-top-width'> || <'border-top-style'> || <color>",
+    "border-inline-end-width": "<'border-top-width'>",
+    "border-inline-start": "<'border-top-width'> || <'border-top-style'> || <color>",
+    "border-inline-start-width": "<'border-top-width'>",
+    "border-inline-width": "<'border-top-width'>{1,2}",
+    "border-left": "<line-width> || <line-style> || <color>",
+    "border-left-width": "<line-width>",
+    "border-radius": "<length-percentage [0,∞]>{1,4} [ / <length-percentage [0,∞]>{1,4} ]?",
+    "border-right": "<line-width> || <line-style> || <color>",
+    "border-right-width": "<line-width>",
+    "border-top": "<line-width> || <line-style> || <color>",
+    "border-top-style": "<line-style>",
+    "border-top-width": "<line-width>",
+    "border-width": "<line-width>{1,4}",
+    "bottom": "auto | <length-percentage> | <anchor()> | <anchor-size()>",
+    "clip": "<shape> | auto",
+    "clip-path": "<clip-source> | [ <basic-shape> || <geometry-box> ] | none",
+    "color": "<color>",
+    "content-visibility": "visible | auto | hidden",
+    "display": "[ <display-outside> || <display-inside> ] | <display-listitem> | <display-internal> | <display-box> | <display-legacy> | <-non-standard-display>",
+    "fill-rule": "nonzero | evenodd",
+    "filter": "none | <filter-value-list> | <-ms-filter-function-list>",
+    "float": "left | right | none | inline-start | inline-end",
+    "font": "[ [ <'font-style'> || <font-variant-css2> || <'font-weight'> || <font-width-css3> ]? <'font-size'> [ / <'line-height'> ]? <'font-family'># ] | <system-family-name> | <-non-standard-font>",
+    "font-family": "[ <family-name> | <generic-family> ]#",
+    "font-size": "<absolute-size> | <relative-size> | <length-percentage [0,∞]> | math",
+    "font-style": "normal | italic | oblique <angle>?",
+    "font-weight": "<font-weight-absolute> | bolder | lighter",
+    "height": "auto | <length-percentage [0,∞]> | min-content | max-content | fit-content | fit-content(<length-percentage [0,∞]>) | <calc-size()> | <anchor-size()> | stretch | <-non-standard-size>",
+    "inset": "<'top'>{1,4}",
+    "left": "auto | <length-percentage> | <anchor()> | <anchor-size()>",
+    "line-height": "normal | <number> | <length> | <percentage>",
+    "max-height": "none | <length-percentage [0,∞]> | min-content | max-content | fit-content | fit-content(<length-percentage [0,∞]>) | <calc-size()> | <anchor-size()> | stretch | <-non-standard-size>",
+    "max-width": "none | <length-percentage [0,∞]> | min-content | max-content | fit-content | fit-content(<length-percentage [0,∞]>) | <calc-size()> | <anchor-size()> | stretch | <-non-standard-size>",
+    "opacity": "<opacity-value>",
+    "overflow": "[ visible | hidden | clip | scroll | auto ]{1,2} | <-non-standard-overflow>",
+    "padding": "<'padding-top'>{1,4}",
+    "padding-block": "<'padding-top'>{1,2}",
+    "padding-block-end": "<'padding-top'>",
+    "padding-block-start": "<'padding-top'>",
+    "padding-bottom": "<length-percentage [0,∞]>",
+    "padding-inline": "<'padding-top'>{1,2}",
+    "padding-inline-end": "<'padding-top'>",
+    "padding-inline-start": "<'padding-top'>",
+    "padding-left": "<length-percentage [0,∞]>",
+    "padding-right": "<length-percentage [0,∞]>",
+    "padding-top": "<length-percentage [0,∞]>",
+    "position": "static | relative | absolute | sticky | fixed | -webkit-sticky",
+    "right": "auto | <length-percentage> | <anchor()> | <anchor-size()>",
+    "text-indent": "<length-percentage> && hanging? && each-line?",
+    "top": "auto | <length-percentage> | <anchor()> | <anchor-size()>",
+    "transform": "none | <transform-list>",
+    "translate": "none | <length-percentage> [ <length-percentage> <length>? ]?",
+    "visibility": "visible | hidden | collapse",
+    "width": "auto | <length-percentage [0,∞]> | min-content | max-content | fit-content | fit-content(<length-percentage [0,∞]>) | <calc-size()> | <anchor-size()> | stretch | <-non-standard-size>",
+    "x": "<length> | <percentage>",
+  },
+};
+// Stryker restore all

package/src/html-tree-adapter.mjs

@@ -139,5 +139,117 @@ export function parseHtmlFragment(html) {
     treeAdapter: adapter,
   });
   settle();
-  return fromParse5(fragment, { file: new VFile(html) });
+  return fromParse5Bounded(fragment, new VFile(html));
+}
+
+/**
+ * How many levels of the tree one `fromParse5` call converts.
+ *
+ * WHY IT EXISTS — `hast-util-from-parse5` converts by recursion, three frames
+ * (`one` → `all` → `element`) per level, so how deep a tree it survives is
+ * whatever stack is left, and that depends on the JIT tier: a cold call's
+ * interpreted frames are bigger than an optimized one's. ~2500 nested elements
+ * overflowed on the first call in a process and converted fine on a later one,
+ * so the same document came back withheld or sanitized depending on what had
+ * run before it. 128 levels still convert cold on a 100 KB stack, a tenth of
+ * Node's default.
+ */
+export const CONVERT_DEPTH = 128;
+
+/**
+ * The deepest a node may sit below the fragment root; a deeper parse throws, so
+ * the caller fails closed on it.
+ *
+ * Conversion no longer limits depth (see {@link CONVERT_DEPTH}), so this is the
+ * one place that does, and it answers the same way at every JIT tier. No real
+ * document comes near it — Blink's parser flattens anything nested past 512 —
+ * and what lies past it is built to cost: parse5's scope checks walk the
+ * open-element stack per tag, so parsing is quadratic in depth.
+ */
+export const MAX_HTML_DEPTH = 4096;
+
+/**
+ * `fromParse5(tree, { file })`, recursing at most `chunkDepth` levels at a time.
+ *
+ * Every node a multiple of `chunkDepth` levels down is converted on its own,
+ * deepest first, and then stands in its parent's `childNodes` as a placeholder
+ * text node carrying the converted subtree's position — the one thing about a
+ * child its parent's conversion reads (an unclosed element ends where its last
+ * child does). One walk then swaps each placeholder for its subtree. The result
+ * is the tree a single `fromParse5` call returns, which
+ * `html-tree-adapter.test` holds it to.
+ *
+ * Mutates `tree`: {@link parseHtmlFragment} owns the parse and drops it after.
+ * @param {any} tree
+ * @param {VFile} file
+ * @param {number} [chunkDepth]
+ * @returns {any}
+ */
+export function fromParse5Bounded(tree, file, chunkDepth = CONVERT_DEPTH) {
+  /** @type {Array<{ siblings: any[], index: number }>} */
+  const cuts = [];
+  const stack = [{ node: tree, depth: 0 }];
+  while (stack.length > 0) {
+    const { node, depth } = /** @type {{ node: any, depth: number }} */ (
+      stack.pop()
+    );
+    if (depth > MAX_HTML_DEPTH)
+      throw new RangeError(`HTML nested deeper than ${MAX_HTML_DEPTH} levels`);
+    // A template's content is a root its template's conversion recurses into.
+    if (node.content) stack.push({ node: node.content, depth: depth + 1 });
+    const siblings = node.childNodes ?? [];
+    const childDepth = depth + 1;
+    for (let index = 0; index < siblings.length; index++) {
+      if (childDepth % chunkDepth === 0) cuts.push({ siblings, index });
+      stack.push({ node: siblings[index], depth: childDepth });
+    }
+  }
+  // The walk reaches a cut before any cut below it, so going backwards converts
+  // a subtree only once everything cut out of it already stands as a
+  // placeholder.
+  const grafts = new Map();
+  for (let i = cuts.length - 1; i >= 0; i--) {
+    const { siblings, index } = cuts[i];
+    const converted = fromParse5(siblings[index], { file });
+    const token = {};
+    grafts.set(token, converted);
+    siblings[index] = {
+      nodeName: "#text",
+      value: token,
+      sourceCodeLocation: parse5Location(converted.position),
+    };
+  }
+  const root = fromParse5(tree, { file });
+  /** @type {any[]} */
+  const pending = [root];
+  while (grafts.size > 0 && pending.length > 0) {
+    const node = pending.pop();
+    if (node.content) pending.push(node.content);
+    const children = node.children ?? [];
+    for (let i = 0; i < children.length; i++) {
+      children[i] = grafts.get(children[i].value) ?? children[i];
+      pending.push(children[i]);
+    }
+  }
+  return root;
+}
+
+/**
+ * The parse5 location `hast-util-from-parse5` turns back into `position`.
+ *
+ * A position it built always has both points: it drops one only when parse5
+ * gave no line, and parse5 gives a location whole or not at all.
+ * @param {any} position
+ */
+function parse5Location(position) {
+  if (!position) return undefined;
+  const { start, end } = position;
+  return {
+    startLine: start.line,
+    startCol: start.column,
+    startOffset: start.offset,
+    endLine: end.line,
+    endCol: end.column,
+    endOffset: end.offset,
+  };
 }