// Generated CSP audit catalog. Edit work/generate_csp_catalog.py and regenerate for mechanical catalog updates.

///|
fn catalog_missing(
  policy : Policy,
  directive_name : String,
  code : String,
  message : String,
  severity : Severity,
) -> Finding? {
  if has_directive(policy, directive_name) {
    None
  } else {
    Some(make_finding(severity, code, directive_name, message, 0))
  }
}

///|
fn catalog_source(
  policy : Policy,
  directive_name : String,
  source_value : String,
  code : String,
  message : String,
  severity : Severity,
) -> Finding? {
  match get_directive(policy, directive_name) {
    None => None
    Some(directive) =>
      if directive_has_source(directive, source_value) {
        Some(
          make_finding(severity, code, directive_name, message, directive.line),
        )
      } else {
        None
      }
  }
}

///|
fn catalog_source_prefix(
  policy : Policy,
  directive_name : String,
  prefix : String,
  code : String,
  message : String,
  severity : Severity,
) -> Finding? {
  match get_directive(policy, directive_name) {
    None => None
    Some(directive) => {
      for source in directive.sources {
        if starts_with(source.raw, prefix) {
          return Some(
            make_finding(
              severity,
              code,
              directive_name,
              message,
              directive.line,
            ),
          )
        }
      }
      None
    }
  }
}

///|
fn catalog_expected(
  policy : Policy,
  directive_name : String,
  source_value : String,
  code : String,
  message : String,
  severity : Severity,
) -> Finding? {
  match get_directive(policy, directive_name) {
    None => None
    Some(directive) =>
      if directive_has_source(directive, source_value) {
        None
      } else {
        Some(
          make_finding(severity, code, directive_name, message, directive.line),
        )
      }
  }
}

///|
fn catalog_push(findings : Array[Finding], result : Finding?) -> Unit {
  match result {
    Some(finding) => findings.push(finding)
    None => ()
  }
}

///|
pub fn catalog_missing_default_src(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "default-src",
    "missing-default-src",
    "default-src should bound fallback fetches",
    Warning,
  )
}

///|
pub fn catalog_missing_script_src(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "script-src",
    "missing-script-src",
    "script-src should explicitly control executable JavaScript",
    Warning,
  )
}

///|
pub fn catalog_missing_style_src(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "style-src",
    "missing-style-src",
    "style-src should explicitly control stylesheets",
    Info,
  )
}

///|
pub fn catalog_missing_img_src(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "img-src",
    "missing-img-src",
    "img-src should make image loading intent explicit",
    Info,
  )
}

///|
pub fn catalog_missing_font_src(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "font-src",
    "missing-font-src",
    "font-src should limit font origins",
    Info,
  )
}

///|
pub fn catalog_missing_connect_src(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "connect-src",
    "missing-connect-src",
    "connect-src should constrain APIs, beacons and websockets",
    Warning,
  )
}

///|
pub fn catalog_missing_frame_src(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "frame-src",
    "missing-frame-src",
    "frame-src should control embedded browsing contexts",
    Info,
  )
}

///|
pub fn catalog_missing_frame_ancestors(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "frame-ancestors",
    "missing-frame-ancestors",
    "frame-ancestors should control who may embed the page",
    Warning,
  )
}

///|
pub fn catalog_missing_object_src(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "object-src",
    "missing-object-src",
    "object-src 'none' is recommended",
    Warning,
  )
}

///|
pub fn catalog_missing_base_uri(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "base-uri",
    "missing-base-uri",
    "base-uri should prevent injected base tags",
    Warning,
  )
}

///|
pub fn catalog_missing_form_action(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "form-action",
    "missing-form-action",
    "form-action should restrict form submission targets",
    Info,
  )
}

///|
pub fn catalog_missing_worker_src(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "worker-src",
    "missing-worker-src",
    "worker-src should constrain worker script origins",
    Info,
  )
}

///|
pub fn catalog_missing_manifest_src(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "manifest-src",
    "missing-manifest-src",
    "manifest-src should constrain web app manifests",
    Info,
  )
}

///|
pub fn catalog_missing_media_src(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "media-src",
    "missing-media-src",
    "media-src should make media loading intent explicit",
    Info,
  )
}

///|
pub fn catalog_missing_child_src(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "child-src",
    "missing-child-src",
    "child-src can document legacy frame and worker fallback",
    Info,
  )
}

///|
pub fn catalog_missing_navigate_to(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "navigate-to",
    "missing-navigate-to",
    "navigate-to can restrict top-level navigation",
    Info,
  )
}

///|
pub fn catalog_missing_prefetch_src(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "prefetch-src",
    "missing-prefetch-src",
    "prefetch-src can restrict speculative fetches",
    Info,
  )
}

///|
pub fn catalog_missing_report_to(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "report-to",
    "missing-report-to",
    "report-to should be configured before enforcing risky migrations",
    Info,
  )
}

///|
pub fn catalog_missing_report_uri(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "report-uri",
    "missing-report-uri",
    "report-uri is useful for older CSP report collectors",
    Info,
  )
}

///|
pub fn catalog_missing_upgrade_insecure_requests(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "upgrade-insecure-requests",
    "missing-upgrade-insecure-requests",
    "upgrade-insecure-requests helps migrate legacy http subresources",
    Info,
  )
}

///|
pub fn catalog_missing_trusted_types(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "trusted-types",
    "missing-trusted-types",
    "trusted-types can reduce DOM XSS sinks in supported browsers",
    Info,
  )
}

///|
pub fn catalog_missing_require_trusted_types_for(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "require-trusted-types-for",
    "missing-require-trusted-types-for",
    "require-trusted-types-for can enforce Trusted Types for script",
    Info,
  )
}

///|
pub fn catalog_missing_sandbox(policy : Policy) -> Finding? {
  catalog_missing(
    policy,
    "sandbox",
    "missing-sandbox",
    "sandbox is useful for pages rendering untrusted content",
    Info,
  )
}

///|
pub fn catalog_source_default_src_wildcard(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "default-src",
    "*",
    "default_src-wildcard",
    "wildcard source broadens the trust boundary",
    Warning,
  )
}

///|
pub fn catalog_source_default_src_self(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "default-src",
    "'self'",
    "default_src-self",
    "self source is present; ensure the origin has no user-controlled upload execution path",
    Info,
  )
}

///|
pub fn catalog_source_default_src_unsafe_inline(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "default-src",
    "'unsafe-inline'",
    "default_src-unsafe_inline",
    "unsafe-inline should be replaced with nonce or hash based policy",
    Warning,
  )
}

///|
pub fn catalog_source_default_src_unsafe_eval(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "default-src",
    "'unsafe-eval'",
    "default_src-unsafe_eval",
    "unsafe-eval enables string-to-code execution",
    Warning,
  )
}

///|
pub fn catalog_source_default_src_strict_dynamic(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "default-src",
    "'strict-dynamic'",
    "default_src-strict_dynamic",
    "strict-dynamic changes host allow-list semantics and should be documented",
    Info,
  )
}

///|
pub fn catalog_source_default_src_data(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "default-src",
    "data:",
    "default_src-data",
    "data: allows inline data payloads and should be scoped carefully",
    Warning,
  )
}

///|
pub fn catalog_source_default_src_blob(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "default-src",
    "blob:",
    "default_src-blob",
    "blob: can expand script or worker execution paths",
    Warning,
  )
}

///|
pub fn catalog_source_default_src_filesystem(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "default-src",
    "filesystem:",
    "default_src-filesystem",
    "filesystem: is legacy and rarely needed",
    Warning,
  )
}

///|
pub fn catalog_source_default_src_http(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "default-src",
    "http:",
    "default_src-http",
    "plain http source should be upgraded to https",
    Warning,
  )
}

///|
pub fn catalog_source_default_src_https(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "default-src",
    "https:",
    "default_src-https",
    "scheme-wide https allows every https origin",
    Info,
  )
}

///|
pub fn catalog_source_default_src_ws(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "default-src",
    "ws:",
    "default_src-ws",
    "plain websocket source should usually be wss:",
    Warning,
  )
}

///|
pub fn catalog_source_default_src_wss(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "default-src",
    "wss:",
    "default_src-wss",
    "scheme-wide wss allows every secure websocket origin",
    Info,
  )
}

///|
pub fn catalog_source_script_src_wildcard(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "script-src",
    "*",
    "script_src-wildcard",
    "wildcard source broadens the trust boundary",
    Warning,
  )
}

///|
pub fn catalog_source_script_src_self(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "script-src",
    "'self'",
    "script_src-self",
    "self source is present; ensure the origin has no user-controlled upload execution path",
    Info,
  )
}

///|
pub fn catalog_source_script_src_unsafe_inline(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "script-src",
    "'unsafe-inline'",
    "script_src-unsafe_inline",
    "unsafe-inline should be replaced with nonce or hash based policy",
    Warning,
  )
}

///|
pub fn catalog_source_script_src_unsafe_eval(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "script-src",
    "'unsafe-eval'",
    "script_src-unsafe_eval",
    "unsafe-eval enables string-to-code execution",
    Warning,
  )
}

///|
pub fn catalog_source_script_src_strict_dynamic(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "script-src",
    "'strict-dynamic'",
    "script_src-strict_dynamic",
    "strict-dynamic changes host allow-list semantics and should be documented",
    Info,
  )
}

///|
pub fn catalog_source_script_src_data(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "script-src",
    "data:",
    "script_src-data",
    "data: allows inline data payloads and should be scoped carefully",
    Warning,
  )
}

///|
pub fn catalog_source_script_src_blob(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "script-src",
    "blob:",
    "script_src-blob",
    "blob: can expand script or worker execution paths",
    Warning,
  )
}

///|
pub fn catalog_source_script_src_filesystem(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "script-src",
    "filesystem:",
    "script_src-filesystem",
    "filesystem: is legacy and rarely needed",
    Warning,
  )
}

///|
pub fn catalog_source_script_src_http(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "script-src",
    "http:",
    "script_src-http",
    "plain http source should be upgraded to https",
    Warning,
  )
}

///|
pub fn catalog_source_script_src_https(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "script-src",
    "https:",
    "script_src-https",
    "scheme-wide https allows every https origin",
    Info,
  )
}

///|
pub fn catalog_source_script_src_ws(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "script-src",
    "ws:",
    "script_src-ws",
    "plain websocket source should usually be wss:",
    Warning,
  )
}

///|
pub fn catalog_source_script_src_wss(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "script-src",
    "wss:",
    "script_src-wss",
    "scheme-wide wss allows every secure websocket origin",
    Info,
  )
}

///|
pub fn catalog_source_style_src_wildcard(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "style-src",
    "*",
    "style_src-wildcard",
    "wildcard source broadens the trust boundary",
    Warning,
  )
}

///|
pub fn catalog_source_style_src_self(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "style-src",
    "'self'",
    "style_src-self",
    "self source is present; ensure the origin has no user-controlled upload execution path",
    Info,
  )
}

///|
pub fn catalog_source_style_src_unsafe_inline(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "style-src",
    "'unsafe-inline'",
    "style_src-unsafe_inline",
    "unsafe-inline should be replaced with nonce or hash based policy",
    Warning,
  )
}

///|
pub fn catalog_source_style_src_unsafe_eval(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "style-src",
    "'unsafe-eval'",
    "style_src-unsafe_eval",
    "unsafe-eval enables string-to-code execution",
    Warning,
  )
}

///|
pub fn catalog_source_style_src_strict_dynamic(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "style-src",
    "'strict-dynamic'",
    "style_src-strict_dynamic",
    "strict-dynamic changes host allow-list semantics and should be documented",
    Info,
  )
}

///|
pub fn catalog_source_style_src_data(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "style-src",
    "data:",
    "style_src-data",
    "data: allows inline data payloads and should be scoped carefully",
    Warning,
  )
}

///|
pub fn catalog_source_style_src_blob(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "style-src",
    "blob:",
    "style_src-blob",
    "blob: can expand script or worker execution paths",
    Warning,
  )
}

///|
pub fn catalog_source_style_src_filesystem(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "style-src",
    "filesystem:",
    "style_src-filesystem",
    "filesystem: is legacy and rarely needed",
    Warning,
  )
}

///|
pub fn catalog_source_style_src_http(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "style-src",
    "http:",
    "style_src-http",
    "plain http source should be upgraded to https",
    Warning,
  )
}

///|
pub fn catalog_source_style_src_https(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "style-src",
    "https:",
    "style_src-https",
    "scheme-wide https allows every https origin",
    Info,
  )
}

///|
pub fn catalog_source_style_src_ws(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "style-src",
    "ws:",
    "style_src-ws",
    "plain websocket source should usually be wss:",
    Warning,
  )
}

///|
pub fn catalog_source_style_src_wss(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "style-src",
    "wss:",
    "style_src-wss",
    "scheme-wide wss allows every secure websocket origin",
    Info,
  )
}

///|
pub fn catalog_source_img_src_wildcard(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "img-src",
    "*",
    "img_src-wildcard",
    "wildcard source broadens the trust boundary",
    Warning,
  )
}

///|
pub fn catalog_source_img_src_self(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "img-src",
    "'self'",
    "img_src-self",
    "self source is present; ensure the origin has no user-controlled upload execution path",
    Info,
  )
}

///|
pub fn catalog_source_img_src_unsafe_inline(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "img-src",
    "'unsafe-inline'",
    "img_src-unsafe_inline",
    "unsafe-inline should be replaced with nonce or hash based policy",
    Warning,
  )
}

///|
pub fn catalog_source_img_src_unsafe_eval(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "img-src",
    "'unsafe-eval'",
    "img_src-unsafe_eval",
    "unsafe-eval enables string-to-code execution",
    Warning,
  )
}

///|
pub fn catalog_source_img_src_strict_dynamic(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "img-src",
    "'strict-dynamic'",
    "img_src-strict_dynamic",
    "strict-dynamic changes host allow-list semantics and should be documented",
    Info,
  )
}

///|
pub fn catalog_source_img_src_data(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "img-src",
    "data:",
    "img_src-data",
    "data: allows inline data payloads and should be scoped carefully",
    Warning,
  )
}

///|
pub fn catalog_source_img_src_blob(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "img-src",
    "blob:",
    "img_src-blob",
    "blob: can expand script or worker execution paths",
    Warning,
  )
}

///|
pub fn catalog_source_img_src_filesystem(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "img-src",
    "filesystem:",
    "img_src-filesystem",
    "filesystem: is legacy and rarely needed",
    Warning,
  )
}

///|
pub fn catalog_source_img_src_http(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "img-src",
    "http:",
    "img_src-http",
    "plain http source should be upgraded to https",
    Warning,
  )
}

///|
pub fn catalog_source_img_src_https(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "img-src",
    "https:",
    "img_src-https",
    "scheme-wide https allows every https origin",
    Info,
  )
}

///|
pub fn catalog_source_img_src_ws(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "img-src",
    "ws:",
    "img_src-ws",
    "plain websocket source should usually be wss:",
    Warning,
  )
}

///|
pub fn catalog_source_img_src_wss(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "img-src",
    "wss:",
    "img_src-wss",
    "scheme-wide wss allows every secure websocket origin",
    Info,
  )
}

///|
pub fn catalog_source_font_src_wildcard(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "font-src",
    "*",
    "font_src-wildcard",
    "wildcard source broadens the trust boundary",
    Warning,
  )
}

///|
pub fn catalog_source_font_src_self(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "font-src",
    "'self'",
    "font_src-self",
    "self source is present; ensure the origin has no user-controlled upload execution path",
    Info,
  )
}

///|
pub fn catalog_source_font_src_unsafe_inline(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "font-src",
    "'unsafe-inline'",
    "font_src-unsafe_inline",
    "unsafe-inline should be replaced with nonce or hash based policy",
    Warning,
  )
}

///|
pub fn catalog_source_font_src_unsafe_eval(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "font-src",
    "'unsafe-eval'",
    "font_src-unsafe_eval",
    "unsafe-eval enables string-to-code execution",
    Warning,
  )
}

///|
pub fn catalog_source_font_src_strict_dynamic(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "font-src",
    "'strict-dynamic'",
    "font_src-strict_dynamic",
    "strict-dynamic changes host allow-list semantics and should be documented",
    Info,
  )
}

///|
pub fn catalog_source_font_src_data(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "font-src",
    "data:",
    "font_src-data",
    "data: allows inline data payloads and should be scoped carefully",
    Warning,
  )
}

///|
pub fn catalog_source_font_src_blob(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "font-src",
    "blob:",
    "font_src-blob",
    "blob: can expand script or worker execution paths",
    Warning,
  )
}

///|
pub fn catalog_source_font_src_filesystem(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "font-src",
    "filesystem:",
    "font_src-filesystem",
    "filesystem: is legacy and rarely needed",
    Warning,
  )
}

///|
pub fn catalog_source_font_src_http(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "font-src",
    "http:",
    "font_src-http",
    "plain http source should be upgraded to https",
    Warning,
  )
}

///|
pub fn catalog_source_font_src_https(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "font-src",
    "https:",
    "font_src-https",
    "scheme-wide https allows every https origin",
    Info,
  )
}

///|
pub fn catalog_source_font_src_ws(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "font-src",
    "ws:",
    "font_src-ws",
    "plain websocket source should usually be wss:",
    Warning,
  )
}

///|
pub fn catalog_source_font_src_wss(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "font-src",
    "wss:",
    "font_src-wss",
    "scheme-wide wss allows every secure websocket origin",
    Info,
  )
}

///|
pub fn catalog_source_connect_src_wildcard(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "connect-src",
    "*",
    "connect_src-wildcard",
    "wildcard source broadens the trust boundary",
    Warning,
  )
}

///|
pub fn catalog_source_connect_src_self(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "connect-src",
    "'self'",
    "connect_src-self",
    "self source is present; ensure the origin has no user-controlled upload execution path",
    Info,
  )
}

///|
pub fn catalog_source_connect_src_unsafe_inline(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "connect-src",
    "'unsafe-inline'",
    "connect_src-unsafe_inline",
    "unsafe-inline should be replaced with nonce or hash based policy",
    Warning,
  )
}

///|
pub fn catalog_source_connect_src_unsafe_eval(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "connect-src",
    "'unsafe-eval'",
    "connect_src-unsafe_eval",
    "unsafe-eval enables string-to-code execution",
    Warning,
  )
}

///|
pub fn catalog_source_connect_src_strict_dynamic(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "connect-src",
    "'strict-dynamic'",
    "connect_src-strict_dynamic",
    "strict-dynamic changes host allow-list semantics and should be documented",
    Info,
  )
}

///|
pub fn catalog_source_connect_src_data(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "connect-src",
    "data:",
    "connect_src-data",
    "data: allows inline data payloads and should be scoped carefully",
    Warning,
  )
}

///|
pub fn catalog_source_connect_src_blob(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "connect-src",
    "blob:",
    "connect_src-blob",
    "blob: can expand script or worker execution paths",
    Warning,
  )
}

///|
pub fn catalog_source_connect_src_filesystem(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "connect-src",
    "filesystem:",
    "connect_src-filesystem",
    "filesystem: is legacy and rarely needed",
    Warning,
  )
}

///|
pub fn catalog_source_connect_src_http(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "connect-src",
    "http:",
    "connect_src-http",
    "plain http source should be upgraded to https",
    Warning,
  )
}

///|
pub fn catalog_source_connect_src_https(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "connect-src",
    "https:",
    "connect_src-https",
    "scheme-wide https allows every https origin",
    Info,
  )
}

///|
pub fn catalog_source_connect_src_ws(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "connect-src",
    "ws:",
    "connect_src-ws",
    "plain websocket source should usually be wss:",
    Warning,
  )
}

///|
pub fn catalog_source_connect_src_wss(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "connect-src",
    "wss:",
    "connect_src-wss",
    "scheme-wide wss allows every secure websocket origin",
    Info,
  )
}

///|
pub fn catalog_source_frame_src_wildcard(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "frame-src",
    "*",
    "frame_src-wildcard",
    "wildcard source broadens the trust boundary",
    Warning,
  )
}

///|
pub fn catalog_source_frame_src_self(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "frame-src",
    "'self'",
    "frame_src-self",
    "self source is present; ensure the origin has no user-controlled upload execution path",
    Info,
  )
}

///|
pub fn catalog_source_frame_src_unsafe_inline(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "frame-src",
    "'unsafe-inline'",
    "frame_src-unsafe_inline",
    "unsafe-inline should be replaced with nonce or hash based policy",
    Warning,
  )
}

///|
pub fn catalog_source_frame_src_unsafe_eval(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "frame-src",
    "'unsafe-eval'",
    "frame_src-unsafe_eval",
    "unsafe-eval enables string-to-code execution",
    Warning,
  )
}

///|
pub fn catalog_source_frame_src_strict_dynamic(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "frame-src",
    "'strict-dynamic'",
    "frame_src-strict_dynamic",
    "strict-dynamic changes host allow-list semantics and should be documented",
    Info,
  )
}

///|
pub fn catalog_source_frame_src_data(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "frame-src",
    "data:",
    "frame_src-data",
    "data: allows inline data payloads and should be scoped carefully",
    Warning,
  )
}

///|
pub fn catalog_source_frame_src_blob(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "frame-src",
    "blob:",
    "frame_src-blob",
    "blob: can expand script or worker execution paths",
    Warning,
  )
}

///|
pub fn catalog_source_frame_src_filesystem(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "frame-src",
    "filesystem:",
    "frame_src-filesystem",
    "filesystem: is legacy and rarely needed",
    Warning,
  )
}

///|
pub fn catalog_source_frame_src_http(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "frame-src",
    "http:",
    "frame_src-http",
    "plain http source should be upgraded to https",
    Warning,
  )
}

///|
pub fn catalog_source_frame_src_https(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "frame-src",
    "https:",
    "frame_src-https",
    "scheme-wide https allows every https origin",
    Info,
  )
}

///|
pub fn catalog_source_frame_src_ws(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "frame-src",
    "ws:",
    "frame_src-ws",
    "plain websocket source should usually be wss:",
    Warning,
  )
}

///|
pub fn catalog_source_frame_src_wss(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "frame-src",
    "wss:",
    "frame_src-wss",
    "scheme-wide wss allows every secure websocket origin",
    Info,
  )
}

///|
pub fn catalog_source_worker_src_wildcard(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "worker-src",
    "*",
    "worker_src-wildcard",
    "wildcard source broadens the trust boundary",
    Warning,
  )
}

///|
pub fn catalog_source_worker_src_self(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "worker-src",
    "'self'",
    "worker_src-self",
    "self source is present; ensure the origin has no user-controlled upload execution path",
    Info,
  )
}

///|
pub fn catalog_source_worker_src_unsafe_inline(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "worker-src",
    "'unsafe-inline'",
    "worker_src-unsafe_inline",
    "unsafe-inline should be replaced with nonce or hash based policy",
    Warning,
  )
}

///|
pub fn catalog_source_worker_src_unsafe_eval(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "worker-src",
    "'unsafe-eval'",
    "worker_src-unsafe_eval",
    "unsafe-eval enables string-to-code execution",
    Warning,
  )
}

///|
pub fn catalog_source_worker_src_strict_dynamic(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "worker-src",
    "'strict-dynamic'",
    "worker_src-strict_dynamic",
    "strict-dynamic changes host allow-list semantics and should be documented",
    Info,
  )
}

///|
pub fn catalog_source_worker_src_data(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "worker-src",
    "data:",
    "worker_src-data",
    "data: allows inline data payloads and should be scoped carefully",
    Warning,
  )
}

///|
pub fn catalog_source_worker_src_blob(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "worker-src",
    "blob:",
    "worker_src-blob",
    "blob: can expand script or worker execution paths",
    Warning,
  )
}

///|
pub fn catalog_source_worker_src_filesystem(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "worker-src",
    "filesystem:",
    "worker_src-filesystem",
    "filesystem: is legacy and rarely needed",
    Warning,
  )
}

///|
pub fn catalog_source_worker_src_http(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "worker-src",
    "http:",
    "worker_src-http",
    "plain http source should be upgraded to https",
    Warning,
  )
}

///|
pub fn catalog_source_worker_src_https(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "worker-src",
    "https:",
    "worker_src-https",
    "scheme-wide https allows every https origin",
    Info,
  )
}

///|
pub fn catalog_source_worker_src_ws(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "worker-src",
    "ws:",
    "worker_src-ws",
    "plain websocket source should usually be wss:",
    Warning,
  )
}

///|
pub fn catalog_source_worker_src_wss(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "worker-src",
    "wss:",
    "worker_src-wss",
    "scheme-wide wss allows every secure websocket origin",
    Info,
  )
}

///|
pub fn catalog_source_media_src_wildcard(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "media-src",
    "*",
    "media_src-wildcard",
    "wildcard source broadens the trust boundary",
    Warning,
  )
}

///|
pub fn catalog_source_media_src_self(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "media-src",
    "'self'",
    "media_src-self",
    "self source is present; ensure the origin has no user-controlled upload execution path",
    Info,
  )
}

///|
pub fn catalog_source_media_src_unsafe_inline(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "media-src",
    "'unsafe-inline'",
    "media_src-unsafe_inline",
    "unsafe-inline should be replaced with nonce or hash based policy",
    Warning,
  )
}

///|
pub fn catalog_source_media_src_unsafe_eval(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "media-src",
    "'unsafe-eval'",
    "media_src-unsafe_eval",
    "unsafe-eval enables string-to-code execution",
    Warning,
  )
}

///|
pub fn catalog_source_media_src_strict_dynamic(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "media-src",
    "'strict-dynamic'",
    "media_src-strict_dynamic",
    "strict-dynamic changes host allow-list semantics and should be documented",
    Info,
  )
}

///|
pub fn catalog_source_media_src_data(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "media-src",
    "data:",
    "media_src-data",
    "data: allows inline data payloads and should be scoped carefully",
    Warning,
  )
}

///|
pub fn catalog_source_media_src_blob(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "media-src",
    "blob:",
    "media_src-blob",
    "blob: can expand script or worker execution paths",
    Warning,
  )
}

///|
pub fn catalog_source_media_src_filesystem(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "media-src",
    "filesystem:",
    "media_src-filesystem",
    "filesystem: is legacy and rarely needed",
    Warning,
  )
}

///|
pub fn catalog_source_media_src_http(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "media-src",
    "http:",
    "media_src-http",
    "plain http source should be upgraded to https",
    Warning,
  )
}

///|
pub fn catalog_source_media_src_https(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "media-src",
    "https:",
    "media_src-https",
    "scheme-wide https allows every https origin",
    Info,
  )
}

///|
pub fn catalog_source_media_src_ws(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "media-src",
    "ws:",
    "media_src-ws",
    "plain websocket source should usually be wss:",
    Warning,
  )
}

///|
pub fn catalog_source_media_src_wss(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "media-src",
    "wss:",
    "media_src-wss",
    "scheme-wide wss allows every secure websocket origin",
    Info,
  )
}

///|
pub fn catalog_source_manifest_src_wildcard(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "manifest-src",
    "*",
    "manifest_src-wildcard",
    "wildcard source broadens the trust boundary",
    Warning,
  )
}

///|
pub fn catalog_source_manifest_src_self(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "manifest-src",
    "'self'",
    "manifest_src-self",
    "self source is present; ensure the origin has no user-controlled upload execution path",
    Info,
  )
}

///|
pub fn catalog_source_manifest_src_unsafe_inline(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "manifest-src",
    "'unsafe-inline'",
    "manifest_src-unsafe_inline",
    "unsafe-inline should be replaced with nonce or hash based policy",
    Warning,
  )
}

///|
pub fn catalog_source_manifest_src_unsafe_eval(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "manifest-src",
    "'unsafe-eval'",
    "manifest_src-unsafe_eval",
    "unsafe-eval enables string-to-code execution",
    Warning,
  )
}

///|
pub fn catalog_source_manifest_src_strict_dynamic(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "manifest-src",
    "'strict-dynamic'",
    "manifest_src-strict_dynamic",
    "strict-dynamic changes host allow-list semantics and should be documented",
    Info,
  )
}

///|
pub fn catalog_source_manifest_src_data(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "manifest-src",
    "data:",
    "manifest_src-data",
    "data: allows inline data payloads and should be scoped carefully",
    Warning,
  )
}

///|
pub fn catalog_source_manifest_src_blob(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "manifest-src",
    "blob:",
    "manifest_src-blob",
    "blob: can expand script or worker execution paths",
    Warning,
  )
}

///|
pub fn catalog_source_manifest_src_filesystem(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "manifest-src",
    "filesystem:",
    "manifest_src-filesystem",
    "filesystem: is legacy and rarely needed",
    Warning,
  )
}

///|
pub fn catalog_source_manifest_src_http(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "manifest-src",
    "http:",
    "manifest_src-http",
    "plain http source should be upgraded to https",
    Warning,
  )
}

///|
pub fn catalog_source_manifest_src_https(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "manifest-src",
    "https:",
    "manifest_src-https",
    "scheme-wide https allows every https origin",
    Info,
  )
}

///|
pub fn catalog_source_manifest_src_ws(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "manifest-src",
    "ws:",
    "manifest_src-ws",
    "plain websocket source should usually be wss:",
    Warning,
  )
}

///|
pub fn catalog_source_manifest_src_wss(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "manifest-src",
    "wss:",
    "manifest_src-wss",
    "scheme-wide wss allows every secure websocket origin",
    Info,
  )
}

///|
pub fn catalog_source_child_src_wildcard(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "child-src",
    "*",
    "child_src-wildcard",
    "wildcard source broadens the trust boundary",
    Warning,
  )
}

///|
pub fn catalog_source_child_src_self(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "child-src",
    "'self'",
    "child_src-self",
    "self source is present; ensure the origin has no user-controlled upload execution path",
    Info,
  )
}

///|
pub fn catalog_source_child_src_unsafe_inline(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "child-src",
    "'unsafe-inline'",
    "child_src-unsafe_inline",
    "unsafe-inline should be replaced with nonce or hash based policy",
    Warning,
  )
}

///|
pub fn catalog_source_child_src_unsafe_eval(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "child-src",
    "'unsafe-eval'",
    "child_src-unsafe_eval",
    "unsafe-eval enables string-to-code execution",
    Warning,
  )
}

///|
pub fn catalog_source_child_src_strict_dynamic(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "child-src",
    "'strict-dynamic'",
    "child_src-strict_dynamic",
    "strict-dynamic changes host allow-list semantics and should be documented",
    Info,
  )
}

///|
pub fn catalog_source_child_src_data(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "child-src",
    "data:",
    "child_src-data",
    "data: allows inline data payloads and should be scoped carefully",
    Warning,
  )
}

///|
pub fn catalog_source_child_src_blob(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "child-src",
    "blob:",
    "child_src-blob",
    "blob: can expand script or worker execution paths",
    Warning,
  )
}

///|
pub fn catalog_source_child_src_filesystem(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "child-src",
    "filesystem:",
    "child_src-filesystem",
    "filesystem: is legacy and rarely needed",
    Warning,
  )
}

///|
pub fn catalog_source_child_src_http(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "child-src",
    "http:",
    "child_src-http",
    "plain http source should be upgraded to https",
    Warning,
  )
}

///|
pub fn catalog_source_child_src_https(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "child-src",
    "https:",
    "child_src-https",
    "scheme-wide https allows every https origin",
    Info,
  )
}

///|
pub fn catalog_source_child_src_ws(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "child-src",
    "ws:",
    "child_src-ws",
    "plain websocket source should usually be wss:",
    Warning,
  )
}

///|
pub fn catalog_source_child_src_wss(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "child-src",
    "wss:",
    "child_src-wss",
    "scheme-wide wss allows every secure websocket origin",
    Info,
  )
}

///|
pub fn catalog_source_prefetch_src_wildcard(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "prefetch-src",
    "*",
    "prefetch_src-wildcard",
    "wildcard source broadens the trust boundary",
    Warning,
  )
}

///|
pub fn catalog_source_prefetch_src_self(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "prefetch-src",
    "'self'",
    "prefetch_src-self",
    "self source is present; ensure the origin has no user-controlled upload execution path",
    Info,
  )
}

///|
pub fn catalog_source_prefetch_src_unsafe_inline(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "prefetch-src",
    "'unsafe-inline'",
    "prefetch_src-unsafe_inline",
    "unsafe-inline should be replaced with nonce or hash based policy",
    Warning,
  )
}

///|
pub fn catalog_source_prefetch_src_unsafe_eval(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "prefetch-src",
    "'unsafe-eval'",
    "prefetch_src-unsafe_eval",
    "unsafe-eval enables string-to-code execution",
    Warning,
  )
}

///|
pub fn catalog_source_prefetch_src_strict_dynamic(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "prefetch-src",
    "'strict-dynamic'",
    "prefetch_src-strict_dynamic",
    "strict-dynamic changes host allow-list semantics and should be documented",
    Info,
  )
}

///|
pub fn catalog_source_prefetch_src_data(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "prefetch-src",
    "data:",
    "prefetch_src-data",
    "data: allows inline data payloads and should be scoped carefully",
    Warning,
  )
}

///|
pub fn catalog_source_prefetch_src_blob(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "prefetch-src",
    "blob:",
    "prefetch_src-blob",
    "blob: can expand script or worker execution paths",
    Warning,
  )
}

///|
pub fn catalog_source_prefetch_src_filesystem(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "prefetch-src",
    "filesystem:",
    "prefetch_src-filesystem",
    "filesystem: is legacy and rarely needed",
    Warning,
  )
}

///|
pub fn catalog_source_prefetch_src_http(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "prefetch-src",
    "http:",
    "prefetch_src-http",
    "plain http source should be upgraded to https",
    Warning,
  )
}

///|
pub fn catalog_source_prefetch_src_https(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "prefetch-src",
    "https:",
    "prefetch_src-https",
    "scheme-wide https allows every https origin",
    Info,
  )
}

///|
pub fn catalog_source_prefetch_src_ws(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "prefetch-src",
    "ws:",
    "prefetch_src-ws",
    "plain websocket source should usually be wss:",
    Warning,
  )
}

///|
pub fn catalog_source_prefetch_src_wss(policy : Policy) -> Finding? {
  catalog_source(
    policy,
    "prefetch-src",
    "wss:",
    "prefetch_src-wss",
    "scheme-wide wss allows every secure websocket origin",
    Info,
  )
}

///|
pub fn catalog_expect_object_src_none(policy : Policy) -> Finding? {
  catalog_expected(
    policy,
    "object-src",
    "'none'",
    "expected source missing for object-src",
    "object-src should usually be locked to 'none'",
    Warning,
  )
}

///|
pub fn catalog_expect_base_uri_self(policy : Policy) -> Finding? {
  catalog_expected(
    policy,
    "base-uri",
    "'self'",
    "expected source missing for base-uri",
    "base-uri should usually be limited to self",
    Warning,
  )
}

///|
pub fn catalog_expect_frame_ancestors_none_or_self(policy : Policy) -> Finding? {
  catalog_expected(
    policy,
    "frame-ancestors",
    "'self'",
    "expected source missing for frame-ancestors",
    "frame-ancestors should usually be self or none",
    Info,
  )
}

///|
pub fn catalog_expect_default_src_none_or_self(policy : Policy) -> Finding? {
  catalog_expected(
    policy,
    "default-src",
    "'self'",
    "expected source missing for default-src",
    "default-src should usually start from self or none",
    Info,
  )
}

///|
pub fn catalog_expect_form_action_self(policy : Policy) -> Finding? {
  catalog_expected(
    policy,
    "form-action",
    "'self'",
    "expected source missing for form-action",
    "form submissions should usually stay on the application origin",
    Info,
  )
}

///|
pub fn catalog_expect_script_src_nonce(policy : Policy) -> Finding? {
  catalog_source_prefix(
    policy,
    "script-src",
    "'nonce-",
    "expected source missing for script-src",
    "script-src can use nonces for inline migration",
    Info,
  )
}

///|
pub fn catalog_expect_style_src_nonce(policy : Policy) -> Finding? {
  catalog_source_prefix(
    policy,
    "style-src",
    "'nonce-",
    "expected source missing for style-src",
    "style-src can use nonces for inline migration",
    Info,
  )
}

///|
pub fn catalog_expect_require_trusted_types_script(policy : Policy) -> Finding? {
  catalog_expected(
    policy,
    "require-trusted-types-for",
    "'script'",
    "expected source missing for require-trusted-types-for",
    "require-trusted-types-for 'script' is the useful enforcement target",
    Info,
  )
}

///|
/// Run the expanded CSP audit catalog in addition to the compact default audit.
pub fn extended_audit(policy : Policy) -> Array[Finding] {
  let findings = audit(policy)
  catalog_push(findings, catalog_missing_default_src(policy))
  catalog_push(findings, catalog_missing_script_src(policy))
  catalog_push(findings, catalog_missing_style_src(policy))
  catalog_push(findings, catalog_missing_img_src(policy))
  catalog_push(findings, catalog_missing_font_src(policy))
  catalog_push(findings, catalog_missing_connect_src(policy))
  catalog_push(findings, catalog_missing_frame_src(policy))
  catalog_push(findings, catalog_missing_frame_ancestors(policy))
  catalog_push(findings, catalog_missing_object_src(policy))
  catalog_push(findings, catalog_missing_base_uri(policy))
  catalog_push(findings, catalog_missing_form_action(policy))
  catalog_push(findings, catalog_missing_worker_src(policy))
  catalog_push(findings, catalog_missing_manifest_src(policy))
  catalog_push(findings, catalog_missing_media_src(policy))
  catalog_push(findings, catalog_missing_child_src(policy))
  catalog_push(findings, catalog_missing_navigate_to(policy))
  catalog_push(findings, catalog_missing_prefetch_src(policy))
  catalog_push(findings, catalog_missing_report_to(policy))
  catalog_push(findings, catalog_missing_report_uri(policy))
  catalog_push(findings, catalog_missing_upgrade_insecure_requests(policy))
  catalog_push(findings, catalog_missing_trusted_types(policy))
  catalog_push(findings, catalog_missing_require_trusted_types_for(policy))
  catalog_push(findings, catalog_missing_sandbox(policy))
  catalog_push(findings, catalog_source_default_src_wildcard(policy))
  catalog_push(findings, catalog_source_default_src_self(policy))
  catalog_push(findings, catalog_source_default_src_unsafe_inline(policy))
  catalog_push(findings, catalog_source_default_src_unsafe_eval(policy))
  catalog_push(findings, catalog_source_default_src_strict_dynamic(policy))
  catalog_push(findings, catalog_source_default_src_data(policy))
  catalog_push(findings, catalog_source_default_src_blob(policy))
  catalog_push(findings, catalog_source_default_src_filesystem(policy))
  catalog_push(findings, catalog_source_default_src_http(policy))
  catalog_push(findings, catalog_source_default_src_https(policy))
  catalog_push(findings, catalog_source_default_src_ws(policy))
  catalog_push(findings, catalog_source_default_src_wss(policy))
  catalog_push(findings, catalog_source_script_src_wildcard(policy))
  catalog_push(findings, catalog_source_script_src_self(policy))
  catalog_push(findings, catalog_source_script_src_unsafe_inline(policy))
  catalog_push(findings, catalog_source_script_src_unsafe_eval(policy))
  catalog_push(findings, catalog_source_script_src_strict_dynamic(policy))
  catalog_push(findings, catalog_source_script_src_data(policy))
  catalog_push(findings, catalog_source_script_src_blob(policy))
  catalog_push(findings, catalog_source_script_src_filesystem(policy))
  catalog_push(findings, catalog_source_script_src_http(policy))
  catalog_push(findings, catalog_source_script_src_https(policy))
  catalog_push(findings, catalog_source_script_src_ws(policy))
  catalog_push(findings, catalog_source_script_src_wss(policy))
  catalog_push(findings, catalog_source_style_src_wildcard(policy))
  catalog_push(findings, catalog_source_style_src_self(policy))
  catalog_push(findings, catalog_source_style_src_unsafe_inline(policy))
  catalog_push(findings, catalog_source_style_src_unsafe_eval(policy))
  catalog_push(findings, catalog_source_style_src_strict_dynamic(policy))
  catalog_push(findings, catalog_source_style_src_data(policy))
  catalog_push(findings, catalog_source_style_src_blob(policy))
  catalog_push(findings, catalog_source_style_src_filesystem(policy))
  catalog_push(findings, catalog_source_style_src_http(policy))
  catalog_push(findings, catalog_source_style_src_https(policy))
  catalog_push(findings, catalog_source_style_src_ws(policy))
  catalog_push(findings, catalog_source_style_src_wss(policy))
  catalog_push(findings, catalog_source_img_src_wildcard(policy))
  catalog_push(findings, catalog_source_img_src_self(policy))
  catalog_push(findings, catalog_source_img_src_unsafe_inline(policy))
  catalog_push(findings, catalog_source_img_src_unsafe_eval(policy))
  catalog_push(findings, catalog_source_img_src_strict_dynamic(policy))
  catalog_push(findings, catalog_source_img_src_data(policy))
  catalog_push(findings, catalog_source_img_src_blob(policy))
  catalog_push(findings, catalog_source_img_src_filesystem(policy))
  catalog_push(findings, catalog_source_img_src_http(policy))
  catalog_push(findings, catalog_source_img_src_https(policy))
  catalog_push(findings, catalog_source_img_src_ws(policy))
  catalog_push(findings, catalog_source_img_src_wss(policy))
  catalog_push(findings, catalog_source_font_src_wildcard(policy))
  catalog_push(findings, catalog_source_font_src_self(policy))
  catalog_push(findings, catalog_source_font_src_unsafe_inline(policy))
  catalog_push(findings, catalog_source_font_src_unsafe_eval(policy))
  catalog_push(findings, catalog_source_font_src_strict_dynamic(policy))
  catalog_push(findings, catalog_source_font_src_data(policy))
  catalog_push(findings, catalog_source_font_src_blob(policy))
  catalog_push(findings, catalog_source_font_src_filesystem(policy))
  catalog_push(findings, catalog_source_font_src_http(policy))
  catalog_push(findings, catalog_source_font_src_https(policy))
  catalog_push(findings, catalog_source_font_src_ws(policy))
  catalog_push(findings, catalog_source_font_src_wss(policy))
  catalog_push(findings, catalog_source_connect_src_wildcard(policy))
  catalog_push(findings, catalog_source_connect_src_self(policy))
  catalog_push(findings, catalog_source_connect_src_unsafe_inline(policy))
  catalog_push(findings, catalog_source_connect_src_unsafe_eval(policy))
  catalog_push(findings, catalog_source_connect_src_strict_dynamic(policy))
  catalog_push(findings, catalog_source_connect_src_data(policy))
  catalog_push(findings, catalog_source_connect_src_blob(policy))
  catalog_push(findings, catalog_source_connect_src_filesystem(policy))
  catalog_push(findings, catalog_source_connect_src_http(policy))
  catalog_push(findings, catalog_source_connect_src_https(policy))
  catalog_push(findings, catalog_source_connect_src_ws(policy))
  catalog_push(findings, catalog_source_connect_src_wss(policy))
  catalog_push(findings, catalog_source_frame_src_wildcard(policy))
  catalog_push(findings, catalog_source_frame_src_self(policy))
  catalog_push(findings, catalog_source_frame_src_unsafe_inline(policy))
  catalog_push(findings, catalog_source_frame_src_unsafe_eval(policy))
  catalog_push(findings, catalog_source_frame_src_strict_dynamic(policy))
  catalog_push(findings, catalog_source_frame_src_data(policy))
  catalog_push(findings, catalog_source_frame_src_blob(policy))
  catalog_push(findings, catalog_source_frame_src_filesystem(policy))
  catalog_push(findings, catalog_source_frame_src_http(policy))
  catalog_push(findings, catalog_source_frame_src_https(policy))
  catalog_push(findings, catalog_source_frame_src_ws(policy))
  catalog_push(findings, catalog_source_frame_src_wss(policy))
  catalog_push(findings, catalog_source_worker_src_wildcard(policy))
  catalog_push(findings, catalog_source_worker_src_self(policy))
  catalog_push(findings, catalog_source_worker_src_unsafe_inline(policy))
  catalog_push(findings, catalog_source_worker_src_unsafe_eval(policy))
  catalog_push(findings, catalog_source_worker_src_strict_dynamic(policy))
  catalog_push(findings, catalog_source_worker_src_data(policy))
  catalog_push(findings, catalog_source_worker_src_blob(policy))
  catalog_push(findings, catalog_source_worker_src_filesystem(policy))
  catalog_push(findings, catalog_source_worker_src_http(policy))
  catalog_push(findings, catalog_source_worker_src_https(policy))
  catalog_push(findings, catalog_source_worker_src_ws(policy))
  catalog_push(findings, catalog_source_worker_src_wss(policy))
  catalog_push(findings, catalog_source_media_src_wildcard(policy))
  catalog_push(findings, catalog_source_media_src_self(policy))
  catalog_push(findings, catalog_source_media_src_unsafe_inline(policy))
  catalog_push(findings, catalog_source_media_src_unsafe_eval(policy))
  catalog_push(findings, catalog_source_media_src_strict_dynamic(policy))
  catalog_push(findings, catalog_source_media_src_data(policy))
  catalog_push(findings, catalog_source_media_src_blob(policy))
  catalog_push(findings, catalog_source_media_src_filesystem(policy))
  catalog_push(findings, catalog_source_media_src_http(policy))
  catalog_push(findings, catalog_source_media_src_https(policy))
  catalog_push(findings, catalog_source_media_src_ws(policy))
  catalog_push(findings, catalog_source_media_src_wss(policy))
  catalog_push(findings, catalog_source_manifest_src_wildcard(policy))
  catalog_push(findings, catalog_source_manifest_src_self(policy))
  catalog_push(findings, catalog_source_manifest_src_unsafe_inline(policy))
  catalog_push(findings, catalog_source_manifest_src_unsafe_eval(policy))
  catalog_push(findings, catalog_source_manifest_src_strict_dynamic(policy))
  catalog_push(findings, catalog_source_manifest_src_data(policy))
  catalog_push(findings, catalog_source_manifest_src_blob(policy))
  catalog_push(findings, catalog_source_manifest_src_filesystem(policy))
  catalog_push(findings, catalog_source_manifest_src_http(policy))
  catalog_push(findings, catalog_source_manifest_src_https(policy))
  catalog_push(findings, catalog_source_manifest_src_ws(policy))
  catalog_push(findings, catalog_source_manifest_src_wss(policy))
  catalog_push(findings, catalog_source_child_src_wildcard(policy))
  catalog_push(findings, catalog_source_child_src_self(policy))
  catalog_push(findings, catalog_source_child_src_unsafe_inline(policy))
  catalog_push(findings, catalog_source_child_src_unsafe_eval(policy))
  catalog_push(findings, catalog_source_child_src_strict_dynamic(policy))
  catalog_push(findings, catalog_source_child_src_data(policy))
  catalog_push(findings, catalog_source_child_src_blob(policy))
  catalog_push(findings, catalog_source_child_src_filesystem(policy))
  catalog_push(findings, catalog_source_child_src_http(policy))
  catalog_push(findings, catalog_source_child_src_https(policy))
  catalog_push(findings, catalog_source_child_src_ws(policy))
  catalog_push(findings, catalog_source_child_src_wss(policy))
  catalog_push(findings, catalog_source_prefetch_src_wildcard(policy))
  catalog_push(findings, catalog_source_prefetch_src_self(policy))
  catalog_push(findings, catalog_source_prefetch_src_unsafe_inline(policy))
  catalog_push(findings, catalog_source_prefetch_src_unsafe_eval(policy))
  catalog_push(findings, catalog_source_prefetch_src_strict_dynamic(policy))
  catalog_push(findings, catalog_source_prefetch_src_data(policy))
  catalog_push(findings, catalog_source_prefetch_src_blob(policy))
  catalog_push(findings, catalog_source_prefetch_src_filesystem(policy))
  catalog_push(findings, catalog_source_prefetch_src_http(policy))
  catalog_push(findings, catalog_source_prefetch_src_https(policy))
  catalog_push(findings, catalog_source_prefetch_src_ws(policy))
  catalog_push(findings, catalog_source_prefetch_src_wss(policy))
  catalog_push(findings, catalog_expect_object_src_none(policy))
  catalog_push(findings, catalog_expect_base_uri_self(policy))
  catalog_push(findings, catalog_expect_frame_ancestors_none_or_self(policy))
  catalog_push(findings, catalog_expect_default_src_none_or_self(policy))
  catalog_push(findings, catalog_expect_form_action_self(policy))
  catalog_push(findings, catalog_expect_script_src_nonce(policy))
  catalog_push(findings, catalog_expect_style_src_nonce(policy))
  catalog_push(findings, catalog_expect_require_trusted_types_script(policy))
  findings
}

///|
/// Return the number of expanded catalog checks wired into extended_audit.
pub fn catalog_rule_count() -> Int {
  175
}