src/live-checks.ts

Functions

Imports

It imports src/env.ts, src/github/client.ts, src/ops-sites.ts, src/ops-types/sites.ts, src/ops-types/views.ts, src/read-capped.ts, src/time.ts. Imported by src/bing-webmaster.ts, src/search-console.ts, src/site-check.ts, src/watcher-detect.ts, src/watcher-gather.ts.

Source

1import { checkSecurityHeaders, failures } from "@dustinedwards/site-runtime/check";
2import type { Env } from "./env";
3import { ghFetch, getDefaultBranch, getRefSha, resolveRepo } from "./github/client";
4import type { OpsSite } from "./ops-sites";
5import type { SiteProbe } from "./ops-types/sites";
6import type { WebAnalyticsSite } from "./ops-types/views";
7import { readCapped } from "./read-capped";
8import { MINUTE_MS } from "./time";
9
10// THE WATCHER'S LIVE CHECKS (capsid/research/design-automation-for-speed.md, D5, ruled
11// by Dustin 2026-10-04). Four things Dustin checked by hand with PowerShell after a
12// deploy, read by the Worker instead: the deployed sha against the default branch, the
13// Web Analytics beacon on public pages, a CSP that lets the beacon load and report,
14// and no beacon on pages that must not carry one.
15//
16// WHAT TO CHECK IS A DOCUMENT, NOT CODE. Which pages carry a beacon is a cross-repo
17// rule, so it lives in Capsid's store at capsid/policy/live-checks.md,
18// beside the other policies, and is read each pass. No document means the check does not
19// run: nothing is probed on a guess. It judges nothing but what it is told to look at,
20// and it can only post a job, like every watcher finding. See docs/live-checks.md.
21//
22// Reads only. Each page is one GET of the site's own configured origin plus a path the
23// document names, so a document cannot point the watcher at another host.
24
25const LIVE_CHECKS_NAMESPACE = "capsid";
26const LIVE_CHECKS_PATH = "policy/live-checks.md";
27
28const BEACON_SCRIPT_HOST = "static.cloudflareinsights.com";
29const BEACON_REPORT_HOST = "cloudflareinsights.com";
30/** Where Cloudflare's edge injects the beacon from: a VERSIONED path under the file name, so a
31 *  source naming only /beacon.min.js blocks it (site-runtime csp.mjs, measured in a browser).
32 *  A page that writes its own tag is judged by that tag's src instead (beaconSrc). */
33export const BEACON_INJECTED_URL = `https://${BEACON_SCRIPT_HOST}/beacon.min.js/v0`;
34/** Where the beacon reports from a host not proxied by Cloudflare. */
35const BEACON_REPORT_URL = `https://${BEACON_REPORT_HOST}/cdn-cgi/rum`;
36
37// A push whose deploy has had this long and still has not reached the site is a finding.
38// Shorter and the watcher would file a job every time a pass landed inside a normal
39// deploy (CI takes about seven minutes).
40export const DEPLOY_GRACE_MINUTES = 45;
41
42// Bounds, so one document cannot turn a pass into a flood of subrequests. The tick
43// already makes GitHub and Cloudflare reads in the same invocation.
44export const MAX_PAGE_RULES = 20;
45export const MAX_SHA_RULES = 6;
46export const MAX_ANALYTICS_RULES = 20;
47export const MAX_PAGE_BYTES = 1_048_576;
48const PAGE_TIMEOUT_MS = 10_000;
49const PATH_PATTERN = /^\/[A-Za-z0-9._~/%-]{0,199}$/;
50
51export type LiveRule =
52  | { namespace: string; kind: "beacon"; path: string }
53  | { namespace: string; kind: "nobeacon"; path: string }
54  | { namespace: string; kind: "headers"; path: string }
55  | { namespace: string; kind: "sha" }
56  | { namespace: string; kind: "analytics" };
57
58export type LiveConfig = { rules: LiveRule[] } | { error: string };
59
60/**
61 * The rules in the document. Only lines that begin `- site ` are read; everything else
62 * is prose. A `- site` line that does not parse refuses the whole document, because a
63 * rule that silently did not apply reads as a page that was checked and found fine.
64 *
65 *   - site <namespace> beacon <path>     a CSP on this page that lets the beacon load and report
66 *   - site <namespace> nobeacon <path>   no beacon on this page
67 *   - site <namespace> headers <path>    the OWASP security headers on this page
68 *   - site <namespace> sha               the deployed sha is the default branch's head
69 *   - site <namespace> analytics         Web Analytics automatic setup is on for the site's host
70 */
71export function parseLiveConfig(body: string): LiveConfig {
72  const rules: LiveRule[] = [];
73  for (const [index, raw] of body.split(/\r?\n/).entries()) {
74    const line = raw.trim();
75    if (line !== "- site" && !line.startsWith("- site ")) continue;
76    const where = `line ${index + 1} (${line.slice(0, 80)})`;
77    const parts = line.slice("- site".length).trim().split(/\s+/);
78    const [namespace, kind, path, ...rest] = parts;
79    if (!namespace || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(namespace)) return { error: `${where}: no site namespace` };
80    if (kind === "analytics") {
81      if (path !== undefined) return { error: `${where}: analytics takes no path` };
82      rules.push({ namespace, kind: "analytics" });
83      continue;
84    }
85    if (kind === "sha") {
86      if (path !== undefined) return { error: `${where}: sha takes no path` };
87      // Capsid's own deploy is the "master head" check; a second finding about the same
88      // thing would be two jobs for one problem.
89      if (namespace === "capsid") return { error: `${where}: capsid's deployed sha is already checked by the master head check` };
90      rules.push({ namespace, kind: "sha" });
91      continue;
92    }
93    if (kind !== "beacon" && kind !== "nobeacon" && kind !== "headers") return { error: `${where}: the rule is beacon, nobeacon, headers, analytics or sha` };
94    if (path === undefined || rest.length > 0 || !PATH_PATTERN.test(path)) {
95      return { error: `${where}: ${kind} needs one path that starts with / and holds only letters, digits and . _ ~ / % - (no query, no host)` };
96    }
97    rules.push({ namespace, kind, path });
98  }
99  if (rules.filter((r) => r.kind === "analytics").length > MAX_ANALYTICS_RULES) return { error: `more than ${MAX_ANALYTICS_RULES} analytics rules` };
100  if (rules.filter((r) => r.kind !== "sha" && r.kind !== "analytics").length > MAX_PAGE_RULES) return { error: `more than ${MAX_PAGE_RULES} page rules; each is a fetch inside one pass` };
101  if (rules.filter((r) => r.kind === "sha").length > MAX_SHA_RULES) return { error: `more than ${MAX_SHA_RULES} sha rules; each is a GitHub read inside one pass` };
102  return { rules };
103}
104
105// THE PAGE.
106
107/** Scripts on the page that load the Web Analytics beacon. A script tag whose own
108 *  attributes name the beacon host. A beacon a page injects with inline script, or one
109 *  Cloudflare adds in the browser, is not in the delivered HTML and is not counted. */
110export function beaconCount(html: string): number {
111  return beaconSrcs(html).length;
112}
113
114const BEACON_SRC = new RegExp(`\\bsrc\\s*=\\s*["']?((?:https?:)?//${BEACON_SCRIPT_HOST.replace(/\./g, "\\.")}/[^"'\\s>]*)`, "i");
115
116/** The src of each beacon script tag in the delivered HTML, made absolute (https). */
117function beaconSrcs(html: string): string[] {
118  const out: string[] = [];
119  for (const tag of html.matchAll(/<script\b[^>]*>/gi)) {
120    const src = BEACON_SRC.exec(tag[0])?.[1];
121    if (src) out.push(src.startsWith("//") ? `https:${src}` : src.replace(/^http:/i, "https:"));
122  }
123  return out;
124}
125
126/** The beacon address a page's CSP must allow: the page's own tag when it writes one, else
127 *  the address the edge injects from. */
128export function beaconSrc(html: string): string {
129  return beaconSrcs(html)[0] ?? BEACON_INJECTED_URL;
130}
131
132type Directives = Map<string, string[]>;
133
134/** One Content-Security-Policy header value as its enforced policies, each a map of
135 *  directive to sources. A header can carry several, comma separated; every one
136 *  applies. The first occurrence of a directive in a policy wins, as in the spec. */
137export function parseCsp(header: string): Directives[] {
138  return header
139    .split(",")
140    .map((policy) => {
141      const directives: Directives = new Map();
142      for (const part of policy.split(";")) {
143        const [name, ...sources] = part.trim().split(/\s+/);
144        if (!name) continue;
145        const key = name.toLowerCase();
146        if (!directives.has(key)) directives.set(key, sources);
147      }
148      return directives;
149    })
150    .filter((d) => d.size > 0);
151}
152
153/**
154 * Whether a CSP source expression covers `url` (CSP3, "Does url match expression"): its
155 * host, and its path when it has one. A path ending in "/" covers everything under it;
156 * any other path covers only itself, so https://cloudflareinsights.com/x does not let the
157 * beacon report. The beacon is always https, which an http: source upgrades to; a port
158 * other than 443 or * does not match it.
159 */
160function sourceMatches(source: string, url: string): boolean {
161  const s = source.toLowerCase();
162  if (s === "*" || s === "https:") return true;
163  const target = new URL(url);
164  const m = /^(?:([a-z][a-z0-9+.-]*):\/\/)?([^/:?#]+)(?::(\d+|\*))?(\/[^?#]*)?/.exec(s);
165  if (!m) return false;
166  const [, scheme, host, port, path] = m;
167  if (scheme && scheme !== "https" && scheme !== "http") return false;
168  if (port && port !== "*" && port !== "443") return false;
169  // A wildcard needs a subdomain, so *.cloudflareinsights.com does not name the apex.
170  const hostOk = host === target.hostname || (host.startsWith("*.") && target.hostname.endsWith(host.slice(1)));
171  if (!hostOk) return false;
172  if (!path || path === "/") return true;
173  const decoded = decodeURIComponent(path);
174  return decoded.endsWith("/") ? target.pathname.startsWith(decoded) : target.pathname === decoded;
175}
176
177export interface CspVerdict {
178  ok: boolean;
179  why: string | null;
180}
181
182/**
183 * Whether every enforced policy lets the beacon load from `scriptUrl`. A directive a
184 * policy omits falls back to default-src, and a policy with neither allows it. A
185 * 'strict-dynamic' script-src ignores host sources, so the beacon, which carries no
186 * nonce, is blocked however its host is listed.
187 */
188export function cspAllowsBeaconScript(policies: Directives[], scriptUrl: string = BEACON_INJECTED_URL): CspVerdict {
189  for (const policy of policies) {
190    const sources = policy.get("script-src") ?? policy.get("default-src");
191    if (!sources) continue;
192    if (sources.some((s) => s.toLowerCase() === "'strict-dynamic'")) {
193      return { ok: false, why: "script-src uses 'strict-dynamic', which ignores host sources, and the beacon script has no nonce" };
194    }
195    if (sources.length === 0 || sources.some((s) => s.toLowerCase() === "'none'")) {
196      return { ok: false, why: `script-src allows no script (${sources.join(" ") || "empty"})` };
197    }
198    if (!sources.some((s) => sourceMatches(s, scriptUrl))) {
199      return { ok: false, why: `script-src (${sources.join(" ")}) does not cover ${scriptUrl}` };
200    }
201  }
202  return { ok: true, why: null };
203}
204
205/**
206 * Whether every enforced policy lets the beacon report. Cloudflare sends it to the
207 * site's own /cdn-cgi/rum when the site is proxied through Cloudflare, so 'self' is
208 * enough there; any other host sends it to cloudflareinsights.com
209 * (developers.cloudflare.com/web-analytics/faq).
210 */
211export function cspAllowsBeaconReport(policies: Directives[], platform: "cloudflare" | "vercel"): CspVerdict {
212  for (const policy of policies) {
213    const sources = policy.get("connect-src") ?? policy.get("default-src");
214    if (!sources) continue;
215    if (sources.length === 0 || sources.some((s) => s.toLowerCase() === "'none'")) {
216      return { ok: false, why: `connect-src allows no connection (${sources.join(" ") || "empty"})` };
217    }
218    const self = platform === "cloudflare" && sources.some((s) => s.toLowerCase() === "'self'");
219    if (!self && !sources.some((s) => sourceMatches(s, BEACON_REPORT_URL))) {
220      return { ok: false, why: `connect-src (${sources.join(" ")}) does not cover ${BEACON_REPORT_URL}${platform === "cloudflare" ? " or 'self'" : ""}` };
221    }
222  }
223  return { ok: true, why: null };
224}
225
226// FINDINGS.
227
228export interface LiveFinding {
229  namespace: string;
230  fingerprint: string;
231  headline: string;
232  evidence: string[];
233}
234
235/** A page's path as one fingerprint-safe word: "/" is root, "/a/b" is a-b. */
236export const slug = (path: string): string => path.replace(/^\/+|\/+$/g, "").replace(/[^A-Za-z0-9]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase() || "root";
237
238export interface PageRead {
239  status: number | null;
240  headers: Headers | null;
241  html: string | null;
242  // Why this is not a readable HTML page, or null when it is.
243  problem: string | null;
244  // The page was not served to an anonymous visitor: a login redirect off the site, or a
245  // 401 or 403. For a page that must carry no beacon that is the answer wanted, not a
246  // page that could not be read.
247  gated: boolean;
248}
249
250/** The findings one beacon or nobeacon rule produces from one page read. A page that
251 *  could not be read yields none about the beacon (not read is not absent); the caller
252 *  reports it as unread. */
253export function pageFindings(site: Pick<OpsSite, "namespace" | "name" | "origin" | "platform">, rule: Extract<LiveRule, { path: string }>, page: PageRead): LiveFinding[] {
254  if (page.problem !== null || page.html === null || page.headers === null) return [];
255  const url = `${site.origin}${rule.path}`;
256  const where = slug(rule.path);
257  const out: LiveFinding[] = [];
258  if (rule.kind === "headers") {
259    // The package's own check, so the oracle (OWASP's defaults and its test vectors) lives
260    // in one place and the watcher holds no second copy.
261    const results = checkSecurityHeaders(page.headers);
262    if (results.length === 0) throw new Error("checkSecurityHeaders returned no results, so a pass would mean nothing was checked");
263    const failed = failures(results);
264    if (failed.length > 0) {
265      out.push({
266        namespace: site.namespace,
267        fingerprint: `live-headers-${site.namespace}-${where}`,
268        headline: `${site.name} is missing security headers on a page that must carry them`,
269        evidence: [`page: ${url}`, `${failed.length} of ${results.length} header checks failed`, ...failed.slice(0, 12).map((r) => `${r.name}: ${r.detail}`)],
270      });
271    }
272    return out;
273  }
274  if (rule.kind === "nobeacon") {
275    const count = beaconCount(page.html);
276    if (count > 0) {
277      out.push({
278        namespace: site.namespace,
279        fingerprint: `live-beacon-present-${site.namespace}-${where}`,
280        headline: `${site.name} carries the Web Analytics beacon on a page that must not`,
281        evidence: [`page: ${url}`, `beacon scripts in the delivered HTML: ${count}`, "Conventions 7.9 keeps private and signed-in pages out of analytics. Cache-Control: no-transform stops Cloudflare injecting it."],
282      });
283    }
284    return out;
285  }
286  const header = page.headers.get("content-security-policy");
287  if (header) {
288    const policies = parseCsp(header);
289    const script = cspAllowsBeaconScript(policies, beaconSrc(page.html));
290    if (!script.ok) {
291      out.push({
292        namespace: site.namespace,
293        fingerprint: `live-csp-script-${site.namespace}-${where}`,
294        headline: `${site.name}'s CSP blocks the Web Analytics beacon script`,
295        evidence: [`page: ${url}`, script.why ?? "", `header: ${header.slice(0, 300)}`],
296      });
297    }
298    const report = cspAllowsBeaconReport(policies, site.platform);
299    if (!report.ok) {
300      out.push({
301        namespace: site.namespace,
302        fingerprint: `live-csp-report-${site.namespace}-${where}`,
303        headline: `${site.name}'s CSP blocks the Web Analytics beacon from reporting`,
304        evidence: [`page: ${url}`, report.why ?? "", `header: ${header.slice(0, 300)}`],
305      });
306    }
307  }
308  return out;
309}
310
311/** The sha finding for one site, or null. `committedAt` is when the default branch's head
312 *  was committed; a head younger than the grace is a deploy still in flight. */
313export function shaFinding(
314  site: Pick<OpsSite, "namespace" | "name">,
315  deployed: string | null,
316  head: { sha: string; committed_at: string | null },
317  now: Date
318): LiveFinding | null {
319  if (deployed === null) {
320    return {
321      namespace: site.namespace,
322      fingerprint: `live-sha-unreported-${site.namespace}`,
323      headline: `${site.name} is set to be checked against its default branch but reports no deployed sha`,
324      evidence: ["The site's health route did not report a sha, so the rule in capsid/policy/live-checks.md cannot be judged.", "Either the route does not report one or the rule should go."],
325    };
326  }
327  // A health route may report a short sha; either side may be the prefix.
328  if (deployed.length >= 7 && (head.sha.startsWith(deployed) || deployed.startsWith(head.sha))) return null;
329  const committed = head.committed_at ? Date.parse(head.committed_at) : Number.NaN;
330  if (Number.isNaN(committed)) return null;
331  const minutes = (now.getTime() - committed) / MINUTE_MS;
332  if (minutes < DEPLOY_GRACE_MINUTES) return null;
333  return {
334    namespace: site.namespace,
335    fingerprint: `live-sha-drift-${site.namespace}-${head.sha.slice(0, 7)}`,
336    headline: `${site.name}'s deployed sha is not its default branch head`,
337    evidence: [
338      `deployed: ${deployed}`,
339      `default branch head: ${head.sha}, committed ${head.committed_at}`,
340      `${Math.floor(minutes)} minutes ago, past the ${DEPLOY_GRACE_MINUTES} minute grace`,
341      "A merge whose deploy failed or never ran looks exactly like this.",
342    ],
343  };
344}
345
346/** The Web Analytics finding for one site, or null. A Worker cannot see the beacon the edge
347 *  injects, so what is read is the setting that makes Cloudflare inject it: the site's
348 *  host has automatic setup on, and its ruleset is not switched off. */
349export function analyticsFinding(site: Pick<OpsSite, "namespace" | "name" | "origin">, sites: readonly WebAnalyticsSite[]): LiveFinding | null {
350  const host = new URL(site.origin).hostname.toLowerCase();
351  const entry = sites.find((s) => s.host === host);
352  if (!entry) {
353    return {
354      namespace: site.namespace,
355      fingerprint: `live-analytics-missing-${site.namespace}`,
356      headline: `${site.name}'s host has no Web Analytics site, so no traffic is counted`,
357      evidence: [`host: ${host}`, `${sites.length} Web Analytics sites in the account, none for this host`, "Add the host under Web Analytics in the Cloudflare dashboard, with automatic setup."],
358    };
359  }
360  if (entry.auto_install === true && entry.enabled !== false) return null;
361  return {
362    namespace: site.namespace,
363    fingerprint: `live-analytics-off-${site.namespace}`,
364    headline: `${site.name}'s Web Analytics automatic setup is off`,
365    evidence: [`host: ${host}`, `auto_install: ${entry.auto_install}, ruleset enabled: ${entry.enabled}`, "Cloudflare injects the beacon only with automatic setup on, so no traffic is counted for this host."],
366  };
367}
368
369// READING.
370
371export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
372
373/** One GET of a site's page. A page that cannot be judged says why in `problem`: an
374 *  error, a non-2xx answer, a redirect off the site (a login), a body that is not HTML,
375 *  or one past the size bound. None of those is evidence about the beacon. */
376export async function readPage(fetchImpl: FetchLike, origin: string, path: string): Promise<PageRead> {
377  const unread = (status: number | null, problem: string, gated = false): PageRead => ({ status, headers: null, html: null, problem, gated });
378  let res: Response;
379  try {
380    res = await fetchImpl(`${origin}${path}`, {
381      method: "GET",
382      redirect: "follow",
383      headers: { "User-Agent": "capsid-watcher (live checks)", Accept: "text/html" },
384      signal: AbortSignal.timeout(PAGE_TIMEOUT_MS),
385    });
386  } catch (err) {
387    return unread(null, `no answer: ${(err instanceof Error ? err.message : String(err)).slice(0, 120)}`);
388  }
389  if (res.url) {
390    const finalOrigin = new URL(res.url).origin;
391    if (finalOrigin !== new URL(origin).origin) {
392      await res.body?.cancel();
393      return unread(res.status, `redirected off the site to ${finalOrigin}`, true);
394    }
395  }
396  if (res.status < 200 || res.status >= 300) {
397    await res.body?.cancel();
398    return unread(res.status, `answered ${res.status}`, res.status === 401 || res.status === 403);
399  }
400  const type = res.headers.get("content-type") ?? "";
401  if (!/\btext\/html\b/i.test(type)) {
402    await res.body?.cancel();
403    return unread(res.status, `content-type is ${type || "absent"}, not HTML`);
404  }
405  const { text, truncated } = await readCapped(res, MAX_PAGE_BYTES);
406  if (truncated) return unread(res.status, `page is larger than ${MAX_PAGE_BYTES} bytes, so a beacon count over it would be a guess`);
407  return { status: res.status, headers: res.headers, html: text, problem: null, gated: false };
408}
409
410/** The default branch's head sha and when it was committed. */
411export async function defaultBranchHead(env: Env, namespace: string): Promise<{ sha: string; committed_at: string | null }> {
412  const { owner, repo } = await resolveRepo(env, namespace);
413  const branch = await getDefaultBranch(env, owner, repo);
414  const sha = await getRefSha(env, owner, repo, branch);
415  const resp = await ghFetch(env, owner, repo, `/repos/${owner}/${repo}/commits/${encodeURIComponent(sha)}`);
416  if (!resp.ok) throw new Error(`commit lookup failed for ${sha.slice(0, 7)} (${resp.status})`);
417  const body = (await resp.json()) as { commit?: { committer?: { date?: string } | null } };
418  return { sha, committed_at: body.commit?.committer?.date ?? null };
419}
420
421interface LiveSummary {
422  pages_expected: number;
423  pages_read: number;
424  shas_expected: number;
425  shas_read: number;
426  analytics_expected: number;
427  analytics_read: number;
428}
429
430export interface LiveResult {
431  findings: LiveFinding[];
432  // Whether every configured check was read, so a finding that stops appearing is
433  // evidence it is fixed. Not run on a missing document, an invalid one, or any
434  // unread page or sha: absence of a read is not absence of a problem.
435  ran: boolean;
436  summary: LiveSummary;
437}
438
439const NOTHING: LiveSummary = { pages_expected: 0, pages_read: 0, shas_expected: 0, shas_read: 0, analytics_expected: 0, analytics_read: 0 };
440
441export async function readLiveConfig(db: D1Database): Promise<{ body: string } | null> {
442  const row = await db
443    .prepare("SELECT body FROM documents WHERE namespace = ?1 AND path = ?2 AND status = 'published'")
444    .bind(LIVE_CHECKS_NAMESPACE, LIVE_CHECKS_PATH)
445    .first<{ body: string | null }>();
446  return row && row.body !== null ? { body: row.body } : null;
447}
448
449export interface LiveDeps {
450  fetchImpl: FetchLike;
451  head: (namespace: string) => Promise<{ sha: string; committed_at: string | null }>;
452  // The account's Web Analytics sites, read once per pass. Throws, with the reason, when
453  // Cloudflare cannot be read (no token, a 403 for a missing permission).
454  analytics: () => Promise<WebAnalyticsSite[]>;
455}
456
457/**
458 * Run every rule in the document. `probes` are this pass's site probes, which carry the
459 * deployed sha. A site down on this pass is the site-down check's finding, so its pages
460 * and sha are skipped here and the run is not complete.
461 */
462export async function liveChecks(
463  config: { body: string } | null,
464  sites: readonly OpsSite[],
465  probes: readonly SiteProbe[],
466  deps: LiveDeps,
467  now: Date
468): Promise<LiveResult> {
469  if (config === null) return { findings: [], ran: false, summary: NOTHING };
470  const parsed = parseLiveConfig(config.body);
471  if ("error" in parsed) {
472    return {
473      findings: [
474        {
475          namespace: LIVE_CHECKS_NAMESPACE,
476          fingerprint: "live-config-invalid",
477          headline: "capsid/policy/live-checks.md does not parse, so no live check is running",
478          evidence: [parsed.error, "Fix the line named; the check reads the document again every pass."],
479        },
480      ],
481      ran: false,
482      summary: NOTHING,
483    };
484  }
485  const findings: LiveFinding[] = [];
486  const bySite = new Map(sites.map((s) => [s.namespace, s]));
487  const probeFor = new Map(probes.map((p) => [p.namespace, p]));
488  let analyticsRead: Promise<{ sites: WebAnalyticsSite[] } | { problem: string }> | undefined;
489  const summary: LiveSummary = { pages_expected: 0, pages_read: 0, shas_expected: 0, shas_read: 0, analytics_expected: 0, analytics_read: 0 };
490
491  for (const rule of parsed.rules) {
492    const site = bySite.get(rule.namespace);
493    if (!site) {
494      findings.push({
495        namespace: LIVE_CHECKS_NAMESPACE,
496        fingerprint: `live-config-unknown-site-${rule.namespace}`,
497        headline: `capsid/policy/live-checks.md names a site that is not configured: ${rule.namespace}`,
498        evidence: ["A rule for a site with no origin in Portal Settings never runs.", "Add the site there, or remove its lines."],
499      });
500      continue;
501    }
502    const probe = probeFor.get(rule.namespace);
503    const counted = rule.kind === "sha" ? "shas" : rule.kind === "analytics" ? "analytics" : "pages";
504    summary[`${counted}_expected`] += 1;
505    if (!probe || probe.state === "down") continue;
506
507    if (rule.kind === "analytics") {
508      analyticsRead ??= deps.analytics().then(
509        (sites) => ({ sites }),
510        (err: unknown) => ({ problem: (err instanceof Error ? err.message : String(err)).slice(0, 400) })
511      );
512      const read = await analyticsRead;
513      if ("problem" in read) {
514        findings.push({
515          namespace: site.namespace,
516          fingerprint: `live-analytics-unread-${site.namespace}`,
517          headline: `${site.name}'s Web Analytics setting could not be read for the live checks`,
518          evidence: [read.problem, "Not read is not clean: the setting was not judged."],
519        });
520        continue;
521      }
522      summary.analytics_read += 1;
523      const f = analyticsFinding(site, read.sites);
524      if (f) findings.push(f);
525      continue;
526    }
527    if (rule.kind === "sha") {
528      const head = await deps.head(rule.namespace);
529      summary.shas_read += 1;
530      const f = shaFinding(site, probe.sha, head, now);
531      if (f) findings.push(f);
532      continue;
533    }
534    const page = await readPage(deps.fetchImpl, site.origin, rule.path);
535    if (page.problem !== null && page.gated && rule.kind === "nobeacon") {
536      // Not served to the public, which is what the rule asks for.
537      summary.pages_read += 1;
538      continue;
539    }
540    if (page.problem !== null) {
541      findings.push({
542        namespace: site.namespace,
543        fingerprint: `live-page-unread-${site.namespace}-${slug(rule.path)}`,
544        headline: `${site.name}'s ${rule.path} could not be read for the live checks`,
545        evidence: [`page: ${site.origin}${rule.path}`, page.problem, "Not read is not clean: the beacon and CSP on this page were not judged."],
546      });
547      continue;
548    }
549    summary.pages_read += 1;
550    findings.push(...pageFindings(site, rule, page));
551  }
552  const ran = summary.pages_read === summary.pages_expected && summary.shas_read === summary.shas_expected && summary.analytics_read === summary.analytics_expected;
553  // One finding per fingerprint: two rules for one unknown site, or the same page named
554  // twice, are one problem, and the queue refuses a second job under the same title.
555  const unique = [...new Map(findings.map((f) => [f.fingerprint, f])).values()];
556  return { findings: unique, ran, summary };
557}