@thymian/rules-rfc-6797 0.0.0-stage → 0.3.0

package/dist/rules/utils/results.d.ts

@@ -0,0 +1,5 @@
+import type { RuleFnResult, RuleViolationLocation } from '@thymian/core';
+export type RuleOptions = Record<PropertyKey, unknown>;
+export declare function violation(location: RuleViolationLocation, message: string): RuleFnResult;
+export declare function ruleSkip(location: RuleViolationLocation, ruleName: string, message: string): RuleFnResult;
+//# sourceMappingURL=results.d.ts.map

package/dist/rules/utils/results.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"results.d.ts","sourceRoot":"","sources":["../../../src/rules/utils/results.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAGzE,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAEvD,wBAAgB,SAAS,CACvB,QAAQ,EAAE,qBAAqB,EAC/B,OAAO,EAAE,MAAM,GACd,YAAY,CAEd;AAID,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,YAAY,CAKd"}

package/dist/rules/utils/results.js

@@ -0,0 +1,14 @@
+// What the rule functions of this package return — a violation, or a
+// `rule-skip` for an input a rule cannot decide — and the options they take.
+export function violation(location, message) {
+    return { location, violation: { message }, findings: [] };
+}
+// A result that says the rule could not decide this input, rather than pass
+// it: a finding with no violation, which the reports render as skipped.
+export function ruleSkip(location, ruleName, message) {
+    return {
+        location,
+        findings: [{ kind: 'rule-skip', title: ruleName, message }],
+    };
+}
+//# sourceMappingURL=results.js.map

package/dist/rules/utils/results.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"results.js","sourceRoot":"","sources":["../../../src/rules/utils/results.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,6EAA6E;AAO7E,MAAM,UAAU,SAAS,CACvB,QAA+B,EAC/B,OAAe;IAEf,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC5D,CAAC;AAED,4EAA4E;AAC5E,wEAAwE;AACxE,MAAM,UAAU,QAAQ,CACtB,QAA+B,EAC/B,QAAgB,EAChB,OAAe;IAEf,OAAO;QACL,QAAQ;QACR,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC"}

package/dist/rules/utils/sts-contexts.d.ts

@@ -0,0 +1,12 @@
+import { type ApiContext, type HttpResponse, type LintContext, type LiveApiContext, type RuleFn } from '@thymian/core';
+import { type RuleOptions } from './results.js';
+import { type StsDirective } from './sts-field-value.js';
+export declare function liveStsValues(headers: HttpResponse['headers']): string[];
+export type StsFieldCheck = (fieldValue: string) => string | undefined;
+export declare function onConformingValue(check: (directives: StsDirective[], fieldValue: string) => string | undefined): StsFieldCheck;
+export declare function stsValueRuleFns(ruleName: string, check: StsFieldCheck): {
+    lint: RuleFn<LintContext, RuleOptions>;
+    live: RuleFn<LiveApiContext, RuleOptions>;
+};
+export declare function stsPresenceRuleFn(message: string): RuleFn<ApiContext, RuleOptions>;
+//# sourceMappingURL=sts-contexts.d.ts.map

package/dist/rules/utils/sts-contexts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sts-contexts.d.ts","sourceRoot":"","sources":["../../../src/rules/utils/sts-contexts.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,UAAU,EAEf,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EAGnB,KAAK,MAAM,EAGZ,MAAM,eAAe,CAAC;AAQvB,OAAO,EAAE,KAAK,WAAW,EAAuB,MAAM,cAAc,CAAC;AACrE,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAK9B,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAExE;AAGD,MAAM,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAKvE,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAC5E,aAAa,CAKf;AAKD,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,aAAa,GACnB;IACD,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;CAC3C,CAiDA;AAQD,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAOjC"}

package/dist/rules/utils/sts-contexts.js

@@ -0,0 +1,69 @@
+// The execution functions of the rules that check the Strict-Transport-
+// Security header, and the STS field lines of a live response. The common
+// interface is value-blind — it sees header names only — so every value
+// check overrides all three contexts: `static` reads the value the API
+// description pins, `test` and `analytics` read the value that was actually
+// sent. Presence, a name, is the one check the common interface carries.
+import { constant, protocol, responseHeader, } from '@thymian/core';
+import { carriesHeader, describedTransaction, liveHeaderValues, pinnedHeaderValues, } from './headers.js';
+import { ruleSkip, violation } from './results.js';
+import { parseStsFieldValue, STS_HEADER, } from './sts-field-value.js';
+// Every STS field line of a live response. More than one is what
+// `hsts-host-must-send-only-one-sts-header` checks; a value rule holds each
+// field line to its requirement on its own.
+export function liveStsValues(headers) {
+    return liveHeaderValues(headers, STS_HEADER);
+}
+// A directive-level rule owns one requirement and takes the generic grammar
+// for granted: a field value that does not parse is left to the grammar rule,
+// which reports it once — one defect, one violation — and passes here.
+export function onConformingValue(check) {
+    return (fieldValue) => {
+        const parsed = parseStsFieldValue(fieldValue);
+        return parsed.conforms ? check(parsed.directives, fieldValue) : undefined;
+    };
+}
+// The execution functions of a rule that holds every STS field value to one
+// check: `lint` for `.overrideStaticRule()`, `live` for `.overrideTest()` and
+// `.overrideAnalyticsRule()`.
+export function stsValueRuleFns(ruleName, check) {
+    const evaluate = (location, fieldValues) => {
+        const problems = fieldValues
+            .map(check)
+            .filter((problem) => problem !== undefined);
+        return problems.length === 0
+            ? []
+            : [violation(location, problems.join(' '))];
+    };
+    return {
+        // A function validator, not the lint context's `validateHttpTransactions`:
+        // that one keeps only results carrying a violation, and an unpinned value
+        // must surface as a `rule-skip` rather than vanish into a pass.
+        lint: (ctx) => ctx.validateCommonHttpTransactions(responseHeader(STS_HEADER), (_req, _res, location) => {
+            const res = describedTransaction(ctx, location)?.thymianRes;
+            const values = res === undefined ? undefined : pinnedHeaderValues(res, STS_HEADER);
+            if (values === undefined) {
+                return [
+                    ruleSkip(location, ruleName, 'The API description declares Strict-Transport-Security without pinning its value (const, enum or examples), so the value cannot be checked statically.'),
+                ];
+            }
+            return evaluate(location, values);
+        }),
+        // `constant(true)` as the candidate filter: `test` picks the requests it
+        // sends by the candidate filter alone, over the *described* transactions,
+        // so a response-side candidate (`responseHeader(STS_HEADER)`) would only
+        // send the requests whose description already declares the header — and
+        // miss a server that sends it where the description does not say so.
+        live: (ctx) => ctx.validateHttpTransactions(constant(true), (_req, res, location) => evaluate(location, liveStsValues(res.headers))),
+    };
+}
+// The execution function of a rule that flags a response over secure
+// transport without a Strict-Transport-Security header. Presence is the one
+// STS check the common interface can carry on its own: it sees the scheme
+// through its request filter and header names on the response, so one
+// function serves all three contexts — the declared headers in `static`, the
+// headers sent in `test` and `analytics`.
+export function stsPresenceRuleFn(message) {
+    return (ctx) => ctx.validateCommonHttpTransactions(protocol('https'), (_req, res, location) => carriesHeader(res, STS_HEADER) ? [] : [violation(location, message)]);
+}
+//# sourceMappingURL=sts-contexts.js.map

package/dist/rules/utils/sts-contexts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sts-contexts.js","sourceRoot":"","sources":["../../../src/rules/utils/sts-contexts.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AAEzE,OAAO,EAEL,QAAQ,EAIR,QAAQ,EACR,cAAc,GAIf,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAoB,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EACL,kBAAkB,EAClB,UAAU,GAEX,MAAM,sBAAsB,CAAC;AAE9B,iEAAiE;AACjE,4EAA4E;AAC5E,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAAC,OAAgC;IAC5D,OAAO,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC/C,CAAC;AAKD,4EAA4E;AAC5E,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAC/B,KAA6E;IAE7E,OAAO,CAAC,UAAU,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,8BAA8B;AAC9B,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,KAAoB;IAKpB,MAAM,QAAQ,GAAG,CACf,QAA+B,EAC/B,WAAqB,EACL,EAAE;QAClB,MAAM,QAAQ,GAAG,WAAW;aACzB,GAAG,CAAC,KAAK,CAAC;aACV,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;QAEjE,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC1B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,OAAO;QACL,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,8BAA8B,CAChC,cAAc,CAAC,UAAU,CAAC,EAC1B,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YACvB,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC;YAC5D,MAAM,MAAM,GACV,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAEtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;oBACL,QAAQ,CACN,QAAQ,EACR,QAAQ,EACR,wJAAwJ,CACzJ;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CACF;QACH,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CACnE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAC/C;KACJ,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,4EAA4E;AAC5E,0EAA0E;AAC1E,sEAAsE;AACtE,6EAA6E;AAC7E,0CAA0C;AAC1C,MAAM,UAAU,iBAAiB,CAC/B,OAAe;IAEf,OAAO,CAAC,GAAG,EAAE,EAAE,CACb,GAAG,CAAC,8BAA8B,CAChC,QAAQ,CAAC,OAAO,CAAC,EACjB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CACtB,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CACvE,CAAC;AACN,CAAC"}

package/dist/rules/utils/sts-field-value.d.ts

@@ -0,0 +1,17 @@
+export declare const STS_HEADER = "strict-transport-security";
+export type StsDirective = {
+    name: string;
+    value?: string;
+};
+export type StsFieldValue = {
+    conforms: true;
+    directives: StsDirective[];
+} | {
+    conforms: false;
+    problem: string;
+};
+export declare function parseStsFieldValue(fieldValue: string): StsFieldValue;
+export declare function findDirectives(directives: readonly StsDirective[], name: string): StsDirective[];
+export declare function isDeltaSeconds(value: string | undefined): value is string;
+export declare function maxAgeSeconds(directives: readonly StsDirective[]): number | undefined;
+//# sourceMappingURL=sts-field-value.d.ts.map

package/dist/rules/utils/sts-field-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sts-field-value.d.ts","sourceRoot":"","sources":["../../../src/rules/utils/sts-field-value.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,UAAU,8BAA8B,CAAC;AAMtD,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,YAAY,EAAE,CAAA;CAAE,GAC9C;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAqBzC,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,CAqGpE;AAED,wBAAgB,cAAc,CAC5B,UAAU,EAAE,SAAS,YAAY,EAAE,EACnC,IAAI,EAAE,MAAM,GACX,YAAY,EAAE,CAEhB;AAGD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAEzE;AAKD,wBAAgB,aAAa,CAC3B,UAAU,EAAE,SAAS,YAAY,EAAE,GAClC,MAAM,GAAG,SAAS,CAGpB"}

package/dist/rules/utils/sts-field-value.js

@@ -0,0 +1,133 @@
+// The Strict-Transport-Security field value, parsed against RFC 6797 §6.1:
+//
+//   Strict-Transport-Security = "Strict-Transport-Security" ":"
+//                               [ directive ]  *( ";" [ directive ] )
+//   directive                 = directive-name [ "=" directive-value ]
+//   directive-name            = token
+//   directive-value           = token | quoted-string
+//
+// with RFC 2616's token and quoted-string, and its implied linear whitespace
+// between them. This is the generic grammar only: what each directive must
+// look like (max-age's delta-seconds, includeSubDomains being valueless, no
+// directive twice) is left to the rule that owns that requirement, so one
+// defect in a header yields one violation from one rule.
+export const STS_HEADER = 'strict-transport-security';
+// RFC 2616 §2.2: token = 1*<any CHAR except CTLs or separators>.
+const SEPARATORS = new Set('()<>@,;:\\"/[]?={} \t');
+function isTokenChar(char) {
+    const code = char.charCodeAt(0);
+    return code > 31 && code < 127 && !SEPARATORS.has(char);
+}
+// RFC 2616 §2.2: qdtext is any TEXT but <">, and TEXT is any octet except
+// CTLs but including linear whitespace, so a horizontal tab stays.
+function isControl(char) {
+    const code = char.charCodeAt(0);
+    return (code < 32 && char !== '\t') || code === 127;
+}
+function describeChar(char) {
+    return char === undefined ? 'the end of the value' : JSON.stringify(char);
+}
+export function parseStsFieldValue(fieldValue) {
+    const directives = [];
+    let i = 0;
+    const skipWhitespace = () => {
+        while (fieldValue[i] === ' ' || fieldValue[i] === '\t') {
+            i++;
+        }
+    };
+    const readToken = () => {
+        const start = i;
+        while (i < fieldValue.length && isTokenChar(fieldValue[i])) {
+            i++;
+        }
+        return fieldValue.slice(start, i);
+    };
+    // Positioned on the opening quote; returns the unescaped content, or
+    // undefined when the string never closes or carries a control character.
+    // A quoted-pair is "\" CHAR, so only US-ASCII may be escaped.
+    const readQuotedString = () => {
+        let content = '';
+        i++;
+        while (i < fieldValue.length) {
+            const char = fieldValue[i];
+            if (char === '"') {
+                i++;
+                return content;
+            }
+            if (char === '\\') {
+                const escaped = fieldValue[i + 1];
+                if (escaped === undefined || escaped.charCodeAt(0) > 127) {
+                    return undefined;
+                }
+                content += escaped;
+                i += 2;
+                continue;
+            }
+            if (isControl(char)) {
+                return undefined;
+            }
+            content += char;
+            i++;
+        }
+        return undefined;
+    };
+    const fail = (problem) => ({
+        conforms: false,
+        problem,
+    });
+    for (;;) {
+        skipWhitespace();
+        // An empty directive — nothing before the next ";" or the end — is
+        // allowed by `[ directive ] *( ";" [ directive ] )`.
+        if (i < fieldValue.length && fieldValue[i] !== ';') {
+            const name = readToken();
+            if (name === '') {
+                return fail(`expected a directive name but found ${describeChar(fieldValue[i])}`);
+            }
+            skipWhitespace();
+            let value;
+            if (fieldValue[i] === '=') {
+                i++;
+                skipWhitespace();
+                if (fieldValue[i] === '"') {
+                    value = readQuotedString();
+                    if (value === undefined) {
+                        return fail(`the quoted value of "${name}" is malformed`);
+                    }
+                }
+                else {
+                    value = readToken();
+                    if (value === '') {
+                        return fail(`"${name}=" is followed by ${describeChar(fieldValue[i])} instead of a token or a quoted-string`);
+                    }
+                }
+                skipWhitespace();
+            }
+            directives.push(value === undefined
+                ? { name: name.toLowerCase() }
+                : { name: name.toLowerCase(), value });
+        }
+        if (i >= fieldValue.length) {
+            return { conforms: true, directives };
+        }
+        if (fieldValue[i] !== ';') {
+            return fail(`directives must be separated by ";", but ${describeChar(fieldValue[i])} follows "${fieldValue.slice(0, i).trim()}"`);
+        }
+        i++;
+    }
+}
+export function findDirectives(directives, name) {
+    return directives.filter((directive) => directive.name === name);
+}
+// RFC 2616 §3.3.2: delta-seconds = 1*DIGIT.
+export function isDeltaSeconds(value) {
+    return value !== undefined && /^[0-9]+$/.test(value);
+}
+// The policy's lifetime: the first max-age, in seconds. `undefined` when
+// there is none or its value is not delta-seconds — each another rule's
+// defect, and in either case no policy is in effect to judge.
+export function maxAgeSeconds(directives) {
+    const value = findDirectives(directives, 'max-age')[0]?.value;
+    return isDeltaSeconds(value) ? Number(value) : undefined;
+}
+//# sourceMappingURL=sts-field-value.js.map

package/dist/rules/utils/sts-field-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sts-field-value.js","sourceRoot":"","sources":["../../../src/rules/utils/sts-field-value.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,gEAAgE;AAChE,sEAAsE;AACtE,uEAAuE;AACvE,sCAAsC;AACtC,sDAAsD;AACtD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,yDAAyD;AAEzD,MAAM,CAAC,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAYtD,iEAAiE;AACjE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAEpD,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,IAAI,GAAG,EAAE,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,0EAA0E;AAC1E,mEAAmE;AACnE,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,GAAG,EAAE,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,IAAwB;IAC5C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,UAAU,GAAmB,EAAE,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,MAAM,cAAc,GAAG,GAAG,EAAE;QAC1B,OAAO,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACvD,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,MAAM,KAAK,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,CAAW,CAAC,EAAE,CAAC;YACrE,CAAC,EAAE,CAAC;QACN,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC;IACF,qEAAqE;IACrE,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,gBAAgB,GAAG,GAAuB,EAAE;QAChD,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,CAAC,EAAE,CAAC;QACJ,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAW,CAAC;YACrC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,CAAC,EAAE,CAAC;gBACJ,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;oBACzD,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,OAAO,IAAI,OAAO,CAAC;gBACnB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,IAAI,IAAI,CAAC;YAChB,CAAC,EAAE,CAAC;QACN,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,CAAC;QAChD,QAAQ,EAAE,KAAK;QACf,OAAO;KACR,CAAC,CAAC;IAEH,SAAS,CAAC;QACR,cAAc,EAAE,CAAC;QAEjB,mEAAmE;QACnE,qDAAqD;QACrD,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;YACzB,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChB,OAAO,IAAI,CACT,uCAAuC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CACrE,CAAC;YACJ,CAAC;YACD,cAAc,EAAE,CAAC;YAEjB,IAAI,KAAyB,CAAC;YAC9B,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC1B,CAAC,EAAE,CAAC;gBACJ,cAAc,EAAE,CAAC;gBACjB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC1B,KAAK,GAAG,gBAAgB,EAAE,CAAC;oBAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,OAAO,IAAI,CAAC,wBAAwB,IAAI,gBAAgB,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,KAAK,GAAG,SAAS,EAAE,CAAC;oBACpB,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;wBACjB,OAAO,IAAI,CACT,IAAI,IAAI,qBAAqB,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,wCAAwC,CACjG,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,cAAc,EAAE,CAAC;YACnB,CAAC;YAED,UAAU,CAAC,IAAI,CACb,KAAK,KAAK,SAAS;gBACjB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE;gBAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CACxC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACxC,CAAC;QACD,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,IAAI,CACT,4CAA4C,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CACrH,CAAC;QACJ,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,UAAmC,EACnC,IAAY;IAEZ,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,cAAc,CAAC,KAAyB;IACtD,OAAO,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,yEAAyE;AACzE,wEAAwE;AACxE,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAC3B,UAAmC;IAEnC,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IAC9D,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC"}

package/dist/rules/utils/transport.d.ts

@@ -0,0 +1,4 @@
+import type { RuleFnResult, RuleViolationLocation } from '@thymian/core';
+export declare function isServerFallbackOrigin(origin: string): boolean;
+export declare function serverFallbackSkip(location: RuleViolationLocation, ruleName: string): RuleFnResult;
+//# sourceMappingURL=transport.d.ts.map

package/dist/rules/utils/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../../src/rules/utils/transport.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAezE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAM9D;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,MAAM,GACf,YAAY,CAMd"}

package/dist/rules/utils/transport.js

@@ -0,0 +1,24 @@
+// The transport a request travelled over, as far as a rule may judge it.
+import { ruleSkip } from './results.js';
+// A document with no `servers` entry, a relative server URL, or a variable
+// in the scheme or port that cannot be resolved is loaded as
+// `http://localhost:8080`: the scheme is Thymian's fallback, not the API's.
+// A rule judging the scheme skips exactly that origin in `static` and in
+// `test`, whose requests carry the described origin even when sent to a
+// target URL, rather than report a transport the description never declared.
+// A description that really declares `http://localhost:8080` is a local
+// development server, where HSTS is not demanded in practice either.
+// `analytics` never skips it: recorded traffic is real.
+const SERVER_FALLBACK_ORIGIN = 'http://localhost:8080';
+export function isServerFallbackOrigin(origin) {
+    try {
+        return new URL(origin).origin === SERVER_FALLBACK_ORIGIN;
+    }
+    catch {
+        return false;
+    }
+}
+export function serverFallbackSkip(location, ruleName) {
+    return ruleSkip(location, ruleName, `This request is served from ${SERVER_FALLBACK_ORIGIN}, which is also what Thymian loads an API description without a usable server URL as, so its scheme may be Thymian's rather than the API's and the transport is not judged.`);
+}
+//# sourceMappingURL=transport.js.map

package/dist/rules/utils/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../../src/rules/utils/transport.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAIzE,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,2EAA2E;AAC3E,6DAA6D;AAC7D,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,6EAA6E;AAC7E,wEAAwE;AACxE,qEAAqE;AACrE,wDAAwD;AACxD,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAEvD,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,sBAAsB,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAA+B,EAC/B,QAAgB;IAEhB,OAAO,QAAQ,CACb,QAAQ,EACR,QAAQ,EACR,+BAA+B,sBAAsB,6KAA6K,CACnO,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "@thymian/rules-rfc-6797",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.0",
+  "description": "Thymian rule set implementing RFC 6797 HTTP Strict Transport Security (HSTS) validation",
+  "license": "AGPL-3.0-only",
+  "bugs": {
+    "url": "https://github.com/thymianofficial/thymian/issues"
+  },
+  "homepage": "https://thymian.dev",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/thymianofficial/thymian.git",
+    "directory": "packages/rules-rfc-6797"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "keywords": [
+    "thymian",
+    "api-governance",
+    "http",
+    "http-conformance",
+    "http-rules",
+    "hsts",
+    "strict-transport-security",
+    "rfc-6797"
+  ],
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "type": "module",
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!**/*.tsbuildinfo"
+  ],
+  "dependencies": {
+    "@thymian/core": "0.3.0",
+    "tslib": "^2.3.0"
+  },
+  "devDependencies": {
+    "@thymian/core-testing": "0.3.0",
+    "@thymian/plugin-http-analyzer": "0.3.0",
+    "@thymian/plugin-http-linter": "0.3.0",
+    "@thymian/plugin-http-tester": "0.3.0"
+  }
+}