@brandlab-digital/conformance 2.1.0 → 3.0.0

package/dist/knip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"knip.js","sourceRoot":"","sources":["../src/knip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAiCH,MAAM,kBAAkB,GAAG;IACzB,kFAAkF;IAClF,4EAA4E;IAC5E,wBAAwB;IACxB,gFAAgF;IAChF,qBAAqB;CACtB,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAEjF,MAAM,UAAU,YAAY,CAAC,UAA+B,EAAE;IAC5D,MAAM,KAAK,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC;IACtC,MAAM,SAAS,GAAoC,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;IAC9E,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,+EAA+E;QAC/E,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACzC,0EAA0E;QAC1E,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACnD,MAAM,IAAI,SAAS,CAAC,wDAAwD,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,gEAAgE,CAAC,CAAC;QAClH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,iBAAiB,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtH,MAAM,MAAM,GAAuB;QACjC,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,4EAA4E;QAC5E,uBAAuB,EAAE,IAAI;QAC7B,SAAS;KACV,CAAC;IACF,yEAAyE;IACzE,iFAAiF;IACjF,qBAAqB;IACrB,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE;QACnB,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;QACzF,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClE,OAAO;YACL,GAAG,IAAI;YACP,oFAAoF;YACpF,+EAA+E;YAC/E,oFAAoF;YACpF,8DAA8D;YAC9D,OAAO,EAAE,CAAC,YAAY,UAAU,GAAG,CAAC;YACpC,mFAAmF;YACnF,6EAA6E;YAC7E,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,aAAa,GACjB,sGAAsG,CAAC;AAEzG;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,IAAI,iCAAiC,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,SAAS;QAC9E,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC","sourcesContent":["/**\n * The shared Knip preset for Brandlab Next.js projects:\n *\n *   // knip.ts\n *   import { brandlabKnip } from '@brandlab-digital/conformance/knip'\n *   export default brandlabKnip({ mdx: true })\n *\n * It keeps Knip's own Next.js, Playwright, Vitest and ESLint plugin entries\n * (overriding them would replace the maintained defaults) and adds only what\n * those plugins cannot see in a Brandlab project: production entries Next loads\n * outside the app graph, CSS-only dependencies and, when enabled, MDX articles.\n * Knip calls the returned function with its command-line mode.\n */\n\nexport type BrandlabKnipCompiler = (text: string, filename: string) => string;\n\n/** The subset of Knip's configuration the preset produces; it satisfies `KnipConfig`. */\nexport interface BrandlabKnipConfig {\n  entry: string[];\n  ignoreExportsUsedInFile: boolean;\n  compilers: Record<string, true | BrandlabKnipCompiler>;\n  project?: string[];\n  ignoreDependencies?: string[];\n}\n\n/** The parsed Knip arguments Knip passes to a function configuration. */\nexport interface BrandlabKnipMode {\n  production?: boolean;\n  strict?: boolean;\n}\n\n/** A Knip function configuration: Knip calls it with its parsed arguments. */\nexport type BrandlabKnipConfigFunction = (mode?: BrandlabKnipMode) => BrandlabKnipConfig;\n\nexport interface BrandlabKnipOptions {\n  /** The project renders long-form MDX articles from src/content/. */\n  mdx?: boolean;\n  /**\n   * Additional real entry files that no plugin can discover. Suffix a pattern\n   * with `!` when it is part of the production graph. Never list whole source\n   * directories to silence findings.\n   */\n  entry?: readonly string[];\n}\n\nconst PRODUCTION_ENTRIES = [\n  // Knip's production mode excludes next.config by design, so the redirect table it\n  // imports (the fixed 3.0 owner) would look unused although Next applies it.\n  'src/data/redirects.ts!',\n  // Read statically by brandlab-verify; it is part of the project, not dead code.\n  'brandlab.config.ts!',\n];\n\nconst SOURCE_EXTENSIONS = ['js', 'mjs', 'cjs', 'jsx', 'ts', 'tsx', 'mts', 'cts'];\n\nexport function brandlabKnip(options: BrandlabKnipOptions = {}): BrandlabKnipConfigFunction {\n  const entry = [...PRODUCTION_ENTRIES];\n  const compilers: BrandlabKnipConfig['compilers'] = { css: compileCssImports };\n  if (options.mdx) {\n    // Articles are loaded by slug through dynamic imports that Knip cannot follow.\n    entry.push('src/content/**/*.{md,mdx}!');\n    // Knip's MDX compiler exposes each article's imports to the module graph.\n    compilers.mdx = true;\n  }\n  for (const pattern of options.entry ?? []) {\n    if (typeof pattern !== 'string' || !pattern.trim()) {\n      throw new TypeError('brandlabKnip entry patterns must be non-empty strings.');\n    }\n    if (/^(?:src\\/?)?\\*\\*(?:\\/\\*)?!?$/.test(pattern.trim())) {\n      throw new Error(`brandlabKnip entry \"${pattern}\" marks all source as used; list the real entry files instead.`);\n    }\n    entry.push(pattern.trim());\n  }\n  const extensions = `{${[...SOURCE_EXTENSIONS, ...Object.keys(compilers), ...(options.mdx ? ['md'] : [])].join(',')}}`;\n  const config: BrandlabKnipConfig = {\n    entry: [...new Set(entry)],\n    // Exports that are also consumed inside their own module are not dead code.\n    ignoreExportsUsedInFile: true,\n    compilers,\n  };\n  // Otherwise no ignoreDependencies: optional peers of the shared packages\n  // (eslint-config-next for configs.next) already count as used, and anything else\n  // must stay visible.\n  return (mode = {}) => {\n    const copy = { ...config, entry: [...config.entry], compilers: { ...config.compilers } };\n    if (mode.production !== true && mode.strict !== true) return copy;\n    return {\n      ...copy,\n      // Knip's default project marks every file as production (**/*!), so production mode\n      // reported test tooling (vitest.setup.ts, tests/ helpers) as unused files. The\n      // application lives in src/; root production files are entries (brandlab.config.ts)\n      // or belong to a plugin (next.config.ts, mdx-components.tsx).\n      project: [`src/**/*.${extensions}!`],\n      // Knip's production mode never reads next.config (not even as an entry), where the\n      // MDX wrapper imports @next/mdx; the default graph still checks that import.\n      ...(options.mdx ? { ignoreDependencies: ['@next/mdx'] } : {}),\n    };\n  };\n}\n\nconst CSS_COMMENT = /\\/\\*[\\s\\S]*?\\*\\//g;\nconst CSS_DIRECTIVE =\n  /@(?:import|config|plugin|reference)\\s+(?:url\\(\\s*)?(?:\"([^\"]+)\"|'([^']+)'|([^'\"\\s;)]+))\\s*\\)?[^;]*;/g;\n\n/**\n * Expose CSS-only dependencies (`@import \"tailwindcss\"`, `@plugin`, `@config`,\n * `@reference`, local `@import`) to Knip as module imports. Remote URLs and\n * data URIs are not dependencies and are skipped.\n */\nexport function compileCssImports(text: string): string {\n  const imports: string[] = [];\n  for (const match of text.replace(CSS_COMMENT, '').matchAll(CSS_DIRECTIVE)) {\n    const specifier = match[1] ?? match[2] ?? match[3];\n    if (!specifier || /^(?:[a-z][a-z0-9+.-]*:|\\/\\/|#)/i.test(specifier)) continue;\n    imports.push(`import ${JSON.stringify(specifier)};`);\n  }\n  return imports.join('\\n');\n}\n"]}

package/dist/project.d.ts

@@ -1,7 +1,8 @@
 import { type PackedPreflight } from "./packed-preflight.js";
 import { type BrandlabContractVersions, type BrandlabReleaseManifest, type BrandlabRuntimeReleaseContract } from "./release-manifest.js";
 import { type BrandlabOperationalFinding, type BrandlabVerificationEvidence, type BrandlabVerificationResult } from "./verification-policy.js";
-export { BRANDLAB_VERIFICATION_CHECKS, BRANDLAB_VERIFICATION_FAMILIES, BRANDLAB_VERIFICATION_POLICY_VERSION, type BrandlabVerificationCheckId, type BrandlabVerificationCheckResult, type BrandlabVerificationEvidence, type BrandlabVerificationEvidenceKind, type BrandlabVerificationFamilyId, type BrandlabVerificationFamilyResult, type BrandlabVerificationResult, type BrandlabVerificationStatus, } from "./verification-policy.js";
+export { BRANDLAB_STATIC_RULES, matchesBrandlabStaticRule, type BrandlabStaticRule, } from "./rule-registry.js";
+export { BRANDLAB_VERIFICATION_CHECKS, BRANDLAB_VERIFICATION_FAMILIES, BRANDLAB_VERIFICATION_POLICY_VERSION, checkForRule, type BrandlabRuleEvaluation, type BrandlabVerificationCheckId, type BrandlabVerificationCheckResult, type BrandlabVerificationEvidence, type BrandlabVerificationEvidenceKind, type BrandlabVerificationFamilyId, type BrandlabVerificationFamilyResult, type BrandlabVerificationResult, type BrandlabVerificationStatus, } from "./verification-policy.js";
 export declare const BRANDLAB_CONFORMANCE_SCHEMA_VERSION = "brandlab.conformance.v2";
 export declare const BRANDLAB_CONFORMANCE_EVALUATOR_VERSION = "current-only-v2";
 export type BrandlabConformanceMode = "local" | "ci" | "preflight";
@@ -61,5 +62,7 @@ interface ProjectPackageJsonLike {
 export declare function evaluateBrandlabProject(options: EvaluateBrandlabProjectOptions): BrandlabConformanceResult;
 export declare function shouldFailBrandlabConformance(result: BrandlabConformanceResult): boolean;
 export declare function detectInstalledBrandlabRelease(packageJson: ProjectPackageJsonLike | null): string | null;
+/** Variable names documented in an env example file (`KEY=`, `export KEY=`); values are ignored. */
+export declare function parseEnvironmentKeys(text: string): Set<string>;
 export type { BrandlabContractVersions };
 //# sourceMappingURL=project.d.ts.map

package/dist/project.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAGA,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAKL,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EAIpC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAChC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,oCAAoC,EACpC,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,EACpC,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,EACrC,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,GAChC,MAAM,0BAA0B,CAAC;AAElC,eAAO,MAAM,mCAAmC,4BAA4B,CAAC;AAC7E,eAAO,MAAM,sCAAsC,oBAAoB,CAAC;AAWxE,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,IAAI,GAAG,WAAW,CAAC;AACnE,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,uBAAuB,CAAC;IAClC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,YAAY,EAAE,QAAQ,GAAG,aAAa,GAAG,SAAS,CAAC;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,yBAAyB;IACxC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,aAAa,EAAE,OAAO,mCAAmC,CAAC;IAC1D,gBAAgB,EAAE,OAAO,sCAAsC,CAAC;IAChE,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,yBAAyB,EAAE,MAAM,CAAC;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,mBAAmB,EAAE,0BAA0B,EAAE,CAAC;IAClD,YAAY,EAAE,0BAA0B,CAAC;IACzC,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B;IAC7C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,IAAI,CAAC,EAAE,uBAAuB,CAAC;IAC/B,OAAO,CAAC,EAAE,8BAA8B,CAAC;IACzC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,oBAAoB,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAChE;AAED,UAAU,sBAAsB;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AA0HD,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,8BAA8B,GACtC,yBAAyB,CA0F3B;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAExF;AAED,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,sBAAsB,GAAG,IAAI,GACzC,MAAM,GAAG,IAAI,CAUf;AAoqBD,YAAY,EAAE,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAGA,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAKL,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EAIpC,MAAM,uBAAuB,CAAC;AAe/B,OAAO,EAGL,KAAK,0BAA0B,EAE/B,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAChC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,oCAAoC,EACpC,YAAY,EACZ,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,EACpC,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,EACrC,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,GAChC,MAAM,0BAA0B,CAAC;AAElC,eAAO,MAAM,mCAAmC,4BAA4B,CAAC;AAC7E,eAAO,MAAM,sCAAsC,oBAAoB,CAAC;AASxE,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,IAAI,GAAG,WAAW,CAAC;AACnE,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,uBAAuB,CAAC;IAClC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,YAAY,EAAE,QAAQ,GAAG,aAAa,GAAG,SAAS,CAAC;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,yBAAyB;IACxC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,aAAa,EAAE,OAAO,mCAAmC,CAAC;IAC1D,gBAAgB,EAAE,OAAO,sCAAsC,CAAC;IAChE,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,yBAAyB,EAAE,MAAM,CAAC;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,mBAAmB,EAAE,0BAA0B,EAAE,CAAC;IAClD,YAAY,EAAE,0BAA0B,CAAC;IACzC,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B;IAC7C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,IAAI,CAAC,EAAE,uBAAuB,CAAC;IAC/B,OAAO,CAAC,EAAE,8BAA8B,CAAC;IACzC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,oBAAoB,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAChE;AAED,UAAU,sBAAsB;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AA2ID,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,8BAA8B,GACtC,yBAAyB,CAuG3B;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAExF;AAED,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,sBAAsB,GAAG,IAAI,GACzC,MAAM,GAAG,IAAI,CAUf;AAuVD,oGAAoG;AACpG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAY9D;AAiVD,YAAY,EAAE,wBAAwB,EAAE,CAAC"}

package/dist/project.js

@@ -1,10 +1,13 @@
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { join, relative, resolve } from "node:path";
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
 import { BRANDLAB_CURRENT_RUNTIME_RELEASE } from "./current-release.js";
 import { verifyPackedPreflight } from "./packed-preflight.js";
 import { BRANDLAB_SHARED_PACKAGE_NAMES, compareBrandlabSemver, digestBrandlabAuthority, isBrandlabSemver, projectBrandlabRuntimeReleaseContract, validateBrandlabReleaseManifest, validateBrandlabRuntimeReleaseContract, } from "./release-manifest.js";
+import { BRANDLAB_SOURCE_ROOT_DIRECTORIES, collectBrandlabSource, lineAt, readOptionalText, stripCommentsPreservingLayout, } from "./source-files.js";
+import { findContactContractRecipients, inspectStaticRules, recordEvaluation, staticFinding, } from "./static-rules.js";
 import { applyBrandlabVerificationPolicy, BRANDLAB_VERIFICATION_POLICY_VERSION, } from "./verification-policy.js";
-export { BRANDLAB_VERIFICATION_CHECKS, BRANDLAB_VERIFICATION_FAMILIES, BRANDLAB_VERIFICATION_POLICY_VERSION, } from "./verification-policy.js";
+export { BRANDLAB_STATIC_RULES, matchesBrandlabStaticRule, } from "./rule-registry.js";
+export { BRANDLAB_VERIFICATION_CHECKS, BRANDLAB_VERIFICATION_FAMILIES, BRANDLAB_VERIFICATION_POLICY_VERSION, checkForRule, } from "./verification-policy.js";
 export const BRANDLAB_CONFORMANCE_SCHEMA_VERSION = "brandlab.conformance.v2";
 export const BRANDLAB_CONFORMANCE_EVALUATOR_VERSION = "current-only-v2";
 const RUNTIME_PACKAGE_FIELDS = [
@@ -13,12 +16,11 @@ const RUNTIME_PACKAGE_FIELDS = [
     ["react-dom", "reactDom"],
     ["typescript", "typescript"],
 ];
-const SOURCE_EXTENSIONS = new Set([".js", ".jsx", ".mjs", ".ts", ".tsx"]);
 const SOURCE_RULES = [
     {
         ruleId: "brandlab-source-retired-analytics-event",
         surface: "analytics",
-        pattern: /\b(?:contact_form_submission|phone_call|phone_calls|form_start|cta_click)\b/,
+        pattern: /\b(?:contact_form_submission|phone_call|phone_calls|form_start|form_submit|generate_lead|cta_click)\b/,
         expected: "Only the current Brandlab analytics event contract is used.",
         remediation: "Use contact_form for accepted forms and phone_link_click for telephone-link diagnostics.",
     },
@@ -106,6 +108,22 @@ const SOURCE_RULES = [
         expected: "The simplified contact runtime has no project-level state-service requirement.",
         remediation: "Remove the retired contact state variables and use the shared stateless contact flow.",
     },
+    {
+        ruleId: "brandlab-analytics-retired-phone-api",
+        surface: "analytics",
+        pattern: /\btrackPhoneCall\b/,
+        expected: "Telephone taps are reported only as phone_link_click by the shared instrumentation.",
+        actual: "The retired trackPhoneCall API is still referenced.",
+        remediation: "Remove trackPhoneCall; installBrandlabInstrumentation reports one phone_link_click per tap.",
+    },
+    {
+        ruleId: "brandlab-analytics-web-vitals",
+        surface: "analytics",
+        pattern: /\b(?:useReportWebVitals|reportWebVitals|reportBrandlabWebVital|createBrandlabWebVitalsReporter|CoreWebVitalsReporter)\b|['"](?:next\/web-vitals|web-vitals|web_vital)['"]|\bwebVitals\s*:/,
+        expected: "No web-vitals reporter; speed evidence comes from Search Console.",
+        actual: "A web-vitals reporter, web_vital event or webVitals flag is still wired.",
+        remediation: "Remove the web-vitals reporter and the webVitals flag; web_vital events are not sent in 3.0.",
+    },
 ];
 export function evaluateBrandlabProject(options) {
     const root = resolve(options.root);
@@ -133,8 +151,11 @@ export function evaluateBrandlabProject(options) {
         ? options.releaseManifest
         : null;
     const findings = [];
+    const evaluations = [];
+    const source = collectBrandlabSource(root);
     inspectRelease({
         findings,
+        evaluations,
         packageJson,
         packageLock,
         installedRelease,
@@ -143,12 +164,20 @@ export function evaluateBrandlabProject(options) {
         attestation,
         packedPreflight,
     });
-    if (manifest?.runtime.nextVersionPolicy === "exact")
-        inspectImageRuntime(root, findings);
-    inspectProjectConfig(root, findings);
-    inspectProjectSource(root, findings);
+    if (manifest?.runtime.nextVersionPolicy === "exact") {
+        inspectImageRuntime(root, findings, evaluations);
+    }
+    inspectProjectConfig(root, source, findings, evaluations);
+    inspectProjectSource(source, findings, evaluations);
+    inspectStaticRules({
+        root,
+        source,
+        config: readOptionalText(join(root, "brandlab.config.ts")),
+        findings,
+        evaluations,
+    });
     const sortedFindings = findings.sort(compareFindings);
-    const policyResult = applyBrandlabVerificationPolicy(sortedFindings, options.verificationEvidence);
+    const policyResult = applyBrandlabVerificationPolicy(sortedFindings, options.verificationEvidence, evaluations);
     const operationalFindings = policyResult.operationalFindings.sort(compareFindings);
     const authorityDigest = digestBrandlabAuthority({
         release,
@@ -202,23 +231,28 @@ export function detectInstalledBrandlabRelease(packageJson) {
     return new Set(versions).size === 1 ? versions[0] : null;
 }
 function inspectRelease(options) {
+    recordEvaluation(options.evaluations, "release", "brandlab-release-package-json-missing");
     if (!options.packageJson) {
         options.findings.push(releaseFinding("brandlab-release-package-json-missing", "A readable package.json", "package.json is missing or invalid.", "Restore a valid package.json."));
         return;
     }
+    recordEvaluation(options.evaluations, "release", "brandlab-release-installed-version-unresolved");
     if (!options.installedRelease) {
         options.findings.push(releaseFinding("brandlab-release-installed-version-unresolved", "All four Brandlab packages pinned to one exact release", "The installed Brandlab release could not be resolved.", "Pin all four packages to one exact supported version."));
         return;
     }
+    recordEvaluation(options.evaluations, "release", "brandlab-release-unsupported");
     if (!options.manifest) {
         options.findings.push(releaseFinding("brandlab-release-unsupported", "The release selected by the active Brandlab channel", `${options.installedRelease} is not supported by the active platform.`, "Upgrade the project to the current candidate before further work."));
         return;
     }
+    recordEvaluation(options.evaluations, "release", "brandlab-release-declared-installed-mismatch");
     if (options.detectedRelease !== options.installedRelease) {
         options.findings.push(releaseFinding("brandlab-release-declared-installed-mismatch", options.installedRelease, options.detectedRelease ?? "unresolved", "Restore one exact package version across all four Brandlab packages.", "package.json"));
     }
     inspectBrandlabPackages({
         findings: options.findings,
+        evaluations: options.evaluations,
         packageJson: options.packageJson,
         packageLock: options.packageLock,
         installedRelease: options.installedRelease,
@@ -227,16 +261,19 @@ function inspectRelease(options) {
     });
     inspectRuntime({
         findings: options.findings,
+        evaluations: options.evaluations,
         packageJson: options.packageJson,
         packageLock: options.packageLock,
         manifest: options.manifest,
     });
 }
 function inspectBrandlabPackages(options) {
+    recordEvaluation(options.evaluations, "release", "brandlab-release-package-lock");
     if (options.packageLock.state !== "valid") {
         options.findings.push(releaseFinding(`brandlab-release-package-lock-${options.packageLock.state}`, "A valid npm lockfile v2 or v3", `package-lock.json state is ${options.packageLock.state}.`, "Regenerate the lockfile from the exact package declarations.", "package-lock.json"));
         return;
     }
+    recordEvaluation(options.evaluations, "release", "brandlab-release-package-pin-mismatch", "brandlab-release-package-resolution-mismatch", ...(options.attestation ? ["brandlab-release-package-integrity-mismatch"] : []));
     for (const packageName of BRANDLAB_SHARED_PACKAGE_NAMES) {
         const declared = declaredPackageSpec(options.packageJson, packageName);
         const locked = lockedRootSpec(options.packageLock, packageName);
@@ -258,12 +295,17 @@ function inspectBrandlabPackages(options) {
                 : `version=${resolved.version ?? "missing"}; linked=${String(resolved.linked)}; integrity=${resolved.integrity ? "present" : "missing"}.`, "Run a clean npm install from the exact published release.", "package-lock.json"));
         }
         const expectedIntegrity = options.attestation?.packages[packageName].registry.integrity ?? null;
-        if (expectedIntegrity && resolved?.integrity !== expectedIntegrity) {
+        if (options.attestation && !packed && !expectedIntegrity) {
+            // A bound manifest without registry integrity cannot prove the lockfile.
+            options.findings.push(releaseFinding("brandlab-release-package-integrity-mismatch", `${packageName} integrity matching the immutable manifest`, "The release manifest records no registry integrity for this package.", "Bind the verified release manifest recorded after registry publication.", "package-lock.json"));
+        }
+        else if (expectedIntegrity && resolved?.integrity !== expectedIntegrity) {
             options.findings.push(releaseFinding("brandlab-release-package-integrity-mismatch", `${packageName} integrity matching the immutable manifest`, "The lockfile integrity differs from the release attestation.", "Regenerate the lockfile from the verified registry package.", "package-lock.json"));
         }
     }
 }
 function inspectRuntime(options) {
+    recordEvaluation(options.evaluations, "runtime", ...RUNTIME_PACKAGE_FIELDS.map(([packageName]) => `brandlab-runtime-${slugify(packageName)}`), "brandlab-runtime-react-pair", "brandlab-runtime-node", "brandlab-runtime-package-manager", ...(options.manifest.runtime.sharp ? ["brandlab-runtime-sharp"] : []));
     for (const [packageName, runtimeField] of RUNTIME_PACKAGE_FIELDS) {
         const expected = options.manifest.runtime[runtimeField];
         const declared = declaredPackageSpec(options.packageJson, packageName);
@@ -276,6 +318,14 @@ function inspectRuntime(options) {
             options.findings.push(runtimeFinding(`brandlab-runtime-${slugify(packageName)}`, runtimeExpectation(packageName, expected, options.manifest.runtime.nextVersionPolicy), `package.json=${declared ?? "missing"}; lockfile=${locked ?? "missing"}; resolved=${resolved?.version ?? "missing"}.`, `Use the runtime versions permitted by the ${options.manifest.releaseVersion} contract; an exact mitigation pin requires a reviewed policy change before upgrading.`, "package.json"));
         }
     }
+    // React and React DOM are one runtime: a newer patch of one alone is a mismatch.
+    const declaredReact = declaredPackageSpec(options.packageJson, "react");
+    const declaredReactDom = declaredPackageSpec(options.packageJson, "react-dom");
+    const lockedReact = options.packageLock.resolvedPackages.get("react")?.version ?? null;
+    const lockedReactDom = options.packageLock.resolvedPackages.get("react-dom")?.version ?? null;
+    if (!declaredReact || declaredReact !== declaredReactDom || lockedReact !== lockedReactDom) {
+        options.findings.push(runtimeFinding("brandlab-runtime-react-pair", "react and react-dom declared and locked at the same exact version", `package.json react=${declaredReact ?? "missing"}, react-dom=${declaredReactDom ?? "missing"}; lockfile react=${lockedReact ?? "missing"}, react-dom=${lockedReactDom ?? "missing"}.`, "Pin react and react-dom to one exact version and regenerate the lockfile.", "package.json"));
+    }
     const node = options.packageJson.engines?.node ?? null;
     const lockNode = options.packageLock.rootEngines.node ?? null;
     if (node !== options.manifest.runtime.node || lockNode !== node) {
@@ -294,20 +344,22 @@ function inspectRuntime(options) {
         }
     }
 }
-function inspectImageRuntime(root, findings) {
+function inspectImageRuntime(root, findings, evaluations) {
+    recordEvaluation(evaluations, "runtime", "brandlab-runtime-image-initialisation");
     const filename = ["next.config.ts", "next.config.mts", "next.config.mjs", "next.config.js"]
         .find((name) => existsSync(join(root, name)));
     const source = filename ? stripCommentsPreservingLayout(readOptionalText(join(root, filename)) ?? "") : "";
     // A direct side-effect import executes the shared guard before Next starts.
     // This source check is not runtime certification; packed/browser checks prove that separately.
-    if (/^\s*import\s*['"]@brandlab-digital\/site-next\/image-runtime['"]/m.test(source) ||
-        /^\s*require\(\s*['"]@brandlab-digital\/site-next\/image-runtime['"]\s*\)/m.test(source))
+    if (/^[ \t]*import[ \t]*['"]@brandlab-digital\/site-next\/image-runtime['"]/m.test(source) ||
+        /^[ \t]*require\([ \t]*['"]@brandlab-digital\/site-next\/image-runtime['"][ \t]*\)/m.test(source))
         return;
     findings.push(runtimeFinding("brandlab-runtime-image-initialisation", "The shared image-runtime side-effect import in next.config", "The startup decoder exclusion could not be established from configuration.", "Import @brandlab-digital/site-next/image-runtime at the top of next.config; verify the packed runtime and affected images.", filename ?? "next.config.ts"));
 }
-function inspectProjectConfig(root, findings) {
+function inspectProjectConfig(root, projectSource, findings, evaluations) {
     const configPath = join(root, "brandlab.config.ts");
     const source = readOptionalText(configPath);
+    recordEvaluation(evaluations, "routes", "brandlab-config-missing", "brandlab-config-invalid");
     if (!source) {
         findings.push(staticFinding({
             ruleId: "brandlab-config-missing",
@@ -319,31 +371,33 @@ function inspectProjectConfig(root, findings) {
         }));
         return;
     }
+    // 3.0 removed the profile field; a leftover one is reported as a retired API.
     if (!/\bdefineBrandlabProject\s*\(\s*\{/.test(source) ||
-        !/\bprojectId\s*:\s*['"][a-z0-9][a-z0-9-]*['"]/.test(source) ||
-        !/\bprofile\s*:\s*['"]next-(?:local-service|root-level)['"]/.test(source)) {
+        !/\bprojectId\s*:\s*['"][a-z0-9][a-z0-9-]*['"]/.test(source)) {
         findings.push(staticFinding({
             ruleId: "brandlab-config-invalid",
             surface: "routes",
             path: "brandlab.config.ts",
-            expected: "A literal defineBrandlabProject configuration with projectId and profile",
+            expected: "A literal defineBrandlabProject configuration with projectId",
             actual: "The minimum project identity contract could not be verified.",
             remediation: "Keep the configuration literal and limited to project variation.",
         }));
     }
-    const envSource = readOptionalText(join(root, ".env.example")) ?? "";
-    if (/\bcontact\s*:\s*\{/.test(source)) {
-        requireEnvKey(findings, envSource, "RESEND_API_KEY", "contact");
-        requireEnvKey(findings, envSource, "CONTACT_EMAIL", "contact");
+    const envKeys = parseEnvironmentKeys(readOptionalText(join(root, ".env.example")) ?? "");
+    const contracts = findContactContractRecipients(projectSource);
+    if (/\bcontact\s*:\s*\{/.test(source) || contracts.length > 0) {
+        requireEnvKey(findings, evaluations, envKeys, "RESEND_API_KEY", "contact");
+        inspectContactRecipients(contracts, envKeys, findings, evaluations);
     }
     const reviewsConfig = source.match(/\breviews\s*:\s*\{([^{}]*)\}/)?.[1] ?? "";
     const usesLiveGooglePlacesReviews = /\bprovider\s*:\s*['"]google-places['"]/.test(reviewsConfig) &&
         /\bmode\s*:\s*['"](?:summary|full)['"]/.test(reviewsConfig);
     if (usesLiveGooglePlacesReviews) {
-        requireEnvKey(findings, envSource, "GOOGLE_MAPS_PLATFORM_API_KEY", "reviews");
+        requireEnvKey(findings, evaluations, envKeys, "GOOGLE_MAPS_PLATFORM_API_KEY", "reviews");
     }
+    recordEvaluation(evaluations, "environment", "brandlab-environment-retired-contact-state");
     for (const retired of ["CONTACT_CONTEXT_SECRET", "KV_REST_API_URL", "KV_REST_API_TOKEN"]) {
-        if (new RegExp(`^${retired}=`, "m").test(envSource)) {
+        if (envKeys.has(retired)) {
             findings.push(staticFinding({
                 ruleId: "brandlab-environment-retired-contact-state",
                 surface: "environment",
@@ -355,11 +409,74 @@ function inspectProjectConfig(root, findings) {
         }
     }
 }
-function requireEnvKey(findings, envSource, key, capability) {
-    if (new RegExp(`^${key}=`, "m").test(envSource))
+/** The environment variable key rule site-core applies to delivery.recipientEnv. */
+const ENV_KEY_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+/** Variable names documented in an env example file (`KEY=`, `export KEY=`); values are ignored. */
+export function parseEnvironmentKeys(text) {
+    const keys = new Set();
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const assignment = line.startsWith("export ") ? line.slice("export ".length).trimStart() : line;
+        const separator = assignment.indexOf("=");
+        if (separator <= 0)
+            continue;
+        const key = assignment.slice(0, separator).trimEnd();
+        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+            keys.add(key);
+    }
+    return keys;
+}
+/** The recipient variable is whatever the contact contract declares, never an assumed name. */
+function inspectContactRecipients(contracts, envKeys, findings, evaluations) {
+    recordEvaluation(evaluations, "contact", "brandlab-contact-recipient-env");
+    if (contracts.length === 0) {
+        findings.push(staticFinding({
+            ruleId: "brandlab-contact-recipient-env",
+            surface: "contact",
+            path: "src/config/contact.ts",
+            expected: "One defineContactContract contract declaring delivery.recipientEnv",
+            actual: "The contact capability is enabled but no contact contract was found.",
+            remediation: "Declare the contact contract with defineContactContract in src/config/contact.ts.",
+        }));
+        return;
+    }
+    for (const contract of contracts.filter(({ recipientEnv }) => !recipientEnv)) {
+        findings.push(staticFinding({
+            ruleId: "brandlab-contact-recipient-env",
+            surface: "contact",
+            path: contract.path,
+            line: contract.line,
+            expected: "delivery.recipientEnv declared as a literal environment variable key",
+            actual: "The recipient environment variable could not be read from the contract.",
+            remediation: "Write delivery.recipientEnv as a string literal such as 'CONTACT_EMAIL'.",
+        }));
+    }
+    for (const contract of contracts) {
+        if (!contract.recipientEnv || ENV_KEY_PATTERN.test(contract.recipientEnv))
+            continue;
+        findings.push(staticFinding({
+            ruleId: "brandlab-contact-recipient-env",
+            surface: "contact",
+            path: contract.path,
+            line: contract.line,
+            expected: "delivery.recipientEnv is an environment variable key (A-Z, 0-9 and _, starting with a letter)",
+            actual: `delivery.recipientEnv ${JSON.stringify(contract.recipientEnv.slice(0, 64))} is not an environment variable key.`,
+            remediation: "Name the recipient variable in upper case, for example 'CONTACT_EMAIL'.",
+        }));
+    }
+    const keys = [...new Set(contracts.flatMap(({ recipientEnv }) => recipientEnv && ENV_KEY_PATTERN.test(recipientEnv) ? [recipientEnv] : []))];
+    for (const key of keys.sort())
+        requireEnvKey(findings, evaluations, envKeys, key, "contact");
+}
+function requireEnvKey(findings, evaluations, envKeys, key, capability) {
+    const ruleId = `brandlab-environment-${capability}-${slugify(key)}`;
+    recordEvaluation(evaluations, "environment", ruleId);
+    if (envKeys.has(key))
         return;
     findings.push(staticFinding({
-        ruleId: `brandlab-environment-${capability}-${slugify(key)}`,
+        ruleId,
         surface: "environment",
         path: ".env.example",
         expected: `${key} documented for the enabled ${capability} capability`,
@@ -367,112 +484,38 @@ function requireEnvKey(findings, envSource, key, capability) {
         remediation: `Document the non-secret ${key} variable name without adding a credential value.`,
     }));
 }
-function inspectProjectSource(root, findings) {
-    const sourceRoot = join(root, "src");
-    if (!existsSync(sourceRoot))
+function inspectProjectSource(source, findings, evaluations) {
+    recordEvaluation(evaluations, "source", "brandlab-source-root-missing");
+    if (source.directoryRoots.length === 0) {
+        findings.push(staticFinding({
+            ruleId: "brandlab-source-root-missing",
+            surface: "source",
+            expected: `Project source under a recognised root (${BRANDLAB_SOURCE_ROOT_DIRECTORIES.map((name) => `${name}/`).join(", ")})`,
+            actual: "No recognised source root was found, so no source rule could run.",
+            remediation: "Keep application source under src/ (or a recognised legacy root) and rerun verification.",
+        }));
+    }
+    if (source.files.length === 0)
         return;
-    for (const file of sourceFiles(sourceRoot)) {
-        const source = readFileSync(file, "utf8");
-        const executableSource = stripCommentsPreservingLayout(source);
+    for (const rule of SOURCE_RULES)
+        recordEvaluation(evaluations, rule.surface, rule.ruleId);
+    for (const file of source.files) {
         for (const rule of SOURCE_RULES) {
-            const match = executableSource.match(rule.pattern);
+            const match = file.executable.match(rule.pattern);
             if (!match || match.index === undefined)
                 continue;
             findings.push(staticFinding({
                 ruleId: rule.ruleId,
                 surface: rule.surface,
-                path: normalizePath(relative(root, file)),
-                line: lineAt(source, match.index),
+                path: file.path,
+                line: lineAt(file.text, match.index),
                 expected: rule.expected,
-                actual: "A project-owned implementation was detected.",
+                actual: rule.actual ?? "A project-owned implementation was detected.",
                 remediation: rule.remediation,
             }));
         }
     }
 }
-function stripCommentsPreservingLayout(source) {
-    const output = [...source];
-    let state = "code";
-    let escaped = false;
-    for (let index = 0; index < output.length; index += 1) {
-        const current = output[index];
-        const next = output[index + 1];
-        if (state === "line") {
-            if (current === "\n" || current === "\r") {
-                state = "code";
-            }
-            else {
-                output[index] = " ";
-            }
-            continue;
-        }
-        if (state === "block") {
-            if (current === "*" && next === "/") {
-                output[index] = " ";
-                output[index + 1] = " ";
-                index += 1;
-                state = "code";
-            }
-            else if (current !== "\n" && current !== "\r") {
-                output[index] = " ";
-            }
-            continue;
-        }
-        if (state !== "code") {
-            if (escaped) {
-                escaped = false;
-            }
-            else if (current === "\\") {
-                escaped = true;
-            }
-            else if ((state === "single" && current === "'") ||
-                (state === "double" && current === '"') ||
-                (state === "template" && current === "`")) {
-                state = "code";
-            }
-            continue;
-        }
-        if (current === "'") {
-            state = "single";
-        }
-        else if (current === '"') {
-            state = "double";
-        }
-        else if (current === "`") {
-            state = "template";
-        }
-        else if (current === "/" && next === "/") {
-            output[index] = " ";
-            output[index + 1] = " ";
-            index += 1;
-            state = "line";
-        }
-        else if (current === "/" && next === "*") {
-            output[index] = " ";
-            output[index + 1] = " ";
-            index += 1;
-            state = "block";
-        }
-    }
-    return output.join("");
-}
-function sourceFiles(root) {
-    const files = [];
-    for (const entry of readdirSync(root, { withFileTypes: true })) {
-        if (entry.name.startsWith(".") || entry.name === "node_modules")
-            continue;
-        const path = join(root, entry.name);
-        if (entry.isDirectory()) {
-            files.push(...sourceFiles(path));
-            continue;
-        }
-        if (SOURCE_EXTENSIONS.has(extension(entry.name)) &&
-            !/\.(?:test|spec)\.[cm]?[jt]sx?$/.test(entry.name)) {
-            files.push(path);
-        }
-    }
-    return files.sort();
-}
 function readPackageJson(root) {
     const source = readOptionalText(join(root, "package.json"));
     if (!source)
@@ -641,28 +684,11 @@ function runtimeFinding(ruleId, expected, actual, remediation, path) {
         remediation,
     };
 }
-function staticFinding(options) {
-    return {
-        ruleId: options.ruleId,
-        surface: options.surface,
-        severity: "blocker",
-        contract: { name: "project", version: "current-only-v2" },
-        evidenceKind: "static",
-        ...(options.path ? { path: options.path } : {}),
-        ...(options.line ? { line: options.line } : {}),
-        expected: options.expected,
-        actual: options.actual,
-        remediation: options.remediation,
-    };
-}
 function compareFindings(left, right) {
     return (left.ruleId.localeCompare(right.ruleId) ||
         (left.path ?? "").localeCompare(right.path ?? "") ||
         (left.line ?? 0) - (right.line ?? 0));
 }
-function readOptionalText(path) {
-    return existsSync(path) ? readFileSync(path, "utf8") : null;
-}
 function stringRecord(value) {
     if (!isRecord(value))
         return {};
@@ -671,17 +697,7 @@ function stringRecord(value) {
 function isRecord(value) {
     return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-function extension(name) {
-    const index = name.lastIndexOf(".");
-    return index === -1 ? "" : name.slice(index);
-}
-function lineAt(source, index) {
-    return source.slice(0, index).split("\n").length;
-}
 function slugify(value) {
     return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
-function normalizePath(value) {
-    return value.split(/[/\\]/).join("/");
-}
 //# sourceMappingURL=project.js.map