@brandlab-digital/conformance 3.3.3 → 3.4.1

package/dist/rule-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"rule-registry.js","sourceRoot":"","sources":["../src/rule-registry.ts"],"names":[],"mappings":"AAeA,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,EAAE,MAAM,EAAE,uCAAuC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,uCAAuC,GAAG;IAC1J,EAAE,MAAM,EAAE,+CAA+C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,6DAA6D,GAAG;IACxL,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,0DAA0D,GAAG;IACpK,EAAE,MAAM,EAAE,8CAA8C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,2CAA2C,GAAG;IACrK,EAAE,MAAM,EAAE,uCAAuC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,6CAA6C,GAAG;IAChK,EAAE,MAAM,EAAE,uCAAuC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,gEAAgE,GAAG;IACnL,EAAE,MAAM,EAAE,8CAA8C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,oFAAoF,GAAG;IAC9M,EAAE,MAAM,EAAE,6CAA6C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,kFAAkF,GAAG;IAC3M,EAAE,MAAM,EAAE,4BAA4B,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,yEAAyE,GAAG;IAC/K,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,kEAAkE,GAAG;IACzK,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,oEAAoE,GAAG;IACrK,EAAE,MAAM,EAAE,kCAAkC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,GAAG;IAC1J,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,uEAAuE,GAAG;IACzK,EAAE,MAAM,EAAE,uCAAuC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,2DAA2D,GAAG;IAC5K,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,sGAAsG,GAAG;IAC9M,EAAE,MAAM,EAAE,wCAAwC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,0OAA0O,GAAG;IAC5V,EAAE,MAAM,EAAE,yCAAyC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,2GAA2G,GAAG;IAClO,EAAE,MAAM,EAAE,4CAA4C,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,wDAAwD,GAAG;IAClL,EAAE,MAAM,EAAE,4CAA4C,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,6FAA6F,GAAG;IACpN,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,yDAAyD,GAAG;IACnK,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,4BAA4B,GAAG;IAC3H,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,uEAAuE,GAAG;IACtK,EAAE,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,0EAA0E,GAAG;IAC3K,EAAE,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,6GAA6G,GAAG;IACpN,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,sEAAsE,GAAG;IACtK,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,uEAAuE,GAAG;IAC/K,EAAE,MAAM,EAAE,wCAAwC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,uDAAuD,GAAG;IACvK,EAAE,MAAM,EAAE,8CAA8C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,gEAAgE,GAAG;IACtL,EAAE,MAAM,EAAE,2CAA2C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,+DAA+D,GAAG;IAClL,EAAE,MAAM,EAAE,2CAA2C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,yDAAyD,GAAG;IAC5K,EAAE,MAAM,EAAE,uCAAuC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,uDAAuD,GAAG;IACtK,EAAE,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,yBAAyB,EAAE,OAAO,EAAE,oGAAoG,GAAG;IACrN,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,qGAAqG,GAAG;IACjN,EAAE,MAAM,EAAE,yCAAyC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,kHAAkH,GAAG;IAC1O,EAAE,MAAM,EAAE,4CAA4C,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,0DAA0D,GAAG;IACrL,EAAE,MAAM,EAAE,qCAAqC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,6DAA6D,GAAG;IACjL,EAAE,MAAM,EAAE,uCAAuC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,+GAA+G,GAAG;IAClO,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,iFAAiF,GAAG;IAC7L,EAAE,MAAM,EAAE,oCAAoC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,iHAAiH,GAAG;IACpO,EAAE,MAAM,EAAE,sCAAsC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,gEAAgE,GAAG;IACrL,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,4DAA4D,GAAG;IAC1K,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,kGAAkG,GAAG;IACvM,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,4GAA4G,GAAG;IACnN,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,mFAAmF,GAAG;IACvL,EAAE,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,oEAAoE,GAAG;IAC7K,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,wGAAwG,GAAG;IACxM,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,0DAA0D,GAAG;IAC9J,EAAE,MAAM,EAAE,4CAA4C,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,yCAAyC,GAAG;IAC5J,EAAE,MAAM,EAAE,wCAAwC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,2BAA2B,GAAG;IAC1I,EAAE,MAAM,EAAE,4CAA4C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,sEAAsE,GAAG;IAC1L,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,6EAA6E,GAAG;IACjL,EAAE,MAAM,EAAE,yCAAyC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,gMAAgM,GAAG;IACtT,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,0EAA0E,GAAG;IAC7K,EAAE,MAAM,EAAE,2CAA2C,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,0HAA0H,GAAG;IAC1O,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,8fAA8f,GAAG;IAChmB,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,0EAA0E,GAAG;IAC1L,EAAE,MAAM,EAAE,2CAA2C,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,iEAAiE,GAAG;CAC1I,CAAC;AAEnD,6FAA6F;AAC7F,MAAM,UAAU,yBAAyB,CAAC,IAAwB,EAAE,MAAc;IAChF,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;IACzH,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC","sourcesContent":["import type { BrandlabVerificationCheckId } from \"./verification-policy.js\";\n\n/**\n * Every static rule the evaluator can run, the check it evaluates and what it\n * proves. `<placeholder>` segments stand for the concrete package, capability,\n * key or state named in each finding. The generated rule reference is built\n * from this list, and tests keep it identical to the evaluator.\n */\nexport interface BrandlabStaticRule {\n  ruleId: string;\n  surface: string;\n  checkId: BrandlabVerificationCheckId;\n  summary: string;\n}\n\nexport const BRANDLAB_STATIC_RULES = [\n  { ruleId: \"brandlab-release-package-json-missing\", surface: \"release\", checkId: \"release-consistency\", summary: \"package.json is present and readable.\", },\n  { ruleId: \"brandlab-release-installed-version-unresolved\", surface: \"release\", checkId: \"release-consistency\", summary: \"All four Brandlab packages are pinned to one exact release.\", },\n  { ruleId: \"brandlab-release-unsupported\", surface: \"release\", checkId: \"release-consistency\", summary: \"The installed release is the one this checker certifies.\", },\n  { ruleId: \"brandlab-release-declared-installed-mismatch\", surface: \"release\", checkId: \"release-consistency\", summary: \"The declared and detected releases agree.\", },\n  { ruleId: \"brandlab-release-package-lock-<state>\", surface: \"release\", checkId: \"release-consistency\", summary: \"A valid npm lockfile v2 or v3 is committed.\", },\n  { ruleId: \"brandlab-release-package-pin-mismatch\", surface: \"release\", checkId: \"release-consistency\", summary: \"Each package is declared once and locked at the exact release.\", },\n  { ruleId: \"brandlab-release-package-resolution-mismatch\", surface: \"release\", checkId: \"release-consistency\", summary: \"The lockfile resolves each package from the canonical npm registry with integrity.\", },\n  { ruleId: \"brandlab-release-package-integrity-mismatch\", surface: \"release\", checkId: \"release-consistency\", summary: \"With --release-manifest, lockfile integrity equals the immutable release record.\", },\n  { ruleId: \"brandlab-runtime-<package>\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"next, react, react-dom and typescript use versions the release permits.\", },\n  { ruleId: \"brandlab-runtime-react-pair\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"react and react-dom are declared and locked at the same version.\", },\n  { ruleId: \"brandlab-runtime-node\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"engines.node matches the release in package.json and the lockfile.\", },\n  { ruleId: \"brandlab-runtime-package-manager\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"packageManager is the release's npm version.\", },\n  { ruleId: \"brandlab-runtime-sharp\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"Sharp is pinned only by overrides.sharp with one lockfile resolution.\", },\n  { ruleId: \"brandlab-runtime-image-initialisation\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"next.config imports the shared image-runtime guard first.\", },\n  { ruleId: \"brandlab-runtime-next-config\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"next.config exports defineBrandlabNextConfig, which owns headers, image formats and Preview noindex.\", },\n  { ruleId: \"brandlab-runtime-image-remote-patterns\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"Image remote patterns are https on public hosts (from 3.3.3 a production build refuses http and local ones, and wildcard hosts that admit a local address); any other wildcard host, or every path of another site's host, is a warning.\", },\n  { ruleId: \"brandlab-environment-<capability>-<key>\", surface: \"environment\", checkId: \"runtime-supported\", summary: \".env.example documents each variable an enabled capability reads, including the contract's recipient key.\", },\n  { ruleId: \"brandlab-environment-retired-contact-state\", surface: \"environment\", checkId: \"runtime-supported\", summary: \".env.example lists no retired contact state variables.\", },\n  { ruleId: \"brandlab-source-dangerously-set-inner-html\", surface: \"security\", checkId: \"runtime-supported\", summary: \"No project-owned dangerouslySetInnerHTML; only SchemaScript and SafeRichText inject markup.\", },\n  { ruleId: \"brandlab-source-public-secret\", surface: \"security\", checkId: \"runtime-supported\", summary: \"No API key, secret or token behind a NEXT_PUBLIC_ name.\", },\n  { ruleId: \"brandlab-config-missing\", surface: \"routes\", checkId: \"route-identity\", summary: \"brandlab.config.ts exists.\", },\n  { ruleId: \"brandlab-config-invalid\", surface: \"routes\", checkId: \"route-identity\", summary: \"brandlab.config.ts is a literal defineBrandlabProject with projectId.\", },\n  { ruleId: \"brandlab-routes-catalogue\", surface: \"routes\", checkId: \"route-identity\", summary: \"Exactly one module declares the route catalogue with defineRouteCatalog.\", },\n  { ruleId: \"brandlab-routes-location-estate\", surface: \"routes\", checkId: \"route-identity\", summary: \"A project that publishes locations declares them in src/data/locations/estate.ts with defineLocationEstate.\", },\n  { ruleId: \"brandlab-redirects-table\", surface: \"routes\", checkId: \"route-identity\", summary: \"Exactly one module declares the redirect table with defineRedirects.\", },\n  { ruleId: \"brandlab-contact-recipient-env\", surface: \"contact\", checkId: \"contact-runtime\", summary: \"The contact contract declares delivery.recipientEnv as a literal key.\", },\n  { ruleId: \"brandlab-source-local-contact-delivery\", surface: \"contact\", checkId: \"contact-runtime\", summary: \"Email delivery is left to the shared contact runtime.\", },\n  { ruleId: \"brandlab-source-local-contact-email-renderer\", surface: \"contact\", checkId: \"contact-runtime\", summary: \"Contact email rendering is left to the shared contact runtime.\", },\n  { ruleId: \"brandlab-source-local-contact-attachments\", surface: \"contact\", checkId: \"contact-runtime\", summary: \"Attachment preparation is left to the shared contact runtime.\", },\n  { ruleId: \"brandlab-source-contact-draft-persistence\", surface: \"contact\", checkId: \"contact-runtime\", summary: \"Contact details are never persisted in browser storage.\", },\n  { ruleId: \"brandlab-source-retired-contact-state\", surface: \"contact\", checkId: \"contact-runtime\", summary: \"No retired contact state service variables in source.\", },\n  { ruleId: \"brandlab-contact-provider-route\", surface: \"contact\", checkId: \"contact-provider-errors\", summary: \"POST /api/contact is created by the shared handler, so provider errors are handled by the runtime.\", },\n  { ruleId: \"brandlab-analytics-pii-payload\", surface: \"analytics\", checkId: \"analytics-privacy\", summary: \"No lead fields, messages or attachment details in analytics payloads, and no project-set user_data.\", },\n  { ruleId: \"brandlab-source-retired-analytics-event\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"Only current event names are sent: contact_form for accepted enquiries and phone_link_click as a tap diagnostic.\", },\n  { ruleId: \"brandlab-source-local-google-tag-bootstrap\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"The Google tag bootstrap is owned by the shared runtime.\", },\n  { ruleId: \"brandlab-analytics-google-tag-owner\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"Exactly one BrandlabGoogleTag, rendered by the root layout.\", },\n  { ruleId: \"brandlab-analytics-google-tag-consent\", surface: \"analytics\", checkId: \"analytics-privacy\", summary: \"BrandlabGoogleTag takes its ad_user_data consent default from the analytics binding: no adUserData attribute.\", },\n  { ruleId: \"brandlab-analytics-contract\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"Exactly one module declares the analytics binding with defineBrandlabAnalytics.\", },\n  { ruleId: \"brandlab-analytics-instrumentation\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"src/instrumentation-client.ts calls installBrandlabInstrumentation, which reports one phone_link_click per tap.\", },\n  { ruleId: \"brandlab-analytics-retired-phone-api\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"No trackPhoneCall; taps are reported once as phone_link_click.\", },\n  { ruleId: \"brandlab-analytics-web-vitals\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"No web-vitals reporter, web_vital event or webVitals flag.\", },\n  { ruleId: \"brandlab-robots-package-route\", surface: \"robots\", checkId: \"search-routing\", summary: \"robots is a thin binding of @brandlab-digital/site-next/robots with no static public/robots.txt.\", },\n  { ruleId: \"brandlab-sitemap-package-route\", surface: \"sitemap\", checkId: \"search-routing\", summary: \"The sitemap route uses the shared sitemap API over the route catalogue, with no static public/sitemap.xml.\", },\n  { ruleId: \"brandlab-sitemap-split-mode\", surface: \"sitemap\", checkId: \"search-routing\", summary: \"/sitemaps/[chunk] exists exactly when brandlab.config sets sitemap.mode: 'split'.\", },\n  { ruleId: \"brandlab-metadata-route-builder\", surface: \"metadata\", checkId: \"search-routing\", summary: \"Page metadata comes from createRouteMetadataBuilder(site, routes).\", },\n  { ruleId: \"brandlab-site-identity\", surface: \"metadata\", checkId: \"search-routing\", summary: \"Exactly one module declares the site identity (canonical URL, locale, titles) with defineBrandlabSite.\", },\n  { ruleId: \"brandlab-source-raw-json-ld\", surface: \"schema\", checkId: \"structured-data\", summary: \"JSON-LD is rendered only by the shared schema component.\", },\n  { ruleId: \"brandlab-source-self-serving-rating-schema\", surface: \"schema\", checkId: \"structured-data\", summary: \"No self-serving AggregateRating schema.\", },\n  { ruleId: \"brandlab-source-synthetic-offer-schema\", surface: \"schema\", checkId: \"structured-data\", summary: \"No invented Offer markup.\", },\n  { ruleId: \"brandlab-source-local-google-reviews-fetch\", surface: \"reviews\", checkId: \"structured-data\", summary: \"Google Places reviews are fetched only by the shared review runtime.\", },\n  { ruleId: \"brandlab-business-facts\", surface: \"business\", checkId: \"business-identity\", summary: \"Exactly one module declares the business facts with defineBrandlabBusiness.\", },\n  { ruleId: \"brandlab-content-implementation-wording\", surface: \"content\", checkId: \"public-output-safety\", summary: \"Everything that renders publicly (pages, components, metadata, schema, alt text, MDX, Markdown and JSON content) carries finished copy, not template, helper, scaffold or placeholder wording.\", },\n  { ruleId: \"brandlab-source-root-missing\", surface: \"source\", checkId: \"source-safety\", summary: \"Project source sits under a recognised root so the source rules can run.\", },\n  { ruleId: \"brandlab-source-platform-reimplementation\", surface: \"source\", checkId: \"source-safety\", summary: \"Protected platform surfaces (SchemaScript, SafeRichText, contact, sitemap, analytics APIs) are imported, not redeclared.\", },\n  { ruleId: \"brandlab-source-retired-api\", surface: \"source\", checkId: \"source-safety\", summary: \"No API, option or configuration key removed in 3.0 (TrackedTelephoneLink, shouldIndexSite, buildRobotsMetadata, buildSeoMetadata and the duplicate metadata builders, isBrandlabProductionDeployment, resolveBrowserAnalyticsConfig, resolveBrandlabGoogleTagConfig, the contact submission controller and its lead-tracking helpers (use useBrandlabContactForm), header profiles and isProduction, xRobotsTag, contentSecurityPolicyMode, leadDiagnostics, ALLOW_INDEXING, NEXT_PUBLIC_SITE_URL, profile, routes.aliases).\", },\n  { ruleId: \"brandlab-ci-workflow-pinned\", surface: \"project-verification\", checkId: \"project-build\", summary: \"Every reused workflow and action is pinned to a 40-character commit SHA.\", },\n  { ruleId: \"brandlab-deployment-vercelignore-lockfile\", surface: \"deployment\", checkId: \"deployment-binding\", summary: \".vercelignore never excludes package.json or package-lock.json.\", },\n] as const satisfies readonly BrandlabStaticRule[];\n\n/** Whether a concrete rule ID (from a finding or evaluation) belongs to a registry entry. */\nexport function matchesBrandlabStaticRule(rule: BrandlabStaticRule, ruleId: string): boolean {\n  if (rule.ruleId === ruleId) return true;\n  if (!rule.ruleId.includes(\"<\")) return false;\n  const stem = rule.ruleId.slice(0, rule.ruleId.indexOf(\"-<\"));\n  const pattern = new RegExp(`^${rule.ruleId.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\").replace(/<[a-z]+>/g, \"[a-z0-9-]+\")}$`);\n  return ruleId === stem || pattern.test(ruleId);\n}\n"]}
+{"version":3,"file":"rule-registry.js","sourceRoot":"","sources":["../src/rule-registry.ts"],"names":[],"mappings":"AAeA,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,EAAE,MAAM,EAAE,uCAAuC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,uCAAuC,GAAG;IAC1J,EAAE,MAAM,EAAE,+CAA+C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,6DAA6D,GAAG;IACxL,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,0DAA0D,GAAG;IACpK,EAAE,MAAM,EAAE,8CAA8C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,2CAA2C,GAAG;IACrK,EAAE,MAAM,EAAE,uCAAuC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,6CAA6C,GAAG;IAChK,EAAE,MAAM,EAAE,uCAAuC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,gEAAgE,GAAG;IACnL,EAAE,MAAM,EAAE,8CAA8C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,oFAAoF,GAAG;IAC9M,EAAE,MAAM,EAAE,6CAA6C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,kFAAkF,GAAG;IAC3M,EAAE,MAAM,EAAE,4BAA4B,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,yEAAyE,GAAG;IAC/K,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,kEAAkE,GAAG;IACzK,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,oEAAoE,GAAG;IACrK,EAAE,MAAM,EAAE,kCAAkC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,GAAG;IAC1J,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,uEAAuE,GAAG;IACzK,EAAE,MAAM,EAAE,uCAAuC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,2DAA2D,GAAG;IAC5K,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,sGAAsG,GAAG;IAC9M,EAAE,MAAM,EAAE,wCAAwC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,0OAA0O,GAAG;IAC5V,EAAE,MAAM,EAAE,yCAAyC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,2GAA2G,GAAG;IAClO,EAAE,MAAM,EAAE,4CAA4C,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,wDAAwD,GAAG;IAClL,EAAE,MAAM,EAAE,4CAA4C,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,6FAA6F,GAAG;IACpN,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,yDAAyD,GAAG;IACnK,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,4BAA4B,GAAG;IAC3H,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,uEAAuE,GAAG;IACtK,EAAE,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,0EAA0E,GAAG;IAC3K,EAAE,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,6GAA6G,GAAG;IACpN,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,sEAAsE,GAAG;IACtK,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,uEAAuE,GAAG;IAC/K,EAAE,MAAM,EAAE,wCAAwC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,uDAAuD,GAAG;IACvK,EAAE,MAAM,EAAE,8CAA8C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,gEAAgE,GAAG;IACtL,EAAE,MAAM,EAAE,2CAA2C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,+DAA+D,GAAG;IAClL,EAAE,MAAM,EAAE,2CAA2C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,yDAAyD,GAAG;IAC5K,EAAE,MAAM,EAAE,uCAAuC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,uDAAuD,GAAG;IACtK,EAAE,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,yBAAyB,EAAE,OAAO,EAAE,oGAAoG,GAAG;IACrN,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,qGAAqG,GAAG;IACjN,EAAE,MAAM,EAAE,yCAAyC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,kHAAkH,GAAG;IAC1O,EAAE,MAAM,EAAE,4CAA4C,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,0DAA0D,GAAG;IACrL,EAAE,MAAM,EAAE,qCAAqC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,6DAA6D,GAAG;IACjL,EAAE,MAAM,EAAE,uCAAuC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,+GAA+G,GAAG;IAClO,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,iFAAiF,GAAG;IAC7L,EAAE,MAAM,EAAE,oCAAoC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,iHAAiH,GAAG;IACpO,EAAE,MAAM,EAAE,sCAAsC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,gEAAgE,GAAG;IACrL,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,4DAA4D,GAAG;IAC1K,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,kGAAkG,GAAG;IACvM,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,4GAA4G,GAAG;IACnN,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,mFAAmF,GAAG;IACvL,EAAE,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,oEAAoE,GAAG;IAC7K,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,wGAAwG,GAAG;IACxM,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,0DAA0D,GAAG;IAC9J,EAAE,MAAM,EAAE,4CAA4C,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,yCAAyC,GAAG;IAC5J,EAAE,MAAM,EAAE,kCAAkC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,6BAA6B,GAAG;IACtI,EAAE,MAAM,EAAE,qCAAqC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,mGAAmG,GAAG;IAC/M,EAAE,MAAM,EAAE,wCAAwC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,2BAA2B,GAAG;IAC1I,EAAE,MAAM,EAAE,4CAA4C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,sEAAsE,GAAG;IAC1L,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,6EAA6E,GAAG;IACjL,EAAE,MAAM,EAAE,yCAAyC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,gMAAgM,GAAG;IACtT,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,0EAA0E,GAAG;IAC7K,EAAE,MAAM,EAAE,2CAA2C,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,0HAA0H,GAAG;IAC1O,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,8fAA8f,GAAG;IAChmB,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,0EAA0E,GAAG;IAC1L,EAAE,MAAM,EAAE,2CAA2C,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,iEAAiE,GAAG;CAC1I,CAAC;AAEnD,6FAA6F;AAC7F,MAAM,UAAU,yBAAyB,CAAC,IAAwB,EAAE,MAAc;IAChF,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;IACzH,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC","sourcesContent":["import type { BrandlabVerificationCheckId } from \"./verification-policy.js\";\n\n/**\n * Every static rule the evaluator can run, the check it evaluates and what it\n * proves. `<placeholder>` segments stand for the concrete package, capability,\n * key or state named in each finding. The generated rule reference is built\n * from this list, and tests keep it identical to the evaluator.\n */\nexport interface BrandlabStaticRule {\n  ruleId: string;\n  surface: string;\n  checkId: BrandlabVerificationCheckId;\n  summary: string;\n}\n\nexport const BRANDLAB_STATIC_RULES = [\n  { ruleId: \"brandlab-release-package-json-missing\", surface: \"release\", checkId: \"release-consistency\", summary: \"package.json is present and readable.\", },\n  { ruleId: \"brandlab-release-installed-version-unresolved\", surface: \"release\", checkId: \"release-consistency\", summary: \"All four Brandlab packages are pinned to one exact release.\", },\n  { ruleId: \"brandlab-release-unsupported\", surface: \"release\", checkId: \"release-consistency\", summary: \"The installed release is the one this checker certifies.\", },\n  { ruleId: \"brandlab-release-declared-installed-mismatch\", surface: \"release\", checkId: \"release-consistency\", summary: \"The declared and detected releases agree.\", },\n  { ruleId: \"brandlab-release-package-lock-<state>\", surface: \"release\", checkId: \"release-consistency\", summary: \"A valid npm lockfile v2 or v3 is committed.\", },\n  { ruleId: \"brandlab-release-package-pin-mismatch\", surface: \"release\", checkId: \"release-consistency\", summary: \"Each package is declared once and locked at the exact release.\", },\n  { ruleId: \"brandlab-release-package-resolution-mismatch\", surface: \"release\", checkId: \"release-consistency\", summary: \"The lockfile resolves each package from the canonical npm registry with integrity.\", },\n  { ruleId: \"brandlab-release-package-integrity-mismatch\", surface: \"release\", checkId: \"release-consistency\", summary: \"With --release-manifest, lockfile integrity equals the immutable release record.\", },\n  { ruleId: \"brandlab-runtime-<package>\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"next, react, react-dom and typescript use versions the release permits.\", },\n  { ruleId: \"brandlab-runtime-react-pair\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"react and react-dom are declared and locked at the same version.\", },\n  { ruleId: \"brandlab-runtime-node\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"engines.node matches the release in package.json and the lockfile.\", },\n  { ruleId: \"brandlab-runtime-package-manager\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"packageManager is the release's npm version.\", },\n  { ruleId: \"brandlab-runtime-sharp\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"Sharp is pinned only by overrides.sharp with one lockfile resolution.\", },\n  { ruleId: \"brandlab-runtime-image-initialisation\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"next.config imports the shared image-runtime guard first.\", },\n  { ruleId: \"brandlab-runtime-next-config\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"next.config exports defineBrandlabNextConfig, which owns headers, image formats and Preview noindex.\", },\n  { ruleId: \"brandlab-runtime-image-remote-patterns\", surface: \"runtime\", checkId: \"runtime-supported\", summary: \"Image remote patterns are https on public hosts (from 3.3.3 a production build refuses http and local ones, and wildcard hosts that admit a local address); any other wildcard host, or every path of another site's host, is a warning.\", },\n  { ruleId: \"brandlab-environment-<capability>-<key>\", surface: \"environment\", checkId: \"runtime-supported\", summary: \".env.example documents each variable an enabled capability reads, including the contract's recipient key.\", },\n  { ruleId: \"brandlab-environment-retired-contact-state\", surface: \"environment\", checkId: \"runtime-supported\", summary: \".env.example lists no retired contact state variables.\", },\n  { ruleId: \"brandlab-source-dangerously-set-inner-html\", surface: \"security\", checkId: \"runtime-supported\", summary: \"No project-owned dangerouslySetInnerHTML; only SchemaScript and SafeRichText inject markup.\", },\n  { ruleId: \"brandlab-source-public-secret\", surface: \"security\", checkId: \"runtime-supported\", summary: \"No API key, secret or token behind a NEXT_PUBLIC_ name.\", },\n  { ruleId: \"brandlab-config-missing\", surface: \"routes\", checkId: \"route-identity\", summary: \"brandlab.config.ts exists.\", },\n  { ruleId: \"brandlab-config-invalid\", surface: \"routes\", checkId: \"route-identity\", summary: \"brandlab.config.ts is a literal defineBrandlabProject with projectId.\", },\n  { ruleId: \"brandlab-routes-catalogue\", surface: \"routes\", checkId: \"route-identity\", summary: \"Exactly one module declares the route catalogue with defineRouteCatalog.\", },\n  { ruleId: \"brandlab-routes-location-estate\", surface: \"routes\", checkId: \"route-identity\", summary: \"A project that publishes locations declares them in src/data/locations/estate.ts with defineLocationEstate.\", },\n  { ruleId: \"brandlab-redirects-table\", surface: \"routes\", checkId: \"route-identity\", summary: \"Exactly one module declares the redirect table with defineRedirects.\", },\n  { ruleId: \"brandlab-contact-recipient-env\", surface: \"contact\", checkId: \"contact-runtime\", summary: \"The contact contract declares delivery.recipientEnv as a literal key.\", },\n  { ruleId: \"brandlab-source-local-contact-delivery\", surface: \"contact\", checkId: \"contact-runtime\", summary: \"Email delivery is left to the shared contact runtime.\", },\n  { ruleId: \"brandlab-source-local-contact-email-renderer\", surface: \"contact\", checkId: \"contact-runtime\", summary: \"Contact email rendering is left to the shared contact runtime.\", },\n  { ruleId: \"brandlab-source-local-contact-attachments\", surface: \"contact\", checkId: \"contact-runtime\", summary: \"Attachment preparation is left to the shared contact runtime.\", },\n  { ruleId: \"brandlab-source-contact-draft-persistence\", surface: \"contact\", checkId: \"contact-runtime\", summary: \"Contact details are never persisted in browser storage.\", },\n  { ruleId: \"brandlab-source-retired-contact-state\", surface: \"contact\", checkId: \"contact-runtime\", summary: \"No retired contact state service variables in source.\", },\n  { ruleId: \"brandlab-contact-provider-route\", surface: \"contact\", checkId: \"contact-provider-errors\", summary: \"POST /api/contact is created by the shared handler, so provider errors are handled by the runtime.\", },\n  { ruleId: \"brandlab-analytics-pii-payload\", surface: \"analytics\", checkId: \"analytics-privacy\", summary: \"No lead fields, messages or attachment details in analytics payloads, and no project-set user_data.\", },\n  { ruleId: \"brandlab-source-retired-analytics-event\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"Only current event names are sent: contact_form for accepted enquiries and phone_link_click as a tap diagnostic.\", },\n  { ruleId: \"brandlab-source-local-google-tag-bootstrap\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"The Google tag bootstrap is owned by the shared runtime.\", },\n  { ruleId: \"brandlab-analytics-google-tag-owner\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"Exactly one BrandlabGoogleTag, rendered by the root layout.\", },\n  { ruleId: \"brandlab-analytics-google-tag-consent\", surface: \"analytics\", checkId: \"analytics-privacy\", summary: \"BrandlabGoogleTag takes its ad_user_data consent default from the analytics binding: no adUserData attribute.\", },\n  { ruleId: \"brandlab-analytics-contract\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"Exactly one module declares the analytics binding with defineBrandlabAnalytics.\", },\n  { ruleId: \"brandlab-analytics-instrumentation\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"src/instrumentation-client.ts calls installBrandlabInstrumentation, which reports one phone_link_click per tap.\", },\n  { ruleId: \"brandlab-analytics-retired-phone-api\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"No trackPhoneCall; taps are reported once as phone_link_click.\", },\n  { ruleId: \"brandlab-analytics-web-vitals\", surface: \"analytics\", checkId: \"analytics-conversion\", summary: \"No web-vitals reporter, web_vital event or webVitals flag.\", },\n  { ruleId: \"brandlab-robots-package-route\", surface: \"robots\", checkId: \"search-routing\", summary: \"robots is a thin binding of @brandlab-digital/site-next/robots with no static public/robots.txt.\", },\n  { ruleId: \"brandlab-sitemap-package-route\", surface: \"sitemap\", checkId: \"search-routing\", summary: \"The sitemap route uses the shared sitemap API over the route catalogue, with no static public/sitemap.xml.\", },\n  { ruleId: \"brandlab-sitemap-split-mode\", surface: \"sitemap\", checkId: \"search-routing\", summary: \"/sitemaps/[chunk] exists exactly when brandlab.config sets sitemap.mode: 'split'.\", },\n  { ruleId: \"brandlab-metadata-route-builder\", surface: \"metadata\", checkId: \"search-routing\", summary: \"Page metadata comes from createRouteMetadataBuilder(site, routes).\", },\n  { ruleId: \"brandlab-site-identity\", surface: \"metadata\", checkId: \"search-routing\", summary: \"Exactly one module declares the site identity (canonical URL, locale, titles) with defineBrandlabSite.\", },\n  { ruleId: \"brandlab-source-raw-json-ld\", surface: \"schema\", checkId: \"structured-data\", summary: \"JSON-LD is rendered only by the shared schema component.\", },\n  { ruleId: \"brandlab-source-self-serving-rating-schema\", surface: \"schema\", checkId: \"structured-data\", summary: \"No self-serving AggregateRating schema.\", },\n  { ruleId: \"brandlab-source-faq-howto-schema\", surface: \"schema\", checkId: \"structured-data\", summary: \"No FAQPage or HowTo markup.\", },\n  { ruleId: \"brandlab-sitemap-build-time-lastmod\", surface: \"sitemap\", checkId: \"search-routing\", summary: \"Sitemap lastmod comes from content dates (lastSignificantChange), never new Date() or Date.now().\", },\n  { ruleId: \"brandlab-source-synthetic-offer-schema\", surface: \"schema\", checkId: \"structured-data\", summary: \"No invented Offer markup.\", },\n  { ruleId: \"brandlab-source-local-google-reviews-fetch\", surface: \"reviews\", checkId: \"structured-data\", summary: \"Google Places reviews are fetched only by the shared review runtime.\", },\n  { ruleId: \"brandlab-business-facts\", surface: \"business\", checkId: \"business-identity\", summary: \"Exactly one module declares the business facts with defineBrandlabBusiness.\", },\n  { ruleId: \"brandlab-content-implementation-wording\", surface: \"content\", checkId: \"public-output-safety\", summary: \"Everything that renders publicly (pages, components, metadata, schema, alt text, MDX, Markdown and JSON content) carries finished copy, not template, helper, scaffold or placeholder wording.\", },\n  { ruleId: \"brandlab-source-root-missing\", surface: \"source\", checkId: \"source-safety\", summary: \"Project source sits under a recognised root so the source rules can run.\", },\n  { ruleId: \"brandlab-source-platform-reimplementation\", surface: \"source\", checkId: \"source-safety\", summary: \"Protected platform surfaces (SchemaScript, SafeRichText, contact, sitemap, analytics APIs) are imported, not redeclared.\", },\n  { ruleId: \"brandlab-source-retired-api\", surface: \"source\", checkId: \"source-safety\", summary: \"No API, option or configuration key removed in 3.0 (TrackedTelephoneLink, shouldIndexSite, buildRobotsMetadata, buildSeoMetadata and the duplicate metadata builders, isBrandlabProductionDeployment, resolveBrowserAnalyticsConfig, resolveBrandlabGoogleTagConfig, the contact submission controller and its lead-tracking helpers (use useBrandlabContactForm), header profiles and isProduction, xRobotsTag, contentSecurityPolicyMode, leadDiagnostics, ALLOW_INDEXING, NEXT_PUBLIC_SITE_URL, profile, routes.aliases).\", },\n  { ruleId: \"brandlab-ci-workflow-pinned\", surface: \"project-verification\", checkId: \"project-build\", summary: \"Every reused workflow and action is pinned to a 40-character commit SHA.\", },\n  { ruleId: \"brandlab-deployment-vercelignore-lockfile\", surface: \"deployment\", checkId: \"deployment-binding\", summary: \".vercelignore never excludes package.json or package-lock.json.\", },\n] as const satisfies readonly BrandlabStaticRule[];\n\n/** Whether a concrete rule ID (from a finding or evaluation) belongs to a registry entry. */\nexport function matchesBrandlabStaticRule(rule: BrandlabStaticRule, ruleId: string): boolean {\n  if (rule.ruleId === ruleId) return true;\n  if (!rule.ruleId.includes(\"<\")) return false;\n  const stem = rule.ruleId.slice(0, rule.ruleId.indexOf(\"-<\"));\n  const pattern = new RegExp(`^${rule.ruleId.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\").replace(/<[a-z]+>/g, \"[a-z0-9-]+\")}$`);\n  return ruleId === stem || pattern.test(ruleId);\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brandlab-digital/conformance",
-  "version": "3.3.3",
+  "version": "3.4.1",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
@@ -25,6 +25,7 @@
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
+    "@brandlab-digital/site-core": "3.4.1",
     "typescript": "6.0.3"
   },
   "peerDependencies": {