@growth-labs/conformance 0.1.0 → 0.3.0

package/dist/runner.js

@@ -1,14 +1,33 @@
 import { extractHtmlSignals, getSchemaTypes, nodeHasSchemaType } from './html.js';
-import { isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS } from './policy.js';
-import { conformanceFixtureSchema, EVIDENCE_SCHEMA_VERSION, fleetEvidenceBundleSchema, siteEvidenceBundleSchema, } from './schema.js';
+import { collectHeaders, isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS, } from './policy.js';
+import { conformanceFixtureSchema, EVIDENCE_SCHEMA_VERSION, fleetEvidenceBundleSchema, REQUIRED_FUNCTIONAL_PROBE_NAMES, siteEvidenceBundleSchema, } from './schema.js';
 const REQUIRED_PUBLICATION_SURFACES = ['sitemap', 'robots', 'feed'];
 const DISCOVER_HERO_MIN_WIDTH = 1200;
+const MIN_HSTS_MAX_AGE_SECONDS = 31536000;
+const VALID_COOP_VALUES = new Set(['same-origin', 'same-origin-allow-popups', 'unsafe-none']);
+const VALID_CORP_VALUES = new Set(['same-origin', 'same-site', 'cross-origin']);
+const EXECUTABLE_CSP_DIRECTIVES = [
+    'default-src',
+    'script-src',
+    'script-src-elem',
+    'script-src-attr',
+];
+const INLINE_CSP_DIRECTIVES = [
+    'default-src',
+    'script-src',
+    'script-src-elem',
+    'script-src-attr',
+    'style-src',
+    'style-src-elem',
+    'style-src-attr',
+];
 export function runSiteConformance(input, options = {}) {
     const fixture = conformanceFixtureSchema.parse(input);
     const generatedAt = options.now?.() ?? new Date().toISOString();
     const htmlSignals = extractHtmlSignals(fixture.response.html ?? fixture.response.body ?? '');
     const checks = [
-        checkSecurityHeaders(fixture),
+        checkSecurityHeaders(fixture, fixture.response.html ?? fixture.response.body ?? ''),
+        checkSecurityReceipts(fixture),
         checkMetadata(fixture, htmlSignals),
         checkStructuredData(fixture, htmlSignals),
         checkImages(fixture, htmlSignals),
@@ -29,6 +48,7 @@ export function runSiteConformance(input, options = {}) {
         summary,
         checks,
         findings,
+        securityReceipts: fixture.securityReceipts,
     };
     return siteEvidenceBundleSchema.parse(bundle);
 }
@@ -51,10 +71,29 @@ export function runFleetConformance(inputs, options = {}) {
     };
     return fleetEvidenceBundleSchema.parse(bundle);
 }
-function checkSecurityHeaders(fixture) {
+function checkSecurityHeaders(fixture, html) {
+    const headerEntries = collectHeaders(fixture.response.headers);
     const headers = normalizeHeaders(fixture.response.headers);
     const findings = [];
-    const missingSecurityHeaders = REQUIRED_SECURITY_HEADERS.filter((name) => !headers[name]);
+    const requiredSecurityHeaders = REQUIRED_SECURITY_HEADERS.filter((name) => name !== 'x-frame-options' || fixture.expected.framePolicy.legacyHeader !== 'omit');
+    const missingSecurityHeaders = requiredSecurityHeaders.filter((name) => {
+        const values = headerEntries[name] ?? [];
+        return !values.some((value) => value.trim().length > 0);
+    });
+    for (const header of REQUIRED_SECURITY_HEADERS) {
+        const values = headerEntries[header] ?? [];
+        const distinctValues = [...new Set(values.map((value) => value.trim()).filter(Boolean))];
+        if (distinctValues.length > 1) {
+            findings.push({
+                code: 'security.header.conflicting_values',
+                severity: 'error',
+                message: `Required security header ${header} has conflicting duplicate values.`,
+                path: `response.headers.${header}`,
+                evidence: JSON.stringify(distinctValues),
+                remediation: 'Emit one authoritative value for each required security header per response.',
+            });
+        }
+    }
     if (fixture.renderMode === 'ssr' &&
         fixture.buildEvidence?.staticHeaderPolicy === true &&
         fixture.buildEvidence.ssrHeaderPolicy !== true &&
@@ -77,14 +116,49 @@ function checkSecurityHeaders(fixture) {
         });
     }
     const csp = headers['content-security-policy'];
-    if (csp?.toLowerCase().includes('unsafe-inline')) {
+    if (csp)
+        findings.push(...validateContentSecurityPolicy(csp, html, fixture));
+    const xFrameOptions = headers['x-frame-options'];
+    const expectedLegacyFrameHeader = fixture.expected.framePolicy.legacyHeader;
+    if (expectedLegacyFrameHeader === 'omit' && xFrameOptions) {
+        findings.push({
+            code: 'security.frame_legacy_conflict',
+            severity: 'error',
+            message: 'X-Frame-Options conflicts with the declared embeddable frame-ancestors policy.',
+            path: 'response.headers.x-frame-options',
+            evidence: xFrameOptions,
+            remediation: 'Omit the legacy header only on the explicitly declared embeddable route and retain the exact CSP frame-ancestors directive.',
+        });
+    }
+    else if (expectedLegacyFrameHeader !== 'omit' &&
+        xFrameOptions &&
+        xFrameOptions.toUpperCase() !== expectedLegacyFrameHeader) {
         findings.push({
-            code: 'security.csp.unsafe_inline',
+            code: 'security.header.invalid',
+            severity: 'error',
+            message: `X-Frame-Options must be ${expectedLegacyFrameHeader} for this response class.`,
+            path: 'response.headers.x-frame-options',
+            evidence: xFrameOptions,
+        });
+    }
+    const coop = headers['cross-origin-opener-policy'];
+    if (coop && !VALID_COOP_VALUES.has(coop.toLowerCase())) {
+        findings.push({
+            code: 'security.header.invalid',
             severity: 'error',
-            message: 'Content-Security-Policy must not allow unsafe-inline script or style execution.',
-            path: 'response.headers.content-security-policy',
-            evidence: csp,
-            remediation: 'Use nonces or hashes in the shared CSP policy instead of unsafe-inline.',
+            message: 'Cross-Origin-Opener-Policy must be same-origin, same-origin-allow-popups, or unsafe-none.',
+            path: 'response.headers.cross-origin-opener-policy',
+            evidence: coop,
+        });
+    }
+    const corp = headers['cross-origin-resource-policy'];
+    if (corp && !VALID_CORP_VALUES.has(corp.toLowerCase())) {
+        findings.push({
+            code: 'security.header.invalid',
+            severity: 'error',
+            message: 'Cross-Origin-Resource-Policy must be same-origin, same-site, or cross-origin.',
+            path: 'response.headers.cross-origin-resource-policy',
+            evidence: corp,
         });
     }
     const xContentType = headers['x-content-type-options'];
@@ -98,13 +172,47 @@ function checkSecurityHeaders(fixture) {
         });
     }
     const hsts = headers['strict-transport-security'];
-    if (hsts && !/max-age=\d+/i.test(hsts)) {
+    if (hsts) {
+        const hstsDirectives = parseDirectivePairs(hsts);
+        const maxAge = parseHstsMaxAge(hstsDirectives);
+        if (maxAge === null) {
+            findings.push({
+                code: 'security.header.invalid',
+                severity: 'error',
+                message: 'Strict-Transport-Security must declare max-age.',
+                path: 'response.headers.strict-transport-security',
+                evidence: hsts,
+            });
+        }
+        else if (maxAge < MIN_HSTS_MAX_AGE_SECONDS) {
+            findings.push({
+                code: 'security.hsts.max_age_too_low',
+                severity: 'error',
+                message: 'Strict-Transport-Security max-age must be at least 31536000 seconds.',
+                path: 'response.headers.strict-transport-security',
+                evidence: `max-age=${maxAge}`,
+                remediation: 'Use at least one year of HSTS. Add includeSubDomains/preload only after host inventory proof.',
+            });
+        }
+        if (hstsDirectives.has('preload') && !hstsDirectives.has('includesubdomains')) {
+            findings.push({
+                code: 'security.header.invalid',
+                severity: 'error',
+                message: 'Strict-Transport-Security preload requires includeSubDomains.',
+                path: 'response.headers.strict-transport-security',
+                evidence: hsts,
+                remediation: 'Only add includeSubDomains/preload after the consumer has verified all subdomains can enforce HTTPS.',
+            });
+        }
+    }
+    const reportOnlyCsp = headers['content-security-policy-report-only'];
+    if (reportOnlyCsp && !csp) {
         findings.push({
             code: 'security.header.invalid',
             severity: 'error',
-            message: 'Strict-Transport-Security must declare max-age.',
-            path: 'response.headers.strict-transport-security',
-            evidence: hsts,
+            message: 'Report-only CSP cannot replace enforced Content-Security-Policy.',
+            path: 'response.headers.content-security-policy-report-only',
+            evidence: reportOnlyCsp,
         });
     }
     const cacheControl = headers['cache-control'];
@@ -127,6 +235,465 @@ function checkSecurityHeaders(fixture) {
     }
     return receipt('security-headers', findings);
 }
+function checkSecurityReceipts(fixture) {
+    const findings = [];
+    const probes = fixture.securityReceipts.functionalProbes;
+    const probesByName = new Map(probes.map((probe) => [probe.name, probe]));
+    for (const required of REQUIRED_FUNCTIONAL_PROBE_NAMES) {
+        if (!probesByName.has(required)) {
+            findings.push({
+                code: 'security.functional_probe.missing',
+                severity: 'error',
+                message: `Missing enforced-CSP functional probe receipt: ${required}.`,
+                path: `securityReceipts.functionalProbes.${required}`,
+                remediation: 'Provide a consumer-owned pass or documented NA receipt for every required functional surface.',
+            });
+        }
+    }
+    probes.forEach((probe, index) => {
+        const path = `securityReceipts.functionalProbes[${index}]`;
+        if (probe.status === 'fail') {
+            findings.push({
+                code: 'security.functional_probe.failed',
+                severity: 'error',
+                message: `Functional probe ${probe.name} failed under enforced CSP.`,
+                path,
+                evidence: probe.evidence,
+                remediation: 'Fix the consumer CSP/header contract before treating conformance evidence as passing.',
+            });
+        }
+        if (probe.status === 'pass' && !probe.evidence) {
+            findings.push({
+                code: 'security.functional_probe.evidence_missing',
+                severity: 'error',
+                message: `Functional probe ${probe.name} passed without explicit evidence.`,
+                path: `${path}.evidence`,
+                remediation: 'Attach a sanitized consumer-owned receipt for the successful probe.',
+            });
+        }
+        if (probe.status === 'na' && (!probe.capabilityBoundary || !probe.evidence)) {
+            findings.push({
+                code: 'security.functional_probe.na_undeclared',
+                severity: 'error',
+                message: `Functional probe ${probe.name} is NA without boundary and evidence.`,
+                path,
+                remediation: 'Declare why the surface is out of scope and attach sanitized supporting evidence.',
+            });
+        }
+    });
+    const cspReports = fixture.securityReceipts.cspReports;
+    if (cspReports.length === 0) {
+        findings.push({
+            code: 'security.csp_report.missing',
+            severity: 'error',
+            message: 'Missing CSP reporting or canary receipt for the enforced policy.',
+            path: 'securityReceipts.cspReports',
+            remediation: 'Provide a consumer-owned CSP report endpoint or blocked-canary receipt proving reporting works.',
+        });
+    }
+    let passingCspReports = 0;
+    cspReports.forEach((report, index) => {
+        const path = `securityReceipts.cspReports[${index}]`;
+        if (report.status === 'pass') {
+            passingCspReports += 1;
+            if (!report.evidence) {
+                findings.push({
+                    code: 'security.csp_report.evidence_missing',
+                    severity: 'error',
+                    message: `CSP report receipt ${report.name} passed without explicit evidence.`,
+                    path: `${path}.evidence`,
+                });
+            }
+        }
+        if (report.status === 'fail') {
+            findings.push({
+                code: 'security.csp_report.failed',
+                severity: 'error',
+                message: `CSP report receipt ${report.name} failed.`,
+                path,
+                evidence: report.evidence,
+                remediation: 'Fix the consumer CSP reporting path before treating conformance evidence as passing.',
+            });
+        }
+        if (report.status === 'na' && (!report.capabilityBoundary || !report.evidence)) {
+            findings.push({
+                code: 'security.csp_report.na_undeclared',
+                severity: 'error',
+                message: `CSP report receipt ${report.name} is NA without boundary and evidence.`,
+                path,
+            });
+        }
+    });
+    if (cspReports.length > 0 && passingCspReports === 0) {
+        findings.push({
+            code: 'security.csp_report.missing',
+            severity: 'error',
+            message: 'At least one CSP reporting or canary receipt must pass.',
+            path: 'securityReceipts.cspReports',
+        });
+    }
+    return receipt('security-receipts', findings);
+}
+function validateContentSecurityPolicy(csp, html, fixture) {
+    const findings = [];
+    const { directives, findings: parseFindings } = parseContentSecurityPolicy(csp);
+    findings.push(...parseFindings);
+    const frameAncestors = directives.get('frame-ancestors');
+    const expectedFrameAncestors = fixture.expected.framePolicy.ancestors;
+    if (!frameAncestors) {
+        findings.push({
+            code: 'security.csp.frame_ancestors_missing',
+            severity: 'error',
+            message: 'Content-Security-Policy must declare frame-ancestors.',
+            path: 'response.headers.content-security-policy.frame-ancestors',
+        });
+    }
+    else if (normalizeCspSources(frameAncestors.sources) !== normalizeCspSources(expectedFrameAncestors)) {
+        findings.push({
+            code: 'security.csp.frame_ancestors_mismatch',
+            severity: 'error',
+            message: 'Content-Security-Policy frame-ancestors does not match the declared response class.',
+            path: 'response.headers.content-security-policy.frame-ancestors',
+            evidence: frameAncestors.raw,
+            remediation: 'Emit only the exact declared frame ancestors and keep embeddable routes explicitly bounded.',
+        });
+    }
+    const defaultSources = lowerSources(directives.get('default-src')?.sources ?? []);
+    if (defaultSources.includes('*')) {
+        findings.push({
+            code: 'security.csp.default_src_wildcard',
+            severity: 'error',
+            message: 'Content-Security-Policy default-src must not allow wildcard sources.',
+            path: 'response.headers.content-security-policy.default-src',
+            evidence: directives.get('default-src')?.raw,
+            remediation: 'Scope default-src to self or narrower origins, then add explicit directives for required external surfaces.',
+        });
+    }
+    for (const directiveName of EXECUTABLE_CSP_DIRECTIVES) {
+        const directive = directives.get(directiveName);
+        if (!directive)
+            continue;
+        if (lowerSources(directive.sources).includes("'unsafe-eval'")) {
+            findings.push({
+                code: 'security.csp.unsafe_eval',
+                severity: 'error',
+                message: 'Content-Security-Policy must not allow unsafe-eval.',
+                path: `response.headers.content-security-policy.${directiveName}`,
+                evidence: directive.raw,
+                remediation: 'Remove unsafe-eval and replace any dependent runtime with nonce/hash-compatible script execution.',
+            });
+        }
+    }
+    for (const directiveName of INLINE_CSP_DIRECTIVES) {
+        const directive = directives.get(directiveName);
+        if (!directive)
+            continue;
+        if (lowerSources(directive.sources).includes("'unsafe-inline'")) {
+            if (directiveName === 'style-src-attr') {
+                const inventory = fixture.securityReceipts.inlineStyleAttributes;
+                if (!inventory) {
+                    findings.push({
+                        code: 'security.csp.style_attr_inline_inventory_missing',
+                        severity: 'error',
+                        message: "style-src-attr 'unsafe-inline' requires a commit-bound inline-style-attribute inventory receipt.",
+                        path: 'securityReceipts.inlineStyleAttributes',
+                        evidence: directive.raw,
+                        remediation: 'Remove the allowance or attach the exact consumer commit SHA, positive occurrence count, and scan evidence.',
+                    });
+                    continue;
+                }
+                if (!fixture.buildEvidence?.commitSha ||
+                    fixture.buildEvidence.commitSha !== inventory.commitSha) {
+                    findings.push({
+                        code: 'security.csp.style_attr_inline_inventory_stale',
+                        severity: 'error',
+                        message: 'The inline-style-attribute inventory must match the exact commit in build evidence.',
+                        path: 'securityReceipts.inlineStyleAttributes.commitSha',
+                        evidence: `inventory=${inventory.commitSha}; build=${fixture.buildEvidence?.commitSha ?? 'missing'}`,
+                        remediation: 'Rescan the exact build commit before retaining the style attribute allowance.',
+                    });
+                }
+                continue;
+            }
+            findings.push({
+                code: 'security.csp.unsafe_inline',
+                severity: 'error',
+                message: 'Content-Security-Policy must not allow unsafe-inline script or style execution.',
+                path: `response.headers.content-security-policy.${directiveName}`,
+                evidence: directive.raw,
+                remediation: 'Use nonces or hashes in the shared CSP policy instead of unsafe-inline.',
+            });
+        }
+    }
+    const scriptSources = getEffectiveScriptSources(directives);
+    for (const script of extractInlineExecutableScripts(html)) {
+        if (inlineExecutableScriptAllowed(script, scriptSources))
+            continue;
+        findings.push({
+            code: 'security.csp.inline_executable_without_nonce_or_hash',
+            severity: 'error',
+            message: 'Executable inline script lacks a CSP source matching its nonce or SHA-256 hash.',
+            path: script.path,
+            remediation: 'Add a runtime nonce to the script and CSP, or add the exact SHA-256 hash source for the inline script body.',
+        });
+    }
+    return findings;
+}
+function parseContentSecurityPolicy(csp) {
+    const directives = new Map();
+    const findings = [];
+    csp.split(';').forEach((rawDirective, index) => {
+        const trimmed = rawDirective.trim();
+        if (!trimmed)
+            return;
+        const tokens = trimmed.split(/\s+/);
+        const name = tokens[0]?.toLowerCase() ?? '';
+        const sources = tokens.slice(1);
+        if (!/^[a-z][a-z0-9-]*$/.test(name)) {
+            findings.push({
+                code: 'security.csp.malformed',
+                severity: 'error',
+                message: 'Content-Security-Policy contains a malformed directive name.',
+                path: `response.headers.content-security-policy[${index}]`,
+                evidence: trimmed,
+            });
+            return;
+        }
+        if (directiveRequiresSources(name) && sources.length === 0) {
+            findings.push({
+                code: 'security.csp.malformed',
+                severity: 'error',
+                message: `Content-Security-Policy directive ${name} is missing source values.`,
+                path: `response.headers.content-security-policy.${name}`,
+                evidence: trimmed,
+            });
+        }
+        const existing = directives.get(name);
+        if (existing) {
+            if (normalizeCspSources(existing.sources) !== normalizeCspSources(sources)) {
+                findings.push({
+                    code: 'security.csp.directive_conflict',
+                    severity: 'error',
+                    message: `Content-Security-Policy contains conflicting duplicate ${name} directives.`,
+                    path: `response.headers.content-security-policy.${name}`,
+                    evidence: `${existing.raw} | ${trimmed}`,
+                    remediation: 'Emit one directive per CSP directive name with the complete source list.',
+                });
+            }
+            return;
+        }
+        directives.set(name, { name, sources, raw: trimmed });
+    });
+    return { directives, findings };
+}
+function directiveRequiresSources(name) {
+    return name === 'default-src' || name.endsWith('-src') || name.endsWith('-src-elem');
+}
+function normalizeCspSources(sources) {
+    return lowerSources(sources).sort().join(' ');
+}
+function lowerSources(sources) {
+    return sources.map((source) => source.toLowerCase());
+}
+function getEffectiveScriptSources(directives) {
+    return (directives.get('script-src-elem')?.sources ??
+        directives.get('script-src')?.sources ??
+        directives.get('default-src')?.sources ??
+        []);
+}
+function inlineExecutableScriptAllowed(script, sources) {
+    if (script.nonce && sources.includes(`'nonce-${script.nonce}'`))
+        return true;
+    return sources.some((source) => hashSourceMatchesInlineScript(source, script.content));
+}
+function hashSourceMatchesInlineScript(source, content) {
+    const match = /^'(sha256|sha384|sha512)-([^']+)'$/.exec(source);
+    if (!match)
+        return false;
+    const algorithm = match[1]?.toLowerCase();
+    const expected = match[2];
+    return algorithm === 'sha256' && expected === sha256Base64(content);
+}
+function extractInlineExecutableScripts(html) {
+    const scripts = [];
+    const scriptPattern = /<script\b([^>]*)>([\s\S]*?)<\/script>/gi;
+    let match = scriptPattern.exec(html);
+    let scriptIndex = 0;
+    while (match !== null) {
+        const attributes = parseHtmlAttributes(match[1] ?? '');
+        const content = match[2] ?? '';
+        if (!attributes.has('src') &&
+            isExecutableScriptType(attributes.get('type')) &&
+            content.trim().length > 0) {
+            const nonce = attributes.get('nonce');
+            scripts.push({
+                content,
+                nonce: nonce && nonce.length > 0 ? nonce : undefined,
+                path: `html.script[${scriptIndex}]`,
+            });
+        }
+        scriptIndex += 1;
+        match = scriptPattern.exec(html);
+    }
+    return scripts;
+}
+function parseHtmlAttributes(rawAttributes) {
+    const attributes = new Map();
+    const attributePattern = /([^\s"'=<>]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>]+)))?/g;
+    let match = attributePattern.exec(rawAttributes);
+    while (match !== null) {
+        const name = match[1]?.toLowerCase();
+        if (!name)
+            continue;
+        attributes.set(name, match[2] ?? match[3] ?? match[4] ?? '');
+        match = attributePattern.exec(rawAttributes);
+    }
+    return attributes;
+}
+function isExecutableScriptType(type) {
+    if (!type)
+        return true;
+    const normalized = type.split(';', 1)[0]?.trim().toLowerCase();
+    return (normalized === '' ||
+        normalized === 'module' ||
+        normalized === 'text/javascript' ||
+        normalized === 'application/javascript' ||
+        normalized === 'text/ecmascript' ||
+        normalized === 'application/ecmascript' ||
+        normalized === 'text/jscript' ||
+        normalized === 'application/x-javascript');
+}
+function parseDirectivePairs(value) {
+    const directives = new Map();
+    for (const part of value.split(';')) {
+        const trimmed = part.trim();
+        if (!trimmed)
+            continue;
+        const [rawName, ...rawValue] = trimmed.split('=');
+        const name = rawName?.trim().toLowerCase();
+        if (!name)
+            continue;
+        const directiveValue = rawValue.length > 0 ? rawValue.join('=').trim() : true;
+        directives.set(name, directiveValue);
+    }
+    return directives;
+}
+function parseHstsMaxAge(directives) {
+    const value = directives.get('max-age');
+    if (typeof value !== 'string' || !/^\d+$/.test(value))
+        return null;
+    return Number(value);
+}
+const SHA256_INITIAL_HASH = [
+    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+];
+const SHA256_ROUND_CONSTANTS = [
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+];
+function sha256Base64(input) {
+    return bytesToBase64(sha256(new TextEncoder().encode(input)));
+}
+function sha256(message) {
+    const bitLength = message.length * 8;
+    const paddedLength = Math.ceil((message.length + 9) / 64) * 64;
+    const padded = new Uint8Array(paddedLength);
+    padded.set(message);
+    padded[message.length] = 0x80;
+    const bitLengthHigh = Math.floor(bitLength / 0x100000000);
+    const bitLengthLow = bitLength >>> 0;
+    padded[paddedLength - 8] = (bitLengthHigh >>> 24) & 0xff;
+    padded[paddedLength - 7] = (bitLengthHigh >>> 16) & 0xff;
+    padded[paddedLength - 6] = (bitLengthHigh >>> 8) & 0xff;
+    padded[paddedLength - 5] = bitLengthHigh & 0xff;
+    padded[paddedLength - 4] = (bitLengthLow >>> 24) & 0xff;
+    padded[paddedLength - 3] = (bitLengthLow >>> 16) & 0xff;
+    padded[paddedLength - 2] = (bitLengthLow >>> 8) & 0xff;
+    padded[paddedLength - 1] = bitLengthLow & 0xff;
+    const hash = [...SHA256_INITIAL_HASH];
+    const words = new Array(64).fill(0);
+    for (let chunkOffset = 0; chunkOffset < padded.length; chunkOffset += 64) {
+        for (let i = 0; i < 16; i += 1) {
+            const offset = chunkOffset + i * 4;
+            words[i] =
+                (((padded[offset] ?? 0) << 24) |
+                    ((padded[offset + 1] ?? 0) << 16) |
+                    ((padded[offset + 2] ?? 0) << 8) |
+                    (padded[offset + 3] ?? 0)) >>>
+                    0;
+        }
+        for (let i = 16; i < 64; i += 1) {
+            const s0 = rotateRight(words[i - 15] ?? 0, 7) ^
+                rotateRight(words[i - 15] ?? 0, 18) ^
+                ((words[i - 15] ?? 0) >>> 3);
+            const s1 = rotateRight(words[i - 2] ?? 0, 17) ^
+                rotateRight(words[i - 2] ?? 0, 19) ^
+                ((words[i - 2] ?? 0) >>> 10);
+            words[i] = add32(words[i - 16] ?? 0, s0, words[i - 7] ?? 0, s1);
+        }
+        let [a, b, c, d, e, f, g, h] = hash;
+        for (let i = 0; i < 64; i += 1) {
+            const sum1 = rotateRight(e ?? 0, 6) ^ rotateRight(e ?? 0, 11) ^ rotateRight(e ?? 0, 25);
+            const choice = ((e ?? 0) & (f ?? 0)) ^ (~(e ?? 0) & (g ?? 0));
+            const temp1 = add32(h ?? 0, sum1, choice, SHA256_ROUND_CONSTANTS[i] ?? 0, words[i] ?? 0);
+            const sum0 = rotateRight(a ?? 0, 2) ^ rotateRight(a ?? 0, 13) ^ rotateRight(a ?? 0, 22);
+            const majority = ((a ?? 0) & (b ?? 0)) ^ ((a ?? 0) & (c ?? 0)) ^ ((b ?? 0) & (c ?? 0));
+            const temp2 = add32(sum0, majority);
+            h = g;
+            g = f;
+            f = e;
+            e = add32(d ?? 0, temp1);
+            d = c;
+            c = b;
+            b = a;
+            a = add32(temp1, temp2);
+        }
+        hash[0] = add32(hash[0] ?? 0, a ?? 0);
+        hash[1] = add32(hash[1] ?? 0, b ?? 0);
+        hash[2] = add32(hash[2] ?? 0, c ?? 0);
+        hash[3] = add32(hash[3] ?? 0, d ?? 0);
+        hash[4] = add32(hash[4] ?? 0, e ?? 0);
+        hash[5] = add32(hash[5] ?? 0, f ?? 0);
+        hash[6] = add32(hash[6] ?? 0, g ?? 0);
+        hash[7] = add32(hash[7] ?? 0, h ?? 0);
+    }
+    const digest = new Uint8Array(32);
+    hash.forEach((word, index) => {
+        const offset = index * 4;
+        digest[offset] = (word >>> 24) & 0xff;
+        digest[offset + 1] = (word >>> 16) & 0xff;
+        digest[offset + 2] = (word >>> 8) & 0xff;
+        digest[offset + 3] = word & 0xff;
+    });
+    return digest;
+}
+function rotateRight(value, bits) {
+    return (value >>> bits) | (value << (32 - bits));
+}
+function add32(...values) {
+    return values.reduce((sum, value) => (sum + value) >>> 0, 0);
+}
+function bytesToBase64(bytes) {
+    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+    let output = '';
+    for (let index = 0; index < bytes.length; index += 3) {
+        const first = bytes[index] ?? 0;
+        const second = bytes[index + 1] ?? 0;
+        const third = bytes[index + 2] ?? 0;
+        const triple = (first << 16) | (second << 8) | third;
+        output += alphabet[(triple >>> 18) & 0x3f];
+        output += alphabet[(triple >>> 12) & 0x3f];
+        output += index + 1 < bytes.length ? alphabet[(triple >>> 6) & 0x3f] : '=';
+        output += index + 2 < bytes.length ? alphabet[triple & 0x3f] : '=';
+    }
+    return output;
+}
 function checkMetadata(fixture, htmlSignals) {
     const findings = [];
     if (!htmlSignals.canonicalUrl) {