[whatwg/fetch] Add the "speculationrules" destination (PR #1952)

This destination is used when fetching speculation rule sets, whether via the
`Speculation-Rules` HTTP response header or an external
`<script type=speculationrules src>` element. It is governed by the
`speculation-rules-src` CSP directive.

---

Supersedes #1841 by @domenic, whose commit is included here unchanged and with
its authorship preserved. On top of it, this PR:

* fixes the illustrative destination table's `""` initiator `rowspan`, which was
  not grown when the new row was added, leaving the table a cell short
  (editorial);
* moves `"speculationrules"` out of the "no CSP directive" grouping and gives it
  the `speculation-rules-src` directive; and
* notes that the destination also covers external
  `<script type=speculationrules src>` elements, not just the header.

### Dependencies

This should land after:

* whatwg/html#11426 (merged) — defines the `Speculation-Rules` header.
* w3c/webappsec-csp#808 — defines `speculation-rules-src`, with fallback to
  `script-src-elem`, `script-src`, and `default-src`. Until this lands, the
  directive named in the table does not yet exist.
* whatwg/html#11697 — makes an external `<script type=speculationrules src>`
  actually fetch its rule set. Until this lands, the header is the only way to
  reach this destination.

Marked as a draft until those two are resolved.

<!--
Thank you for contributing to the Fetch Standard! Please describe the change you are making and complete the checklist below if your change is not editorial.

When you submit this PR, and each time you edit this comment (including checking a checkbox through the UI!), PR Preview will run and update it. As such make any edits in one go and only after PR Preview has run.

If you think your PR is ready to land, please double-check that the build is passing and the checklist is complete before pinging.
-->

- [x] At least two implementers are interested (and none opposed):
   * See https://github.com/whatwg/html/pull/11426
- [x] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at:
   * The header is covered by https://github.com/web-platform-tests/wpt/blob/c669bcf970fe50b56e0ee53de9c2097a012dafc7/speculation-rules/prefetch/resources/ruleset.py#L40-L43
   * CSP integration is covered alongside w3c/webappsec-csp#808
- [x] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed:
   * See https://github.com/whatwg/html/pull/11426
- [x] [MDN issue](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) is filed: https://github.com/mdn/content/issues/40289
- [x] The top of this comment includes a [clear commit message](https://github.com/whatwg/meta/blob/main/COMMITTING.md) to use.

(See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.)


<!--
    This comment and the below content is programmatically generated.
    You may add a comma-separated list of anchors you'd like a
    direct link to below (e.g. #idl-serializers, #idl-sequence):

    Don't remove this comment or modify anything below this line.
    If you don't want a preview generated for this pull request,
    just replace the whole of this comment's content by "no preview"
    and remove what's below.
-->
***
<a href="https://whatpr.org/fetch/1952.html" title="Last updated on Aug 20, 2026, 11:52 PM UTC (9d2f96e)">Preview</a> | <a href="https://whatpr.org/fetch/1952/4a2b67d...9d2f96e.html" title="Last updated on Aug 20, 2026, 11:52 PM UTC (9d2f96e)">Diff</a>
You can view, comment on, or merge this pull request online at:

  https://github.com/whatwg/fetch/pull/1952

-- Commit Summary --

  * Add the "speculationrules" destination
  * Editorial: fix the destination table's initiator rowspan
  * Give the "speculationrules" destination a CSP directive
  * Note external <script type=speculationrules> in the destination table

-- File Changes --

    M fetch.bs (11)

-- Patch Links --

https://github.com/whatwg/fetch/pull/1952.patch
https://github.com/whatwg/fetch/pull/1952.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1952
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/1952@github.com>