@salesforce/storefront-next-dev 1.4.0-alpha.1 → 1.4.1-alpha.0

package/dist/audit/catalog/categories/performance/rules/ttfb-budget.md

@@ -0,0 +1,20 @@
+---
+id: performance/ttfb-budget
+title: Time to First Byte (TTFB)
+severity: high
+appliesTo: [home, plp, pdp]
+inputs: [playhouse.summary]
+---
+
+## Intent
+Checks that each page's server response time from its representative mobile cold-cache run is 800 ms or less. The representative run is the run selected by median LCP. TTFB isolates the time from sending the document request until its first response byte, without counting DNS, TCP, TLS, or redirect time.
+## Inspect
+The rule script reads each page's `summary.json` and takes the mobile cold-cache cell's `medianRun.ttfb`, which Playhouse derives from Lighthouse's `server-response-time` audit. A valid run must have both a positive LCP and a positive TTFB. Playhouse can write 0 for either metric when it could not measure it, so those runs are left out. When any run is invalid, the script picks the median again from the valid runs the way Playhouse does (the run closest to the median LCP, ties to the earlier run) and reads that run's `runs[].row.ttfb`.
+## Evaluate
+Pass when every measured page's representative-run TTFB is at or under 800 ms; fail otherwise. A failure is medium severity, or high above 1,800 ms. A page without a mobile cold-cache cell, or without any measured run, is skipped. If no page can be measured, the rule is not decided.
+## Evidence
+One `summary.json` pointer per page, `/cells/<i>/medianRun/ttfb` (or `/runs/<j>/row/ttfb` when runs were left out), with the measured value, the measured min–max spread when several runs exist, and how many runs were not measured. The verdict stays limited to the stable server-response measurement; captured network timing and response headers can be inspected separately when diagnosing a failure.
+## Remediation
+Use application and platform traces, plus existing response timing and cache headers when available, to locate the delay. Parallelize independent server work and reduce blocking SCAPI or CMS calls. Do not prescribe shared HTML caching without confirming with the merchant that the response does not vary by shopper. Re-run the same Playhouse capture to confirm the mobile cold-cache representative-run TTFB is at or under 800 ms.
+## Examples
+Compliant: home representative-run TTFB 480 ms. Problematic: PLP representative-run TTFB 1,250 ms.

package/dist/audit/catalog/categories/security/CATEGORY.md

@@ -0,0 +1,17 @@
+# Security
+
+## Purpose and boundaries
+
+Trace trust boundaries and deployed response evidence. Combine final response headers with Playhouse diagnostics where runtime behavior matters. Never persist secret values; cite only redacted key names and locations.
+
+## Investigation sequence
+
+Map client/server boundaries, protected routes, sinks, and configuration before evaluating each rule. For CSP, identify the final document policy first, then correlate console, Inspector Issue, and blocked-request evidence across representative cells.
+
+## Evidence and redaction
+
+Redact credentials and personal data before writing any artifact. Playhouse console and diagnostic text can contain arbitrary application data; cite stable reason codes and sanitized URLs instead of copying full messages.
+
+## Severity and blind spots
+
+Dependency and infrastructure controls need current external evidence. A CSP diagnostic is not automatically a failure: the policy may be correctly blocking an optional or malicious request.

package/dist/audit/catalog/categories/security/rules/browser-hardening-headers.js

@@ -0,0 +1,37 @@
+import { a as harRuleDataSchema, f as tokens, i as harRule, o as header } from "../../../../../har.js";
+
+//#region src/audit/catalog/categories/security/rules/browser-hardening-headers.ts
+const dataSchema = harRuleDataSchema;
+const REFERRER_POLICIES = [
+	"no-referrer",
+	"same-origin",
+	"strict-origin",
+	"strict-origin-when-cross-origin"
+];
+var browser_hardening_headers_default = harRule("HTML page responses", ({ document }) => {
+	const { entry } = document;
+	const headers = {
+		"x-content-type-options": header(entry, "x-content-type-options"),
+		"x-frame-options": header(entry, "x-frame-options"),
+		"referrer-policy": header(entry, "referrer-policy"),
+		"permissions-policy": header(entry, "permissions-policy")
+	};
+	const reasons = [];
+	if (headers["x-content-type-options"]?.trim().toLowerCase() !== "nosniff") reasons.push("X-Content-Type-Options is not nosniff.");
+	if (!/(?:^|[;,])\s*frame-ancestors\b/i.test(header(entry, "content-security-policy") ?? "") && !headers["x-frame-options"]) reasons.push("Neither CSP frame-ancestors nor X-Frame-Options is set.");
+	const referrer = tokens(headers["referrer-policy"]).at(-1);
+	if (!referrer) reasons.push("Referrer-Policy is missing.");
+	else if (!REFERRER_POLICIES.includes(referrer)) reasons.push(`Referrer-Policy ${referrer} discloses more than the baseline allows.`);
+	if (!headers["permissions-policy"]) reasons.push("Permissions-Policy is missing.");
+	return {
+		responses: 1,
+		failures: reasons.length ? [{
+			entry: document,
+			reasons,
+			headers
+		}] : []
+	};
+}, "send nosniff, block framing by other sites, limit the referrer and set a Permissions-Policy");
+
+//#endregion
+export { dataSchema, browser_hardening_headers_default as default };

package/dist/audit/catalog/categories/security/rules/browser-hardening-headers.md

@@ -0,0 +1,20 @@
+---
+id: security/browser-hardening-headers
+title: Basic Security Headers
+severity: medium
+appliesTo: [home, plp, pdp]
+inputs: [playhouse.network-har]
+---
+
+## Intent
+Checks that each page's HTML response sends four standard security headers: `X-Content-Type-Options: nosniff`, so browsers don't run a file as a different type than declared; CSP `frame-ancestors` or `X-Frame-Options`, so other sites can't show the page in a hidden frame and trick clicks (clickjacking); a `Referrer-Policy` that doesn't send full page URLs to other sites; and a `Permissions-Policy` that limits browser features such as the camera or location.
+## Inspect
+The rule script matches the final document response in `network-mobile-cold.har` (via `network-mobile-cold.json`) for each page. It reads `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`, `Permissions-Policy` and CSP `frame-ancestors`. If no page's document can be matched, the rule is not decided.
+## Evaluate
+Fail when `X-Content-Type-Options` is not `nosniff`; neither CSP `frame-ancestors` nor `X-Frame-Options` is set; `Referrer-Policy` is missing or its effective (last) value is not `no-referrer`, `same-origin`, `strict-origin` or `strict-origin-when-cross-origin`; or `Permissions-Policy` is missing. Pass otherwise.
+## Evidence
+The HAR entry of each failing document, with the reasons and the four header values.
+## Remediation
+Restore the Storefront Next security-header defaults at the response owner or public edge (Managed Runtime, CDN or application), keeping only documented integration-specific exceptions, then re-run Playhouse and confirm the headers on the final document response.
+## Examples
+Compliant: `nosniff`, `strict-origin-when-cross-origin`, CSP `frame-ancestors 'self'` and a `Permissions-Policy`. Problematic: no `frame-ancestors` and no `X-Frame-Options`.

package/dist/audit/catalog/categories/security/rules/content-security-policy.js

@@ -0,0 +1,40 @@
+import { a as harRuleDataSchema, i as harRule, o as header } from "../../../../../har.js";
+
+//#region src/audit/catalog/categories/security/rules/content-security-policy.ts
+const dataSchema = harRuleDataSchema;
+/** Each comma-separated policy as directive → lowercased sources; every enforced policy applies. */
+function policies(value) {
+	return (value ?? "").split(",").map((policy) => new Map(policy.split(";").flatMap((directive) => {
+		const [name, ...sources] = directive.trim().toLowerCase().split(/\s+/);
+		return name ? [[name, sources]] : [];
+	}))).filter((policy) => policy.size);
+}
+var content_security_policy_default = harRule("HTML page responses", ({ document }) => {
+	const { entry } = document;
+	const headers = {
+		"content-security-policy": header(entry, "content-security-policy"),
+		"content-security-policy-report-only": header(entry, "content-security-policy-report-only")
+	};
+	const enforced = policies(headers["content-security-policy"]);
+	const reasons = [];
+	if (!enforced.length) reasons.push(headers["content-security-policy-report-only"] ? "Content-Security-Policy is report-only." : "Content-Security-Policy is missing.");
+	else {
+		if (enforced.some((policy) => [...policy.values()].some((sources) => sources.includes("'unsafe-eval'")))) reasons.push("CSP allows 'unsafe-eval'.");
+		if (!enforced.some((policy) => {
+			const sources = policy.get("script-src") ?? policy.get("default-src");
+			return sources !== void 0 && !sources.includes("*");
+		})) reasons.push("CSP does not restrict scripts: script-src (or default-src without script-src) is missing or allows *.");
+		for (const directive of ["frame-ancestors", "form-action"]) if (!enforced.some((policy) => policy.has(directive))) reasons.push(`CSP ${directive} is missing.`);
+	}
+	return {
+		responses: 1,
+		failures: reasons.length ? [{
+			entry: document,
+			reasons,
+			headers
+		}] : []
+	};
+}, "enforce a Content Security Policy that restricts scripts, framing and form targets and doesn't allow 'unsafe-eval'");
+
+//#endregion
+export { dataSchema, content_security_policy_default as default };

package/dist/audit/catalog/categories/security/rules/content-security-policy.md

@@ -0,0 +1,20 @@
+---
+id: security/content-security-policy
+title: Content Security Policy (CSP)
+severity: high
+appliesTo: [home, plp, pdp]
+inputs: [playhouse.network-har]
+---
+
+## Intent
+Checks that each page's HTML response sends an enforced `Content-Security-Policy` header (report-only isn't enough) that restricts where scripts can come from, doesn't allow `'unsafe-eval'`, and sets `frame-ancestors` and `form-action`. A CSP limits what an injected script can do.
+## Inspect
+The rule script matches the final document response in `network-mobile-cold.har` (via `network-mobile-cold.json`) for each page. It parses `Content-Security-Policy` (every enforced policy) and notes `Content-Security-Policy-Report-Only`. If no page's document can be matched, the rule is not decided.
+## Evaluate
+Fail when there is no enforcing CSP (report-only alone fails); any directive allows `'unsafe-eval'`; no policy restricts scripts (`script-src`, or `default-src` when `script-src` is absent, is missing or contains `*`); or `frame-ancestors` or `form-action` is missing. `'wasm-unsafe-eval'` is not `'unsafe-eval'`. Pass otherwise.
+## Evidence
+The HAR entry of each failing document, with the reasons and the CSP header values.
+## Remediation
+Start from the Storefront Next CSP defaults, keep nonce/hash-based script protection, and extend only the directives audited integrations need. Remove `'unsafe-eval'`, add `frame-ancestors` and `form-action`, and use report-only only as a temporary rollout step before enforcing. Re-run Playhouse and confirm the header on the final document response.
+## Examples
+Compliant: `script-src 'self' 'strict-dynamic' 'nonce-…'; frame-ancestors 'self'; form-action 'self'`. Problematic: only `Content-Security-Policy-Report-Only`, or `script-src * 'unsafe-eval'`.

package/dist/audit/catalog/categories/security/rules/csp-runtime-compatibility.md

@@ -0,0 +1,24 @@
+---
+id: security/csp-runtime-compatibility
+title: Site Features Blocked by the CSP
+severity: medium
+appliesTo: [home, plp, pdp]
+inputs: [playhouse.diagnostics, playhouse.network-har, playhouse.document, source.code]
+---
+
+## Intent
+Checks what the Content Security Policy blocked while the pages loaded, from the browser console and DevTools issues, and whether any of it is something the storefront needs: its own scripts, checkout or account features, or an approved integration. Blocked probes, browser extensions and one-off messages are ignored.
+## Inspect
+For every representative Playhouse cell, inspect diagnostics `sourceStatus`, normalized `contentSecurityPolicyIssue` counts (from CDP `ContentSecurityPolicyIssue`) and `contentSecurityPolicyViolationType:*` reason codes, CSP-related warning/error entries, and network failures with a CSP blocked reason. Correlate sanitized hosts, resource types, and source locations to first-party code or an owned integration, then confirm the relevant deployed directive in the HAR and its source configuration. Identify whether the update belongs in Storefront Next CSP configuration, a tag manager/container, customer edge configuration, or vendor code.
+
+## Evaluate
+Create a finding only when repeated evidence shows CSP blocks a required first-party resource, checkout/account behavior, or an approved integration. Probes, malicious attempts, browser extensions, and isolated unexplained messages don't fail the rule. A blocked optional tracker that needs ownership review is a `low` finding that must name the affected integration or host, resource type, likely owner surface, and safe next action. Report-only violations are rollout evidence, not proof of enforcement. Use `not-verified` only when diagnostics sources are missing or invalid.
+
+## Evidence
+Cite page, form factor, cache state, diagnostics source status, issue type/count, stable reason codes, sanitized blocked host/path, resource type, likely integration owner, and relevant configuration or source location. Quote only the minimum sanitized console fragment needed; console text can contain arbitrary customer or application data.
+
+## Remediation
+State where the change belongs. For an approved blocked resource, prefer the exact HTTPS origin in the narrow resource directive over broadening policy globally. For tag-manager integrations, identify the container/tag owner and update or remove the owning tag before changing application CSP; if ownership is unresolved, keep it a `low` finding that asks for that decision rather than proposing an allowlist. For code that requires `eval`, remove, replace, or obtain a CSP-compatible vendor implementation; never recommend `unsafe-eval` as the shortcut. Repeat the affected journey and confirm required functionality works without introducing a high-risk CSP exception.
+
+## Examples
+Compliant: diagnostics were captured and required storefront resources have no CSP failures; no change is required. Problematic: every PDP capture blocks a required first-party product script; cite the source/configuration owner and narrow directive. Ambiguous: an image analytics pixel is blocked; record the exact host and `Image` resource type, ask the tag owner whether it is required, then either remove the tag or allow that origin only in `img-src`. A vendor script attempts `eval`; recommend removing or replacing that integration, never enabling `unsafe-eval`.

package/dist/audit/catalog/categories/security/rules/dependency-vulnerabilities.md

@@ -0,0 +1,19 @@
+---
+id: security/dependency-vulnerabilities
+title: Known Vulnerabilities in Dependencies
+severity: high
+appliesTo: [project]
+inputs: [source.manifests, dependency.advisories]
+---
+## Intent
+Checks the production npm dependencies against a current security advisory scan from the package manager, and reports advisories that affect a version the storefront ships and code it actually uses. Without a current scan, the rule is left for manual review.
+## Inspect
+Identify the production dependency graph and obtain a current advisory scan from the ecosystem package manager or approved scanner; do not infer safety from lockfile text alone.
+## Evaluate
+Report a finding only when a current advisory maps to a shipped version and reachable production use, or use `not-verified` when no current scan is available.
+## Evidence
+Cite package, installed version, advisory identifier, scanner timestamp, dependency path, and reachability assessment; never include registry credentials.
+## Remediation
+Upgrade, replace, remove, or document a time-bound mitigation, then rerun the same scanner.
+## Examples
+Compliant: current scan with no applicable production advisories. Problematic: reachable critical advisory. Ambiguous: stale scan or development-only dependency.

package/dist/audit/catalog/categories/security/rules/dynamic-code-execution.md

@@ -0,0 +1,19 @@
+---
+id: security/dynamic-code-execution
+title: eval and new Function With Untrusted Input
+severity: high
+appliesTo: [project]
+inputs: [source.code]
+---
+## Intent
+Checks every use of `eval` and `new Function` for input an attacker could influence, such as URL parameters, CMS content or API responses. Running that input as code would let an attacker run their own JavaScript on the site.
+## Inspect
+Trace eval and Function constructor inputs across trust boundaries.
+## Evaluate
+Finding requires dynamic or untrusted input; constant tooling code may be not-applicable.
+## Evidence
+Cite source, transformations, and sink.
+## Remediation
+Replace string execution with data-driven logic.
+## Examples
+Compliant: no dynamic execution. Problematic: CMS value reaches eval. Ambiguous: compile-time constant unresolved.

package/dist/audit/catalog/categories/security/rules/hardcoded-credentials.md

@@ -0,0 +1,19 @@
+---
+id: security/hardcoded-credentials
+title: Credentials in Source Code
+severity: critical
+appliesTo: [project]
+inputs: [source.code]
+---
+## Intent
+Searches the project's source for real credentials written into code or config, such as API keys, passwords, client secrets and private keys, ignoring test fixtures and examples. Anyone with access to the repository can read them.
+## Inspect
+Search high-confidence credential formats and assignments while excluding fixtures.
+## Evaluate
+Finding requires a real credential-like secret in shipping source.
+## Evidence
+Cite credential type and location only; replace value with [redacted].
+## Remediation
+Remove, rotate, and load from a server-side secret manager.
+## Examples
+Compliant: environment lookup. Problematic: private key literal. Ambiguous: documented placeholder.

package/dist/audit/catalog/categories/security/rules/html-config-secrets.js

@@ -0,0 +1,46 @@
+import "../../../../../har.js";
+import { a as measurePage } from "../../../../../document-size.js";
+import { z } from "zod";
+
+//#region src/audit/catalog/categories/security/rules/html-config-secrets.ts
+const dataSchema = z.object({
+	pages: z.array(z.object({
+		page: z.string(),
+		url: z.string(),
+		appConfig: z.array(z.string()),
+		pageData: z.array(z.string()),
+		other: z.array(z.string())
+	}).strict()),
+	skipped: z.array(z.object({
+		page: z.string(),
+		reason: z.string()
+	}).strict())
+}).strict();
+/** Lists the inline scripts archived from each page's HTML for the agent to review; secrets can't be recognized by a script, so this never decides. */
+const listInlineScripts = async ({ pages, playhouse }) => {
+	const data = {
+		pages: [],
+		skipped: []
+	};
+	for (const page of pages) {
+		const size = await measurePage(playhouse, page.label);
+		if ("reason" in size) data.skipped.push({
+			page: page.label,
+			reason: size.reason
+		});
+		else if (size.markupBytes === null) data.skipped.push({
+			page: page.label,
+			reason: "Playhouse archived no inline scripts for this page."
+		});
+		else data.pages.push({
+			page: page.label,
+			url: size.url,
+			...size.scripts
+		});
+	}
+	return { data };
+};
+var html_config_secrets_default = listInlineScripts;
+
+//#endregion
+export { dataSchema, html_config_secrets_default as default };

package/dist/audit/catalog/categories/security/rules/html-config-secrets.md

@@ -0,0 +1,22 @@
+---
+id: security/html-config-secrets
+title: Secrets in the Page's Config and Data
+severity: critical
+appliesTo: [home, plp, pdp]
+inputs: [playhouse.scripts, playhouse.main-document, source.code, project.config]
+---
+
+## Intent
+Checks the config and data the deployed site writes into each page's HTML for secrets, such as third-party API keys, client secrets, access tokens and passwords. Anything in the HTML can be read by every visitor, so a secret there must be treated as leaked. Unlike `security/public-client-secrets`, which reads the project's source, this checks what the live site actually sends, which includes values set as environment variables on Managed Runtime. Keys that are meant to be public, such as the Commerce API client id or a publishable payment key, are allowed.
+## Inspect
+The rule script lists the inline scripts Playhouse archived from each page's HTML (`data` file, paths relative to the page's `archiveDir`): `appConfig` (`window.__APP_CONFIG__`), `pageData` (React Router loader data) and `other` (every other inline script, such as analytics and tag snippets). Read all of them; secrets can have any property name and any format, so don't rely on names like `apiKey` or `secret` alone. Look at every value that looks like a credential: long random strings, tokens with known prefixes (`sk_`, `ghp_`, `xoxb-`, `AKIA`, `eyJ` for JWTs), URLs with credentials or tokens in them, private keys, and values under names like `key`, `token`, `secret`, `password`, `auth` or `credentials`. If a page has no archived scripts, `curl -sL <page url>` and read its inline scripts instead.
+
+For each candidate, decide whether it is public by design. Public: the Commerce API (SLAS) public client id, organization id, short code and site id; analytics and tag manager ids; payment publishable or client keys (`pk_live_`, Adyen client keys); reCAPTCHA site keys; search-only keys (Algolia search keys); error-reporting DSNs; map and other browser keys meant to be restricted by referrer. Secret: SLAS private client secrets, Commerce API or OCAPI client passwords, payment secret keys (`sk_live_`), cloud credentials, webhook signing secrets, admin or write API keys, access or refresh tokens issued to the server, private keys and passwords. When the same vendor issues both, check the vendor's key type or format. Then find where the value comes from in the project (config schema, `config.server.ts`, environment variable names, loaders) so the finding can say what to move.
+## Evaluate
+Report a `finding` when a page's HTML contains a secret. Use the rule's severity for credentials that grant write, admin or account access, and lower it for a key that only grants read access to public data. Keys you can't classify with confidence are `info` findings that ask the customer to confirm the key type. Pass when every candidate is public by design, and cite what was reviewed. The same config usually appears on every page; cite it once and say so.
+## Evidence
+For each secret: the archived script that contains it (`playhouse`) with a `value` naming its location in the config or data (for example `engagement.adapters.reviews.apiKey`) and the key type, never the secret itself; and `source` evidence for where the project puts it into browser config or loader data. Replace the value with `[redacted]` everywhere, including in the summary and remediation.
+## Remediation
+Keep the secret on the server: read it in server-only code (loaders, actions or server middleware) instead of browser config, or call the third party through a server route. Then rotate the leaked secret, since anyone who loaded the page may have copied it.
+## Examples
+Compliant: `__APP_CONFIG__` with the SLAS public client id and a Stripe publishable key. Problematic: `__APP_CONFIG__` with a reviews vendor's write API key, or loader data with a server access token.

package/dist/audit/catalog/categories/security/rules/protected-route-authorization.md

@@ -0,0 +1,19 @@
+---
+id: security/protected-route-authorization
+title: Server-Side Access Checks for Shopper Data
+severity: critical
+appliesTo: [account, checkout]
+inputs: [source.code, manual.authorization]
+---
+## Intent
+Checks that the loaders and actions behind account, order, profile and checkout pages verify on the server that the shopper is signed in and allowed to see that specific record. Hiding a page in the UI isn't protection: without a server check, anyone can request another shopper's data directly.
+## Inspect
+Trace account, order, profile, and checkout loaders/actions through session and object authorization.
+## Evaluate
+Finding requires missing or bypassable server enforcement; UI guards do not count.
+## Evidence
+Cite route, server handler, authorization path, and reproduction where safe.
+## Remediation
+Enforce authentication and object-level authorization before data access.
+## Examples
+Compliant: loader rejects unauthorized user. Problematic: direct loader exposes orders. Ambiguous: custom guard body unavailable.

package/dist/audit/catalog/categories/security/rules/public-client-secrets.md

@@ -0,0 +1,20 @@
+---
+id: security/public-client-secrets
+title: Secrets Exposed to the Browser
+severity: critical
+appliesTo: [project]
+inputs: [source.code, project.config]
+---
+
+## Intent
+Checks the configuration sent to the browser (`PUBLIC__` variables and other client-side config) for secret keys, while allowing values meant to be public, such as site ids and publishable keys. Every visitor can read anything in client config.
+## Inspect
+Inspect PUBLIC__ and client-exposed config for secret-shaped keys/values while recognizing intentionally public site and publishable keys.
+## Evaluate
+Finding requires a credential with secret capability exposed to the client.
+## Evidence
+Cite only key name and source location with value replaced by [redacted].
+## Remediation
+Move server-side and rotate the exposed credential.
+## Examples
+Compliant: referrer-restricted public site key. Problematic: client secret under PUBLIC__. Ambiguous: high-entropy non-secret identifier.

package/dist/audit/catalog/categories/security/rules/raw-html-sinks.md

@@ -0,0 +1,20 @@
+---
+id: security/raw-html-sinks
+title: Unsanitized HTML (XSS)
+severity: high
+appliesTo: [project]
+inputs: [source.code]
+---
+
+## Intent
+Traces every `dangerouslySetInnerHTML` and `innerHTML` back to where its content comes from, such as the CMS, shoppers or APIs, and checks that untrusted content is sanitized first. Rendering unsanitized HTML lets injected scripts run on the site (cross-site scripting).
+## Inspect
+Trace dangerouslySetInnerHTML and innerHTML values backward through CMS/user inputs, transformations, sanitizers, and trust boundaries.
+## Evaluate
+Finding requires an untrusted or inadequately sanitized flow; sink presence alone, with every flow trusted or sanitized, is a pass.
+## Evidence
+Cite source, transformations, sanitizer policy, and sink lines without sensitive content.
+## Remediation
+Render structured data or apply a maintained context-appropriate sanitizer.
+## Examples
+Compliant: compile-time constant markup. Problematic: unsanitized CMS HTML. Ambiguous: sink with unresolved upstream source.

package/dist/audit/catalog/categories/security/rules/strict-transport-security.js

@@ -0,0 +1,183 @@
+import { c as matchDocument, s as headerValues } from "../../../../../har.js";
+import { z } from "zod";
+
+//#region src/audit/catalog/categories/security/rules/strict-transport-security.ts
+const documentResultSchema = z.object({
+	page: z.string(),
+	cell: z.string(),
+	harArtifact: z.string(),
+	networkArtifact: z.string(),
+	finalUrl: z.string().nullable(),
+	statusCode: z.number().nullable(),
+	header: z.string().nullable(),
+	maxAgeSeconds: z.number().nullable(),
+	includeSubDomains: z.boolean(),
+	result: z.enum([
+		"pass",
+		"fail",
+		"not-evaluated"
+	]),
+	reasons: z.array(z.string()),
+	evidence: z.array(z.object({
+		artifact: z.string(),
+		pointer: z.string(),
+		value: z.union([
+			z.string(),
+			z.number(),
+			z.boolean()
+		]).optional()
+	}).strict())
+}).strict();
+const dataSchema = z.object({ documents: z.array(documentResultSchema) }).strict();
+const MIN_MAX_AGE_SECONDS = 15552e3;
+function isDevelopmentUrl(value) {
+	try {
+		const url = new URL(value);
+		return url.protocol !== "https:" || [
+			"localhost",
+			"127.0.0.1",
+			"::1"
+		].includes(url.hostname);
+	} catch {
+		return true;
+	}
+}
+function parseHeader(value) {
+	if (value === null) return {
+		maxAgeSeconds: null,
+		includeSubDomains: false
+	};
+	const directives = value.split(";").map((item) => item.trim()).filter(Boolean);
+	const match = directives.find((item) => /^max-age\s*=/i.test(item))?.match(/^max-age\s*=\s*"?(\d+)"?$/i);
+	return {
+		maxAgeSeconds: match ? Number(match[1]) : null,
+		includeSubDomains: directives.some((item) => /^includesubdomains$/i.test(item))
+	};
+}
+const prepare = async ({ pages, playhouse }) => {
+	const documents = [];
+	for (const page of pages) {
+		const harArtifacts = (await playhouse.artifactNames(page.label)).filter((name) => /^network-.+\.har$/.test(name));
+		if (!harArtifacts.length) {
+			documents.push({
+				page: page.label,
+				cell: "unknown",
+				harArtifact: "network-{cell}.har",
+				networkArtifact: "network-{cell}.json",
+				finalUrl: null,
+				statusCode: null,
+				header: null,
+				maxAgeSeconds: null,
+				includeSubDomains: false,
+				result: "not-evaluated",
+				reasons: ["No representative HAR artifact was available."],
+				evidence: []
+			});
+			continue;
+		}
+		for (const harArtifact of harArtifacts) {
+			const cell = /^network-(.+)\.har$/.exec(harArtifact)?.[1];
+			if (!cell) continue;
+			const networkArtifact = `network-${cell}.json`;
+			const match = await matchDocument(playhouse, page.label, cell);
+			const { finalUrl } = match;
+			if (finalUrl && isDevelopmentUrl(finalUrl)) {
+				documents.push({
+					page: page.label,
+					cell,
+					harArtifact,
+					networkArtifact,
+					finalUrl,
+					statusCode: null,
+					header: null,
+					maxAgeSeconds: null,
+					includeSubDomains: false,
+					result: "not-evaluated",
+					reasons: ["The final document is not an eligible public HTTPS URL."],
+					evidence: []
+				});
+				continue;
+			}
+			if ("reason" in match) {
+				documents.push({
+					page: page.label,
+					cell,
+					harArtifact,
+					networkArtifact,
+					finalUrl,
+					statusCode: null,
+					header: null,
+					maxAgeSeconds: null,
+					includeSubDomains: false,
+					result: "not-evaluated",
+					reasons: [match.reason],
+					evidence: []
+				});
+				continue;
+			}
+			const matched = match.document;
+			const hstsHeaders = headerValues(matched.entry, "strict-transport-security");
+			const header = hstsHeaders.length === 1 ? hstsHeaders[0].value : null;
+			const parsed = parseHeader(header);
+			const reasons = [];
+			if (hstsHeaders.length === 0) reasons.push("Strict-Transport-Security is missing.");
+			else if (hstsHeaders.length > 1) reasons.push("Multiple Strict-Transport-Security headers make the effective policy ambiguous.");
+			if (hstsHeaders.length === 1 && parsed.maxAgeSeconds === null) reasons.push("max-age is missing or invalid.");
+			else if (parsed.maxAgeSeconds !== null && parsed.maxAgeSeconds < MIN_MAX_AGE_SECONDS) reasons.push(`max-age is below ${MIN_MAX_AGE_SECONDS} seconds.`);
+			if (hstsHeaders.length === 1 && !parsed.includeSubDomains) reasons.push("includeSubDomains is missing.");
+			const result = hstsHeaders.length > 1 ? "not-evaluated" : reasons.length ? "fail" : "pass";
+			const evidence = [{
+				artifact: harArtifact,
+				pointer: `/log/entries/${matched.index}/request/url`,
+				value: match.finalUrl
+			}, ...header !== null ? [{
+				artifact: harArtifact,
+				pointer: `/log/entries/${matched.index}/response/headers/${hstsHeaders[0].index}/value`,
+				value: header
+			}] : []];
+			documents.push({
+				page: page.label,
+				cell,
+				harArtifact,
+				networkArtifact,
+				finalUrl: match.finalUrl,
+				statusCode: matched.entry.response.status,
+				header,
+				maxAgeSeconds: parsed.maxAgeSeconds,
+				includeSubDomains: parsed.includeSubDomains,
+				result,
+				reasons,
+				evidence
+			});
+		}
+	}
+	const failed = documents.filter((item) => item.result === "fail");
+	const unresolved = documents.filter((item) => item.result === "not-evaluated");
+	const passed = documents.filter((item) => item.result === "pass");
+	const evidenceFor = (items) => items.flatMap((item) => item.evidence.map((evidence) => ({
+		type: "playhouse",
+		page: item.page,
+		...evidence
+	})));
+	if (failed.length) return {
+		data: { documents },
+		decision: {
+			status: "fail",
+			summary: `${failed.length} HTML page response${failed.length === 1 ? "" : "s"} failed the HSTS baseline (max-age of at least 15552000 seconds with includeSubDomains).`,
+			evidence: evidenceFor(failed)
+		}
+	};
+	if (passed.length && !unresolved.length) return {
+		data: { documents },
+		decision: {
+			status: "pass",
+			summary: `${passed.length} HTML page response${passed.length === 1 ? "" : "s"} sent Strict-Transport-Security with a max-age of at least 15552000 seconds and includeSubDomains.`,
+			evidence: evidenceFor(passed)
+		}
+	};
+	return { data: { documents } };
+};
+var strict_transport_security_default = prepare;
+
+//#endregion
+export { dataSchema, strict_transport_security_default as default };

package/dist/audit/catalog/categories/security/rules/strict-transport-security.md

@@ -0,0 +1,24 @@
+---
+id: security/strict-transport-security
+title: HTTPS-Only Header (HSTS)
+severity: high
+appliesTo: [home, plp, pdp]
+inputs: [playhouse.network-har, playhouse.document, source.code]
+---
+
+## Intent
+Checks that each page's HTML response sends `Strict-Transport-Security` with a `max-age` of at least 180 days (15552000 seconds) and `includeSubDomains`. The header tells browsers to always use HTTPS for the site, so an attacker can't intercept a first plain-HTTP request.
+## Inspect
+Match the final HTTPS document response in a representative sanitized HAR and inspect `Strict-Transport-Security`. Inspect edge or Storefront Next configuration only to explain the deployed value.
+
+## Evaluate
+Create a finding when HSTS is missing, `max-age` is invalid or below 15552000 seconds, or `includeSubDomains` is absent from the expected production baseline. Do not evaluate localhost or plain-HTTP development URLs. Use `not-verified` when the final HTTPS document cannot be matched.
+
+## Evidence
+Cite page, sanitized final URL, HTTPS status, and the HSTS directives needed for the conclusion. Do not cite unrelated headers or unredacted URL parameters.
+
+## Remediation
+Restore the Storefront Next or public-edge HSTS baseline and verify the deployed response. Confirm organizational ownership before adding `preload`.
+
+## Examples
+Compliant: `max-age=15552000; includeSubDomains`. Problematic: HSTS is absent on production HTTPS. Ambiguous: the audit target is localhost; mark not applicable rather than passing it.

package/dist/audit/catalog/categories/seo/CATEGORY.md

@@ -0,0 +1,17 @@
+# SEO
+
+## Purpose and boundaries
+
+Inspect delivered main-document evidence together with route metadata source. A helper's presence is not proof of correct output on every page.
+
+## Investigation sequence
+
+Compare home, PLP, and PDP delivered metadata, then trace each value to source.
+
+## Evidence and redaction
+
+Cite delivered element/value and source line when available.
+
+## Severity and blind spots
+
+Crawler behavior and production indexing controls may vary by deployment.

package/dist/audit/catalog/categories/seo/rules/canonical-url.md

@@ -0,0 +1,20 @@
+---
+id: seo/canonical-url
+title: Canonical URL
+severity: high
+appliesTo: [home, plp, pdp]
+inputs: [playhouse.main-document, source.code]
+---
+
+## Intent
+Checks that each page declares a canonical URL (`<link rel="canonical">`) pointing to its own clean URL, and that variants such as query strings, locales and filtered category pages point to the right one. Search engines use it to merge duplicate URLs into one result.
+## Inspect
+Compare each delivered canonical with the final URL and inspect handling of query, locale, PLP, and PDP variants.
+## Evaluate
+Finding requires missing, malformed, cross-page, or incorrect canonical output on a captured page.
+## Evidence
+Cite page URL, delivered canonical value, and generation source.
+## Remediation
+Emit one absolute self-consistent canonical for the clean page URL.
+## Examples
+Compliant: PDP canonical drops tracking parameters. Problematic: every page canonicalizes to home. Ambiguous: helper exists but output was not captured.