@thymian/rules-rfc-9110 0.0.0-PLACEHOLDER

package/dist/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-ignore-if-unmodified-since-header-if-no-date-available.rule.js

@@ -0,0 +1,9 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/recipient-must-ignore-if-unmodified-since-header-if-no-date-available')
+    .severity('error')
+    .type('informational')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-13.1.4')
+    .description('A recipient MUST ignore the If-Unmodified-Since header field if the resource does not have a modification date available.')
+    .tags('conditional-requests', 'if-modified-since', 'evaluation')
+    .done();
+//# sourceMappingURL=recipient-must-ignore-if-unmodified-since-header-if-no-date-available.rule.js.map

package/dist/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-ignore-if-unmodified-since-header-if-no-date-available.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-must-ignore-if-unmodified-since-header-if-no-date-available.rule.js","sourceRoot":"","sources":["../../../../../src/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-ignore-if-unmodified-since-header-if-no-date-available.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,+EAA+E,CAChF;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,eAAe,CAAC;KACrB,GAAG,CAAC,4DAA4D,CAAC;KACjE,WAAW,CACV,2HAA2H,CAC5H;KACA,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,YAAY,CAAC;KAC/D,IAAI,EAAE,CAAC"}

package/dist/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-ignore-if-unmodified-since-when-if-match-present.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=recipient-must-ignore-if-unmodified-since-when-if-match-present.rule.d.ts.map

package/dist/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-ignore-if-unmodified-since-when-if-match-present.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-must-ignore-if-unmodified-since-when-if-match-present.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-ignore-if-unmodified-since-when-if-match-present.rule.ts"],"names":[],"mappings":";AAGA,wBAmBU"}

package/dist/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-ignore-if-unmodified-since-when-if-match-present.rule.js

@@ -0,0 +1,13 @@
+import { and, requestHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/recipient-must-ignore-if-unmodified-since-when-if-match-present')
+    .severity('error')
+    .type('static', 'analytics')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-13.1.4')
+    .description('A recipient MUST ignore If-Unmodified-Since if the request contains an If-Match header field; the condition in If-Match is considered to be a more accurate replacement for the condition in If-Unmodified-Since, and the two are only combined for the sake of interoperating with older intermediaries that might not implement If-Match.')
+    .summary('Recipient MUST ignore If-Unmodified-Since when If-Match is present.')
+    .appliesTo('server', 'cache')
+    .tags('conditional-requests', 'if-unmodified-since', 'if-match')
+    .rule((ctx) => ctx.validateCommonHttpTransactions(and(requestHeader('if-match'), requestHeader('if-unmodified-since'))))
+    .done();
+//# sourceMappingURL=recipient-must-ignore-if-unmodified-since-when-if-match-present.rule.js.map

package/dist/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-ignore-if-unmodified-since-when-if-match-present.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-must-ignore-if-unmodified-since-when-if-match-present.rule.js","sourceRoot":"","sources":["../../../../../src/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-ignore-if-unmodified-since-when-if-match-present.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,yEAAyE,CAC1E;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC3B,GAAG,CAAC,4DAA4D,CAAC;KACjE,WAAW,CACV,6UAA6U,CAC9U;KACA,OAAO,CACN,qEAAqE,CACtE;KACA,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,IAAI,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,UAAU,CAAC;KAC/D,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,8BAA8B,CAChC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC,CACrE,CACF;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-interpret-if-unmodified-since-value-in-terms-of-servers-clock.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=recipient-must-interpret-if-unmodified-since-value-in-terms-of-servers-clock.rule.d.ts.map

package/dist/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-interpret-if-unmodified-since-value-in-terms-of-servers-clock.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-must-interpret-if-unmodified-since-value-in-terms-of-servers-clock.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-interpret-if-unmodified-since-value-in-terms-of-servers-clock.rule.ts"],"names":[],"mappings":";AAEA,wBAUU"}

package/dist/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-interpret-if-unmodified-since-value-in-terms-of-servers-clock.rule.js

@@ -0,0 +1,9 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/recipient-must-interpret-if-unmodified-since-value-in-terms-of-servers-clock')
+    .severity('error')
+    .type('informational')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-13.1.3')
+    .description("A recipient MUST interpret an If-Modified-Since field value's timestamp in terms of the origin server's clock.")
+    .tags('conditional-requests', 'if-modified-since', 'evaluation')
+    .done();
+//# sourceMappingURL=recipient-must-interpret-if-unmodified-since-value-in-terms-of-servers-clock.rule.js.map

package/dist/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-interpret-if-unmodified-since-value-in-terms-of-servers-clock.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-must-interpret-if-unmodified-since-value-in-terms-of-servers-clock.rule.js","sourceRoot":"","sources":["../../../../../src/rules/conditional-requests/preconditions/if-unmodified-since/recipient-must-interpret-if-unmodified-since-value-in-terms-of-servers-clock.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,sFAAsF,CACvF;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,eAAe,CAAC;KACrB,GAAG,CAAC,4DAA4D,CAAC;KACjE,WAAW,CACV,gHAAgH,CACjH;KACA,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,YAAY,CAAC;KAC/D,IAAI,EAAE,CAAC"}

package/dist/rules/conditional-requests/utils.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Utility functions for RFC9110 Conditional Requests validation
+ */
+/**
+ * Checks if an ETag is marked as weak (starts with W/)
+ * @param etag The ETag value to check
+ * @returns true if the ETag is weak, false otherwise
+ */
+export declare function isWeakETag(etag: string): boolean;
+/**
+ * Checks if an ETag is strong (not marked as weak)
+ * @param etag The ETag value to check
+ * @returns true if the ETag is strong, false otherwise
+ */
+export declare function isStrongETag(etag: string): boolean;
+/**
+ * Validates if a string is a valid HTTP-date according to RFC9110
+ * Accepts IMF-fixdate, obsolete RFC 850, and ANSI C's asctime() format
+ * @param date The date string to validate
+ * @returns true if valid HTTP-date, false otherwise
+ */
+export declare function isValidHttpDate(date: string): boolean;
+/**
+ * Compares two ETags according to RFC9110 rules
+ * @param etag1 First ETag to compare
+ * @param etag2 Second ETag to compare
+ * @param useWeakComparison If true, uses weak comparison; otherwise uses strong comparison
+ * @returns true if ETags match according to the comparison type
+ */
+export declare function compareETags(etag1: string, etag2: string, useWeakComparison: boolean): boolean;
+/**
+ * Parses If-Match or If-None-Match header value into individual ETags
+ * Handles both "*" and comma-separated ETag lists
+ * @param headerValue The If-Match or If-None-Match header value
+ * @returns Array of ETag strings, or ["*"] if the value is "*"
+ */
+export declare function parseConditionalETagHeader(headerValue: string): string[];
+/**
+ * Validates If-Match or If-None-Match header syntax
+ * According to RFC9110, the header must not contain "*" mixed with other values
+ * @param headerValue The If-Match or If-None-Match header value
+ * @returns true if syntax is invalid (violation), false if valid
+ */
+export declare function hasInvalidConditionalETagSyntax(headerValue: string): boolean;
+/**
+ * Compares two HTTP dates
+ * @param date1 First date string
+ * @param date2 Second date string
+ * @returns -1 if date1 < date2, 0 if equal, 1 if date1 > date2, null if invalid
+ */
+export declare function compareHttpDates(date1: string, date2: string): -1 | 0 | 1 | null;
+//# sourceMappingURL=utils.d.ts.map

package/dist/rules/conditional-requests/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/rules/conditional-requests/utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CA8BrD;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,iBAAiB,EAAE,OAAO,GACzB,OAAO,CAmBT;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAmBxE;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAa5E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAenB"}

package/dist/rules/conditional-requests/utils.js

@@ -0,0 +1,130 @@
+/**
+ * Utility functions for RFC9110 Conditional Requests validation
+ */
+/**
+ * Checks if an ETag is marked as weak (starts with W/)
+ * @param etag The ETag value to check
+ * @returns true if the ETag is weak, false otherwise
+ */
+export function isWeakETag(etag) {
+    return etag.trim().startsWith('W/') || etag.trim().startsWith('w/');
+}
+/**
+ * Checks if an ETag is strong (not marked as weak)
+ * @param etag The ETag value to check
+ * @returns true if the ETag is strong, false otherwise
+ */
+export function isStrongETag(etag) {
+    return !isWeakETag(etag);
+}
+/**
+ * Validates if a string is a valid HTTP-date according to RFC9110
+ * Accepts IMF-fixdate, obsolete RFC 850, and ANSI C's asctime() format
+ * @param date The date string to validate
+ * @returns true if valid HTTP-date, false otherwise
+ */
+export function isValidHttpDate(date) {
+    if (!date || typeof date !== 'string') {
+        return false;
+    }
+    const trimmed = date.trim();
+    // IMF-fixdate format: Sun, 06 Nov 1994 08:49:37 GMT
+    const imfFixdate = /^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} GMT$/;
+    // RFC 850 format: Sunday, 06-Nov-94 08:49:37 GMT
+    const rfc850 = /^(Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), \d{2}-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-\d{2} \d{2}:\d{2}:\d{2} GMT$/;
+    // asctime format: Sun Nov  6 08:49:37 1994
+    const asctime = /^(Mon|Tue|Wed|Thu|Fri|Sat|Sun) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ( \d|\d{2}) \d{2}:\d{2}:\d{2} \d{4}$/;
+    if (imfFixdate.test(trimmed) ||
+        rfc850.test(trimmed) ||
+        asctime.test(trimmed)) {
+        // Additional validation: ensure it's parseable as a valid date
+        const parsed = new Date(trimmed);
+        return !isNaN(parsed.getTime());
+    }
+    return false;
+}
+/**
+ * Compares two ETags according to RFC9110 rules
+ * @param etag1 First ETag to compare
+ * @param etag2 Second ETag to compare
+ * @param useWeakComparison If true, uses weak comparison; otherwise uses strong comparison
+ * @returns true if ETags match according to the comparison type
+ */
+export function compareETags(etag1, etag2, useWeakComparison) {
+    if (!etag1 || !etag2) {
+        return false;
+    }
+    const clean1 = etag1.trim();
+    const clean2 = etag2.trim();
+    // Extract opaque tags (remove W/ prefix if present)
+    const opaque1 = clean1.replace(/^[Ww]\//, '');
+    const opaque2 = clean2.replace(/^[Ww]\//, '');
+    if (useWeakComparison) {
+        // Weak comparison: compare opaque tags only
+        return opaque1 === opaque2;
+    }
+    else {
+        // Strong comparison: both must be strong ETags and opaque tags must match
+        return isStrongETag(clean1) && isStrongETag(clean2) && opaque1 === opaque2;
+    }
+}
+/**
+ * Parses If-Match or If-None-Match header value into individual ETags
+ * Handles both "*" and comma-separated ETag lists
+ * @param headerValue The If-Match or If-None-Match header value
+ * @returns Array of ETag strings, or ["*"] if the value is "*"
+ */
+export function parseConditionalETagHeader(headerValue) {
+    if (!headerValue || typeof headerValue !== 'string') {
+        return [];
+    }
+    const trimmed = headerValue.trim();
+    // Handle wildcard
+    if (trimmed === '*') {
+        return ['*'];
+    }
+    // Split by comma and clean up each ETag
+    const etags = trimmed
+        .split(',')
+        .map((etag) => etag.trim())
+        .filter((etag) => etag.length > 0);
+    return etags;
+}
+/**
+ * Validates If-Match or If-None-Match header syntax
+ * According to RFC9110, the header must not contain "*" mixed with other values
+ * @param headerValue The If-Match or If-None-Match header value
+ * @returns true if syntax is invalid (violation), false if valid
+ */
+export function hasInvalidConditionalETagSyntax(headerValue) {
+    if (!headerValue || typeof headerValue !== 'string') {
+        return false;
+    }
+    const etags = parseConditionalETagHeader(headerValue);
+    // If there's a "*" and other values, it's invalid
+    if (etags.includes('*') && etags.length > 1) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Compares two HTTP dates
+ * @param date1 First date string
+ * @param date2 Second date string
+ * @returns -1 if date1 < date2, 0 if equal, 1 if date1 > date2, null if invalid
+ */
+export function compareHttpDates(date1, date2) {
+    if (!isValidHttpDate(date1) || !isValidHttpDate(date2)) {
+        return null;
+    }
+    const time1 = new Date(date1).getTime();
+    const time2 = new Date(date2).getTime();
+    if (time1 < time2) {
+        return -1;
+    }
+    if (time1 > time2) {
+        return 1;
+    }
+    return 0;
+}
+//# sourceMappingURL=utils.js.map

package/dist/rules/conditional-requests/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/rules/conditional-requests/utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAE5B,oDAAoD;IACpD,MAAM,UAAU,GACd,sHAAsH,CAAC;IAEzH,iDAAiD;IACjD,MAAM,MAAM,GACV,mJAAmJ,CAAC;IAEtJ,2CAA2C;IAC3C,MAAM,OAAO,GACX,uHAAuH,CAAC;IAE1H,IACE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EACrB,CAAC;QACD,+DAA+D;QAC/D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAa,EACb,KAAa,EACb,iBAA0B;IAE1B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAE5B,oDAAoD;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAE9C,IAAI,iBAAiB,EAAE,CAAC;QACtB,4CAA4C;QAC5C,OAAO,OAAO,KAAK,OAAO,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,OAAO,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB;IAC5D,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAEnC,kBAAkB;IAClB,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,wCAAwC;IACxC,MAAM,KAAK,GAAG,OAAO;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAErC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,WAAmB;IACjE,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC;IAEtD,kDAAkD;IAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,KAAa;IAEb,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IAExC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept/recipient-should-process-q-parameter-as-weight.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=recipient-should-process-q-parameter-as-weight.rule.d.ts.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept/recipient-should-process-q-parameter-as-weight.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-should-process-q-parameter-as-weight.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept/recipient-should-process-q-parameter-as-weight.rule.ts"],"names":[],"mappings":";AAEA,wBASU"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept/recipient-should-process-q-parameter-as-weight.rule.js

@@ -0,0 +1,8 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/recipient-should-process-q-parameter-as-weight')
+    .severity('warn')
+    .type('static')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-accept')
+    .description('Recipients SHOULD process any parameter named "q" as weight, regardless of parameter ordering.')
+    .done();
+//# sourceMappingURL=recipient-should-process-q-parameter-as-weight.rule.js.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept/recipient-should-process-q-parameter-as-weight.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-should-process-q-parameter-as-weight.rule.js","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept/recipient-should-process-q-parameter-as-weight.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,wDAAwD,CACzD;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,QAAQ,CAAC;KACd,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,gGAAgG,CACjG;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept/sender-should-send-q-parameter-last.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=sender-should-send-q-parameter-last.rule.d.ts.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept/sender-should-send-q-parameter-last.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-should-send-q-parameter-last.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept/sender-should-send-q-parameter-last.rule.ts"],"names":[],"mappings":";AAGA,wBAuCU"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept/sender-should-send-q-parameter-last.rule.js

@@ -0,0 +1,29 @@
+import { getHeader, requestHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/sender-should-send-q-parameter-last')
+    .severity('warn')
+    .type('analytics', 'static')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-accept')
+    .summary('Senders using weights SHOULD send "q" last (after all media-range parameters).')
+    .rule((ctx) => ctx.validateCommonHttpTransactions(requestHeader('accept')))
+    .overrideAnalyticsRule((ctx) => ctx.validateHttpTransactions(requestHeader('accept'), (req) => {
+    const accept = getHeader(req.headers, 'accept');
+    if (!accept) {
+        return false;
+    }
+    const acceptHeaders = Array.isArray(accept) ? accept : [accept];
+    const acceptValues = acceptHeaders.flatMap((header) => header.split(','));
+    const malformedValues = acceptValues.filter((accept) => {
+        const acceptParams = accept.split(';').map((param) => param.trim());
+        const qParamIndex = acceptParams.findIndex((param) => param.startsWith('q='));
+        return qParamIndex !== acceptParams.length - 1;
+    });
+    if (malformedValues.length > 0) {
+        return {
+            message: `The weight parameter "q" SHOULD be send as last parameter. Malformed value(s) sent: ${malformedValues.join(', ')}`,
+        };
+    }
+    return false;
+}))
+    .done();
+//# sourceMappingURL=sender-should-send-q-parameter-last.rule.js.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept/sender-should-send-q-parameter-last.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-should-send-q-parameter-last.rule.js","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept/sender-should-send-q-parameter-last.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,6CAA6C,CAAC;KACnE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC;KAC3B,GAAG,CAAC,yDAAyD,CAAC;KAC9D,OAAO,CACN,gFAAgF,CACjF;KACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,8BAA8B,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;KAC1E,qBAAqB,CAAC,CAAC,GAAG,EAAE,EAAE,CAC7B,GAAG,CAAC,wBAAwB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEhD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEhE,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1E,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QACrD,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CACnD,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CACvB,CAAC;QACF,OAAO,WAAW,KAAK,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,OAAO,EAAE,uFAAuF,eAAe,CAAC,IAAI,CAClH,IAAI,CACL,EAAE;SACJ,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CACH;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept-charset/user-agent-may-associate-quality-value-with-charset.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=user-agent-may-associate-quality-value-with-charset.rule.d.ts.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept-charset/user-agent-may-associate-quality-value-with-charset.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent-may-associate-quality-value-with-charset.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept-charset/user-agent-may-associate-quality-value-with-charset.rule.ts"],"names":[],"mappings":";AAGA,wBAaU"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept-charset/user-agent-may-associate-quality-value-with-charset.rule.js

@@ -0,0 +1,11 @@
+import { requestHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/user-agent-may-associate-quality-value-with-charset')
+    .severity('hint')
+    .type('static', 'analytics')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-accept-charset')
+    .description("A user agent MAY associate a quality value with each charset to indicate the user's relative preference for that charset, as defined in Section 12.4.2.")
+    .appliesTo('user-agent')
+    .rule((ctx) => ctx.validateCommonHttpTransactions(requestHeader('accept-charset')))
+    .done();
+//# sourceMappingURL=user-agent-may-associate-quality-value-with-charset.rule.js.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept-charset/user-agent-may-associate-quality-value-with-charset.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent-may-associate-quality-value-with-charset.rule.js","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept-charset/user-agent-may-associate-quality-value-with-charset.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,6DAA6D,CAC9D;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC3B,GAAG,CAAC,iEAAiE,CAAC;KACtE,WAAW,CACV,yJAAyJ,CAC1J;KACA,SAAS,CAAC,YAAY,CAAC;KACvB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,8BAA8B,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CACpE;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept-encoding/codings-value-may-be-given-quality-value.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=codings-value-may-be-given-quality-value.rule.d.ts.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept-encoding/codings-value-may-be-given-quality-value.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codings-value-may-be-given-quality-value.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept-encoding/codings-value-may-be-given-quality-value.rule.ts"],"names":[],"mappings":";AAGA,wBAUU"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept-encoding/codings-value-may-be-given-quality-value.rule.js

@@ -0,0 +1,10 @@
+import { requestHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/codings-value-may-be-given-quality-value')
+    .severity('hint')
+    .type('analytics', 'static')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-accept-encoding')
+    .description('Each codings value MAY be given an associated quality value (weight) representing the preference for that encoding, as defined in Section 12.4.2.')
+    .rule((ctx) => ctx.validateCommonHttpTransactions(requestHeader('accept-encoding')))
+    .done();
+//# sourceMappingURL=codings-value-may-be-given-quality-value.rule.js.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept-encoding/codings-value-may-be-given-quality-value.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codings-value-may-be-given-quality-value.rule.js","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept-encoding/codings-value-may-be-given-quality-value.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,kDAAkD,CAAC;KACxE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC;KAC3B,GAAG,CAAC,kEAAkE,CAAC;KACvE,WAAW,CACV,mJAAmJ,CACpJ;KACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,8BAA8B,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CACrE;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept-encoding/origin-server-should-send-response-without-content-coding.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=origin-server-should-send-response-without-content-coding.rule.d.ts.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept-encoding/origin-server-should-send-response-without-content-coding.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-server-should-send-response-without-content-coding.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept-encoding/origin-server-should-send-response-without-content-coding.rule.ts"],"names":[],"mappings":";AAEA,wBAaU"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept-encoding/origin-server-should-send-response-without-content-coding.rule.js

@@ -0,0 +1,10 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/origin-server-should-send-response-without-content-coding')
+    .severity('warn')
+    .type('static')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-accept-encoding')
+    .description('If a non-empty Accept-Encoding header field is present in a request and none of the available representations for the response have a content coding that is listed as acceptable, the origin server SHOULD send a response without any content coding unless the identity coding is indicated as unacceptable.')
+    .summary('The origin server SHOULD send a response without any content coding unless the identity coding is indicated as unacceptable.')
+    .appliesTo('origin server')
+    .done();
+//# sourceMappingURL=origin-server-should-send-response-without-content-coding.rule.js.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept-encoding/origin-server-should-send-response-without-content-coding.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-server-should-send-response-without-content-coding.rule.js","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept-encoding/origin-server-should-send-response-without-content-coding.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,mEAAmE,CACpE;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,QAAQ,CAAC;KACd,GAAG,CAAC,kEAAkE,CAAC;KACvE,WAAW,CACV,iTAAiT,CAClT;KACA,OAAO,CACN,8HAA8H,CAC/H;KACA,SAAS,CAAC,eAAe,CAAC;KAC1B,IAAI,EAAE,CAAC"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept-encoding/server-must-not-include-accept-encoding-for-non-content-coding-415-errors.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=server-must-not-include-accept-encoding-for-non-content-coding-415-errors.rule.d.ts.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept-encoding/server-must-not-include-accept-encoding-for-non-content-coding-415-errors.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-must-not-include-accept-encoding-for-non-content-coding-415-errors.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept-encoding/server-must-not-include-accept-encoding-for-non-content-coding-415-errors.rule.ts"],"names":[],"mappings":";AASA,wBAsBU"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept-encoding/server-must-not-include-accept-encoding-for-non-content-coding-415-errors.rule.js

@@ -0,0 +1,12 @@
+import { and, not, requestHeader, responseHeader, statusCode, } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/server-must-not-include-accept-encoding-for-non-content-coding-415-errors')
+    .severity('error')
+    .type('static', 'analytics')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-accept-encoding')
+    .description('In order to avoid confusion with issues related to media types, servers that fail a request with a 415 status for reasons unrelated to content codings MUST NOT include the Accept-Encoding header field.')
+    .summary('Servers that fail a request with a 415 status for reasons unrelated to content codings MUST NOT include the Accept-Encoding header field.')
+    .appliesTo('server')
+    .rule((ctx) => ctx.validateCommonHttpTransactions(and(statusCode(415), not(requestHeader('accept-encoding')), responseHeader('accept-encoding'))))
+    .done();
+//# sourceMappingURL=server-must-not-include-accept-encoding-for-non-content-coding-415-errors.rule.js.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept-encoding/server-must-not-include-accept-encoding-for-non-content-coding-415-errors.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-must-not-include-accept-encoding-for-non-content-coding-415-errors.rule.js","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept-encoding/server-must-not-include-accept-encoding-for-non-content-coding-415-errors.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,GAAG,EACH,GAAG,EACH,aAAa,EACb,cAAc,EACd,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,mFAAmF,CACpF;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC3B,GAAG,CAAC,kEAAkE,CAAC;KACvE,WAAW,CACV,2MAA2M,CAC5M;KACA,OAAO,CACN,2IAA2I,CAC5I;KACA,SAAS,CAAC,QAAQ,CAAC;KACnB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,8BAA8B,CAChC,GAAG,CACD,UAAU,CAAC,GAAG,CAAC,EACf,GAAG,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,EACrC,cAAc,CAAC,iBAAiB,CAAC,CAClC,CACF,CACF;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept-language/user-agent-must-not-send-accept-language-without-user-control.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=user-agent-must-not-send-accept-language-without-user-control.rule.d.ts.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept-language/user-agent-must-not-send-accept-language-without-user-control.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent-must-not-send-accept-language-without-user-control.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept-language/user-agent-must-not-send-accept-language-without-user-control.rule.ts"],"names":[],"mappings":";AAEA,wBAaU"}

package/dist/rules/content-negotiation/content-negotiation-fields/accept-language/user-agent-must-not-send-accept-language-without-user-control.rule.js

@@ -0,0 +1,10 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/user-agent-must-not-send-accept-language-without-user-control')
+    .severity('error')
+    .type('analytics')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-accept-language')
+    .description('Since intelligibility is highly dependent on the individual user, user agents need to allow user control over the linguistic preference (either through configuration of the user agent itself or by defaulting to a user controllable system setting). A user agent that does not provide such control to the user MUST NOT send an Accept-Language header field.')
+    .summary('A user agent that does not provide such control to the user MUST NOT send an Accept-Language header field.')
+    .appliesTo('user-agent')
+    .done();
+//# sourceMappingURL=user-agent-must-not-send-accept-language-without-user-control.rule.js.map

package/dist/rules/content-negotiation/content-negotiation-fields/accept-language/user-agent-must-not-send-accept-language-without-user-control.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent-must-not-send-accept-language-without-user-control.rule.js","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/accept-language/user-agent-must-not-send-accept-language-without-user-control.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,uEAAuE,CACxE;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,WAAW,CAAC;KACjB,GAAG,CAAC,kEAAkE,CAAC;KACvE,WAAW,CACV,oWAAoW,CACrW;KACA,OAAO,CACN,4GAA4G,CAC7G;KACA,SAAS,CAAC,YAAY,CAAC;KACvB,IAAI,EAAE,CAAC"}

package/dist/rules/content-negotiation/content-negotiation-fields/vary/cache-must-not-use-response-without-matching-vary-headers.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=cache-must-not-use-response-without-matching-vary-headers.rule.d.ts.map

package/dist/rules/content-negotiation/content-negotiation-fields/vary/cache-must-not-use-response-without-matching-vary-headers.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-must-not-use-response-without-matching-vary-headers.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/vary/cache-must-not-use-response-without-matching-vary-headers.rule.ts"],"names":[],"mappings":";AAcA,wBAkBU"}

package/dist/rules/content-negotiation/content-negotiation-fields/vary/cache-must-not-use-response-without-matching-vary-headers.rule.js

@@ -0,0 +1,22 @@
+import { or, requestHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+const typicalVaryHeaders = [
+    'Accept-Encoding',
+    'Accept-Language',
+    'User-Agent',
+    'Origin',
+    'Accept',
+    'Cookie',
+    'Authorization',
+    'X-Requested-With',
+];
+export default httpRule('rfc9110/cache-must-not-use-response-without-matching-vary-headers')
+    .severity('error')
+    .type('analytics')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-vary')
+    .description('To inform cache recipients that they MUST NOT use this response to satisfy a later request unless the later request has the same values for the listed header fields as the original request (Section 4.1 of [CACHING]) or reuse of the response has been validated by the origin server.')
+    .summary('Cache MUST NOT use this response to satisfy a later request unless the later request has the same values for the listed Vary header fields.')
+    .appliesTo('cache')
+    .rule((ctx) => ctx.validateHttpTransactions(or(...typicalVaryHeaders.map((header) => requestHeader(header)))))
+    .done();
+//# sourceMappingURL=cache-must-not-use-response-without-matching-vary-headers.rule.js.map

package/dist/rules/content-negotiation/content-negotiation-fields/vary/cache-must-not-use-response-without-matching-vary-headers.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-must-not-use-response-without-matching-vary-headers.rule.js","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/vary/cache-must-not-use-response-without-matching-vary-headers.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,MAAM,kBAAkB,GAAG;IACzB,iBAAiB;IACjB,iBAAiB;IACjB,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,eAAe;IACf,kBAAkB;CACnB,CAAC;AAEF,eAAe,QAAQ,CACrB,mEAAmE,CACpE;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,WAAW,CAAC;KACjB,GAAG,CAAC,uDAAuD,CAAC;KAC5D,WAAW,CACV,2RAA2R,CAC5R;KACA,OAAO,CACN,6IAA6I,CAC9I;KACA,SAAS,CAAC,OAAO,CAAC;KAClB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,wBAAwB,CAC1B,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CACjE,CACF;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/content-negotiation/content-negotiation-fields/vary/origin-server-should-generate-vary-header.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=origin-server-should-generate-vary-header.rule.d.ts.map

package/dist/rules/content-negotiation/content-negotiation-fields/vary/origin-server-should-generate-vary-header.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-server-should-generate-vary-header.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/vary/origin-server-should-generate-vary-header.rule.ts"],"names":[],"mappings":";AAEA,wBAWU"}

package/dist/rules/content-negotiation/content-negotiation-fields/vary/origin-server-should-generate-vary-header.rule.js

@@ -0,0 +1,10 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/origin-server-should-generate-vary-header')
+    .severity('warn')
+    .type('static')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-vary')
+    .description("An origin server SHOULD generate a Vary header field on a cacheable response when it wishes that response to be selectively reused for subsequent requests. Generally, that is the case when the response content has been tailored to better fit the preferences expressed by those selecting header fields, such as when an origin server has selected the response's language based on the request's Accept-Language header field.")
+    .summary('An origin server SHOULD generate a Vary header field on a cacheable response when it wishes that response to be selectively reused for subsequent requests.')
+    .appliesTo('origin server')
+    .done();
+//# sourceMappingURL=origin-server-should-generate-vary-header.rule.js.map

package/dist/rules/content-negotiation/content-negotiation-fields/vary/origin-server-should-generate-vary-header.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-server-should-generate-vary-header.rule.js","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/vary/origin-server-should-generate-vary-header.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,mDAAmD,CAAC;KACzE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,QAAQ,CAAC;KACd,GAAG,CAAC,uDAAuD,CAAC;KAC5D,WAAW,CACV,uaAAua,CACxa;KACA,OAAO,CACN,6JAA6J,CAC9J;KACA,SAAS,CAAC,eAAe,CAAC;KAC1B,IAAI,EAAE,CAAC"}

package/dist/rules/content-negotiation/content-negotiation-fields/vary/proxy-must-not-generate-vary-wildcard.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=proxy-must-not-generate-vary-wildcard.rule.d.ts.map

package/dist/rules/content-negotiation/content-negotiation-fields/vary/proxy-must-not-generate-vary-wildcard.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-must-not-generate-vary-wildcard.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/vary/proxy-must-not-generate-vary-wildcard.rule.ts"],"names":[],"mappings":";AAGA,wBAsBU"}

package/dist/rules/content-negotiation/content-negotiation-fields/vary/proxy-must-not-generate-vary-wildcard.rule.js

@@ -0,0 +1,19 @@
+import { getHeader, responseHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/proxy-must-not-generate-vary-wildcard')
+    .severity('error')
+    .type('analytics')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-vary')
+    .description('A list containing the member "*" signals that other aspects of the request might have played a role in selecting the response representation, possibly including aspects outside the message syntax (e.g., the client\'s network address). A recipient will not be able to determine whether this response is appropriate for a later request without forwarding the request to the origin server. A proxy MUST NOT generate "*" in a Vary field value.')
+    .summary('A proxy MUST NOT generate "*" in a Vary field value.')
+    .appliesTo('proxy')
+    .rule((ctx) => ctx.validateHttpTransactions(responseHeader('vary'), (req) => {
+    const varyHeader = getHeader(req.headers, 'vary');
+    if (!varyHeader) {
+        return;
+    }
+    const varyValues = Array.isArray(varyHeader) ? varyHeader : [varyHeader];
+    return varyValues.flatMap((v) => v.split(',')).includes('*');
+}))
+    .done();
+//# sourceMappingURL=proxy-must-not-generate-vary-wildcard.rule.js.map

package/dist/rules/content-negotiation/content-negotiation-fields/vary/proxy-must-not-generate-vary-wildcard.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-must-not-generate-vary-wildcard.rule.js","sourceRoot":"","sources":["../../../../../src/rules/content-negotiation/content-negotiation-fields/vary/proxy-must-not-generate-vary-wildcard.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,+CAA+C,CAAC;KACrE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,WAAW,CAAC;KACjB,GAAG,CAAC,uDAAuD,CAAC;KAC5D,WAAW,CACV,ybAAyb,CAC1b;KACA,OAAO,CAAC,sDAAsD,CAAC;KAC/D,SAAS,CAAC,OAAO,CAAC;KAClB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,wBAAwB,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;IAC3D,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAElD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAEzE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC,CAAC,CACH;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/content-negotiation/proactive-negotiation/user-agent-may-send-preference-headers-for-proactive-negotiation.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=user-agent-may-send-preference-headers-for-proactive-negotiation.rule.d.ts.map

package/dist/rules/content-negotiation/proactive-negotiation/user-agent-may-send-preference-headers-for-proactive-negotiation.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent-may-send-preference-headers-for-proactive-negotiation.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/content-negotiation/proactive-negotiation/user-agent-may-send-preference-headers-for-proactive-negotiation.rule.ts"],"names":[],"mappings":";AAEA,wBAaU"}

package/dist/rules/content-negotiation/proactive-negotiation/user-agent-may-send-preference-headers-for-proactive-negotiation.rule.js

@@ -0,0 +1,10 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/user-agent-may-send-preference-headers-for-proactive-negotiation')
+    .severity('hint')
+    .type('informational')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-proactive-negotiation')
+    .summary("In order to improve the server's guess, a user agent MAY send request header fields that describe its preferences.")
+    .description('Proactive negotiation is advantageous when the algorithm for selecting from among the available representations is difficult to describe to a user agent, or when the server desires to send its "best guess" to the user agent along with the first response (when that "best guess" is good enough for the user, this avoids the round-trip delay of a subsequent request). In order to improve the server\'s guess, a user agent MAY send request header fields that describe its preferences.')
+    .appliesTo('user-agent')
+    .done();
+//# sourceMappingURL=user-agent-may-send-preference-headers-for-proactive-negotiation.rule.js.map

package/dist/rules/content-negotiation/proactive-negotiation/user-agent-may-send-preference-headers-for-proactive-negotiation.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent-may-send-preference-headers-for-proactive-negotiation.rule.js","sourceRoot":"","sources":["../../../../src/rules/content-negotiation/proactive-negotiation/user-agent-may-send-preference-headers-for-proactive-negotiation.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,0EAA0E,CAC3E;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,eAAe,CAAC;KACrB,GAAG,CAAC,wEAAwE,CAAC;KAC7E,OAAO,CACN,oHAAoH,CACrH;KACA,WAAW,CACV,meAAme,CACpe;KACA,SAAS,CAAC,YAAY,CAAC;KACvB,IAAI,EAAE,CAAC"}