spiderlint 0.0.0 → 0.143.0

package/dist/plugins/structured-data.js

@@ -0,0 +1,358 @@
+// SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+//
+// SPDX-License-Identifier: AGPL-3.0-only
+import { load } from "cheerio";
+import { log } from "../logger.js";
+import { pageRule, resolve } from "../rules/builtin.js";
+import { said } from "../rules/message.js";
+import { SUPERSEDED } from "./schema-registry.js";
+import { definePlugin } from "./types.js";
+const ID = "structureddata";
+const GALLERY = "https://developers.google.com/search/docs/appearance/structured-data/search-gallery";
+// Properties a rich result requires per schema.org type, from Google Search Central’s per-feature pages as of 2026-09-25; refreshed by hand.
+const REQUIRED = {
+    BreadcrumbList: ["itemListElement"],
+    Course: ["name", "description"],
+    Dataset: ["name", "description"],
+    Event: ["name", "startDate", "location"],
+    FAQPage: ["mainEntity"],
+    JobPosting: ["title", "description", "datePosted", "hiringOrganization"],
+    LocalBusiness: ["name", "address"],
+    Product: ["name"],
+    Recipe: ["name", "image"],
+    Review: ["author", "itemReviewed", "reviewRating"],
+    VideoObject: ["name", "thumbnailUrl", "uploadDate"],
+};
+// Types describing the page they sit on, whose `name` should echo its title and whose `url` its canonical.
+const PAGES = new Set(["WebPage", "AboutPage", "CheckoutPage", "CollectionPage", "ContactPage", "FAQPage", "ItemPage", "MedicalWebPage", "ProfilePage", "QAPage", "SearchResultsPage"]);
+// Article types, whose `headline` stands in for `name` and which carry a publication date.
+const ARTICLES = new Set(["Article", "AdvertiserContentArticle", "AnalysisNewsArticle", "BackgroundNewsArticle", "BlogPosting", "LiveBlogPosting", "NewsArticle", "OpinionNewsArticle", "Report", "ReportageNewsArticle", "ReviewNewsArticle", "SatiricalArticle", "ScholarlyArticle", "SocialMediaPosting", "TechArticle"]);
+// Per-page types never expected to share one identity across the site.
+const PER_PAGE = new Set([...PAGES, ...ARTICLES, "BreadcrumbList", "ListItem"]);
+// ISO 8601 date or date-time, as schema.org `Date` and `DateTime` accept it.
+const ISO_DATE = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:?\d{2})?)?$/;
+// Date-valued properties outside the `date*` and `*Date` names.
+const DATES = new Set(["uploadDate", "validFrom", "validThrough", "expires", "priceValidUntil", "availabilityStarts", "availabilityEnds"]);
+const isNode = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+// A vocabulary term’s bare name: `https://schema.org/Person` and `schema:Person` are `Person`.
+const bare = (term) => term.replace(/^.*[/#:]/, "");
+// An `@id` made absolute against the page, fragment kept; a blank node stays as written.
+const absolute = (id, base) => (!id.startsWith("_:") && URL.canParse(id, base) ? new URL(id, base).href : id);
+// The bare terms of a space-separated attribute.
+const terms = (attribute) => (attribute ?? "")
+    .split(/\s+/)
+    .filter(Boolean)
+    .map((term) => bare(term));
+const MICRODATA = { scope: "itemscope", prop: "itemprop", id: ["itemid"], type: "itemtype", items: "[itemscope]", props: "[itemprop]", tops: "[itemscope]:not([itemprop])" };
+const RDFA = { scope: "typeof", prop: "property", id: ["resource", "about"], type: "typeof", items: "[typeof]", props: "[property]", tops: "[typeof]:not([property])" };
+// The value a property element carries: its `content`, a URL attribute resolved, a machine value, or its text.
+function valueOf($, element, base) {
+    const node = $(element);
+    const url = node.attr("href") ?? node.attr("src") ?? node.attr("data");
+    return node.attr("content") ?? (url === undefined ? undefined : resolve(url, base)) ?? node.attr("value") ?? node.attr("datetime") ?? node.text().replaceAll(/\s+/g, " ").trim();
+}
+// One item as a JSON-LD-shaped node: `@type`, `@id` and each property, nested items as nodes.
+function itemOf($, element, syntax, base) {
+    const node = {};
+    const types = terms($(element).attr(syntax.type));
+    if (types.length > 0)
+        node["@type"] = types;
+    const id = syntax.id.map((key) => $(element).attr(key)).find((value) => value !== undefined);
+    if (id !== undefined)
+        node["@id"] = absolute(id, base);
+    const owned = $(element)
+        .find(syntax.props)
+        .filter((_, property) => $(property).parent().closest(syntax.items).get(0) === element);
+    for (const property of owned.get()) {
+        const value = $(property).attr(syntax.scope) === undefined ? valueOf($, property, base) : itemOf($, property, syntax, base);
+        const names = terms($(property).attr(syntax.prop));
+        for (const name of names)
+            node[name] = node[name] === undefined ? value : [node[name], value].flat();
+    }
+    return node;
+}
+// Top-level Microdata and RDFa items; a page without either marker skips the parse.
+async function extract(page, body) {
+    if (!page.html || !/\bitemscope\b|\btypeof\s*=/i.test(body))
+        return;
+    const $ = load(body);
+    const top = (syntax) => $(syntax.tops)
+        .get()
+        .map((element) => itemOf($, element, syntax, page.url.href));
+    const facts = { microdata: top(MICRODATA), rdfa: top(RDFA) };
+    log.debug({ url: page.url.href, microdata: facts.microdata.length, rdfa: facts.rdfa.length }, "structured data read");
+    return facts;
+}
+// The top-level nodes of every syntax: each JSON-LD object, array entry and `@graph` member, then each Microdata and RDFa item.
+function nodesOf(page) {
+    const blocks = (page.html?.jsonld ?? []).flatMap((block) => (Array.isArray(block) ? block : [block])).filter((block) => isNode(block) && !("@error" in block));
+    const markup = page[ID];
+    return [...blocks.flatMap((block) => (Array.isArray(block["@graph"]) ? block["@graph"].filter(isNode) : [block])), ...(markup?.microdata ?? []), ...(markup?.rdfa ?? [])];
+}
+// Every node at any depth, top-level ones first.
+function* everyNode(value) {
+    if (Array.isArray(value))
+        for (const entry of value)
+            yield* everyNode(entry);
+    if (!isNode(value))
+        return;
+    yield value;
+    for (const [key, child] of Object.entries(value))
+        if (key !== "@context")
+            yield* everyNode(child);
+}
+// A node’s types, a bare name for a schema.org IRI.
+function typesOf(node) {
+    const raw = node["@type"];
+    return (Array.isArray(raw) ? raw : [raw]).filter((type) => typeof type === "string").map((type) => type.replace(/^https?:\/\/schema\.org\//, ""));
+}
+// Present and not empty.
+const isSet = (value) => value !== undefined && value !== null && value !== "" && !(Array.isArray(value) && value.length === 0);
+// Every node of the page at any depth.
+const allNodes = (page) => nodesOf(page).flatMap((top) => everyNode(top).toArray());
+// A node that says something besides its identity.
+const isDefinition = (node) => typeof node["@id"] === "string" && Object.keys(node).some((key) => key !== "@id" && key !== "@context");
+const parse = pageRule("structured-data/parse", ["html.jsonld"], (page) => {
+    if (!page.html)
+        return;
+    const errors = page.html.jsonld.filter((block) => isNode(block) && typeof block["@error"] === "string").map((block) => block["@error"]);
+    return errors.length === 0 ? [] : [{ ...said("JSON-LD blocks do not parse"), data: { [page.url.href]: { blocks: errors.length } }, locations: errors, value: errors }];
+}, { docs: "https://json-ld.org/spec/latest/json-ld/", fix: "Serialise the JSON-LD with a JSON encoder instead of a text template, so quotes and newlines in values are escaped." });
+const required = pageRule("structured-data/required", ["html.jsonld", ID], (page) => {
+    if (!page.html)
+        return;
+    const locations = nodesOf(page).flatMap((node) => typesOf(node).flatMap((type) => {
+        const missing = (REQUIRED[type] ?? []).filter((property) => !isSet(node[property]));
+        return missing.length === 0 ? [] : [`${type} without ${missing.join(", ")}`];
+    }));
+    return locations.length === 0 ? [] : [{ ...said("structured data nodes lack properties their rich result requires"), data: { [page.url.href]: { nodes: locations.length } }, value: locations, locations }];
+}, { docs: GALLERY, fix: "Add the missing properties to each named node, or drop a type the page does not really describe." });
+// The URL a `ListItem.item` names: a string, or a node’s `@id` or `url`.
+function itemUrl(item) {
+    if (typeof item === "string")
+        return item;
+    if (!isNode(item))
+        return undefined;
+    const url = item["@id"] ?? item.url;
+    return typeof url === "string" ? url : undefined;
+}
+// Lower-cased with whitespace collapsed, for a containment test between a title and a name.
+const folded = (text) => text.toLowerCase().replaceAll(/\s+/g, " ").trim();
+// Page and article nodes whose `url` or `mainEntityOfPage` is not the canonical, or whose name appears in neither `<title>` nor `og:title`.
+const consistent = pageRule("structured-data/consistent", ["html.jsonld", ID, "html.canonical", "html.title", "html.property"], (page) => {
+    if (!page.html)
+        return;
+    const html = page.html;
+    const canonical = resolve(html.canonical ?? page.url.twin ?? page.url.href, page.url.href);
+    const titles = [html.title, html.property["og:title"]].filter((title) => title !== undefined).map((title) => folded(title));
+    const locations = nodesOf(page).flatMap((node) => {
+        const type = typesOf(node).find((name) => PAGES.has(name) || ARTICLES.has(name));
+        if (!type)
+            return [];
+        const urls = [node.url, node.mainEntityOfPage]
+            .map((value) => itemUrl(value))
+            .filter((url) => url !== undefined)
+            .map((url) => resolve(url, page.url.href));
+        const name = [node.headline, node.name].find((value) => typeof value === "string");
+        log.debug({ url: page.url.href, type, canonical, urls, name }, "page entity compared");
+        return [
+            ...urls.filter((url) => url !== canonical).map((url) => `${type} names ${url}, the canonical is ${canonical}`),
+            ...(name !== undefined && titles.length > 0 && titles.every((title) => !title.includes(folded(name)) && !folded(name).includes(title)) ? [`${type} “${name}” appears in neither the title nor og:title`] : []),
+        ];
+    });
+    return locations.length === 0 ? [] : [{ ...said("structured data claims disagree with the page’s own tags"), data: { [page.url.href]: { claims: locations.length } }, value: locations, locations }];
+}, { docs: "https://developers.google.com/search/docs/appearance/structured-data/sd-policies", fix: "Point `url` and `mainEntityOfPage` at the canonical URL, and use the page title as the entity’s `name` or `headline`." });
+// The document an `@id` points into: everything before its fragment.
+const documentOf = (id) => id.split("#", 1)[0] ?? id;
+// Each bare `{ "@id" }` reference to a blank node or fragment that the crawled page it points into never defines, once per `@id`, with the pages naming it.
+const references = (severity) => ({
+    meta: { id: "structured-data/references", severity, scope: "site", facts: ["html.jsonld", ID], docs: "https://www.w3.org/TR/json-ld11/#node-identifiers", fix: "Define each referenced `@id` on the page it points into, or on the referring page itself; a reference into a page that never defines it names nothing." },
+    check(pages) {
+        const defined = new Map();
+        for (const page of pages) {
+            const ids = new Set(allNodes(page)
+                .filter((node) => isDefinition(node))
+                .map((node) => absolute(String(node["@id"]), page.url.href)));
+            for (const href of [page.url.href, page.url.twin])
+                if (href)
+                    defined.set(resolve(href, href), ids);
+        }
+        const naming = new Map();
+        for (const page of pages) {
+            const own = defined.get(resolve(page.url.href, page.url.href)) ?? new Set();
+            const ids = new Set(allNodes(page)
+                .filter((node) => typeof node["@id"] === "string" && !isDefinition(node))
+                .map((node) => absolute(String(node["@id"]), page.url.href)));
+            for (const id of ids) {
+                const target = id.startsWith("_:") ? own : id.includes("#") ? defined.get(documentOf(id)) : undefined;
+                const isDangling = target !== undefined && !target.has(id) && !own.has(id);
+                log.debug({ rule: "structured-data/references", url: page.url.href, id, crawled: target !== undefined, isDangling }, "reference judged");
+                if (isDangling)
+                    naming.set(id, [...(naming.get(id) ?? []), page.url.href]);
+            }
+        }
+        return naming
+            .entries()
+            .map(([id, urls]) => ({
+            rule: "structured-data/references",
+            severity,
+            scope: "site",
+            url: id,
+            ...(id.startsWith("_:") ? said("a reference names a node its own page never defines; named by these pages") : { ...said("a reference names a node its document never defines; named by these pages"), data: { [id]: { document: documentOf(id) } } }),
+            value: id,
+            urls,
+        }))
+            .toArray();
+    },
+});
+// Absolute URLs the page’s breadcrumb lists name.
+function crumbsOf(page) {
+    const lists = nodesOf(page).filter((node) => typesOf(node).includes("BreadcrumbList"));
+    const items = lists.flatMap((list) => [list.itemListElement].flat().filter(isNode));
+    return [...new Set(items.flatMap((item) => itemUrl(item.item) ?? []).map((url) => resolve(url, page.url.href)))];
+}
+// Every breadcrumb target the crawl found answering outside 2xx or redirecting, once per target, with the pages naming it.
+const breadcrumbs = (severity) => ({
+    meta: { id: "structured-data/breadcrumbs", severity, scope: "site", facts: ["html.jsonld", ID, "http.status", "site.redirects"], docs: "https://developers.google.com/search/docs/appearance/structured-data/breadcrumb", fix: "Point each breadcrumb `item` at the final URL of a page that answers 200." },
+    check(pages, _group, site) {
+        const status = new Map(pages.map((page) => [page.url.href, page.http.status]));
+        const redirects = site?.redirects ?? {};
+        const naming = new Map();
+        for (const page of pages)
+            for (const url of crumbsOf(page))
+                naming.set(url, [...(naming.get(url) ?? []), page.url.href]);
+        const findings = [];
+        for (const [url, urls] of naming) {
+            const [answer, landing] = [status.get(url), redirects[url]];
+            log.debug({ rule: "structured-data/breadcrumbs", url, status: answer, landing, pages: urls.length }, "breadcrumb judged");
+            const verdict = landing ? { ...said("the breadcrumb item redirects; named by these pages"), data: { [url]: { landing } } } : answer !== undefined && (answer < 200 || answer > 299) ? said("the breadcrumb item answers {status}; named by these pages", { status: String(answer) }) : undefined;
+            if (verdict)
+                findings.push({ rule: "structured-data/breadcrumbs", severity, scope: "site", url, ...verdict, value: landing ?? answer, urls });
+        }
+        return findings;
+    },
+});
+// Records that `page` shows `value` for `key`.
+function sight(sightings, key, value, page) {
+    const values = sightings.get(key) ?? new Map();
+    values.set(value, (values.get(value) ?? new Set()).add(page));
+    sightings.set(key, values);
+}
+// One site finding for a key seen with more than one value, each value located with its page count.
+function conflict(url, values, sentence, severity) {
+    const locations = values
+        .entries()
+        .map(([value, urls]) => `${value} on ${urls.size} page${urls.size === 1 ? "" : "s"}`)
+        .toArray();
+    return { rule: "structured-data/entities", severity, scope: "site", url, ...sentence, value: values.keys().toArray(), locations, urls: [...new Set(values.values().flatMap((urls) => urls.values()))] };
+}
+// One `@id` typed differently on different pages, and one named site-wide entity carried under several `@id`s.
+const entities = (severity) => ({
+    meta: { id: "structured-data/entities", severity, scope: "site", facts: ["html.jsonld", ID], docs: "https://www.w3.org/TR/json-ld11/#node-identifiers", fix: "Give each real-world entity one absolute `@id` and the same `@type` on every page that describes it." },
+    check(pages) {
+        const typings = new Map();
+        const identities = new Map();
+        for (const page of pages) {
+            const definitions = allNodes(page).filter((node) => isDefinition(node) && typesOf(node).length > 0);
+            for (const node of definitions) {
+                const [id, types] = [absolute(String(node["@id"]), page.url.href), typesOf(node).toSorted((a, b) => a.localeCompare(b))];
+                sight(typings, id, types.join(", "), page.url.href);
+                const isShared = typeof node.name === "string" && types.every((type) => !PER_PAGE.has(type));
+                if (isShared)
+                    sight(identities, `${types.join(", ")} “${String(node.name)}”`, id, page.url.href);
+            }
+        }
+        const findings = [];
+        for (const [id, values] of typings) {
+            log.debug({ rule: "structured-data/entities", id, typings: values.size }, "identity typing judged");
+            if (values.size > 1)
+                findings.push(conflict(id, values, said("one @id is typed {count} ways across the site", { count: values.size }), severity));
+        }
+        for (const [entity, values] of identities) {
+            log.debug({ rule: "structured-data/entities", entity, ids: values.size }, "entity identity judged");
+            if (values.size > 1)
+                findings.push(conflict(values
+                    .keys()
+                    .toArray()
+                    .toSorted((a, b) => a.localeCompare(b))[0] ?? entity, values, said("{entity} is carried under {count} different @ids", { entity, count: values.size }), severity));
+        }
+        return findings;
+    },
+});
+// The term schema.org supersedes `term` with, if any.
+const successor = (term) => (Object.hasOwn(SUPERSEDED, term) ? SUPERSEDED[term] : undefined);
+// Types, properties and schema.org enumeration values that schema.org marks `supersededBy`.
+const deprecated = pageRule("structured-data/deprecated", ["html.jsonld", ID], (page) => {
+    if (!page.html)
+        return;
+    const locations = new Set();
+    const nodes = allNodes(page);
+    for (const node of nodes) {
+        for (const type of typesOf(node))
+            if (successor(type))
+                locations.add(`type ${type} → ${successor(type)}`);
+        for (const [key, value] of Object.entries(node)) {
+            if (!key.startsWith("@") && successor(key))
+                locations.add(`property ${key} → ${successor(key)}`);
+            const iris = [value].flat().filter((term) => typeof term === "string" && /^https?:\/\/schema\.org\/\w+$/.test(term));
+            for (const iri of iris)
+                if (successor(bare(iri)))
+                    locations.add(`value ${bare(iri)} → ${successor(bare(iri))}`);
+        }
+    }
+    log.debug({ url: page.url.href, superseded: locations.size }, "vocabulary judged");
+    return locations.size === 0 ? [] : [{ ...said("schema.org terms are superseded"), data: { [page.url.href]: { terms: locations.size } }, value: [...locations], locations: [...locations] }];
+}, { docs: "https://schema.org/docs/attic.home.html", fix: "Rename each term to the one schema.org supersedes it with." });
+// A date-valued property by name.
+const isDateProperty = (key) => key.startsWith("date") || key.endsWith("Date") || DATES.has(key);
+// Milliseconds since the epoch, NaN for anything but a parsable string.
+const time = (value) => (typeof value === "string" ? Date.parse(value) : NaN);
+// Dates that are not ISO 8601, a modification before publication, and a publication date disagreeing with `article:published_time`.
+const dates = pageRule("structured-data/dates", ["html.jsonld", ID, "html.property"], (page) => {
+    if (!page.html)
+        return;
+    const meta = page.html.property;
+    const locations = allNodes(page).flatMap((node) => {
+        const type = typesOf(node)[0] ?? "node";
+        const invalid = Object.entries(node)
+            .filter(([key, value]) => isDateProperty(key) && typeof value === "string" && (!ISO_DATE.test(value.trim()) || Number.isNaN(Date.parse(value))))
+            .map(([key, value]) => `${type} ${key} “${String(value)}” is not ISO 8601`);
+        const [published, modified, shown] = [time(node.datePublished), time(node.dateModified), time(meta["article:published_time"])];
+        return [
+            ...invalid,
+            ...(published > modified ? [`${type} dateModified ${String(node.dateModified)} is before datePublished ${String(node.datePublished)}`] : []),
+            ...(published !== shown && !Number.isNaN(published) && !Number.isNaN(shown) ? [`${type} datePublished ${String(node.datePublished)} disagrees with article:published_time ${meta["article:published_time"]}`] : []),
+        ];
+    });
+    log.debug({ url: page.url.href, invalid: locations.length }, "dates judged");
+    return locations.length === 0 ? [] : [{ ...said("structured data dates are malformed or contradictory"), data: { [page.url.href]: { dates: locations.length } }, value: locations, locations }];
+}, { docs: "https://developers.google.com/search/docs/appearance/structured-data/article", fix: "Write each date as ISO 8601 with a time zone, from the same source that fills `article:published_time`." });
+export default definePlugin({
+    name: "structured-data",
+    extractors: [{ id: ID, extract }],
+    rules: {
+        "structured-data/parse": parse,
+        "structured-data/required": required,
+        "structured-data/breadcrumbs": breadcrumbs,
+        "structured-data/consistent": consistent,
+        "structured-data/references": references,
+        "structured-data/entities": entities,
+        "structured-data/deprecated": deprecated,
+        "structured-data/dates": dates,
+    },
+    presets: {
+        "structured-data": {
+            description: "JSON-LD, Microdata and RDFa that parse, carry what their rich result requires, agree with the page and each other, use current schema.org terms and valid dates, and whose breadcrumbs lead to live pages",
+            rules: {
+                "structured-data/parse": { severity: "error", score: 7.8 },
+                "structured-data/required": { severity: "warning", score: 5.8 },
+                "structured-data/breadcrumbs": { severity: "warning", score: 5.2 },
+                "structured-data/consistent": { severity: "warning", score: 5.4 },
+                "structured-data/references": { severity: "warning", score: 4.8 },
+                "structured-data/entities": { severity: "warning", score: 5 },
+                "structured-data/deprecated": { severity: "warning", score: 4 },
+                "structured-data/dates": { severity: "warning", score: 4.6 },
+            },
+        },
+    },
+});

package/dist/plugins/tls-probe.js

@@ -0,0 +1,298 @@
+// SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+//
+// SPDX-License-Identifier: AGPL-3.0-only
+import { spawn } from "node:child_process";
+import { X509Certificate } from "node:crypto";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { getCACertificates } from "node:tls";
+import { reason } from "../crawl/fetch.js";
+import { log } from "../logger.js";
+import { scan } from "./tls-scan.js";
+import { definePlugin } from "./types.js";
+const TIMEOUT_MS = 10_000;
+// Milliseconds one origin’s scan may take: up to about 150 handshakes.
+const SCAN_MS = 180_000;
+// Whether `openssl` runs, per PATH, so a missing tool warns once.
+const available = new Map();
+// One `openssl` run with `input` on stdin, killed on `signal` or after the timeout.
+function openssl(parameters, input, signal) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("openssl", parameters, { signal: AbortSignal.any([signal, AbortSignal.timeout(TIMEOUT_MS)]) });
+        let output = "";
+        child.stdout.on("data", (chunk) => {
+            output += chunk.toString("utf8");
+        });
+        child.stderr.on("data", (chunk) => {
+            output += chunk.toString("utf8");
+        });
+        child.on("error", reject);
+        child.on("close", (code) => resolve({ code, output }));
+        child.stdin.end(input);
+    });
+}
+// Whether `openssl` runs; warns when it does not.
+async function isRunnable() {
+    try {
+        const run = await openssl(["version"], "", AbortSignal.timeout(TIMEOUT_MS));
+        return run.code === 0;
+    }
+    catch (error) {
+        log.warn({ tool: "openssl", error: reason(error) }, "openssl not found; tls-probe early data skipped");
+        return false;
+    }
+}
+// Whether `openssl` is on PATH, asked once per PATH so a missing tool warns once.
+function opensslFound() {
+    const key = process.env.PATH ?? "";
+    let known = available.get(key);
+    if (!known) {
+        known = isRunnable();
+        available.set(key, known);
+    }
+    return known;
+}
+// The `s_client` arguments reaching `host` at `address`.
+function target(host, port, address) {
+    return ["s_client", "-connect", `${address.includes(":") ? `[${address}]` : address}:${port}`, "-servername", host];
+}
+function isIssuedBy(certificate, issuer) {
+    return certificate.checkIssued(issuer) && certificate.verify(issuer.publicKey);
+}
+// Whether each sent certificate is issued by the next, and the last is a root or issued by a trusted one.
+function chainOf(certificates) {
+    const last = certificates.at(-1);
+    if (!last)
+        return;
+    const isLinked = certificates.slice(0, -1).every((certificate, index) => isIssuedBy(certificate, certificates[index + 1]));
+    const roots = [...getCACertificates("default"), ...getCACertificates("system")].map((pem) => new X509Certificate(pem));
+    // A cross-signed root is anchored by its own key in the store, whoever signed it.
+    const isAnchored = isIssuedBy(last, last) || roots.some((root) => isIssuedBy(last, root) || (root.subject === last.subject && root.publicKey.equals(last.publicKey)));
+    return { sent: certificates.length, complete: isLinked && isAnchored };
+}
+// Whether a DER OCSPResponse says `successful` (RFC 6960 §4.2.1): its first element, an ENUMERATED, is 0.
+function isSuccessful(response) {
+    if (!response || response[0] !== 0x30)
+        return false;
+    const at = 2 + ((response[1] ?? 0) & 0x80 ? (response[1] ?? 0) & 0x7f : 0);
+    return response[at] === 0x0a && response[at + 1] === 1 && response[at + 2] === 0;
+}
+// Whether a TLS 1.3 session resumed with early data had it accepted; `false` when no ticket allows it.
+async function isEarlyDataAccepted(host, port, address, signal) {
+    const directory = await mkdtemp(path.join(tmpdir(), "spiderlint-early-"));
+    const [session, data] = [path.join(directory, "session.pem"), path.join(directory, "early.txt")];
+    const request = `HEAD / HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\n\r\n`;
+    try {
+        await openssl([...target(host, port, address), "-tls1_3", "-ign_eof", "-sess_out", session], request, signal);
+        let ticket = "";
+        try {
+            ticket = await readFile(session, "utf8");
+        }
+        catch (error) {
+            log.debug({ host, port, error: reason(error) }, "session file unreadable");
+        }
+        if (!ticket) {
+            log.debug({ host, port }, "no session ticket; early data not tried");
+            return false;
+        }
+        await writeFile(data, request);
+        const resumed = await openssl([...target(host, port, address), "-tls1_3", "-ign_eof", "-sess_in", session, "-early_data", data], "", signal);
+        const verdict = /Early data was (accepted|rejected|not sent)/.exec(resumed.output)?.[1];
+        log.debug({ host, port, verdict }, "early data tried");
+        return verdict === "accepted";
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}
+// Early data acceptance, or undefined when `openssl` gave no verdict, so the scan already read survives a slow s_client.
+async function earlyData(host, port, address, signal) {
+    try {
+        return await isEarlyDataAccepted(host, port, address, signal);
+    }
+    catch (error) {
+        if (signal.aborted)
+            throw error;
+        log.debug({ host, port, error: reason(error) }, "early data unanswered");
+    }
+}
+// Protocols, suites, groups and negotiation-level weaknesses of one https origin from hand-built hellos, with its chain, OCSP stapling and, through `openssl s_client`, TLS 1.3 early data.
+const probe = {
+    id: "tls-probe",
+    per: "origin",
+    resolves: true,
+    timeout: SCAN_MS,
+    async extract(origin, context) {
+        const url = new URL(origin);
+        if (url.protocol !== "https:")
+            return;
+        const host = url.hostname.replaceAll(/^\[|\]$/g, "");
+        const port = url.port || "443";
+        const address = await context.address(host);
+        const isFull = context.settings?.scan !== false;
+        const { certificates = [], ocsp, ...scanned } = await scan({ host, address, port: Number(port), signal: context.signal }, isFull);
+        if (scanned.protocols.length === 0)
+            throw new Error(`no handshake with ${host}:${port}`);
+        const sent = certificates.map((der) => new X509Certificate(der));
+        const chain = chainOf(sent);
+        const responder = sent[0]?.infoAccess?.includes("OCSP - URI:") ?? false;
+        const isEarly = scanned.protocols.includes("TLSv1.3") && (await opensslFound()) ? await earlyData(host, port, address, context.signal) : undefined;
+        log.debug({ origin, address, isFull, protocols: scanned.protocols, chain, responder, isStapled: isSuccessful(ocsp), isEarly }, "tls probed");
+        return { address, ...scanned, ...(chain && { chain }), ...(sent.length > 0 && { ocsp: { responder, stapled: isSuccessful(ocsp) } }), ...(isEarly !== undefined && { "early-data": isEarly }) };
+    },
+};
+// A `when` that skips an origin behind a Cloudflare edge.
+const NOT_CLOUDFLARE = { not: { const: "cloudflare" } };
+const RULES = {
+    "tls-probe/legacy-protocols": {
+        fact: "site.origins.*.tls-probe.legacy",
+        expect: { maxItems: 0 },
+        message: "the server still accepts {got}, which RFC 6176, RFC 7568 and RFC 8996 retire",
+        severity: "error",
+        score: 9.2,
+        docs: "https://www.rfc-editor.org/rfc/rfc9325#section-3.1.1",
+        fix: "Disable SSLv3, TLS 1.0 and TLS 1.1; keep only TLS 1.2 and 1.3.",
+        hints: { cloudflare: "Raise Minimum TLS Version to 1.2 under SSL/TLS, Edge Certificates in the Cloudflare dashboard: https://developers.cloudflare.com/ssl/edge-certificates/additional-options/minimum-tls/" },
+    },
+    "tls-probe/insecure-ciphers": {
+        fact: "site.origins.*.tls-probe.insecure-ciphers",
+        expect: { maxItems: 0 },
+        when: { "site.origins.*.tls-probe.insecure-ciphers": { type: "array" }, "site.origins.*.stack.edge.name": NOT_CLOUDFLARE },
+        message: "the server accepts suites broken outright: {got}",
+        severity: "error",
+        score: 9.4,
+        docs: "https://www.rfc-editor.org/rfc/rfc9325#section-4.1",
+        fix: "Remove NULL, RC4, 3DES and other broken cipher suites from the server config.",
+    },
+    "tls-probe/vulnerabilities": {
+        fact: "site.origins.*.tls-probe.vulnerabilities",
+        expect: { maxItems: 0 },
+        when: { "site.origins.*.tls-probe.vulnerabilities": { type: "array" }, "site.origins.*.stack.edge.name": NOT_CLOUDFLARE },
+        message: "what the server negotiates leaves it open to {got}",
+        severity: "error",
+        score: 9.6,
+        docs: "https://www.rfc-editor.org/rfc/rfc7457",
+        fix: "Update the TLS library, and disable the protocol, suite or extension each named attack needs.",
+    },
+    "tls-probe/weak-ciphers": {
+        fact: "site.origins.*.tls-probe.weak-ciphers",
+        expect: { maxItems: 0 },
+        when: { "site.origins.*.tls-probe.weak-ciphers": { type: "array" }, "site.origins.*.stack.edge.name": NOT_CLOUDFLARE },
+        message: "the server accepts suites without forward secrecy, with CBC or with a 64-bit block: {got}",
+        severity: "warning",
+        score: 6.2,
+        docs: "https://www.rfc-editor.org/rfc/rfc9325#section-4.2",
+        fix: "Keep only AEAD suites that offer forward secrecy (ECDHE).",
+    },
+    "tls-probe/forward-secrecy": {
+        fact: "site.origins.*.tls-probe.forward-secrecy",
+        expect: { const: "all" },
+        when: { "site.origins.*.tls-probe.forward-secrecy": { type: "string" }, "site.origins.*.stack.edge.name": NOT_CLOUDFLARE },
+        message: "forward secrecy covers {got} of the accepted suites, where “all” are expected",
+        severity: "warning",
+        score: 5.8,
+        docs: "https://www.rfc-editor.org/rfc/rfc9325#section-7.3",
+        fix: "Configure only ECDHE suites so every handshake offers forward secrecy.",
+    },
+    "tls-probe/weak-dh": {
+        fact: "site.origins.*.tls-probe.dh-bits",
+        expect: { minimum: 2048 },
+        when: { "site.origins.*.tls-probe.dh-bits": { type: "number" } },
+        message: "the server’s DHE prime has {got} bits, short of 2048",
+        severity: "warning",
+        score: [
+            [512, 6.4],
+            [1024, 5.4],
+            [2047, 3.4],
+        ],
+        docs: "https://www.rfc-editor.org/rfc/rfc9325#section-4.5",
+        fix: "Use a DH group of at least 2048 bits, or drop the DHE suites for ECDHE.",
+    },
+    "tls-probe/compression": {
+        fact: "site.origins.*.tls-probe.compression",
+        expect: { const: false },
+        when: { "site.origins.*.tls-probe.compression": { type: "boolean" } },
+        message: "the server compresses TLS records, through which CRIME reads secrets",
+        severity: "warning",
+        score: 6,
+        docs: "https://www.rfc-editor.org/rfc/rfc9325#section-3.3",
+        fix: "Disable TLS compression.",
+    },
+    "tls-probe/secure-renegotiation": {
+        fact: "site.origins.*.tls-probe.secure-renegotiation",
+        expect: { const: true },
+        when: { "site.origins.*.tls-probe.secure-renegotiation": { type: "boolean" } },
+        message: "the server does not answer renegotiation_info, so a renegotiation can be spliced into a session",
+        severity: "warning",
+        score: 5.2,
+        docs: "https://www.rfc-editor.org/rfc/rfc5746",
+        fix: "Enable secure renegotiation in the TLS library.",
+    },
+    "tls-probe/server-cipher-order": {
+        fact: "site.origins.*.tls-probe.server-order",
+        expect: { const: true },
+        when: { "site.origins.*.tls-probe.weak-ciphers": { minItems: 1 }, "site.origins.*.stack.edge.name": NOT_CLOUDFLARE },
+        message: "the server lets the client pick a weak suite over a strong one",
+        severity: "info",
+        score: 2.8,
+        docs: "https://www.rfc-editor.org/rfc/rfc9325#section-4.2.1",
+        fix: "Set the server to prefer its own strong suites over the client’s list.",
+    },
+    "tls-probe/fallback-scsv": {
+        fact: "site.origins.*.tls-probe.fallback-scsv",
+        expect: { const: true },
+        when: { "site.origins.*.tls-probe.fallback-scsv": { type: "boolean" } },
+        message: "the server accepts a needless fallback to an older version instead of refusing it",
+        severity: "info",
+        score: 2.4,
+        docs: "https://www.rfc-editor.org/rfc/rfc7507",
+        fix: "Enable TLS_FALLBACK_SCSV in the TLS library.",
+    },
+    "tls-probe/tls13-missing": {
+        fact: "site.origins.*.tls-probe.protocols",
+        expect: { contains: { const: "TLSv1.3" } },
+        message: "the server offers {got} and no TLS 1.3",
+        severity: "info",
+        score: 2.2,
+        docs: "https://www.rfc-editor.org/rfc/rfc9325#section-3.1.1",
+        fix: "Enable TLS 1.3 in the server configuration.",
+    },
+    "tls-probe/chain-complete": {
+        fact: "site.origins.*.tls-probe.chain.complete",
+        expect: { const: true },
+        when: { "site.origins.*.tls-probe.chain": { type: "object" } },
+        message: "the server does not send the intermediate certificates its chain needs, so clients that have not cached them fail",
+        severity: "error",
+        score: 8,
+        docs: "https://www.rfc-editor.org/rfc/rfc8446#section-4.4.2",
+        fix: "Configure the server to serve the full certificate chain, including intermediates.",
+    },
+    "tls-probe/ocsp-stapling": {
+        fact: "site.origins.*.tls-probe.ocsp.stapled",
+        expect: { const: true },
+        when: { "site.origins.*.tls-probe.ocsp.responder": true },
+        message: "the certificate names an OCSP responder but the server staples no response, so each client asks the CA",
+        severity: "info",
+        score: 1.8,
+        docs: "https://www.rfc-editor.org/rfc/rfc6066#section-8",
+        fix: "Enable OCSP stapling so the server attaches the CA’s response to handshakes.",
+    },
+    "tls-probe/early-data": {
+        fact: "site.origins.*.tls-probe.early-data",
+        expect: { const: false },
+        when: { "site.origins.*.tls-probe.early-data": { type: "boolean" } },
+        message: "the server accepts TLS 1.3 early data, which an attacker can replay; non-idempotent requests must answer 425",
+        severity: "info",
+        score: 2.6,
+        docs: "https://www.rfc-editor.org/rfc/rfc8470",
+        fix: "Disable early data, or answer 425 Too Early to non-idempotent requests.",
+    },
+};
+// Hand-built handshakes per https origin, for what one connection does not show.
+export default definePlugin({
+    name: "tls-probe",
+    settings: { type: "object", properties: { scan: { type: "boolean", default: true } }, additionalProperties: false },
+    sites: [probe],
+    presets: { "tls-probe": { description: "Protocols, cipher suites, groups, negotiation weaknesses, chain completeness, OCSP stapling and early data of every https origin", rules: RULES } },
+});