@thymian/rules-rfc-6797 0.0.0-stage → 0.3.0

package/README.md

@@ -1,3 +1,159 @@
-# Temporary Holding Version
+<!-- HEADER:START - Do not remove or modify this section -->
+<div align="center">
+  <img src="https://raw.githubusercontent.com/thymianofficial/thymian/main/astro-docs/src/assets/logo.svg" alt="Thymian Logo" width="200"/>
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# Thymian
+
+**Add resilience and HTTP conformance to your API development workflow**
+
+[![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL%203.0-green.svg)](https://github.com/thymianofficial/thymian/blob/main/LICENSE)
+[![CI](https://github.com/thymianofficial/thymian/actions/workflows/ci.yaml/badge.svg)](https://github.com/thymianofficial/thymian/actions/workflows/ci.yaml)
+[![Documentation](https://img.shields.io/badge/docs-thymian.dev-green.svg)](https://thymian.dev)
+[![Discord](https://img.shields.io/discord/1440702693768429791?logo=discord&label=Discord&color=5865F2)](https://discord.gg/TRSwCxbz9f)
+[![Reddit](https://img.shields.io/badge/Reddit-ThymianOfficial-FF4500?logo=reddit)](https://www.reddit.com/r/ThymianOfficial/)
+[![Twitter](https://img.shields.io/badge/Twitter-@thymiandev-1DA1F2?logo=x)](https://x.com/thymiandev)
+
+</div>
+<!-- HEADER:END -->
+
+## @thymian/rules-rfc-6797
+
+A rule set for HTTP Strict Transport Security as defined in RFC 6797 (HSTS): the `Strict-Transport-Security` header a host sends, and how it answers a request that arrives over plain HTTP.
+
+Only the parts of RFC 6797 a host can be held to are in scope: §6 (the header's syntax), §7 (the server processing model) and §9.2 (the effective request URI). The user-agent processing model (§8) constrains browsers, which Thymian cannot observe. The Coverage section below is generated from the package's coverage record and states how many of those units the shipped rules check.
+
+## Installation
+
+```bash
+npm install @thymian/rules-rfc-6797
+```
+
+Then add it to the `ruleSets` of your `thymian.config.yaml`:
+
+```yaml
+ruleSets:
+  - '@thymian/rules-rfc-6797'
+```
+
+> **Getting started with Thymian?** See the [main Thymian package](https://www.npmjs.com/package/thymian) for quick installation and first-run instructions.
+
+<!-- COVERAGE:START - Generated by `nx run rules-rfc-6797:generate-coverage`. Do not edit by hand. -->
+
+## Coverage
+
+**14 of 14** units covered, by **15** rule(s).
+
+- Source: RFC 6797 (November 2012)
+- Counting rule: One unit per paragraph of §6, §7 and §9.2 — the chapters addressed to the host — that contains a BCP 14 keyword.
+
+Not yet covered: none.
+
+## Severity map
+
+| Severity | Keyword | recommended | strict | minimal |
+| -------- | ------- | ----------- | ------ | ------- |
+| error    | MUST    | 11          | 9      | 7       |
+| warn     | SHOULD  | 0           | 1      | 0       |
+| hint     | MAY     | 4           | 5      | 0       |
+| off      | (off)   | 2           | 2      | 10      |
+
+## Conventions
+
+### rfc6797/server-should-redirect-insecure-requests-to-https
+
+RFC 6797 asks for this redirect only from a host that has already chosen to be an HSTS Host, and the recommended profile requires it of every server because a plain-HTTP request not answered by a permanent redirect — typically a typed bare domain on a first visit — is exactly the downgrade window HSTS exists to close, and the one place its header can never be delivered.
+
+### rfc6797/server-should-send-sts-header-over-secure-transport
+
+RFC 6797 only permits a host to establish HSTS by sending this header and asks it of every response only from a host that has already chosen to be an HSTS Host, and the recommended profile requires it of every server because, outside the browsers' pre-load lists, the header is the only way a browser learns the policy, so a response without it leaves every first visit, and every visit after the policy lapses, open to a downgrade to plain HTTP.
+
+## Rule verdicts
+
+### effective-request-uri
+
+| Rule                                                                                       | static                           | analytics                        | test                             |
+| ------------------------------------------------------------------------------------------ | -------------------------------- | -------------------------------- | -------------------------------- |
+| rfc6797/hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris | impossible (peer-not-observable) | impossible (peer-not-observable) | impossible (peer-not-observable) |
+
+### server-processing-model
+
+| Rule                                                               | static                         | analytics                     | test                          |
+| ------------------------------------------------------------------ | ------------------------------ | ----------------------------- | ----------------------------- |
+| rfc6797/hsts-host-must-not-send-sts-header-over-insecure-transport | observable                     | observable                    | observable                    |
+| rfc6797/hsts-host-must-send-only-one-sts-header                    | impossible (not-representable) | observable                    | observable                    |
+| rfc6797/hsts-host-should-redirect-insecure-requests-to-https       | heuristic                      | heuristic                     | heuristic                     |
+| rfc6797/https-redirect-is-should-for-deployment-reasons            | impossible (nothing-to-check)  | impossible (nothing-to-check) | impossible (nothing-to-check) |
+| rfc6797/server-may-establish-hsts-over-secure-transport            | observable                     | observable                    | observable                    |
+| rfc6797/server-should-redirect-insecure-requests-to-https          | observable                     | observable                    | observable                    |
+| rfc6797/server-should-send-sts-header-over-secure-transport        | observable                     | observable                    | observable                    |
+| rfc6797/sts-header-inclusion-is-should-to-accommodate-caches       | impossible (nothing-to-check)  | impossible (nothing-to-check) | impossible (nothing-to-check) |
+
+### syntax
+
+| Rule                                                         | static                           | analytics                        | test                             |
+| ------------------------------------------------------------ | -------------------------------- | -------------------------------- | -------------------------------- |
+| rfc6797/hsts-host-may-assert-include-subdomains              | observable                       | observable                       | observable                       |
+| rfc6797/hsts-host-must-not-repeat-sts-directives             | observable                       | observable                       | observable                       |
+| rfc6797/hsts-host-must-send-include-subdomains-without-value | observable                       | observable                       | observable                       |
+| rfc6797/hsts-host-must-send-max-age-as-delta-seconds         | observable                       | observable                       | observable                       |
+| rfc6797/hsts-host-must-send-max-age-directive                | observable                       | observable                       | observable                       |
+| rfc6797/hsts-host-must-send-sts-header-conforming-to-grammar | observable                       | observable                       | observable                       |
+| rfc6797/user-agent-must-enforce-hsts-policy                  | impossible (peer-not-observable) | impossible (peer-not-observable) | impossible (peer-not-observable) |
+| rfc6797/user-agent-must-ignore-unrecognized-sts-directives   | heuristic                        | heuristic                        | heuristic                        |
+
+## Tag status
+
+### security
+
+- `security:transport` — 17 rule(s)
+- `security:cors` — ships empty
+- `security:cookies` — ships empty
+- `security:csp` — ships empty
+- `security:content-type` — ships empty
+- `security:authentication` — ships empty
+- `security:authorization` — ships empty
+- `security:disclosure` — ships empty
+- `security:dos` — ships empty
+- `security:cache-poisoning` — ships empty
+- `security:request-smuggling` — ships empty
+- `security:clickjacking` — ships empty
+- `security:csrf` — ships empty
+- `security:spoofing` — ships empty
+
+### privacy
+
+- `privacy:tracking` — ships empty
+- `privacy:fingerprinting` — ships empty
+- `privacy:referrer` — ships empty
+
+<!-- COVERAGE:END -->
+
+<!-- FOOTER:START - Do not remove or modify this section -->
+
+## 📚 Documentation
+
+- **[Getting Started](https://thymian.dev/introduction/getting-started)** - Set up Thymian in minutes
+- **[Documentation](https://thymian.dev)** - Comprehensive guides and API reference
+- **[CLI Reference](https://thymian.dev/references/cli)** - Complete CLI command documentation
+- **[HTTP Rules](https://thymian.dev/guides/http-rules/how-to-use-rules)** - Learn about HTTP conformance validation
+
+## 🏢 Enterprise Support
+
+Get professional consulting and dedicated support from the creators of Thymian. We offer:
+
+- API design and governance strategies
+- HTTP standards compliance auditing
+- Custom plugin development
+- Custom rule development
+- Team training and workshops
+
+**[Learn more about Enterprise Support](https://thymian.dev/enterprise)** | **Email: [support@thymian.dev](mailto:support@thymian.dev)**
+
+---
+
+<div align="center">
+
+**Shipped with 🌱 by [qupaya](https://qupaya.com)**
+
+</div>
+<!-- FOOTER:END -->

package/dist/coverage.d.ts

@@ -0,0 +1,291 @@
+declare const _default: import("@thymian/core").CoverageRecord<{
+    readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+    readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+    readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+    readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+    readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+    readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+    readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+    readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+    readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+    readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+    readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+    readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+    readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+    readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+}, {
+    readonly 'rfc6797/user-agent-must-enforce-hsts-policy': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/hsts-host-must-not-repeat-sts-directives': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/hsts-host-must-send-sts-header-conforming-to-grammar': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/user-agent-must-ignore-unrecognized-sts-directives': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/hsts-host-must-send-max-age-directive': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/hsts-host-must-send-max-age-as-delta-seconds': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/hsts-host-must-send-include-subdomains-without-value': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/hsts-host-may-assert-include-subdomains': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/hsts-host-must-send-only-one-sts-header': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/server-may-establish-hsts-over-secure-transport': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/sts-header-inclusion-is-should-to-accommodate-caches': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/hsts-host-should-redirect-insecure-requests-to-https': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/https-redirect-is-should-for-deployment-reasons': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/hsts-host-must-not-send-sts-header-over-insecure-transport': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/server-should-send-sts-header-over-secure-transport': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/server-should-redirect-insecure-requests-to-https': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+    readonly 'rfc6797/hsts-host-must-not-treat-empty-path-as-slash-when-comparing-effective-request-uris': import("@thymian/core").CoverageEntry<{
+        readonly '6.1/1': "The STS header field indicates to a UA that it MUST enforce the HSTS Policy in regards to the host emitting the response.";
+        readonly '6.1/2': "All directives MUST appear only once in an STS header field.";
+        readonly '6.1/3': "UAs MUST ignore any STS header field containing directives, or other header field value data, that does not conform to the syntax.";
+        readonly '6.1/4': "If an STS header field contains directives not recognized by the UA, the UA MUST ignore them and process the recognized ones.";
+        readonly '6.1.1/1': "The REQUIRED max-age directive specifies how many seconds the UA regards the host as a Known HSTS Host.";
+        readonly '6.1.1/2': "The max-age directive's REQUIRED value is delta-seconds (1*DIGIT), after quoted-string unescaping.";
+        readonly '6.1.2/1': "The OPTIONAL includeSubDomains directive is a valueless directive that extends the HSTS Policy to subdomains.";
+        readonly '7.1/1': "Over secure transport, an HSTS Host SHOULD include an STS header field that MUST satisfy the §6.1 grammar, and MUST include only one.";
+        readonly '7.1/2': "Establishing a Known HSTS Host MAY be accomplished by returning a valid STS header field over secure transport; a pre-loaded list MAY also be used.";
+        readonly '7.1/3': "NOTE: including the STS header field is a SHOULD to accommodate caches and load balancing.";
+        readonly '7.2/1': "Over non-secure transport, an HSTS Host SHOULD answer with a permanent redirect whose Location has the https scheme.";
+        readonly '7.2/2': "NOTE: the redirect is a SHOULD rather than a MUST because of redirect risks and deployment characteristics.";
+        readonly '7.2/3': "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.";
+        readonly '9.2/1': "Effective request URIs are compared per RFC 2616 §3.2.3, except that empty path components MUST NOT be treated as equivalent to an absolute path of \"/\".";
+    }>;
+}>;
+export default _default;
+//# sourceMappingURL=coverage.d.ts.map

package/dist/coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.d.ts","sourceRoot":"","sources":["../src/coverage.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,wBAyHG"}