spiderlint 0.0.0 → 0.143.0

package/dist/rules/catalog.js

@@ -0,0 +1,139 @@
+// SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+//
+// SPDX-License-Identifier: AGPL-3.0-only
+import { groupsOf } from "../index.js";
+import { log } from "../logger.js";
+import { ConfigError } from "../config/index.js";
+import { ruleMaker } from "../plugins/index.js";
+import { compileRule } from "./declarative.js";
+import { fixFor } from "./fix.js";
+import { compileRulesets, lookup, presetNames, resolveRuleset } from "./rulesets.js";
+const PREFIX = "spiderlint:";
+const TONE = { error: "red", warning: "yellow", info: "blue", hint: "dim", off: "dim" };
+function bare(name) {
+    return name.startsWith(PREFIX) ? name.slice(PREFIX.length) : name;
+}
+// The user's rulesets, then every shipped preset.
+function sources(config) {
+    return [...Object.keys(config.rulesets), ...presetNames().map((name) => `${PREFIX}${name}`)];
+}
+// Severities each rule runs at across the configured groups, flags applied.
+function running(config) {
+    const severities = new Map();
+    const groups = Object.entries(groupsOf(config));
+    for (const [group, { rules }] of groups) {
+        const compiled = compileRulesets(rules, config.rulesets, new Set(config.excludeRules), config.overrides);
+        log.debug({ group, rulesets: rules, rules: compiled.length }, "catalog group compiled");
+        for (const { meta } of compiled)
+            severities.set(meta.id, (severities.get(meta.id) ?? new Set()).add(meta.severity));
+    }
+    return severities;
+}
+// A ruleset and every ruleset it extends, by bare name.
+function closure(name, rulesets) {
+    return [bare(name), ...(lookup(name, rulesets)?.extends ?? []).flatMap((parent) => closure(parent, rulesets))];
+}
+// Every rule the named rulesets resolve to, or every rule any ruleset defines.
+export function listRules(config, names) {
+    const severities = running(config);
+    const all = sources(config);
+    const homes = new Map();
+    for (const name of all) {
+        const own = Object.keys(lookup(name, config.rulesets)?.rules ?? {});
+        for (const id of own)
+            homes.set(id, [...(homes.get(id) ?? []), bare(name)]);
+    }
+    const specs = Object.assign({}, ...(names.length > 0 ? names : all).map((name) => resolveRuleset(name, config.rulesets)));
+    log.debug({ rulesets: names, rules: Object.keys(specs).length }, "catalog rules resolved");
+    return Object.entries(specs)
+        .toSorted(([a], [b]) => a.localeCompare(b))
+        .map(([id, spec]) => describeRule(id, spec, severities, homes.get(id) ?? []));
+}
+// A rule’s score as `5.0`, or the scale a dynamic one follows as `0 days → 6.8, 2 → 5.2`.
+function scoreText({ score, scale }) {
+    return scale ? `dynamic: ${scale.map(([value, points]) => `${value} → ${points.toFixed(1)}`).join(", ")}` : (score ?? 0).toFixed(1);
+}
+// One rule’s catalog row, compiled at its preset severity so an `off` rule still has a meta.
+function describeRule(id, spec, severities, rulesets) {
+    const preset = spec.severity ?? "warning";
+    const { meta } = compileRule(id, { ...spec, severity: preset === "off" ? "warning" : preset });
+    const kind = spec.unique ? "unique" : spec.fact ? "declarative" : "built-in";
+    return { id, severity: [...(severities.get(id) ?? ["off"])].join("/"), preset, score: scoreText(meta), scope: meta.scope, rulesets, facts: meta.facts, docs: meta.docs, kind, expect: spec.expect, when: spec.when, message: spec.message, fix: meta.fix };
+}
+// Everything known about one rule; a rule no ruleset carries and no plugin makes is a config error.
+export function explainRule(config, id) {
+    const found = listRules(config, []).find((rule) => rule.id === id);
+    log.debug({ rule: id, found: found !== undefined, maker: ruleMaker(id) !== undefined }, "rule explained");
+    if (found)
+        return found;
+    if (ruleMaker(id))
+        return describeRule(id, { severity: "off" }, running(config), []);
+    throw new ConfigError(`rule ${id}: not defined (see spiderlint list-rules)`);
+}
+// Each shipped rule’s docs and the presets that list it, presets extending none first.
+export function shippedRules() {
+    const rules = new Map();
+    const presets = presetNames()
+        .map((name) => ({ name, config: lookup(`${PREFIX}${name}`, {}) }))
+        .toSorted((a, b) => Number(Boolean(a.config?.extends?.length)) - Number(Boolean(b.config?.extends?.length)));
+    for (const { name, config } of presets) {
+        const own = Object.keys(config?.rules ?? {});
+        for (const id of own)
+            rules.set(id, { presets: [...(rules.get(id)?.presets ?? []), { name, description: config?.description ?? "" }] });
+    }
+    const all = Object.entries(resolveRuleset(`${PREFIX}all`, {}));
+    for (const [id, spec] of all) {
+        const { meta } = compileRule(id, { ...spec, severity: !spec.severity || spec.severity === "off" ? "warning" : spec.severity });
+        rules.set(id, { presets: rules.get(id)?.presets ?? [], ...(meta.docs && { docs: meta.docs }) });
+    }
+    log.debug({ presets: presets.length, rules: rules.size }, "shipped rules mapped");
+    return rules;
+}
+// Every shipped preset, with whether a configured group runs it.
+export function listPresets(config) {
+    const used = new Set(Object.values(groupsOf(config)).flatMap(({ rules }) => rules.flatMap((name) => closure(name, config.rulesets))));
+    return presetNames().map((name) => {
+        const preset = lookup(`${PREFIX}${name}`, config.rulesets);
+        return { name, description: preset?.description ?? "", rules: Object.keys(resolveRuleset(`${PREFIX}${name}`, config.rulesets)).length, extends: (preset?.extends ?? []).map((parent) => bare(parent)), used: used.has(name) };
+    });
+}
+// Left-aligned columns sized to their widest cell; the header row bold.
+function table(rows, paint, style) {
+    const widths = rows[0]?.map((_cell, column) => Math.max(...rows.map((row) => (row[column] ?? "").length))) ?? [];
+    return rows
+        .map((row, index) => row
+        .map((cell, column) => {
+        const padded = column === row.length - 1 ? cell : cell.padEnd(widths[column] ?? 0);
+        const tone = index === 0 ? "bold" : style(index, column, cell);
+        return tone ? paint(tone, padded) : padded;
+    })
+        .join("  ")
+        .trimEnd())
+        .join("\n");
+}
+export function formatRules(rules, paint) {
+    const rows = [["RULE", "SEVERITY", "SCORE", "SCOPE", "RULESET", "DOCS"], ...rules.map((rule) => [rule.id, rule.severity, rule.score.split(":", 1)[0], rule.scope, rule.rulesets.join(", "), rule.docs ?? ""])];
+    return table(rows, paint, (_row, column, cell) => (column === 1 ? TONE[cell.split("/", 1)[0] ?? ""] : column === 5 ? "dim" : undefined));
+}
+// One labelled line per field the rule carries; schemas as compact JSON.
+export function formatExplanation(rule, paint) {
+    const rows = [
+        ["severity", `${rule.severity} (preset ${rule.preset})`],
+        ["score", rule.score],
+        ["scope", rule.scope],
+        ["kind", rule.kind],
+        ["rulesets", rule.rulesets.join(", ") || undefined],
+        ["reads", rule.facts.join(", ")],
+        ["expect", rule.expect && JSON.stringify(rule.expect)],
+        ["when", rule.when && JSON.stringify(rule.when)],
+        ["message", rule.message],
+        ["fix", rule.fix && fixFor(rule.fix)],
+        ["docs", rule.docs],
+    ];
+    const lines = rows.filter((row) => row[1] !== undefined).map(([label, value]) => `${paint("dim", label.padEnd(9))}${value}`);
+    return [paint("bold", rule.id), ...lines].join("\n");
+}
+export function formatPresets(presets, paint) {
+    const rows = [["PRESET", "RULES", "USED", "DESCRIPTION"], ...presets.map((preset) => [preset.name, String(preset.rules), preset.used ? "yes" : "no", preset.description])];
+    return table(rows, paint, (_row, column, cell) => (column === 2 ? (cell === "yes" ? "green" : "dim") : undefined));
+}

package/dist/rules/clock.js

@@ -0,0 +1,48 @@
+// SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+//
+// SPDX-License-Identifier: AGPL-3.0-only
+import { log } from "../logger.js";
+import { said } from "./message.js";
+// Seconds a host’s clock may drift before it is a warning, and before it is an error.
+const TOLERATED = 60;
+const BROKEN = 3600;
+// Seconds by which hosts that all skew alike may still disagree when the fault is our own clock.
+const SPREAD = 5;
+// The middle value of a non-empty list.
+function median(values) {
+    const sorted = values.toSorted((a, b) => a - b);
+    return sorted[Math.floor(sorted.length / 2)];
+}
+// Two or more hosts off by nearly the same amount in the same direction.
+export function isOwnClock(skews) {
+    const isOff = skews.every((skew) => Math.abs(skew) > TOLERATED && Math.sign(skew) === Math.sign(skews[0]));
+    return skews.length > 1 && isOff && Math.max(...skews) - Math.min(...skews) <= SPREAD;
+}
+// One finding per host whose `Date` runs off our clock, an error past an hour; none, and one warning, when every host is off alike.
+const clockSkew = (severity) => ({
+    meta: { id: "http/clock-skew", severity, scope: "site", facts: ["http.date-skew"], docs: "https://www.rfc-editor.org/rfc/rfc9110#section-6.6.1", fix: "Synchronise the server clock with NTP (chrony or systemd-timesyncd)." },
+    check(pages) {
+        const measured = pages.filter((page) => page.http["date-skew"] !== undefined);
+        const hosts = Map.groupBy(measured, (page) => page.url.host)
+            .entries()
+            .map(([host, members]) => ({ host, skew: median(members.map((page) => page.http["date-skew"])), urls: members.map((page) => page.url.href) }))
+            .toArray();
+        const skews = hosts.map((entry) => entry.skew);
+        log.debug({ rule: "http/clock-skew", hosts: hosts.length, skews }, "host clocks compared");
+        if (isOwnClock(skews)) {
+            log.warn({ offset: -skews[0], hosts: hosts.length }, `the local clock is off by ${-skews[0]} s; clock skew findings suppressed`);
+            return [];
+        }
+        const findings = [];
+        for (const { host, skew, urls } of hosts) {
+            if (Math.abs(skew) <= TOLERATED)
+                continue;
+            const level = Math.abs(skew) > BROKEN ? "error" : severity;
+            findings.push({ rule: "http/clock-skew", severity: level, scope: "site", url: host, ...said(skew > 0 ? "the host’s clock runs ahead of ours" : "the host’s clock runs behind ours"), data: { [host]: { skew: { fact: "http.date-skew", value: Math.abs(skew) } } }, value: skew, urls });
+        }
+        return findings;
+    },
+});
+export const clockRules = {
+    "http/clock-skew": clockSkew,
+};

package/dist/rules/declarative.js

@@ -0,0 +1,234 @@
+// SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+//
+// SPDX-License-Identifier: AGPL-3.0-only
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { ConfigError } from "../config/index.js";
+import { label } from "../facts/labels.js";
+import { subjectPath } from "../facts/sites.js";
+import { log } from "../logger.js";
+import { ruleMaker } from "../plugins/index.js";
+import { said } from "./message.js";
+import { baseScore, interpolate, levelOf, pin, scoreOf } from "./score.js";
+import { isPageRule } from "./types.js";
+// strictTypes off so `{ minItems: 1 }` needs no `type: array` beside it; `format: uri` is an absolute URL a browser parses.
+const ajv = new Ajv2020({ strictTypes: false, formats: { uri: (text) => URL.canParse(text) } });
+// Dotted path into a facts document; absent stays undefined.
+export function get(facts, path) {
+    let value = facts;
+    for (const key of path.split(".")) {
+        if (value === null || typeof value !== "object")
+            return undefined;
+        value = value[key];
+    }
+    return value;
+}
+// JSON pointer walk for the value an AJV error points at.
+function at(value, pointer) {
+    return pointer === "" ? value : get(value, pointer.slice(1).replaceAll("/", "."));
+}
+// A string past `max` keeps its head and tail around one ellipsis, since either end may hold the fix.
+function elide(text, max) {
+    return text.length > max ? `${text.slice(0, Math.ceil(max / 2))}…${text.slice(text.length - Math.floor(max / 2) + 1)}` : text;
+}
+// Rendering of an offending value for the finding message; a title or description shows whole.
+export function describe(value) {
+    if (typeof value === "string")
+        return `${value.length} characters: “${elide(value, 200)}”`;
+    if (Array.isArray(value) && value.length === 0)
+        return "none";
+    if (Array.isArray(value))
+        return value.every((item) => typeof item === "string" || typeof item === "number") ? `${value.length} items: ${elide(value.map((item) => (typeof item === "string" ? `“${item}”` : String(item))).join(", "), 200)}` : `${value.length} items`;
+    const json = JSON.stringify(value);
+    return json.length > 80 ? `${json.slice(0, 77)}…` : json;
+}
+// The rule’s own sentence as a template over `{got}` and `{field}`, else AJV’s wording against the fact path.
+function message(fact, value, error, text) {
+    const actual = value === undefined ? undefined : at(value, error.instancePath);
+    // A length says nothing against an exact value, so a `const` or `enum` miss shows the value alone.
+    const got = value === undefined ? "none" : typeof actual === "string" && ["const", "enum"].includes(error.keyword) ? `“${actual}”` : describe(actual);
+    const field = error.instancePath.slice(1).replaceAll("/", ".") || fact.split(".").at(-1);
+    if (text)
+        return said(text, { got, field });
+    const name = label(fact) ?? fact;
+    return { message: value === undefined ? `${name} is absent` : `${name}${error.instancePath} ${error.message} (got ${got})` };
+}
+function severityOf(id, spec, fallback) {
+    const severity = typeof spec.score === "number" && !spec.pinned ? levelOf(spec.score) : (spec.severity ?? fallback);
+    if (severity === "off")
+        throw new ConfigError(`rule ${id}: compiled while off`);
+    return severity;
+}
+// A `when` path read from the site document, as `site.role`, rather than one subject’s facts.
+function isSitePath(path) {
+    return path.startsWith("site.") && !/^site\.(origins|hosts)\./.test(path);
+}
+// The `when` entries a site-wide guard reads.
+function siteWhen(when) {
+    return Object.fromEntries(Object.entries(when ?? {}).filter(([path]) => isSitePath(path)));
+}
+// A `when` entry is a constant to equal, or a schema object the fact must satisfy.
+function guard(id, when) {
+    const tests = Object.entries(when ?? {}).map(([path, expected]) => {
+        const test = typeof expected === "object" && expected !== null ? ajv.compile(expected) : (actual) => actual === expected;
+        return { path, expected, test };
+    });
+    return (facts, subject, site) => {
+        for (const { path, expected, test } of tests) {
+            const actual = get(isSitePath(path) ? { site } : facts, path);
+            if (test(actual))
+                continue;
+            log.debug({ rule: id, url: subject, when: path, expected, actual }, "rule skipped");
+            return true;
+        }
+        return false;
+    };
+}
+// A page whose facts lack the extractor's top-level key is skipped, not failed.
+function compilePage(id, spec, fact, validate) {
+    const severity = severityOf(id, spec, "warning");
+    const root = fact.split(".", 1)[0];
+    const isSkipped = guard(id, spec.when);
+    return {
+        meta: { id, severity, scope: "page", facts: [fact], docs: spec.docs, fix: spec.fix, expect: spec.expect },
+        check(page, site) {
+            if (isSkipped(page, page.url.href, site))
+                return;
+            if (get(page, root) === undefined) {
+                log.debug({ rule: id, url: page.url.href, extractor: root }, "rule skipped");
+                return;
+            }
+            const value = get(page, fact);
+            if (validate(value))
+                return [];
+            const error = validate.errors?.[0];
+            return [{ rule: id, severity, scope: "page", url: page.url.href, group: page.group, ...message(fact, value, error, spec.message), value }];
+        },
+    };
+}
+// One finding per value held by two or more distinct URLs.
+function compileUnique(id, spec, fact) {
+    const severity = severityOf(id, spec, "warning");
+    const scope = spec.scope === "group" ? "group" : "site";
+    const isSkipped = guard(id, spec.when);
+    return {
+        meta: { id, severity, scope, facts: [fact], docs: spec.docs, fix: spec.fix },
+        check(pages, group, site) {
+            const byValue = new Map();
+            for (const page of pages) {
+                if (isSkipped(page, page.url.href, site))
+                    continue;
+                const value = get(page, fact);
+                if (typeof value !== "string")
+                    continue;
+                byValue.set(value, [...(byValue.get(value) ?? []), page.url.href]);
+            }
+            const findings = [];
+            for (const [value, urls] of byValue) {
+                if (urls.length < 2)
+                    continue;
+                log.debug({ rule: id, group, value, pages: urls.length }, "duplicate value");
+                findings.push({ rule: id, severity, scope, url: urls[0], group, ...(spec.message ? said(spec.message, { got: describe(value) }) : { message: `${label(fact) ?? fact} is shared by ${urls.length} pages (${describe(value)})` }), value, urls });
+            }
+            return findings;
+        },
+    };
+}
+// One check per origin or host whose facts carry the extractor’s key, keyed by that subject; only `when` paths under the same subjects apply.
+// A subject whose path runs through a probe robots.txt withheld is skipped, not failed.
+function isWithheld(facts, path, rule, subject) {
+    const parts = path.split(".");
+    const withheld = parts.find((_part, index) => get(facts, parts.slice(0, index + 1).join("."))?.disallowed === true);
+    if (withheld)
+        log.debug({ rule, subject, path, withheld }, "rule skipped, robots.txt withheld its probe");
+    return withheld !== undefined;
+}
+function compileSubject(id, spec, fact, subject, validate) {
+    const severity = severityOf(id, spec, "warning");
+    const prefix = `site.${subject.kind}.*.`;
+    const when = Object.entries(spec.when ?? {}).filter(([path]) => path.startsWith(prefix));
+    log.debug({ rule: id, kind: subject.kind, when: when.length, site: Object.keys(siteWhen(spec.when)), ignored: Object.keys(spec.when ?? {}).length - when.length - Object.keys(siteWhen(spec.when)).length }, "subject rule compiled");
+    const isSkipped = guard(id, Object.fromEntries(when.map(([path, expected]) => [path.slice(prefix.length), expected])));
+    const isSiteSkipped = guard(id, siteWhen(spec.when));
+    const needs = [...when.map(([path]) => path), ...(spec.hints ? [`${prefix}stack`] : [])].filter((path) => subjectPath(path)?.id !== subject.id);
+    return {
+        meta: { id, severity, scope: "site", facts: [fact, ...new Set(needs)], docs: spec.docs, fix: spec.fix, expect: spec.expect, ...(spec.linked === true && subject.kind === "hosts" && { linked: true }) },
+        check(_pages, _group, site) {
+            if (isSiteSkipped({}, "site", site))
+                return;
+            const unjudged = new Set(spec.linked === true ? [] : (site?.linked ?? []));
+            const judged = Object.entries(site?.[subject.kind] ?? {}).filter(([name, facts]) => facts[subject.id] !== undefined && !unjudged.has(name) && !isSkipped(facts, name) && !isWithheld(facts, subject.path, id, name));
+            log.debug({ rule: id, subjects: judged.length, linked: spec.linked === true }, "subjects judged");
+            return judged.length === 0
+                ? undefined
+                : judged.flatMap(([name, facts]) => {
+                    const value = get(facts, subject.path);
+                    if (validate(value))
+                        return [];
+                    const error = validate.errors?.[0];
+                    const hint = hintFor(spec.hints, facts.stack);
+                    if (hint)
+                        log.debug({ rule: id, subject: name, service: hint.service }, "service hint chosen");
+                    return [{ rule: id, severity, scope: "site", url: name, ...message(fact, value, error, spec.message), value, ...(hint && { hint: hint.text }) }];
+                });
+        },
+    };
+}
+// The hint for the first service the subject’s `stack` names, if the rule has one for it.
+function hintFor(hints, stack) {
+    const names = Object.values((stack ?? {})).map((entry) => entry.name);
+    const service = names.find((name) => hints?.[name] !== undefined);
+    return service && hints ? { service, text: hints[service] } : undefined;
+}
+// A built-in page rule honours `when` as a declarative one does; an aggregate one its `site.` paths.
+function guarded(rule, when) {
+    const id = rule.meta.id;
+    if (isPageRule(rule)) {
+        const isSkipped = guard(id, when);
+        return { ...rule, check: (page, site) => (isSkipped(page, page.url.href, site) ? undefined : rule.check(page, site)) };
+    }
+    const isSkipped = guard(id, siteWhen(when));
+    return { ...rule, check: (pages, group, site) => (isSkipped({}, "site", site) ? undefined : rule.check(pages, group, site)) };
+}
+// Gives every finding its score: the spec’s number, else the rule’s own or the scale’s over the finding’s value, else the level’s base; a hand-written level pins it inside its band.
+function scored(rule, spec) {
+    const fixed = typeof spec.score === "number" ? (spec.pinned ? pin(spec.severity, spec.score) : spec.score) : undefined;
+    const scale = typeof spec.score === "object" ? spec.score : undefined;
+    const level = (spec.pinned ? spec.severity : rule.meta.severity);
+    const meta = { ...rule.meta, score: fixed ?? (scale ? undefined : baseScore(level)), scale };
+    const grade = (finding) => {
+        const measured = scale && typeof finding.value === "number" ? interpolate(scale, finding.value) : finding.score;
+        const raw = fixed ?? measured ?? scoreOf(finding);
+        const score = spec.pinned ? pin(level, raw) : raw;
+        log.debug({ rule: rule.meta.id, url: finding.url, score, pinned: spec.pinned === true }, "finding scored");
+        return { ...finding, score, severity: levelOf(score) };
+    };
+    const all = (found) => found?.map((finding) => grade(finding));
+    return isPageRule(rule) ? { meta: { ...meta, scope: "page" }, check: (page, site) => all(rule.check(page, site)) } : { meta: { ...meta, scope: rule.meta.scope }, check: (pages, group, site) => all(rule.check(pages, group, site)) };
+}
+// A rule from its spec, every finding scored.
+export function compileRule(id, spec) {
+    return scored(compileUnscored(id, spec), spec);
+}
+// `fact` + `expect` is a page rule, `unique` an aggregate, an ID without `fact` a built-in handed its `expect`; else a config error.
+function compileUnscored(id, spec) {
+    if (spec.unique)
+        return compileUnique(id, spec, spec.unique);
+    const make = spec.fact ? undefined : ruleMaker(id);
+    if (!spec.fact && (make || !spec.expect)) {
+        if (!make)
+            throw new ConfigError(`rule ${id}: needs fact and expect, or unique, or a built-in ID`);
+        const rule = make(severityOf(id, spec, "warning"), spec.expect);
+        // A ruleset entry’s `docs` and `fix` win over the built-in’s own.
+        Object.assign(rule.meta, spec.docs && { docs: spec.docs }, spec.fix && { fix: spec.fix });
+        return guarded(rule, spec.when);
+    }
+    if (!spec.fact || !spec.expect)
+        throw new ConfigError(`rule ${id}: needs both fact and expect`);
+    try {
+        const subject = subjectPath(spec.fact);
+        return subject ? compileSubject(id, spec, spec.fact, subject, ajv.compile(spec.expect)) : compilePage(id, spec, spec.fact, ajv.compile(spec.expect));
+    }
+    catch (error) {
+        throw new ConfigError(`rule ${id}: expect ${error instanceof Error ? error.message : String(error)}`);
+    }
+}

package/dist/rules/deprecated.js

@@ -0,0 +1,45 @@
+// SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+//
+// SPDX-License-Identifier: AGPL-3.0-only
+import { log } from "../logger.js";
+import { said } from "./message.js";
+// Response headers no current browser acts on, by lower-cased name.
+export const DEPRECATED = {
+    "x-xss-protection": { name: "X-XSS-Protection", instead: "browsers removed the filter; Content-Security-Policy replaces it", docs: "https://developer.mozilla.org/docs/Web/HTTP/Headers/X-XSS-Protection" },
+    "report-to": { name: "Report-To", instead: "Reporting-Endpoints replaces it", docs: "https://developer.mozilla.org/docs/Web/HTTP/Headers/Report-To", unless: "nel" },
+    "expect-ct": { name: "Expect-CT", instead: "browsers enforce Certificate Transparency by default", docs: "https://developer.mozilla.org/docs/Web/HTTP/Headers/Expect-CT" },
+    "public-key-pins": { name: "Public-Key-Pins", instead: "browsers removed key pinning", docs: "https://chromestatus.com/feature/5903385005916160" },
+    "public-key-pins-report-only": { name: "Public-Key-Pins-Report-Only", instead: "browsers removed key pinning", docs: "https://chromestatus.com/feature/5903385005916160" },
+    "feature-policy": { name: "Feature-Policy", instead: "Permissions-Policy replaces it", docs: "https://developer.mozilla.org/docs/Web/HTTP/Headers/Permissions-Policy" },
+    p3p: { name: "P3P", instead: "W3C retired the standard and no browser reads it", docs: "https://www.w3.org/TR/P3P/" },
+};
+// One finding per page naming every deprecated header it sends, with what replaces each.
+const deprecatedHeader = (severity) => ({
+    meta: { id: "http/deprecated-header", severity, scope: "page", facts: ["http.headers"], docs: "https://developer.mozilla.org/docs/Web/HTTP/Headers", fix: "Remove each deprecated header, and send Reporting-Endpoints in place of Report-To unless NEL still reads it." },
+    check(page) {
+        const sent = Object.keys(page.http.headers).filter((name) => {
+            const entry = DEPRECATED[name];
+            return entry !== undefined && (entry.unless === undefined || page.http.headers[entry.unless] === undefined);
+        });
+        log.debug({ rule: "http/deprecated-header", url: page.url.href, sent }, "deprecated headers checked");
+        if (sent.length === 0)
+            return [];
+        const listed = sent.map((name) => DEPRECATED[name]);
+        return [
+            {
+                rule: "http/deprecated-header",
+                severity,
+                scope: "page",
+                url: page.url.href,
+                group: page.group,
+                ...said("the page sends deprecated headers"),
+                data: { [page.url.href]: { headers: listed.map((entry) => entry.name).join(", ") } },
+                locations: listed.map((entry) => `${entry.name} → ${entry.instead}`),
+                value: Object.fromEntries(listed.map((entry) => [entry.name, entry.docs])),
+            },
+        ];
+    },
+});
+export const deprecatedRules = {
+    "http/deprecated-header": deprecatedHeader,
+};

package/dist/rules/disclosure.js

@@ -0,0 +1,99 @@
+// SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+//
+// SPDX-License-Identifier: AGPL-3.0-only
+import { getDomain } from "tldts";
+import { log } from "../logger.js";
+import { said } from "./message.js";
+// Response headers, and the generator meta, that name the software behind a response.
+export const DISCLOSING = {
+    server: "version",
+    via: "version",
+    "x-generator": "version",
+    "meta generator": "version",
+    "x-powered-by": "always",
+    "x-aspnet-version": "always",
+    "x-aspnetmvc-version": "always",
+    "x-debug-token": "always",
+    "x-debug-token-link": "always",
+    "x-drupal-cache": "presence",
+    "x-varnish": "presence",
+    "x-runtime": "presence",
+};
+// Products a CDN or hosting platform names in `Server` and the owner cannot remove.
+export const UNREMOVABLE = new Set(["cloudflare", "amazons3", "cloudfront", "fastly", "akamaighost", "akamainetstorage", "netlify", "vercel", "github.com", "gws", "esf", "sffe", "google frontend", "bunnycdn", "keycdn"]);
+// A version number: a digit after `/`, a space or `(`, optionally `v`-prefixed.
+const VERSION = /(?:^|[/\s(])v?\d/i;
+// A value with `Via`’s received-protocol dropped, since `1.1` there is HTTP’s version, not the proxy’s.
+function stripped(field, value) {
+    return field === "via"
+        ? value
+            .split(",")
+            .map((hop) => hop.trim().replace(/^\S+\s+/, ""))
+            .join(", ")
+        : value.trim();
+}
+// The severity one field earns, or undefined when it discloses nothing the owner can change.
+function judge(field, value, severity) {
+    const product = stripped(field, value);
+    const kind = DISCLOSING[field] ?? "presence";
+    const isVersioned = VERSION.test(product);
+    const isUnremovable = field === "server" && UNREMOVABLE.has(product.toLowerCase().split("/", 1)[0] ?? "");
+    log.debug({ rule: "http/server-disclosure", field, value, kind, isVersioned, isUnremovable }, "disclosure judged");
+    if (isUnremovable || product.length === 0)
+        return undefined;
+    return kind === "always" || (isVersioned && kind === "version") ? severity : "hint";
+}
+// Each disclosing field of one response, joined when repeated.
+function fields(headers, generator) {
+    const found = Object.keys(DISCLOSING).flatMap((name) => {
+        const value = [headers?.[name] ?? []].flat().join(", ");
+        return value ? [[name, value]] : [];
+    });
+    return generator ? [...found, ["meta generator", generator]] : found;
+}
+// The registrable domain of a host, the host itself when it has none.
+function domainOf(host) {
+    return getDomain(host, { allowPrivateDomains: true }) ?? host;
+}
+// One finding per host, field and value across every page and every resource under a crawled registrable domain.
+const serverDisclosure = (severity) => ({
+    meta: {
+        id: "http/server-disclosure",
+        severity,
+        scope: "site",
+        facts: ["http.headers", "html.meta.generator", "resources"],
+        docs: "https://developer.mozilla.org/docs/Web/HTTP/Reference/Headers/Server",
+        fix: "Remove the version from the Server header and drop X-Powered-By and debug headers at the server or proxy.",
+    },
+    check(pages) {
+        const domains = new Set(pages.map((page) => domainOf(page.url.host)));
+        const seen = new Map();
+        const note = (url, found) => {
+            const host = new URL(url).host;
+            for (const [field, value] of found) {
+                const key = `${host}\n${field}\n${value}`;
+                const entry = seen.get(key) ?? { host, field, value, urls: new Set() };
+                entry.urls.add(url);
+                seen.set(key, entry);
+            }
+        };
+        for (const page of pages) {
+            note(page.url.href, fields(page.http.headers, page.html?.meta.generator));
+            const owned = (page.resources ?? []).filter((resource) => domains.has(domainOf(new URL(resource.url).host)));
+            for (const resource of owned)
+                note(resource.url, fields(resource.http?.headers));
+        }
+        const findings = [];
+        for (const { host, field, value, urls } of seen.values()) {
+            const level = judge(field, value, severity);
+            if (!level)
+                continue;
+            const listed = [...urls].toSorted((a, b) => a.localeCompare(b));
+            findings.push({ rule: "http/server-disclosure", severity: level, scope: "site", url: host, ...said("the host names its software in {field}", { field }), data: { [host]: { value } }, value: { [field]: value }, urls: listed, score: level === "hint" ? 3.5 : 5.4 });
+        }
+        return findings;
+    },
+});
+export const disclosureRules = {
+    "http/server-disclosure": serverDisclosure,
+};

package/dist/rules/fix.js

@@ -0,0 +1,21 @@
+// SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>
+//
+// SPDX-License-Identifier: AGPL-3.0-only
+import { getDomain } from "tldts";
+import { log } from "../logger.js";
+const PLACEHOLDER = /\{(host|domain|origin|url)\}/g;
+// The subject a finding names: a page URL, else the bare host or origin a site rule keys it by.
+function subject(finding) {
+    const href = URL.canParse(finding.url) ? finding.url : `https://${finding.url}`;
+    if (!URL.canParse(href))
+        return undefined;
+    const url = new URL(href);
+    return { host: url.hostname, domain: getDomain(url.hostname, { allowPrivateDomains: true }) ?? url.hostname, origin: url.origin, url: url.href };
+}
+// A rule’s fix, or the hint for the service the finding’s subject runs on, with `{host}`, `{domain}`, `{origin}` and `{url}` taken from the finding, else shown as `<host>`.
+export function fixFor(fix, finding) {
+    const values = finding && subject(finding);
+    if (finding && !values)
+        log.debug({ rule: finding.rule, url: finding.url }, "fix left generic, no subject");
+    return (finding?.hint ?? fix).replaceAll(PLACEHOLDER, (_match, name) => values?.[name] ?? `<${name}>`);
+}