@brandlab-digital/conformance 3.12.1 → 3.13.0

package/dist/site-system/rules/guards/index.d.ts

@@ -0,0 +1,22 @@
+import type { SiteSystemFinding } from "../../checks.js";
+import type { SiteSystemFetch } from "../../samples.js";
+import type { SiteSystemRenderedInput } from "../../runners.js";
+export { checkW9Params, dynamicRoutePageFiles, searchParamLines } from "./w9-params.js";
+export { checkW10, firewallRules, parseRobotsTxt, robotsAllows, robotsGroupsFor, userAgentConditionMatches, type FirewallRule, type RobotsGroup, type UserAgentCondition, type W10Input } from "./w10-crawlers.js";
+export interface CostGuardRuleOptions {
+    /** The moment W5 judges a decision's reviewBy on (in Sydney). Defaults to now. */
+    readonly now?: Date;
+    /** Fetches robots.txt with --base-url (tests). */
+    readonly fetch?: SiteSystemFetch;
+}
+export declare function checkW5(projectRoot: string, today: string): SiteSystemFinding[];
+/** True when robots.txt shuts every search and answer crawler out of the whole site (`Disallow: /`). */
+export declare function robotsClosedToEveryCrawler(text: string): boolean;
+/**
+ * The deployment environment a Next build was made for: the `NEXT_PUBLIC_VERCEL_ENV` that defineBrandlabNextConfig
+ * inlines (from VERCEL_ENV), as the build records it in required-server-files.json. Undefined when it is not recorded.
+ */
+export declare function buildDeploymentEnvironment(buildDir: string): string | undefined;
+/** Runs W5, W10 and W9-params. */
+export declare function runCostGuardRules(input: SiteSystemRenderedInput, options?: CostGuardRuleOptions): Promise<readonly SiteSystemFinding[]>;
+//# sourceMappingURL=index.d.ts.map

package/dist/site-system/rules/guards/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/site-system/rules/guards/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAMhE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,yBAAyB,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEnN,MAAM,WAAW,oBAAoB;IACnC,kFAAkF;IAClF,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACpB,kDAAkD;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;CAClC;AAMD,wBAAgB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAO/E;AA0BD,wGAAwG;AACxG,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGhE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS/E;AAUD,kCAAkC;AAClC,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAwBjJ"}

package/dist/site-system/rules/guards/index.js

@@ -0,0 +1,109 @@
+/**
+ * The cost guards (release 3.13.0): small checks so cost work never harms a site. W5, the origin region recorded and
+ * reviewed; W10, robots.txt and the firewall leave the search and answer crawlers open; W9-params, estate pages never
+ * read searchParams. The browser half of W9 (URL variants) is a journey (`defineBrandlabSiteSystemTests`).
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { originRegionProblems, sydneyToday } from "../../../origin-region.js";
+import { parseProjectHosting, readSiteSystemProjectConfig } from "../../config.js";
+import { fail, pass } from "../enquiry/common.js";
+import { checkW9Params } from "./w9-params.js";
+import { BRANDLAB_SEARCH_CRAWLERS } from "@brandlab-digital/site-core/site";
+import { checkW10, parseRobotsTxt, robotsAllows } from "./w10-crawlers.js";
+export { checkW9Params, dynamicRoutePageFiles, searchParamLines } from "./w9-params.js";
+export { checkW10, firewallRules, parseRobotsTxt, robotsAllows, robotsGroupsFor, userAgentConditionMatches } from "./w10-crawlers.js";
+function readOptional(path) {
+    return existsSync(path) ? readFileSync(path, "utf8") : null;
+}
+export function checkW5(projectRoot, today) {
+    const config = readOptional(join(projectRoot, "brandlab.config.ts"));
+    const hosting = config === null ? undefined : parseProjectHosting(config);
+    const problems = originRegionProblems({ hosting, vercelJson: readOptional(join(projectRoot, "vercel.json")), today });
+    if (problems.length > 0)
+        return problems.map((problem) => fail("W5", problem.startsWith("vercel.json") ? "vercel.json" : "brandlab.config.ts", problem));
+    const regions = hosting?.state === "literal" ? JSON.stringify(hosting.value?.originRegion ?? "syd1") : '"syd1"';
+    return [pass("W5", `vercel.json runs the server functions in the recorded origin region (${regions}).`)];
+}
+async function readRobots(input, fetcher) {
+    if (input.baseUrl) {
+        const url = `${input.baseUrl.replace(/\/+$/, "")}/robots.txt`;
+        try {
+            const response = await (fetcher ?? globalThis.fetch)(url, { headers: { accept: "text/plain" }, redirect: "follow", signal: AbortSignal.timeout(30_000) });
+            if (!response.ok)
+                return { text: null, problem: `GET /robots.txt answered ${response.status}.` };
+            const closed = /\bnoindex\b/i.test(response.headers.get("x-robots-tag") ?? "");
+            return { text: await response.text(), closed };
+        }
+        catch (error) {
+            return { text: null, problem: `GET /robots.txt failed (${error instanceof Error ? error.message : String(error)}).` };
+        }
+    }
+    const buildDir = input.buildDir ?? join(input.projectRoot, ".next");
+    const file = join(buildDir, "server", "app", "robots.txt.body");
+    const text = readOptional(file);
+    if (text === null) {
+        return { text: null, problem: "The build has no prerendered robots.txt (.next/server/app/robots.txt.body); run next build, or pass --base-url to read it from the running site." };
+    }
+    // The robots helper closes every deployment but production on purpose: a build made for a Preview (VERCEL_ENV
+    // preview) is not judged. A production build, or one whose environment is not recorded, still is.
+    const environment = buildDeploymentEnvironment(buildDir);
+    return { text, closed: environment !== undefined && environment !== "production" && robotsClosedToEveryCrawler(text) };
+}
+/** True when robots.txt shuts every search and answer crawler out of the whole site (`Disallow: /`). */
+export function robotsClosedToEveryCrawler(text) {
+    const groups = parseRobotsTxt(text);
+    return BRANDLAB_SEARCH_CRAWLERS.every((crawler) => !robotsAllows(groups, crawler, "/"));
+}
+/**
+ * The deployment environment a Next build was made for: the `NEXT_PUBLIC_VERCEL_ENV` that defineBrandlabNextConfig
+ * inlines (from VERCEL_ENV), as the build records it in required-server-files.json. Undefined when it is not recorded.
+ */
+export function buildDeploymentEnvironment(buildDir) {
+    const manifest = readOptional(join(buildDir, "required-server-files.json"));
+    if (manifest === null)
+        return undefined;
+    try {
+        const value = JSON.parse(manifest).config?.env?.NEXT_PUBLIC_VERCEL_ENV;
+        return typeof value === "string" && value.trim() ? value.trim() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function representativePaths(projectRoot) {
+    try {
+        return ["/", ...Object.values(readSiteSystemProjectConfig(projectRoot).representativeRoutes)];
+    }
+    catch {
+        return ["/"];
+    }
+}
+/** Runs W5, W10 and W9-params. */
+export async function runCostGuardRules(input, options = {}) {
+    const today = sydneyToday(options.now);
+    const vercelText = readOptional(join(input.projectRoot, "vercel.json"));
+    let vercelJson = null;
+    try {
+        vercelJson = vercelText === null ? null : JSON.parse(vercelText);
+    }
+    catch {
+        vercelJson = null;
+    }
+    const config = readOptional(join(input.projectRoot, "brandlab.config.ts"));
+    const hosting = config === null ? undefined : parseProjectHosting(config);
+    const robots = await readRobots(input, options.fetch);
+    return [
+        ...checkW5(input.projectRoot, today),
+        ...checkW10({
+            robotsTxt: robots.text,
+            ...(robots.problem ? { robotsProblem: robots.problem } : {}),
+            closedDeployment: robots.closed === true,
+            paths: [...new Set(representativePaths(input.projectRoot))],
+            vercelJson,
+            hosting: hosting?.state === "literal" ? hosting.value : undefined,
+        }),
+        ...checkW9Params(input.projectRoot),
+    ];
+}
+//# sourceMappingURL=index.js.map

package/dist/site-system/rules/guards/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/site-system/rules/guards/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAGnF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,yBAAyB,EAA+E,MAAM,mBAAmB,CAAC;AASnN,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,WAAmB,EAAE,KAAa;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC;IACzJ,MAAM,OAAO,GAAG,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAE,OAAO,CAAC,KAAgD,EAAE,YAAY,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5J,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,wEAAwE,OAAO,IAAI,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAA8B,EAAE,OAAoC;IAC5F,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAK,UAAU,CAAC,KAAoC,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1L,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,4BAA4B,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;YACjG,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxH,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,kJAAkJ,EAAE,CAAC;IACrL,CAAC;IACD,8GAA8G;IAC9G,kGAAkG;IAClG,MAAM,WAAW,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACzD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,YAAY,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;AACzH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAoD,CAAC,MAAM,EAAE,GAAG,EAAE,sBAAsB,CAAC;QAC3H,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;AACH,CAAC;AAED,kCAAkC;AAClC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA8B,EAAE,UAAgC,EAAE;IACxG,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;IACxE,IAAI,UAAU,GAAY,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,UAAU,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,OAAO;QACL,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC;QACpC,GAAG,QAAQ,CAAC;YACV,SAAS,EAAE,MAAM,CAAC,IAAI;YACtB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,gBAAgB,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI;YACxC,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3D,UAAU;YACV,OAAO,EAAE,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAClE,CAAC;QACF,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;KACpC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The cost guards (release 3.13.0): small checks so cost work never harms a site. W5, the origin region recorded and\n * reviewed; W10, robots.txt and the firewall leave the search and answer crawlers open; W9-params, estate pages never\n * read searchParams. The browser half of W9 (URL variants) is a journey (`defineBrandlabSiteSystemTests`).\n */\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { originRegionProblems, sydneyToday } from \"../../../origin-region.js\";\nimport type { SiteSystemFinding } from \"../../checks.js\";\nimport { parseProjectHosting, readSiteSystemProjectConfig } from \"../../config.js\";\nimport type { SiteSystemFetch } from \"../../samples.js\";\nimport type { SiteSystemRenderedInput } from \"../../runners.js\";\nimport { fail, pass } from \"../enquiry/common.js\";\nimport { checkW9Params } from \"./w9-params.js\";\nimport { BRANDLAB_SEARCH_CRAWLERS } from \"@brandlab-digital/site-core/site\";\nimport { checkW10, parseRobotsTxt, robotsAllows } from \"./w10-crawlers.js\";\n\nexport { checkW9Params, dynamicRoutePageFiles, searchParamLines } from \"./w9-params.js\";\nexport { checkW10, firewallRules, parseRobotsTxt, robotsAllows, robotsGroupsFor, userAgentConditionMatches, type FirewallRule, type RobotsGroup, type UserAgentCondition, type W10Input } from \"./w10-crawlers.js\";\n\nexport interface CostGuardRuleOptions {\n  /** The moment W5 judges a decision's reviewBy on (in Sydney). Defaults to now. */\n  readonly now?: Date;\n  /** Fetches robots.txt with --base-url (tests). */\n  readonly fetch?: SiteSystemFetch;\n}\n\nfunction readOptional(path: string): string | null {\n  return existsSync(path) ? readFileSync(path, \"utf8\") : null;\n}\n\nexport function checkW5(projectRoot: string, today: string): SiteSystemFinding[] {\n  const config = readOptional(join(projectRoot, \"brandlab.config.ts\"));\n  const hosting = config === null ? undefined : parseProjectHosting(config);\n  const problems = originRegionProblems({ hosting, vercelJson: readOptional(join(projectRoot, \"vercel.json\")), today });\n  if (problems.length > 0) return problems.map((problem) => fail(\"W5\", problem.startsWith(\"vercel.json\") ? \"vercel.json\" : \"brandlab.config.ts\", problem));\n  const regions = hosting?.state === \"literal\" ? JSON.stringify((hosting.value as { originRegion?: unknown } | undefined)?.originRegion ?? \"syd1\") : '\"syd1\"';\n  return [pass(\"W5\", `vercel.json runs the server functions in the recorded origin region (${regions}).`)];\n}\n\nasync function readRobots(input: SiteSystemRenderedInput, fetcher: SiteSystemFetch | undefined): Promise<{ text: string | null; problem?: string; closed?: boolean }> {\n  if (input.baseUrl) {\n    const url = `${input.baseUrl.replace(/\\/+$/, \"\")}/robots.txt`;\n    try {\n      const response = await (fetcher ?? (globalThis.fetch as unknown as SiteSystemFetch))(url, { headers: { accept: \"text/plain\" }, redirect: \"follow\", signal: AbortSignal.timeout(30_000) });\n      if (!response.ok) return { text: null, problem: `GET /robots.txt answered ${response.status}.` };\n      const closed = /\\bnoindex\\b/i.test(response.headers.get(\"x-robots-tag\") ?? \"\");\n      return { text: await response.text(), closed };\n    } catch (error) {\n      return { text: null, problem: `GET /robots.txt failed (${error instanceof Error ? error.message : String(error)}).` };\n    }\n  }\n  const buildDir = input.buildDir ?? join(input.projectRoot, \".next\");\n  const file = join(buildDir, \"server\", \"app\", \"robots.txt.body\");\n  const text = readOptional(file);\n  if (text === null) {\n    return { text: null, problem: \"The build has no prerendered robots.txt (.next/server/app/robots.txt.body); run next build, or pass --base-url to read it from the running site.\" };\n  }\n  // The robots helper closes every deployment but production on purpose: a build made for a Preview (VERCEL_ENV\n  // preview) is not judged. A production build, or one whose environment is not recorded, still is.\n  const environment = buildDeploymentEnvironment(buildDir);\n  return { text, closed: environment !== undefined && environment !== \"production\" && robotsClosedToEveryCrawler(text) };\n}\n\n/** True when robots.txt shuts every search and answer crawler out of the whole site (`Disallow: /`). */\nexport function robotsClosedToEveryCrawler(text: string): boolean {\n  const groups = parseRobotsTxt(text);\n  return BRANDLAB_SEARCH_CRAWLERS.every((crawler) => !robotsAllows(groups, crawler, \"/\"));\n}\n\n/**\n * The deployment environment a Next build was made for: the `NEXT_PUBLIC_VERCEL_ENV` that defineBrandlabNextConfig\n * inlines (from VERCEL_ENV), as the build records it in required-server-files.json. Undefined when it is not recorded.\n */\nexport function buildDeploymentEnvironment(buildDir: string): string | undefined {\n  const manifest = readOptional(join(buildDir, \"required-server-files.json\"));\n  if (manifest === null) return undefined;\n  try {\n    const value = (JSON.parse(manifest) as { config?: { env?: Record<string, unknown> } }).config?.env?.NEXT_PUBLIC_VERCEL_ENV;\n    return typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction representativePaths(projectRoot: string): string[] {\n  try {\n    return [\"/\", ...Object.values(readSiteSystemProjectConfig(projectRoot).representativeRoutes)];\n  } catch {\n    return [\"/\"];\n  }\n}\n\n/** Runs W5, W10 and W9-params. */\nexport async function runCostGuardRules(input: SiteSystemRenderedInput, options: CostGuardRuleOptions = {}): Promise<readonly SiteSystemFinding[]> {\n  const today = sydneyToday(options.now);\n  const vercelText = readOptional(join(input.projectRoot, \"vercel.json\"));\n  let vercelJson: unknown = null;\n  try {\n    vercelJson = vercelText === null ? null : JSON.parse(vercelText);\n  } catch {\n    vercelJson = null;\n  }\n  const config = readOptional(join(input.projectRoot, \"brandlab.config.ts\"));\n  const hosting = config === null ? undefined : parseProjectHosting(config);\n  const robots = await readRobots(input, options.fetch);\n  return [\n    ...checkW5(input.projectRoot, today),\n    ...checkW10({\n      robotsTxt: robots.text,\n      ...(robots.problem ? { robotsProblem: robots.problem } : {}),\n      closedDeployment: robots.closed === true,\n      paths: [...new Set(representativePaths(input.projectRoot))],\n      vercelJson,\n      hosting: hosting?.state === \"literal\" ? hosting.value : undefined,\n    }),\n    ...checkW9Params(input.projectRoot),\n  ];\n}\n"]}

package/dist/site-system/rules/guards/w10-crawlers.d.ts

@@ -0,0 +1,55 @@
+import type { SiteSystemFinding } from "../../checks.js";
+export interface RobotsGroup {
+    /** The user-agent tokens, lower-cased. */
+    readonly agents: readonly string[];
+    readonly rules: readonly {
+        readonly allow: boolean;
+        readonly path: string;
+    }[];
+    readonly crawlDelay: string | null;
+}
+/** robots.txt as groups (RFC 9309): consecutive user-agent lines, then their rules. Comments and unknown lines are skipped. */
+export declare function parseRobotsTxt(text: string): RobotsGroup[];
+/** The groups that apply to a crawler: those naming its token, or else the `*` groups. */
+export declare function robotsGroupsFor(groups: readonly RobotsGroup[], crawler: string): RobotsGroup[];
+/** Whether a crawler may fetch `path` under these groups: the longest matching rule wins, and Allow wins a tie. */
+export declare function robotsAllows(groups: readonly RobotsGroup[], crawler: string, path: string): boolean;
+/** A user-agent condition from a firewall rule, in the forms Vercel and the brandlab.config record write. */
+export type UserAgentCondition = {
+    readonly match: "contains" | "equals" | "regex";
+    readonly value: string;
+} | {
+    readonly eq?: string;
+    readonly neq?: string;
+    readonly inc?: readonly string[];
+    readonly ninc?: readonly string[];
+    readonly pre?: string;
+    readonly suf?: string;
+    readonly re?: string;
+};
+/** Whether a user-agent condition matches the crawler (case-insensitive, so a doubtful rule is flagged). */
+export declare function userAgentConditionMatches(condition: UserAgentCondition | string, crawler: string): boolean;
+export interface FirewallRule {
+    /** Where the rule is recorded, for messages: `vercel.json routes[2]` or `hosting.firewall "block-scrapers"`. */
+    readonly source: string;
+    readonly action: string;
+    readonly userAgent: UserAgentCondition | string;
+}
+/** The firewall rules that match on the user agent: vercel.json `routes` with `mitigate`, and `hosting.firewall`. */
+export declare function firewallRules(vercelJson: unknown, hosting: unknown): FirewallRule[];
+export interface W10Input {
+    /** robots.txt text, or null when it could not be read; `robotsProblem` says why. */
+    readonly robotsTxt: string | null;
+    readonly robotsProblem?: string;
+    /**
+     * True when the robots.txt came from a Preview, closed on purpose: a running deployment that answers noindex, or a
+     * build made for a non-production environment whose robots.txt disallows everything.
+     */
+    readonly closedDeployment?: boolean;
+    /** Paths each crawler must be able to fetch: home and the representative routes. */
+    readonly paths: readonly string[];
+    readonly vercelJson: unknown;
+    readonly hosting: unknown;
+}
+export declare function checkW10(input: W10Input): SiteSystemFinding[];
+//# sourceMappingURL=w10-crawlers.d.ts.map

package/dist/site-system/rules/guards/w10-crawlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"w10-crawlers.d.ts","sourceRoot":"","sources":["../../../../src/site-system/rules/guards/w10-crawlers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,+HAA+H;AAC/H,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA6B1D;AAED,0FAA0F;AAC1F,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CAI9F;AAQD,mHAAmH;AACnH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAUnG;AAED,6GAA6G;AAC7G,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAe7L,4GAA4G;AAC5G,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,kBAAkB,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAoB1G;AAED,MAAM,WAAW,YAAY;IAC3B,gHAAgH;IAChH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,GAAG,MAAM,CAAC;CACjD;AAED,qHAAqH;AACrH,wBAAgB,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,YAAY,EAAE,CAuBnF;AAID,MAAM,WAAW,QAAQ;IACvB,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,iBAAiB,EAAE,CA+B7D"}

package/dist/site-system/rules/guards/w10-crawlers.js

@@ -0,0 +1,182 @@
+/**
+ * W10, the crawler guard (3.13.0): robots.txt and the recorded firewall rules never block a search or answer crawler
+ * (site-core `BRANDLAB_SEARCH_CRAWLERS`), and robots.txt gives none of them a Crawl-delay. The robots.txt is the
+ * built one (or the running site's with --base-url); the firewall rules are vercel.json `routes` with `mitigate` and
+ * the rules recorded in brandlab.config.ts `hosting.firewall`.
+ */
+import { BRANDLAB_SEARCH_CRAWLERS } from "@brandlab-digital/site-core/site";
+import { fail, notApplicable, pass } from "../enquiry/common.js";
+/** robots.txt as groups (RFC 9309): consecutive user-agent lines, then their rules. Comments and unknown lines are skipped. */
+export function parseRobotsTxt(text) {
+    const groups = [];
+    let current = null;
+    let collectingAgents = false;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.replace(/#.*$/, "").trim();
+        const colon = line.indexOf(":");
+        if (colon === -1)
+            continue;
+        const key = line.slice(0, colon).trim().toLowerCase();
+        const value = line.slice(colon + 1).trim();
+        if (key === "user-agent") {
+            if (!collectingAgents || !current) {
+                current = { agents: [], rules: [], crawlDelay: null };
+                groups.push(current);
+            }
+            current.agents.push(value.toLowerCase());
+            collectingAgents = true;
+            continue;
+        }
+        if (!current)
+            continue;
+        collectingAgents = false;
+        if (key === "allow" || key === "disallow") {
+            // An empty Disallow allows everything; it adds no rule.
+            if (value)
+                current.rules.push({ allow: key === "allow", path: value });
+        }
+        else if (key === "crawl-delay") {
+            current.crawlDelay = value;
+        }
+    }
+    return groups;
+}
+/** The groups that apply to a crawler: those naming its token, or else the `*` groups. */
+export function robotsGroupsFor(groups, crawler) {
+    const token = crawler.toLowerCase();
+    const named = groups.filter((group) => group.agents.includes(token));
+    return named.length > 0 ? named : groups.filter((group) => group.agents.includes("*"));
+}
+function patternMatches(pattern, path) {
+    const anchored = pattern.endsWith("$");
+    const body = (anchored ? pattern.slice(0, -1) : pattern).split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+    return new RegExp(`^${body}${anchored ? "$" : ""}`).test(path);
+}
+/** Whether a crawler may fetch `path` under these groups: the longest matching rule wins, and Allow wins a tie. */
+export function robotsAllows(groups, crawler, path) {
+    let best = null;
+    for (const group of robotsGroupsFor(groups, crawler)) {
+        for (const rule of group.rules) {
+            if (!patternMatches(rule.path, path))
+                continue;
+            const length = rule.path.length;
+            if (!best || length > best.length || (length === best.length && rule.allow))
+                best = { allow: rule.allow, length };
+        }
+    }
+    return best ? best.allow : true;
+}
+/** The user agents a crawler sends, as a rule would see them: its bare token and a typical full string. */
+function crawlerUserAgents(crawler) {
+    return [crawler, `Mozilla/5.0 (compatible; ${crawler}/1.0)`];
+}
+function safeRegExp(source) {
+    try {
+        return new RegExp(source, "i");
+    }
+    catch {
+        return null;
+    }
+}
+/** Whether a user-agent condition matches the crawler (case-insensitive, so a doubtful rule is flagged). */
+export function userAgentConditionMatches(condition, crawler) {
+    return crawlerUserAgents(crawler).some((agent) => {
+        const ua = agent.toLowerCase();
+        if (typeof condition === "string")
+            return safeRegExp(condition)?.test(agent) ?? false;
+        if ("match" in condition) {
+            const value = condition.value.toLowerCase();
+            if (condition.match === "contains")
+                return ua.includes(value);
+            if (condition.match === "equals")
+                return ua === value;
+            return safeRegExp(condition.value)?.test(agent) ?? false;
+        }
+        const checks = [];
+        if (condition.eq !== undefined)
+            checks.push(ua === condition.eq.toLowerCase());
+        if (condition.neq !== undefined)
+            checks.push(ua !== condition.neq.toLowerCase());
+        if (condition.inc !== undefined)
+            checks.push(condition.inc.some((value) => ua === value.toLowerCase()));
+        if (condition.ninc !== undefined)
+            checks.push(!condition.ninc.some((value) => ua === value.toLowerCase()));
+        if (condition.pre !== undefined)
+            checks.push(ua.startsWith(condition.pre.toLowerCase()));
+        if (condition.suf !== undefined)
+            checks.push(ua.endsWith(condition.suf.toLowerCase()));
+        if (condition.re !== undefined)
+            checks.push(safeRegExp(condition.re)?.test(agent) ?? false);
+        return checks.length > 0 && checks.every(Boolean);
+    });
+}
+/** The firewall rules that match on the user agent: vercel.json `routes` with `mitigate`, and `hosting.firewall`. */
+export function firewallRules(vercelJson, hosting) {
+    const rules = [];
+    const routes = isRecord(vercelJson) && Array.isArray(vercelJson.routes) ? vercelJson.routes : [];
+    routes.forEach((route, index) => {
+        if (!isRecord(route) || !isRecord(route.mitigate) || typeof route.mitigate.action !== "string")
+            return;
+        const has = Array.isArray(route.has) ? route.has : [];
+        for (const condition of has) {
+            if (!isRecord(condition) || condition.type !== "header" || String(condition.key).toLowerCase() !== "user-agent")
+                continue;
+            const value = condition.value;
+            if (typeof value === "string" || isRecord(value)) {
+                rules.push({ source: `vercel.json routes[${index}]`, action: route.mitigate.action, userAgent: value });
+            }
+        }
+    });
+    const recorded = isRecord(hosting) && Array.isArray(hosting.firewall) ? hosting.firewall : [];
+    for (const rule of recorded) {
+        if (!isRecord(rule) || !isRecord(rule.userAgent) || typeof rule.action !== "string")
+            continue;
+        const { match, value } = rule.userAgent;
+        if ((match === "contains" || match === "equals" || match === "regex") && typeof value === "string") {
+            rules.push({ source: `hosting.firewall "${String(rule.id)}"`, action: rule.action, userAgent: { match, value } });
+        }
+    }
+    return rules;
+}
+const BLOCKING_ACTIONS = new Set(["deny", "challenge"]);
+export function checkW10(input) {
+    const findings = [];
+    const crawlers = BRANDLAB_SEARCH_CRAWLERS;
+    if (input.closedDeployment) {
+        findings.push(notApplicable("W10", "robots.txt came from a Preview deployment or a build made for one, which stays closed to every crawler; W10 reads the production build (VERCEL_ENV=production next build, or --base-url on production)."));
+    }
+    else if (input.robotsTxt === null) {
+        findings.push(fail("W10", "/robots.txt", input.robotsProblem ?? "robots.txt could not be read, so the crawler guard could not check it."));
+    }
+    else {
+        const groups = parseRobotsTxt(input.robotsTxt);
+        for (const crawler of crawlers) {
+            const blocked = input.paths.filter((path) => !robotsAllows(groups, crawler, path));
+            if (blocked.length > 0) {
+                findings.push(fail("W10", "/robots.txt", `robots.txt blocks ${crawler} from ${blocked.join(", ")}; search and answer crawlers stay allowed (no blanket robots rule).`));
+            }
+            const delay = robotsGroupsFor(groups, crawler).find((group) => group.crawlDelay !== null);
+            if (delay) {
+                findings.push(fail("W10", "/robots.txt", `robots.txt gives ${crawler} a Crawl-delay of ${delay.crawlDelay}; Google ignores it and Bing honours it, so it only slows Bing indexing. Keep one only with a recorded decision and a Romie-owned W10 exception.`));
+            }
+        }
+    }
+    for (const rule of firewallRules(input.vercelJson, input.hosting)) {
+        const hit = crawlers.filter((crawler) => userAgentConditionMatches(rule.userAgent, crawler));
+        if (hit.length === 0)
+            continue;
+        if (BLOCKING_ACTIONS.has(rule.action)) {
+            findings.push(fail("W10", rule.source.startsWith("vercel.json") ? "vercel.json" : "brandlab.config.ts", `The firewall rule ${rule.source} (${rule.action}) matches ${hit.join(", ")}; search and answer crawlers must not be denied or challenged.`));
+        }
+        else if (rule.action === "rate-limit") {
+            findings.push({ checkId: "W10", status: "pass", severity: "warning", target: "brandlab.config.ts", message: `The firewall rule ${rule.source} rate-limits ${hit.join(", ")}; check it never stops their normal crawl.` });
+        }
+    }
+    if (findings.some((finding) => finding.status === "fail" || finding.status === "not-applicable"))
+        return findings;
+    return [...findings, pass("W10", `robots.txt and the recorded firewall rules leave ${crawlers.join(", ")} open on ${input.paths.join(", ")}, with no Crawl-delay.`)];
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+//# sourceMappingURL=w10-crawlers.js.map

package/dist/site-system/rules/guards/w10-crawlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"w10-crawlers.js","sourceRoot":"","sources":["../../../../src/site-system/rules/guards/w10-crawlers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,wBAAwB,EAA8B,MAAM,kCAAkC,CAAC;AAExG,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AASjE,+HAA+H;AAC/H,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,MAAM,GAAiG,EAAE,CAAC;IAChH,IAAI,OAAO,GAAmC,IAAI,CAAC;IACnD,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,IAAI,CAAC,gBAAgB,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,OAAO,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;gBACtD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACzC,gBAAgB,GAAG,IAAI,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,gBAAgB,GAAG,KAAK,CAAC;QACzB,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC1C,wDAAwD;YACxD,IAAI,KAAK;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;aAAM,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACjC,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,eAAe,CAAC,MAA8B,EAAE,OAAe;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,IAAY;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzI,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,YAAY,CAAC,MAA8B,EAAE,OAAe,EAAE,IAAY;IACxF,IAAI,IAAI,GAA8C,IAAI,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;gBAAE,SAAS;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAChC,IAAI,CAAC,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC;gBAAE,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACpH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAOD,2GAA2G;AAC3G,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,CAAC,OAAO,EAAE,4BAA4B,OAAO,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,yBAAyB,CAAC,SAAsC,EAAE,OAAe;IAC/F,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/C,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QACtF,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,SAAS,CAAC,KAAK,KAAK,UAAU;gBAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,EAAE,KAAK,KAAK,CAAC;YACtD,OAAO,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QAC3D,CAAC;QACD,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,SAAS,CAAC,EAAE,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACjF,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACxG,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3G,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACvF,IAAI,SAAS,CAAC,EAAE,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;QAC5F,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC;AASD,qHAAqH;AACrH,MAAM,UAAU,aAAa,CAAC,UAAmB,EAAE,OAAgB;IACjE,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAc,EAAE,KAAK,EAAE,EAAE;QACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QACvG,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,KAAK,MAAM,SAAS,IAAI,GAAG,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY;gBAAE,SAAS;YAC1H,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;YAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,KAAK,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,KAAoC,EAAE,CAAC,CAAC;YACzI,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QAC9F,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAiBxD,MAAM,UAAU,QAAQ,CAAC,KAAe;IACtC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAqC,wBAAwB,CAAC;IAC5E,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,yMAAyM,CAAC,CAAC,CAAC;IACjP,CAAC;SAAM,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,wEAAwE,CAAC,CAAC,CAAC;IAC7I,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YACnF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,qBAAqB,OAAO,SAAS,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC,CAAC;YAC1K,CAAC;YACD,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;YAC1F,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,oBAAoB,OAAO,qBAAqB,KAAK,CAAC,UAAU,kJAAkJ,CAAC,CAAC,CAAC;YAChQ,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7F,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC/B,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC,CAAC;QACxP,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,qBAAqB,IAAI,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C,EAAE,CAAC,CAAC;QAC5N,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClH,OAAO,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,oDAAoD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;AACvK,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["/**\n * W10, the crawler guard (3.13.0): robots.txt and the recorded firewall rules never block a search or answer crawler\n * (site-core `BRANDLAB_SEARCH_CRAWLERS`), and robots.txt gives none of them a Crawl-delay. The robots.txt is the\n * built one (or the running site's with --base-url); the firewall rules are vercel.json `routes` with `mitigate` and\n * the rules recorded in brandlab.config.ts `hosting.firewall`.\n */\nimport { BRANDLAB_SEARCH_CRAWLERS, type BrandlabSearchCrawler } from \"@brandlab-digital/site-core/site\";\nimport type { SiteSystemFinding } from \"../../checks.js\";\nimport { fail, notApplicable, pass } from \"../enquiry/common.js\";\n\nexport interface RobotsGroup {\n  /** The user-agent tokens, lower-cased. */\n  readonly agents: readonly string[];\n  readonly rules: readonly { readonly allow: boolean; readonly path: string }[];\n  readonly crawlDelay: string | null;\n}\n\n/** robots.txt as groups (RFC 9309): consecutive user-agent lines, then their rules. Comments and unknown lines are skipped. */\nexport function parseRobotsTxt(text: string): RobotsGroup[] {\n  const groups: { agents: string[]; rules: { allow: boolean; path: string }[]; crawlDelay: string | null }[] = [];\n  let current: (typeof groups)[number] | null = null;\n  let collectingAgents = false;\n  for (const raw of text.split(/\\r?\\n/)) {\n    const line = raw.replace(/#.*$/, \"\").trim();\n    const colon = line.indexOf(\":\");\n    if (colon === -1) continue;\n    const key = line.slice(0, colon).trim().toLowerCase();\n    const value = line.slice(colon + 1).trim();\n    if (key === \"user-agent\") {\n      if (!collectingAgents || !current) {\n        current = { agents: [], rules: [], crawlDelay: null };\n        groups.push(current);\n      }\n      current.agents.push(value.toLowerCase());\n      collectingAgents = true;\n      continue;\n    }\n    if (!current) continue;\n    collectingAgents = false;\n    if (key === \"allow\" || key === \"disallow\") {\n      // An empty Disallow allows everything; it adds no rule.\n      if (value) current.rules.push({ allow: key === \"allow\", path: value });\n    } else if (key === \"crawl-delay\") {\n      current.crawlDelay = value;\n    }\n  }\n  return groups;\n}\n\n/** The groups that apply to a crawler: those naming its token, or else the `*` groups. */\nexport function robotsGroupsFor(groups: readonly RobotsGroup[], crawler: string): RobotsGroup[] {\n  const token = crawler.toLowerCase();\n  const named = groups.filter((group) => group.agents.includes(token));\n  return named.length > 0 ? named : groups.filter((group) => group.agents.includes(\"*\"));\n}\n\nfunction patternMatches(pattern: string, path: string): boolean {\n  const anchored = pattern.endsWith(\"$\");\n  const body = (anchored ? pattern.slice(0, -1) : pattern).split(\"*\").map((part) => part.replace(/[.+?^${}()|[\\]\\\\]/g, \"\\\\$&\")).join(\".*\");\n  return new RegExp(`^${body}${anchored ? \"$\" : \"\"}`).test(path);\n}\n\n/** Whether a crawler may fetch `path` under these groups: the longest matching rule wins, and Allow wins a tie. */\nexport function robotsAllows(groups: readonly RobotsGroup[], crawler: string, path: string): boolean {\n  let best: { allow: boolean; length: number } | null = null;\n  for (const group of robotsGroupsFor(groups, crawler)) {\n    for (const rule of group.rules) {\n      if (!patternMatches(rule.path, path)) continue;\n      const length = rule.path.length;\n      if (!best || length > best.length || (length === best.length && rule.allow)) best = { allow: rule.allow, length };\n    }\n  }\n  return best ? best.allow : true;\n}\n\n/** A user-agent condition from a firewall rule, in the forms Vercel and the brandlab.config record write. */\nexport type UserAgentCondition =\n  | { readonly match: \"contains\" | \"equals\" | \"regex\"; readonly value: string }\n  | { readonly eq?: string; readonly neq?: string; readonly inc?: readonly string[]; readonly ninc?: readonly string[]; readonly pre?: string; readonly suf?: string; readonly re?: string };\n\n/** The user agents a crawler sends, as a rule would see them: its bare token and a typical full string. */\nfunction crawlerUserAgents(crawler: string): string[] {\n  return [crawler, `Mozilla/5.0 (compatible; ${crawler}/1.0)`];\n}\n\nfunction safeRegExp(source: string): RegExp | null {\n  try {\n    return new RegExp(source, \"i\");\n  } catch {\n    return null;\n  }\n}\n\n/** Whether a user-agent condition matches the crawler (case-insensitive, so a doubtful rule is flagged). */\nexport function userAgentConditionMatches(condition: UserAgentCondition | string, crawler: string): boolean {\n  return crawlerUserAgents(crawler).some((agent) => {\n    const ua = agent.toLowerCase();\n    if (typeof condition === \"string\") return safeRegExp(condition)?.test(agent) ?? false;\n    if (\"match\" in condition) {\n      const value = condition.value.toLowerCase();\n      if (condition.match === \"contains\") return ua.includes(value);\n      if (condition.match === \"equals\") return ua === value;\n      return safeRegExp(condition.value)?.test(agent) ?? false;\n    }\n    const checks: boolean[] = [];\n    if (condition.eq !== undefined) checks.push(ua === condition.eq.toLowerCase());\n    if (condition.neq !== undefined) checks.push(ua !== condition.neq.toLowerCase());\n    if (condition.inc !== undefined) checks.push(condition.inc.some((value) => ua === value.toLowerCase()));\n    if (condition.ninc !== undefined) checks.push(!condition.ninc.some((value) => ua === value.toLowerCase()));\n    if (condition.pre !== undefined) checks.push(ua.startsWith(condition.pre.toLowerCase()));\n    if (condition.suf !== undefined) checks.push(ua.endsWith(condition.suf.toLowerCase()));\n    if (condition.re !== undefined) checks.push(safeRegExp(condition.re)?.test(agent) ?? false);\n    return checks.length > 0 && checks.every(Boolean);\n  });\n}\n\nexport interface FirewallRule {\n  /** Where the rule is recorded, for messages: `vercel.json routes[2]` or `hosting.firewall \"block-scrapers\"`. */\n  readonly source: string;\n  readonly action: string;\n  readonly userAgent: UserAgentCondition | string;\n}\n\n/** The firewall rules that match on the user agent: vercel.json `routes` with `mitigate`, and `hosting.firewall`. */\nexport function firewallRules(vercelJson: unknown, hosting: unknown): FirewallRule[] {\n  const rules: FirewallRule[] = [];\n  const routes = isRecord(vercelJson) && Array.isArray(vercelJson.routes) ? vercelJson.routes : [];\n  routes.forEach((route: unknown, index) => {\n    if (!isRecord(route) || !isRecord(route.mitigate) || typeof route.mitigate.action !== \"string\") return;\n    const has = Array.isArray(route.has) ? route.has : [];\n    for (const condition of has) {\n      if (!isRecord(condition) || condition.type !== \"header\" || String(condition.key).toLowerCase() !== \"user-agent\") continue;\n      const value = condition.value;\n      if (typeof value === \"string\" || isRecord(value)) {\n        rules.push({ source: `vercel.json routes[${index}]`, action: route.mitigate.action, userAgent: value as UserAgentCondition | string });\n      }\n    }\n  });\n  const recorded = isRecord(hosting) && Array.isArray(hosting.firewall) ? hosting.firewall : [];\n  for (const rule of recorded) {\n    if (!isRecord(rule) || !isRecord(rule.userAgent) || typeof rule.action !== \"string\") continue;\n    const { match, value } = rule.userAgent;\n    if ((match === \"contains\" || match === \"equals\" || match === \"regex\") && typeof value === \"string\") {\n      rules.push({ source: `hosting.firewall \"${String(rule.id)}\"`, action: rule.action, userAgent: { match, value } });\n    }\n  }\n  return rules;\n}\n\nconst BLOCKING_ACTIONS = new Set([\"deny\", \"challenge\"]);\n\nexport interface W10Input {\n  /** robots.txt text, or null when it could not be read; `robotsProblem` says why. */\n  readonly robotsTxt: string | null;\n  readonly robotsProblem?: string;\n  /**\n   * True when the robots.txt came from a Preview, closed on purpose: a running deployment that answers noindex, or a\n   * build made for a non-production environment whose robots.txt disallows everything.\n   */\n  readonly closedDeployment?: boolean;\n  /** Paths each crawler must be able to fetch: home and the representative routes. */\n  readonly paths: readonly string[];\n  readonly vercelJson: unknown;\n  readonly hosting: unknown;\n}\n\nexport function checkW10(input: W10Input): SiteSystemFinding[] {\n  const findings: SiteSystemFinding[] = [];\n  const crawlers: readonly BrandlabSearchCrawler[] = BRANDLAB_SEARCH_CRAWLERS;\n  if (input.closedDeployment) {\n    findings.push(notApplicable(\"W10\", \"robots.txt came from a Preview deployment or a build made for one, which stays closed to every crawler; W10 reads the production build (VERCEL_ENV=production next build, or --base-url on production).\"));\n  } else if (input.robotsTxt === null) {\n    findings.push(fail(\"W10\", \"/robots.txt\", input.robotsProblem ?? \"robots.txt could not be read, so the crawler guard could not check it.\"));\n  } else {\n    const groups = parseRobotsTxt(input.robotsTxt);\n    for (const crawler of crawlers) {\n      const blocked = input.paths.filter((path) => !robotsAllows(groups, crawler, path));\n      if (blocked.length > 0) {\n        findings.push(fail(\"W10\", \"/robots.txt\", `robots.txt blocks ${crawler} from ${blocked.join(\", \")}; search and answer crawlers stay allowed (no blanket robots rule).`));\n      }\n      const delay = robotsGroupsFor(groups, crawler).find((group) => group.crawlDelay !== null);\n      if (delay) {\n        findings.push(fail(\"W10\", \"/robots.txt\", `robots.txt gives ${crawler} a Crawl-delay of ${delay.crawlDelay}; Google ignores it and Bing honours it, so it only slows Bing indexing. Keep one only with a recorded decision and a Romie-owned W10 exception.`));\n      }\n    }\n  }\n  for (const rule of firewallRules(input.vercelJson, input.hosting)) {\n    const hit = crawlers.filter((crawler) => userAgentConditionMatches(rule.userAgent, crawler));\n    if (hit.length === 0) continue;\n    if (BLOCKING_ACTIONS.has(rule.action)) {\n      findings.push(fail(\"W10\", rule.source.startsWith(\"vercel.json\") ? \"vercel.json\" : \"brandlab.config.ts\", `The firewall rule ${rule.source} (${rule.action}) matches ${hit.join(\", \")}; search and answer crawlers must not be denied or challenged.`));\n    } else if (rule.action === \"rate-limit\") {\n      findings.push({ checkId: \"W10\", status: \"pass\", severity: \"warning\", target: \"brandlab.config.ts\", message: `The firewall rule ${rule.source} rate-limits ${hit.join(\", \")}; check it never stops their normal crawl.` });\n    }\n  }\n  if (findings.some((finding) => finding.status === \"fail\" || finding.status === \"not-applicable\")) return findings;\n  return [...findings, pass(\"W10\", `robots.txt and the recorded firewall rules leave ${crawlers.join(\", \")} open on ${input.paths.join(\", \")}, with no Crawl-delay.`)];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n"]}

package/dist/site-system/rules/guards/w9-params.d.ts

@@ -0,0 +1,19 @@
+import ts from "typescript";
+import type { SiteSystemFinding } from "../../checks.js";
+/** The page files under a dynamic segment, relative to the project, sorted. */
+export declare function dynamicRoutePageFiles(projectRoot: string): string[] | null;
+/** True when the module's directive prologue says `'use client'`. */
+export declare function isClientModule(source: ts.SourceFile): boolean;
+/**
+ * Where a source file names `searchParams` or `useSearchParams` in code (not in comments or strings), by 1-based line.
+ * `useSearchParams` in a `'use client'` module is the client-side reading the rule recommends, so it does not count
+ * there; the `searchParams` page prop always does.
+ */
+export declare function searchParamReads(fileName: string, text: string): {
+    line: number;
+    name: string;
+}[];
+/** The 1-based lines `searchParamReads` reports. */
+export declare function searchParamLines(fileName: string, text: string): number[];
+export declare function checkW9Params(projectRoot: string): SiteSystemFinding[];
+//# sourceMappingURL=w9-params.d.ts.map

package/dist/site-system/rules/guards/w9-params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"w9-params.d.ts","sourceRoot":"","sources":["../../../../src/site-system/rules/guards/w9-params.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAMzD,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAgB1E;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,GAAG,OAAO,CAM7D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAajG;AAED,oDAAoD;AACpD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAEzE;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAkBtE"}

package/dist/site-system/rules/guards/w9-params.js

@@ -0,0 +1,84 @@
+/**
+ * W9-params (3.13.0): a page under a dynamic route (`[slug]`, `[...slug]`) never reads `searchParams`. Reading it
+ * makes the page render per request, so every tracking query (`?utm_source=`, `?gclid=`) becomes an origin render and
+ * a separate cache entry instead of the prerendered page. A source scan of the page files under the app directory.
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+import ts from "typescript";
+import { fail, notApplicable, pass } from "../enquiry/common.js";
+const PAGE_FILE = /^page\.(?:tsx|ts|jsx|js)$/;
+const SEARCH_PARAM_NAMES = new Set(["searchParams", "useSearchParams"]);
+/** The page files under a dynamic segment, relative to the project, sorted. */
+export function dynamicRoutePageFiles(projectRoot) {
+    const appDir = ["src/app", "app"].map((path) => join(projectRoot, path)).find((path) => existsSync(path));
+    if (!appDir)
+        return null;
+    const files = [];
+    const visit = (directory, dynamic) => {
+        for (const entry of readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+            if (entry.isDirectory()) {
+                if (entry.name === "node_modules" || entry.name.startsWith("_"))
+                    continue;
+                visit(join(directory, entry.name), dynamic || /^\[.+\]$/.test(entry.name));
+            }
+            else if (dynamic && entry.isFile() && PAGE_FILE.test(entry.name)) {
+                files.push(relative(projectRoot, join(directory, entry.name)));
+            }
+        }
+    };
+    visit(appDir, false);
+    return files;
+}
+/** True when the module's directive prologue says `'use client'`. */
+export function isClientModule(source) {
+    for (const statement of source.statements) {
+        if (!ts.isExpressionStatement(statement) || !ts.isStringLiteral(statement.expression))
+            return false;
+        if (statement.expression.text === "use client")
+            return true;
+    }
+    return false;
+}
+/**
+ * Where a source file names `searchParams` or `useSearchParams` in code (not in comments or strings), by 1-based line.
+ * `useSearchParams` in a `'use client'` module is the client-side reading the rule recommends, so it does not count
+ * there; the `searchParams` page prop always does.
+ */
+export function searchParamReads(fileName, text) {
+    const source = ts.createSourceFile(fileName, text, ts.ScriptTarget.Latest, true, fileName.endsWith("x") ? ts.ScriptKind.TSX : ts.ScriptKind.TS);
+    const client = isClientModule(source);
+    const reads = new Map();
+    const visit = (node) => {
+        if (ts.isIdentifier(node) && SEARCH_PARAM_NAMES.has(node.text) && !(client && node.text === "useSearchParams")) {
+            const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1;
+            reads.set(`${line}:${node.text}`, { line, name: node.text });
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return [...reads.values()].sort((left, right) => left.line - right.line || left.name.localeCompare(right.name));
+}
+/** The 1-based lines `searchParamReads` reports. */
+export function searchParamLines(fileName, text) {
+    return [...new Set(searchParamReads(fileName, text).map((read) => read.line))];
+}
+export function checkW9Params(projectRoot) {
+    const files = dynamicRoutePageFiles(projectRoot);
+    if (files === null)
+        return [notApplicable("W9-params", "The project has no app directory to scan.")];
+    if (files.length === 0)
+        return [notApplicable("W9-params", "The project has no page under a dynamic route.")];
+    const failures = files.flatMap((file) => {
+        const reads = searchParamReads(file, readFileSync(join(projectRoot, file), "utf8"));
+        if (reads.length === 0)
+            return [];
+        const names = [...new Set(reads.map((read) => read.name))].join(" and ");
+        const lines = [...new Set(reads.map((read) => read.line))];
+        return [
+            fail("W9-params", file, `${file} reads ${names} (line ${lines.join(", ")}): a page under a dynamic route that reads the query renders at the origin for every tracking link (?utm_source=, ?gclid=) instead of serving its prerendered copy. Read the query in a 'use client' component with useSearchParams, inside a Suspense boundary, or move the page out of the dynamic route.`),
+        ];
+    });
+    return failures.length > 0 ? failures : [pass("W9-params", `None of the ${files.length} pages under a dynamic route reads searchParams.`)];
+}
+//# sourceMappingURL=w9-params.js.map

package/dist/site-system/rules/guards/w9-params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"w9-params.js","sourceRoot":"","sources":["../../../../src/site-system/rules/guards/w9-params.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,SAAS,GAAG,2BAA2B,CAAC;AAC9C,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAExE,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1G,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,SAAiB,EAAE,OAAgB,EAAE,EAAE;QACpD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/H,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC1E,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7E,CAAC;iBAAM,IAAI,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACpG,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,IAAY;IAC7D,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAChJ,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAChE,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,EAAE;QAC9B,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,CAAC,EAAE,CAAC;YAC/G,MAAM,IAAI,GAAG,MAAM,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YAClF,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,CAAC;IACd,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,IAAY;IAC7D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,MAAM,KAAK,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,2CAA2C,CAAC,CAAC,CAAC;IACrG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,gDAAgD,CAAC,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO;YACL,IAAI,CACF,WAAW,EACX,IAAI,EACJ,GAAG,IAAI,UAAU,KAAK,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6SAA6S,CAC9V;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,KAAK,CAAC,MAAM,kDAAkD,CAAC,CAAC,CAAC;AAC7I,CAAC","sourcesContent":["/**\n * W9-params (3.13.0): a page under a dynamic route (`[slug]`, `[...slug]`) never reads `searchParams`. Reading it\n * makes the page render per request, so every tracking query (`?utm_source=`, `?gclid=`) becomes an origin render and\n * a separate cache entry instead of the prerendered page. A source scan of the page files under the app directory.\n */\nimport { existsSync, readdirSync, readFileSync } from \"node:fs\";\nimport { join, relative } from \"node:path\";\nimport ts from \"typescript\";\nimport type { SiteSystemFinding } from \"../../checks.js\";\nimport { fail, notApplicable, pass } from \"../enquiry/common.js\";\n\nconst PAGE_FILE = /^page\\.(?:tsx|ts|jsx|js)$/;\nconst SEARCH_PARAM_NAMES = new Set([\"searchParams\", \"useSearchParams\"]);\n\n/** The page files under a dynamic segment, relative to the project, sorted. */\nexport function dynamicRoutePageFiles(projectRoot: string): string[] | null {\n  const appDir = [\"src/app\", \"app\"].map((path) => join(projectRoot, path)).find((path) => existsSync(path));\n  if (!appDir) return null;\n  const files: string[] = [];\n  const visit = (directory: string, dynamic: boolean) => {\n    for (const entry of readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {\n      if (entry.isDirectory()) {\n        if (entry.name === \"node_modules\" || entry.name.startsWith(\"_\")) continue;\n        visit(join(directory, entry.name), dynamic || /^\\[.+\\]$/.test(entry.name));\n      } else if (dynamic && entry.isFile() && PAGE_FILE.test(entry.name)) {\n        files.push(relative(projectRoot, join(directory, entry.name)));\n      }\n    }\n  };\n  visit(appDir, false);\n  return files;\n}\n\n/** True when the module's directive prologue says `'use client'`. */\nexport function isClientModule(source: ts.SourceFile): boolean {\n  for (const statement of source.statements) {\n    if (!ts.isExpressionStatement(statement) || !ts.isStringLiteral(statement.expression)) return false;\n    if (statement.expression.text === \"use client\") return true;\n  }\n  return false;\n}\n\n/**\n * Where a source file names `searchParams` or `useSearchParams` in code (not in comments or strings), by 1-based line.\n * `useSearchParams` in a `'use client'` module is the client-side reading the rule recommends, so it does not count\n * there; the `searchParams` page prop always does.\n */\nexport function searchParamReads(fileName: string, text: string): { line: number; name: string }[] {\n  const source = ts.createSourceFile(fileName, text, ts.ScriptTarget.Latest, true, fileName.endsWith(\"x\") ? ts.ScriptKind.TSX : ts.ScriptKind.TS);\n  const client = isClientModule(source);\n  const reads = new Map<string, { line: number; name: string }>();\n  const visit = (node: ts.Node) => {\n    if (ts.isIdentifier(node) && SEARCH_PARAM_NAMES.has(node.text) && !(client && node.text === \"useSearchParams\")) {\n      const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1;\n      reads.set(`${line}:${node.text}`, { line, name: node.text });\n    }\n    ts.forEachChild(node, visit);\n  };\n  visit(source);\n  return [...reads.values()].sort((left, right) => left.line - right.line || left.name.localeCompare(right.name));\n}\n\n/** The 1-based lines `searchParamReads` reports. */\nexport function searchParamLines(fileName: string, text: string): number[] {\n  return [...new Set(searchParamReads(fileName, text).map((read) => read.line))];\n}\n\nexport function checkW9Params(projectRoot: string): SiteSystemFinding[] {\n  const files = dynamicRoutePageFiles(projectRoot);\n  if (files === null) return [notApplicable(\"W9-params\", \"The project has no app directory to scan.\")];\n  if (files.length === 0) return [notApplicable(\"W9-params\", \"The project has no page under a dynamic route.\")];\n  const failures = files.flatMap((file) => {\n    const reads = searchParamReads(file, readFileSync(join(projectRoot, file), \"utf8\"));\n    if (reads.length === 0) return [];\n    const names = [...new Set(reads.map((read) => read.name))].join(\" and \");\n    const lines = [...new Set(reads.map((read) => read.line))];\n    return [\n      fail(\n        \"W9-params\",\n        file,\n        `${file} reads ${names} (line ${lines.join(\", \")}): a page under a dynamic route that reads the query renders at the origin for every tracking link (?utm_source=, ?gclid=) instead of serving its prerendered copy. Read the query in a 'use client' component with useSearchParams, inside a Suspense boundary, or move the page out of the dynamic route.`,\n      ),\n    ];\n  });\n  return failures.length > 0 ? failures : [pass(\"W9-params\", `None of the ${files.length} pages under a dynamic route reads searchParams.`)];\n}\n"]}

package/dist/site-system-e2e.d.ts

@@ -2,5 +2,6 @@ import { type BrandlabSiteSystemTestOptions } from './site-system/journeys/plan.
 export { SITE_SYSTEM_DESKTOP_VIEWPORT, SITE_SYSTEM_DESKTOP_WIDTHS, SITE_SYSTEM_JOURNEY_IDS, SITE_SYSTEM_PHONE_VIEWPORT, SITE_SYSTEM_QUOTE_NAME, planBrandlabSiteSystemJourneys, siteSystemJourneyTitle, siteSystemJourneysFor, type BrandlabSiteSystemTestOptions, type SiteSystemActionOrder, type SiteSystemJourneyId, type SiteSystemJourneyPlan, } from './site-system/journeys/plan.js';
 export { HOVER_OPEN_WINDOW_MS, MOUSE_OUT_CLOSE_WINDOW_MS } from './site-system/journeys/menu.js';
 export { SITE_SYSTEM_PHONE_PLACEMENTS } from './site-system/journeys/page-helpers.js';
+export { W9_CACHE_HEADERS, W9_TRACKING_QUERY, W9_UNKNOWN_SLUG, notFoundVariantProblems, trackingVariantProblems, urlVariants, type W9Response, type W9Variants, } from './site-system/journeys/variants.js';
 export declare function defineBrandlabSiteSystemTests(options: BrandlabSiteSystemTestOptions): void;
 //# sourceMappingURL=site-system-e2e.d.ts.map

package/dist/site-system-e2e.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"site-system-e2e.d.ts","sourceRoot":"","sources":["../src/site-system-e2e.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAkC,KAAK,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAGpH,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAItF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,6BAA6B,GAAG,IAAI,CAqB1F"}
+{"version":3,"file":"site-system-e2e.d.ts","sourceRoot":"","sources":["../src/site-system-e2e.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAkC,KAAK,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAKpH,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,WAAW,EACX,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,oCAAoC,CAAC;AAI5C,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,6BAA6B,GAAG,IAAI,CAuB1F"}