insa-check-core 0.1.0

package/dist/checks/info-disclosure/more.js

@@ -0,0 +1,186 @@
+import { findTags, htmlComments, resolveUrl } from "../html.js";
+import { effectiveOrigin, landingPage } from "../util.js";
+// --- #3 Accessible debug functionality ---------------------------------------------
+/** Well-known debug/status endpoints. A finding needs matching content, not just HTTP 200. */
+const DEBUG_PROBES = [
+    { path: "/phpinfo.php", signature: /phpinfo\(\)|<title>PHP [\d.]+ - phpinfo|PHP Version/i, what: "PHP configuration page" },
+    { path: "/info.php", signature: /phpinfo\(\)|PHP Version/i, what: "PHP configuration page" },
+    { path: "/server-status", signature: /Apache Server Status/i, what: "Apache server status" },
+    { path: "/server-info", signature: /Apache Server Information/i, what: "Apache server information" },
+    { path: "/elmah.axd", signature: /Error Log for/i, what: "ELMAH error log" },
+    { path: "/trace.axd", signature: /Application Trace/i, what: "ASP.NET trace viewer" },
+    { path: "/actuator", signature: /"_links"\s*:/, what: "Spring Boot actuator index" },
+    { path: "/actuator/env", signature: /"propertySources"\s*:/, what: "Spring Boot environment" },
+    { path: "/_profiler", signature: /Symfony Profiler/i, what: "Symfony profiler" },
+    { path: "/__debug__/", signature: /djdt|Django Debug Toolbar/i, what: "Django debug toolbar" },
+    { path: "/telescope", signature: /Laravel Telescope/i, what: "Laravel Telescope" },
+    { path: "/debug/pprof/", signature: /Types of profiles available/i, what: "Go pprof profiler" },
+    { path: "/debug/default/view", signature: /Yii Debugger/i, what: "Yii debugger" },
+];
+export const debugPages = {
+    key: "debug-pages",
+    kind: "url",
+    async run(ctx) {
+        const origin = await effectiveOrigin(ctx);
+        const found = [];
+        await Promise.all(DEBUG_PROBES.map(async (p) => {
+            const res = await ctx.request(`${origin}${p.path}`, { followRedirects: false });
+            if (res.status === 200 && p.signature.test(res.body))
+                found.push(`${origin}${p.path}: ${p.what}`);
+        }));
+        if (found.length)
+            return { status: "fail", detail: `${found.length} debug or status page(s) are publicly accessible.`, evidence: found.sort() };
+        return { status: "pass", detail: `None of ${DEBUG_PROBES.length} well-known debug/status endpoints are exposed.` };
+    },
+};
+// --- #4 Sensitive information in error messages -------------------------------------
+const NOT_FOUND_PROBE = "/insa-check-not-found-probe";
+const ERROR_LEAKS = [
+    { signature: /Traceback \(most recent call last\)/, what: "Python stack trace" },
+    { signature: /Django Version:|You're seeing this error because you have <code>DEBUG = True/, what: "Django debug error page" },
+    { signature: /at [\w$.]+\([\w$]+\.java:\d+\)/, what: "Java stack trace" },
+    { signature: /Server Error in '.*' Application|System\.Web\.|ASP\.NET Version:/, what: "ASP.NET detailed error" },
+    { signature: /Whoops, looks like something went wrong|Symfony\\Component|Illuminate\\/, what: "PHP framework debug page" },
+    { signature: /(Fatal error|Warning|Notice)<\/b>:[^<]* in <b>[^<]+<\/b> on line <b>\d+/, what: "PHP error with file path" },
+    { signature: /SQLSTATE\[|ORA-\d{5}|You have an error in your SQL syntax|PG::\w+Error/, what: "database error message" },
+    { signature: /at \w[\w.<>]* \((?:\/|[A-Z]:\\)[^)]+\.[cm]?[jt]s:\d+:\d+\)/, what: "Node.js stack trace" },
+    { signature: /Rails\.root:|ActionController::RoutingError/, what: "Rails debug error page" },
+];
+export const errorMessages = {
+    key: "error-messages",
+    kind: "url",
+    async run(ctx) {
+        const origin = await effectiveOrigin(ctx);
+        const res = await ctx.request(`${origin}${NOT_FOUND_PROBE}`);
+        const leaks = ERROR_LEAKS.filter((l) => l.signature.test(res.body)).map((l) => l.what);
+        if (leaks.length) {
+            return { status: "fail", detail: `The "not found" page reveals technical details: ${leaks.join(", ")}.`, evidence: [`${origin}${NOT_FOUND_PROBE} → HTTP ${res.status}`] };
+        }
+        // A clean 404 page says nothing about errors caused by invalid input, or about log contents.
+        return {
+            status: "manual",
+            detail: `The "not found" page (HTTP ${res.status}) shows no stack traces or internal details. Errors from invalid input, and log contents, still need manual review.`,
+        };
+    },
+};
+// --- #5 Sensitive information in robots.txt ------------------------------------------
+const ROBOTS_SENSITIVE = /backup|\.sql|\.env|\.git|secret|private|passw|config|dump|\.bak|database|\.zip|\.tar|credential|token/i;
+const ROBOTS_ADMIN = /admin|login|dashboard|manage|internal|staff|cpanel|phpmyadmin/i;
+export const robotsTxt = {
+    key: "robots-txt",
+    kind: "url",
+    async run(ctx) {
+        const origin = await effectiveOrigin(ctx);
+        const res = await ctx.request(`${origin}/robots.txt`);
+        if (res.status !== 200 || !/^\s*(user-agent|disallow|allow|sitemap)\s*:/im.test(res.body)) {
+            return { status: "pass", detail: "No robots.txt is served, so it discloses nothing." };
+        }
+        const paths = [...res.body.matchAll(/^\s*(?:dis)?allow\s*:\s*(\S+)/gim)].map((m) => m[1]);
+        const sensitive = [...new Set(paths.filter((p) => ROBOTS_SENSITIVE.test(p)))];
+        const admin = [...new Set(paths.filter((p) => !ROBOTS_SENSITIVE.test(p) && ROBOTS_ADMIN.test(p)))];
+        if (sensitive.length) {
+            return { status: "fail", detail: `robots.txt advertises ${sensitive.length} sensitive-looking path(s).`, evidence: [...sensitive, ...admin] };
+        }
+        if (admin.length) {
+            return { status: "manual", detail: `robots.txt lists ${admin.length} administrative path(s); confirm each still requires authentication.`, evidence: admin };
+        }
+        return { status: "pass", detail: `robots.txt lists ${paths.length} path(s); none look sensitive.` };
+    },
+};
+// --- #6 Sensitive information in page source ------------------------------------------
+const MAX_SCRIPTS = 5;
+/** Tokens that should never be in client-side code. */
+const SECRET_PATTERNS = [
+    { signature: /AKIA[0-9A-Z]{16}/, what: "AWS access key ID" },
+    { signature: /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/, what: "private key" },
+    { signature: /\bsk_live_[0-9a-zA-Z]{16,}/, what: "Stripe secret key" },
+    { signature: /\bgh[pousr]_[0-9A-Za-z]{30,}/, what: "GitHub token" },
+    { signature: /\bxox[baprs]-[0-9A-Za-z-]{10,}/, what: "Slack token" },
+    { signature: /\b(?:password|passwd|pwd)\s*[:=]\s*["'][^"']{4,}["']/i, what: "hard-coded password" },
+];
+/** Things worth a human look; often legitimate (public API keys, leftover notes). */
+const REVIEW_PATTERNS = [
+    { signature: /\b(?:api[_-]?key|secret|token)["']?\s*[:=]\s*["'][A-Za-z0-9_\-/+=]{16,}["']/i, what: "API key or token assignment" },
+    { signature: /AIza[0-9A-Za-z_-]{35}/, what: "Google API key" },
+];
+const COMMENT_HINT = /todo|fixme|hack|password|passwd|secret|internal|debug|staging|credential/i;
+export const pageSource = {
+    key: "page-source-secrets",
+    kind: "url",
+    async run(ctx) {
+        const page = await landingPage(ctx);
+        const origin = new URL(page.url).origin;
+        const sources = [{ url: page.url, body: page.body }];
+        const scripts = findTags(page.body, ["script"])
+            .map((t) => resolveUrl(t.attrs["src"], page.url))
+            .filter((u) => !!u && u.origin === origin)
+            .slice(0, MAX_SCRIPTS);
+        for (const u of scripts) {
+            const res = await ctx.request(u.href);
+            if (res.status === 200)
+                sources.push({ url: u.href, body: res.body });
+        }
+        // Evidence names the kind of data and where it is, never the value.
+        const secrets = [];
+        const review = [];
+        for (const { url, body } of sources) {
+            for (const p of SECRET_PATTERNS)
+                if (p.signature.test(body))
+                    secrets.push(`${p.what} in ${url}`);
+            for (const p of REVIEW_PATTERNS)
+                if (p.signature.test(body))
+                    review.push(`${p.what} in ${url}`);
+        }
+        const comments = htmlComments(page.body).filter((c) => COMMENT_HINT.test(c));
+        if (comments.length)
+            review.push(`${comments.length} HTML comment(s) mentioning passwords, TODOs or internal notes in ${page.url}`);
+        if (secrets.length)
+            return { status: "fail", detail: `${secrets.length} secret(s) found in page source or scripts (values not shown).`, evidence: [...secrets, ...review] };
+        if (review.length)
+            return { status: "manual", detail: "Page source contains items to review; they may be public by design (values not shown).", evidence: review };
+        return { status: "pass", detail: `No secrets or suspicious comments found in the landing page and ${sources.length - 1} same-origin script(s).` };
+    },
+};
+// --- #7 Disclosure of internal addresses -----------------------------------------------
+const PRIVATE_IP = /\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})\b/g;
+const validIp = (ip) => ip.split(".").every((o) => Number(o) <= 255);
+export const internalAddresses = {
+    key: "internal-addresses",
+    kind: "url",
+    async run(ctx) {
+        const page = await landingPage(ctx);
+        const origin = new URL(page.url).origin;
+        const notFound = await ctx.request(`${origin}${NOT_FOUND_PROBE}`);
+        const targetHost = new URL(page.url).hostname;
+        const found = new Set();
+        for (const res of [page, notFound]) {
+            const where = res === page ? "landing page" : "error page";
+            for (const [name, value] of Object.entries(res.headers)) {
+                for (const ip of value.match(PRIVATE_IP) ?? [])
+                    if (validIp(ip) && ip !== targetHost)
+                        found.add(`${ip} in ${name} header (${where})`);
+            }
+            for (const ip of res.body.match(PRIVATE_IP) ?? [])
+                if (validIp(ip) && ip !== targetHost)
+                    found.add(`${ip} in body (${where})`);
+        }
+        if (found.size)
+            return { status: "fail", detail: `${found.size} internal address(es) disclosed in responses.`, evidence: [...found].sort() };
+        return { status: "pass", detail: "No private IP addresses found in the headers or bodies of the landing page and error page." };
+    },
+};
+// --- #10 Externally archived pages (note only) -------------------------------------------
+export const archivedPages = {
+    key: "archived-pages",
+    kind: "url",
+    async run(ctx) {
+        const host = new URL((await landingPage(ctx)).url).host;
+        // Deliberately not queried: sending the target to a third-party service is outside this tool's privacy rules.
+        return {
+            status: "manual",
+            detail: "Not checked automatically (no third-party services are contacted). Search web archives and search-engine caches for old pages exposing sensitive content.",
+            evidence: [`https://web.archive.org/web/*/${host}/*`],
+        };
+    },
+};
+//# sourceMappingURL=more.js.map

package/dist/checks/info-disclosure/more.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"more.js","sourceRoot":"","sources":["../../../src/checks/info-disclosure/more.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE1D,sFAAsF;AACtF,8FAA8F;AAC9F,MAAM,YAAY,GAAwD;IACxE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,sDAAsD,EAAE,IAAI,EAAE,wBAAwB,EAAE;IAC3H,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,0BAA0B,EAAE,IAAI,EAAE,wBAAwB,EAAE;IAC5F,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,uBAAuB,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAC5F,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,4BAA4B,EAAE,IAAI,EAAE,2BAA2B,EAAE;IACpG,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC5E,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,IAAI,EAAE,sBAAsB,EAAE;IACrF,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACpF,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,uBAAuB,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC9F,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAChF,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,4BAA4B,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAC9F,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAClF,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,8BAA8B,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC/F,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE;CAClF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAU;IAC/B,GAAG,EAAE,aAAa;IAClB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,CAAC,GAAG,CACf,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CACH,CAAC;QACF,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,mDAAmD,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChJ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,YAAY,CAAC,MAAM,iDAAiD,EAAE,CAAC;IACrH,CAAC;CACF,CAAC;AAEF,uFAAuF;AACvF,MAAM,eAAe,GAAG,6BAA6B,CAAC;AACtD,MAAM,WAAW,GAA0C;IACzD,EAAE,SAAS,EAAE,qCAAqC,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAChF,EAAE,SAAS,EAAE,8EAA8E,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC9H,EAAE,SAAS,EAAE,gCAAgC,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACzE,EAAE,SAAS,EAAE,kEAAkE,EAAE,IAAI,EAAE,wBAAwB,EAAE;IACjH,EAAE,SAAS,EAAE,yEAAyE,EAAE,IAAI,EAAE,0BAA0B,EAAE;IAC1H,EAAE,SAAS,EAAE,yEAAyE,EAAE,IAAI,EAAE,0BAA0B,EAAE;IAC1H,EAAE,SAAS,EAAE,wEAAwE,EAAE,IAAI,EAAE,wBAAwB,EAAE;IACvH,EAAE,SAAS,EAAE,4DAA4D,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACxG,EAAE,SAAS,EAAE,6CAA6C,EAAE,IAAI,EAAE,wBAAwB,EAAE;CAC7F,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAU;IAClC,GAAG,EAAE,gBAAgB;IACrB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,eAAe,EAAE,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mDAAmD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,GAAG,eAAe,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QAC5K,CAAC;QACD,6FAA6F;QAC7F,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,8BAA8B,GAAG,CAAC,MAAM,qHAAqH;SACtK,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,wFAAwF;AACxF,MAAM,gBAAgB,GAAG,wGAAwG,CAAC;AAClI,MAAM,YAAY,GAAG,gEAAgE,CAAC;AAEtF,MAAM,CAAC,MAAM,SAAS,GAAU;IAC9B,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC;QACtD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,+CAA+C,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1F,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;QACzF,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnG,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,SAAS,CAAC,MAAM,6BAA6B,EAAE,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QAChJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,KAAK,CAAC,MAAM,sEAAsE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC/J,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,KAAK,CAAC,MAAM,gCAAgC,EAAE,CAAC;IACtG,CAAC;CACF,CAAC;AAEF,yFAAyF;AACzF,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,uDAAuD;AACvD,MAAM,eAAe,GAA0C;IAC7D,EAAE,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC5D,EAAE,SAAS,EAAE,wDAAwD,EAAE,IAAI,EAAE,aAAa,EAAE;IAC5F,EAAE,SAAS,EAAE,4BAA4B,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACtE,EAAE,SAAS,EAAE,8BAA8B,EAAE,IAAI,EAAE,cAAc,EAAE;IACnE,EAAE,SAAS,EAAE,gCAAgC,EAAE,IAAI,EAAE,aAAa,EAAE;IACpE,EAAE,SAAS,EAAE,uDAAuD,EAAE,IAAI,EAAE,qBAAqB,EAAE;CACpG,CAAC;AACF,qFAAqF;AACrF,MAAM,eAAe,GAA0C;IAC7D,EAAE,SAAS,EAAE,8EAA8E,EAAE,IAAI,EAAE,6BAA6B,EAAE;IAClI,EAAE,SAAS,EAAE,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,EAAE;CAC/D,CAAC;AACF,MAAM,YAAY,GAAG,2EAA2E,CAAC;AAEjG,MAAM,CAAC,MAAM,UAAU,GAAU;IAC/B,GAAG,EAAE,qBAAqB;IAC1B,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACxC,MAAM,OAAO,GAAoC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;aAC5C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;aACnD,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,oEAAoE;QACpE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,eAAe;gBAAE,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;YACjG,KAAK,MAAM,CAAC,IAAI,eAAe;gBAAE,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,QAAQ,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,qEAAqE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAEpI,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,gEAAgE,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;QAC5K,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,wFAAwF,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnK,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mEAAmE,OAAO,CAAC,MAAM,GAAG,CAAC,yBAAyB,EAAE,CAAC;IACpJ,CAAC;CACF,CAAC;AAEF,0FAA0F;AAC1F,MAAM,UAAU,GAAG,+GAA+G,CAAC;AACnI,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,iBAAiB,GAAU;IACtC,GAAG,EAAE,oBAAoB;IACzB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,eAAe,EAAE,CAAC,CAAC;QAClE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC;YAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE;oBAAE,IAAI,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,UAAU;wBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC,CAAC;YACxI,CAAC;YACD,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE;gBAAE,IAAI,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,UAAU;oBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,GAAG,CAAC,CAAC;QACjI,CAAC;QACD,IAAI,KAAK,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,+CAA+C,EAAE,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7I,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,4FAA4F,EAAE,CAAC;IAClI,CAAC;CACF,CAAC;AAEF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAU;IAClC,GAAG,EAAE,gBAAgB;IACrB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACxD,8GAA8G;QAC9G,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,2JAA2J;YACnK,QAAQ,EAAE,CAAC,iCAAiC,IAAI,IAAI,CAAC;SACtD,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/checks/tls/certificate.d.ts

@@ -0,0 +1,3 @@
+import type { Check } from "../../types.js";
+export declare const certificate: Check;
+//# sourceMappingURL=certificate.d.ts.map

package/dist/checks/tls/certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../../../src/checks/tls/certificate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAgB5C,eAAO,MAAM,WAAW,EAAE,KAqCzB,CAAC"}

package/dist/checks/tls/certificate.js

@@ -0,0 +1,49 @@
+const MIN_RSA_BITS = 2048;
+const EXPIRY_WARNING_DAYS = 30;
+const ERROR_MEANINGS = {
+    CERT_HAS_EXPIRED: "the certificate has expired",
+    CERT_NOT_YET_VALID: "the certificate is not yet valid",
+    DEPTH_ZERO_SELF_SIGNED_CERT: "the certificate is self-signed",
+    SELF_SIGNED_CERT_IN_CHAIN: "the chain contains an untrusted self-signed certificate",
+    UNABLE_TO_VERIFY_LEAF_SIGNATURE: "the chain is incomplete or the issuer is untrusted",
+    UNABLE_TO_GET_ISSUER_CERT_LOCALLY: "the issuer is not a trusted CA (or an intermediate is missing)",
+    ERR_TLS_CERT_ALTNAME_INVALID: "the certificate does not cover this hostname",
+    CERT_REVOKED: "the certificate has been revoked",
+};
+export const certificate = {
+    key: "certificate",
+    kind: "url",
+    async run(ctx) {
+        const info = await ctx.tlsInfo();
+        const cert = info.cert;
+        if (!cert)
+            return { status: "fail", detail: "The server presented no certificate." };
+        const evidence = [
+            `Subject: ${cert.subject}`,
+            `Issuer: ${cert.issuer}`,
+            `Valid: ${cert.validFrom} → ${cert.validTo}`,
+            `Key: ${cert.keyType ?? "unknown"} ${cert.bits ?? "?"} bits`,
+        ];
+        const problems = [];
+        if (!info.authorized) {
+            const code = info.authorizationError ?? "UNKNOWN";
+            problems.push(`not trusted: ${ERROR_MEANINGS[code] ?? code} (${code})`);
+        }
+        if (cert.daysRemaining < 0 && info.authorizationError !== "CERT_HAS_EXPIRED") {
+            problems.push(`expired ${-cert.daysRemaining} days ago`);
+        }
+        if (cert.keyType === "RSA" && cert.bits !== undefined && cert.bits < MIN_RSA_BITS) {
+            problems.push(`weak RSA key (${cert.bits} bits, minimum ${MIN_RSA_BITS})`);
+        }
+        if (problems.length > 0) {
+            return { status: "fail", detail: `Certificate ${problems.join("; ")}.`, evidence };
+        }
+        const soon = cert.daysRemaining <= EXPIRY_WARNING_DAYS ? ` Warning: expires in ${cert.daysRemaining} days.` : "";
+        return {
+            status: "pass",
+            detail: `Trusted certificate, valid for ${cert.daysRemaining} more days.${soon}`,
+            evidence,
+        };
+    },
+};
+//# sourceMappingURL=certificate.js.map

package/dist/checks/tls/certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../../../src/checks/tls/certificate.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,MAAM,cAAc,GAA2B;IAC7C,gBAAgB,EAAE,6BAA6B;IAC/C,kBAAkB,EAAE,kCAAkC;IACtD,2BAA2B,EAAE,gCAAgC;IAC7D,yBAAyB,EAAE,yDAAyD;IACpF,+BAA+B,EAAE,oDAAoD;IACrF,iCAAiC,EAAE,gEAAgE;IACnG,4BAA4B,EAAE,8CAA8C;IAC5E,YAAY,EAAE,kCAAkC;CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAU;IAChC,GAAG,EAAE,aAAa;IAClB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;QAErF,MAAM,QAAQ,GAAG;YACf,YAAY,IAAI,CAAC,OAAO,EAAE;YAC1B,WAAW,IAAI,CAAC,MAAM,EAAE;YACxB,UAAU,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,OAAO,EAAE;YAC5C,QAAQ,IAAI,CAAC,OAAO,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,OAAO;SAC7D,CAAC;QACF,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,IAAI,SAAS,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,gBAAgB,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,IAAI,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,EAAE,CAAC;YAC7E,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,GAAG,YAAY,EAAE,CAAC;YAClF,QAAQ,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,kBAAkB,YAAY,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAC,CAAC,wBAAwB,IAAI,CAAC,aAAa,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,kCAAkC,IAAI,CAAC,aAAa,cAAc,IAAI,EAAE;YAChF,QAAQ;SACT,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/checks/tls/hsts.d.ts

@@ -0,0 +1,5 @@
+import type { Check } from "../../types.js";
+/** Six months, the common minimum (e.g. Mozilla Observatory). */
+export declare const HSTS_MIN_MAX_AGE = 15768000;
+export declare const hsts: Check;
+//# sourceMappingURL=hsts.d.ts.map

package/dist/checks/tls/hsts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hsts.d.ts","sourceRoot":"","sources":["../../../src/checks/tls/hsts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5C,iEAAiE;AACjE,eAAO,MAAM,gBAAgB,WAAa,CAAC;AAE3C,eAAO,MAAM,IAAI,EAAE,KA8BlB,CAAC"}

package/dist/checks/tls/hsts.js

@@ -0,0 +1,35 @@
+import { httpsUrl, parseDirectives } from "../util.js";
+/** Six months, the common minimum (e.g. Mozilla Observatory). */
+export const HSTS_MIN_MAX_AGE = 15_768_000;
+export const hsts = {
+    key: "hsts",
+    kind: "url",
+    async run(ctx) {
+        const res = await ctx.request(httpsUrl(ctx));
+        if (new URL(res.url).protocol !== "https:") {
+            return { status: "fail", detail: "The HTTPS URL redirects back to HTTP, so HSTS cannot apply." };
+        }
+        const header = res.headers["strict-transport-security"];
+        if (!header) {
+            return { status: "fail", detail: "No Strict-Transport-Security header on the HTTPS response." };
+        }
+        const directives = parseDirectives(header);
+        const maxAge = Number(directives.get("max-age"));
+        if (!directives.has("max-age") || !Number.isInteger(maxAge)) {
+            return { status: "fail", detail: "Strict-Transport-Security has no valid max-age.", evidence: [header] };
+        }
+        if (maxAge < HSTS_MIN_MAX_AGE) {
+            return {
+                status: "fail",
+                detail: `HSTS max-age is ${maxAge}s; at least ${HSTS_MIN_MAX_AGE}s (6 months) is expected.`,
+                evidence: [header],
+            };
+        }
+        const extras = [
+            directives.has("includesubdomains") ? "includeSubDomains" : "no includeSubDomains",
+            directives.has("preload") ? "preload" : null,
+        ].filter(Boolean);
+        return { status: "pass", detail: `HSTS enabled, max-age ${maxAge}s (${extras.join(", ")}).`, evidence: [header] };
+    },
+};
+//# sourceMappingURL=hsts.js.map

package/dist/checks/tls/hsts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hsts.js","sourceRoot":"","sources":["../../../src/checks/tls/hsts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEvD,iEAAiE;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C,MAAM,CAAC,MAAM,IAAI,GAAU;IACzB,GAAG,EAAE,MAAM;IACX,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC;QACnG,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;QAClG,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iDAAiD,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3G,CAAC;QACD,IAAI,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,mBAAmB,MAAM,eAAe,gBAAgB,2BAA2B;gBAC3F,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG;YACb,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB;YAClF,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;SAC7C,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,MAAM,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IACpH,CAAC;CACF,CAAC"}

package/dist/checks/tls/https-redirect.d.ts

@@ -0,0 +1,3 @@
+import type { Check } from "../../types.js";
+export declare const httpsRedirect: Check;
+//# sourceMappingURL=https-redirect.d.ts.map

package/dist/checks/tls/https-redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"https-redirect.d.ts","sourceRoot":"","sources":["../../../src/checks/tls/https-redirect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5C,eAAO,MAAM,aAAa,EAAE,KA6C3B,CAAC"}

package/dist/checks/tls/https-redirect.js

@@ -0,0 +1,46 @@
+import { isNetworkUnreachable } from "../util.js";
+export const httpsRedirect = {
+    key: "https-redirect",
+    kind: "url",
+    async run(ctx) {
+        const url = new URL(ctx.target.href);
+        url.protocol = "http:";
+        url.port = "";
+        let res;
+        try {
+            res = await ctx.request(url.href);
+        }
+        catch (err) {
+            if (isNetworkUnreachable(err)) {
+                return {
+                    status: "pass",
+                    detail: `Plain HTTP is not served (${err.code} on ${url.host}:80).`,
+                };
+            }
+            throw err;
+        }
+        const chain = [...res.redirects, res.url];
+        if (res.redirects.length === 0) {
+            return {
+                status: "fail",
+                detail: `${url.href} answered HTTP ${res.status} without redirecting to HTTPS.`,
+                evidence: chain,
+            };
+        }
+        if (new URL(res.url).protocol !== "https:") {
+            return {
+                status: "fail",
+                detail: "HTTP redirects never reach an HTTPS URL.",
+                evidence: chain,
+            };
+        }
+        return {
+            status: "pass",
+            detail: res.redirects.length === 1
+                ? "HTTP redirects straight to HTTPS."
+                : `HTTP reaches HTTPS after ${res.redirects.length} redirects.`,
+            evidence: chain,
+        };
+    },
+};
+//# sourceMappingURL=https-redirect.js.map

package/dist/checks/tls/https-redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"https-redirect.js","sourceRoot":"","sources":["../../../src/checks/tls/https-redirect.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,CAAC,MAAM,aAAa,GAAU;IAClC,GAAG,EAAE,gBAAgB;IACrB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC;QACvB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;QAEd,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,6BAA8B,GAAyB,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO;iBAC3F,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,kBAAkB,GAAG,CAAC,MAAM,gCAAgC;gBAC/E,QAAQ,EAAE,KAAK;aAChB,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,0CAA0C;gBAClD,QAAQ,EAAE,KAAK;aAChB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;gBACxB,CAAC,CAAC,mCAAmC;gBACrC,CAAC,CAAC,4BAA4B,GAAG,CAAC,SAAS,CAAC,MAAM,aAAa;YACnE,QAAQ,EAAE,KAAK;SAChB,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/checks/tls/legacy-protocols.d.ts

@@ -0,0 +1,3 @@
+import type { Check } from "../../types.js";
+export declare const legacyProtocols: Check;
+//# sourceMappingURL=legacy-protocols.d.ts.map

package/dist/checks/tls/legacy-protocols.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-protocols.d.ts","sourceRoot":"","sources":["../../../src/checks/tls/legacy-protocols.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAoB,MAAM,gBAAgB,CAAC;AAI9D,eAAO,MAAM,eAAe,EAAE,KAuB7B,CAAC"}

package/dist/checks/tls/legacy-protocols.js

@@ -0,0 +1,27 @@
+const LEGACY = ["TLSv1", "TLSv1.1"];
+export const legacyProtocols = {
+    key: "legacy-tls",
+    kind: "url",
+    async run(ctx) {
+        const info = await ctx.tlsInfo();
+        const accepted = [];
+        for (const version of LEGACY) {
+            if (await ctx.probeTls(version))
+                accepted.push(version);
+        }
+        const negotiated = `Default negotiation: ${info.protocol ?? "?"} / ${info.cipher ?? "?"}`;
+        if (accepted.length > 0) {
+            return {
+                status: "fail",
+                detail: `Server accepts deprecated protocol(s): ${accepted.join(", ")}.`,
+                evidence: [negotiated],
+            };
+        }
+        return {
+            status: "pass",
+            detail: "TLS 1.0 and 1.1 were refused. (Cipher-suite enumeration is not performed in v1.)",
+            evidence: [negotiated],
+        };
+    },
+};
+//# sourceMappingURL=legacy-protocols.js.map

package/dist/checks/tls/legacy-protocols.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-protocols.js","sourceRoot":"","sources":["../../../src/checks/tls/legacy-protocols.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,GAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAExD,MAAM,CAAC,MAAM,eAAe,GAAU;IACpC,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAuB,EAAE,CAAC;QACxC,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,IAAI,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,UAAU,GAAG,wBAAwB,IAAI,CAAC,QAAQ,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC1F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,0CAA0C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACxE,QAAQ,EAAE,CAAC,UAAU,CAAC;aACvB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,kFAAkF;YAC1F,QAAQ,EAAE,CAAC,UAAU,CAAC;SACvB,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/checks/util.d.ts

@@ -0,0 +1,22 @@
+import type { HttpResponse, ScanContext } from "../types.js";
+/** The landing page as a browser would see it (redirects followed). */
+export declare function landingPage(ctx: ScanContext): Promise<HttpResponse>;
+/** HTTPS version of the target URL (same host and path). */
+export declare function httpsUrl(ctx: ScanContext): string;
+/** Origin the site actually serves from, after following redirects from the target. */
+export declare function effectiveOrigin(ctx: ScanContext): Promise<string>;
+/** Splits a header value into a lowercase directive map: "max-age=1; preload" -> {max-age: "1", preload: ""}. */
+export declare function parseDirectives(value: string, separator?: string): Map<string, string>;
+export interface ParsedCookie {
+    name: string;
+    secure: boolean;
+    httpOnly: boolean;
+    domain?: string;
+    path?: string;
+    sameSite?: string;
+}
+export declare function parseSetCookie(header: string): ParsedCookie;
+/** Heuristic: cookie names that conventionally carry a session or auth credential. */
+export declare function looksLikeSessionCookie(name: string): boolean;
+export declare function isNetworkUnreachable(err: unknown): boolean;
+//# sourceMappingURL=util.d.ts.map

package/dist/checks/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../src/checks/util.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE7D,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEnE;AAED,4DAA4D;AAC5D,wBAAgB,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAMjD;AAED,uFAAuF;AACvF,wBAAsB,eAAe,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvE;AAED,iHAAiH;AACjH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAWnF;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAe3D;AAID,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAG1D"}

package/dist/checks/util.js

@@ -0,0 +1,63 @@
+/** The landing page as a browser would see it (redirects followed). */
+export function landingPage(ctx) {
+    return ctx.request(ctx.target.href);
+}
+/** HTTPS version of the target URL (same host and path). */
+export function httpsUrl(ctx) {
+    if (ctx.target.protocol === "https:")
+        return ctx.target.href;
+    const url = new URL(ctx.target.href);
+    url.protocol = "https:";
+    url.port = "";
+    return url.href;
+}
+/** Origin the site actually serves from, after following redirects from the target. */
+export async function effectiveOrigin(ctx) {
+    return new URL((await landingPage(ctx)).url).origin;
+}
+/** Splits a header value into a lowercase directive map: "max-age=1; preload" -> {max-age: "1", preload: ""}. */
+export function parseDirectives(value, separator = ";") {
+    const out = new Map();
+    for (const part of value.split(separator)) {
+        const trimmed = part.trim();
+        if (!trimmed)
+            continue;
+        const eq = trimmed.indexOf("=");
+        const name = (eq === -1 ? trimmed : trimmed.slice(0, eq)).trim().toLowerCase();
+        const val = eq === -1 ? "" : trimmed.slice(eq + 1).trim().replace(/^"|"$/g, "");
+        if (!out.has(name))
+            out.set(name, val);
+    }
+    return out;
+}
+export function parseSetCookie(header) {
+    const [pair = "", ...attrs] = header.split(";");
+    const name = pair.split("=")[0]?.trim() ?? "";
+    const cookie = { name, secure: false, httpOnly: false };
+    for (const attr of attrs) {
+        const [rawKey = "", ...rest] = attr.split("=");
+        const key = rawKey.trim().toLowerCase();
+        const value = rest.join("=").trim();
+        if (key === "secure")
+            cookie.secure = true;
+        else if (key === "httponly")
+            cookie.httpOnly = true;
+        else if (key === "domain")
+            cookie.domain = value;
+        else if (key === "path")
+            cookie.path = value;
+        else if (key === "samesite")
+            cookie.sameSite = value;
+    }
+    return cookie;
+}
+const SESSION_COOKIE = /sess|sid$|^sid|auth|token|login|jwt|remember/i;
+/** Heuristic: cookie names that conventionally carry a session or auth credential. */
+export function looksLikeSessionCookie(name) {
+    return SESSION_COOKIE.test(name) && !/csrf|xsrf/i.test(name);
+}
+export function isNetworkUnreachable(err) {
+    const code = err.code;
+    return code === "ECONNREFUSED" || code === "ETIMEDOUT" || code === "EHOSTUNREACH" || code === "ECONNRESET";
+}
+//# sourceMappingURL=util.js.map

package/dist/checks/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../../src/checks/util.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAgB;IAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,QAAQ,CAAC,GAAgB;IACvC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACxB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAgB;IACpD,OAAO,IAAI,GAAG,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AACtD,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,SAAS,GAAG,GAAG;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/E,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACtE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,GAAG,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;aACtC,IAAI,GAAG,KAAK,UAAU;YAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;aAC/C,IAAI,GAAG,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;aAC5C,IAAI,GAAG,KAAK,MAAM;YAAE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC;aACxC,IAAI,GAAG,KAAK,UAAU;YAAE,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,cAAc,GAAG,+CAA+C,CAAC;AAEvE,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;IAC7C,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY,CAAC;AAC7G,CAAC"}

package/dist/code/checks/crypto.d.ts

@@ -0,0 +1,5 @@
+/** #19 Weak / unproven algorithms. */
+export declare const weakCrypto: import("../types.js").CodeCheck;
+/** #20 Incorrect use of primitives. */
+export declare const cryptoMisuse: import("../types.js").CodeCheck;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/code/checks/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/code/checks/crypto.ts"],"names":[],"mappings":"AAqBA,sCAAsC;AACtC,eAAO,MAAM,UAAU,iCAmCtB,CAAC;AAEF,uCAAuC;AACvC,eAAO,MAAM,YAAY,iCAsCxB,CAAC"}